In Cybercrime's Evolution, Active, Automated Attacks Are the Latest Fad

Every few years, there is a significant and often unexpected shift in the tactics that online criminals use to exploit us for profit. In the early 2000s, criminals ran roughshod through people's computers by exploiting simple buffer overflows and scripting flaws in email clients and using SQL injection attacks. That evolved into drive-by downloads through flaws in browsers and their clunky plug-ins. Late in the decade, criminals began employing social components, initially offering up fake antivirus products and then impersonating law enforcement agencies to trick us into paying imaginary fines and tickets. In 2013, someone got the bright idea to recycle an old trick at mass scale: ransomware.

If history has taught us anything, it's that there are cycles to threats, and at some point in the future, ransomware as we know it today will begin to wane and morph into a new type of attack. Many factors can lead to the end of a good scam. In this case, we have finally removed Java and Adobe Flash Player from most of our home PCs, our browsers keep themselves up to date, and Windows, Mac, and even Linux largely update themselves with reasonable regularity.

This of course hasn't eliminated "spray and pray" malware. It has just made it less profitable. The majority of ransomware infections these days seem to originate via email and are affecting lower volumes of victims than in the heyday of mass web exploitation.

While there has always been a divide between unskilled and skilled cybercriminals, with the declining utility and increasing risk of traditional tactics, at least some of the latter are beginning to recognize that they need to up their game.

Unskilled online criminals will continue to pay for spam runs or hire already infected PCs to indiscriminately distribute commodity malware. The others? They've got a new scam. And it isn't something that is likely to catch on with the script kiddies. They're going out and behaving as rogue penetration testers.

We first noticed this with the SamSam gang. They were able to operate discreetly enough that it took the community nearly two years to notice. Why? They operated at low volume. Few samples made it to services like VirusTotal, few victims were important enough to garner attention, and few security vendors noticed the blips in their statistical analysis of enormous malware volumes.

Penetration testing takes skill, but it also takes patience. To many people with hacking skills, getting paid to break into systems sounds like a dream come true until they face the reality. The goal isn't just to break in; the real goal is to document how you broke in and write a report about it. Cybercriminals are simply bypassing this boring part and infecting the systems with malware instead.

These "criminal penetration tests" are seemingly very successful. While SamSam wrote the blueprint, we have seen the pattern copied by LockerGoga, MegaCortex, Ryuk, and others.

The attack pattern we're seeing/we've seen goes like this:

1. Find some low-hanging fruit.

2. Sort through results and pick interesting targets.
3. Identify computers that hold interesting or sensitive data.
4. Encrypt, ransom, or steal data for profit.

I think that this is a significant change in behavior and it brings us to an important change in tactic: the automated, active attack.

This blended approach, using both automated discovery and human intelligence to choose targets, combined with the deployment of low-volume custom malware, is enough to severely cripple most organizations. Most organizations' defenses are only prepared to deal with automated malware distribution, not semitargeted attacks.

This approach is very lucrative for cybercriminals because it can yield anywhere from $50,000 to over $1 million per victim, and can be targeted at nearly any organization. Even the smallest of firms potentially have tens of thousands of dollars on hand when it's time for payroll, and if they don't have backups, paying the ransom could be their best option.

While security through obscurity is a terrible idea with regard to cryptography, it can't hurt when applied to information security. By no means should it be your only strategy, but simply upping your game a few notches can help you avoid being discovered through the simple scans and spams that criminals are using to initiate these attacks.

As mentioned, patterns have begun to emerge out of investigations of these attacks. The SamSam group, and others as well, have frequently sought out improperly exposed remote desktop (RDP) connections. Requiring a VPN, multifactor authentication or strong, unique passwords would prevent many attacks. Disabling web server banners advertising precise versions of helper software like PHP, Perl, Ruby, or even your CMS type can help you avoid being identified by unsophisticated automated scans.

Better yet is building a culture of security within your organization and focusing on how you can increase the maturity of your security preparedness. Keeping up is hard and staying ahead can feel impossible, but understanding that you can't be perfect can free you to make decisions about managing risk rather trying to do the impossible.

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.