DOCSLIB.ORG

Effective Ransomware Responses Understanding Ransomware and How to Successfully Combat It

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Effective Ransomware Responses Understanding Ransomware and How to Successfully Combat It EFFECTIVE RANSOMWARE RESPONSES UNDERSTANDING RANSOMWARE AND HOW TO SUCCESSFULLY COMBAT IT WHITE PAPER CONTENTS Preface 3 About Ransomware 4 Damage by Ransomware 4 Encryption of corporate and personal documents and data 4 Secondary and tertiary damage 5 Disclosure of confidential or proprietary information during restoration attempts 5 Severity of Ransomware 5 Ransomware Response Strategy 1: Identify Attack Mechanisms 6 Infection via email 8 Ransomware Response Strategy 2: Implement Advanced Security Solutions 7 Email security is the first line of defense 7 Why FireEye Works 8 Conclusion 8 WHITE PAPER / EFFECTIVE RANSOMWARE RESPONSES 2 PREFACE The M-Trends 2017 Annual Threat Report1 indicates that Mandiant investigators observed increased risk awareness from media coverage of ransomware. In a particularly high-profile case, a widespread ransomware worm, aka WannaCrypt or Wcry, exploded across 74 countries. Parts of Britain’s National Health Service (NHS) Spain’s Telefonica, FedEx and Deutsche Bahn were hit, along with many other countries and companies worldwide. Most ransomware attacks target either the confidentiality or availability of data. Targeted organizations are threatened with the public release of sensitive data while targets of opportunity are typically infected with commodity ransomware such as Cerber or Locky. Ransomware operators have infected victims worldwide using their native languages. This type of malware has primarily afected Windows operating systems, but in recent years, ransomware has been developed to afect other operating systems, such as Android (Simplocker)3 and Mac OS X (KeRanger).4 Organizations have a pressing reason to exercise caution against ransomware due to its expanding and widespread distribution and popularity5 among malicious actors. 1 Mandiant, a FireEye company. “M-Trends 2017.” March 2017 2 The Register. “74 countries hit by NSA-powered WannaCrypt ransomware backdoor.” May 13, 2017. 3 WeLiveSecurity.com. “ESET Analyzes Simplocker – First Android File-Encrypting, TOR-enabled Ransomware.” June 4, 2014. 4 WeLiveSecurity.com. “New Mac ransomware appears: KeRanger, spread via Transmission app.” March 7, 2016. 5 PCMag.com. “The Growing Threat of Ransomware.” April 13, 2016. WHITE PAPER / EFFECTIVE RANSOMWARE RESPONSES 3 The impact of ransomware is immediate, compared to stealthier malware used in advanced attacks. About Ransomware virtual currencies such as PayPal and Bitcoin are preferred Ransomware is a type of malware that renders the methods of payment because they are not easily traceable. victim’s computer or specific files unusable or unreadable, and demands a ransom from the victim in return for The impact of ransomware is immediate, compared to a cryptographic key which can be used to restore the stealthier malware. There is growing concern about the computer or decrypt the encrypted files. complex efects of ransomware on organizations, which include monetary damage and business downtime. Once it infects a target system, modern ransomware encrypts a targeted group of critical files, making them unavailable to the user. It then displays instructions for Damage by Ransomware payment required to restore access to the files. Online There are three main types of damage caused by ransomware. Encryption of corporate and personal Secondary and tertiary damage Disclosure of information during documents and data (encryption of file servers) restoration attempts Shared PC Web exploit Spam mail Internet Competitor Primary File server victim’s PC Corporate shared server File restoration service • Ransomware is introduced via routes • File servers / shared PCs are exposed • Confidential documents could get including email and web, and encrypts to secondary/tertiary damage via leaked via file decryption service corporate/personal documents/data network drives, etc. providers Figure 1. Types of damage caused by ransomware. Encryption of corporate and personal documents and data encrypt files after receiving a response or public RSA key from Ransomware encrypts important documents and data on the attacker’s command-and-control server. This trend means a system to render them inaccessible to an organization or that blocking control server trafc may prevent encryption. individual. Since the encrypted files cannot be restored with of-the-shelf security solutions, the victim must either pay the In many cases, complete recovery is nearly impossible without ransom to the attacker or use pre-existing backups to restore the attacker’s decryption key. Once a computer gets infected the files. In limited cases, flaws in ransomware encryption with ransomware, damage is almost always instantaneous implementation can also be identified and used to recover and unavoidable because data on that computer is, at least data. However, many popular ransomware families only temporarily, unusable. 