Dhiraj Kukreja* Securing Cyberspace
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
The Flame: Questions and Answers 1.8
The Flame: Questions and Answers 1.8 Aleks Kaspersky Lab Expert Posted May 28, 13:00 GMT Tags: Targeted Attacks, Wiper, Cyber weapon, Cyber espionage, Flame Duqu and Stuxnet raised the stakes in the cyber battles being fought in the Middle East – but now we’ve found what might be the most sophisticated cyber weapon yet unleashed. The ‘Flame’ cyber espionage worm came to the attention of our experts at Kaspersky Lab after the UN’s International Telecommunication Union came to us for help in finding an unknown piece of malware which was deleting sensitive information across the Middle East. While searching for that code – nicknamed Wiper – we discovered a new malware codenamed Worm.Win32.Flame. Flame shares many characteristics with notorious cyber weapons Duqu and Stuxnet: while its features are different, the geography and careful targeting of attacks coupled with the usage of specific software vulnerabilities seems to put it alongside those familiar ‘superweapons’ currently deployed in the Middle East by unknown perpetrators. Flame can easily be described as one of the most complex threats ever discovered. It’s big and incredibly sophisticated. It pretty much redefines the notion of cyberwar and cyberespionage. For the full lowdown on this advanced threat, read on… General Questions What exactly is Flame? A worm? A backdoor? What does it do? Flame is a sophisticated attack toolkit, which is a lot more complex than Duqu. It is a backdoor, a Trojan, and it has wormlike features, allowing it to replicate in a local network and on removable media if it is commanded so by its master. -
What You Should Know About Kaspersky
What you should know Proven. Transparent. about Kaspersky Lab Independent. Fighting for your digital freedom Your data and privacy are under attack by cybercriminals and spy agencies, so you need a partner who is not afraid of standing beside you to protect what matters to you most. For over 20 years, Kaspersky Lab has been catching all kinds of cyberthreats. No matter whether they come from script kiddies, cybercriminals or governments, or from the north, south, east or west. We believe the online world should be free from attack and state-sponsored espionage, and will continue fighting for a truly free and safe digital world. Proven Transparent Independent Kaspersky Lab routinely scores the highest We are totally transparent and are making As a private company, we are independent marks in independent ratings and surveys. it even easier to understand what we do: from short term business considerations and institutional influence. • Measured alongside more than 100 other • Independent review of the company’s well-known vendors in the industry source code, software updates and We share our expertise, knowledge • 72 first places in 86 tests in 2017 threat detection rules and technical findings with the world’s • Top 3 ranking* in 91% of all product tests • Independent review of internal security community, IT security vendors, • In 2017, Kaspersky Lab received processes international organizations, and law Platinum Status for Gartner’s Peer • Three transparency centers by 2020 enforcement agencies. Insight** Customer Choice Award 2017, • Increased bug bounty rewards with up in the Endpoint Protection Platforms to $100K per discovered vulnerability Our research team is spread across the market world and includes some of the most renowned security experts in the world. -
Potential Human Cost of Cyber Operations
ICRC EXPERT MEETING 14–16 NOVEMBER 2018 – GENEVA THE POTENTIAL HUMAN COST OF CYBER OPERATIONS REPORT ICRC EXPERT MEETING 14–16 NOVEMBER 2018 – GENEVA THE POTENTIAL HUMAN COST OF CYBER OPERATIONS Report prepared and edited by Laurent Gisel, senior legal adviser, and Lukasz Olejnik, scientific adviser on cyber, ICRC THE POTENTIAL HUMAN COST OF CYBER OPERATIONS Table of Contents Foreword............................................................................................................................................. 3 Acknowledgements ............................................................................................................................. 4 Executive summary ............................................................................................................................. 5 Introduction....................................................................................................................................... 10 Session 1: Cyber operations in practice .………………………………………………………………………….….11 A. Understanding cyber operations with the cyber kill chain model ...................................................... 11 B. Operational purpose ................................................................................................................. 11 C. Trusted systems and software supply chain attacks ...................................................................... 13 D. Cyber capabilities and exploits .................................................................................................. -
