10 Major Security Threats 2014

2014 Edition 10 Major Security Threats ~ Information Security Is Getting Increasingly Complex…

Which Threats Are YOU Facing? ~

IT SECURITY CENTER (ISEC) INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN March 2014

This document is available for download at the following URL:

10 Major Security Threats 2014: ~ Information Security Is Getting Increasingly Complex… Which Threats Are YOU Facing? ~ http://www.ipa.go.jp/security/english/vuln/10threats2014_en.html Contents

INTRODUCTION ...... 2

CHAPTER 1. THREAT CATEGORY AND TREND ...... 4 1.1. Cyber Domain Issues ...... 5 1.2. Cyber Crime Through Virus and Hacking ...... 6 1.3. Internet-Based Scam and Crime ...... 7 1.4. Internal Control and Security Management ...... 8 1.5. Net Morality ...... 9

CHAPTER 2. 10 MAJOR SECURITY THREATS 2014 ...... 11 1st Espionage Operations through Targeted Attack ...... 12 2nd Unauthorized Login and Use of Services ...... 14 3rd Website Hacking ...... 16 4th Leakage of User Information from Web Services ...... 18 5th Unauthorized Online Banking Transfer ...... 20 6th Malicious Smartphone Applications ...... 22 7th Careless SNS Posting ...... 24 8th Information Leakage through Loss of Devices and Misconfiguration of Settings ...... 26 9th Fraud/Extortion with Virus Attacks ...... 28 10th Denial of Service ...... 30 Other Candidates for 10 Major Security Threats ...... 32

CHAPTER 3. EMERGING THREATS AND CONCERNS ...... 35 3.1. Growing Networked Devices ...... 36 3.2. Importance of End Point Security ...... 38 3.3. Internet Use among Increasingly Younger Ages ...... 40

APPENDIX： MAJOR SECURITY INCIDENTS AND NEWS IN 2013 ...... 42

Introduction This report ranks and explains the security threats observed through the security incidents, cyber attacks and changes in IT environment during the year 2013 selected by the vote of the 10 Major Security Threats Committee which consists of 117 information security experts. The ranks change every year depending on various factors and those factors are getting increasingly complex year by year.

 Changes in Threats The table on the next page shows the changes in the things like attack trend, IT environment and government policies from 2001 to 2013. Compared to 2001, it is apparent that threat factors IT defenders should watch out have increased in numbers and complexity. Following the changes in threats, new laws and policies have been enforced, and issues like national security and cybercrime investigation have begun to be recognized as new problem domains. As just mentioned, today’s “information security” has gone beyond the traditional matters such as virus, unauthorized access or security management, and new issues have begun to be defined from different angles in different fields and domains.  Trends in 2013 Overall, it can be said that 2013 was a year where problems in multiple fields and domains have become evident. One is that cyber attacks and crimes represented by targeted attacks have grown. Threats imposed by cyber attacks are also relatively growing, such as mega-leak of personal information, increasing website hacking and record-breaking large distributed denial of service (DDoS) traffic volume. Meanwhile, a number of inappropriate publications to social media like Facebook and Twitter have caused eruptions of criticism on the Internet. In these cases, not only individuals (publishers) but also their employers were accused of lack of supervision, which taught us that morality of individual Internet users can be a critical issue. Especially, the number of cases where minors are taken into custody or arrested is increasing, and criminal acts among increasingly younger ages are becoming a major social problem.  Future Challenges One of the changes in IT environment is an increase of Internet-connected devices, such as office equipment and smart home devices. With that, unauthorized access to and information leak from those devices due to improper settings have emerged. Protecting PCs and servers is not enough anymore. What we need to protect is now expanding to office equipment and smart home devices. We are at the time to rethink the fundamentals of security.

As we see, IT environment is evolving in various ways and generating new problems. What is important is that one assesses whether the threats impose a risk on one’s organization, understands problems and challenges, and takes appropriate

countermeasures. We hope you read this report and use the threats addressed here to assess risks those threats may affect you and your organization.

Table 1: Changes in Threats

Golden Age for Internal Control / Compliance Globalization of Threats Network Virus Fever 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013

★Windows XP Released ★iPhone Released ★iPad Released Cloud Computing / Mobile Devices IT Broadband Network Public Wireless LAN Environment Social Media Services

Targeted Attack Combined Attack Worm/ Network Virus Phishing Fraud Attacking Methods Botnet

Mobile Attack

Intelligence Stealing / Destruction

Attackers Pecuniary Gain / Industrial Spying

Crime for Fun Hactivism

・Nimda ・SQL Slammar ・DDoS Attack on U.S. & South Korea ・CodeRed ・MS Blaster ・Stuxnet Attack on Iran Incidents/ ・ Data Leak through P2P Software ・Attacks on Government Agencies Events ・Data Leak through Spyware ・Attacks on Financial Institutions

・NSA Suveillance Revealed

・Act on Prohibition of Unauthorized Computer Access Cyber Crime Crackdown ・Act on Electronic Signatures and Management System ・Unfair Competition Prevention Act Revised Certification Business ・Act on the Protection of ・Penal Code Revised Personal Information ・Act on Prohibition of ・Electronic Documents Act Unauthorized Computer Access Revised Laws/ ・ISO/IEC 27001 Published Policies ・Common Standards of Foreign Affairs / Information Security National Security Measures for Government Agencies Published ・National Strategy for Secure Cyberspace (U.S.) ・Public-Private Collaboration Launched ・U.S.-Japan Cooperation for Cyber Attack Response ・National Security Strategy Announced

Chapter 1. Threat Category and Trend Recently, terms like “cyber attack”, “cyberspace” and “cyber domain” have been often heard and many readers may feel confused about their relationship with traditional “information security”. The thing is, as seen from prevalence of internet services, changes in people’s life style such as wide used of social networking services (SNS) and smartphones, or international discussion on state-sponsored cyber attacks, challenges and environment surrounding information security are complexly evolving. If one focuses on just an attack, the overall picture of the attack or relationship between traditional information security and cyber issues, which have diversified into international politics, foreign affairs and national security and military sphere, will look very complex and be difficult to understand, making it harder to see and sort out the real problems. The word “cyber attack” could mean different things depending on individuals and organizations that use the word. It is important that one responds to threats based on the assessment - that which threats have impact on one and one’s organization in what way. Threats will not affect all individuals and organizations equally. Their impact changes depending on the attacker’s intention, organization’s operational environment and/or problem domains in which threats operate in. We recommend the readers keep this in mind and read the report thinking how each threat may affect you and your organization. In this report, we categorized problem domains into five groups shown in the figure below based on the background a threat emerges, intention and characteristics of the attacker, and property of the organization. The following sections will explain the characteristics and trend of each problem domain in more detail.

Problem Domains in Traditional Information Security New Problem Domains

Information and Telecommunication Services International Politics/ National Security Internet-based Cyber Crime through Scam and Crime Virus and Hacking Cyberspace (Domain) - InterfereIssues Military Ops - Website Hacking - Phony Invoice Scam - Interfere- National Military Secret Operation and - Unauthorized login - Social Media ID Theft - ClassifiedIntelligence-Information Stealing Stealing - Fraudulent Wire - Destruction- Destruction of Infrastructure of Social Transfer Infrastructure

Organizational Netiquette Security Management

Internal Control/ Net Morality Security Management

- Cyberbullying - Information Leak - Information Disclosure - Internal Threat on SNS - Natural Disaster - Operation Error

1.1. Cyber Domain Issues

Attacking/defending technologies are generally common but the implications differ

Attacking New Domain Techniques Cyber Attack Cyberspace Virus Infection (Domain)

Hacking Land, Sea, Air Space

Traditional Information Security Issues Foreign Affairs/National Security, Military Operational Issues Are Expanded

The idea of cyber domain (the fifth Cyber attacks are already a main theme domain) was defined by the U.S. in international politics and were addressed government in 2011, which suggested in the U.S.-China summit in June 2013. cyberspace was to be dealt at the level of International politics seek a way international politics and global commons, cyberspace is utilized safely by nations like just like other domains (land, sea, air and territorial lands and waters. space). It can be said that cyber attacks  National Security Issues have become a matter of international In Japan’s new National Security politics since then - because cyberspace Strategy announced in December 2013, has been recognized as a domain that can cyberspace protection has been integrated be used to achieve foreign affairs and into a national strategy. It defines cyber national security, or military campaigns. attacks as “theft of national secrets and Thus, it must be considered as a different intelligence”, “destruction of social issue from traditional information security. infrastructure” and “attacks intended to  Global Commons disrupt military systems” – meaning the International notion considers damages to national interests such as cyberspace as a global common1 like other stealing of classified information and domains. Today’s cyberspace is a place intellectual properties, or risks that may where everything from social to economic cause social chaos are assumed. They are to military operates. Nations have set out to now considered in the national security set the rules to ensure free access and framework as a factor that could threaten activities in cyberspace. society, economy and military operations.  International Politics In the days to come, necessary

1 arrangements will be preceded in various Global, shared resources that must be accessible by all nations and no nation is allowed to exclusively possess aspects both inside and outside of Japan.

