classic | mobile
Follow us on:
Follow us on Facebook  Share via Twitter  Share via LinkedIn
 

Search...
Hi-Tech Security Solutions Business Directory


Cyber security in 2017
February 2017, Cyber Security

2016 saw a huge number and variety of cyber attacks, ranging from a high-profile DDoS events using hijacked Internet-facing security cameras to the alleged hacking of party officials during the US election. We also saw a rising tide of data breaches, from organisations big and small, and significant losses of people’s personal information. Harish Chib, VP MEA for SOPHOS ponders how some of those trends might play out in 2017.

Harish Chib, VP MEA for SOPHOS.
Harish Chib, VP MEA for SOPHOS.

Current and emerging attack trends

Destructive DDoS IOT attacks will rise. In 2016, Mirai (https://en.wikipedia.org/wiki/Mirai_(malware)) showed the massive destructive potential of DDoS attacks as a result of insecure consumer IoT (Internet of Things) devices. Mirai's attacks exploited only a small number of devices and vulnerabilities and used basic password guessing techniques.

However, cybercriminals will find it easy to extend their reach because there are so many IoT devices containing outdated code based on poorly-maintained operating systems and applications with well-known vulnerabilities. Expect IoT exploits, better password guessing and more compromised IoT devices being used for DDoS or perhaps to target other devices in your network.

Shift from exploitation to targeted social attacks

Cybercriminals are getting better at exploiting the ultimate vulnerability – humans. Ever more sophisticated and convincing targeted attacks seek to coax users into compromising themselves. For example, it’s common to see an email that addresses the recipient by name and claims they have an outstanding debt the sender has been authorised to collect. Shock, awe or borrowing authority by pretending to be law enforcement are common and effective tactics. The email directs them to a malicious link that users are panicked into clicking on, opening them up to attack. Such phishing attacks can no longer be recognised by obvious mistakes.

Financial infrastructure at greater risk of attack. The use of targeted phishing and 'whaling' continues to grow. These attacks use detailed information about company executives to trick employees into paying fraudsters or compromising accounts. We also expect more attacks on critical financial infrastructure, such as the attack involving SWIFT-connected institutions, which cost the Bangladesh Central Bank $81 million in February 2016. SWIFT recently admitted that there have been other such attacks and it expects to see more, stating in a leaked letter to client banks: "The threat is very persistent, adaptive and sophisticated – and it is here to stay".

Flaky infrastructure

Exploitation of the Internet’s inherently insecure infrastructure. All Internet users rely on ancient foundational protocols, and their ubiquity makes them nearly impossible to revamp or replace. These archaic protocols that have long been the backbone of the Internet and business networks are sometimes surprisingly flaky.

For example, attacks against BGP (Border Gateway Protocol) could potentially disrupt, hijack, or disable much of the Internet. And the DDoS attack on Dyn in October (launched by a myriad of IoT devices), took down the DNS provider and, along with it, access to part of the Internet. It was one of the largest assaults seen and those claiming responsibility said that it was just a dry run. Large-scale ISPs and enterprises can take some steps to respond, but these may well fail to prevent serious damage if individuals or states choose to exploit the Internet's deepest security flaws.

Increased attack complexity

Attacks increasingly bring together multiple technical and social elements, and reflect careful, lengthy probing of the victim organisation's network. Attackers compromise multiple servers and workstations long before they start to steal data or act aggressively. Closely managed by experts, these attacks are strategic, not tactical, and can cause far more damage. This is a very different world to the pre-programmed and automated malware payloads we used to see – patient and evading detection.

More attacks using built-in admin languages and tools. We see more exploits based on PowerShell, Microsoft's language for automating administrative tasks. As a scripting language, PowerShell evades countermeasures focused on executables. We also see more attacks using penetration testing and other administrative tools that may already exist on the network, need not be infiltrated, and may not be suspected. These powerful tools require equally strong controls.

Ransomware evolves

As more users recognise the risks of ransomware attack via email, criminals are exploring other vectors. Some are experimenting with malware that re-infects later, long after a ransom is paid, and some are starting to use built-in tools and no executable malware at all to avoid detection by endpoint protection code that focuses on executable files. Recent examples have offered to decrypt files after the victim shared the ransomware with two friends, and those friends paid to decrypt their files.

Ransomware authors are also starting to use techniques other than encryption, for example deleting or corrupting file headers. And finally, with ‘old’ ransomware still floating around the web, users may fall victim to attacks that can't be ‘cured’ because payment locations no longer work.

Emergence of personal IoT attacks

Users of home IoT devices may not notice or even care if their baby monitors are hijacked to attack someone else's website. But once attackers 'own' a device on a home network, they can compromise other devices, such as laptops containing important personal data. We expect to see more of this as well as more attacks that use cameras and microphones to spy on households. Cyber criminals always find a way to profit.