A PRACTICAL METHOD of IDENTIFYING CYBERATTACKS February 2018 INDEX
In Collaboration With A PRACTICAL METHOD OF IDENTIFYING CYBERATTACKS February 2018 INDEX TOPICS EXECUTIVE SUMMARY 4 OVERVIEW 5 THE RESPONSES TO A GROWING THREAT 7 DIFFERENT TYPES OF PERPETRATORS 10 THE SCOURGE OF CYBERCRIME 11 THE EVOLUTION OF CYBERWARFARE 12 CYBERACTIVISM: ACTIVE AS EVER 13 THE ATTRIBUTION PROBLEM 14 TRACKING THE ORIGINS OF CYBERATTACKS 17 CONCLUSION 20 APPENDIX: TIMELINE OF CYBERSECURITY 21 INCIDENTS 2 A Practical Method of Identifying Cyberattacks EXECUTIVE OVERVIEW SUMMARY The frequency and scope of cyberattacks Cyberattacks carried out by a range of entities are continue to grow, and yet despite the seriousness a growing threat to the security of governments of the problem, it remains extremely difficult to and their citizens. There are three main sources differentiate between the various sources of an of attacks; activists, criminals and governments, attack. This paper aims to shed light on the main and - based on the evidence - it is sometimes types of cyberattacks and provides examples hard to differentiate them. Indeed, they may of each. In particular, a high level framework sometimes work together when their interests for investigation is presented, aimed at helping are aligned. The increasing frequency and severity analysts in gaining a better understanding of the of the attacks makes it more important than ever origins of threats, the motive of the attacker, the to understand the source. Knowing who planned technical origin of the attack, the information an attack might make it easier to capture the contained in the coding of the malware and culprits or frame an appropriate response. the attacker’s modus operandi. -
Detecting Botnets Using File System Indicators
Detecting botnets using file system indicators Master's thesis University of Twente Author: Committee members: Peter Wagenaar Prof. Dr. Pieter H. Hartel Dr. Damiano Bolzoni Frank Bernaards LLM (NHTCU) December 12, 2012 Abstract Botnets, large groups of networked zombie computers under centralised control, are recognised as one of the major threats on the internet. There is a lot of research towards ways of detecting botnets, in particular towards detecting Command and Control servers. Most of the research is focused on trying to detect the commands that these servers send to the bots over the network. For this research, we have looked at botnets from a botmaster's perspective. First, we characterise several botnet enhancing techniques using three aspects: resilience, stealth and churn. We see that these enhancements are usually employed in the network communications between the C&C and the bots. This leads us to our second contribution: we propose a new botnet detection method based on the way C&C's are present on the file system. We define a set of file system based indicators and use them to search for C&C's in images of hard disks. We investigate how the aspects resilience, stealth and churn apply to each of the indicators and discuss countermeasures botmasters could take to evade detection. We validate our method by applying it to a test dataset of 94 disk images, 16 of which contain C&C installations, and show that low false positive and false negative ratio's can be achieved. Approaching the botnet detection problem from this angle is novel, which provides a basis for further research. -
NAVIGATING the CYBERSECURITY STORM
NAVIGATING the CYBERSECURITY STORM A Guide for Directors and Officers BY PAUL A. FERRILLO EDITED BY BILL BROWN published by sponsored by sponsored by 1 © 2015 by Paul A. Ferrillo. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or any other information storage or retrieval system without prior written permission. To use the information contained in this book for a greater purpose or application, contact Paul A. Ferrillo via [email protected] 2 Is your company protected from the Internet of RiskSM? With CyberEdge® cyber insurance solutions you can enjoy the Business Opportunity of Things. 20 billion objects are connected to the Internet, what everyone is calling the Internet of Things. This hyperconnectivity opens the door both to the future of things, and to greater network vulnerabilities. CyberEdge end-to-end cyber risk management solutions are designed to protect your company from this new level of risk. So that you can turn the Internet of Things into the next big business opportunity. To learn more and download the free CyberEdge Mobile App, visit www.AIG.com/CyberEdge Insurance, products and services are written or provided by subsidiaries or affiliates of American International Group, Inc. Insurance and services may not be available in all jurisdictions, and coverage is subject to actual policy language. For additional information, please visit our website at www.AIG.com. ABOUT PAUL A. FERRILLO Paul Ferrillo is counsel in Weil’s Litigation Department, where he focuses on complex securities and business litigation, and internal investigations. -
What You Should Know About Kaspersky 3 About Kaspersky
