Cisco 2009 Midyear Security Report
Total Page:16
File Type:pdf, Size:1020Kb
Cisco 2009 Midyear Security Report An update on global security threats and trends 1 Introduction 4 Online Security Risks 16 Vulnerabilities Cause for Concern: Technical Innovation and Trends The Weak Links in Social Networking of Online Criminals Malware: Conficker Combines Old Mac OS: Online Criminals Move Beyond Windows Cause for Concern: Criminal Sophistication and New Threats Cloud Computing: Protecting Data in the Cloud and Collaboration Prolific Spammers Caught and Indicted Productivity Applications: Targets of Cause for Optimism: Organizations Collaborate “Spamdexing”: SEO for Online Criminals Zero-Day Exploits to Shut Down Online Threats Financial Information Targeted by Top Alerts: January–June 2009 DNS Poisoning Web 2.0 Security: Filtering Dangerous Content Recent Social Engineering Spam Campaign: Swine Flu Conversations with a Botmaster 20 Data Loss and Compliance Botnets: The Rise — and Fall — of Data Loss Srizbi/Reactor Mailer Identity Theft The Takedown of Srizbi/Reactor Mailer Data Breaches Waledac: Storm 2.0 Insiders Battling the Botnets Web 2.0 Collaboration Quandaries and Mobile Device Threats: Text Message Scams Mobile Device Dilemmas U.S. Government: A New Administration, Compliance a New Focus on Cybersecurity HIPAA Gets HITECH The President’s Smart Phone “Addiction” New “Red Flags” Rules Technology: An Engine of U.S. Growth for the Securing Data Next “New Economy” Policies Geopolitical: Twitter Users Are Broadcasting the Revolution Economic Instability and Online Security 25 Conclusion and Recommendations Conclusion Security Community Making Strides Trends to Watch Spam to Return to Record High Levels More Attacks on Legitimate Websites Social Networking Attacks to Continue Recommendations Cisco Security Intelligence Operations All contents are Copyright © 2009 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. As the global economy struggles to regain its footing, Security industry watchers also point to the methods Introduction one moneymaking sector remains healthy—online crime. used by Conficker to propagate and create the botnet. This sector embraces technical innovation, collaborates Instead of using newer approaches that involve social with like-minded enterprises to develop new strategies engineering, or delivering the payload via email or the for generating income, and continues to demonstrate Internet, Conficker’s creators exploited a vulnerability in adoption of the best legitimate business strategies to the Windows operating system. This was an “old-school” maximize profits. method that may not have seemed threatening, given Criminal sophistication and business acumen have the preponderance of new tactics for online scams. increased since the publication of the Cisco 2008 Annual Conficker’s creators appear to have recognized that Security Report. For instance, criminal enterprises are their entry point into computer systems might yield more innovating new business models with the creators of satisfying results. botnets—networks of compromised computers that It’s safe to say online attacks will continue to showcase can carry out the bidding of online scammers. These the most cutting-edge technology—and criminals will innovations include “botnets as a service,” a sobering spin try to use older tactics in new ways. Criminals are also on the software-as-a-service trend that has spread across closely watching security researchers and learning from the technology sector. their methods for thwarting attacks, putting the “good guy” “We see many signs that criminals are mimicking the knowledge to use so their next attack can evade existing practices embraced by successful, legitimate businesses protections. to reap revenue and grow their enterprises,” said Tom Cause for Concern: Criminal ® Gillis, Vice President and General Manager of Cisco The Cisco Midyear Security Report Security Products. “It seems the best practices espoused Sophistication and Collaboration presents an overview of Cisco security by Fortune magazine and Harvard Business School have “Bad guys” are aggressively collaborating, selling each other their wares, and developing expertise in specific intelligence, highlighting threat information found their way into the online underworld.” tactics and technologies. Specialization makes it tougher and trends from the first half of 2009. The Cause for Concern: Technical to shut down illegal activity, because there are many report also includes recommendations from Innovation of Online Criminals players in this ecosystem. Cisco security experts and predictions of The technical innovation and capabilities of online Consider the collaboration between the creators of two criminals are remarkable. The