DOCSLIB.ORG

Digitaalisen Kybermaailman Ilmiöitä Ja Määrittelyjä

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Digitaalisen Kybermaailman Ilmiöitä Ja Määrittelyjä DIGITAALISEN KYBERMAAILMAN ILMIÖITÄ JA MÄÄRITTELYJÄ PROF. MARTTI LEHTO V 15.0 6.4.2021 JYVÄSKYLÄN YLIOPISTO INFORMAATIOTEKNOLOGIAN TIEDEKUNTA 2021 ALKUSANAT Euroopan komissio analysoi pohdinta-asiakirjassaan kesällä 2017 tulevaisuuden uhka- maailmaa. Sen mukaan teknologian kehitys muuttaa merkittävästi niin turvallisuuden kuin puolustuksen luonnetta. Big data, pilviteknologia, miehittämättömät ajoneuvot ja tekoäly muokkaavat yhteiskunnan eri rakenteita aina turvallisuuteen ja puolustukseen saakka. Tämän verrattain helposti saatavilla olevan teknologian käyttö mahdollistaa epätavanomaisten, valtioiden rajat ylittävien ja epäsymmetristen uhkien nopean kas- vun. Näitä ovat muun muassa hybridi- ja kyberuhat, terrorismi sekä kemialliset, biologi- set ja radiologiset iskut. Internetin käyttäjien määrän nopean kasvun myötä kyberrikol- lisuus ja terroristien internetin käyttö ovat 2000-luvulla muokanneet merkittävästi digi- taalista toimintaympäristöä.1 Digitaaliteknologia muuttaa ihmisten elämää. EU:n digitaalistrategian tavoitteena on valjastaa digitalisaatio palvelemaan ihmisiä ja yrityksiä sekä tukemaan tavoitetta tehdä Euroopasta ilmastoneutraali vuoteen 2050 mennessä. Komissio on päättänyt tehdä ku- luvasta vuosikymmenestä Euroopan "digitaalisen vuosikymmenen". Euroopan on nyt lu- jitettava digitaalista suvereniteettiaan ja asetettava standardeja sen sijaan, että se kul- kisi muiden jäljissä. Painopisteinä ovat data, teknologia ja infrastruktuuri.2 Euroopan komissio ja unionin ulkoasioiden ja turvallisuuspolitiikan korkea edustaja esit- tivät 16. joulukuuta 2020 uuden EU:n kyberturvallisuusstrategian. Strategia liittyy kiin- teästi tiedonantoon Euroopan digitaalista tulevaisuutta rakentamassa sekä Euroopan elpymissuunnitelmaan ja EU:n turvallisuusunionistrategiaan. Tavoitteena on parantaa Euroopan kollektiivista kykyä sietää kyberuhkia ja varmistetaan, että kuluttajat ja yrityk- set voivat saada täyden hyödyn luotettavista palveluista ja digitaalisista työkaluista. Oli kyse sitten eurooppalaisten käyttämistä verkkoon liitetyistä laitteista, sähköverkoista tai pankeista, lentokoneista, julkishallinnoista ja sairaaloista, kaikilla on oikeus käyttää niitä tietoisina siitä, että heidät on suojattu kyberuhilta. Uusi kyberturvallisuusstrategia antaa EU:lle myös mahdollisuuden vahvistaa johtajuut- taan kybertoimintaympäristön kansainvälisissä normeissa ja standardeissa ja tiivistää yhteistyötä kumppaneiden kanssa eri puolilla maailmaa edistääkseen maailmanlaa- juista, avointa, vakaata ja turvallista kybertoimintaympäristöä, joka perustuu oikeusval- tioperiaatteeseen, ihmisoikeuksiin, perusvapauksiin ja demokraattisiin arvoihin. Komissio esittää lisäksi ehdotuksia, jotka koskevat kriittisten yksiköiden ja verkkojen ky- kyä sietää sekä kyberuhkia että fyysisiä uhkia: nämä ovat direktiivi toimenpiteistä kyber- turvallisuuden yhteisen korkean tason varmistamiseksi unionissa (tarkistettu verkko- ja tietoturvadirektiivi eli ”NIS 2”) ja uusi direktiivi kriittisten yksiköiden häiriönsietokyvystä. Ne kattavat monia aloja, ja niillä pyritään puuttumaan nykyisiin ja