Feeds

So many 'cyberspying hackers' about... and most of you are garbage

You're living off your reputation, sniff infosec boffins

3 Big data security analytics techniques

RSA Europe 2013 Cyber-espionage groups are too numerous to count and are often far less skilled than their reputation suggests, according to threat-trackers.

Costin Raiu, director of global research at Kaspersky Lab, estimated that anything between 100 to 200 hacking crews operate in China alone.

Despite the hype abut zero-day attacks, many successful assaults relied on rudimentary attacks that successfully took advantage of poor patching practices and other rudimentary security mistakes, Raiu said during a panel session at the RSA Europe Conference.

"Lots of attacks are successful but not advanced," Raiu said. "They start with the most common stuff before they go up the ladder."

"They don't want to use zero-days, exposing them in the process, unless they need to," he added.

Jaime Blasco, Director, AlienVault Labs, said it was more meaningful to talk abut effective attacks than the commonly used industry term of Advanced Persistent Threats.

Blasco said: "There are different groups with different skills sets and different intentions," adding that the infamous APT1 (Comment Crew) group is "not skilled" even though it is very successful.

Europol's Jaap van Oss, team leader of the international police agency's cybercrime division, added that the widely varying skill set of the criminal world is akin to that occupied by state-sponsored hackers.

Neil Thacker, infosec and strategy officer at Websense, said that the threat of APTs "helped me to get a budget for a project". Thacker's job gives him a role equivalent at a CISO at a firm outside the IT sector.

The quartet made their comments during a packed panel session, entitled Cut Through the Hype to Expose the Truth About Advanced Persistent Threats at the RSA Conference Europe on Tuesday.

Thacker added that although everyone wanted to know the source of APT attacks assigning attribution was difficult. "Everybody wants information on who’s attacking, but attribution isn’t easy," Thacker said.

Raiu spoke of gangs from outside China renting domains through Chinese registrars in order to disguise the true origin of attacks under a false flag. “They are opening stolen documents on virtual machines without any internet connection to avoid exposing themselves that way,” he added.

Hacking back (active defence) against attackers is one possible response to cyber-espionage. This might involve disrupting systems linked to a particular attack, for example. However the panelists were wary about the idea. “In order to have strong security you might need to have a strong offence, but legal tell me [not to] do it," Thacker said.

All the panelists agreed that breaches of one sort of another are inevitable, so the trick becomes detecting a malware attack quickly and isolating compromised systems before more damage can be done. You can’t defeat attacks but "you can profile them and learn about the techniques and tools in play before developing better incident response", according to Blasco.

The vast majority (90-95 per cent) of attacks involve some aspect of social engineering, such as  phishing attacks that trick users into handing over their passwords to a fake site.

Common evidence sniffed out at many scenes of breaches include Win XP boxes with no antivirus installed, weak patching and systems where everyone is operating with admin privileges. ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.