Understanding Cyber Threats to Organizations

Threats

• A threat refers to something that can cause damage and disrupt operational activities of an organization.
• Attackers use threats to infiltrate and steal data, such as personal info, financial info, and login credentials.

Examples of Threats

• An attacker stealing sensitive data.
• An attacker causing a server to shut down.
• An attacker tricking an employee into revealing sensitive information.
• An attacker infecting a system with malware.
• An attacker spoofing the identity of an authorized person to gain access.
• An attacker modifying or tampering with data transferred over a network.
• An attacker remotely altering data in a database server.
• An attacker performing URL redirection or forwarding.
• An attacker performing privilege escalation for unauthorized access.
• An attacker executing a denial-of-service (DoS) attack for making resources unavailable.
• An attacker eavesdropping on a communication channel without authorization.

Threat Sources

• Threats can be classified into natural, unintentional, and intentional
• Natural threats include fires, floods and power failures and have the potential to cause physical damage to computer systems
• Unintentional threats originate from insider security breaches, negligence, operator errors, unskilled administrators, or untrained employees
• Intentional threats include insiders or internal attacks performed by disgruntled or negligent employees that intentionally/unintentionally harm the organization.
• Most computer and internet related crimes are internal attacks performed by individuals within the organization
• External attacks exploit vulnerabilities already present in a network, and the potential severity is dependent on identified network weaknesses
• Structured external threats are implemented by technically skilled attackers who use tools to gain access into a network with the intention of disrupting services
• The motivation behind structured attacks can vary but includes criminal bribes, racism, politics, and terrorism
• Structured external threats include examples like distributed ICMP floods, spoofing and simultaneously executing attacks from multiple sources
• Unstructured external threats are performed by unskilled attackers, aspiring hackers, and are typically based on curiosity rather than criminal intent.
• Unstructured external attacks can be easily prevented with port scanning and address sweeping security solutions
• An example is using freely available online tools to attack a network or crash a website

Threat Actors/Agents

• Black hats use their extraordinary computing skills for illegal/malicious purposes, often engaging in criminal activities, and are also know as crackers.
• White hats (penetration testers) use their hacking skills for defensive purposes with permission from the system owner, such as security analysts knowledgeable about countermeasures.
• Gray hats work both offensively and defensively at various times, helping hackers find vulnerabilities while assisting vendors to improve products (software/hardware).
• Suicide hackers aim to bring down critical infrastructure for a cause and are unconcerned about facing jail terms or other punishment.
• Script kiddies are unskilled hackers using scripts, tools, and software developed by real hackers, focusing on the quantity of attacks instead of quality.
• Cyber terrorists with religious or political motivations aim to create fear through large-scale disruption of computer networks
• State-sponsored hackers, employed by governments, seek to penetrate systems, gain top-secret information, and damage other governments.
• Industrial spies perform corporate espionage to steal critical information like blueprints and formulas, often using advanced persistent threats (APTs) and social engineering.
• Insiders are employees (trusted persons) with critical asset access who use their privileges to violate rules or harm the organization's systems, often due to disgruntled or terminated status.
• Hacker teams are skilled hackers with resources and funding working together to research state-of-the-art technologies
• Criminal Syndicates are part of organized and prolonged criminal activities that exploit victims from distinct jurisdictions' to embezzle money through cyber attacks.
• Hackivists hack into government or corporate computer systems as a form of activism.
• Organized hackers are groups of hackers that work together in criminal activities that sell the information to the highest bidder.

Attributes of Threat Actors

• Internal actors are trusted insiders with authorized access to resources.
• External actors are outsiders with no authorized access but physical resources.
• Highly sophisticated threat actors are more successful than less sophisticated ones.
• Resources/funding determines how a threat actor supports an attack financially or with tools.
• Intent/motivation of threat actors can be connected to political/personal goals, making them more likely to launch an attack.

Threat Vectors

• Direct access is where the attacker gains physical access to the target system and performs malicious activities.
• Removable Media is where devices such as USB drives, phones, and printers become a way for malware to run automatically on the system.
• Wireless is where corporate devices can be comprised through unsecured wirless hotspots and/or credentials being stolen.
• Email sends phishing attacks containing malicious attachments that allow attackers to compromise their targets.
• Cloud contains injected malware into cloud resources to gain access to user information.
• Ransomware/Malware takes advantage of unpatched vulnerabilities as well as malware to infiltrate an organization.
• Supply chain attempts to compromise the target by exploiting vulnerabilities in the resources supplies by 3rd party vendors
• Business partners are third-party organizations that emerge as a threat vector.

