We’re seeing a change in cybercrime and the way cyberattacks are being performed. A recent set of attacks against critical infrastructure entities exposed a new approach to cybercrime and critical infrastructure hacks. Oil and gas pipeline operators, utilities, and even some city and state governments reveal the following new methods and motives.
Attackers were not out to steal data but were looking to disrupt services. Attackers used a new attack vector not previously seen. Instead of attacking primary targets directly, the attackers zeroed in on less secure vendors of those targets. We will be looking at how they did this along with how this can be prevented.
Step One – Reconnaissance
Before launching an attack, hackers first identify a vulnerable target and explore the best ways to exploit it. The initial target can be anyone in an organization. The attackers simply need a single point of entry to get started. Targeted phishing emails are common in this step as an effective method of distributing malware.
The whole point of this phase is getting to know the target. The questions hackers are answering at this stage are:
- Who are the important people in the company? They discover this information by looking at the company website or LinkedIn.
- Who do they do business with? For this, they may be able to use social engineering by making a few “sales calls” to the company. Another way is good old-fashioned dumpster diving.
- What public data is available about the company? Hackers collect IP address information and run scans to determine what hardware and software are being used. They also commonly check the Internet Corporation for Assigned Names and Numbers (ICAAN) web registry database.
The more time hackers spend researching and gaining information about the people and systems at the company they’re targeting, the more successful the hacking attempt will be.
Step Two – Weaponization
In this phase, the hacker uses the information they gathered in the previous phase to create what they need to get into the network. This could be creating believable spear-phishing emails. These would look like emails employees of the targeted company could potentially receive from a known vendor or other business contact.
The next is step is creating watering holes, or fake web pages. These web pages will look identical to a vendor’s web page or even a bank’s web page. The sole purpose of this step is to capture your username and password, or to offer you a free download of a document or something else of interest.
The final thing the attacker will do in this stage is collect the tools they plan to use once they gain access to the network so that they can successfully exploit any vulnerabilities they find.
Step Three – Delivery
Now the attack starts. Phishing emails are sent, watering hole web pages are posted to the Internet and the attacker waits for all the data they need to start rolling in. If the phishing email contains a weaponized attachment, then the attacker waits for someone to open the attachment and the subsequent malware to call home.
Step Four – Exploitation
Now the fun begins for the hacker. As usernames and passwords arrive, the hacker tries them against web-based email systems or virtual private network (VPN) connections to the target company network. If malware-laced attachments were sent, then the attacker remotely accesses the infected computers. The attacker explores the network and gains a better idea of the traffic flow, what systems are connected and how they can be exploited.
Step Five – Installation
In this phase, the attacker makes sure they continue to have access to the network. They will install a persistent backdoor, create admin accounts on the network, disable firewall rules and perhaps even activate remote desktop access on servers and other systems on the network. The intent at this point is to make sure the attacker can stay in the system for as long as they need to.
Step Six – Command and Control
Now they have access to the network, administrator accounts and all the needed tools are in place. They have unfettered access to the entire network. They can look at anything, impersonate any user on the network and even send emails from the CEO to all employees. At this point, they are in control. They can lock you out of your entire network if they want to.
Step Seven – Achieve the End Goal
Now that they have total control, they can achieve their objectives or end goal. This could be stealing information on employees, customers, product designs, etc. Or they can start interfering with the operations of the company. Remember, not all hackers are after monetizable data. Some hackers are out to just mess things up.
If you take online orders, they could shut down your order-taking system or delete orders from the system. They could even create orders and have them shipped to your customers. If you have an industrial control system and they gain access to it, they could shut down equipment, enter new set points and disable alarms. Not all hackers want to steal your money, sell your information or post your incriminating emails on WikiLeaks. Some hackers just want to cause you pain.
So, what now?
What can you do to protect your network, your company and even your reputation? You need to prepare for an attack. Let’s face it, sooner or later hackers WILL come for you, It’s just a matter of when and how. Don’t let yourself think you don’t have anything they want. Trust us, you do.
– This article originally appeared on Velta Technology’s blog. Velta Technology is a CFE Media content partner.
Original content can be found at www.veltatech.com.
Do you have experience and expertise with the topics mentioned in this article? You should consider contributing content to our CFE Media editorial team and getting the recognition you and your company deserve. Click here to start this process.
