Adobe has released a software update that addresses a number of critical vulnerabilities in its products - there is a good overview of this patch and what you need to do in order to apply it on security researcher Brian Krebs’ blog:
http://krebsonsecurity.com/2011/03/critical-security-updates-for-adobe-acrobat-flash-reader
Krebs has noted - interestingly enough - that the update comes a week after Adobe warned that a number of miscreants were exploiting the Flash vulnerability to launch targeted attacks on users. The concept of targeted attacks against users is gaining momentum, including the use of this technique to punch through the security defences of organisations. Recently, for example, we have seen a lot of coverage about yet another targeted attack against a large enterprise - RSA.
When reading about these attacks, it is worth keeping in mind that most do not make the news for several reasons, including the fact that many of them have not yet been discovered. It is also worth noting that many enterprises that do discover attacks, fail to understand their implications, and simply disinfect the computer and then move on. We have been researching targeted attacks for three years, and have concluded that these types of attacks represent the future of online fraud and financial industry darkware.
To demonstrate the power of targeted attacks and why we should take them very seriously, I would like to share with you one example of a simple and very effective targeted attack method. We are in no way suggesting that this attack hit RSA and we do not have any information about that particular attack.
Let us call this attack example VIGNS - vanity infection from Google news searches. The purpose of the VIGNS attack is to place under-the-radar malware on a computer owned by an executive who has access to sensitive corporate information. Once the malware is on the executive's computer it can transmit information on an ongoing basis to an IP address of the hacker's choice.
The attack process, as with any targeted attack, starts with some form of reconnaissance: the attacker searches the business social networking site LinkedIn for executives at the targeted organisation. LinkedIn is the perfect tool for this: one can easily find victims by searching the company name and the role they are after. One then reads the victim's professional profile and decides whether they are a good fit. If they are, then all that needs to be done in order to take it to the next level is the name of the victim.
Next, the attacker needs to build a Web page that infects its visitors. It does not matter where this page is placed - criminals, we have observed, have access to a large number of compromised servers and they are likely to place this page on any one of these servers. The page itself exploits a zero day or a recently discovered browser or browser add-on vulnerability. The recently announced Adobe vulnerabilities are a perfect example and can be easily used to achieve this goal. At any given time, it is easy to find vulnerabilities that can be used for this purpose. Now, the attackers have a Web page that can be used to infect visitors with malware and the name of the victim whose computer they want to compromise.
But how do they get the victim to visit this page? With the help of Google - and their own vanity - of course. Most executives tend to have a Google alert set up on their name. By placing the victim's name within the malicious Web page, it is possible to get Google to index the page and generate a Google alert on the executive's name. The executive will receive the alert and will most likely click the link to check on who is mentioning him/her. Clicking the link will take the executive to a malicious Web page which will then infect their computer. Simple.
Now here is where it gets interesting, our researchers have discovered a number of ways that can be used to enable this attack to fly under the radar of IT security software.
The first method is not to post the exploit on the Web page until after Google's indexing systems have visited the page in question. This will minimise the timeframe that the exploit is active and can be detected. The attackers can easily check when Google visits the malicious Web page and turn on the exploit only after the search engine has made its pass.
The second method is to take the Web page off immediately after the malware reports back that it gained access to the executive's computer. The malware can easily know where it has landed by looking at information such as the e-mail account on the computer. This approach also minimises the time of exposure for the malicious Web page.
The next method is to have the malicious Web page redirect to an old news page that legitimately mentions the executive's name. When the executive accesses the malicious page, their computer gets infected, but since they are on an old news page, they do not suspect any problems.
Another method involves blocking any bots from visiting the malicious website - other than those that you want to let in (such as Google). This prevents bots that are looking for compromised web pages from tagging the page as infected or otherwise malicious.
It is also worth noting that it is possible to apply a number of hacker techniques to ensure that the malware goes undetected. Even if the cybercriminals decide to use a known malware kit such as Zeus or SpyEye, they can easily generate a variant that is undetectable by anti-virus products. After testing the code with
anti-malware software, they can limit its distribution to only the specified - and malicious - Web page. This will keep anti-virus solutions from classifying this threat. The cybercriminals can even make the attack harder to detect by programming the malware to remove itself if it reaches the wrong computer - again by looking at simple parameters such as the e-mail account configured on the computer.
For those readers who believe we are teaching criminals how to execute a targeted attack, rest assured that our research suggests that the criminals are much more sophisticated. This is, as I mentioned, a simple targeted attack, and we have seen far more complex and sophisticated attacks in the wild.
So how do you protect against this type of attack? Being cautious is not enough. I consider myself to be fairly sophisticated when it comes to security awareness, yet I would easily fall for this type of attack. Keeping systems and anti-virus up to date will not help either as the attack uses zero-day unpatched exploits and the malware is completely unknown to anti-virus vendors.
One possible solution is to use tools that specialise in zero-day attack prevention such as our own Trustee Secure Web Access for the Enterprise. Our R&D teams are continuously incorporating new knowledge into the Secure Web Access product to block zero-day malware.
The differentiation from other desktop security solutions is in our data-centric approach: we look at sensitive data and sensitive applications on the computer and identify unknown pieces of software that attempt to access this information or applications. Our software can then block access, report the attempt or remove the violating software from the computer. Since all of these attacks are ultimately looking for sensitive information, this approach is the most likely to detect and block any malicious software that was not been seen before.
The methodology I have presented above is just one in a series of sophisticated, targeted attacks we expect will be launched against organisations in the near future. We strongly recommend that organisations re-evaluate their approach to targeted attacks since they represent, as we witnessed with various incidents in the press, the most dangerous type of threat to their business.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version