Autorun.inf Mitigation

• Autorun.inf is a file that when executed, runs executables listed in the file and displays the file.
• To mitigate the autorun.inf threat, the Autostart functionality should be turned off.

Common Malware Distribution Techniques

• Black hat SEO ranks malware highly in search results.
• Social Engineered Click-jacking tricks users into clicking on innocent looking webpages.
• Spear-phishing mimics legitimate institutions in an attempt to steal login credentials.
• Malvertising embeds malware in ad networks to displays across hundreds of legitimate, high-traffic sites
• Compromised legitimate websites host embedded malware that spreads to unsuspecting visitors.
• Drive-by-downloads uses browser flaws to install malware just by visiting a webpage.
• Spam emails attaches the malware to emails and tricks victims to click the attachment.

General Malware Components

• Crypters conceal the existence of malware.
• Downloaders used by trojans download malicious code
• Droppers are covert carriers to embed malware files in order to perform an installation task
• Exploits contain commands to take advantage of bugs/vulnerabilities, breaking security through software vulnerabilities. Local (inside network) and remote (outside network) exploits
• Injectors inject malicious code into code into vulnerable running processes and changes methods
• Obfuscators conceals malicious code via various techniques for difficulty.
• Packers compress the malware file by compressing into unreadable format.
• Payloads perform the desired activity once activated that may modify or delete files, open ports etc.
• Malicious code defines the basic functionality of malware. Can take various forms Java Applets, ActiveX Controls, Browser Plug-ins and Pushed Content

Trojan Indications

• The DVD ROM drawer opens and closes automatically.
• The compute screen blinking, flips upside down, or is inverted so that everything is displayed backward.
• Printers automatically start printing documents
• A web page suddenly opening without input from the user
• The color settings of the operating system changes automatically.
• Screensavers convert to a personal scrolling message/advertisements.
• The sound volume suddenly fluctuates
• Date and time of the computer changes.
• Mouse courser moves by itself.
• The left-and right-click functions of the mouse are interchanged.
• The mouse pointer disappears compeltely.
• The mouse pointer automatically clicks on icons and is uncontrollable.
• The Windows start button disappears.
• Pop-ups with bizarre messages appear unexpectedly.
• Clipboard images/text appearing to be manipulated.
• The keyboard and mouse freeze.
• Contacts receive emails that the user did not send.
• Strange warnings or question boxes appear.
• System turns off and restarts in unusual way.
• The taskbar disappears automatically due to a Trojan.
• The Task manager is disabled by a Trojan.
• Antivirus programs are automatically disabled and corrupted/altered/deleted from the systems data.

Types of Trojans

• Remote Access Trojans (RATs) give attackers full control of the victim's system to remotely access files and private conversations.
• Backdoor Trojans are programs that bypass standard authentication mechanisms to leverage backdoor programs in order to access the victim's computer without detection, as it is performed without the user's knowledge.
• Botnet Trojans are leveraged to infect a large amount of computers to create bot herders that can command said botnets to be used for attacks on targets.
• Rootkit Trojans are designed to get admin level access to a system that's difficult to detect by observing services, system task lists, or registries.
• E-banking trojans intercept account information before the system an encrypt it and send it to the attack command-and-control.

Trojan Uses

• Deeting critical operating system files.
• Disabling firewalls and antivirus.
• Create backdoors to gain remote access
• Use a victim's pc for spamming.
• Steal personal information such as security codes and passwords.
• Download spyware, adware, malware.
• Encrypt and lock out victims from accessing the system.

Types of Viruses

• System or Boot Sector infects system sectors including the master boot record (MBR) and the DOS boot record system sectors
• Email attachments and removable media (USB drives) are the primary carriers
• File Viruses infect files executed or interpreted in the system, such as COM, EXE, SYS, OVL, OBJ, PRG, MNU, and BAT files
• inserts their code into the original file and infect executable files
• Multipartite Virus (hybrid virus) combines the approach of file infectors and boot record infectors, simultaneously attacking both the boot sector and the executable or program files.
• Macro viruses infect Microsoft Word and similar applications, written in the macro language Visual Basic
• Cluster clusters infect files without changing the file or planting additional files
• Stealth/Tunneling alter and corrupts corrupting services to hide from anti-virus programs