STE WILLIAMS

Yet another cyberespionage gang out of Asia has been discovered working on a for-hire basis as advanced persistent threat (APT)-type attackers shift gears toward a more focused, stealthy, “smash-and-grab” strategy using contracted hackers.

Click here for more articles from Dark Reading.
Click here to register to attend Interop.

The newly discovered “Icefog” attack campaign, unmasked by Kaspersky Lab this week, features hit-and-run attacks on targeted Windows machines, where the attackers steal what they’re after and then get out. The attack also appears to be “beta testing” a Mac OS X backdoor, according to the researchers, who say it operates out of China, South Korea, and Japan.

Such a for-hire, commando-type operation at first glance may seem to contradict the “p” in APT — “persistent” — but researchers say the in-and-out attack is a better way to remain undetected and successfully complete their mission. “Getting in and out of networks quickly is generally going to be more covert than staying in long-term. Staying in longer does provide an attacker with the opportunity to exfiltrate the data more slowly,” says Roel Schouwenberg, senior researcher, in an email interview. “I think a lot of people have been using the term APT and cyberespionage interchangeably. This group is as persistent as it needs to be to get the job done.”

Moving in and out of the target’s network quickly suggests the attackers have been instructed to grab specific information, he says. “We do think this actor functions as a cybermercenary group,” Schouwenberg says.

The attackers plant a backdoor that’s directly and manually controlled by the attackers. It doesn’t automatically pilfer information and credentials like most traditional cyberespionage attacks do; instead, the attackers interact “live” with the infected machines. And additional backdoors and malware are placed on the victim’s machines for siphoning the data, as well as moving laterally within the victim’s network, Kaspersky Lab found.

Icefog’s unmasking follows that of a Chinese APT group called Hidden Lynx, which also operates on a for-hire basis, hacking specific targets for clients who commission them. Symantec, which published a whitepaper on the group and its attack methods earlier this month, found that the Hidden Lynx gang was behind water-holing attacks that targeted U.S. financial services firms, and also broke into Bit9’s server to gain access to its file-signing infrastructure in order to sign malware. It’s also connected to the infamous Operation Aurora attacks on Google, Adobe, Intel, and others.

Cyberespionage actors are performing more reconnaissance these days from inside-out as well as outside-in, says Tom Kellermann, vice president of cybersecurity at Trend Micro. Trend Micro lately has seen more “smash-and-grab” attacks by cyberspies, he says.

“It looks more like a commando-style op [now],” Kellermann says. “But keep in mind that, realistically, every time they do leave, they are leaving behind a remote access Trojan or a backdoor in some host” in order to maintain a foothold, he says. In some cases, they leave the backdoors on backup servers because those machines are rarely updated or changed, says Kellermann, whose company published a report this week on APTs.

Icefog, meanwhile, has been in operation since 2011. It has targeted mainly defense contractors in South Korea, Taiwan, and Japan, including government institutions, maritime and shipbuilding organizations, telecommunications providers, satellite operators, high-tech firms, and mass media. Kaspersky Lab says it’s likely the gang — which is still actively attacking victims — also targets interests in the U.S. and Europe.

The researchers sinkholed 13 of Icefog’s 70 or so domains to study the attack, and saw more than 4,000 infected IP addresses and several hundred victims. Among the defense contractors that appear to be in the bull’s eye of the campaign are Lig Nex1 and Selectron Industrial Company; shipbuilding firms DSME Tech and Hanjin Heavy Industries; telecom operator Korea Telecom; and media Fuji TV and the Japan-China Economic Association. Kaspersky Lab says the attacks were not necessarily successful against those targets, however.

They spotted “a few dozen” Windows machines that were infected, along with more than 350 Mac OS X machines. The attackers were mostly stealing sensitive documents, email account credentials, and passwords to internal and external resources of the victims.

Unlike traditional APT attacks that linger for months or years, the Icefog attack lasts for a few days or weeks: Once the attackers get the information they were after, they leave — a more focused APT model that Kaspersky expect to become more popular.