Conficker worm, which large botnets, Conficker and Waledac see( page 10). In how identified trends will evolve. began infecting computer systems in late 2008 and early April, the Conficker botnet monetized itself by delivering 2009 (and is still infecting thousands of new systems daily), the Waledac malware via Conficker’s own hosts, along with provides the best example. Several million computer scareware—scam software sold to consumers based systems have been under Conficker’s control at some on their (often unnecessary) fear of a potential threat—to time as of June 2009, which means the worm appears to generate revenue from victims. In other words, Conficker have created the largest botnet to date. (Read more about served as a large-scale distributor for Waledac’s wares. Conficker on page 4.) All contents are Copyright © 2009 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Cisco 2009 Midyear Security Report 1 The Conficker-Waledac collaboration is an example of the researchers learned that botnets can be sold off at a given networked and persistent threats that will likely become price per “node” or infected system. As botnet creators more prevalent. The threats are networked because they become more capable of operating in stealth mode for involve at least two enterprises collaborating with each longer periods of time, they will be able to earn more other for illegal purposes, and they are persistent because money before the botnets are detected and dismantled. the same attacks are launched from the same hosts over Depending on situation and opportunity, those who a long period of time—which means they can inflict engage in online attacks have also been known to both greater damage. collaborate with, and target, each other. One security Cisco security experts expect to see cyber criminals researcher discovered that a major botmaster used an engaging in similar joint ventures in the coming months. online forum to ask other criminals for help after his own In fact, they have located online advertisements that offer botnet was hacked. other criminals the ability to access existing botnets. In a recent online conversation with a botmaster, Cisco Cause for Optimism: Organizations Collaborate to Shut Down Online Threats As online criminals constantly adapt and refine their techniques for reaping illegal revenue, security profes- sionals and individual computer users must become even more sophisticated in their own approaches to combating security threats. There are encouraging signs that aggressive “good guy” collaboration can succeed. The Conficker Working Group is an excellent example. The group was founded in early 2009 as the Conficker botnet continued to spread, and now boasts more than 100 security organizations (including Cisco) as members. The group’s website (www.confickerworkinggroup.org) publicizes news about recent Conficker infections, the latest patches to block the Conficker worm, and tests to check for infection. The collaborative efforts of Conficker members helped disrupt most of the worm’s activities earlier this year (see page 5). As these advertisements indicate, online criminals see revenue opportunity in selling or renting out botnets. 2 Cisco 2009 Midyear Security Report All contents are Copyright © 2009 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information. Another positive example is the crippling of the Srizbi/ According to the Cyberspace Policy Review report Reactor Mailer botnet (see page 9). One Internet hosting released by the White House in May 2009, the United company, McColo, hosted the Reactor Mailer command States looks to “harness the full benefits of innovation to and control infrastructure that controlled Srizbi/Reactor address cybersecurity concerns . [and] develop the Mailer. After an aggressive campaign documenting policies, processes, people, and technology required to McColo’s activities, the company’s upstream Internet mitigate cybersecurity-related risks.” The report also notes providers terminated McColo’s service. Once McColo that the country “faces the dual challenge of maintaining was shut down, worldwide spam volumes plummeted. an environment that promotes efficiency, innovation, However, Srizbi/Reactor Mailer was able to shift its economic prosperity, and free trade while also promoting operations to a hosting company based in Estonia, and safety, security, civil liberties, and privacy rights.” spam volumes originating from the botnet rose until The United States is not alone in its desire to improve Microsoft’s Malicious Software Removal Tool (MSRT) cybersecurity and prevent cyber criminals from achieving disabled the majority of the bots. The availability of the success. Because these are issues of global concern, it is MRST demonstrates how coordinated