Connect with us

Featured

Spy vs Spy in hacker wars

Kaspersky Labs has revealed that hackers are now hacking other attack groups, using their tools and stealing victim data, making more difficult to gather accurate threat intelligence.

Sophisticated threat actors are actively hacking other attack groups in order to steal victim data, borrow tools and techniques and re-use each other’s infrastructure – making accurate threat intelligence ever harder for security researchers, according to Kaspersky Lab’s Global Research and Analysis Team (GReAT).

Accurate threat intelligence relies on identifying the patterns and tools that signpost a particular threat actor. Such knowledge allows researchers to better map different attackers’ goals, targets and behaviours, and to help organisations determine their level of risk. When threat actors start hacking each other and taking over tools, infrastructure and even victims, this model quickly starts to break down.

Kaspersky Lab believes that such attacks are likely to be implemented mainly by nation-state backed groups, targeting foreign or less competent actors. It is important that IT security researchers learn how to spot and interpret the signs of these attacks, so that they can present their intelligence in context.

In a detailed review of the opportunities for such attacks, GReAT researchers identified two main approaches: passive and active. Passive attacks involve intercepting other groups’ data in transit, for example as it moves between victims and command and control servers – and are almost impossible to detect. The active approach involves infiltrating another threat actor’s malicious infrastructure.

There is a greater risk of detection in the active approach, but it also offers more benefits as it allows the attacker to extract information on a regular basis, monitor its target and their victims, and potentially even insert its own implants or mount attacks in the name of its victim. The success of active attacks relies heavily on the target making mistakes in operational security.

GReAT has encountered a number of strange and unexpected artefacts while investigating specific threat actors that suggest such active attacks are already happening in-the-wild.

Examples include:

  1. Backdoors installed in another entity’s command-and-control (C&C) infrastructure

Installing a backdoor in a hacked network allows attackers to establish persistence inside the operations of another group. Kaspersky Lab researchers have found what appear to be two in-the-wild examples of such backdoors.

One of these was found in 2013, while analysing a server used by NetTraveler, a Chinese-language campaign targeting activists and organisations in Asia. The second one was found in 2014, while investigating a hacked website used by Crouching Yeti (also known as Energetic Bear), a Russian-language threat actor targeting the industrial sector since 2010. The researchers noticed that, for a brief period of time, the panel managing the C&C network was modified with a tag that pointed to a remote IP in China (likely a false flag). The researchers believe this was also a backdoor belonging to another group, although there are no indicators as to who this might be.

  1. Sharing hacked websites

In 2016, Kaspersky Lab researchers found that a website compromised by the Korean-language DarkHotel also hosted exploit scripts for another targeted attacker, which the team called ScarCruft, a group targeting mainly Russian-, Chinese- and South Korean- organisations. The DarkHotel operation dates from April 2016, while the ScarCruft attacks were implemented a month later, suggesting that ScarCruft may have observed the DarkHotel attacks before launching its own.

  1. Targeting-by-proxy

Infiltrating a group with an established stake in a certain region or industry sector enables an attacker to reduce costs and improve targeting, benefiting from the specialist expertise of its victim.

Some threat actors share rather than steal victims. This is a risky approach if one of the groups is less advanced and gets caught, as the inevitable forensic analysis that follows will also reveal the other intruders. In November 2014, Kaspersky Lab reported that a server belonging to a research institution in the Middle East, known as the Magnet of Threats, simultaneously hosted implants for the highly sophisticated threat actors Regin and Equation Group (English-language), Turla and ItaDuke (Russian-language), as well as Animal Farm (French-language) and Careto (Spanish). In fact, this server was the starting point for the discovery of the Equation Group.

