How hackers use Chelsea Clinton and the World Cup to steal your data

EDITOR's NOTE: This is part two of a two-part story on cybersecurity issues. Click here for part one .

Last year saw a substantial upswing in malware; it was a factor in 94 percent of all data lost, according to Verizon’s Data Breach Investigations Report for 2010.

And the malware most often used is the SQL injection attack or an injection of malware after the attacker has root access to a system. Both methods can evade antivirus software and other traditional detection methods.

In its recently released “2010 Midyear Security Report,” Cisco Systems Inc. noted “an uptick in generalized SQL injection attacks, culminating with a June 2010 re-emergence of Asprox [a Trojan that wrought havoc on the United Kingdom government and computer systems two years ago].”

Analysis “revealed that attackers had begun reconnaissance sweeps looking for susceptible SQL servers starting in late March 2010,” blogged Mary Landesman, market intelligence manager for ScanSafe, a Web security solution provider Cisco acquired last December.

Reconnaissance sweeps, which can indicate network mapping, are normal when generated from in a network. The same activity generated from outside a network is suspect, especially as about 51 percent of the injected malware is installed by a remote attacker, the Verizon report said.

Attackers will use different methods to get into a system, with numerous gambits exploiting Web browsers. “In so-called man-in-the-browser attacks, cyber attackers can exploit the ability of browsers to access the network stack on the host machines and get to the data before it’s been encrypted — that’s the goal,” said Enterprise Management Associates managing research director Scott Crawford.

Search engine results pages play a significant role in driving traffic to compromised Web sites. During the first quarter of 2010, the Cisco report said, “7.4 percent of all Web-based malware encounters resulted from search engine queries, and nearly 90 percent of all Asprox encounters in June 2010 were the result of links in search engine results page."

For example, recent Internet searches for Chelsea Clinton and wedding would turn up links to several such sites. Clicking on the link would take a user to a site warning of a malware infection and offering to remove it. Before Chelsea Clinton’s wedding, it was the World Cup, said the lead author of the report, Wade Baker, Verizon Business director of risk intelligence. “They’ll use the headlines of the day as bait. The malware will install itself on the user’s desktop or laptop, then dial out to another machine and say, ‘I’ve infected this organization, come do something.’ ”

That could be “a back door that might open a port on the machine or perhaps a key logger to steal user names or passwords to access the system, or it could make the desktop part of a botnet and start sending out spam or host illegal software,” Baker said. “Users are too willing to click on links.”

And daily, the number of gambits multiply. For example, Baker said, “Twitter uses URL shorteners to help keep Twitter messages short. Attackers have picked up on that because you can put anything behind a shortened URL and not know where in the world it goes to.”

Attackers shop to drop victims

In an appendix to the Verizon DBIR report, the Secret Service, the only Homeland Security Department entity authorized to investigate computer fraud, warns of an increasingly sophisticated cybercrime community.

“Criminals are surprisingly adaptive in developing entire new categories of online schemes,” the Secret Service writes. One example is the booming fake antivirus business. Users get bogus alerts designed to trick them into buying software that supposedly will protect their systems, but which is completely useless. While hardly new, the number of such scams jumped in 2008 and now comprise a significant percentage of all malware, the appendix said.

Criminals also have access to continuously growing numbers of new back-office services, such as antivirus checking services. The service providers buy subscriptions to dozens of commercial antivirus and security software packages. For a small fee, their customers can upload malware to see if any current security product will detect it. “This type of service allows criminals to know with certainty if the malware they are planning to deploy will be detected by any of the widely deployed antivirus products,” the Secret Service said.

Spying on IT systems has never been easier for criminals. “If a criminal needs a piece of spyware,” the Secret Service said, “he can download several samples of such software (many of low quality in one regard or another) from several Internet archives.”

The incipient attacker can modify the spyware for his needs or “spend several thousand dollars and buy a full-featured, undetectable spyware package from a current vendor who will support it,” the service said. “If he needs an exclusive package, there have been reports of other spyware products that can cost tens of thousands of dollars, if one knows the right people.”

Increasingly, such seems to be the case, with 54 percent of breaches involving malware and 97 percent of the 140 million records being compromised by customized malware, Baker said. Customization once meant software tweaked to evade antivirus detection, but now include modified code to let the attacker hide or encrypt the output file of captured data, he said in the report.

And there’s no putting the cat back in the bag. “The culture also has evolved over the last decade and is now described as non-state sponsored, transnational and is almost impossible to infiltrate due to its dynamic nature and operational security,” the Secret Service said.

Take up the drawbridge

Organizations and security gurus have devised guidelines, checklists, milestones; security information and event management (SIEM), log aggregation and analysis, and other network monitoring software can help fend off and detect threats, although new threats evolve daily.

“I am a big fan of aggregating events,” Baker said, “but unfortunately, the motivation and the way people use the tools turns out something like this: They’ll buy an intrusion detection system and they’ll turn it on. It’ll start making noise and they get tired of responding to false positives, so they end up turning it off or turning it way down to where it doesn’t alarm for pretty much anything.”

On the surface, it seems simple: If an organization suspects a data breach has occurred, and it’s known that in 86 percent of cases, the evidence is in their log files, why don’t they just look at the log files?

Some IT departments don’t know what to look for, Baker said. Some don’t have enough resources to dedicate staff to analyzing and monitoring the data. Some just don’t have the technology, he said.

But some intrusion protection is easy to implement. “It’s Security 101,” Baker said. “You get a device from the factory with a default password, first thing you do is change it. That’s a very airy hole, it’s nothing new, but organizations still have a very difficult time taking care of it.”

Security is less a question of milestones or checklists and more an issue of making and enforcing policy, Crawford said. “Read Gene Kim on this.” Kim is co-author of “Visible Ops Security” and former chief technology officer of IT security and compliance software developer TripWire Inc.

“Ensuring that information security focuses on protecting what matters to the organization, and then embedding information security controls into daily operations of change management, access management and incident management,” Kim writes. “This will enable us to deter unauthorized changes, reduce the likelihood of unauthorized access, reduce efforts around audit preparation, remediation and short then time required to detect and correct information security incidents.”

The secret to successful security is a lot like the secret to success at anything: First, you show up.

“It’s everyday practices, doing them every day across thousands of systems — that’s the real challenge,” Baker said.