Growth of malvertising

Malvertising, which spreads malware through online ad networks and web pages, has been around for years, but in 2016 we saw much more of it. These attacks highlight larger problems throughout the advertising ecosystem, such as click fraud, which generates paying clicks that don't correspond to real customer interest. Malvertising has actually generated click fraud, compromising users and stealing from advertisers at the same time.

The downside of encryption

As encryption becomes ubiquitous, it has become much harder for security products to inspect traffic, making it easier for criminals to sneak through undetected. Unsurprisingly, cybercriminals are using encryption in creative new ways. Security products will need to tightly integrate network and client capabilities, to rapidly recognise security events after code is decrypted on the endpoint.

Virtualised and cloud exploits

Attacks against physical hardware (e.g. Rowhammer) raise the possibility of dangerous new exploits against virtualised cloud systems. Attackers might abuse the host or other guests running on a shared host, attack privilege models, and conceivably access others' data. And, as Docker and the entire container (or ‘serverless’) eco-system become more popular, attackers will increasingly seek to discover and exploit vulnerabilities in this relatively new trend in computing. We expect active attempts to operationalise such attacks.

Technical attacks against states and societies

Technology-based attacks have become increasingly political. Societies face growing risks from both disinformation (e.g., 'fake news') and voting system compromise. For instance, researchers have demonstrated attacks that might allow a local voter to fraudulently vote repeatedly without detection. Even if states never engage in attacks against their adversaries' elections, the perception that these attacks are possible is itself a powerful weapon.


  Share via Twitter   Share via LinkedIn      

Further reading:

  • Authlogics appoints AxizWorkgroup as a distributor in Africa
    February 2017, News, Cyber Security, IT infrastructure
    Multi-factor authentication company Authlogics has announced that AxizWorkgroup is its first local distributor and will deliver authentication solutions to resellers in Africa.
  • Dealing with the insider threat
    February 2017, Cyber Security, IT infrastructure
    Teramind has developed a range of solutions to combat the insider threat. The solutions are available either as a hosted or on-site system.
  • Protection from ransomware
    February 2017, Cyber Security, IT infrastructure
    With some careful preparation, you can significantly lower your risk of being infected by ransomware, and reduce the impact if you are hit.
  • Defining African communications
    February 2017, Technews Publishing, Cyber Security, IT infrastructure
    Hi-Tech Security Solutions was present at AfricaCom to witness the vast resources being poured into improving the communications capabilities of the continent.
  • Clues are dead
    February 2017, News, Cyber Security
    Kaspersky Lab’s discovery in 2016 of an APT able to create new tools for each victim has effectively killed off ‘Indicators of Compromise’ as a reliable means of detecting infection.
  • Tough with opportunities
    February 2017, Security & Communication Warehouse, CCTV, Surveillance & Remote Monitoring, Cyber Security
    Marius Stoop looks at what we can expect in the security industry in 2017.
  • Accessing cyber security
    November 2016, Tyco Security Products, This Week's Editor's Pick, Access Control & Identity Management, Cyber Security, Security Services & Risk Management
    Tyco Security Products is taking a proactive role in securing its range of physical security products by developing its Cyber Protection Programme.
  • Control your own privacy
    November 2016, Technews Publishing, Cyber Security
    Whether you know it or not, or whether you care or not, everything you do online is being tracked. TrackOFF protects you digital identity from fingerprinting and other nefarious online spies.
  • The app effect on security
    November 2016, Cyber Security
    While security teams focus on patching operating systems and web browsers, vulnerabilities in those two types of software typically account for a small amount of publicly disclosed vulnerabilities.
  • Datacentrix revamps Security Operations Centre
    November 2016, News, Cyber Security, Security Services & Risk Management
    Datacentrix, a provider of high performing and secure ICT solutions, has officially launched its overhauled Security Operations Centre (SOC), unveiling a highly intelligent service that provides actionable information to help organisations respond to attacks faster and more efficiently.
  • IT security drives business growth
    November 2016, This Week's Editor's Pick, Access Control & Identity Management, Cyber Security
    South African businesses highlight a 30% percent increase in revenue from new business, while almost three-quarters agree identity-centric security is critical to the business.
  • King IV looks at your data
    November 2016, J2 Software, Cyber Security, Security Services & Risk Management
    The launch of the King IV Report on Corporate Governance by the Institute of Directors in Southern Africa on 1 November provides a wake-up call for South African organisations.

 
 
         
Contact:
Technews Publishing (Pty) Ltd
1st Floor, Stabilitas House
265 Kent Ave, Randburg, 2194
South Africa
Publications by Technews
Dataweek Electronics & Communications Technology
Electronic Buyers Guide (EBG)

Hi-Tech Security Solutions
Hi-Tech Security Business Directory (HSBD)

Motion Control in Southern Africa
Motion Control Buyers’ Guide (MCBG)

South African Instrumentation & Control
South African Instrumentation & Control Buyers’ Guide (IBG)
Other
Terms & conditions of use, including privacy policy
PAIA Manual
         
    Mobile | Classic

Copyright © Technews Publishing (Pty) Ltd. All rights reserved.