“Attribution is hard at the best of times as clues are rare and easily manipulated, and now we also have to factor in the impact of threat actors hacking each other. As more groups leverage each other’s toolkits, victims and infrastructure, insert their own implants or adopt the identity of their victim to mount further attacks, where will that leave threat hunters trying to build a clear, accurate picture? Our examples hint that some of this is already happening in-the-wild and threat intelligence researchers will need to pause and adapt their thinking when it comes to analysing the work of advanced threat actors,” said Juan Andres Guerrero-Saade, Principal Security Researcher, Global Research and Analysis Team, Kaspersky Lab.

In order to keep pace with the rapidly evolving threat landscape, Kaspersky Lab advises enterprises to implement a full-scale security platform combined with cutting-edge threat intelligence. Kaspersky Lab’s enterprise security portfolio provides businesses with threat prevention through its next-generation endpoint security suite, detection based on the Kaspersky Anti Targeted Attack platform, and prediction and incident response through its threat intelligence services.

Further details on ways in which threat actors acquire and reuse elements of other groups, including tool repurposing and malware clustering, and their ramifications for threat intelligence can be found in the paper, Walking in your enemy’s shadow: when fourth-party collection becomes attribution hell.

Featured

Cisco gives pre-owned tech a Refresh

In a market of constant upgrades, Cisco Refresh aims to keep quality product away from landfills, writes BRYAN TURNER.

When one gets a new smartphone upgrade, the old device may be used as a backup or can be used by someone else. In business environments, equipment upgrades may not be conducive to keeping old equipment around, which may send older, working equipment to landfills.

This is where Cisco’s Refresh initiative comes in. At Cisco Connect in Sun City this week, Ehrika Gladden, VP and general manager of Cisco Refresh, lifted the lid on a little-known aspect of the company’s strategy. 

“Refresh is Cisco’s global pre-owned equipment business unit,” said Gladden. “It is certified to meet the quality and engineering standards of Cisco. It is licensed for software and it’s also inclusive of a services warranty.

“Our responsibility in 80 countries around the world is tied to both the recovery of assets and the ability to leverage those assets at a lower price point. This ensures our sustainability and proper usage of the Earth’s resources while providing access to small and medium businesses. The products are typically in the range of 20-40% cheaper. The products represent the entire portfolio for Cisco in some part, the majority of that product set is 2+ years in terms of generation.”

Cisco’s Circular Economy initiative ensures a sustainable loop through businesses willing to pay a premium for the latest, cutting-edge solutions, while Cisco markets older, working equipment for resale to those who don’t require the latest solutions. This ensures far less new components need to be used in a product range.

“We are leveraging the model of remanufacturing, refurbishing, recycling, and reusing,” said Gladden. “Depending on the product set, there is a certain set of product yield that we expect. They vary from product to product, but we do have a percentage that doesn’t make it through.

“Those are always reused, meaning we will look at those products and decide to use them completely differently, leveraging the components, remanufacturing back into the overall build process. If that can’t be done, we will go into a recycle process where we melt those products down to reuse them.”

Repairing and refurbishing older products isn’t just that. Cisco is creating repair centres that are owned by third-parties to uplift local ownership.

“The repair centres, as a global manufacturer, is Cisco’s entree into local ownership,” said Gladden. “I want to be precise about what I mean by local ownership. It’s critical for us to have a localised presence, but doing that through ownership. When you look at inclusive economies, those that are participative, to be sustainable – not in the product set, but generationally.

“The ability as a global manufacturer through a local ownership model  isto create a repair centre where a product can be returned, screened, tested, and repaired, leveraging the talent that the Networking Academy is creating.”

Cisco is working closely with local governments to understand where it operates and how to leverage the skills in the market.

Gladden said: “We are also super excited about the National Development Plan and African Union statements which with we align: eradication of poverty, job creation, ownership, healthcare, education, it all fits in the model. So we were very excited to have the opportunity to come to Africa first to announce this. Over the next twelve months, we want to establish our first repair centres, and in the next 3 to 5 years, build that vision into a reality.”

