2011 has been a busy year so far for cyber criminals. No one can say IT security incidents went underreported; they have certainly been prominent in the headlines.
The year started with the RSA breach, a sophisticated, targeted phishing attack, where a small group of RSA employees were tricked into opening a corrupt email with an appealing subject line “2011 Recruitment Plan”. The email was in fact hiding a poisoned spreadsheet. The attackers managed to compromise RSA’s securID authentication tokens potentially putting at risk dozens of Fortune 500 companies and cost millions of U.S. dollars.
Also breached in the beginning of the year was HBGary Federal, a U.S. government IT security firm. Targeted by a determined group of hackers, the agency saw the download and release of confidential information, thousands of company emails, malware data and financial documents belonging to its clients. The goal of the attackers – allegedly the internet activist group “Anonymous” - was to cause mere damage and embarrassment to the firm, in retaliation to its CEO’s claim that he had infiltrated their group and would disclose Anonymous members’ information.
In April, Epsilon, one of the world's largest providers of marketing-email services, dispatching some 40 billion e-mails a year to clients such as Mc Kinsey & Company, Marriott Rewards, Citibank, Walgreens, Tivo, etc, experienced one of the most severe data breaches in history, exposing millions of individual email addresses. The criminals intended to capture as much customer information as possible in order to create advanced, customized and credible spear-phishing emails scams to use later against the compromised email recipients.
Later on that month, Sony’s Playstation Network leaked the personal information of over 70 million subscribers - including email addresses, passwords, PINs, contact details, possibly credit card information and all sorts of other records – leaving Sony’s customers vulnerable to phishing campaigns and identity theft. What’s more, the company confessed to another, second breach early May, and an extra loss of 24.6 million computer game users - without disclosing further information as per what caused the breach.
Citibank revealed in June that personal and account information of an estimated 200,000 of its bankcard customers in North America has been breached. Stolen data may include credit card information, as well as customer names and email addresses.
All combined, these attacks have exposed millions of customers’ records, personal information and other sensitive organizational data. On the bright side, companies have started to take matters into their hands, and have become more proactive about security. They are reporting breaches as they happen and - in most cases – are promptly notifying their customers and people about what had happened.
Let’s look at the commonalities between these various incidents and the emerging patterns behind them.
The first diagnosis that we can establish from these breaches is the following: these attacks have been very carefully planned, orchestrated and executed. They are highly sophisticated attacks that qualify as Advanced Persistent Threats (APT), engineered specifically against target companies. The scope of organizations impacted is impressive.
With the exception of HBGary, the targeted businesses are all large corporations with over 10,000 employees, operating significant volumes of assets, customer information and confidential data - a gold mine for cyber criminals.
The attackers are highly trained security experts, who are motivated by an appetite for challenge and financial gain. These attacks are planned and orchestrated with the precision of a military assault, where hackers first try and reproduce the entire network of the targeted organization in order to simulate the attack in their own lab environment, before executing their scenario. As evidenced in the HBGary case, criminals are showing a high degree of patience and determination.
Social engineering attacks
Another similarity is that these attacks result from social engineering techniques. Cyber-criminals are now targeting and manipulating employees inside the organization, “hacking the human mind” to break into the organizations’ systems. In the case of Epsilon, they tricked one of the company’s employees into opening a phishing email and clicking on a link. The hackers then gained access to the employee’s credentials, and exploited them to reach the corporate database.
Unfortunately, users are almost always the weakest links in an organization’s security system. There is always a vulnerable user to be found: it can be a new, unaware employee, or an overly nice secretary who shares a little too much information. Once inside, hackers operate in silence. They stay under the radar to steal as much information as possible before their presence is detected and corporations start investigating. This can sometimes take years.
In addition, these Cyber-criminals are no longer isolated amateurs. They belong to well-structured organizations that resemble terrorist cells - with money, motivation and goals. They can deploy considerable intelligence, time and resources in order to craft original social engineering attacks and gather informational assets. The only question as to the potential damage they can cause, is how far an attacker is willing to go?
Information: hackers’ gold mine
Financial information is not the only valuable data worth stealing. What we see in these breaches is that attackers are looking more for general customer information and less for specific billing or credit card data. Indeed, such information can be very lucrative for spammers.
When you have a customer database record, such as a user name, linked to a name and an email, you already have a lot of valuable information. This information can be used to craft a customized spam message, bearing the user’s name, details and interests, which will appear legitimate.
Chances are higher that a user will open a customized spam message and click on it, than if they receive generic spam. This in turn increases the profitability of a spammers’ campaign. Imagine for example emailing 500,000 recipients with a proposal to buy some product. If only 1 recipient out of 1,000 orders your product, that's already 500 new orders. Now you can imagine the latent profit that a spammer can make with 70 millions email addresses and individual information.
Lessons in protection
Companies shouldn’t buy into the illusion that they are compliant and therefore safe from attacks. Targeted attacks are on the rise and no company is completely bulletproof. Businesses must erect as many barriers as possible between cyber-criminals and their corporate network and assets.
Protection starts with the deployment of an in-depth security strategy across the network, endpoints, and multiple security devices connecting to the network. Enterprises need to apply several layers of protection, including an advanced Firewall and Intrusion Prevention System (IPS) to detect blended threats; a comprehensive endpoint security solution to secure all endpoints and mobile devices; a preventative data loss prevention solution to protect informational assets.
Simultaneously, they need to define a solid and well-structured security policy to enforce the protections. This policy needs to be aligned with the business objectives, and clearly understood by the employees of the organization. In addition, I would encourage enterprises to take a fresh look at how they expose their data assets in order to reevaluate how to best protect them.
After securing and shutting this ‘main door’ to potential attackers, organizations must work on securing and closing their perennial ‘back door’ – the users themselves. Human error is the one security problem that technologies alone can’t fix and for which there’s no patch. It is up to organizations to actively engage, train and educate their employees, in order to turn them into real, security-aware corporate gatekeepers.
Only a trained, security-aware workforce, combined with a solid, in-depth security system and a well-defined security policy can defeat today’s hackers. Hopefully business at large can adapt and learns these lessons, avoiding further data breaches in the coming months.