1.2. Cyber Crime Through Virus and Hacking

Stealing information stored on PC with smartphones and tablets. The scope of the virus or hacking a server bypassing devices we need to make sure to secure is authentication is typical cyberattack getting larger. techniques. These attacks are likely  Popularization of Banking Services motivated by pecuniary gain and the scale A factor that has boosted for-profit cyber of the damage is getting bigger every year. crime can be popularization of online In one 2013 statistics 2 , 380 million banking and financial services. In 2013, people became a victim globally. In Japan, online banking fraud attracted a lot of it is said 4 million people fall into a victim attention. The number of cyber fraud annually, which means someone is cases where customers’ online banking exploited about every 10 seconds. credential is stolen and money in their Attackers operate globally on the Internet account is fraudulently wire-transferred is and target both businesses/organizations increasing. and individuals. Attackers use techniques that make full In cyber crime through virus or hacking, use of sophisticated computer science depending on the attacker, software technologies or tools available on the vulnerabilities or systems’ improper settings Internet and steal the information with are likely exploited. It is important to pecuniary value. implement appropriate security measures  Expansion to Smartphone/Tablet not only to PCs and servers but also every In recent years, targets of attacks are no single computer device that is connected to longer PCs and servers but expanded to the Internet and use them safely.

2 http://www.symantec.com/content/ja/jp/about/presskits/ 2013_Norton_Report.pdf

1.3. Internet-Based Scam and Crime

What!? But I’d better pay as I’m told…

Well, well. We’ve got another easy mark.

Hehehe…

A scam by tricking a person to steal  Social Media ID Theft money is traditional modus operandi and Aside from for-profit scams by fraudsters, still well used in so-called emergency scam there have been observed criminal (bank transfer scam) and business scam. behaviors possibly motivated by fun Now these fraudsters operate on the exploiting SNS. A major example is theft of Internet as well. social media ID, such as Twitter ID, of a  Phony Invoice Scam celebrity or actual company. Especially, Since about 10 years ago, scams like a because the year 2013 was the first year person receives a letter saying “Bill unpaid. that the ban on the Internet-based election Contact us as soon as possible.” or “We’ve campaign was lifted in Japan, many filed complaint.” aiming at tricking recipients candidates actively used blogs and SNS in to pay money have been widely observed. their campaign. Meanwhile, multiple As a variant, there is a scam called vogues SNS accounts used to impersonate one-click fraud where a thank-you-for- candidates and make false statement were signing-up-for-our-service message is reported. In some cases, celebrities were shown when a person clicks a link on a impersonated. These incidents have porn/dating site or in email, and the suggested a danger that one can easily message urges to pay high-price claiming a spread false information. contract has been completed (by clicking) and the person has legal obligation to pay The best defense against a scam on the the fee. Actually, the contract is not Internet is, just like in the real physical completed yet and the fraudster takes world, not to be fooled easily. People need advantage of the people’s ignorance or to be always cautious about the information weak point to siphon money. online when using the Internet.

1.4. Internal Control and Security Management

Corporate accounting scandals in early to the Internet increases, such as 2000’s triggered a discussion about internal multifunction printers/copiers, webcams control and compliance in Japan. Likewise, and cloud computing services, the cases establishing an information security have been reported where information is management system has been a popular unintentionally made accessible from the move among businesses and organizations outside due to misconfiguration of these since mid 2000’s. The basics of internal devices and services. Based on the control and compliance are to protect an advancement in smart home devises and organization’s information assets (i.e. data office equipment today, users need to be and systems) from intentional or accidental aware of their Internet connectivity and use leak, falsification, deletion and/or disruption them safely. by establishing security controls.  Natural Disaster and Operation Error  Rules and System Controls It is rare that organizations address The Internal control and security system outage caused by natural disaster management system is established, where or operational error in their security talk. the rules are set, education is provided, and However, among the incidents, these are control mechanisms are implemented to the most frequent causes and may impose the systems. For instance, when critical damage. Preparing a response information leak through Winny and lost system, contingency operation plan and PCs occurred frequently in mid 2000’s, recovery procedure in case for an accident measures like a ban on the use of Winny or is also an important security measure. mandatory use of encryption software were widely adopted. Internal control and security  Change in Data Leak Channels management play a critical role to ensure Traditionally, information leak was information security for businesses and caused mainly by accidental human errors organizations. As IT environment changes, such as through lost PC or USB memory threats and risks change as well. stick or mistakenly sent email. But as the Management system must respond and number of devices and services connected adapt to those changes.

1.5. Net Morality

Today, everyone, from small children to  Information Disclosure on SNS the elderly, uses the Internet-based Net morality is a serious problem not only services. The Internet has become at young student generation but also at absolutely indispensable for our everyday adolescent generation. With the life. On another front, as Internet population prevalence of SNS, we now have quite glows and services diversify, morality an environment where people can easily (etiquette and literacy) and Internet share private information or things behavior have been questioned. happened at work with others to receive  Education for Minors attention. However, to live in a society, As smartphones and online games we must show a certain level of morality. become popular, elementary-school and In 2013, a number of adolescents posted middle-school students are also a picture of their prank – for instance, a familiarized to the Internet. Meanwhile, young man lying inside a refrigerated ice underground social networking cream case during his part time job at a communities for young school students convenience store - and that developed have emerged, where students from the into a big social problem. In some cases, same school form a community and post in addition to the pranksters, the stores messages about their school and people were accused of employer liability and there anonymously, and cyberbullying has forced to close the stores. become a new social problem. Also, there have been the cases where middle-school When using the Internet, everyone has to and high-school students crazed with take all responsibility for his or her deed. online games to a fault hacked into other Unauthorized use of other people’s users’ account to steal their game items ID/Password will be charged under the Act and were charged with unauthorized on Prohibition of Unauthorized Computer access and/or running phishing websites. Access, and cyberbullying can be charged Criminal acts among increasingly younger with defamation. People must be well children are becoming a major social conscious of laws and morality, just like in problem. the real world, when using the Internet.

TOP SECRET

Chapter 2. 10 Major Security Threats 2014 Table 2 shows the ranking of information security threats that made a huge social impact in 2013. Selection and ranking of the threats were made by the 10 Major Security Threats Committee. This chapter describes each threat in detail and its likely targets (or, in other words, victims) are identified as “primary victim” and “secondary victim”. It should be noted that those targets may change depending on the factors, such as the attacker’s intentions and objectives, the form of the information systems and the user’s position/role expected in attack.

Table 2: The Ranking of 10 Major Information Security Threats 2014 No. Threat Category Espionage Operations through Targeted 1 Cyber Domain Issues Attack

2 Unauthorized Login and Use of Services Virus/Hacking Attack

3 Website Hacking Virus/Hacking Attack

Leakage of User Information from Web 4 Virus/Hacking Attack Services

5 Unauthorized Online Banking Transfer Virus/Hacking Attack

6 Malicious Smartphone Applications Virus/Hacking Attack

7 Careless SNS Posting Net Morality

Information Leakage through Loss of 8 Internal Control / Security Management Devices and Misconfiguration of Settings

9 Fraud/Extortion through Virus Attacks Virus/Hacking Attack

10 Denial of Service Virus/Hacking Attack

1st Espionage Operations through Targeted Attack ~ Both government agencies and businesses are targeted ~

Espionage Operations to steal classified information through the Internet are booming. Those attacks are targeting a wide range of organizations from government agencies to companies and becoming an issue of concern that threatens national interests and corporate management.

< Primary Victim> difficult to detect”. The impact of attacks Government agencies goes beyond information systems of Companies organizations, and the attacks become a diplomatic issue between nations.  Development into a Diplomatic Issue Nobody noticed that a secret agent had According to a report, in the U.S.-China infiltrated an organization and got away Strategic and Economic Dialogue held in with classified information. This sounds Washington D.C. in July 2013, the U.S. like a traditional espionage case in real Vice President made a strong request to space. Nowadays, espionage operations the Chinese government to stop cyber similar to this case are occurring in economic espionage. Such a story cyberspace, too. suggests that the U.S. government is A targeted attack that leverages email highly concerned with theft of classified as a mean to gain entry into a target information in cyberspace. system is often introduced as a relatively new type of attack, but it has been around Targeted attacks deploy various for more than 10 years. Exactly speaking, techniques, and they are executed it is just recent, perhaps the last 3 or 4 strategically in a well-planned manner. In years, that the damages caused by most cases, attacks are carried out targeted attacks became apparent and through the following steps. started to get people’s attention. What is (1) Planning troubling is that a “target does not notice it Select a target organization and draw is being attacked” and an “attack is up an attack plan such as reconnaissance