tuleviin verkossa ja 1 Euroopan komissio, Pohdinta-asiakirja Euroopan puolustuksen tulevaisuudesta, 2017. https://www.eduskunta.fi/FI/tiedotteet/Sivut/komission-pohdinta-euroopan-puolutuksen-tulevaisuu- desta.aspx 2 https://ec.europa.eu/info/strategy/priorities-2019-2024/europe-fit-digital-age_fi sen ulkopuolella esiintyviin riskeihin aina kyberhyökkäyksistä rikollisuuteen tai luonnon- katastrofeihin johdonmukaisella ja toisiaan täydentävällä tavalla. Teknologian kehitys ja digitalisaation vaikutukset ilmenevät myös suomalaisissa turval- lisuusasiakirjoissa. Vuoden 2017 puolustusselonteossa kyberympäristön merkityksen todetaan kasvavan. Puolustusselonteon mukaan kyber- ja informaatiovaikuttamista on kohdistettu Suomeen muun muassa kriittistä infrastruktuuria, teollisuuslaitoksia sekä poliittista päätöksentekojärjestelmää ja kansalaisia vastaan3. Vuoden 2020 Valtioneuvoston ulko- ja turvallisuuspoliittisen selonteon mukaan ”Hybri- divaikuttaminen on lisääntynyt ja monimuotoistunut, minkä takia siitä on tullut aiempaa suurempi turvallisuusuhka. Hybridivaikuttamisessa valtiollinen tai muu ulkoinen toimija pyrkii vaikuttamaan samanaikaisesti tai jatkumona, suunnitelmallisesti ja eri keinoja käyttäen kohteen haavoittuvuuksiin omien tavoitteidensa saavuttamiseksi. Keinovali- koima on laaja, ja siihen kuuluu muun muassa poliittisia, diplomaattisia, taloudellisia ja sotilaallisia keinoja sekä informaatio- ja kybervaikuttamista. Vaikuttaminen on vahingol- lista ja sitä pyritään tekemään niin, että se on kiistettävissä.4 Elektronisen sodankäynnin, informaatiosodankäynnin ja kybersodankäynnin operaatiot muodostavat viitekehyksenä kyberajan ei-kineettisten verkostoperustaisten operaatioi- den kokonaisuuden. Sodankäynnissä nämä operaatiot muodostavat verkottuneen koko- naisuuden, jossa eri operaatiomuotojen avulla pyritään saavuttamaan sodankäynnille asetetut tavoitteet usein osana hybridivaikuttamista. Kyberympäristöstä on tullut erot- tamaton osa niin nykyajan sodankäyntiä kuin turvallisuuden kokemista. Kybermaailman kehitys ei ole irrallinen ilmiö vaan se yhdistyy vahvasti yhteiskuntara- kenteisiin ja eri turvallisuustoimijoiden tarpeisiin ja odotuksiin. Kehitykselle on omi- naista nopeus sekä tietynlainen arvaamattomuus tulevaisuudesta. Kybermaailmaa ja teknologian kehitystä ei myöskään tule nähdä pelkästään uhkien näkökulmasta vaan teknologia tuottaa uudenlaisia ratkaisuja ja toimintamalleja turvallisuuden tuottami- seen. Uusista teknologisista ratkaisuista otetaan käyttöön ne mitkä parhaiten tuottavat lisäarvoa, tehokkuutta ja vaikuttavuutta. Digitaaliset ratkaisut tulee toteuttaa ”Cyber Se- curity by Design” -periaatteella, mikäli todella halutaan lisätä kansallista kyberresiliens- siä. Tämä materiaali sisältää digitaalisen kybermaailman määrittelyä ja rakenteita, kuvauk- sen yhteiskunnan kriittisistä rakenteista, kyberuhkataksonomian määrittelyn (kybervan- dalismi, -rikollisuus, -tiedustelu, - terrorismi, -sabotaasi ja -sodankäynti), kyberturvalli- suuden juridisia näkökulmia ja lopuksi perusteita kyberturvallisuuden rakentamiseksi. 3 Valtioneuvoston kanslia. 2017. Valtioneuvoston puolustusselonteko, Valtioneuvoston kanslian julkaisu- sarja 5/2017. 4 Valtioneuvoston kanslia. 