Understanding Cybersecurity Threats

The Big Picture

• Attackers such as Advanced Persistent Threats (ATPs) have superior insight into how organizations are compromised, while organizations must understand the same big picture to protect themselves.
• Understanding how and why organizations get hacked is crucial for effective security.

Data Challenges

• Determining the exact details of how a system was compromised is difficult because of limited reporting and the difficulty in finding and analyzing all relevant information.
• Many compromises are never reported, discovered, or fully investigated.
• The information available may be incomplete, misleading, or even incorrect.

Stealthy Attacker Tactics

• ATPs prioritize covert actions to avoid detection and maintain access to target systems.
• They leave traces only when absolutely necessary to stay connected.
• Organizations often fear negative publicity, damage to reputation, and potential legal issues, leading to a reluctance to report security incidents.
• The increasing number of compromises and improved detection capabilities are driving more organizations to acknowledge and report security breaches.

Evolving Threats and Defense

• Attackers constantly refine their strategies and techniques to exploit new vulnerabilities and create innovative attack methods.
• Defenders are continuously developing new technologies and methods to counter emerging threats.

Techno-Criminals vs. Cybercriminals

• Techno-criminals use technology to facilitate traditional crimes like theft, credit card fraud, and fraud.
• Cybercriminals, on the other hand, primarily use computers and the internet to commit crimes.

Credit Card Skimming

• Physical skimming devices ("skimmers") are used to steal credit card data by physically swiping cards and storing information on the device.
• Skimmers are common in retail establishments and are now increasingly used with ATM machines.
• Skimmers often include cameras to capture PINs, and can send stolen data via text messages or wireless connections.
• These devices are readily available online and within criminal networks.

Hacking Power Systems

• In 2009, the FBI discovered a widespread incident where Puerto Rico Electric Utility customers tampered with energy meters to reduce their bills.
• Customers used strong magnets to reduce energy consumption readings, leading to a loss of approximately $400 million annually for the company.
• Customers could reprogram meters using devices called "optical probes," which required physical access to meters.
• These devices are available for purchase online for around $300.

Unsophisticated Hacking Techniques

• Chris Chaney, a hacker known as the "Hollywood Hacker," accessed the personal email accounts of celebrities using basic techniques.
• He employed common password reset methods by guessing email addresses and answering security questions found online.
• Chaney forwarded emails sent and received from the hacked accounts to his own address.

Neighborly Harassment

• Barry Ardolf, from Minnesota, targeted his neighbor, Matt Kostolnik, by compromising his wireless network and engaging in malicious activities.
• Ardolf cracked Kostolnik's Wired Equivalent Privacy (WEP) secure network and sent malicious emails that appeared to originate from Kostolnik's home.
• He posted child pornography on a fake MySpace page pretending to be Kostolnik and sent emails to Kostolnik's employers impersonating him.
• Ardolf was caught by analyzing captured data packets that revealed his IP address.

Understanding Empirical Data in Cybersecurity

• ATP (Advanced Persistent Threat) actors often employ stealthy methods to compromise targets, minimizing their digital footprint.
• Many organizations do not report security compromises, fearing negative publicity, customer confidence loss, or legal repercussions.
• Organizations are increasingly reporting compromises due to the rise in attacks and improved detection capabilities.
• Attackers continuously evolve their strategies and techniques to exploit vulnerabilities and create new attacks.
• Defenders constantly develop new defensive technologies to counter evolving attack methods.

Examples of Threat Actors

• Techno-Criminals: Utilize technology to enhance traditional crimes rather than being purely digitally focused
• Skimmers: Devices used to steal credit card data by physically swiping cards, often found in retail establishments, ATMs, and increasingly incorporating wireless technology and cameras.
• Hacking Power Systems:
  • Cases of manipulating energy meters in Puerto Rico, costing the utility company millions annually.
  • Attackers used magnets and "optical probes" to manipulate readings and reduce energy bills.
  • Devices are readily available online, requiring minimal technical expertise.

