Security Vision
In the last article we talked about trends and evolution among malware and ransomware. This time we would like to look at the remaining range of the most common and interesting threats of recent years. Let's start with my favourite social engineering, which will always be relevant as long as human weaknesses exist (I know pentesters who like to find weaknesses in the human psyche as a hobby, even just in real life).
Social engineering and phishing
First, let's understand the differences between common initial access techniques such as social engineering and phishing. Phishing attacks are conducted in large volumes and target a wide audience, while social engineering implements specific campaigns targeting specific employees. Social engineering covers a wide range of actions aimed at exploiting human error or incorrect human behaviour in order to gain access to information or services (to which a persona has access). In other words, social engineering is more narrowly focused and specific: it uses various forms of manipulation to get victims to make mistakes or pass on confidential or sensitive information. In cybersecurity, social engineering induces users to open documents, files or emails, visit websites, or give unauthorised parties access to systems or services. And while these tricks may misuse technology, they always rely on the human element to succeed. As an example of the approach: using social engineering, attackers exploit the access of employees within an organisation to gain a technical foothold in the network from which they can launch further attacks. Phishing is more grassroots in nature and spreads widely: just in case someone takes the bait.
Phishing attacks are currently responsible for 90% of data breaches. IBM reports that phishing kit deployments tend to be short-lived, with nearly a third of deployed kits being used for no more than a day. According to Microsoft, modern phishing kits are sophisticated enough to masquerade as legitimate content with proper spelling, grammar and realistic images. A number of analyses describe interesting cases: it turns out that attackers using these kits can also be fooled. Some of the phishing kits contain ‘additional’ features that send the received credentials not only to the phishers, but also to the kit author or another intermediary. From the victim's perspective, this can seriously exacerbate the impact of the incident, as the stolen credentials now end up in the hands of several different gangs. Phishing kits also account for regional differences (with geo-blocking), filter out unwanted agents, add obfuscation options, and are sold as part of a software-as-a-service package: Phishing as a Service (PhaaS).
Another fresh phishing trend is QR codes. Criminals use QR codes to redirect victims to malicious sites that steal login and financial information. It's likely that the trend of using QR codes for phishing will continue unabated, especially given the widespread adaptation of QR codes in everyday life.
And let's look at a relatively new thing among phishers - the use of APT social engineering. It is quite common to see reports saying that Iranian cyber groups such as APT34427 (OilRig or TA452), APT35428 (Charming Kitten or TA453) or TA456429 (Imperial Kitten or Tortoiseshell) use long-running social engineering campaigns for cyber espionage and information operations. In one of these, the group posed as British academics from the School of Oriental and African Studies (SOAS) at the University of London. They targeted senior think tank staff, Middle East journalists, and professors with targeted fake invitations to conferences. These invitations eventually led to the theft of credentials on profiled websites.
While the Iranian attackers use the professional involvement of their chosen targets to create a story, other campaigns, such as those run by Curium432 (TA456433), focus on romantic encounters. Their script usually consists of masquerading as an attractive woman on social media, networking through online platforms (to build a bond of trust), sharing malicious documents, and then convincing the victim to open the document. Well, as often happens in phishing cases, this leads to the deployment of a VPO performing the theft of sensitive information.
Given the success of previous campaigns, it is highly likely that we will continue to see similar examples of social engineering and the proliferation of prolonged personal hacking of human nature vulnerabilities.
The attack vectors that are most commonly used after gaining initial access as a result of a successful social engineering/phishing campaign are:
1. Distribution of VPOs: cryptographers, RATs
2. Using the power of compromised nodes for cryptocurrency mining.
3. Selling gained access to the compromised network
4. Data leakage, cyber espionage
5. Organising botnets from compromised network nodes
Phishing/social engineering is especially dangerous when used in conjunction with 0-day vulnerabilities in client software (Microsoft Word, Outlook) that lead to remote code execution or sensitive data leakage. An example of this is the recently discovered CVE-2023-35636 in Outlook, which, when a malicious link is clicked, leads to a NetNTLMv2 attacker capturing the password hash of a user account, which can then be compromised or an ntlm relay attack can be performed to gain access to an arbitrary resource with the rights of the compromised account.
What you can do to avoid social engineering and phishing attacks
- Antivirus defences
- Two-factor authentication, strong passwords, change passwords frequently.
- Don't click on links from unknown sources
- Install high-level spam filters
- Never share personal information on unsecured sites
- Don't open emails that look like spam
- Raise employee awareness
- Don't give a user local administrator privileges
- Use zone separation for hosts and accounts when building your network infrastructure (in line with Microsoft Red Forrest recommendations).
- Use Application Whitelisting solutions to prevent untrusted code from running.
Distributed Denial of Service (DDoS attacks)
Another common security threat is distributed denial of service (DDoS), which targets system and data availability. And while it's not a new threat (it's now 24 years old), it plays a significant role in the cybersecurity threat landscape. An attack is considered realised when users of a system or service are unable to access requested data, services or other resources. DDoS attacks can disable even the largest websites by overloading the server with the maximum number of unwanted requests. Interestingly, distributed denial of service attacks are often used as bait to distract the owners of the target website while the hacker tries to mount a second, more exploitative attack. According to analyst agencies such as ENISA and Sonicwall, the threat of DDoS attacks continues to grow and has increased by more than 60 per cent in the last year.