2020. Valtioneuvoston ulko- ja turvallisuuspoliittinen selonteko, Valtioneuvos- ton julkaisuja 2020:30, 29.10.2020. KUVIOT KUVIO 1 Kybermaailman viitekehys ............................................................................... 13 KUVIO 2 Internetin kolme kerrosta ................................................................................ 15 KUVIO 3 Esineiden internetin eri elementit (Al-Fuqaha et al., 2015) ............................ 16 KUVIO 4 Mirai Botnet arkkitehtuuri (McAfee Labs Threats Report, 2017) .................... 18 KUVIO 5 Kybermaailman viisi kerrosta ........................................................................... 21 KUVIO 6 Yhteiskunnan elintärkeiden toimintojen turvaaminen eri uhkia vastaan ....... 23 KUVIO 7 Kyberuhkien rakennemalli ............................................................................... 26 KUVIO 8 Kyberuhkien keskinäisvaikutusmalli (ENISA, 2012) ......................................... 28 KUVIO 9 Kybertoimintaympäristön haavoittuvuuksia ................................................... 29 KUVIO 10 Yhdysvaltalainen näkemys kriittisestä infrastruktuurista .............................. 33 KUVIO 11 Kyberaseen periaatteellinen rakenne ............................................................ 35 KUVIO 12 Hyökkäystavat kybermaailman eri kerroksiin ................................................ 38 KUVIO 13 Kyberhyökkäyksen yleinen malli .................................................................... 44 KUVIO 14 Kriittinen infrastruktuuriverkosto vuorovaikutussuhteineen ........................ 46 KUVIO 15 SCADA-rakenne .............................................................................................. 48 KUVIO 16 Kyberrikollisuuden muotoja ja päivittäinen aktiivisuus ................................. 54 KUVIO 17 Kyberrikollisuuden alueellinen jakautuminen 2017 ...................................... 54 KUVIO 18 Kybertiedustelu, kybervakoilu ja tietojen kokoaminen ................................. 59 KUVIO 19 Stuxnetin toiminnallisuus ............................................................................... 69 KUVIO 20 Ei-kineettisen sodankäynnin evoluutio 1900-luvulta lähtien ........................ 77 KUVIO 21 Ei-kineettisen sodankäynnin toimintaympäristö ........................................... 79 KUVIO 22 ISO27005: Riskien käsittely .......................................................................... 103 KUVIO 23 Kyberuhkien ja riskien hallinnan kokonaisuus ............................................. 106 KUVIO 24 Kyberhäiriötilanteiden hallinta .................................................................... 108 KUVIO 25 Kyberturvallisuus, toiminnallisuus ja käyttömukavuus ............................... 110 KUVIO 26 Uusien teknologioiden mahdollistamia kyberturvallisuusratkaisuja ........... 111 KUVIO 27 Kyberturvallisuusarkkitehtuurin yleinen rakennemalli ................................ 120 KUVIO 28 Kyberturvallisuuden teknologiatekijät vs. inhimilliset tekijät ...................... 121 KUVIO 29 Yhteiskunnan kriittiset rakenteet ................................................................ 123 TAULUKOT TAULUKKO 1 Kyberhyökkäysmenetelmiä ja tekniikoita ................................................
Load more

Recommended publications
  • Ransom Where?