4 Secondary and tertiary damage Ransomware can cause secondary or tertiary damage through equipment such as Five examples of file servers or network share devices. If the initial victim’s computer is connected to such devices, the ransomware will often encrypt the entire shared resource. ransomware variations FireEye detects In ransomware campaigns, malicious actors can spread ransomware to new victims Cerber: In June 2016, a campaign within infected organizations. Popular tools used to download ransomware also was detected that distributed steal email credentials, and attackers use compromised email accounts to further emails with a malicious Microsoft distribute ransomware. Word document attached. Through these two proliferation mechanisms, a single infected PC can introduce Locky: Began spreading in ransomware to an entire enterprise and cause significant damage. early 2016 using the same mass distribution channels as the Disclosure of confidential or proprietary information during restoration attempts Dridex credential theft malware. In August 2017, massive email Malicious actors may try to steal data from (or otherwise abuse) systems that campaigns afected numerous have been afected by ransomware. In multiple cases, threat actors have been industries with healthcare being observed deploying ransomware alongside capabilities that steal data. Infections the hardest hit. with fraud-enabling malware often serve as a foothold for the attacker to perform a variety of monetization actions. WannaCrypt: A well- coordinated ransomware attack wreaked havoc in 2017 using a Severity of Ransomware piece of malware. Also known The volume and variety of ransomware is growing and causing more damage. as WannaCry, it exploits a Attackers are also becoming more flagrant, threatening to corrupt confidential files vulnerability in Microsoft’s Server or publish them online if the ransom is not paid by a specified time. Message Block (SMB) protocol. Jaf: Ransomware that burst onto FireEye regularly identifies and announces the discovery of new variations of the scene in May 2017, flooding ransomware. FireEye Threat Intelligence observed a highly prolific WannaCry networks with high-volume email ransomware campaign impacting organizations globally. In 2016, CryptXXX was spam campaigns via the Necurs one of the top five ransomware variants. Cerber and Locky ransomware infections botnet. The spam includes a PDF spread both via email and exploit kits but the majority, especially Locky, are attachment with an embedded distributed via email. Word document containing a malicious VBA macro that CryptoWall generated illegal gains of $1 million over a six-month period in 2015. downloads the payload from one FireEye estimated that the TeslaCrypt hackers took home $76,522 USD between of multiple domains. February 7 and April 28, 2015. TeslaCrypt: First discovered in February 2015, this ransomware Cyber attacks that use ransomware are expected to increase in the next few years. encrypts various types of files, They are fairly easy to deploy even for novice computer users worldwide. including online games. The malware uses multiple tactics to reduce victims’ chances of blocking or easily remediating infections. These include encrypting files regardless of whether a connection to the control server can be established, and deleting local “shadow copies” that can be used for data or system recovery. WHITE PAPER / EFFECTIVE RANSOMWARE RESPONSES 5 Ransomware Response Strategy 1: Organizations should intensify eforts to identify the exact Identify Attack Mechanisms intrusion mechanisms of ransomware and implement email There is no single solution to the increasing threat of security with advanced threat protection that could protect ransomware. The victim typically either pays the ransom and critical corporate information from ransomware attacks. A hopes the problem stops there or risks significant business sound security strategy must thoroughly analyze the attack disruption while they attempt to self-recover. mechanisms of ransomware and assess security measures that could mitigate ransomware damage. Paying attackers for decryption is not a real solution. Paying them not only creates a financial burden on the victim Infection via email organization, but also directly rewards attackers with money Ransomware infects systems via email. In fact, most and motivation for further attacks. Further, paying a ransom reported ransomware infections were introduced via doesn’t guarantee the attacker will provide the key needed email. According to a report by the Cyber Threat Alliance to restore the computer or decrypt the encrypted files. Law (CTA),7 CryptoWall 3.0, which caused $325 million damage enforcement
Load more

Recommended publications
  • Ransom Where?