12 of target individuals there. has become increasingly difficult to (2) Preparation prevent attacks at the initial entry phase. Prepare virus and targeted emails. For, instead of exploiting known (3) Initial Entry vulnerabilities, the recent attacks which Send targeted emails to the above send emails with an executable file individuals and infect their PC with virus. attached or exploit zero-day It is confirmed some attackers infiltrated vulnerabilities are on the increase. into organizations via websites and/or VPN services in some methods.  Not Only Government Agencies But (4) Establishing a connection Also Companies Targeted Set up backdoors on the infected PC It has been observed that attacks are and establish a communication channel aimed at not only government agencies with the attacker. but also companies. According to “IBM (5) Penetration/Exploration Tokyo SOC Report”I, among all targeted Access the PC via a backdoor remotely, organizations, 37.7% of them were and explorer the internal systems/network government agencies and public bodies, and penetrate further. followed by financial institutions (16.4%), (6) Execution of the objective media (13.1%) and IT and telecom (8.2%). Steal the target information. In some This result is based on an observation of cases, falsify or delete the data. some emails and does not show the (7) Re-Infiltration whole picture. However, this indicates that Through the existing backdoors, access the attacks are targeting a wide range of and steal persistently. businesses.  Remote Hacking through Backdoor The point of this technique is that the  Implement System design measures internal systems are hacked through  Implement Anti-virus measures backdoors and the information is stolen. To mitigate the threat of targeted attack, Attackers often re-infiltrate through the it is important to implement both anti-virus backdoors they set up in the past and measures to prevent virus from infiltrating keep stealing information persistently. the system and system design measures Once infiltrated, the organization will to stop the attacker from exploring and suffer damage for a long time. penetrating further into the system. Since  Increased Sophistication in Initial an attack is conducted under a series of Entry Techniques scenarios, the defender must understand Just a few years ago, it was a common the threats at each phase, detect, and belief that taking proper vulnerability block the attacks. For more detail, see the countermeasures, namely updating PC System Design Guide for Thwarting software timely, would prevent initial Targeted Email AttacksII breach almost 100%. However, recently, it

References I. IBM Japan: 2013 First Half - Tokyo SOC Data Analysis Report http://www-935.ibm.com/services/jp/its/pdf/tokyo_soc_report2013_h1.pdf (in Japanese) II. IPA： System Design Guide for Thwarting Targeted Email Attacks https://www.ipa.go.jp/security/english/newattack_en.html

2nd Unauthorized Login and Use of Services ~ Secure password management is important! ~

In 2013, unauthorized login and consequent unauthorized use of services or information leakage occurred frequently. One of the causes of unauthorized login is reuse of passwords at the various websites. Users should use a different password for each website.

Unauthorized login leads to unauthorized Web service users use of services or leakage of personal information. If administrator passwords leaks, not only unauthorized use of the  Passwords under Constant Threat system in operation but also causing Various membership-based web secondary or tertiary damages, such as services use an ID/Password (ID/PW) theft of user passwords stored in the authentication method. ID/PW is a database, become possible. standard authentication method and  Password Management more works only when no one but the user Difficult Than Thought knows the password. Meanwhile, Password must be kept secret. because passwords enable attackers to However, people use a number of online impersonate a user of the password, they services these days and using a different are always after poorly protected password for each service is quite a passwords. burden for them. In one survey, 70% of  Impact of Unauthorized Login respondents answered the number of the In 2013, a number of cases were ID/PW pairs they can remember is, at reported where the passwords stolen most, 3I. Attackers exploit that. They steal from one web service were used for the ID/PW pairs used in one service and unauthorized login at different websites. attempt to abuse other services with the

14 pairs. Because many people reuse the is much higher than the success rate of ID/PW pairs, it results in a number of other attack techniques like brute force successful unauthorized accesses. attack. This confirms that password reuse attack is an effective attacking method.  Password Reuse Attack Password reuse attack deploys an  No reuse of passwords ID/PW list the attacker has illegally  Use of one-time password/two-factor obtained in some websites, and the authentication attacker attempts unauthorized access to Web service providers could reduce an account of the users who use the unauthorized access through password same ID/PW pair for multiple web reuse attack by hashing the password services. If the attacker abuses the with salt or blocking the consecutive login password of the user who reuses the attempts from the same host, for instance. same password in several websites, the Meanwhile, users should manage their attacker can use the web services in the password properly. For example, they sites without the user’s knowing by should set a hard-to-guess, complex impersonating the user. password for each web service and should not reuse passwords across sites.  Unauthorized Access through If it is difficult to memorize all passwords, II Impersonation they can write them down on some paper In 2013, a local credit card company or in a file that is accessible only to them reported that its members-only website and keep it secret so that no one will know. was breached. According to investigation, Managing passwords online using a a third party impersonated a user with his password manager or online notepad or her ID/PW it likely obtained from other may be convenient but they should bear web services and logged in to the site. in mind that those services could be  Risk of Password ReuseIII hacked. IPA issued a monthly security Services and systems that are of high awareness alert regarding password importance, like online banking services, management in August 2013. Some often provide authentication options such statistics showed that, in an online service as the use of one-time password or site, among 15,457,485 unauthorized token-based authentication. It is essential access attempts, 23,926 attempts, which to mitigate the risk of unauthorized access account for 0.15 percent, succeeded. and use of services by using as strong an 0.15 percent may sounds not much, but it authentication method as possible.

References I. Awareness Survey on Password Management by Individuals and Organizations https://www.verisign.co.jp/welcome/pdf/password_management_survey.pdf (in Japanese) II. Message from Orico about Unauthorized Access to e-Orico Service (Update) http://www.orico.co.jp/information/20131115.html (in Japanese) III. Security Awareness Alert August 2013 http://www.ipa.go.jp/security/txt/2013/08outline.html#5 (in Japanese)

3rd Website Hacking ~ PC infected with virus without user’s knowledge~

Welcome to Safe and Secure ●● Ltd. Website

2013 witnessed the increase in Website hacking. Website hacking is used as part of attack schemes to spread virus infection. Website administrators should keep in mind that the ultimate victim of website hacking is the visitors to their website, and, thus, take necessary security measures to prevent that.

indeed the legitimate websites - not Website administrators Website visitors spoofed ones – very few visitors suspect anything. Hence, the visitors are more likely to get infected with virus in this In 2013, hacking of government and method than in others. corporate websites increased dramatically.  Watering Hole Attack People may view website hacking as an Watering hole attack is a method to incident where images and information on infect PCs of the workers at the target a webpage are visibly altered. That is not organization with virus. Attackers falsify true in most cases. There, nothing is the websites the workers likely visit altered on the surface, but the malicious (watering holes) and insert malicious code which downloads virus is covertly code to the sites. It is named after an inserted into websites. The visitors to the ambush attack against animals that come falsified websites download virus without to an oasis in a desert. As the success their knowing, which leads to information rate of this attack is high, it is concerned theft from their PC or intrusion into their that it will become the main method of internal networks. virus infection.  Difficult for Visitors to Notice Since there seems to be nothing wrong Website hacking exploits with falsified websites and they are misconfiguration of web servers, software

16 vulnerabilities or admin accounts. Below website hacking incidents reached over are the most popular attack techniques. 4,000 in June and July 2013 – more than  Theft of login credential from Admin doubled compared to incidents from PC January to April 2013. The PC used by web administrators  Hacking of Websites hosted on gets infected with virus and their admin Rental Service ServersIII credentials are stolen. The attacker logs In September 2013, a local web server in with the credentials and falsifies the rental service reported that 8,438 web contents. websites had been falsified. The attack  Hacking of FTP/SSH Account exploited vulnerability in a WordPress Many websites use the FTP/SSH plugin among other things. The rental service for maintenance. However, when service vendor reported that through a using an ID/PW authentication method, malicious file uploaded by the attacker, the sites are vulnerable to attacks like the information of a configuration file password guessing and dictionary attack. (wp-config.php file) was obtained by the That vulnerability could be exploited, attacker, which allowed the attacker to which leads to unauthorized login and falsify the users’ database and websites. content hacking.  Exploitation of CMS Vulnerability  Secure Server If vulnerability in a content management  Secure accounts and password system (CMS) is exploited, websites  Keep software up to date created by the CMS can be falsified.  Take measures to resolve/mitigate Especially, if there is vulnerability in vulnerability in web applications popular CMS products, such as Attacks targeting a website exploit WordPress and Joomla!, the same attack misconfiguration of the system and/or technique can be used for a number of vulnerability in software. It is important to websites, leading to a large-scale attack I. take necessary measures to prevent  Exploitation of Vulnerability in Web vulnerabilities and conduct vulnerability Application assessments when developing and Vulnerability in web applications other configuring a website, and secure the web than CMS products can be exploited, too. server. It is also important to maintain the For example, if SQL injection vulnerability effort for proper operation and monitoring is exploited, the contents using databases at the operational phase such as keeping can be falsified. software up to date on a regular basis, managing access permission, and  Sharp rise in Website HackingII detecting unauthorized modification to the According to JPCERT/CC, monthly website.