What You Should Know Proven. Transparent. About Kaspersky Independent. Fighting for Your Digital Freedom Your data and privacy are under attack by cybercriminals and spy agencies, so you need a partner who is not afraid of standing beside you to protect what matters to you most. For over 20 years, Kaspersky has been catching all kinds of cyberthreats. No matter whether they come from script kiddies, cybercriminals or governments, or from the north, south, east or west. We believe the online world should be free from attack and state-sponsored espionage, and will continue fighting for a truly free and safe digital world. Proven Transparent We share our expertise, knowledge and technical findings with the world’s Kaspersky routinely scores the highest We are totally transparent and are making security community, IT security vendors, marks in independent ratings and surveys. it even easier to understand what we do: international organizations and law • Measured alongside more than 100 other • Independent review of the company’s enforcement agencies. well-known vendors in the industry source code, software updates and threat Our research team is spread across the • 73 first places in 88 tests in 2018 detection rules world and includes some of the most • Independent review of internal processes • Top 3 ranking* in 91% of all product tests renowned security experts in the world. • In 2017 and 2018, Kaspersky received • Three transparency centers by 2020 We detect and neutralize all forms of Platinum Status for Gartner’s Peer • Increased bug bounty rewards with up to advanced APTs, regardless of their origin Insight** Customer Choice Award 2017, in $100K per discovered vulnerability or purpose. -
Download Article (PDF)
Proceedings of the 2nd International Conference on Computer Science and Electronics Engineering (ICCSEE 2013) Trust in Cyberspace: New Information Security Paradigm R. Uzal, D. Riesco, G. Montejano N. Debnath Universidad Nacional de San Luis Department of Computer Science San Luis, Argentina Winona State University [email protected] USA {driesco, gmonte}@unsl.edu.ar [email protected] Abstract—This paper is about the differences between grids and infrastructure for destruction [3]. It is evident we traditional and new Information Security paradigms, the are facing new and very important changes in the traditional conceptual difference between “known computer viruses” and Information Security paradigm. Paradigm shift means a sophisticated Cyber Weapons, the existence of a Cyber fundamental change in an individual's or a society's view of Weapons “black market”, the differences between Cyber War, how things work in the cyberspace. For example, the shift Cyber Terrorism and Cyber Crime, the new Information from the geocentric to the heliocentric paradigm, from Security paradigm characteristics and the author’s conclusion “humors” to microbes as causes of disease, from heart to about the new Information Security paradigm to be faced. brain as the center of thinking and feeling [4]. Criminal Authors remark that recently discovered Cyber Weapons can hackers could detect some of those placed “military logic be easily described as one of the most complex IT threats ever bombs” and use them for criminal purposes. This is not a discovered. They are big and incredibly sophisticated. They pretty much redefine the notion of Information Security. theory. It is just a component of current and actual Considering the existence of a sort of Cyber Weapon black Information Security new scenarios. -
Symantec Corporate Template
Security Threat Intelligence & Response Deepak Maheshwari Head – Government Affairs, India Region Combo, Sri Lanka March 26, 2015 Council of Europe – International Conference on Assessing the Threat of Cybercrime 1 Symantec Security Response – Major Investigations ESPIONAGE: TURLA (2014) ESPIONAGE: REGIN (2014) A campaign which has A complex and stealthy systematically targeted the spying tool used for mass governments and surveillance and embassies of former intelligence gathering by Eastern nation states. Bloc countries MASS SURVEILLENCE, TARGETS GOVERNMENT EMBASSIES TARGETS COMMUNICATIONS METHODS SPEAR PHISHING, SOCIAL ENGINEERING, WATER HOLE METHODS WATER HOLE SABOTAGE: STUXNET (2010) FINANCIAL FRAUD: PLOUTUS (2013) The first computer Criminals compromising software threat that was ATMs with customer used as a cyber-weapon. Trojan and mobile Targeted nuclear facility in phone. Can command Iran. Used multiple zero- day exploits. ATM to issue cash using SMS. TARGETS NUCLEAR FACILITY TARGETS BANKS ZERO-DAY EXPLOITS, PHYSICAL ACCESS METHODS SUPPLY CHAIN METHODS Council of Europe – International Conference on Assessing the Threat of Cybercrime 2 Symantec Security Response – Leaders in Protection & Intelligence GLOBAL REACH WEB REQUESTS THREAT INTELLIGENCE ROUND THE CLOCK 24 x 7 x 365 100s OF 7 SITES, 13 BILLION DAILY INVESTIGATIONS MALWARE DETECTION IPS PROTECTION EMAIL PROTECTION > 31M SIGNATURES > 2M BLOCKED DAILY > 1.7B BLOCKED DAILY SOME OF LANDMARK INVESTIGATIONS STUXNET REGIN DRAGONFLY TURLA HIDDEN LYNX RAMNIT NITRO PLOUTUS ATM 3 -
Threat Landscape Report – 1St Quarter 2018
