Feeds

State-backed hackers: You think you're so mysterious, but you're really not – report

It's those 'regional traits' that give you away, say infosec sleuths

Reducing security risks from open source software

Nation-state driven cyber attacks often take on a distinct national or regional flavour that can uncloak their origins, according to new research by net security firm FireEye.

Computer viruses, worms, and denial of service attacks often appear from behind a veil of anonymity. But a skilful blending of forensic “reverse-hacking” techniques combined with deep knowledge of others’ cultures and strategic aims can uncover the perpetrators of attacks.

Kenneth Geers, senior global threat analyst at threat protection biz FireEye, explained: “Cyber shots are fired in peacetime for immediate geopolitical ends, as well as to prepare for possible future kinetic attacks. Since attacks are localised and idiosyncratic—understanding the geopolitics of each region can aid in cyber defence.”

Estonia was able to point the finger of blame towards the infamous (and ultimately politically unsuccessful) cyberattacks against its systems in 2007. FireEye argues that understanding the context of cyberattacks can be used to unpick their origins or to better prepare for them.

“A cyber attack, viewed outside of its geopolitical context, allows very little legal manoeuvring room for the defending state,” said Professor Thomas Wingfield of the Marshall Centre, a joint US-German defence studies institute.

“False flag operations and the very nature of the internet make tactical attribution a losing game. However, strategic attribution – fusing all sources of intelligence on a potential threat – allows a much higher level of confidence and more options for the decision maker,” Professor Wingfield continued. “And strategic attribution begins and ends with geopolitical analysis."

Cyber attacks can be a low-cost, high payoff way to defend national sovereignty and to project national power. According to FireEye, the key characteristics for some of the main regions of the world include:

  • Asia-Pacific: home to large, bureaucratic hacker groups, such as the “Comment Crew” who pursues targets in high-frequency, brute-force attacks.
  • Russia/Eastern Europe: More technically advanced cyberattacks that are often highly effective at evading detection.
  • Middle East: Cybercriminals in the region often using creativity, deception, and social engineering to trick users into compromising their own computers.
  • United States: origin of the most complex, targeted, and rigorously engineered cyber attack campaigns to date, such as the Stuxnet worm. Attackers favour a drone-like approach to malware delivery.

FireEye's report goes on to speculate about factors that could change the world’s cyber security landscape in the near to medium term, including a cyber arms treaty that could stem the use of online attacks and about whether privacy concerns from the ongoing Snowden revelations about PRISM might serve to restrain government-sponsored cyber attacks in the US and globally.

The net security firm also looks at new actors on the cyberwar stage – most notably Brazil, Poland, and Taiwan. Finally, it considers the possibility that such attacks mights result in outages of critical national infrastructure systems, a long-feared threat over the last 15 years that has thankfully failed to materialise.

Squirrels have caused frequent power outages by doing things like chewing through high-tension power cables (or even touching them, to fatal effect for the furry little rodents) but El Reg's security desk hasn't come up with even one verified example where hacking has triggered a blackout – except in the imaginations of Hollywood execs, of course.

FireEye's report, titled World War C: Understanding Nation-State Motives Behind Today’s Advanced Cyber Attacks, can be found here (PDF). ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.