References I. Security Alert for Website Falsification ~ Website Falsification Incidents Are Increasing Dramatically ~ https://www.ipa.go.jp/security/topics/alert20130906.html (in Japanese) II. JPCERT/CC Incident Response Report [October 1, 2013 ~ December 31, 2013] http://www.jpcert.or.jp/pr/2014/IR_Report20140116.pdf (in Japanese) III. Announcement: Falsification on Lolipop Hosted Websites http://lolipop.jp/info/news/4149/ (in Japanese)

4th Leakage of User Information from Web Services ~ Hackers steal user data from web services ~

Account List

During the first half of 2013, a number of membership-based web services suffered hacking attacks and a large volume of user information was stolen. If information leakage occurs at web services sites where a huge amount of personal and sensitive information like credit card data is stored, the ramifications are very huge. Thus, the services need to take adequate security measures.

online service sites are exposed to the Web service operators Web service users risk of unauthorized access and use of services. In that sense, mega leak is not a problem which affects the company of the Web services have become hacked site alone but a problem which indispensable for our everyday life. could have a big social impact. Meanwhile, their websites hold a wealth  Impact on Web Service Users of user information and, hence, are a Needless to say, the most affected perfect target for the attackers. Data victim of personal information theft is the leakage from PlayStation Network where users of the hacked web service. The personal information of more than 77 damages which the users may suffer are million users was stolen made headlines as follows: in 2011. Such “mega leaks” (massive  Spam emails information leakage) have often been  Fraudulent sale reported since then.  Financial loss caused by use of  Wide-Ranging Impact of Mega Leak stolen data of their credit cards The impact of mega leak goes beyond  Unauthorized login the hacked web service and its users. If a massive volume of password is stolen, The same attack techniques mentioned the attacker’s next move can be exploiting in the previous section (3rd Website those passwords to log in to other web Hacking) are often used. A technique services with the passwords. That means similar to that of targeted-attack has also not only the hacked website but also other been observed with which an attacker

18 infiltrates the internal system and steals that up to 150,165 credit card data might the web site information. have been accessed by an unauthorized  Exploitation of Vulnerability party who impersonated the customer(s)II. A web service is built on not just a In the latter half of 2013, Adobe Systems single software but several softwares that made headlines worldwide regarding data provide different service layers. The breach of credentials and encrypted credit attacker’s prime targets are vulnerabilities card data of 2.9 million customersIII. of the applications specially developed for  Data Leakage through Targeted the service or vulnerabilities for generic Attack applications such as open source Yahoo! Japan reported that up to about software. For example, web application 1.5 million passwords (encrypted by frameworks like Apache Struts 2 and irreversible encryption algorism) and a CMS software like WordPress tend to be part of the information required to reset targeted. passwords might have leakedIV. It is said  Targeted Attack a targeted attack breached a PC on the Not only a direct hacking but a targeted internal network and a malicious attack is also used where the attacker program was installed within the web sends emails to the target organization, service system through the opens a backdoor and infiltrates the compromised PC so as to steal data. internal system. After successfully sneaking into the internal system, the  Enforce network access control attacker explores the networks, gets into  Configure the server so as to use the web service system and steals the secure settings target information.  Keep OS and software up to date  Resolve/mitigate vulnerability  Mega Leak of Credit Card Data one To deal with e attacks targeting a after another website, it is essential to protect the web During the first half of 2013, a series of service properly by patching mega leaks of credit card data took place vulnerabilities in web system and one after another. An eyeglass retailer applications and using secure settings. JINS reported credit card data of 2,059 Also, to prevent unauthorized access to customers leaked from its online shop the web system through the machines due to the vulnerabilities in a server inside an organization, design/operational middleware, Apache Struts 2I. An online measures against targeted attacks should glossary store 7 Net Shopping announced be implemented.

References I. Important Announcement: Customer Data Leakage through Unauthorized Access to JINS Online Shop http://www.jins-jp.com/illegal-access/news.html (in Japanese) II. 7 Net Shopping: Possible Card Data Leakage ~ Up to 1.5 Million Customers Affected http://internet.watch.impress.co.jp/docs/news/20131029_621296.html (in Japanese) III. Important Customer Security Announcement http://blogs.adobe.com/conversations/2013/10/important-customer-security-announcement.html IV. Unauthorized Access to Our Server (May 17) (Yahoo! Japan) http://pr.yahoo.co.jp/release/2013/0523a.html (in Japanese)

5th Unauthorized Online Banking Transfer ~ Attackers have their eyes on your online banking credentials ~

●● XX Bank BANK

2013 saw the largest-ever number of unauthorized online banking transfer cases and the largest-ever losses, and such transfer drew public attention. The transfer involves theft of the user’s credential with phishing scam or virus, impersonation of a bank account holder and fraudulent wire transfer.

scope of the damage (targets) is Online banking users Banks, expanding. Credit card issuers ID/PW theft for unauthorized online banking transfer is carried out with a Unauthorized online banking transfer is phishing website or virus (malicious conducted through unauthorized login program). and use of the service by an attacker who  Phishing Website impersonates a legitimate account holder. (1) The attacker sends a user an email The attacker uses legitimate user impersonating an existing credentials they stole with phishing scam organization such as a bank or a or virus, logs into the service with the credit card issuer. credentials, and transfers money to his or (2) The attacker redirects the user to her account. The user usually does not the phishing website via the URL in find the transfer until checking the bank the email and tricks the user into balance, making detection often too late. entering the ID/PW for his or her In 2012, unauthorized online banking online banking account. transfer through phishing scams which (3) The attacker logs into the online targeted major banks caught public banking service using the stolen attention. In 2013, however, unauthorized ID/PW, impersonates the user, and online banking transfer was observed makes fraudulent wire transfers to among not only the major banks but also the attacker’s accounts. local banks and internet banks. The

 Credential-Stealing Virus use of one-time password, i.e. obtaining a (1) The user who neglects to patch new password for every session by email. vulnerabilities in OS or software However, there occurred incidents where unknowingly accesses a one–time passwords were stolen. It was virus-laden website set up by the confirmed that some users of free email attacker. services had had their ID/PW for the (2) The virus is downloaded and services stolen and their email messages, infects the user’s PC automatically. including the one with one-time (3) When the user accesses a target passwords, read by a third party. There online banking service, the virus actually happened fraudulent wire displays a fraudulent login screen transfers which seem to have resulted in the browser through a from use of one-time password obtained man-in-the-browser attack and this way. Banks tell their customers in steals the user ID, password and their websites that when obtaining second PIN. one-time passwords, they should not use (4) The attacker makes a fraudulent free email services and should receive it wire transfer using the information with devices other than PCs, such as a obtained in the step (3). cell phone and a smartphone. Credential-stealing virus was used in about 98% of unauthorized online  Keep OS and software up to date banking transfer incidents in 2013I.  Use anti-virus software  Use one-time password  Sharp increase in Loss Caused by  Know incidents and techniques Unauthorized Online Banking To prevent virus infection, it is most Transfer through Credential-Stealing important to use anti-virus software as VirusII well as to update timely software such as According to the report by the National JRE, Adobe Reader and Adobe Flash Police Agency, between January 2013 Player. and November 2013, loss caused by Some banks offer authentication fraudulent wire transfers from online methods other than ID/PW, such as banking accounts added up to about 12 one-time password and so on. It is billion yen. The loss was four times as recommended to use as strong an much as the one in 2011, which had seen authentication method as possible. the largest-ever loss in the past (0.38 It is also important for the user to be billions). security conscious and not to be easily  Theft of One-Time PasswordIII tricked - for example, not to open As a way to mitigate unauthorized suspicious attachments or not to enter online banking transfer, one can consider passwords carelessly.

References I. NPA: Unauthorized online banking transfers resulted in about 1.2 billion at 25 banks in 46 prefectures – financial losses four times as many as the largest losses in the past http://www.jiji.com/jc/zc?k=201312/2013121200517 (in Japanese) II. Damage and loss caused by unauthorized online banking transfer and unauthorized access https://www.antiphishing.jp/news/pdf/apcseminar2013npa.pdf (in Japanese) III. Security alert: how to protect your bank account from unauthorized online banking transfer http://www.rakuten-bank.co.jp/info/2013/130502.html (in Japanese)

6th Malicious Smartphone Applications ~ Data in your smartphone is being stolen~

There have been a series of incidents where smartphone applications which seem attractive but in fact contain malicious code steals information stored in a smartphone, such as the address book data without the owner’s knowing. The secondary damage has also been confirmed in which the stolen personal information is abused in cybercrimes such as spam operations and billing frauds.

