Feeds

So many 'cyberspying hackers' about... and most of you are garbage

You're living off your reputation, sniff infosec boffins

Internet Security Threat Report 2014

RSA Europe 2013 Cyber-espionage groups are too numerous to count and are often far less skilled than their reputation suggests, according to threat-trackers.

Costin Raiu, director of global research at Kaspersky Lab, estimated that anything between 100 to 200 hacking crews operate in China alone.

Despite the hype abut zero-day attacks, many successful assaults relied on rudimentary attacks that successfully took advantage of poor patching practices and other rudimentary security mistakes, Raiu said during a panel session at the RSA Europe Conference.

"Lots of attacks are successful but not advanced," Raiu said. "They start with the most common stuff before they go up the ladder."

"They don't want to use zero-days, exposing them in the process, unless they need to," he added.

Jaime Blasco, Director, AlienVault Labs, said it was more meaningful to talk abut effective attacks than the commonly used industry term of Advanced Persistent Threats.

Blasco said: "There are different groups with different skills sets and different intentions," adding that the infamous APT1 (Comment Crew) group is "not skilled" even though it is very successful.

Europol's Jaap van Oss, team leader of the international police agency's cybercrime division, added that the widely varying skill set of the criminal world is akin to that occupied by state-sponsored hackers.

Neil Thacker, infosec and strategy officer at Websense, said that the threat of APTs "helped me to get a budget for a project". Thacker's job gives him a role equivalent at a CISO at a firm outside the IT sector.

The quartet made their comments during a packed panel session, entitled Cut Through the Hype to Expose the Truth About Advanced Persistent Threats at the RSA Conference Europe on Tuesday.

Thacker added that although everyone wanted to know the source of APT attacks assigning attribution was difficult. "Everybody wants information on who’s attacking, but attribution isn’t easy," Thacker said.

Raiu spoke of gangs from outside China renting domains through Chinese registrars in order to disguise the true origin of attacks under a false flag. “They are opening stolen documents on virtual machines without any internet connection to avoid exposing themselves that way,” he added.

Hacking back (active defence) against attackers is one possible response to cyber-espionage. This might involve disrupting systems linked to a particular attack, for example. However the panelists were wary about the idea. “In order to have strong security you might need to have a strong offence, but legal tell me [not to] do it," Thacker said.

All the panelists agreed that breaches of one sort of another are inevitable, so the trick becomes detecting a malware attack quickly and isolating compromised systems before more damage can be done. You can’t defeat attacks but "you can profile them and learn about the techniques and tools in play before developing better incident response", according to Blasco.

The vast majority (90-95 per cent) of attacks involve some aspect of social engineering, such as  phishing attacks that trick users into handing over their passwords to a fake site.

Common evidence sniffed out at many scenes of breaches include Win XP boxes with no antivirus installed, weak patching and systems where everyone is operating with admin privileges. ®

Internet Security Threat Report 2014

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.