    Ransom where? Holding data hostage with ransomware May 2019 Author With the evolution of digitization and increased interconnectivity, the cyberthreat landscape has transformed from merely a security and privacy concern to a danger much more insidious by nature — ransomware. Ransomware is a type of malware that is designed to encrypt, Imani Barnes Analyst 646.572.3930 destroy or shut down networks in exchange [email protected] for a paid ransom. Through the deployment of ransomware, cybercriminals are no longer just seeking to steal credit card information and other sensitive personally identifiable information (PII). Instead, they have upped their games to manipulate organizations into paying large sums of money in exchange for the safe release of their data and control of their systems. While there are some business sectors in which the presence of this cyberexposure is overt, cybercriminals are broadening their scopes of potential victims to include targets of opportunity1 across a multitude of industries. This paper will provide insight into how ransomware evolved as a cyberextortion instrument, identify notorious strains and explain how companies can protect themselves. 1 WIRED. “Meet LockerGoga, the Ransomware Crippling Industrial Firms” March 25, 2019; https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/. 2 Ransom where? | May 2019 A brief history of ransomware The first signs of ransomware appeared in 1989 in the healthcare industry. An attacker used infected floppy disks to encrypt computer files, claiming that the user was in “breach of a licensing agreement,”2 and demanded $189 for a decryption key. While the attempt to extort was unsuccessful, this attack became commonly known as PC Cyborg and set the archetype in motion for future attacks.
    [Show full text]
  • 2016.4 Vol.28 Mac はマルウェアから 100%安全か
    2016.4 Vol.28 Mac はマルウェアから 100%安全か セキュリティプレス・アン Mac 向けセキュリティソリューション AhnLab V3 365 Clinic for Mac Mac はマルウェアから 100%安全か AppleのMacは、多くの人にマルウェアから安全だと思われている。しかし実際はWindowほどではないにせよ、Mac向けのマルウ ェアもマルウェア史の初期から存在し続けていた。それは現在も同じで、Macも安全地帯ではないということだ。 今回のプレス・アンでは、最新Mac向けマルウェアの特徴を分析し、Mac環境を保護する方策を探る。 Appleのマッキントッシュ(Macintosh、以下Mac)に対するユーザーの信頼は厚く、次のような挿絵からも見て取れる。コンピューター使用中感電し たキャラに、「コンピューターに異常はないかい？」と聞いたところ「これはMacだから大丈夫」と断言する内容である。 [図1] The Brads- Impossible 2 セキュリティプレス・アン その信頼はセキュリティに関しても絶大で、どうやらMacは安全な環境であると思われているらしい。しかし前述のようにMac向けマルウェアは昔か ら存在していたし、Macの運営環境である「OS X」に移行してから10年間、脅威は持続的に発見されている。もちろんWindowに比べればMac向け マルウェアが少ないのは確かだが、最近発見されるマルウェアの傾向を見るとMacもまたマルウェアの安全地帯ではないことが分かる。最近登場して いるMac向けマルウェアの特徴を分析し、Macを保護するソリューションを見てみよう。 主なMacマルウェア 現在のMacも多くの進化を遂げた。プロセッサやOSの変化により、[図2]のようにOS環境がOS Xに変更された前後で発見されたマルウェアは異なる。 初期 偽装した セキュリティ プログラム リリース リリース [図2] Mac向けマルウェア史タイムライン OS X移行後に登場したマルウェアに関する詳細情報は次の通りだ。 マルウェア(発見時期) 特徴 備考 Renepo -システムセキュリティ設定: 低 -OS X 初のマルウェア (2004) -OS X ファイアウォール解除 -2004/3/3、ニックネーム DimBulbが「Macintosh Underground -ソフトウェアアップデート機能解除 forum」に参加後、3/13からスクリプトワームに対して掲載し、フォーラ -ohphoneX(ボイス及びビデオ共有)、d ムの参加者とマルウェア作成を開始。9/10の掲載バージョンが10/23に sniff(暗号スニファ)、John the Rippe 外部に知れ渡り、10/24から大炎上したことから作成を放棄 r(暗号クラック)をダウンロードインストール -Apple社ではマルウェアではないと否認し、対応せず RSPlug(Dnschanger) -DNSアドレスを変更してフィッシングサイ -使用者に実害を与えた初のOS X向けマルウェア (2007.10) トに誘導し、金銭的要求 3 セキュリティプレス・アン マルウェア(発見時期) 特徴 備考 MacSweeper -常に何かを診断し、購入要求 -OS X初の偽装アンチウィルスプログラム (2008.1.17) -KiVVi Softwareで作成し、強制マーケティングに使用したことで公式謝 罪 -2011/5以降Mac Defender、Mac Protector、Mac Security、 Mac Guard、Mac Shieldなど偽装プログラムが大幅に増加 -Apple社は同年5月末セキュリティアップデートを行い、偽装アンチウィルス
    [Show full text]