 Personal Information Targeted Smartphone owners People in the The address book of a smartphone address book stores a huge volume of personal information. It contains other people’s names, phone numbers, email addresses Smartphones offer more various and and possibly the organization they belong useful features than cell phones. The to. In other words, the address book is a most distinctive feature of smartphones in collection of personal information of other comparison to cell phones is that users people. As well as the address book data, can install their favorite applications freely. a smartphone contains a lot of privacy There are various applications such as information such as call records, emails ones for practical purposes, ones for and GPS location information. The entertainment, and hobby. From children attackers spread malicious smartphone to senior citizens, they are used by applications and try to steal those data. various people. Meanwhile, the damages  Horror of Secondary Damage caused by malicious applications that Leakage of personal information affects steal the address book data are not only a smartphone owner but also increasing. people who are registered in his or her

address book. They would become a

22 target of marketing calls and spams, and MalwareI the damage will creep up on them later. Juniper Networks reported the number The smartphone owners should bear in of smartphone malwares increased 614% mind that they keep personal information from March 2012 to March 2013. This of other people and take proper security means about 276,259 malicious measures. applications are at large. It also reported that 92% of malicious applications were  Spreading Malicious Applications targeting Android OS. Most of attacks result from download  Data Theft from 810,000 and installation of a malicious application. Smartphones OwnersI In most cases, an attacker submits the About 810,000 smartphone owners application to the official application downloaded a malicious application that markets, pretends that it is an application disguised itself “anti-virus tool”. As a with a useful function, and induces the result, personal information of about 37 users to install the application into their million people registered in the address smartphone. Meanwhile, some attacks try book of the infected smartphones was to make the users install a malicious stolen. Using the address book data they application via email. The users cannot stole, the arrested perpetrators sent see a danger in malicious applications marketing emails to an unspecified that request access to the address book number of people three times and lured and mistakenly consider them useful. some of them to the website they set up,  Threats Other Than Personal and made about 389 million yen in sales. Information Theft In addition to theft of personal Smartphone users need to take the information, there are other threats following measures to avoid dangersII. involving malicious applications such as  Keep the smartphone OS up to date botnets and SMS Trojan horses. A new  Download applications only from virus has been reported that infects trustworthy providers. Make sure to neighboring smartphones via Wi-Fi and check user reviews/evaluations and Bluetooth and forms a big botnet. In other do not install suspicious applications countries, it is reported that a SMS Trojan  Set an Android smartphone not to horse sends messages to premium-rate install applications from unknown SMS numbers without the owner’s providers authorization. This compels the owner to  Check access control requests made pay the additional fee, which an attacker by the application when installing it to collects. Android smartphones  Keep applications up to date  Exponential Increase in Mobile  Use security software

References I. Marketing with malicious application: Data theft from 800,000 smartphone users - ＩＴ vendor executives arrested http://www.sponichi.co.jp/society/news/2013/07/24/kiji/K20130724006284570.html (in Japanese) II. Smartphone Security Guide http://www.ipa.go.jp/files/000011456.pdf (in Japanese)

7th Careless SNS Posting ~ Pranks and gaffes became a social issue ~

With the prevalence of SNS, more and more people have come to post their private information on the Internet easily. On the other hand, there were the cases where imprudent employees posted work-related information to SNS, and as a result, their employers (companies and organizations) suffered serious damage.

the employers suffered damage, such as Companies and organizations loss of customer confidence and business suspension.  Organization is a Group of Private As cell phones and smartphones Individuals become widespread, blog services and Needless to say, an organization is a SNS have expanded and become widely collective entity composed of private accepted as a self-expression or individuals, and keeping tabs on and communication tool. The emergence of controlling the private issues and morality Facebook and Twitter is said to have of each individual is quite impossible for revolutionized the way people the organizations. However, the communicate, enabling to post organizations must realize that private information for people around the world behavior of their employees can impact and establishing networks on various their business operation, and, thus, deal it themes. as a potential threat to their business  Line between Personal and continuity. Also, individuals are required to Professional Lives Has Disappeared behave appropriately with moral Meanwhile, there are an increasing standards of their society in mind. number of cases where careless posting about work-related information by One cause of those imprudent SNS employees caused a serious trouble to posts is that some SNS users and organizations/companies. Because what bloggers have misperceptions about the employees did (albeit in private) was consequences of their actions. antisocial and immoral, the supervisory  Growing Desire to Make One’s capability of their employers (companies Presence Known and organizations) was questioned and SNS is a tool that enables to broadcast

24 oneself to the public and make one’s store posted on Twitter some pictures of presence known to friends and himself laying inside a store’s ice cream acquaintances. However, if one has a freezerI. People who saw the pictures wrong idea about what one’s action could made comments on insanitation of the mean and how people would see it, one storeII. The similar incidents continued to could be bombarded with criticism. Once happen, and in some cases, the stores something is uploaded on the Internet, it were forced to close, the bakatters were cannot be erased completely and will sued, or a full blown damage suit was exist in some digital space semi filed against them. permanently. Before posting something,  Inappropriate Tweets by Bureaucrats people need to think calmly and carefully. In June 2013, a bureaucrat was  Unanticipated Diffusion of suspended for 30 days due to Information inappropriate tweets about a citizen group. With SNS like Twitter, information may He showed his real name and business spread more than the poster anticipated. career on his Twitter profile, which In most cases, the poster does not realize enabled the public to identify him. That how his or her posts may impact on the led to exposure of his pictures and videos public. It is important for the SNS users to on the Internet and subsequently wide understand the characteristics of SNS media coverageIII. In September 2013, and the possible consequences their another bureaucrat who repeatedly made posts have. rants and criticism in his private blog got  Misunderstanding of Privacy Settings suspended for 2 weeks. He did not make Some SNS users are not aware that the the real name or the agency he worked privacy settings of their posts are set to for open to the public, but got himself “public”, which means everyone can view identified by his blog entries. the posts. When only fiends or regular visitors make comments and respond to  Improve net morality of users the posts, some users mistakenly think  Educate employees that no people other than them view their  Establish rules on social media posts and therefore upload impudent usage posts. Companies and organizations should let their employees know that improper  Bakatters Become Increasingly A pictures and messages may cause a Social Problem social problem and damage to their Bakatter is a word coined with baka companies and organizations. Setting up (‘idiot’ in Japanese) and Twitter. Bakatter the policy and rules for SNS use could refers to those who tweet stupid selfies also be effective to deter problematic (pictures of themselves doing something posts as well as enforcing webfiltering stupid and unethical). In July 2013, a which is in accordance with the policy. part-time employee of a convenience References I. Laying inside an ice cream freezer and posting it on Twitter: a 19 year-old boy prosecuted by Gunma Police http://sankei.jp.msn.com/affairs/news/131018/crm13101813260004-n1.htm (in Japanese) II. A series of thoughtless pictures on Twitter – Seeking laughter in an increasingly extreme way and pranks http://sankei.jp.msn.com/affairs/news/130825/crm13082509050001-n1.htm (in Japanese) III. Ill-mouthed bureaucrat demoted and transferred to OSAKA - MIC: ‘No place in central government’ http://sankei.jp.msn.com/west/west_affairs/news/130724/waf13072413510015-n1.htm (in Japanese)

8th Information Leakage through Loss of Devices and Misconfiguration of Settings ~ IT Control by a system administrator becomes more and more difficult every year ~

Cloud Services Am I ： supposed to Default setting be able to see “Public on the web” this? Public… ○Shared Privately

Internet User

Special Project

Information leakage through loss of laptop PCs or USB memory sticks continue to occur. It was and still is one of the most common security incidents. Meanwhile, due to the prevalence of smartphones and cloud computing services, the methods, media and places to store data have become diverse. Accordingly, risk of information leakage has increased.

storage media is properly handled. Companies and Client organizations However, because the storage media is a organizations “physical media” and, thus, there is always a risk of loss or theft of the media, data leakage will continue to take place. Information leakage through loss of  Change in Cause of Data Leakage laptop PCs and other devices did and still In addition to loss or theft of physical do occur. Also, it has been one of the devices, unauthorized access to internal most common incidents. data by the external party due to  More Devices, More Channels for misconfiguration of the devices has been Information Leakage observed. This is due to the increase in Using a storage media like USB Internet-connected office equipment and memory stick and laptop PC, people use of cloud computing services. The risk increasingly take internal information of data leakage is getting bigger every outside the office to their clients and for year and the burden for administrators to other reasons. Also, as a smartphone and prevent it is becoming heavier. tablet become popular personal items, Under such an environment, leakage of copying such information to privately classified information due to the user’s owned devices is becoming easier. Data negligence or misconfiguration of devices leakage will not happen as long as the has the following impacts.