Unsophisticated Threat Actors

• Chris Chaney ("Hollywood Hacker"): Gained access to celebrities' email accounts through simple methods:
  • Guesses email addresses.
  • Exploits "forgot password" features by guessing security questions easily found online.
  • Forwards emails to monitor account activity.
• Barry Ardolf: Terrorized his neighbor using a combination of social engineering and technical tricks.
  • Cracked the neighbor's WEP-secured wireless network.
  • Spread malicious emails traced back to the neighbor's home.
  • Created a fake MySpace page with child pornography and pretended to be the victim.
  • Sent emails impersonating the victim to their employees.
  • Captured network data exposed his IP address and led to his capture.

Understanding Empirical Data in Cybersecurity

• This chapter focuses on providing empirical examples of hacking and counter-hacking.
• These examples offer insights into how attackers compromise organizations and how those organizations respond.

The Problem with Data Sets

• Many incidents go unreported or have limited available information.
• Not all compromises are discovered.
• Not all discovered compromises are reported.
• The full facts surrounding specific compromises are often uncovered.
• Even when facts are released, they may be misleading or incorrect.

Attackers' Operational Methods

• Advanced Persistent Threat (ATP) attackers typically favor stealthy methods to avoid leaving traces.
• These methods can be sophisticated and help them to maintain access to compromised organizations.

Issues Surrounding Reporting Organizational Breaches

• Many organizations choose not to report breaches due to concerns about:
  • Bad publicity
  • Loss of customer confidence
  • Potential legal actions
• The increase in breaches and the ability to detect them has led to a greater willingness among organizations to report.

Evolving Threat Landscape

• Attacker tactics are constantly changing to:
  • Exploit new vulnerabilities
  • Create new attacks
• Defenders develop new technologies to counter these threats.

Techno-Criminals & Skimmers

• Techno-criminals utilize technology to facilitate traditional crimes, unlike Cybercriminals who use computers and the internet for their crimes.
• Skimmers are physical devices used to steal credit card data.
• They are often placed on ATM machines, particularly in areas of high card usage, such as restaurants or retail stores.
• Modern skimmers can send captured data via text messages or wireless methods and often include micro-cameras to capture PINs.
• These devices are readily available through online markets and criminal underground networks.

Hacking Power Systems

• In 2009, the FBI discovered a large-scale scheme in Puerto Rico where customers manipulated energy meters to reduce their bills.
• 10% of the meters were modified, costing the utility company $400 million annually.
• Attackers used strong magnets to slow down the meters, reducing energy readings by 50-75%.
• They also employed devices like “optical probes” to reprogram the meters; these devices require physical access to meters and can be purchased online.
• These techniques highlight the potential vulnerabilities of critical infrastructure to relatively unsophisticated attackers with physical access.

Hollywood Hacker (Chris Chaney)

• Chris Chaney, despite lacking technical skills, targeted celebrities' email accounts.
• He was arrested for distributing nude photos of celebrities, including Scarlett Johansson.
• Chaney employed simple methods to gain access, including:
  • Guessing email addresses
  • Utilizing "forgot password" features of free email services
• He would reset passwords by answering security questions that could be easily found online.
• Chaney also forwarded emails to himself to monitor communications.

The Neighbor (Barry Ardolf & Matt Kostolnik)

• Barry Ardolf, residing in Minnesota, harassed his neighbor Matt Kostolnik.
• Ardolf cracked Kostolnik's WEP-secured wireless network, sent malicious emails to frame him, and even posted child pornography on a fake MySpace page.
• Ardolf was caught by analyzing captured network packets, revealing his IP address.
• This case demonstrates how individuals with limited technical skills can exploit vulnerabilities to disrupt others' lives.

This quiz explores the tactics used by Advanced Persistent Threats (ATPs) and the challenges organizations face in identifying and reporting cyber breaches. It highlights the importance of recognizing how systems are compromised to enhance security measures. Test your knowledge on the stealthy actions employed by attackers and the implications for businesses.