Feeds

So many 'cyberspying hackers' about... and most of you are garbage

You're living off your reputation, sniff infosec boffins

Choosing a cloud hosting partner with confidence

RSA Europe 2013 Cyber-espionage groups are too numerous to count and are often far less skilled than their reputation suggests, according to threat-trackers.

Costin Raiu, director of global research at Kaspersky Lab, estimated that anything between 100 to 200 hacking crews operate in China alone.

Despite the hype abut zero-day attacks, many successful assaults relied on rudimentary attacks that successfully took advantage of poor patching practices and other rudimentary security mistakes, Raiu said during a panel session at the RSA Europe Conference.

"Lots of attacks are successful but not advanced," Raiu said. "They start with the most common stuff before they go up the ladder."

"They don't want to use zero-days, exposing them in the process, unless they need to," he added.

Jaime Blasco, Director, AlienVault Labs, said it was more meaningful to talk abut effective attacks than the commonly used industry term of Advanced Persistent Threats.

Blasco said: "There are different groups with different skills sets and different intentions," adding that the infamous APT1 (Comment Crew) group is "not skilled" even though it is very successful.

Europol's Jaap van Oss, team leader of the international police agency's cybercrime division, added that the widely varying skill set of the criminal world is akin to that occupied by state-sponsored hackers.

Neil Thacker, infosec and strategy officer at Websense, said that the threat of APTs "helped me to get a budget for a project". Thacker's job gives him a role equivalent at a CISO at a firm outside the IT sector.

The quartet made their comments during a packed panel session, entitled Cut Through the Hype to Expose the Truth About Advanced Persistent Threats at the RSA Conference Europe on Tuesday.

Thacker added that although everyone wanted to know the source of APT attacks assigning attribution was difficult. "Everybody wants information on who’s attacking, but attribution isn’t easy," Thacker said.

Raiu spoke of gangs from outside China renting domains through Chinese registrars in order to disguise the true origin of attacks under a false flag. “They are opening stolen documents on virtual machines without any internet connection to avoid exposing themselves that way,” he added.

Hacking back (active defence) against attackers is one possible response to cyber-espionage. This might involve disrupting systems linked to a particular attack, for example. However the panelists were wary about the idea. “In order to have strong security you might need to have a strong offence, but legal tell me [not to] do it," Thacker said.

All the panelists agreed that breaches of one sort of another are inevitable, so the trick becomes detecting a malware attack quickly and isolating compromised systems before more damage can be done. You can’t defeat attacks but "you can profile them and learn about the techniques and tools in play before developing better incident response", according to Blasco.

The vast majority (90-95 per cent) of attacks involve some aspect of social engineering, such as  phishing attacks that trick users into handing over their passwords to a fake site.

Common evidence sniffed out at many scenes of breaches include Win XP boxes with no antivirus installed, weak patching and systems where everyone is operating with admin privileges. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.