“This is another cyberespionage attack featuring a Mac/OSX component. Businesses need to be thinking more about protecting their non-Windows machines,” Kaspersky’s Schouwenberg says.

[Cyberattacks could have real-world economic consequences in the oil and gas markets, even at the pump. See Destructive Attacks On Oil And Gas Industry A Wake-Up Call .]

Destructive APTs
Kellermann says APTs — which mostly are associated with stealing, not destroying information — could begin adopting a more destructive approach in the near future. “As we become better at incident response, we are going to see more manifestations of destructive payloads against you for turning of a CC,” for example, he says. “It’s not just political events that will be the harbinger of destructiveness … they will use this to punish organizations and to obfuscate what they’re doing on the network.

“They’ve done incredible levels of recon and know our networks better than we do, and know our critical failures.”

There has already been at least one high-profile case of this: The recent Dark Seoul DDoS and data destruction attacks on major South Korean banks, media outlets, and other entities were part of a four-year effort to steal information about South Korean military and government operations. The so-called Operation Troy also targeted U.S. Forces Korea, Republic of Korea, the Korean Department of Defense, and the U.S. Department of Defense, and the DDoS and data destruction attacks were merely serving as a smokescreen for the theft of military secrets about South Korea and the U.S., researchers from McAfee discovered.

Advanced threats, such as nation-state APTs, will be the topic of an Interop talk next week by Bit9 CTO Harry Sverdlove, who will present 14 lessons learned from actual advanced attacks.

The full Kaspersky Lab report on Icefog is available here (PDF) for download.

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/attacks-breaches/rise-of-the-hit-and-run-apt/240161870

Trojans are king: They now account for more than three-quarters of all new malware created and 80 percent of all malware infections, according to new data published this week.

Some 77 percent of all new malware is a Trojan, while worms make up 11.3 percent, and viruses, 10.3 percent, of new malware, PandaLabs found in its second quarter 2013 threat report. The story is much the same for malware infections, with 79.7 percent due to Trojans, 6.7 percent due to viruses, and 6.1 percent due to worms.

“Cybercriminals use Trojans as a key tool to infect users, continually introducing changes to avoid detection, and, in many cases, automating the process of changing the Trojan,” says Luis Corrons, technical director of PandaLabs. “They use scripts and special tools in order to change the binaries run on victims’ computers to evade the signature-based detection used by antivirus firms.”

Overall, the volume of new malware samples rose in Q2 — 12 percent more than the same period in 2013, and 17 percent more than the first half of the year.

China is home to the most infected machines, with 52.4 percent of infections, followed by Turkey, with 43.6 percent, and Peru, 42.1 percent. Europe has the lowest infection rates overall: The U.K. is No. 1 there, with 24.5 percent.

Speaking of China, it got a bit of a reprieve from the spotlight as the main cyberespionage actor in Q2 after controversial NSA spying programs came to light, according to PandaLabs. “China continues to occupy many of the headlines regarding cyberespionage, although in this quarter, the USA has been in the eye of the storm after revelations about the PRISM program that the NSA used to obtain data from users of platforms such as Facebook, YouTube or Skype,” Corrons says.

The full PandaLabs report is available here (PDF) for download.

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/vulnerability/report-8-out-of-10-users-infected-with-a/240161853

NEWPORT BEACH, Calif., Sept. 26, 2013 /PRNewswire/ — Cloud Security Corporation, (OTCBB: CLDS) a leading cloud security company, provided the following update. The Company has consolidated its business operations under the name Cloud Security Corporation and recently changed its website to www.cloudsecuritycorporation.com. Company management is focused on continuing to develop cutting edge cybersecurity technology, raising additional operational capital and exploring prospective acquisitions.

“We’re very pleased by recent developments across the board in Cloud Security Corporation,” stated Safa Movassaghi, Chief Executive Officer, of Cloud Security. “We are currently in advanced negotiations with investors and continue to pursue acquisition targets in the technology sector. ”

About Cloud Security Corporation

Cloud Security Corporation is an innovative cloud computing company that creates security, technology, and products. The Company develops products in the remote-access computing sector including enhanced security connections. Cloud Security Corporation has developed patent-protected remote access security devices such as MyComputerKey(TM). The Company also develops online application security products and is expanding into other verticals.