    Ransom where? Holding data hostage with ransomware May 2019 Author With the evolution of digitization and increased interconnectivity, the cyberthreat landscape has transformed from merely a security and privacy concern to a danger much more insidious by nature — ransomware. Ransomware is a type of malware that is designed to encrypt, Imani Barnes Analyst 646.572.3930 destroy or shut down networks in exchange [email protected] for a paid ransom. Through the deployment of ransomware, cybercriminals are no longer just seeking to steal credit card information and other sensitive personally identifiable information (PII). Instead, they have upped their games to manipulate organizations into paying large sums of money in exchange for the safe release of their data and control of their systems. While there are some business sectors in which the presence of this cyberexposure is overt, cybercriminals are broadening their scopes of potential victims to include targets of opportunity1 across a multitude of industries. This paper will provide insight into how ransomware evolved as a cyberextortion instrument, identify notorious strains and explain how companies can protect themselves. 1 WIRED. “Meet LockerGoga, the Ransomware Crippling Industrial Firms” March 25, 2019; https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/. 2 Ransom where? | May 2019 A brief history of ransomware The first signs of ransomware appeared in 1989 in the healthcare industry. An attacker used infected floppy disks to encrypt computer files, claiming that the user was in “breach of a licensing agreement,”2 and demanded $189 for a decryption key. While the attempt to extort was unsuccessful, this attack became commonly known as PC Cyborg and set the archetype in motion for future attacks.
    [Show full text]
  • Minimizing the Risk of Ransomware
    Minimizing the Impact of Ransomware Authors: Tushar Nandwana, OneBeacon Technology Risk Control and Joe Budzyn – OneBeacon Insurance Group Published: July 2018 1 Ransomware has featured prominently in the news over the last few years. Ransomware – Hospitals, municipalities, businesses, law enforcement agencies, individuals and A Growing Threat even entire regions of the world have been affected by it. Some have paid the ransom and recovered their computer data; others have lost their data forever. In March 2018, the city of Atlanta, Georgia was hit by SamSam ransomware which prevented city residents from paying their bills and accessing court information online. The demand was for $51,000 but it ultimately cost the city several million dollars from other costs to rectify. SamSam also infected the Colorado Department of Transportation twice in February 2018. Numerous other U.S. municipalities and healthcare organizations have been hit by this ransomware2. WannaCry wreaked havoc on the world in May 2017. With its worm‐like, self‐ propagating behaviour, it spread to thousands of systems within hours using the Eternal Blue exploit to target Windows machines. WannaCry resulted in an estimated $4B in economic losses to the affected businesses and infected 30,000 machines worldwide3. In June 2017 we also saw Petya and NotPetya which used the same exploit as WannaCry, but were more intent on destruction rather than ransom. NotPetya targeted systems specifically in the Ukraine4. FedEx ended up reporting a $300M loss, not from the ransom payout but due to the downtime and economic loss sustained by its Ukrainian subsidiary, TNT Express5. Petya caused Danish shipping giant AP Moller $300M in lost revenue6.
    [Show full text]
  • Systematization of Vulnerability Discovery Knowledge: Review
    Systematization of Vulnerability Discovery Knowledge Review Protocol Nuthan Munaiah and Andrew Meneely Department of Software Engineering Rochester Institute of Technology Rochester, NY 14623 {nm6061,axmvse}@rit.edu February 12, 2019 1 Introduction As more aspects of our daily lives depend on technology, the software that supports this technology must be secure. We, as users, almost subconsciously assume the software we use to always be available to serve our requests while preserving the confidentiality and integrity of our information. Unfortunately, incidents involving catastrophic software vulnerabilities such as Heartbleed (in OpenSSL), Stagefright (in Android), and EternalBlue (in Windows) have made abundantly clear that software, like other engineered creations, is prone to mistakes. Over the years, Software Engineering, as a discipline, has recognized the potential for engineers to make mistakes and has incorporated processes to prevent such mistakes from becoming exploitable vulnerabilities. Developers leverage a plethora of processes, techniques, and tools such as threat modeling, static and dynamic analyses, unit/integration/fuzz/penetration testing, and code reviews to engineer secure software. These practices, while effective at identifying vulnerabilities in software, are limited in their ability to describe the engineering failures that may have led to the introduction of vulnerabilities. Fortunately, as researchers propose empirically-validated metrics to characterize historical vulnerabilities, the factors that may have led to the introduction of vulnerabilities emerge. Developers must be made aware of these factors to help them proactively consider security implications of the code that they contribute. In other words, we want developers to think like an attacker (i.e. inculcate an attacker mindset) to proactively discover vulnerabilities.