 Acquisition and abuse of classified settings was “Public”. They did not seem information by the third party to know that the default access level of  Loss of customer confidence and Google Groups was “Public”. business opportunities, and a  Internet-Accessible Multifunction negative impact on business Printers/CopiersII In November 2013, a news media  Loss and Theft reported that some multifunction Loss or theft of a storage media can be printers/copiers were accessible from the caused by the employee’s mistake or Internet. Many scanned or faxed negligence. Due to its size, a storage documents stored in those machines media like USB memory sticks is easy to contained personal information, which carry with as well as to lose. Meanwhile, was left publically accessible. since smartphones and laptop PCs are expensive, they can be stolen.  Establish rules on taking internal  Change in System Environment information outside the office (1) Development in Personal Mobile  Enforce the BYOD policy Environment  Educate users Personal Wi-Fi routers have rapidly  Understand the specification of the become prevalent. The employees bring services in use in their Wi-Fi router to office and connect  Manage accounts and access their work PC to the Internet with their privileges properly router. That creates a new channel for  Use encryption data leakage. The problem is that it takes It is essential to enforce the rules on place outside the control of the system taking storage media outside the office administrators. and make users understand how to use (2) Misconfiguration of Settings could computing services safely by People are increasingly using the educating them. Internet-connected devices and cloud In using cloud computing services, it is computing services. However, using such important to properly manage accounts devices and services without proper and access privileges not to disclose access control or authentication could data more than necessary. allow unauthorized access by the third When it comes to taking storage media party and result in data leakage. outside the office, it is also important to use software which encrypts data in  Publicly Viewable Google GroupsI notebook PCs or USB memory sticks In July 2013, it was found that Google so as to mitigate damage in case of Groups of several organizations were information leakage. publicly viewable since their privacy

References I. Government Agencies Accidentally Disclosed Internal Emails – Fail to Restrict Access to Google Groups http://www.nikkei.com/article/DGXNASDG10016_Q3A710C1CC0000/ (in Japanese) II. To Multifunction Printer/Copier Users: Comment on Reports about Security of Multifunction Printers/Copiers http://www.jbmia.or.jp/whatsnew/detail.php?id=294 (in Japanese)

9th Fraud/Extortion with Virus Attacks ~ Demanding Money with Fake Anti-Virus Software and Ransomware ~

To pay or not to pay... Pay ransom and I’ll free your PC!

Virus attacks with which the attacker uses ransomware that holds the user’s PC hostage and demands money to free the hostage PC have been increasing. If the PC is infected with ransomware, the user cannot access the data on his or her PC in some cases, which has a big impact on the user’s work and inflict severe psychological damage on the user.

allow the attacker to demand money. Internet users  A Dilemma between Making Payment or Giving up the Data A ransomware victim is forced to decide One day, all of a sudden, a PC which whether he or she pays money as the has been infected with virus becomes attacker demands or gives up the data. locked up and the user cannot access Sometimes the attacker does not free the files. Moreover, a message is displayed PC even after the payment is made. In on the screen like “Your PC has been such a worst case, the user loses both locked. You cannot access your PC till money and the data. you pay.” Such a type of virus, called Loss of Treasured Pictures “ransomware” that renders the PC A private PC stores files such as unusable and demands money, has been favorite video clips and music files the observedI. user has collected. Also, it often contains  Data Held Hostage and Ransom pictures of the family and friends and the Demanded loss of such precious files could inflict Ransom is payment demanded or made sever psychological damage on the user. for releasing a hostage. That is, On the other hand, a work PC contains ransomware is malware which holds the emails and work documents. The loss of data on the user’s PC hostage so as to them would result in severe damage in

28 business. increased rapidly and, in October 2013, were three times as many as the previous  Types of Ransomware month. Ransomware is divided into two types. CryptoLocker encrypts randomly and One type of malware locks up the screen lock files and the attacker sells the and renders the PC unusable whereas decryption key and tool with a hefty price the other encrypts the files on the infected tag (about 3 million yen). Since PC, USB memory sticks and shared CryptoLocker uses an advanced drives and makes them inaccessible. encryption technology, once infected, it is Both types demand money for unlocking impossible to decrypt without the or decrypting and force the victim to give decryption key. It is necessary to take the credit card information. Many precautions such as backing up important ransomware have a common files. characteristic that they impersonate a law enforcement agency when displaying a  Use anti-virus software message to demand payment.  Keep OS and software up to date  Infection Sources  Back up data Like other virus infection, ransomware Unless infected, no damage will be has several infection sources such as imposed. To avoid infection, it is essential hacked websites, malicious to use anti-virus software and keep OS advertisements, emails, and so on. It uses and other software up to date to fix infection techniques like tricking the user vulnerabilities timely. into installing virus and/or exploiting It is also important to keep in mind not software vulnerabilities. In some cases, to access suspicious websites or once infected, the hard disk must be carelessly click the links in email or on initialized to free it from virus, which websites. imposes a big loss and damage, including In addition, if there are important data, it time-consuming recovery work. is recommended to back them up periodically. Especially, it is necessary to  CryptoLockerII properly protect the shared network The latter half of 2013 saw widespread drives on a corporate’s internal system infections of a file-encrypting ransomware since important business data are stored called CryptoLocker. According to Trend there. Micro, the CryptoLocker infections

References I. More than 160 ransomware incidents confirmed http://www.sankeibiz.jp/business/news/131105/bsj1311050608002-n1.htm (in Japanese) II. What to do to avoid infection with CryptoLocker http://blog.trendmicro.co.jp/archives/8074 (in Japanese)

10th Denial of Service ~ Various ways to interfere services; users and organizations could become an accomplice without their knowledge ~

In 2013, the data at several Korean companies and government agencies were destroyed by virus, which rendered the systems unusable. Also, DDoS attacks that exploit open DNS resolvers to make them an attack platform have been a serious problem.

outage. Also in 2013, the largest-ever Companies and organizations DDoS attack, where 100 Gbps traffic had continued to strike the targets for nine hours, was observed. In today’s society highly dependent on IT service disruption has come to affect IT, providing stable and reliable IT our daily life as well. Moreover, for the services is one of the most important companies whose business transaction issues. However, despite the service takes place mainly on e-Commerce sites, provider’s effort, sometimes a service is service disruption may threaten their interfered by an attacker who tries to business continuity. cause service disruption or destruction of data. There are three typical attack The motives for attackers vary. It can be techniques. monetary gain, propaganda, nationalism,  DDoS or sabotage against adversarial nations or PCs infected with virus make up a organizations. “botnet”, a group of computers under the  Growth in Scale of Attack control of an attacker. The attacker The scale and damage of an attack commands his or her botnet to attack a have been growing every year. The target server periodically. The PCs of the large-scale DDoS attacks against the botnet access the server repeatedly, multiple major U.S. banks in 2012 which clogs the network bandwidth and, resulted in several hours of service consequently, renders the server

30 unresponsive. Today, there are even An open DNS resolver is a DNS server black markets for botnet business. It has that accepts recursive lookups from been observed that some criminal groups external, unspecified IP addresses. In contract for a DDoS attack or rent 2013, DNS amplification attacks were botnets. observed where the attacker exploited  Data Destruction open DNS resolvers and flooded the Virus that has infected a PC may inflict target with a huge volume of DNS harm, such as preventing the PC from responses. To mitigate or prevent such starting up or deleting data on the PC. attack, the administrators need to see if Data destruction is one of the techniques their network devices are configured with the attacker may employ to hamper the recursion disabled and manage them with service continuity. proper settings. Taking countermeasures  Email Bomb against attacks that exploit a The attacker sends huge volumes of misconfigured NTP (a time email to the target’s email address so as synchronization service) is also required. to overflow the mailbox. Since emails  Abuse of Contact FormIII from unknown senders are sometimes In 2013, anti-nuclear citizen groups expected, it is difficult to block only suffered cyber attack. The email unwanted emails effectively. addresses of the groups were used to sign up for email magazines and other  Cyber attack Incident in South KoreaI such services through web forms. Then, On March 20, 2013, the tens of tens of thousands of registration thousands of computers in several South confirmation emails were sent to the Korean banks and broadcasters were groups. suddenly shut down by malware attack and could not be restarted. At an  Secure server agricultural bank, about 4,500 ATMs,  Control communications which accounted for about the half of the  Use anti-virus software total, were affected and it took several  Keep OS and software up to date days to recover from the chaos. At the If DDoS communications have some broadcasters, the malware affected the characteristics, block the communications production of news shows. It spread at network devices. If a certain system is through a software asset management indeed critical, configure redundancy on system and was programmed to destroy the system. It is also important to avoid the data on a specific date and time. malware infection by using anti-virus  Open DNS ResolversII software and applying security patches.

References I. Cyber attacks by North Korea? Systems at South Korean broadcasters and banks simultaneously shut down http://www.yomiuri.co.jp/net/news1/world/20130320-OYT1T00480.htm (in Japanese) II. Security Alert for DDoS Attacks Exploiting Recursive Lookups https://www.jpcert.or.jp/at/2013/at130022.html (in Japanese) III. Tens of Thousands of emails sent to anti-nuclear citizen groups – Possibly cyber attacks http://www.asahi.com/special/news/articles/SEB201309190046.html (in Japanese)

Other Candidates for 10 Major Security Threats The following threats have not been ranked in the 10 major security threats, but are the candidates that also had a big impact on the society in 2013.