  • Mind Your Own Business: a Longitudinal Study of Threats and Vulnerabilities in Enterprises
    Mind your Own Business: A Longitudinal Study of Threats and Vulnerabilities in Enterprises Abstract—Enterprises own a significant fraction of the hosts to, financial assets, and security investment. Thus, it is very connected to the Internet and possess valuable assets, such as likely that the best practices mentioned above do not equally financial data and intellectual property, which may be targeted apply to all of them. by attackers. They suffer attacks that exploit unpatched hosts and install malware, resulting in breaches that may cost millions Currently, it is not clear how the security posture of in damages. Despite the scale of this phenomenon, the threat and enterprises differ according to different factors and whether vulnerability landscape of enterprises remains under-studied. The enterprises are indeed more secure than consumer hosts, i.e., security posture of enterprises remains unclear, and it’s unknown if their security investment is paying off. In this paper, we aim whether enterprises are indeed more secure than consumer hosts. to throw light into these questions by conducting a large-scale To address these questions, we perform the largest and longest longitudinal measurement study of enterprise security. We an- enterprise security study up to date. Our data covers nearly alyze the enterprise threat landscape including the prevalence 3 years and is collected from 28K enterprises, belonging to 67 industries, which own 82M hosts and 73M public-facing servers. of malware and PUP in enterprise hosts and how common security practices, such as vulnerability patching and operating Our measurements comprise of two parts: an analysis of system updates are handled.
    [Show full text]
  • Ransomware Is Here: What You Can Do About It?
    WHITEPAPER Ransomware is Here: What you can do about it? Overview Over the last few years, ransomware has emerged as one of the most devastating and costly attacks in the hacker arsenal. Cyber thieves are increasingly using this form of attack to target individuals, corporate entities and public sector organizations alike by holding your system or files for ransom. Unlike other forms of cyber theft that often involve stolen financial or healthcare information, ransomware cuts out the middleman. In cases where an attacker steals health or financial documents, they must sell them on to third parties to make money. As far as ransomware is concerned, the money comes directly from the victim. Ransomware is a quickly growing threat vector. According to the FBI’s Internet Crime Complaint center (IC3), infected users made complaints about ransomware 2,453 times in 2015—nearly double the figure for 2014. What’s more, these figures most likely represent only the tip of the iceberg, as many users pay their ransom without making a report to the authorities. A recent survey conducted by a Cyber Security Research Center at the University of Kent found that over 40% of those infected with CryptoLocker actually agreed to pay the ransom demanded, which is a big incentive for hackers to target more systems. Lastly, hackers are rapidly iterating both malware and distribution techniques. In early Q2 of 2016, a new variant of ransomware, known as CryptXXX, emerged on the scene. This program is packed in such a way that users and antivirus software may initially confuse it for a Windows DLL file.
