APT Or Everyday Cybercrime? How To Tell

Oil companies, Internet technology firms, defense contractors, and even computer-security firms have all been targeted by persistent adversaries bent on stealing intellectual property and sensitive business information.

Advanced persistent threats (APTs)--a term that's become much maligned since the media locked onto it--describes attackers that are targeting specific companies and data, rather than searching for vulnerable targets of opportunity. Persistent attackers stole oil field exploration data from ExxonMobil, information on the Joint Strike Fighter from Lockheed Martin and Northrup Grumman, and sensitive data on SecurID tokens from RSA. For many in the industry, the question is no longer if they have been breached, but how deeply, said Richard Bejtlich, chief security officer of Mandiant.

"No one has been able to stop these guys, no one," he said. "They remain a problem for every company with valuable intellectual property."

Separating persistent threats from more opportunistic cybercrime-focused attacks is not easy, but can help inform defense, according to security experts. Block an opportunistic attack and the crisis is averted; block a persistent attacker and they will come back tomorrow, said Toralv Dirro, security strategist for McAfee's Labs in the Europe, Middle East, and Africa region.

"If someone is a victim of a targeted attack, there are patterns," Dirro said. "They should really follow up on identifying those patterns."

In many cases, the patterns are not clear. Even "advanced" attackers will only use, for example, the minimum force necessary to compromise a network. In some cases, attackers have rented botnets; in others, they've used standard cybercrime tools.

"It is never a case of, oh, they are using Poison Ivy, so it's APT--everyone is using Poison Ivy," Mandiant's Bejtlich said. "It really comes down to a lot of analysis to figure out what is going on."

Read the rest of this article on Dark Reading.

Read our report on how to guard your systems from a SQL attack. Download the report now. (Free registration required.)