11th. Internal Threats/Rule Violation Many cases were reported where an employee/ex-employee with malicious intent obstructs business. Also, there are many cases where an employee sells information to the third party or use it personally. Malicious users already on the inside could inflict a wide range of effects without using advanced attack techniques. It is an internal control challenge to properly implement separation of duties and access controls.  Osaka city employee fired : used ex-boss’s ID for unauthorized access and falsify certificates http://sankei.jp.msn.com/affairs/news/131031/crm13103113550008-n1.htm (in Japanese)

12th. Theft of Online Game Items As smartphones get popular, online games have become prevalent. Attacks (unauthorized logins) that aim for virtual currency and/or items used in online games are increasing. In 2013, prosecution of junior high school and high school students were on the rise, and criminal acts among increasingly younger children are becoming a major social problem.  High School student prosecuted for unauthorized access charge / Gifu Police http://mainichi.jp/area/gifu/news/m20131114ddlk21040034000c.html (in Japanese)  40 percent of unauthorized access charge perpetrators were teens http://www.yomiuri.co.jp/net/security/goshinjyutsu/20130412-OYT8T00917.htm (in Japanese)

13th. SNS Account Spoofing/Spread of False Rumors There were reports that the attackers impersonated celebrities or big name companies on SNS and redirected viewers to specific websites such as promotional websites and online dating services. Impersonated persons and organizations would suffer from unexpected cost to appease the situation and loss from harmful rumors. In the U.S., an SNS account of a major news media was hijacked and false information on terrorism was spread, which led to drop in stock price.  Be aware: fraudulent “Official Disney” tweets redirect viewers to promotional websites http://nlab.itmedia.co.jp/nl/articles/1310/29/news116.html (in Japanese)  AP’s Twitter account hijacked – stock price dropped by false information http://www.nikkei.com/article/DGXNASGM2402U_U3A420C1EB1000/ (in Japanese)

14th. Cyber Defamation and Bullying Anonymity of the Internet has been abused to spread defamation, forgeries and/or obloquy through the Internet services like bulletin boards and SNS. Also, cyber bullying has become a serious social problem. Targeted individuals could suffer psychological damage

32 and loss of trust.  Perpetrators arrested: Believed obloquy on the Internet and announced murder on BB http://www.saitama-np.co.jp/news/2013/12/04/07.html (in Japanese)  High school student prosecuted for murder announcement on lawyer - “No grudge, just to enjoy attention” http://sankei.jp.msn.com/affairs/news/131209/crm13120913190003-n1.htm (in Japanese)

15th. Unauthorized Use/Eavesdropping of Wireless LAN Exploitation of non-password protected wireless LAN access points in crime, such as crime announcement, is becoming a serious social problem. Once the network is compromised, it is possible that devices on the network are attacked. Security-neglected wireless LAN can be eavesdropped as well. If tapped into, sensitive information can be leaked and/or credential information can be stolen.  For businesses to use wireless LAN safely http://www.soumu.go.jp/main_content/000199320.pdf (in Japanese)  Monthly Security Watch December 2013 – Prevent Someone from Piggybacking on Your Wireless LAN http://www.ipa.go.jp/security/txt/2013/12outline.html (in Japanese)

16th. Billing Fraud One-click billing fraud involving porn websites and online dating services does not go away. Billing fraud used to be done through postal mail, but as the Internet became prevalent, the use of IT channels, such as email, web browsers or smartphone applications has become a mainstream. In 2013, billing fraud bloomed by targeting individuals whose personal information was stolen via smartphone applications.  One-click fraud applications flooding at Google Play http://www.itmedia.co.jp/enterprise/articles/1304/04/news089.html (in Japanese)  How did you get my cell phone number? I thought it was free software but later charged 500,000 yen! http://www.kokusen.go.jp/mimamori/kmj_mailmag/kmj-support69.html (in Japanese)

17th. Natural Disaster/Operation Error In 2011, the Great East Japan Earthquake occurred. In 2012, the ramification of a cloud computing service outage was recognized. And in and after 2013, troubles caused by unexpected accidents and incidents continue to break out. A business continuity plan (BCP) that prepares for situations such as system outage and loss of backup data is required for IT systems.  GMO cloud service outage – Caused by fire at a data center in Taiwan http://itpro.nikkeibp.co.jp/article/NEWS/20130225/458681/ (in Japanese)  KDDI AU email service out of service for two and half days – Equipment failure and human errors suggested http://japan.cnet.com/news/business/35031332/ (in Japanese)

This page is intentionally left blank.

Chapter 3. Emerging Threats and Concerns Focusing on changes in our Internet environment and life style, this chapter addresses some emerging threats and concerns that are showing impact or beginning to show impact on the society. Table 3: Emerging Threats and Concerns No Title Growing Networked Devices 1 ~ Besides servers and PCs, any Internet-connected devices can be cyber attacked ~ Importance of end point security 2 ~ Keeping software up to date is a royal road to security~ Internet use among increasingly younger ages 3 ~ Minors could become both victim and perpetrator of cyber crime ~

System Administrator

Gonna use his account.

STOP! That’s a CRIME!

3.1. Growing Networked Devices ~ Besides servers and PCs, any Internet-connected devices can be cyber attacked ~

System Administrator

These days, devices at office and home are growingly connected to the Internet and providing convenient features like remote control and maintenance. On the other hand, new threats, such as data leak and device hijacking through the wrong settings, have emerged.

and for smart home devices, various things In recent years, office equipment and can be done such as setting a timer smart home devices that come with an recording remotely. integrated web server and are configurable  Facing Risk of Unauthorized Access and manageable through web interface are Being accessible through browser growingly increasing. (Internet) offers attackers an excellent (Office Equipment) opportunity as well, meaning that it enables  Multifunctional copier/printer attackers to access and exploit the devices.  Webcam Internet-connected devices generally use  NAS (Network Attached Storage) ID and password for user authentication  Router and are always threatened by unauthorized (Smart Home Devices) access.  Digital TV Let’s think about webcams in office. If  Blue-ray disk recorder hacked, an attacker can see (and possibly  Game players hear) everything in office, allowing the Users can access, change the settings, attacker to monitor 24/7. and check the data through browser. With If it is a multifunctional copier/printer or these devices being connected to the NAS, the Internet connectivity may allow an Internet, it becomes easier to access data, attacker to access print data and files on

36 the storage media remotely. Moreover, office equipment may be The root cause of these problems can be exploited as a platform to attack internal that users are unaware of threats, or they systems and used as a gateway to infiltrate do not even know the device is connected into them. to the Internet. Unlike usual IT devices, office equipment is not managed by the Actual security incidents regarding smart system management department and often home device and office equipment have put under the responsibility of its owner been reported. division or the general affairs department.  Baby Monitor HackingI This hinders the coordination with the In 2013, there was an incident where a system management department, which man hacked into a baby monitor remotely tends to result in neglected security. and shouted abuse at an infant. A baby monitor is a monitoring system to check out To use Internet-connected devices safely, babies through sounds and videos and it is important to carefully read the user’s often checkable through web interface. manual and properly configure the device. Normally, it is not directly on the Internet but Take the measures like below and mitigate on a home network to check up on babies the risk of unauthorized access. from other rooms. However, because it is (Network-Based Measures) set up on a (home) network that is  Unless absolutely necessary, do not connected to the Internet, there is still a risk connect the devices to the Internet of unauthorized access.  If connecting, use firewall and allow  Multifunction Copier/Printer Accessible only necessary communications to from the OutsideII pass. Put smart home devices on the In November 2013, a news media internal side of the broadband router. reported that multifunctional  Separate devices that need to access copiers/printers at some academic the Internet and those that are put on institutes were left accessible on the the internal network, and implement Internet. Multifunctional copier/printer access control. makers and an industry group issued a (Measures at Device Level) security alert. According to the media report,  Change the admin password from the received faxes and scanned documents default one. were full of private information and anyone  Enable an access control mechanism could access those documents and when accessed, require ID and password.

References I. Wired voice from kid’s room – Man hijacked webcam and shouted abuse (U.S.) http://www.cnn.co.jp/tech/35036051.html (in Japanese) II. Japan Business Machine and Information System Industries Association: Security alert for multifunction copiers/printers http://www.jbmia.or.jp/whatsnew/detail.php?id=294 (in Japanese)

3.2. Importance of End Point Security ~ Keeping software up to date is a royal road to security ~

Attacks in recent years mainly target end point devices such as PCs used by end users. Following emerging security threats, the security features of OS and software running on it have continued to be enhanced. Using the latest version of OS and software can make a big difference in terms of security.

devices such as the user’s PC. The concept of perimeter protection Communication channels necessary for (perimeter security) is military-origin and business operations, such as email represents an idea of protecting programs and web browsers, are difficult information assets by building a barrier to block, which makes end point security between an attacker and things to be even more important. protected. The basis of today’s information system follows this idea – it In attacks targeting end point devices, protects important assets by putting vulnerability in certain software, such as firewall between the Internet and intranet, Oracle Java (JRE), Adobe and additionally segmenting the internal Acrobat/Adobe Reader, Adobe Flash network with network devices. The idea Player, and Microsoft Office, are often of perimeter security seems a used. Because these software have a beautifully-designed security model, but huge user base and viewing its limitation has been pointed out. files/websites are essential things to do Attacks these days use the same with PCs, they are an excellent medium communication channels as the users to trap users. use for work, manage to get past the barriers, and directly attack end point To counter attacks targeting end point