    [Show full text]
  • Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE of CONTENTS 2016 Internet Security Threat Report 2
    Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE OF CONTENTS 2016 Internet Security Threat Report 2 CONTENTS 4 Introduction 21 Tech Support Scams Go Nuclear, 39 Infographic: A New Zero-Day Vulnerability Spreading Ransomware Discovered Every Week in 2015 5 Executive Summary 22 Malvertising 39 Infographic: A New Zero-Day Vulnerability Discovered Every Week in 2015 8 BIG NUMBERS 23 Cybersecurity Challenges For Website Owners 40 Spear Phishing 10 MOBILE DEVICES & THE 23 Put Your Money Where Your Mouse Is 43 Active Attack Groups in 2015 INTERNET OF THINGS 23 Websites Are Still Vulnerable to Attacks 44 Infographic: Attackers Target Both Large and Small Businesses 10 Smartphones Leading to Malware and Data Breaches and Mobile Devices 23 Moving to Stronger Authentication 45 Profiting from High-Level Corporate Attacks and the Butterfly Effect 10 One Phone Per Person 24 Accelerating to Always-On Encryption 45 Cybersecurity, Cybersabotage, and Coping 11 Cross-Over Threats 24 Reinforced Reassurance with Black Swan Events 11 Android Attacks Become More Stealthy 25 Websites Need to Become Harder to 46 Cybersabotage and 12 How Malicious Video Messages Could Attack the Threat of “Hybrid Warfare” Lead to Stagefright and Stagefright 2.0 25 SSL/TLS and The 46 Small Business and the Dirty Linen Attack Industry’s Response 13 Android Users under Fire with Phishing 47 Industrial Control Systems and Ransomware 25 The Evolution of Encryption Vulnerable to Attacks 13 Apple iOS Users Now More at Risk than 25 Strength in Numbers 47 Obscurity is No Defense
    [Show full text]
  • View This Article on Online Activity Summaryаннаweek Ending January 13, 2017 This Week, the World's Attention
    5/22/2017 FortiGuard Threat Intelligence Brief ­ January 13, 2017 | FortiGuard View this article on online Activity Summary ­­ Week Ending January 13, 2017 This week, the world's attention has been focused on US President­elect Donald Trump and the allegations that purport to connect him to data stolen by Russian hackers during the 2016 US election. While there is still not enough information to determine whether Trump or his staff were in any way involved with this attack ­­ named GRIZZLY STEPPE in a report jointly produced by the Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS) ­­ it is clear that they had access to classified and confidential information that had been stolen during a spear phishing campaign that took place between 2015 and 2016. It is generally harder to detect a spear phishing email from a regular phishing email as the attacker impersonates someone close to the victim, possibly someone in a position of authority. To avoid becoming a victim to this sort of attack, we at FortiGuard Labs advise you once again to instruct employees to be extremely careful when handling email attachments and links. Of course, that will not always be enough. In some cases, such as HR staff who are sent resumes from potential candidates, it is actually their job to open attachments from people they don't know. Even the least capable person at your company has an email address, and they are likely to click on attachments regardless of how many times you warn them. Implementing a secure email gateway is the best protection mechanism in these cases.
    [Show full text]
  • Backdoors in Software: a Cycle of Fear and Uncertainty
    BACKDOORS IN SOFTWARE: A CYCLE OF FEAR AND UNCERTAINTY Leah Holden, Tufts University, Medford, MA Abstract: With the advent of cryptography and an increasingly online world, an antagonist to the security provided by encryption has emerged: backdoors. Backdoors are slated as insidious but often they aren’t intended to be. Backdoors can just be abused maintenance accounts, exploited vulnerabilities, or created by another agent via infecting host servers with malware. We cannot ignore that they may also be intentionally programmed into the source code of an application. Like with the cyber attrition problem, it may be difficult to determine the root cause of a backdoor and challenging to prove its very existence. These characteristics of backdoors ultimately lead to a state of being that I liken to a cycle of fear where governments or companies throw accusations around, the public roasts the accused, and other companies live in fear of being next. Notably missing from this cycle are any concrete solutions for preventing backdoors. A pervasive problem underlies this cycle: backdoors could be mitigated if software developers and their managers fully embraced the concept that no one should ever be able to bypass authentication. From the Clipper chip to the FBI and Apple’s standoff, we will examine requested, suspected, and proven backdoors up through the end of 2017. We will also look at the aftermath of these incidents and their effect on the relationship between software and government. Introduction: A backdoor has been defined as both “an undocumented portal that allows an administrator to enter the system to troubleshoot or do upkeep” and “ a secret portal that hackers and intelligence agencies used to gain illicit access” (Zetter).