    [Show full text]
  • Hacking Healthcare Petya
    Hacking Healthcare Welcome to the first edition of Hacking Healthcare, NH-ISAC’s new weekly newsletter designed to guide you through the week in healthcare cybersecurity and policy. Every Wednesday, Hacking Healthcare, will bring you analysis on the latest news stories, policy developments, reports, and public remarks that impact the cybersecurity practitioner across all the different healthcare industries. We have our views on what matters, but we also want to reflect your interests – so get in touch and let the Hacking Healthcare team know what you want to see. Here we go… This is the public version of the Hacking Healthcare newsletter. For additional in-depth analysis and opinion, become a member of the NH-ISAC. Petya (aka GoldenEye, NotPetya) For the second time in as many months, a ransomware attack is snaking its way around the globe. It appears that the attack started in Ukraine and has much of its impact in Europe. But there are reports that U.S. entities have also been infected, including at least 1 U.S. hospital. Some researchers have reported that the malware resembles Petya or GoldenEye, or maybe an off-spring of one of these variants. We’ll call it Petya for now since that is the standard that NH-ISAC has adopted. Regardless of its lineage, the malware used in the current attack does seem to be relying on the ETERNALBLUE exploit to gain initial network access. Installing all of the latest Microsoft updates for the related vulnerabilitiesseems like a good first step in response. The NH-ISAC is working hard to gather and share further information on this attack and will keep its members informed through their incident- specific blog and AMBER list-serve.
    [Show full text]
  • Security – a Midlife Crisis 02/12/19 What Constitutes a Security Midlife Crisis? History of Technology and Threats
    Security – A midlife crisis 02/12/19 What constitutes a security midlife crisis? History of technology and threats 2005 – 2006 Identify theft (phishing) 2003 – 2004 Advanced worm/Trojan (“I love you”) 2007 – 2008 2000 1995 Organized crime Malicious (data theft) 1980s Breaking code Viruses websites (Melissa) 2009 – today Sophisticated targeted attacks Petya/ Non-Petya Meltdown/ Slammer Stuxnet Spectre Advanced For-profit Viruses and worms persistent Targeted attacks malware threats Mainframe Client / server Client / cloud You know the challenge – breaches are increasing World’s largest data breaches and hacks 2009 – 2014 2015 – 2019 2014 Latest 2019 2013 2018 2012 2017 2011 2016 2010 2015 2009 Source: http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/ Sept 26 – Food delivery service gets hacked • Affected users: 4.9 million • Industry or type: restaurant • Cause of breach: hack DoorDash learned in September that an unauthorized third party was able to access its user data on May 4, 2019. Many of the food delivery app’s users were affected, totaling almost 5 million. The hack affected only those people who joined before April 5, 2018. The hacker was able to access the following information: • Profile information • Names • Email addresses • Delivery addresses • Order history • Phone numbers • Passwords (hashed and salted) • Last four digits of payment cards (for consumers) • Last four digits of bank accounts (for Dashers and merchants) • Driver’s license numbers (for roughly 100,000 Dashers) July 30 – Largest banking data breach • Affected users: 100 million • Industry or type: banking and finance • Cause of breach: hack Capital One, the major US banking institution, suffered possibly the largest banking data breach in history.
