SAN JOSE, CA — (Marketwired) — 12/03/15 — A researcher from has written examining how hackers use third party services to coordinate malware campaigns. The paper was published by Virus Bulletin for their VB2015 conference, and examines how the encryption used by online services like Twitter enable attackers, such as the state-sponsored group The Dukes, to spread malware and steal data.
“If I had to put it in a nutshell, I–d say that attackers are using certain third party services to help them fly under the radar of corporate security,” said F-Secure researcher, , who authored the report and presented his findings at VB2015. “Many online services use encryption to prevent data from being intercepted and stolen while in transit, but the downside of this is that security measures like firewalls aren–t able to identify malicious traffic. It–s a real challenge for companies, and my research has shown how attackers like The Dukes capitalize on this advantage in their attacks.”
The Dukes are a group of state-sponsored attackers that have been targeting governments and related organizations for at least the last seven years, and were the topic of a recent whitepaper published by F-Secure Labs. Lehtiö–s new report provides details on how The Dukes execute attacks by using third party services as what security researchers call “command and control” infrastructure — essentially a tool to coordinate attacks.
The report specifically highlights how The Dukes were able to use Twitter to communicate with infected machines, and direct them to download additional malware. The Dukes were also able to use Microsoft OneDrive as a data exfiltration tool, allowing them to retrieve stolen data without drawing attention to themselves.
“Using these services as command and control infrastructure lets attackers piggyback on the network access given to reliable online platforms,” said Lehtiö. “Attackers use them for communication with devices that they–ve already infected, so in these cases, they–re not being used to directly target the service providers or random users. Things like social media simply give attackers a user-friendly, cost effective tool to coordinate their campaigns to make sure they achieve their objectives.”
Malware campaigns using third party services are often difficult for companies to detect because the malicious data exchanged between attackers and their targets is encrypted and mixed together with legitimate traffic. And research suggests that many companies are not actively decrypting web traffic to differentiate between the two. One study found that less than fifty percent of companies with dedicated secure web gateways decrypt outbound traffic, and less than twenty percent of organizations with firewalls, intrusion prevention systems, or unified threat management appliances decrypt inbound or outbound SSL traffic.*
But according to F-Secure senior researcher, , relying on security solutions that decrypt Internet traffic can be a risky proposition, and companies need to be aware of the potential difficulties in this approach. “Decrypting network traffic using man-in-the-middle techniques can be costly and very complicated to do properly. There have been cases where attackers have taken advantage of this approach to access their victim–s encrypted Internet traffic, essentially exposing confidential information rather than securing it. Companies taking this approach should make sure they have a unique certificate given only to their organization, as using shared certificates greatly increases the risk of a man-in-the-middle attack.”
Niemelä added that reliable can disrupt these attacks at the point of the initial infection as it does not depend on being able to break or bypass encryption, making it a safe, efficient way for companies to protect themselves. Both of F-Secure–s corporate security offerings, and , use award-winning endpoint protection technology to detect and prevent malware infections.
*Source:
F-Secure has been defending tens of millions of people around the globe from digital threats for over 25 years. Our award-winning products protect people and companies against everything from crimeware to corporate cyberattacks, and are available from over 6000 resellers and 200 operators in more than 40 countries. We–re on a mission to help people connect safely with the world around them, so join the movement and switch on freedom!
Founded in 1988, F-Secure is listed on NASDAQ OMX Helsinki Ltd.
| |
You must be logged in to post a comment Login