It may be hard to source some attacks, but it depends on the attack as well. We also have to decide what data to use as to who got attacked?
The answer to the question is 367 entities were attacked and reported to the FBI in 2018 from China.
So that was the amount of attacks that people reported. Do you really think that everyone who gets attacked reports the attacks to the FBI?
Total attacks: 4556 India
471 Russian Federation
409 South Africa
371 Hong Kong
Total Attacks: 20379
I want to also warn everyone – will this count be less this year? Will we depend on digital technologies less this year?
China and many other attack points will keep coming at us.
Contact US to audit your defense.
It may also be time for us to reduce our Chinese exposure, as a Chinese drone manufacturer has a security flaw that allows hackers to grab your details. It is almost as if this is set up on purpose – make the product easy to hack and then sell them to unsuspecting Americans. Later hack them with more data on them.
“Chinese drone giant Da-Jiang Innovations (DJI) commands more than 70 per cent of the global market, supplying products for personal, commercial, and even military use.” from abc.net.au
I think we need to have operational risk assessments – which may include to stop buying Chinese made IT products.
First of all what is a rootkit?
A collection of software that runs and tries to hide from the computer user and administrator while also allowing the attacker access to the computer.
It does this by connecting as ‘root’ to the Operating System kernel. In Linux ‘root’ is the administrator.
If you can masquerade as root and hijack system calls then there is a way software can be written to get root access allowing the software to hide itself in the Linux system.
I am not going to tell you how to create rootkits, as there are many a people on the Internet who have done so and show you what they have done.
Marcus Hodges at Thotcon had a 1 hour presentation about how to hide from the operating system. To hijack operating system calls that then are used to create the rootkit.
Once system calls are hijacked the attacker can create hidden areas on the file system to stow and stay quiet until more objectives are to be pursued.
In the Cyber Kill chain the rootkit performs the function of persistence – keeping a presence on the attacked network.
A decent command to find out what different commands do on a system: strace – commands for troubleshooting and debugging Linux
Contact Us to discuss a strategy to defend your computer networks
Another Thotcon presentation was very good, unique and moves the industry forward.
Julian Cohen presented This idea:
“Understanding Your Adversaries”
In his talk: “Adversary-Based Threat Analysis”
He explained that in the traditional Threat modeling Process the following 6 items happen.
- Identify Assets
- Create Architecture Overview
- Decompose an Application
- Identity the Threats
- Document the Threats
- Rate the Threats
But his method includes rating the adversaries.
He gave some examples that are well documented (the PLA or Peoples Liberation Army) in Mandiant’s report. The report is now in a “new” mandiant web location with all of their reports. Here is an updated link: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
This famous report is explained as APT1 (Advanced Persistent Threats), the fame of this report is that Mandiant did a thorough analysis how and who did the attacking from China(PLAUnit61398), down to learning where exactly the attacks came from(which building). You can search under APT1 in any search engine and the term is attributed to the report.
Julian discusses the adversary as they have a say (or should) in how you defend.
A discussion of the intrusion Kill Chain ensued (by Lockheed Martin) i.e. below is the action and tools that are used.
- Recon: Email harvesting
- Weapon: Office Macros
- Delivery: Phishing
- Exploit: target runs macro
- install: Poison Ivy
- C2 – Command and Control: Poison Ivy
- Actions: Pivot to active directory
Here is where Julian discussed “what” the adversary is using as to how effective they actually are. The adversary is not going to do ‘everything’ , as they will do stuff that works.
There is another matrix which reviews Attacker Cost (Likelihood) focusing on these
- Weapon- office macros
- Delivery – phishing
- Install – Poison Ivy
- C2 – Poison Ivy
We all know Phishing works for them, since we are getting inundated with spam that tries their hardest to trick and get access to their machine.
Then also reviewed what is effective for defenders
- Delivery – Phishing
- Install – Poison Ivy
- C2 – Poison Ivy
He also mentioned this comment:
“Adversaries don’t think about winning once. They build repeatable, scalable playbooks that are cost effective at achieving their objectives over and over again against a series of targets. Adversaries don’t think about winning at all, they think about a steady stream of targets.”
Attacker efficiency: Attackers determine the least costly and most valuable attacks based on
- Who are the targets
- Required success rate
- Speed of conversion
Defenses to APT1 are the following
Detect, Deny, Disrupt, Degrade, Deceive, Destroy.
All attackers are resource constrained and all attackers have a boss and a budget.
Likelihood versus Input (in a risk calculus)
In most cases issues should be treated on likelihood alone
Do not make impact High.
Get the most up-to-date research data to drive the likelihood information in your matrix
He is talking about this matrix I have shown in the past(in this graph likelihood = probability):
In the presentation this is the matrix he showed:
Notice the similarities even though the impact and likelihood were switched in axis, which does not actually mean much.
There is a profound meaning in this realization.
The reality is that since the attackers are not just going after you, but templates of defenders, you have to have a profile that makes you more difficult to crack. With a focus on phishing defenses, and defending against Poison Ivy the tool.
You should not just create a threat model of your systems and software, also pay attention to the attackers which are doing specific things, so that you can focus on high risk items and the likelihood of attacks on your infrastructure.
Thotcon (Chicago’s Hacking Conference) thoughts…
Saw several good Cybersecurity presentations while one of the keynotes “Josh Corman” discussed the burnout of the infosec opsec community. This is a problem for our industry as I have discussed before in past posts. It has to do with the 3 following topics:
1. Workload to most infosec people is 50-60 hours minimum on a regular week, and more during emergencies. Josh mentioned 80 hours as a regular work week for many this high workload leads to exhaustion.
2. What happens when there is no relief and it is a constant way of life to say you will work 80 hours a week forever??? Now we get to a negativity or cynicism. The constant pressure is creating a kind of relief psychology of defense by cynicism.
3. Efficacy or reduced effectiveness due to constant pressures.
What was really on Josh’ mind was the increasing number of suicides by a number of his friends.
So Josh would like to do something about this phenomenon. He gave an example of a Psychologist saying that the other profession with similar characteristics is nursing (high workload, and cynicism leads to lower efficacy).
He also said to not follow the herd and do not put down your fellows/ colleagues.
Above is a picture of the beginning of the second day where the Thotcon organizer was having some fun in a Wookie costume.
The main problem is to get more help so that infosec people will not burn out completely and do things that we all will regret. Another problem is that infosec people are hard to find (or at least competent ones).
So the true issue is to get resources and eyeballs, attention of the C-suite, and generally a different level of attention.
Believe it or not for companies this is taken care of in GRC – Governance, Risk, and Compliance.
Governance is different than just IT department run by CFO, or the CEO. The issue with Governance is that the goals of the organization are kept in mind (which is not just the mind of one person). It is the codification of the goals. WRITTEN goals and thus the group of people in charge of GRC can work toward this written goal using Risk and compliance as a way to manage things. So, the staffing of the IT department (which includes opsec or infosec) is a risk to be measured. You should not have a single person running the IT department, nor should you have 80 hours of work for 1 person. For 80 hours of work, there should be 2 people.
Setting up GRC in an organization might take a while, but once set up it can help an organization manage the compliance and regulatory risks by giving a proper Governance controlled by the people who are supposed to run the company with proper human resource goals as well.