Beware the ‘vanity attack’
Attackers are targeting individuals to gain access to corporate networks. Mickey Boodaei explains the process.
These exploits are highly targeted attacks aimed at specific individuals, which so far have been mainly political targets.
However the same approach could be used to target C Level executives, using these attacks to gain high level access to corporate networks.
When reading about such attacks, it's worth keeping in mind that most do not make the news for several reasons, including the fact that many of them have not yet been discovered. It's also worth noting that many enterprises that do discover attacks, fail to understand their implications, and simply disinfect the impacted computer and then move on.
My company (Trusteer) has been researching targeted attacks for three years, and has concluded that these types of attacks represent the future of online fraud and financial industry darkware.
To demonstrate the power of targeted attacks and why we should take them very seriously, I'd like to share with you one example of a simple and very effective targeted attack method.
Let's call this attack example VIGNS - Vanity Infection from Google News Searches. The purpose of the VIGNS attack is to place under-the-radar malware on a computer owned by an executive who has access to sensitive corporate information. Once the malware is on the executive's computer it can transmit information on an ongoing basis to an IP address of the hacker's choice.
The attack process, as with any targeted attack, starts with some form of reconnaissance: the attacker searches the business social networking site LinkedIn for executives at the targeted organization. LinkedIn is the perfect tool for this: One can easily find victims by searching the company name and the role they are after. One then reads the victim's professional profile and decides whether they're a good fit. If they are, then all that needs to be done in order to take it to the next level is the name of the victim.
Next, the attacker needs to build a web page that infects its visitors. It does not matter where this page is placed - criminals, we have observed, have access to a large number of compromised servers and they are likely to place this page on any one of these servers. The page itself exploits a zero day or a recently discovered browser or browser add-on vulnerability. At any given time, it's easy to find vulnerabilities that can be used for this purpose.
Now, the attackers have a webpage that can be used to infect visitors with malware and the name of the victim whose computer they want to compromise.
But how do they get the victim to visit this page? With the help of Google - and their own vanity - of course. Most executives tend to have a Google Alert set up on their name. By placing the victim's name within the malicious webpage, it is possible to get Google to index the page and generate a Google Alert on the executive's name. The executive will receive the alert and will most likely click the link to check on who is mentioning him/her. Clicking the link will take the executive to a malicious webpage which will then infect their computer. Simple.
Now here's where it gets interesting, our researchers have discovered a number of ways that can be used to enable this attack to fly under the radar of IT security software.
The first method is not to post the exploit on the webpage until after Google's indexing systems have visited the page in question. This will minimize the timeframe that the exploit is active and can be detected. The attackers can easily check when Google visits the malicious webpage and turn on the exploit only after the search engine has made its pass.
The second method is to take the webpage off immediately after the malware reports back that it gained access to the executive's computer. The malware can easily know where it has landed by looking at information such as the email account on the computer. This approach also minimizes the time of exposure for the malicious webpage.
The next method is to have the malicious webpage redirect to an old news page that legitimately mentions the executive's name. When the executive accesses the malicious page, their computer gets infected, but since they are on an old news page, they do not suspect any problems.
Another method involves blocking any bots from visiting the malicious website - other than those that you want to let in (such as Google). This prevents bots that are looking for compromised web pages from tagging the page as infected or otherwise malicious.
It's also worth noting that it is possible to apply a number of hacker techniques to ensure that the malware goes undetected. Even if the cybercriminals decide to use a known malware kit such as Zeus or SpyEye, they can easily generate a variant that is undetectable by anti-virus products. After testing the code with anti-malware software, they can limit its distribution to only the specified - and malicious - webpage. This will keep anti-virus solutions from classifying this threat. The cybercriminals can even make the attack harder to detect by programming the malware to remove itself if it reaches the wrong computer - again by looking at simple parameters such as the email account configured on the computer.
For those readers who believe we are teaching criminals how to execute a targeted attack, rest assured that our research suggests that the criminals are much more sophisticated. This is, as I mentioned, a simple targeted attack, and we have seen far more complex and sophisticated attacks in the wild.
So how do you protect against this type of attack? Being cautious is not enough. I consider myself to be fairly sophisticated when it comes to security awareness, yet I would easily fall for this type of attack.
Keeping systems and anti-virus up to date won't help either as the attack uses zero-day unpatched exploits and the malware is completely unknown to anti-virus vendors.
One possible solution is to use tools that specialize in zero-day attack prevention such as our own Trusteer Secure Web Access for the Enterprise. Our R&D teams are continuously incorporating new knowledge into the Secure Web Access product to block zero-day malware.
The differentiation from other desktop security solutions is in our data-centric approach: We look at sensitive data and sensitive applications on the computer and identify unknown pieces of software that attempt to access this information or applications. Our software can then block access, report the attempt or remove the violating software from the computer. Since all of these attacks are ultimately looking for sensitive information, this approach is the most likely to detect and block any malicious software that was not been seen before.
The methodology I have presented above is just one in a series of sophisticated, targeted attacks we expect will be launched against organizations in the near future. We strongly recommend that organizations re-evaluate their approach to targeted attacks since they represent, as we witnessed with various incidents in the press, a dangerous type of threat to their business
•Date: 25th March 2011 • Region: World •Type: Article •Topic: ISM news