    [Show full text]
  • A PRACTICAL METHOD of IDENTIFYING CYBERATTACKS February 2018 INDEX
    In Collaboration With A PRACTICAL METHOD OF IDENTIFYING CYBERATTACKS February 2018 INDEX TOPICS EXECUTIVE SUMMARY 4 OVERVIEW 5 THE RESPONSES TO A GROWING THREAT 7 DIFFERENT TYPES OF PERPETRATORS 10 THE SCOURGE OF CYBERCRIME 11 THE EVOLUTION OF CYBERWARFARE 12 CYBERACTIVISM: ACTIVE AS EVER 13 THE ATTRIBUTION PROBLEM 14 TRACKING THE ORIGINS OF CYBERATTACKS 17 CONCLUSION 20 APPENDIX: TIMELINE OF CYBERSECURITY 21 INCIDENTS 2 A Practical Method of Identifying Cyberattacks EXECUTIVE OVERVIEW SUMMARY The frequency and scope of cyberattacks Cyberattacks carried out by a range of entities are continue to grow, and yet despite the seriousness a growing threat to the security of governments of the problem, it remains extremely difficult to and their citizens. There are three main sources differentiate between the various sources of an of attacks; activists, criminals and governments, attack. This paper aims to shed light on the main and - based on the evidence - it is sometimes types of cyberattacks and provides examples hard to differentiate them. Indeed, they may of each. In particular, a high level framework sometimes work together when their interests for investigation is presented, aimed at helping are aligned. The increasing frequency and severity analysts in gaining a better understanding of the of the attacks makes it more important than ever origins of threats, the motive of the attacker, the to understand the source. Knowing who planned technical origin of the attack, the information an attack might make it easier to capture the contained in the coding of the malware and culprits or frame an appropriate response. the attacker’s modus operandi.
    [Show full text]
  • Factor Authentication
    THIS COMPUTER HAS BEEN…. WHAT DO I DO NOW? Paul Seldes, FPEM, CEM, FMI ntb group, LLC Director of Operations I DON’T HAVE TO BE HERE RANSOMWARE DEFINED Ransomware is a type of malicious software used by cybercriminals that is designed to extort money from their victims, either by • Encrypting data on the disk or OR • By blocking access to the system CAN IT HAPPEN TO ME? 56% increase in ransomware attacks 2018-2019 (DHS- CISA) $84,000 typical cost of recovery $6 TRILLION cybercrime global costs by 2021 HOW IT WORKS RANSOMWARE IS A GROWTH INDUSTRY Cost of ransomware to the US in 2019 was $7.5 billion Ransomware attacks are also known as BGH 2020: $10 billion ? 2021: $15 billion? 2022: $20 billion? CRYPTOLOCKER – FIRST GLOBAL RANSOMWARE CAMPAIGN 500,000 victims Between $3 and $27 million in payments June 2014 CRYPTOLOCKER – FIRST GLOBAL RANSOMWARE CAMPAIGN There is a $3 million reward for information leading to his arrest (FBI) June 2014 AND SO IT GOES Over 100 variants between 2014 and 2019. WANNACRY – MAY 2017 WORLDWIDE ATTACK In order to spread like a worm, utilized an exploit called ETERNALBLUE, one of the leaked NSA hacking tools released by the Shadow Brokers hacking group in April 2017 The patch for the vulnerability was available for 59 days prior to the attack Hit critical infrastructure in some countries such as Germany and Russia. In the U.K., the health care sector received a hard hit: hospitals had to turn away patients, reroute ambulances, paralyze emergency services, and reschedule surgeries and appointments WANNACRY – MAY 2017 WORLDWIDE ATTACK In order to spread like a worm, utilized an exploit called ETERNALBLUE, one of the leaked NSA hacking tools released by the Shadow Brokers hacking group in April 2017 The patch for the vulnerability was available for 59 days prior to the attack Hit critical infrastructure in some countries such as Germany and Russia.