While defence mechanisms and strategies are becoming more robust, attackers are also improving their technical skills, better adapting to new regulations. In this context, denial of service with ransomware (RDoS) combines the dangers of traditional DDoS while significantly reducing the resource requirements to launch an attack. Cybercriminal groups (e.g. Fancy Bear, Cozy Bear, Lazarus Group and Armada Collective running these campaigns) analyse targeted enterprises to find companies with weak and vulnerable systems. They then threaten these businesses by sending an extortion email and demanding a ransom for not attacking the system. The simplicity of RDoS attacks is at the heart of their execution. Cybercrime-as-a-Service (CaaS) tools are making it increasingly easy to launch an RDoS attack, although it remains difficult to identify its source. In comparison, spreading malware or ransomware requires much more effort in terms of time and planning.
Attacks are getting bigger and, most importantly, more complex: whereas in the past denial of service was mainly executed at the data link layer, now DDoS at the application layer is becoming more and more common. DDoS attacks such as https flood, which can reach enormous power, have become very popular. In 2023, this was facilitated by the discovered HTTP/2 Rapid Reset vulnerability (CVE-2023-44487), through which attackers were able to achieve a ddos attack capacity of more than 200mn requests/second. This illustrates the increased complexity of not only the attacks, but also the requirements for defence systems, as it is more difficult to defend against application layer attacks, as they often look like genuine application traffic.
Several ways to prevent DDoS attacks
- Choose a DDoS attack prevention service
- Create a secure network infrastructure
- Monitor your website traffic
- Use web application firewalls (WAFs)
IoT (Internet of Things) attacks
How do you get around IoT when talking about threat trends? The number of IoT WPOs has made a staggering jump to nearly double, according to data from analytics agency ENISA. In the first half of FY22 alone, the volume of attacks has already surpassed the level recorded in the previous 4 years.
The Internet of Things (IoT) is a network of interconnected physical devices or objects (‘things’). An attack targets devices connected to the Internet. For example, network switches or smart home appliances such as televisions, speakers, surveillance cameras, and medical devices are subject to attacks.
As an example of an illustrative attack on the IoT, consider the experiment of 19-year-old researcher David Colombo, who reported in January 2022 that he could use a bug in a TeslaMate dashboard to control more than 25 cars in 13 different countries. Colombo was able to remotely access various Tesla functions such as unlocking doors, opening windows, starting keyless entry, controlling the stereo, beeping the horn, and checking the car's location and driver presence. At the same time, Colombo stated that he was not able to intercept the remote movement of the car.
While we're on the subject of trends, among the VPOs threatening our home routers, Mirai (a worm and botnet formed by compromised devices) was responsible for the majority of the attacks, which totalled over 7 million. Below you can see a graph of the increase in mentions of the Mirai VPO in compromise indicators and analyst reports in the threat intelligence platform over the previous year.
First discovered in 2016, Mirai has taken over an unprecedented number of devices and wreaked havoc on the internet. The botnet itself was made possible by exploiting a vulnerability that involves using the same, unchanging, vendor-set password to access the administrator account on smart devices.
While most devices are not powerful, they can work together cohesively - allowing them to achieve more than a powerful zombie computer could alone. Mirai has taken over nearly 500,000 devices in its entire existence. Using this group botnet of IoT devices, Mirai has damaged services like Xbox Live and Spotify and websites like the BBC and Github to name a few.
In 2016, the Mirai zombie attacked an entire African country on political orders - it was Liberia. It was discovered that the internet there, although provided by two ‘independent’ ISPs, was connected via a single cable. So hackers attacked the equipment that services that particular cable and took an entire nation out of cyberspace.
Here are some ways to prevent Internet of Things attacks
- Change factory passwords
- Update firmware and stay up-to-date on the latest developments
- Use multi-factor authentication (MFA)
- Encrypt your devices properly
- Connect your IoT devices using secure Wi-Fi
And finally, let's mention threats from artificial intelligence, since AI is so popular in the moment. We have analysed AI threats in a separate article (you can read it here). I will remind here the main ones:
- Information compromise (deepfake)
- Using ChatGPT to write VPOs
- New generation of phishing attacks (spearphishing)
- AI privacy breach (MLDevSecOp)
Interestingly, all the trends suggest that attackers are becoming more intense and pragmatic. They, like us, are thinking how to simplify their work, improve services, make them more convenient, spread as widely as possible. For you and me, this is a chance to learn something, to become even more competent and skilful. Yes, the number and complexity of incidents is growing (and even growing a lot), but at the same time we can see a significant increase in the technical skills of our defenders: the ibshniks have improved, and the level of cyber resilience of organisations as a whole has increased. The trend can be tracked by the increasing percentage of incidents through contractors or the supply chain, suggesting that it is no longer easy to break companies.
This confrontation will never end: approaches change, techniques become more sophisticated. All we have to do is keep up with the times and navigate the updates.