    [Show full text]
  • Best Practices to Protect Against Ransomware, Phishing & Email Fraud
    WHITE PAPER Best Practices for Protecting Against Phishing, Ransomware and Email Fraud An Osterman Research White Paper Published April 2018 SPON Osterman Research, Inc. P.O. Box 1058 • Black Diamond • Washington • 98010-1058 • USA +1 206 683 5683 • [email protected] www.ostermanresearch.com • @mosterman Executive Summary • Various types of security threats are increasing in number and severity at a rapid pace, most notably cryptojacking malware that is focused on mining coins for the roughly 1,400 cryptocurrencies currently in use. • Organizations have been victimized by a wide range of threats and exploits, most notably phishing attacks that have penetrated corporate defenses, targeted email attacks launched from compromised accounts, and sensitive or confidential information accidentally leaked through email. • Threats are becoming more sophisticated as well-financed cybercriminal gangs develop improved variants of malware and social engineering attacks. The result is that the perceived effectiveness of current security solutions is not improving – or is actually getting worse – for many organizations. • Decision makers are most concerned about endpoints getting infected with malware through email or web browsing, user credentials being stolen through email-based phishing, and senior executives’ credentials being stolen through email-based spearphishing. • Four of the five leading concerns expressed by decision makers focus on email as the primary threat vector for cybercriminal activity, and nearly one-half of attacks are focused on account takeovers. Many organizations • Most decision makers have little confidence that their security infrastructure can adequately address infections on mobile devices, are not CEO Fraud/BEC, and preventing users personal devices from introducing malware into the corporate network.
    [Show full text]
  • Veracode.Com
    Joe Brady Senior Solutions Architect [email protected] 1 Detecting Software Austin OWASP Backdoors August 30, 2011 Joe Brady Senior Solutions Architect Software Security Simplified [email protected] About • Veracode provides automated, SaaS-based, application security assessment and remediation capabilities for Internal , external and 3rd party Applications . • Automated techniques include static binary analysis and dynamic analysis . • Founded in 2006, includes application security experts from L 0pht, @stake, Guardent, Symantec, VeriSign and SPI Dynamics/Hewlett Packard 3 Now is a good time to think about software backdoors • Unverified and untested software is everywhere • It’s in your computer, house, car, phone, TV, printer and even refrigerator • Most of that software was developed by people you don’t trust or don’t know very well • You clicked on that link someone sent you didn’t you? What we will cover today (three things to worry think about) • Application Backdoors ‣ Backdoors in the applications you own, are buying or have built ‣ Do you know where your source code was last night? • System Backdoors ‣ Vulnerabilities in the software you use everyday that can be used to implant a system backdoor ‣ E.g. Aurora (CVE-2010-0249) • Mobile Backdoors ‣ Your phone just might be spying on you Attacker Motivation • Most practical method of compromise for many systems ‣ Let the users install your backdoor on systems you have no access to ‣ Looks like legitimate software so may bypass AV • Retrieve and manipulate valuable private data ‣ Looks like legitimate application traffic so little risk of detection by IDS and DLP • For high value targets it becomes cost effective and more reliable.