    [Show full text]
  • Bluekeep Update 12/05/2019
    BlueKeep Update 12/05/2019 Report #: 201912051000 Agenda • What is BlueKeep • Timeline of BlueKeep • BlueKeep Today • Initial Attempts to Exploit BlueKeep • Why Initial Attempts Failed • BlueKeep Tomorrow • Mitigations • Indicators of Compromise (IOCs) • HC3 Contact Information • References Slides Key: Non-Technical: managerial, strategic and high-level (general audience) Technical: Tactical / IOCs; requiring in-depth knowledge (sysadmins, IRT) TLP: WHITE, ID# 201912051000 2 What is BlueKeep • BlueKeep (CVE-2019-0708) • Vulnerability in Microsoft’s (MS) Remote Desktop Protocol • Grants hackers full remote access and code execution on unpatched machines • No user interaction required • Essential owns the machine, malicious actor can do as they please • Affects: Windows XP, 7, Server 2003, Server 2008, and Server 2008 R2 • Deja Blue(Related BlueKeep Vulnerabilities) affects: Windows 8, 10, and all older windows versions • EternalBlue affects: Server Message Block version 1 (SMBv1) • “Wormable” meaning it has the ability to self propagate (think WannaCry level of damage) • MS, NSA, DHS, many other security vendors released advisories and warning on this exploit TLP: WHITE, ID# 201912051000 3 BlueKeep Timeline Metasploit Team Microsoft Released Patch: DHS Tested a Working BlueKeep Scanner Significant Uptick in Releases BlueKeep Coin Miner Exploit CVE-2019-0708 Exploit Against W2000 Discovered in Malicious RDP Activity Exploit Module BlueKeep Vulnerability Watchdog Malware 34 Days (Private Exploit) 70 Days (Semi-Public Exploit) 115 Days (Public
    [Show full text]
  • Protecting Enterprise an Examination of Bugs, Major Vulnerabilities and Exploits
    ESET Research White Papers // April 2018 Protecting Enterprise An examination of bugs, major vulnerabilities and exploits Author Tony Anscombe Contributing researchers Anton Cherepanov Aryeh Goretsky Ondrej Kubovič Robert Lipovský Miguel Ángel Mendoza Diego Perez Protecting Enterprise: An examination of bugs, major vulnerabilities and exploits CONTENTS Executive summary 2 Bugs, vulnerabilities & exploits 2 The vulnerability trend 4 Major security vulnerabilities & attacks 5 EternalBlue 6 WannaCryptor 7 CoinMiner 9 Diskcoder (aka Petya) 10 Meltdown & Spectre 12 The risk to infrastructure 13 Protecting the enterprise 15 Updating (aka Patching) 16 Protection layers 16 2 Protecting Enterprise: An examination of bugs, major vulnerabilities and exploits EXECUTIVE SUMMARY This white paper focuses on the dramatic but whose updates have not been installed across growth in the number and severity of whole organizations. Both WannaCryptor and software vulnerabilities, and discusses how Diskcoder affected organizations worldwide multilayered endpoint security is needed despite operating system updates being to mitigate the threats they pose. available. ESET detected and blocked malware taking advantage of the EternalBlue exploit. Exploits of critical vulnerabilities such as EternalBlue have been utilized to devastating The purpose of this white paper is to help users effect. In 2017, EternalBlue alone spawned understand why no single technology or mix of WannaCryptor, CoinMiner and Diskcoder (aka technologies will guarantee that a network will Petya). In 2018, the security community has not be compromised and why the cybersecurity come to realize the extent of CPU architecture industry, including ESET, constantly refines vulnerabilities. Also, there is a growing products both reactively and proactively, acceptance that most older infrastructure adding layers to ensure effective security.
