Lessons From 5 Advanced Attacks Of 2013

From Cryptolocker to the destructive attacks on Korean firms to the massive flood that made Spamhaus inaccessible, attackers delivered some hard lessons in 2013

Distributed denial-of-service attacks targeted application and business-logic weaknesses to take down systems; fraudsters used encryption to scramble victims data until they paid a ransom; and, attackers increasingly targeted providers as a weak link in the chain of the digital security protecting businesses. In 2013, there were no major revolutions in the way that attackers compromised, cut off, or just plain inconvenienced their victims systems, but their techniques and tactics evolved. From more pernicious encryption in ransomware to massive DDoS attacked fueled by reflection, attackers showed that they still had options available in their bag of tricks.
As the criminals have become more savvy and more technically knowledgable and understand the victims environments better, they are able to see opportunities that they might otherwise overlook, says Jeff Williams, director of security strategy for the counter threat unit at Dell SecureWorks, a managed security provider.
Based on interviews with experts, here are five advanced attacks from 2013 and the lessons for businesses from those events.
1. Cryptolocker and the evolution of ransomware
While many attackers create botnets to steal data or use victims machines as launching points for further attacks, a specialized group of attackers have used strong-arm tactics to extort money from victims. In the past, most of these types of attacks, referred to as ransomware, have been bluffs, but Cryptolocker, which
started spreading
in late summer, uses asymmetric encryption to lock important files.
The group behind Cryptolocker has likely infected between 200,000 and 250,000 computers in the first hundred days, according to
researchers at Dell SecureWorks
. Based on the number of payments made using Bitcoin, the company conservatively estimated that 0.4 percent of victims paid the attackers, but it is likely many times more than minimum take of $240,000, the company stated in an analysis.
[As regional troubles spill over to the digital world, companies should reinforce their defenses and demand their suppliers do the same, experts say. See
Worlds Trouble Spots Escalating Into Cyberthreats For Businesses
.]
What sets it apart is not just the size and the professional ability of the people behind it, but that--unlike most ransomware, which is a bluff--this one actually destroys your files, and if you dont pay them, you lose the data, says Keith Jarvis, senior security researcher with Dell SecureWorks.
Companies should expect ransomware to adopt the asymmetric-key encryption strategy employed by the Cryptolocker gang.
2.
New York Times
hack and supplier insecurity
The August attack on The New York Times and other media outlets by the Syrian Electronic Army highlighted the
vulnerability posed by service providers and technology suppliers
.
Rather than directly breach the New York Times systems, the attackers instead
fooled the companys domain registrar
to transfer the ownership of the nytimes.com and other media firms domains to the SEA. The attack demonstrated the importance of working with any suppliers that could be a critical cog in a companys security strategy, says Carl Herberger, vice president of security solutions for Radware, a network security firm.
You need to have real-time, critical knowledge from your service providers to determine whether they are being attacked and whether you are the intended victim of that attack, says Herberger.
3. Bit9 and attacks on security providers
In February, security firm Bit9 revealed that its systems
had been breached
to gain access to a digital code-signing certificate. By using such a certificate, attackers can create malware that would be considered trusted by Bit9s systems.
The attack, along with the breach of security company RSA, underscore that the firms whose job is to protect other companies are not immune to attack themselves. In addition, companies need to have additional layers of security and not rely on any one security vendor, says Vikram Thakur, a researcher with Symantecs security response group.
The onus resides with the security firm to prevent successful attacks from happening, but when they fail, a victim should have a plan to bolster their defense, Thakur says.
4. DDoS attacks get bigger, more subtle
A number of denial-of-service attacks got digital ink this year. In March, anti-spam group Spamhaus suffered a massive denial-of-service attack, after it unilaterally blocked a number of online providers connected--in some cases tenuously--to spam. The Izz ad-Din al-Qassam Cyberfighters
continued their attacks
on U.S. financial institutions, causing scattered outages during the year.
As part of those attacks and other digital floods, attackers put a greater emphasis on using techniques designed to overwhelm applications. Such application-layer attacks doubled in frequency in the third quarter 2013, compared to the same quarter a year before, according to denial-of-service mitigation firm Prolexic. Reflection attacks, where attackers use incorrectly configured servers to amplify attacks, grew 265 percent in the same period, according to the firm.
The attack against Spamhaus, which
reportedly topped a collective 300 Gbps
, used reflection attacks via open DNS resolvers to generate the massive flood of traffic.
This technique is still an available option for attackers, says Radwares Herberger. Because there are 28 million vulnerable resolvers, and every resolver needs to be fixed, this problem is not going away any time soon.
5. South Korea and destructive attacks
Companies in both the Middle East and South Korea suffered destructive attacks designed to wipe data from computers. In 2012, Saudi Aramco and other companies in the Middle East were targeted with a malicious attack that
erased data from machines
, causing them to become unrecoverable.
This year, South Korean firms were attacked in a similar manner in a multi-vector attack whose finale was the
deletion of master boot records on infected computers
. While such attacks have happened in the past, they seem to be more frequent, says Dell SecureWorks Williams.
The impact of these attacks have been pretty impressive--30,000 machines needed to be rebuilt in the Saudi Aramco case, he says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Lessons From 5 Advanced Attacks Of 2013