Security management - The industrialization of hacking
As we enter the new decade battle lines are being firmly drawn. Amichai Shulman, Imperva's Chief Technology Officer, advises application owners to get their act together and tackle five key trends head on
1. The Industrialisation of Hacking
There is a clear definition of roles within the hacking community developing, forming a supply chain:
- Botnet growers / cultivators whose sole concern is maintaining and increasing botnet communities
- Attackers who purchase botnets for attacks aimed at extracting sensitive information (or other more specialised tasks)
- Cyber criminals who acquire sensitive information for the sole purpose of committing fraudulent transactions
As with any industrialisation process, automation is the key factor for success. Proactive search for potential victims relies today on search engine bots rather than random scanning of the network. Massive attack campaigns rely on zombies sending a predefined set of attack vectors to a list of designated victims. Attack coordination is done through servers that host a list of commands and targets. SQL Injection attacks, "Remote File Include" and other application level attacks, once considered the cutting edge techniques manually applied by savvy hackers are now bundled into software tools available for download and use by the new breed of industrial hackers. Search engines are becoming a vital piece in every attack campaign starting from the search for potential victims, the promotion of infected pages and even as a vehicle for launching the attack vectors.
Imperva tracked and analysed a compromise that affected hundreds of servers injecting malicious code into web pages, these were cross referenced with keywords that scored highly in Google search engine generating traffic and thus creating drive by attacks.
Organisations must realize that this growing trend leaves no web application out of reach for hackers. Attack campaigns are constantly launched not only against high profile applications but rather against any available target. An application may be attacked for the value of the information it stores or for the purpose of turning it into yet another attack platform. Protecting web applications using application level security solutions will become a must for larger and smaller organisations alike.
2: A Move from Application to Data Security
The effectiveness of network layer attacks has decreased dramatically in this past decade largely due better network layer defences. This gave raise to application level attacks such as SQL Injection, Cross Site Scripting and Cross Site Request Forgery. As these are being gradually addressed by the use of web application firewalls, attackers will turn their attention to more sophisticated attacks either from the outside (business logic attacks) or from the inside (direct attacks against the database). Together with the fast growth in the number of applications that access enterprise data pools these will drive the evolution of data-centric security.
While organisations invest in protecting their major applications using application level tools, many of the smaller applications are still unprotected. Additionally, we see no apparent decrease on the part of internal threats.
It becomes apparent to organisations that controls must be put not only around applications accessing the data but also around the data itself. This holds true to data in its structured format within relational databases as well as unstructured data stored in files on organisational file servers.
To protect these vital assets, Organisations must have a complete change of mindset focusing on protecting data at its source, regardless of the application accessing it, if necessary utilising a combination of technologies such as a data based firewall, data and file activity monitoring and the next generation of DLP products.
3: Mainstream Social Networks and Associated Applications
Large populations not previously exposed to online attackers can now be targeted by massive campaigns. Elderly people as well as younger children, people who did not grow up with an inherent distrust of web content, may find it very difficult to distinguish between messages of true social nature and widespread attack campaigns.
Imperva's team was able to demonstrate that specific ads carrying attack vectors could be presented to named individuals at an attacker's will. This in turn allows attackers to easily get their foothold inside specific organisations by targeting individuals within those organisations. Much like searching through the Google search engine for potentials target applications, attackers will scan social networks (using automated tools) for susceptible individuals, further increasing the effectiveness of their attack campaigns.
As social platforms grow at an exponential rate I find this problem to be one of the most challenging for us in the next decade. An entire set of tools that would allow us to evaluate and express personal trust in this virtual society are yet to be developed and put to use by platform owners and consumers. In the meantime, end users should rely on frequently updated anti-malware solutions as well as automatic security updates for their workstations. Organisations, who by now gave up on restricting the usage of social platforms from their enterprise networks, should emphasise the use of centrally managed anti-malware protection and secure surfing gateways.
4. Password grabbing/password stealing attacks
As stolen personal information is increasingly available, the price it commands on the black market is falling, thereby forcing attackers to seek more profitable data. To this extent, the last few months have seen hackers target application credentials. Application credentials hold more value for certain types of attackers as they can be further used in automated schemes. And an attack that makes use of valid credentials for an online banking system can be fully automated. Of particular interest to attackers are credentials for webmail applications as these may further allow compromise of other credential sets through the password recovery feature of applications. This feature usually sends the credentials of an online application to an email account designated by the owner upon registration. Worthy of mention is also the assumption that it is not uncommon for people to have the same username and password used for their Facebook account as well as their Twitter account and their Airline Frequent Flyer account.
Attackers use many different techniques for obtaining application credentials these include Phishing campaigns, Trojans and KeyLoggers on the consumer side and SQL injection, directory traversal and sniffers on the application end. Earlier this year the media became aware of a partial list of Hotmail user credentials traded on the net. The list was probably obtained through KeyLoggers.
5: Transition from Reactive To Proactive Security
To date the security concept has been largely reactive - waiting for a vulnerability to be disclosed; creating a signature (or other security rule) then cross referencing requests against these attack methods, regardless of their context in time or source. A lot of resources are invested in distinguishing "bad" requests from "good" requests based on request content alone - a chore that is becoming more and more difficult due to advanced evasion techniques and sophisticated attack schemes.
Rather than waiting to be attacked, security teams must start to proactively look for attacker activity as it is being initialised over the network, identifying dangerous sources or malicious activity before it gets to attack a protected server and even establishing a defence against attacks before they become publicly disclosed.
We are seeing different projects world-wide approaching this problem from different angles. Projects like DShield (www.dshield.org ), ShadowServer (www.shadowserver.org ), commercial companies like Cyveillance and others, all try to create their networks of cyber-intelligence sensors. They gather information that can be used to create a real-time threat map from which actionable security policies can be created automatically in real time. Our own research activities into this domain show a lot of interesting data. We can daily detect a list of applications that are soon to be targeted by attackers. New attack vectors show-up in early stages, before they are massively used through botnets and recently active source of attacks are being revealed.
The online security community is in the early stages of digesting this information into actionable items. The future will reveal more offerings around IP reputation, early warning systems and other proactive tools. It will be at the hands of application owners and web application solution vendors to integrate with those tools to provide a proactive security suite for applications.
Share this article with others
Post to del.icio.us
Printed from http://www.eurocomms.com/features/113525/Security_management_-_The_industrialization_of_hacking.html
Comment on this article
Skip to comments
We encourage users to analyse, comment on and even challenge European Communications's articles, including the one above - 'Security management - The industrialization of hacking'
User reviews and comments that include profanity or personal attacks or other inappropriate comments or material will be removed from the site.
Additionally, entries that are unsigned or contain "signatures" by someone other than the actual author will be removed. We will take steps to block users who violate any of our posting standards, terms of use or privacy policies or any other policies governing this site.