    [Show full text]
  • 4233 4233-601.Pdf
    WHAT’S OUR OBLIGATION? Instructor Course WHY SHOULD I…?? Legal Lives Depend Fiduciary on it! Privacy Ethical - Patriotic Instructor Course Instructor Course GLOBAL ATTACKS • Cyber crime will cost 6 trillion annually by 2021 • It will be more profitable than the global drug trade • Cyber defense spending will be 1 Trillion within the next 4 years • There will be 3.5 million UNFILLED Cyber Security Jobs by 2021 • Ransomware alone is estimated to cost 11.5 billion in 2019 https://www.csoonline.com/article/3153707/security/top-5-cybersecurity-facts-figures-and-statistics.html Instructor Course A MASSIVE PROBLEM http://allnewspipeline.com/images/cna1.jpg http://media4.s-nbcnews.com/j/newscms/2015_31/1148606/150730-nsa-cyber-map-jhc-1407_cde28ac585ec2df79ff3cb20f7bb4559.nbcnews-ux-2880-1000.jpg Instructor Course LOSS OF CRITICAL TECHNOLOGY? Chinese Hackers Steal Sensitive Data on U.S. Subs and Missiles from Military Contractor, Report Says • 614 gigabytes of submarine communications data and information about Sea Dragon “an underwater technology that the Defense Department has described as introducing a “disruptive offensive capability”” • It is believed that China’s Ministry of State Security, or MSS is responsible • It was reported that the data was on an unclassified network as officials say the data “could be considered classified and was highly sensitive” • “Former Navy officer and NSA analyst John Schindler, writing for the Observer, highlights the loss of cryptographic information used in submarine communications.” He likens the theft
    [Show full text]
  • Invisimole: the Hidden Part of the Story Unearthing Invisimole’S Espionage Toolset and Strategic Cooperations
    ESET Research white papers TLP: WHITE INVISIMOLE: THE HIDDEN PART OF THE STORY UNEARTHING INVISIMOLE’S ESPIONAGE TOOLSET AND STRATEGIC COOPERATIONS Authors: Zuzana Hromcová Anton Cherepanov TLP: WHITE 2 InvisiMole: The hidden part of the story CONTENTS 1 EXECUTIVE SUMMARY � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 4 2 ATTACKS AND INVESTIGATION � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 4 2.1 InvisiMole’s toolset ������������������������������������������������������������������������������������������������������������������������ 5 2.2 Cooperation between InvisiMole and Gamaredon . 5 3 BUILDING BLOCKS � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 6 3.1 Structure ������������������������������������������������������������������������������������������������������������������������������������������6 3.1.1 InvisiMole blobs . 6 3.1.2 Execution guardrails with DPAPI ���������������������������������������������������������������������������������7 3.2 Payload ��������������������������������������������������������������������������������������������������������������������������������������������8 3.2.1 TCP downloader ��������������������������������������������������������������������������������������������������������������9 3.2.2 DNS downloader . 9 3.2.3 RC2CL backdoor �������������������������������������������������������������������������������������������������������������13
    [Show full text]
  • Toward Data-Driven Discovery of Software Vulnerabilities
    Rochester Institute of Technology RIT Scholar Works Theses 4-2020 Toward Data-Driven Discovery of Software Vulnerabilities Nuthan Munaiah [email protected] Follow this and additional works at: https://scholarworks.rit.edu/theses Recommended Citation Munaiah, Nuthan, "Toward Data-Driven Discovery of Software Vulnerabilities" (2020). Thesis. Rochester Institute of Technology. Accessed from This Dissertation is brought to you for free and open access by RIT Scholar Works. It has been accepted for inclusion in Theses by an authorized administrator of RIT Scholar Works. For more information, please contact [email protected]. Toward Data-Driven Discovery of Software Vulnerabilities by Nuthan Munaiah A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computing and Information Sciences B. Thomas Golisano College of Computing and Information Sciences Rochester Institute of Technology Rochester, New York April 2020 Toward Data-Driven Discovery of Software Vulnerabilities by Nuthan Munaiah Committee Approval: We, the undersigned committee members, certify that we have advised and/or supervised the candidate on the work described in this dissertation. We further certify that we have reviewed the dissertation manuscript and approve it in partial fulfillment of the requirements of the degree of Doctor of Philosophy in Computing and Information Sciences. Dr. Andrew Meneely Date Dissertation Advisor Dr. Naveen Sharma Date Dissertation Committee Member Dr. Ernest Fokoué Date Dissertation Committee Member Dr. Pradeep K. Murukannaiah Date Dissertation Committee Member Dr. Sharon Mason Date Dissertation Defense Chairperson Certified by: Dr. Pencheng Shi Date Ph.D. Program Director, Computing and Information Sciences ii iii © 2020 Nuthan Munaiah All rights reserved.
    [Show full text]