Security experts are seeing an increase lately in advanced persistent threats, threats that have no known signature or known pattern of behavior.
"The first victim is patient zero," notes Samuel Visner, vice president and cyber lead executive at CSC, Falls Church, Va., and a former security official with the federal government. These threats lurk unseen in servers, applications and databases and are very difficult to detect. They often are created by nation-states or companies affiliated with them, they can change their own appearance and migrate from server to server seeking confidential information, they can establish communication with their creators, and they can wait stealthily and patiently until conditions are just right to attack.
These thieves are after not just bank or card account information, but intellectual property, such as product development or marketing plans and corporate strategy. "This information is valuable not only to an economic competitor but to a nation-state that has some kind of relationship with companies that owe sovereign allegiance to that government," Visner says.
"The Office of the National Counter-Intelligence Executive says foreign governments are in fact collecting this intelligence, doing what we call network exploitation, and they are collecting information from U.S. and other Western commercial enterprises. They're doing this because its gives them economic clout, which today is a component of geo-strategic clout."
The value of research and development in the U.S. was estimated by the National Science Foundation at $4 billion in 2008, about 2.8% of the nation's gross domestic product. "If somebody were to steal that, they would get all of the benefit and not have to pay any of the cost," Visner says.
It's too soon in the investigation to tell if the Global Payments data breach earlier this month falls under this category, but financial institutions are widely considered to be targets of such attacks.
"One senior banker said, 'Why would the Chinese hack me? I have their money, they want me to secure their money,' " says Bill Wansley, senior vice president at Booz Allen Hamilton, McLean, Va. "They're not going to steal their own money." Wansley responded that the bank has sensitive M&A information that could be valuable.
"Don't kid yourself. We have never not found malware on a client," he says. "If anybody thinks they're not being attacked, they're not aware of the fact. There are those companies that have been attacked and those that don't know it yet. If you're a major institution, you're being attacked all the time."
In fact, banks, credit unions and insurance companies are among the most coveted targets, according to Darin Anderson, general manager of Norman Software NA, Fairfax, Va. "First off, they have a broad base of customers; someone executing a social engineering trick can play the numbers and send out the email to millions of email subscribers," he says. "The bad guys are following the money to financial institutions and looking for ways to get users to compromise their credentials or the institution itself to open a place where they can further perpetuate their crimes."
ORIGINS OF THE APT ATTACK
The term "advanced persistent threat" evolved from the U.S. military and originally was used as a cover name for Chinese hacking. "It has since evolved to describe a type of attack that meets the definition: advanced in that it's very sophisticated in the technical abilities of the attackers, persistent in that it keeps coming back - it's so well-resourced that it has the time and money to keep plugging away when they want to penetrate an organization," says Wansley. "And it's generally associated with a nation-state attack."
Advanced persistent attacks put sophisticated malware on a company's systems through a social engineering-phishing type attack approach, with incredible persistence and detail, Wansley says. A country might dedicate 100,000 people to such a project, who will build detailed personal profiles on individuals they're going after.
"They'll social engineer to the point where they know great details about people, who their colleagues are, and they'll send them a very innocuous email that looks like it's coming from your boss or best friend and says, 'Here's a picture of us together last weekend,' " Wansley says. The email may be legitimate, but the picture could have malware on it and make the recipient an unwitting insider.
The malware learns about vulnerabilities inside a company's systems, collects intelligence, and seeks intellectual property or sensitive data. It has the potential to encrypt that information, copy it and send it out at night when it's less noticeable. "You may see an increase in volume of data leaving at night but you don't know what it is," Wansley says.
These cleverly crafted pieces of malware know how to morph in such a way to not to be detected, and they can establish a morphing schedule so they morph faster than a signature could catch up to them, notes Bryant G. Tow, chief security officer for the Financial Services Group at CSC. One example of this type of malware was the Zeus banking Trojan that Microsoft's crime unit worked with law enforcement to catch in March.
"That malware was so sophisticated that it would act as that man in the middle and display actual account balances on a page that looked so unbelievably real, users had no idea what was going on," Tow says. "As the malware proliferates and makes its way through the network, it knows how to behave and it behaves in such a way that we're often not aware of it."
Some observers thought it was odd that Microsoft participated in the raid. However, Tow points out that Microsoft has a vested interest in going after such perpetrators and protecting its own interests abroad.
