Information security trends. Part 3

Ruslan Rakhmetov, Security Vision

In the first part of our series of articles on modern information security trends, we covered Supply chain attacks and 3rd party attacks, and in the secondpart we discussed attacks on elements of the Internet of Things and the protection of cloud infrastructures. In the final article of this series, we will discuss the security of personal data (including biometric data), as well as countering various crypto-ransomware and illegal mining of cryptocurrencies.

The issues of personal data confidentiality began to be raised almost immediately after the beginning of the widespread use of computer technology to process data related to individuals. That is why the Council of Europe Convention No. 108 on the Protection of Individuals with regard to Automatic Processing of Personal Data was signed back in 1981. Of course, with the development of information technologies, reliable protection of personal information has become a prerequisite for the successful work of both commercial and government structures - neither a customer of an online shop nor a user of a government service will want to become a victim of personal data leakage. The high social importance of ensuring information security of personal data has been and remains the driver of state legislative initiatives - it is enough to recall the domestic Federal Law No. 152 ‘On Personal Data’ dated 27.07.2006, European norms GDPR (General Data Protection Regulation) or, for example, such regional regulatory requirements as CCPA (California Consumer Privacy Act). At the same time, legal regulations are continuously updated to keep pace with the changing cyber threat landscape; for example, in Russia, important additions to the 152-FZ have been introduced several times by the following Federal Laws: 261-FZ of 25.07. 2011 (significant changes were made to the basic tenets of personal data protection), 242-FZ of 21.07.2014 (introduction of a ban on the primary processing of personal data outside the territory of the Russian Federation) and 519-FZ of 30.12.2020 (introduction of new requirements for the processing of personal data authorised by the subject for dissemination). Another trend is the gradual increase of penalties for violation of legal requirements to personal data processing - for example, under GDPR regulations, the penalty can be up to 4% of a company's annual turnover.

From the business point of view, protection of personal data of clients and employees is an important task not only in the context of compliance with the legislation - today it is often the accumulated data on consumers that represent one of the main intangible assets of a company, and the loyalty of employees and clients is formed, among other things, by the measures taken by the company to protect their accounts, personal data, and payment information. An even more important task is the protection of biometric personal data - biological, physiological, behavioural characteristics of a person used to establish identity (identification, authentication). Biometrics is already widely used by financial organisations for remote banking services within the framework of the Russian Unified Biometric System, which also enables a number of other legally significant actions to be performed remotely, as well as in the transport sector to ensure security, in passenger recognition projects at airports and contactless payment for metro fares. Commercial companies often use biometric personal data of their customers to confirm their identity (passport scans or selfies with an open passport in hand), as well as to control access of their employees to premises (video surveillance, biometric fingerprint scanners). The security of biometric personal data can be based, for example, on the principle of processing not the initial physiological characteristics of the subject (storage of fingerprints, facial photographs, gait and figure samples, etc.), but a biometric template - descriptor, which can be simplistically compared to the calculation of a one-way hash function, the value of which does not allow to recover the argument, i.e. the initial data.

At the same time, biometric characteristics have an important feature - unlike classical authentication methods (e.g. passwords) they cannot be easily replaced, which makes the issues of correct processing and protection of biometric personal data critical.

In order to protect personal data in modern IT infrastructure it is possible to be guided by the principles of information protection at all stages of its processing:

1. data storage (Data at rest): Protection of information when it is stored on storage media may include the use of full-disk encryption, encryption of databases and individual files, use of access rights management tools, mobile device management systems (MDM platforms), data leakage control tools (DLP products) and cloud access security brokers (CASB solutions).

2. Data in transit: Data protection in transit primarily involves protecting the transmission channels, for example, by using TLS, VPN solutions with traffic encryption, email security systems (S/MIME, PGP) and collaborative information processing (DRM/RMS solutions).

3. data processing (Data in use): Data protection during its processing may include a variety of access control and delimitation models (e.g., role-based, risk-based, Conditional access control, Risk-based access control, Conditional access), account management and access control solutions (Identity and access management), as well as access rights management systems (IRM solutions - Information rights management).

To protect personal data in cloud infrastructures, in addition to the above-mentioned principles, it is also possible to use SOAR solutions to automate cyber incident response processes, implement a network access model with ‘zero trust’ (Zero Trust model), and use cryptosystems with homomorphic encryption. You can also be guided by the standard GOST R ISO/IEC 27018-2020 ‘Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors’, which corresponds to the international standard ISO/IEC 27018:2019 ‘Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors’.