38 devices, OS and application vendors have to the newer ones. However, it is very been enhancing the security features of important to understand that using the their software as threats emerge and newer version and updating software evolve. The vendors analyze recent attack regularly is one of the easiest and most techniques and security weaknesses in the effective ways to mitigate threats. current software, and reflect the analysis result into the security features of their The support for Windows XP, which had newer products. been the world’s dominant OS for more For example, Acrobat/Adobe Reader has than 10 years, ended on April 9, 2014 (JST). employed sandbox technologies 3 since The ramification of its end of support will Version Xl to limit the execution of not remain at just a “no more security malicious scripts and protect the system patches” but extend to the following from being affected. With this sandbox aspects. feature, it has become drastically harder for  End of Support for Windows XP attackers to embed malicious script into Applications Acrobat/Adobe Reader and infect end point Attackers’ favorite applications used on devices with virus. Windows XP, such as document software, The security features in Windows OS browsers and anti-virus software, will stop have also advanced gradually. As a result, their support for Windows XP sooner or depending on the version of OS, the later. Using those applications after their security strength differs. Since Windows support ends will gradually lower the Vista, Microsoft has added features that security level of the PC. prevent malicious programs from being  End of Maintenance Services executed, such as ASLR 4 and SEHOP, A help desk service for repair or which has reduced the risk of virus infection. maintenance service for Windows XP will According to the infection rates by OS end gradually as well. Thus, the data may published by Microsoft, Windows XP has be lost or work may be disrupted when the an infection rate of 11.3 versus 4.8% for PC is broken. Windows 7 (32bit). Updating software means that software To avoid the risks like the above, it is can now thwart the known attacks it had desired to migrate to a newer or alternate been defenseless against. Of course, it can OS with valid support. be possible to mitigate threats using some other security solutions instead of updating Reference I. The Risk of Running Windows XP After Support Ends in April 2014 http://blogs.technet.com/b/security/archive/2013/08/15/the-risk-of-running-windows-xp-after-support-ends.aspx

3 A security mechanism to prevent the system from being maliciously affected by running unverified programs from external entities in a tightly controlled secure area. 4 A technology to prevent the execution of malicious commands by randomizing the memory addresses for data.

3.3. Internet Use among Increasingly Younger Ages ~ Minors could become both victim and perpetrator of cyber crime ~

Gonna use his account.

STOP! That’s a CRIME!

As the Internet become more and more common among increasingly younger ages, there have been the cases where minors get caught in IT crimes. There have been also the cases where minors are taken into custody or arrested for IT crimes. The importance of cybersecurity education for minors is increasing.

people disclose their personal These days, elementary school information through LINE, a children are beginning to own a cell communication application that allows to phone/smartphone. Various and ample make voice calls and send messages for web contents are available for young free, and get in trouble. people, such as online games, learning Unfortunately, not all Internet users are materials and communication tools, “good guys”. There are “bad guys” who making the Internet common and popular are abusing the Internet for crimes. The among increasingly younger ages. society needs to teach Internet users from their early ages not to disclose The Internet is highly convenient, but personal information easily nor set a at the same time, its anonymity makes it meeting with strangers lightly. easy to exploit the Internet for crimes. In the past few years, minors have One of the reasons the young ages increasingly got caught in troubles engage with the Internet is the prevalence regarding “online dating services”. of online games. There are various types of According to the statistics for the first half online games from multiplayer fighting of 2013 released by the National Police games to virtual life games. With online Agency, 74 people got into a trouble via games, players can purchase “items” used online dating services, and even more in games. Recently, a number of cases surprisingly, most of the victims were have been reported where children buy minors. such game items without the consent of In addition to online dating services, their parents and the parents learn it with the cases are on the rise where young the receipt of a hefty bill later.

The National Consumer Affairs Center of phishing website or writing virus, have been Japan reports it had more than 3,000 observed as well. Since young children hotline calls regarding online game troubles may not be mature enough to tell right from for the 2013 alone as of the end of wrong, the society needs to teach IT November 2013. In one case, a boy (high literacy on regular basis. school sophomore) bought game items  Post Improper Information Online worth about 6,000 dollars. In another case, As introduced in chapter 2, minors have a grandson stole his grandfather’s credit been increasingly taken into custody or card and the grandfather received a bill of arrested for posting imprudent stuff online. almost 2,000 dollars. Some online games What is especially serious is are no fun without paid items. These cases “cyberbullying behavior” in which posting suggest that children seemed to lose bad things about or defaming pictures of themselves in games and caused damage others on bulletin boards. It is worth to their family. Parents need to understand mentioning that these acts are seen among the mechanisms of online games and elementary school students, too, and in discuss the family rules on playing online some cases, they were taken into custody. games with their children. A case in a high school resulted in a tragedy - an eighteen-year-old male While minors are getting caught in IT student committed suicide. crimes, the cases are on the rise where Besides cyberbullying, there have been minors are a perpetrator of IT crimes. the cases where junior-high and high  Unauthorized Access to Online Games school students were arrested for posting There are also the cases where addiction bomb threats or murder announcements on to online games or curiosity leads to bulletin boards. commit unauthorized access. Most Forms and motives vary, but commonly frequently observed cases are most culprits realize what they have done is unauthorized login attempts with ID and a crime only after they are taken into password of other users. custody or arrested. Moreover, some In one case, 3 twelve-year-old children people post imprudently because they are were taken into custody for unauthorized unaware that although anonymity is a access using a fellow student’s ID and characteristic of the Internet, a user can be password. The children said they wanted to identified through log data. check out the fellow student’s characters The society should teach children right and items. knowledge and manners for using the Not only unauthorized access with other Internet from their early ages. It is also users’ ID and password, but also the cases effective to use a parental control features where criminal acts that were built on provided by services and devices. deeper IT knowledge, such as setting up a

References I. Crime Statistics Regarding Online Dating Services - First Half of 2013 http://www.npa.go.jp/cyber/statics/h25/pdf02-1.pdf (in Japanese) II. National Consumer Affairs Center of Japan: Online Games http://www.kokusen.go.jp/soudan_topics/data/game.html (in Japanese) III. IPA: Learning Materials for Elementary/Junior-High/High School Students http://www.ipa.go.jp/security/keihatsu/videos/ (in Japanese)

Appendix ： Major Security Incidents and News in 2013

Jan 7 Bank of Tokyo-Mitsubishi UFJ issued a security alert for spam emails that try to steal credit card information.

Feb 10 Perpetrator of so called the “Remote Control Virus” hacking incidents arrested Feb 20 Trend Micro issued a security alert for cyber shill business using LINE

Mar 20 Several tens of thousands of PCs were cyber-attacked and shut down in Korea - Multiple businesses have been affected

Apr 19 Ban on the use of the Internet for election campaigning lifted

May 23 Yahoo! Japan announced the theft of 1,486,000 user records May 24 National Police Agency issued an alert for sharp increase in web hacking Jun 5 Edward Snowden disclosed NSA’s intelligence operations

Jul 10 Media reported several government agencies disclosed internal information through Google Groups

Jul 25 East Japan Railway Company apologized for not appropriately informing customers about its handling (selling) of SUICA history records Aug 1 IPA issued a security alert for increasing password list attacks

Aug 29 lollipop! server rental service hack led to hack of 8,438 websites

Sep 19 Advanced targeted zero-day attacks targeting Japan were confirmed

Oct 2 Customer information stolen through virus-infected ex-contractor’s private PC Oct 3 Japan-United States Security Consultative Committee (“2+2”) agreed on the cooperation in the cyberspace

Nov 15 Following a media report on information leak through multifunction printer/copier, manufacturers issued a security alert on the issue

Dec 12 Annual loss caused by online banking fraud added up to about 1.2 billion yen (National Police Agency) Dec 17 National security strategy endorsed by the Cabinet. Cyber space now a national domain to protect.

[ Produced and Copyrighted by ] Information-technology Promoting Agency, Japan (IPA）

[ Editor ] Masashi Ohmori

[Illustration] Hitachi Document Solutions Co., Ltd.

[ iAdvisor ] 10 Major Security Threats Committee

[ iiAuthori ] Masashi Ohmori Motohiro Namahishi Noriko Tanamachi

2014 Edition

10 Major Security Threats

~ Information Security Is Getting Increasingly Complex...

Which Threats Are YOU Facing? ~

March 17, 2014 First Edition

[Publication] Information-technology Promotion Agency, Japan

16F, Bunkyo Green Court Center Office,

2-28-8, Honkomagome, Bunkyo-ku,

Tokyo, 113-6591 Japan

http://www.ipa.go.jp/index-e.html

IT SECURITY CENTER (ISEC) INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN

16F, Bunkyo Green Court Center Office 2-28-8 Honkomagome, Bunkyo-ku Tokyo, 113-6591 Japan TEL：03-5978-7527 FAX：03-5978-7518 http://www.ipa.go.jp/security/english/index.html