TLP-AMBER Threat Landscape Report – 1st Quarter 2018 (FINAL) V1.0 – 10/04/2018 This quarterly report summarises the most significant direct cyber threats to EU institutions, bodies, and agencies (EU-I or 'Constituents') in Part I, the development of cyber-threats on a broader scale in Part II, and recent technical trends in Part III. KEY FINDINGS Direct Threats • In Europe, APT28 / Sofacy threat actor (likely affiliated to Russia military intelligence GRU) targeted government institutions related to foreign affairs and attendees of a military conference. Another threat actor, Turla (likely affiliated to Russia’s security service FSB) executed a cyber-operation against foreign affairs entities in a European country. • A spear-phishing campaign that targeted European foreign ministries in the end of 2017 was attributed to a China-based threat actor (Ke3chang) which has a long track record of targeting EU institutions (since 2011). As regards cyber-criminality against EU institutions, attempts to deliver banking trojans are stable, ransomware activities are still in decline and cryptojacking on the rise. Phishing lures involve generic matters (’invoice’, ‘payment’, ‘purchase’, ‘wire transfer’, ‘personal banking’, ‘job application’) and more specific ones (foreign affairs issues, European think tanks matters, energy contracts, EU delegation, EU watch keeper). Almost all EU-I are affected by credential leaks (email address | password) on pastebin-like websites. Several credential- harvesting attempts have also been detected. Attackers keep attempting to lure EU-I staff by employing custom methods such as spoofed EU-I email addresses or weaponisation of EU-I documents. Broader Threats • Critical infrastructure. In the energy sector, the US authorities have accused Russian actors of targeting critical infrastructure (including nuclear) for several years and are expecting this to continue in 2018. -
Regin Platform Nation-State Ownage of Gsm Networks
THE REGIN PLATFORM NATION-STATE OWNAGE OF GSM NETWORKS Kaspersky Lab Report Version 1.0 24 November 2014 2 Contents Introduction, history ..................................................................................................................................................... 3 Initial compromise and lateral movement .................................................................................................................. 3 The Regin platform ....................................................................................................................................................... 4 Stage 1 – 32/64 bit ............................................................................................................................................... 4 Stage 2 – loader – 32-bit ...................................................................................................................................... 7 Stage 2 – loader – 64-bit ...................................................................................................................................... 8 Stage 3 – 32-bit – kernel mode manager “VMEM.sys” ....................................................................................... 8 Stage 3 – 64-bit ...................................................................................................................................................... 9 Stage 4 (32-bit) / 3 (64-bit) – dispatcher module, ‘disp.dll’ ............................................................................... -
Stuxnet, Flame, and Duqu
Page 212 Part 4: Militarization A Fierce Domain: Conflict in Cyberspace, 1986 to 2012 Page 213 Stuxnet, Flame, and Duqu - the DLYMPIC GAMES succeeded in creating problems for a lirnited number of our centrifuges with the software they had installed in electronic parts."3 The Iranian government seemed to downplay the Chris Morton1 impact Stuxnet had on their systems, but a public adrnission of interference was ouc of Stuxnet emerged on the wořld stage in the sununer of2010 as the most sophisticated piece character for a government known for playing their nuclear program cards close to their chest. of malicious software ever found. Designed to permanently damage Iranian uranium enriclunent gas centrifuges, Stuxnet represented a quantum leap in complexity and Ultimately,Stuxnet rendered nearly 1,000 ofthe 9,000 IR-1 type gas centrifuges unusable audaciry in cyber conflict. Not only did the malware astonish researchers with its ab~ty to at the Natanz uranium enrichment facility.Whil e the computer virus <lid not cripple Iran's penetrate and cripple a secretive regime's sensitive nuclear enrichment prog~, 1t. ~so ability to enrich uranium, it is unclear how close Iran would be to producing a nuclear \ concerned security experts due to its brash destruction of part of a na non s cnttcal weapon without the Stuxnet infection.4 i infrastructure.With the emergence of the Duqu and Flame computer viruses, the revelation ofa covertAmerican cyber campaign (code- named OLYMPIC GAMES) against Iran, and Geopolitical Context the recognition of commonality between the three pieces of malware, Stuxnet became known as the centerpiece of a broader campaign, one that rnight hint at the future of On the international stage, Iran was perceived as a destabilizing force, accused ofs ponsoring warfare.