The protection of personal data is closely related to the current cyber threat of encryption viruses. The authors of these malicious viruses rightly believe that the personal data of a company's customers, employees, and partners is of special value, and they base their attacks not only on the direct encryption of IT infrastructure (including media with personal data), but also on the preliminary theft of valuable information in order to blackmail the victim into disclosing the stolen data. Often the attacked companies, on the one hand, are ‘in the grip’ of regulators, who may fine the organisation upon learning about the leak of personal data, and, on the other hand, risk losing customers who are angry about the leak. At the same time, the direct suspension of operations as a result of a crypto-ransomware attack also leads to serious reputational damage, as this fact quickly becomes public knowledge. At the moment, the threat of cyberattacks by encryption viruses is being discussed at the level of top US officials, where in recent months alone there have been a number of high-profile cyber incidents, the exact damage of which has yet to be assessed. Malware is usually distributed using the RaaS (Ransomware-as-a-Service) model, which means that one cybercriminal group, which is the direct author of the virus and maintains its infrastructure, can be partnered with a large number of smaller hacker teams, paying a percentage of the ransom to the authors. Darknet sites are also where attackers interact with those who sell so-called ‘access’ to compromised infrastructures, i.e. valid credentials to companies' IT systems obtained through phishing attacks or exploitation of vulnerabilities. There you can also find ads for programmers willing to develop malware, ads to buy/sell 0-day exploits for which vendors have not yet released patches, and offers of ‘crypto’ services that promise to provide protection against detection by anti-virus tools (FUD, Fully undetectable) by encrypting the internal structures of malicious modules.

From a technical point of view, encryption viruses are no different from ordinary, less destructive viruses: as a rule, they first launch a reconnaissance module (‘dropper’) in the context of a low-privileged user, such as an employee who opened a file sent in a phishing email, or a service account from which a web server attacked through a vulnerability is launched. The dropper is not detected by antivirus software, because from a formal point of view it does not perform illegitimate actions - it collects information about the system it has entered, such as domain name, account name, and host characteristics. Then, if this infrastructure is interesting for attackers, the dropper, at the command of the controlling hacker's C&C server, downloads additional modules that help to gain a foothold in the attacked system, increase privileges and infect other hosts in the network. Then, in the case of a ransomware virus, it searches for information of interest using keywords on all infected systems and uploads the found files to an external server (either belonging to the attackers or to a legitimate information sharing service, such as DropBox). The virus then encrypts all infected devices on the network, often using legitimate tools with a key set by the attacker; there have been cases of irreversible encryption where even a ransom paid did not recover the data.

A recent report by the Ransomware Task Force states that the fight against encryption virus attacks must be fought by building a comprehensive international defence strategy, properly preparing for and responding to attacks, and disrupting the attackers' business model and reducing their illicit revenue. The latter can be discussed in more detail: the paper proposes to make it much more difficult for attackers to withdraw ransom payments by controlling cryptocurrency transactions. Indeed, cryptocurrency is widely used on darknet sites for mutual settlements between buyers and sellers of illegal goods and services, and, as a rule, it is in cryptocurrency that attackers demand ransom from hacked companies. Once the cryptocurrency is obtained, it must be converted into ‘fiat’, i.e. fiat currencies such as dollars or euros, thus legalising and cashing in the proceeds of illegal activity. According to the US FBI, after the Colonial Pipeline attack, that agency managed to recover almost half of the $4.4 million bitcoin equivalent ransom paid - possibly just at the withdrawal and cash-out stage. Cryptocurrency buying and selling transactions are conducted either through crypto exchanges, which are subject to government regulation, or through crypto ATMs, which can also be monitored, or through OTC trading (Over the counter, literally ‘bypassing the counter’), where the seller-owner of the cryptocurrency and the buyer negotiate the transaction directly. Foreign state regulation in the financial sphere implies such norms as KYC (Know your customer), AML (Anti-money laundering), CFT (Combating financing of terrorism). In Russia, a similar set of measures is partially formulated in Federal Law No. 115 ‘On Combating Legalisation (Laundering) of Proceeds of Crime and the Financing of Terrorism’ dated 07.08.2001. Attackers, aware of possible state barriers, take a number of countermeasures: they use cryptomixer services, which allow them to split one cryptocurrency transaction into many smaller ones, perform several internal exchange operations and thus hide the original origin of funds, perform exchange operations of single cryptocurrencies, and use cryptocurrencies as a source of funds. At the same time, many attackers are aware of the ability to track transactions in some cryptocurrencies: in particular, bitcoin is not an anonymous means of payment, as it allows to track the addresses of recipients and senders of cryptocurrency through the blockchain registry, to obtain data on the amount of transfers, transaction history, the amount of funds on bitcoin wallets. Some anonymous cryptocurrencies, such as Monero, Zcash, Dash, provide attackers with more opportunities to hide illegal proceeds, however, ransom demands in such cryptocurrencies are hampered by the ability of attacked companies to acquire them - internal compliance procedures and government regulation in many cases simply will not allow organisations to perform transactions with them.

Another of the attack vectors for attackers to generate illegal revenue in cryptocurrencies is cryptomining or cryptojacking, i.e. the unauthorised use of infected devices to generate cryptocurrency by performing mathematical operations. If attackers have gained access to the infrastructure of the attacked company but do not yet consider it appropriate to launch an attack using a cryptojacking virus, they can covertly launch a cryptominer virus that will generate cryptocurrency in favour of the attackers. The attacked IoT devices we discussed in the last article can be leveraged in a similar way - the large number of infected devices compensates for their low processing power. Some time ago, a JavaScript Mining attack was also popular, where JavaScript code was run in a website visitor's browser to generate Monero - this is how attackers partially monetise their successful attacks on websites. Recently, however, hackers have become increasingly reluctant to use such methods, partly because of the increased computational complexity of mining some cryptocurrencies, partly because it is easier and faster to monetise an attack, for example by selling stolen credentials or using a DDoS attack device.