One common behavior among advanced persistent threats is they typically attempt to establish some kind of control or command path back to the originators or "mother ship," Visner says. Once the malware has found the information sought or an email account that seems to deal with the subject matter, it will open a port and use it to communicate back home.
Another characteristic of these threats is they may cause anomalous behavior inside the network, such as driving bandwidth up as they try to communicate out or changing administrative access rights as they attempt to access administrative controls.
"If you find something that looks amiss, because it causes unusual behavior in the network or it causes the application of administrative privileges that aren't ordinarily associated with a particular user, it gives you reason to wonder if something else is going on inside the network," Visner says.
PREVENTING ATTACKS
The loss of intellectual property can have several effects. "If somebody steals your intellectual property and they can introduce your product to the market and make it more cheaply, the value of your investment is infinitely demonetized," Visner notes. "Your adversary gets all of the return and pays none of the investment. Secondly, the IP thief may not be able to produce the product at the level of quality that the originating firm does, so the firm's reputation may be damaged.
Banks should consider the real and likely scenario that they've already been hacked and that some or all of their systems are owned, says Anderson. "They have a long-term vulnerability and they need to look at the entire ecosystem of layered defense - having technical solutions in place that provide perimeter and endpoint security," he says.
To protect themselves, banks need to do continuous monitoring from within, according to Wansley. "Having a single firewall is not sufficient any more," he says. "You have to constantly monitor for changes in your system, and then find a way to collect and remove the malware from your system."
"Companies also need to establish a deliberate strategy to protect their most sensitive information," he says. If a company uses proprietary algorithms for market trading, those need to be treated specially and the access to those controls has to be done in such a way that it's more difficult for those potential malware instances to get to it, he says.
"The question we have to ask ourselves is whether or not the information is useful to a foreign government or a foreign competitor, or a foreign competitor being aided by a foreign government," Visner says. "Understanding that is the first step towards developing a good hypothesis of how much info is being lost and what's the value of that information."
That includes establishing security policies and technical guidelines for customers and educating internal and external stakeholder groups about cybersecurity, especially around social engineering. It involves setting up an infrastructure and ecosystem that gathers information and evidence on what the bad guys have been able to steal from them and identify who has the information and what is the nature of the information that's been exposed, leaked or stolen. Companies need to come up with a set of procedures to follow to improve their systems based on intelligence they gather through that information gathering.
Existing malware-detection software can help. "You do want to continue to look for the signatures of known threats, because a lot of good work has been done to characterize these threats and signatures," Visner says. "There are programs out there that disseminate information about these threats, sometimes in the form of anti-virus definitions."
Knowing what's going on in your networks is critical, Tow points out. "The more we define what's normal, the better off networks will be," he says. "We can find anomalous behavior and make a determination at that point without being too business-disruptive."
The perpetrators of these attacks are sophisticated and have access to commercial antivirus tools, and the applications and architectures companies use. "They're in a position to understand how a network ought to operate, so they're going to find fairly subtle ways to introduce malware that causes subtle effects on this side of the network, things that might not normally be detected," Visner says.
A tactic of "air gapping" - ensuring that a secure network is isolated from insecure networks, such as the public Internet - can help but is not a complete answer. The Stuxnet worm, for instance, that targeted Iranian nuclear capabilities, got on the laptops of Russian contractors who supported those systems through thumb drives. "The fact that something isn't connected to the Internet does not necessarily mean that malware cannot get on those systems," says Donald Purdy, chief cyber strategist for cybersecurity at CSC.
The FBI has recommended that computers banks use for ACH funds transfers be dedicated to that purpose and not connected to the Internet or perform other functions. It's also specified that these stand-alone computers should have no active USB ports.
"I was told that the Department of Defense puts hot glue in their USB ports to keep people from using them - it's a bit of a low-tech solution but effectiveness nonetheless," says Tow. Such computers should ideally have no other applications on them, not even email or Microsoft Word, he says. "There's no absolute empirical evidence, but the FBI has said unofficially that companies that did this later reported that there were no incidences - the threat and opportunity had reduced to zero."
But there's no silver bullet, of course. "You shouldn't assume that just because a network is isolated from the Internet, that there no pass by which malware can infect that system or information might be stolen," Visner points out. Insiders, insufficient discipline and lack of enforcement of policies can all open doors to attack.
BottomLine: A particularly sophisticated attack, advanced persistent threats are growing in amount and severity.
