Harvest Season: Why Cyberthieves Want Your Compute Power

What's the hottest commodity cyberthieves are going after these days? Credit card numbers? Medical records? Politicians’ emails?

Those may be big, attractive targets. But more and more, attackers are going after unwitting organizations' compute power. That's what lets them steal all those other things in volume and commit all manner of online crimes.

We're witnessing a resurgence in compute power hijacking — what the thieves call "harvesting" — for a variety of nefarious purposes. A big driver is the trend toward ever-larger-scale data theft. Why break into an individual’s laptop to steal one credit card number when you can break into a retailer’s data center and steal millions? Another driver is the surge in cryptocurrency mining, a rapidly growing source of illicit profits.

To exfiltrate multiple terabytes of data at a time requires enormous computing power. To get it, bad actors are targeting legitimate enterprise data centers across all industries and company sizes. Once sophisticated hackers gain a foothold within a data center, they can dwell undetected for months. Indeed, the average "dwell time" for a successful breach is around 150 days, according to Mandiant’s 2016 M-Trends report. And hijackers need only a fraction of the host’s computing power to carry out their schemes. Consequently, their harvesting goes unnoticed.

Uncovering a Hidden Mine
Here’s an example of the damage hijackers can do. Last year, a midtier insurance firm came to our company with a problem. It suspected its data center had been compromised, but couldn’t confirm it. We sent analysts in to investigate. Sure enough, the company had a problem — beyond its wildest suspicions. Not only had the insurer been breached, but the attackers had set up shop, changed the firewall and DNS rules, and were running a massive botnet operation out of the data center. This security-conscious company had become the unwitting "botlord" of some 10,000 machines worldwide.

More on Security
Live at Interop ITX

Our team shut down the operation and cleaned up the infected systems. In the process, we discovered what the attackers were really doing and why they needed all that compute power: Monero mining.

Monero is a form of cryptocurrency, a derivative of Bitcoin. Monero or Bitcoin mining refers to discovering, capturing, and processing Bitcoin transactions floating around the Internet. It’s effectively a competition that favors miners with the most computing power. Right under our customer’s nose, the attackers were using hijacked computing power to run a Monero mining bank to collect transaction fees.

Harvested compute power can be used to fuel any kind of illicit online activity. This includes ransomware or distributed denial-of-service attacks. A clever attacker can initiate a DDoS attack in one country using compute power from another, making the attack harder to trace and easy to deny.

Locks Are No Help Once the Thief Is in the House
What can enterprises do to protect their valuable computing power from hijackers? Perimeter defenses such as firewalls and intrusion prevention systems are essential, but compute harvesting takes place within the data center, after the "walls" have already been breached. Organizations must face the fact that they can’t stop every attack, and redirect some of their security efforts to vulnerabilities inside the data center. 

And in today’s highly virtualized, cloud or hybrid data centers, those vulnerabilities are often easy to exploit. Server and network virtualization, combined with ever-increasing traffic, network speed, and server density have created an enormous visibility gap. Administrators simply can't "see" what's going on deep in their data centers, at the process level. That’s why sophisticated malware can move laterally almost indefinitely until it finds an opening.

Enterprises must take new measures to secure assets within the data center from threats that have successfully breached the perimeter. There are a number of techniques in a growing, emerging market (including GuardiCore as well as other vendors) gaining traction today that security teams can deploy to fight attackers 

Distributed deception, also known as dynamic deception, is a significant advancement over conventional "honeypots" planted as bait for attackers. In traditional static deception designs, honeypots are placed throughout a company's environment. This is resource-intensive to implement, configure, and maintain. Using a distributed deception approach, suspicious reconnaissance behavior is detected throughout the environment, then tunneled away from the production network to centrally located honeypots. By centralizing the honeypots, and relying on other techniques to detect and redirect the attackers, distributed deception is easier to implement and maintain, has fewer false positives, and provides a better containment area for investigation and threat confirmation.

Reputation analysis, the ability to recognize something that doesn’t belong, is another emerging threat-detection tool. It typically relies on having access to a threat intelligence network that’s tracking suspicious IP addresses, domain names, or file hashes associated with known malicious activity.

Visualizing data center applications and workflows and then wrapping policies around them is also essential. Micro-segmentation refers to the ability to implement and enforce security controls around individual or groups of applications within the data center. Any policy violation automatically triggers an alert to initiate an investigation. Of course, this requires deep visibility into data center activity, down to the process level, which is a challenge. But with today's visualization tools, administrators can map their data center applications and processes, making micro-segmentation more practical for more organizations.

Related Content: