Cyberattacks. Part 2: Advanced Techniques and Manipulations

Ruslan Rakhmetov, Security Vision

We have already talked about the main tools and techniques of cyberattacks, and in the current article we want to pay more attention to the human factor and unusual approaches of attackers.

One of the ‘links’ of companies that can be weak is the human being. A company employee or a counterparty with access to necessary data can become a target for attackers, so we will tell you about several types of attacks with a human target.

Phishing

Attacks aimed at tricking users into obtaining confidential information (e.g. passwords or bank card data) by forging trusted sources. The goal is to obtain sensitive information. The method of distribution is communication with the user via email and phishing links.

To protect against phishing, special attention is paid to monitoring emails with anti-spam filters, blocking known dangerous domains and IP addresses, and training employees to recognise suspicious emails and websites.

Social engineering

The use of manipulation and deception to persuade people to provide sensitive information or perform actions that can lead to the theft of data and money. The methods of distribution may vary, but all are based on deception and manipulation. Separately, attacks by insiders and various cyber espionage threats can be distinguished .

To combat such attacks, regular training is conducted, and additionally, each person can develop useful habits when using the Internet.

Attacks on biometric data

Attempts to circumvent or manipulate systems that use biometric authentication. Biometrics is a new way of confirming identity in IT systems, which is already used, for example, in the Moscow metro and some banks. We have singled out attacks on biometric data as a separate category because they are different from other attacks on personal data and require careful protection due to their novelty.

Encryption, activity monitoring and analysis systems, as well as familiar authentication security methods, can be involved in protecting biometric template stores.

Brute Force

A type of attack in which attackers try to guess passwords by trying all possible combinations - without the need for phishing, spoofing, or complex psychological tricks.

To combat such attacks, it is necessary to introduce policies for ‘strong’ passwords and their regular updating. A strong password is one that does not contain words and dates that are important to the user, and also includes letters of both cases (upper and lower case), numbers and special characters. You can create such a password by yourself or by using a special random sequence generator, for example, in free passwordcraft.ru or randomus.ruservices .

In addition, in case of a series of unsuccessful login attempts, IS employees can block an account that is potentially under attack. It is possible to contact the user, making sure that authentication errors were made legitimately, and to automate solutions of SIEM and/or SOARclasses .

Companies are also implementing two-factor authentication methods for user experience on systems that are critical and contain sensitive information. We have already told youabout such 2FA/MFA tools earlier.

Supplier Compromise (Supply Chain Attacks)

This is a group of attacks that target software or hardware vendors to inject malicious components into their products. Companies that use third-party development or contractors to create software can be vulnerable to these attacks. The attack itself focuses on the latter and can be a combination of any of the techniques described in the current and past reviews.

To protect yourself, you can audit vendors, conduct vulnerability checks (static and dynamic analysis) and use only tested and certified solutions, for example, according to the results of FSTEC inspection.

Having failed in their attempts to obtain useful information from the user or having encountered echelons of defences, attackers can continue to try not only using classical methods, but also resorting to other tactics, some of which will be discussed below.

DNS Spoofing.

This attack involves manipulating data in the domain name system to redirect to fake websites.

To protect yourself, you can protect addresses from spoofing by using DNS Security Extensions (DNSSEC) and using firewallswithin and at the perimeter of your company to filter DNS traffic.

Pharming

An attack designed to redirect users from legitimate websites to malicious websites. To carry out this attack, attackers manipulate the domain name system (see above) and otherwise redirect traffic to resources under their control.

To protect themselves, companies can build into their IS processes the monitoring of network requests and DNS records for changes, as well as server software updates. Regular training of employees to recognise fake websites and malicious redirects will also help. Users can verify their own use of secure protocols (HTTPS) instead of less secure protocols (HTTP), and in-browser (e.g. Yandex Browser and Google Chrome) capabilitiescan be used to check security certificates.

Wireless Network Attacks (Wireless Network Attacks)

These are denial of service (DDoS) attacks or network-level traffic interception.

To protect against such an attack, you can enforce strong passwords and conduct regular audits to identify vulnerabilities. We've already talked about how networks are built and how they can be protected.

Side-Channel Attacks.

Using physical computer/server information, such as frequency (network type) and amplitude (strength) of electromagnetic waves, to extract sensitive data or determine location in rooms.

For protection, server rooms are ‘covered’ with layers of walls or special protective enclosures, physical access restrictions and surveillance systems are applied. Data encryption, such as BitLockerfull disc encryption and TPM modules ( for Windows systems) or dm-crypt kernel module ( Linux)can also be applied programmatically.

Quantum Attacks.

Combine all sorts of threats to cryptographic systems based on quantum computing. Quantum computers and their incorporation into conventional technologies can be used to create strong defences such as cryptography (encryption).

No known cases of attacks of this type have been recorded to date, but analysts predict the development of technology and the formation of new techniques and tactics of attackers and, accordingly, ways to combat them.

Man-in-the-Middle attack (MITM)

Attacks in which an attacker is inserted between two points in communication and is able to not only read but also intercept and modify data. The attacker in such an attack operates in a manner similar to VPNs and DLP.

The use of virtual private networks (VPN) can also be used for data protection, when accessing sensitive information on the file balloon, CRM-system or other services of companies. Such a tunnel will not allow an intruder to infiltrate the process of transmission and see the traffic, will provide communication between the user and the service directly, without external ‘viewers’.

Data leakage protection systems (DLP), which we have already discussed in relation to the technical and analytical aspects, use the ‘man in the middle’ principle in their work and infiltrate the traffic, reading it and blocking the transmission of confidential information, if this is configured in the response policies.

In terms of defence against man-in-the-middle attacks ,companies can implement data encryption that protects content from access by those who do not possess a password or other decryption key. It is also possible to physically restrict access to servers and the data on them.

The number of types of cyberattacks is difficult to quantify accurately, as new technologies are constantly emerging and the methods of the attackers themselves are evolving. Defending against cyberattacks requires a holistic approach, so we hope our overview will help you protect your data and define your own security and IT development vectors.