Feeds

So many 'cyberspying hackers' about... and most of you are garbage

You're living off your reputation, sniff infosec boffins

Secure remote control for conventional and virtual desktops

RSA Europe 2013 Cyber-espionage groups are too numerous to count and are often far less skilled than their reputation suggests, according to threat-trackers.

Costin Raiu, director of global research at Kaspersky Lab, estimated that anything between 100 to 200 hacking crews operate in China alone.

Despite the hype abut zero-day attacks, many successful assaults relied on rudimentary attacks that successfully took advantage of poor patching practices and other rudimentary security mistakes, Raiu said during a panel session at the RSA Europe Conference.

"Lots of attacks are successful but not advanced," Raiu said. "They start with the most common stuff before they go up the ladder."

"They don't want to use zero-days, exposing them in the process, unless they need to," he added.

Jaime Blasco, Director, AlienVault Labs, said it was more meaningful to talk abut effective attacks than the commonly used industry term of Advanced Persistent Threats.

Blasco said: "There are different groups with different skills sets and different intentions," adding that the infamous APT1 (Comment Crew) group is "not skilled" even though it is very successful.

Europol's Jaap van Oss, team leader of the international police agency's cybercrime division, added that the widely varying skill set of the criminal world is akin to that occupied by state-sponsored hackers.

Neil Thacker, infosec and strategy officer at Websense, said that the threat of APTs "helped me to get a budget for a project". Thacker's job gives him a role equivalent at a CISO at a firm outside the IT sector.

The quartet made their comments during a packed panel session, entitled Cut Through the Hype to Expose the Truth About Advanced Persistent Threats at the RSA Conference Europe on Tuesday.

Thacker added that although everyone wanted to know the source of APT attacks assigning attribution was difficult. "Everybody wants information on who’s attacking, but attribution isn’t easy," Thacker said.

Raiu spoke of gangs from outside China renting domains through Chinese registrars in order to disguise the true origin of attacks under a false flag. “They are opening stolen documents on virtual machines without any internet connection to avoid exposing themselves that way,” he added.

Hacking back (active defence) against attackers is one possible response to cyber-espionage. This might involve disrupting systems linked to a particular attack, for example. However the panelists were wary about the idea. “In order to have strong security you might need to have a strong offence, but legal tell me [not to] do it," Thacker said.

All the panelists agreed that breaches of one sort of another are inevitable, so the trick becomes detecting a malware attack quickly and isolating compromised systems before more damage can be done. You can’t defeat attacks but "you can profile them and learn about the techniques and tools in play before developing better incident response", according to Blasco.

The vast majority (90-95 per cent) of attacks involve some aspect of social engineering, such as  phishing attacks that trick users into handing over their passwords to a fake site.

Common evidence sniffed out at many scenes of breaches include Win XP boxes with no antivirus installed, weak patching and systems where everyone is operating with admin privileges. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
How to simplify SSL certificate management
Simple steps to take control of SSL certificates across the enterprise, and recommendations centralizing certificate management throughout their lifecycle.