Cisco Cybersecurity Series Dec 2019

Cisco Cybersecurity Series Dec 2019

CISCO CYBERSECURITY SERIES 2019 • THREAT REPORT CISCODECEMBER CYBERSECURITY 2019 SERIES 2019 2019 Threats of the Year Threats of the Year A look back at the tactics and tools of 2019 1 CISCO CYBERSECURITY SERIES 2019 2019 Threats of the Year Contents The Targets and Tools of 2019 3 1. DNS Hijacking 3 Noteworthy Mention: Targeted Ransomware 6 2. Remote Access Trojans (RATs) 7 3. Threats in Encrypted Traffic 9 4. Office 365 Phishing 10 Noteworthy Mention: Magecart Returns 11 5. Social Media and Black Markets 12 6. Digital Extortion Scams 13 Methods to Combat These Threats 15 About the Cisco Cybersecurity Series 17 2 CISCO CYBERSECURITY SERIES 2019 2019 Threats of the Year The Targets and Tools of 2019 Some cybercriminals have specific organizations in mind when they’re planning an attack. For whatever reason, they know who they want to breach, and the potential rewards to be gained. Very little deters them from their goal. Take the global targeted ransomware attacks that took place this year; the effects were so destructive, partly because the organizations were deliberately selected from the firing line. For other cybercriminals, it's more of a 1. DNS Hijacking numbers game. They are looking to hit as DNS, or to give it its full name, the Domain many victims as possible without regard for Name System, is the core technology that which organizations or individuals they affect, translates human readable domain names as long as they get their end result. (e.g., www.example.com) into machine- For example, the emergence of DNS hijacking readable IP addresses (an X-digit number this year saw threat actors take charge of punctuated like this -208.67.222.222). Think certain DNS entries. This allowed attackers of using DNS like asking a librarian for help to silently redirect unsuspecting visitors locating a book; you type in a text name from legitimate systems to malicious ones, and the DNS “librarian” translates this into potentially to install malware or to intercept an IP address, searches the bookshelves confidential data and credentials. for the corresponding IP address, and brings you back the website that you're looking for. In this roundup, we'll take you on a journey through our investigations over the past The scenario year, highlighting six noteworthy threats. You log into your company’s network at You can read more in-depth analyses on our From remote access 9 a.m., and the first thing you do after Threat of the Month blog and sign up to trojans, to hiding your morning coffee is check your industry’s threats in encrypted receive future updates on what 2020 brings traffic, we've seen news. You open your browser, click on various innovations us in the threat landscape. in how the bad guys the bookmark, and expect to arrive at your are seeking to evade detection. With our recommendations at the end of this favorite news site. report, you can use this retrospective in any Except that’s not the website you end security-focused board meetings or business up visiting. planning sessions you're holding over the next few months to guide you on the tools Cisco Talos, Cisco’s threat intelligence group, and processes you need. It can serve as a has been watching DNS very closely, and this resource to help explain how your current year we spotted multiple attacks relying on security posture would cope with an attack, DNS hijacking. and identify any gaps. Understand how quickly you could respond to each of these six threats? When would you know about the threat? And what do you need to do to improve your time to respond. 3 CISCO CYBERSECURITY SERIES 2019 2019 Threats of the Year The thing about DNS attacks is that they pick and choose what to do with you as a don’t go directly after their intended target victim when you arrive unsuspecting at the (you at your desk). Rather, they attack the malicious server. The attacker could attempt librarian (in this case, the industry news to install malware, collect your username and website you were hoping to read over password, or invisibly act as a go-between coffee). Instead of sending you to the correct with the legitimate site and intercept all location where your book resides, the librarian data you access to use for other purposes instead sends you somewhere entirely (i.e., identity theft, ransom, etc.). different. The worst thing is, you may not know it. The fake site, or the book you pull Sea Turtle starts to swim off the shelf, may look like what you wanted, Sea Turtle is an example of DNS hijacking that but actually be something entirely different – went after the organizations that control TLD the supposed children’s book turns out to (top-level domains). The attacker exploited be the Anarchist Cookbook instead. multiple vulnerabilities to take control of the The attack comes down to the cybercriminal name servers for entire domains. altering the directions to a legitimate website This approach gives the attackers control to lead to a malicious one. You ask for the over the IP addresses returned for DNS IP address of a particular domain you want requests. Setting up a malicious name server, to visit, but the DNS records were tampered the attacker can choose when requests for with so that you are sent to a malicious a particular domain are sent to the legitimate IP address instead. The attacker can then site or to a malicious site. Figure 1 Sea Turtle attack process. “Where is 01 Where is the site’s the website?” TLD server? DNS Root Server 01 www.example.com TLD server 02 records altered. 