Continue Reading

Featured

Why Data Privacy has become a Pipe Dream

If you’re active on WhatsApp, Facebook or any other social platform, you’re not as safe as you thought, writes
AARON THORNTON, MD of Dial a Nerd

As you begin to read this, let’s perform a quick experiment! How many active conversations are you engaged in – right now – on WhatsApp? When was the last time you shared a picture or video on Instagram? Is Facebook currently open and active on one of your devices? And how many internet- connected devices are you using at this moment? Chances are, you have multiple devices running multiple applications most of the time. So what’s the problem, you ask? Since when did checking in with a high school buddy in Australia via Facebook become a dangerous act?  

In reply, we say, read on if you can stomach it!  

Nation-State Hacking & You  

It might seem like a laughably long shot to say that you are a key player in the increasingly sinister and sophisticated world of nation-state hacking. Well, you are. Given that individuals, businesses and governments are now constantly connected, round the clock, consumers and businesses have become fair game in cyber espionage. And as we create and share more and more data, both the value and accessibility of that data increases. According to a report by McAfee, IP theft now accounts for more than 25% of the estimated $600 billion cost of cybercrime to the world economy.    

With data having become the ‘new gold’, nation states are naturally pouring investment and key resources into building advanced cyber warfare tools. Indeed, entire divisions of armed forces as well as the upper echelons of corporate leadership are devising ways to harness data to gain economic, political and social power. At the highest level, tools and platforms are being developed with the specific aim of perpetrating cyber espionage and data theft. No surprise then, that the consumer and business environments are rife with increasingly advanced malware, ransomware and many other malicious hacking tools and methods.  

Still not convinced? Yes, we can smell the scepticism from here! So let’s take a moment to see how this has already played out, beneath our noses.  

Remember the Facebook–Cambridge Analytica data scandal of early 2018? For many, this was a watershed moment in the emerging war for consumer data – and the ensuing tensions between privacy, power and profit. Need a refresh? Well, in 2018, Facebook exposed data on up to 87 million Facebook users to a researcher who worked at Cambridge Analytica, which worked for the Trump campaign. In essence, the data was harvested without user consent and used for political purposes.  

Another chilling but less direct example can be found in Russia’s meddling in the 2016 U.S. elections. According to Politico, Russia launched a massive social media campaign to ‘sow discord’ leading up to the elections. The website reported that as early as 2014, an infamous Russian “troll farm” known as the Internet Research Agency – a company linked to Russian president Putin – developed a strategy using fraudulent bank accounts and other fake identity documents to “spread distrust towards the candidates and the political system in general.” 

When referring to the Russian hacks and their impact on election results, one U.S. Representative sagely noted: “They didn’t just steal data; they weaponized it.” 

Ignorance is not bliss 

Okay, so data is being ‘weaponized’, and ordinary people and businesses are being caught in the crosshairs of cyber warfare. A little bit frightening, but the good news is that savvy individuals like you can take steps to protect personal data and actively combat the creeping influence of juggernauts such as Facebook and Google.  

To begin with, awareness is key. As you engage with various platforms and applications at work and at home, take time to understand how your data is being used and what the terms of use are. Is your data being accessed and sold to advertisers? Have you consented to this? In addition to scrutinizing your consent, also pay close attention to how much data you share online – and the nature of the details you are divulging. Always keep in mind that hackers are employing smart social engineering tactics and using the details of your private life (birthdays, holidays, pet’s names, etc) to trick you into opening infected emails and clicking on malware. Whenever you are online, you are a target – and vigilance at all times is critical. Beyond that, it goes without saying that you must commit to following basic security protocols with your devices. So always keep software up to date and keep your data backed up so that you can reboot or wipe a device if needed.   

Now that we’ve left you sufficiently spooked, you can get back to those demanding WhatsApp/Facebook/Instagram notifications (same company, by the way)…albeit, we hope, with a slightly altered [cyber] worldview!  

Continue Reading

Trending

Copyright © 2019 World Wide Worx