    [Show full text]
  • A Survey on Smartphones Security: Software Vulnerabilities, Malware, and Attacks
    (IJACSA) International Journal of Advanced Computer Science and Applications Vol. 8, No. 10, 2017 A Survey on Smartphones Security: Software Vulnerabilities, Malware, and Attacks Milad Taleby Ahvanooey*, Prof. Qianmu Li*, Mahdi Rabbani, Ahmed Raza Rajput School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing, P.O. Box 210094 P.R. China. Abstract—Nowadays, the usage of smartphones and their desktop usage (desktop usage, web usage, overall is down to applications have become rapidly popular in people’s daily life. 44.9% in the first quarter of 2017). Further, based on the latest Over the last decade, availability of mobile money services such report released by Kaspersky on December 2016 [3], 36% of as mobile-payment systems and app markets have significantly online banking attacks have targeted Android devices and increased due to the different forms of apps and connectivity increased 8% compared to the year 2015. In all online banking provided by mobile devices, such as 3G, 4G, GPRS, and Wi-Fi, attacks in 2016, have been stolen more than $100 million etc. In the same trend, the number of vulnerabilities targeting around the world. Although Android OS becomes very popular these services and communication networks has raised as well. today, it is exposing more and more vulnerable encounter Therefore, smartphones have become ideal target devices for attacks due to having open-source software, thus everybody malicious programmers. With increasing the number of can develop apps freely. A malware writer (or developer) can vulnerabilities and attacks, there has been a corresponding ascent of the security countermeasures presented by the take advantage of these features to develop malicious apps.
    [Show full text]
  • Backdoor Attacks and Countermeasures on Deep Learning
    1 Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim Abstract—Backdoor attacks insert hidden associations or trig- cases, an attacker can intelligently bypass existing defenses with gers to the deep learning models to override correct inference an adaptive attack. Drawing the insights from the systematic such as classification and make the system perform maliciously review, we also present key areas for future research on the according to the attacker-chosen target while behaving normally backdoor, such as empirical security evaluations from physical in the absence of the trigger. As a new and rapidly evolving trigger attacks, and in particular, more efficient and practical realistic attack, it could result in dire consequences, especially countermeasures are solicited. considering that the backdoor attack surfaces are broad. In 2019, the U.S. Army Research Office started soliciting countermeasures Index Terms—Backdoor Attacks, Backdoor Countermeasures, and launching TrojAI project, the National Institute of Standards Deep Learning (DL), Deep Neural Network (DNN) and Technology has initialized a corresponding online competi- tion accordingly. CONTENTS However, there is still no systematic and comprehensive review of this emerging area. Firstly, there is currently no systematic taxonomy of backdoor attack surfaces according to I Introduction 2 the attacker’s capabilities. In this context, attacks are diverse and not combed. Secondly, there is also a lack of analysis and II A Taxonomy of Adversarial Attacks on Deep comparison of various nascent backdoor countermeasures. In Learning 3 this context, it is uneasy to follow the latest trend to develop II-A Adversarial Example Attack .
    [Show full text]
  • ATTACK LANDSCAPE UPDATE Ransomware 2.0, Automated Recon, Supply Chain Attacks, and Other Trending Threats
    ATTACK LANDSCAPE UPDATE Ransomware 2.0, automated recon, supply chain attacks, and other trending threats Attack Landscape Update 1 CONTENTS Foreword: 2020 proved that our health data really is a target 3 Introduction 5 Trending Threats 6 Ransomware 2.0 6 Infostealers and automated recon 9 Dodging detection 13 Email threats: Coming to an inbox near you 14 You’ve got mail malware 14 Phishing for sensitive data 17 COVID-themed spam continues to spread 20 Vulnerabilities: The legacy of unpatched software 21 Legacy systems, legacy vulns 22 The vulnerabilities of 2020 23 Honeypots:Tracking opportunistic attacks 24 Conclusion 28 Attack Landscape Update 2 FOREWORD: 2020 PROVED THAT OUR HEALTH DATA REALLY IS A TARGET By Mikko Hypponen For many years, our clients and customers have asked me about personal health data. “Isn’t it true that health data is one of the prime targets of evil hackers? Isn’t it true that they’re after my medical history?” they have asked. For years my answer has been: “No, it’s not.” Around 99% of the cases we investigate at F-Secure Labs are criminals who are trying to make money. My thinking has been that if you’re trying to make money, your prime target is financial information like credit card data, not X-ray images. But now I’m changing my mind. The reason? The rise in attacks against hospitals, medical research units, and even patients that has occurred during the pandemic – in particular, the October attack against the Psychotherapy Center Vastaamo in Finland, in which sensitive information related to tens of thousands of patients was compromised.
    [Show full text]