04 02 Compromised TLD Server 03 Sent to malicious 03 name server. DNS Resolver Select visitors sent Impersonated 04 to malicious site. Website Malicious Name Server site 4 CISCO CYBERSECURITY SERIES 2019 2019 Threats of the Year As part of the Sea Turtle attack, the DNS Prognosis for 2020 records for webmail servers were altered. This allowed the attacker to intercept The actors behind the “Sea Turtle” DNS connections from users logging into webmail hijacking campaign didn’t slow down this systems, enabling the attacker to not only year. In fact, Talos discovered new details capture users’ credentials, but also read all that also suggest they regrouped after we the data passed to and from the webmail published our initial findings about Sea Turtle system and the users. and they redoubled their efforts with new infrastructure. While many actors will slow DNS hijacking is an example of a non-direct down once they are discovered, this group attack, with the bad actors behind it wanting appears to be unusually brazen. Our advice in to disrupt the infrastructure of the Internet, this instance is to place a particular focus on rather than a specific organization. DNS security and multi-factor authentication for more rigorous identity verification. At the end of this report, we explain how to fight cyberattacks like Sea Turtle, but there Read more on DNS hijacking. are some specific techniques to consider in preventing DNS misuse in the first place, such as monitoring passive DNS data and looking for changes to domain records in order to spot malicious changes. Source: https://blog.talosintelligence.com/2019/04/seaturtle.html 5 CISCO CYBERSECURITY SERIES 2019 2019 Threats of the Year Noteworthy Mention: Targeted Ransomware This year, there were a number of global high-profile instances of targeted ransomware attacks. Ransomware is of course nothing new, but it’s important to state that while new forms of attack continue to appear, the old favorites never go away. The ransomware attacks described below demonstrate how destructive successful campaigns can be, especially when vital services are brought to a halt. In May, the U.S. city of Baltimore suffered a massive ransomware attack that affected 7,000 users in city government buildings. The government refused to pay the ransom, but after resorting to entirely manual systems, and multiple data loss investigations, the event is estimated to have cost the city more than $10 million USD to recover. Also in the U.S., Lake City, UT and Riviera Beach, FL suffered similar ransomware attacks, but chose to pay the hackers a combined $1 million in bitcoin. They still face the challenging work of decrypting the stolen data. In the UK, Eurofins Scientific, a forensic firm used by police forces across the country, suffered a massive targeted ransomware attack. The firm deals with more than 70,000 criminal cases every year, and due to the scale of the cyber attack, a number of court cases were forced to be adjourned while other suppliers were found. Read more on targeted ransomware, including a Talos discussion on how to deal with the ransom demand. 6 CISCO CYBERSECURITY SERIES 2019 2019 Threats of the Year 2. Remote Access Trojans (RATs) There may be a variety of useful weapons in an attacker’s arsenal to steal intellectual The scenario property. Downloaders, administration tools, You’re working for a high-profile technology and info stealers often contribute to such an company, close to releasing a market- attack. But the go-to tool in scenarios like changing product to the public. Your goal the one mentioned above is a remote access is to keep the secrets under wraps until the trojan, often referred to as a “RAT.” public announcement. Unfortunately, your surprise is about to be spoiled. How a RAT can be used in an attack As a tool, RATs provide a variety of Someone has breached your company capabilities. For example, if an attacker is and stolen sensitive data about this new hoping to exfiltrate financial data, they could cornerstone product.

View Full Text

Details

  • File Type
    pdf
  • Upload Time
    -
  • Content Languages
    English
  • Upload User
    Anonymous/Not logged-in
  • File Pages
    17 Page
  • File Size
    -

Download

Channel Download Status
Express Download Enable

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

  • Not to be reproduced or distributed without explicit permission.
  • Not used for commercial purposes outside of approved use cases.
  • Not used to infringe on the rights of the original creators.
  • If you believe any content infringes your copyright, please contact us immediately.

Support

For help with questions, suggestions, or problems, please contact us