Feeds

Most resistance to 'Aurora' hack attacks futile, says report

As many as 100 companies pwned!

Choosing a cloud hosting partner with confidence

Most businesses are defenseless against the types of attacks that recently hit Google and at least 33 other companies, according to a report to be published Monday that estimates the actual number of targeted companies could top 100.

The attackers behind the cyber assault dubbed Aurora patiently stalked their hand-chosen victims over a matter of months in a campaign to identify specific end users and applications that could be targeted to gain entry to corporate networks, the report, prepared by security firm iSec Partners, concluded. Emails or instant messages that appeared to come from friends and trusted colleagues were combined with potent zero-day vulnerabilities targeting common applications. In many cases, exploits were tweaked to circumvent specific versions of anti-virus programs.

The findings are significant because they suggest that many of the best practices corporate IT departments have been following for years are ineffective against the attacks, which Google said were successful at piercing its defenses and accessing its trade secrets. iSec founding partner Alex Stamos said that with the exception of Google and a handful of other organizations with budgets to support expensive information security teams, companies are unprepared to defend themselves against this new caliber of attacks.

"Attackers are willing to spend months attacking people in these companies, and they write custom malware specific to those companies," he told The Register. "The malware for each of these companies has been customized based on the versions of vulnerable software they're running, as well as what kind of anti-virus they're using. The problem is to defend against that level of attacker - the game is completely different than what most companies are doing."

In the days immediately following Google's January admission, investigators said as many as 33 other companies were hit by the same attacks. But according to Stamos, that estimate was based on the analysis of just one command and control channel under the control of the attackers. After sifting through the contents of another 60 or so additional channels, Stamos said the number of compromised companies could be as high as 100, many with woefully unprepared IT departments.

The attackers showed painstaking perseverance in gathering information about vulnerable end users, often casing social networks to learn the identities of friends and business associates so instant messages and emails with poisoned links will appear more innocuous. They also employed an encyclopedic knowledge of corporate networking weaknesses that allowed them to convert a compromise of a single computer into a vector that would surrender unfettered access to a company's most valuable crown jewels.

"These guys really understand how to take control of one laptop and turn it into domain admin access," Stamos explained. "People are not well prepared for this kind of stuff."

For companies to reverse the tide, they will have to make fundamental changes to the way they think about and manage security inside their network perimeters. Chief among the changes is disabling all services that despite repeated warnings often remain on, such as LAN Manager Hash. Other recommendations include logging and inspecting all queries made to internal domain name system servers and building safeguards into the network that prevent key resources from being accessed even when a client on the system has been commandeered.

Windows machines, the authors also recommend, should only be run in unprivileged mode for the vast majority of users. A PDF of the report is here. ®

Internet Security Threat Report 2014

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.