For more information, visit:

www.cloudsecuritycorporation.com

Article source: http://www.darkreading.com/cloud-security-corporation-corporate-upd/240161894

Six years ago, when Mike Hamilton, the chief information security officer for the City of Seattle, wanted to collaborate with other local municipalities, the federal government and critical-infrastructure providers to exchange threat information, no platform existed through which to share threat intelligence.

Instead, the City of Seattle, along with the U.S. Department of Homeland Security and the University of Washington, created a system based on a security information and event management (SIEM) system. Dubbed the Public Regional Information Security Event Management (PRISEM) system, not to be confused with the National Security Agency’s controversial PRISM project, the platform allows the City of Seattle’s information security team to collect threat information from federal agencies and security firms, develop indicators of compromise, and look for malicious activity across the networks of PRISEM members.

Using the system, analysts “can search all the monitored jurisdictions for the indicators of compromise in a number of ways, and we can notify them when we see them talking to bad places,” Hamilton says. “As a whole, we are able to get in front of threats a lot faster than if everyone was operating independently.”

The City of Seattle is one of the few successful collaborations between organizations to share information on online threats, attacks and compromises. Fear of liability, a lack of trust between business rivals and a still-developing standards have slowed the adoption of collaborative threat-intelligence platforms. In addition, the threat intelligence gained from the system was not actionable, but a firehose stream of data through which an analyst was required to sift.

Yet, that may be changing. Last week, Hewlett Packard refreshed its security offerings, among them a threat-intelligence sharing environment known as Threat Central. Customers who subscribe to the system will be able to upload threat data from their HP ArcSight devices or any database compliant with the Structured Threat Information Expression (STIX) standard created by government contractor MITRE.

Working together is the only way to defend against the widespread attacks that companies, government agencies and educational institutions are seeing today, says Ted Ross, director of field intelligence for HP Security Research.

“The adversary figured this out a long time ago,” he says. “And if we don’t collaborate effectively as a community then, we will be attacked in ways that people are not expecting.”

HP’s Threat Central is only the latest threat-intelligence collaboration platform to arrive. A wide variety of other platforms have been created by large companies, small startups and even academic research groups.

Georgia Tech, for example, has created a system for malware analysis and threat-data sharing called Apiary, which can quickly analyze malware and return information to the more than 100 organizations working with the university on the beta project. Malware-analysis-as-service firm ThreatGRID has its own system for analyzing binaries and creating indicators of compromise from the files. The service, which processes up to 500,000 suspect files every day, allows teams to collaborate and share their findings with teams from other companies.

The Open Threat Exchange, a community driven project managed by unified-security provider AlienVault, allows anyone using the Open-Source Security Information Manager (OSSIM) or Alien Vault’s own product to upload threat data, investigate threats and download indicators of compromise.

Threat Connect, a threat analysis and collaboration environment created by security services firm Cyber Squared, pulls data from a number of sources to allow security analysts to more quickly triage and analyze threats.

“Threat intelligence is a really complicated area, so everyone has a different approach to providing a customer a solution for threat intelligence,” says Adam Vincent, CEO of Cyber Squared. “Collaboration is definitely a main part of that, but each company has a different perspective on the problem.”

Yet, all the firms face two common problems. When a threat information-sharing platform is small, the participants know each other and are more likely to share. But as they grown, distrust sets in and fewer companies share and more just consumer information, says Dean De Beer, chief technology officer of ThreatGRID.

“The majority of companies are consumers,” he says. “You have people who are giving up a lot of data, and they will get tired of not getting much back.”

In those cases, the companies who run the services have to step up and add at least a baseline value to the service to keep the most productive customers coming back, De Beer says.

[Companies participating in threat-intelligence programs have suffered from too much information, and they struggle to deal with information that is neither actionable nor relevant. See Dolloping Out Threat Intelligence.]

While the disparate levels of benefit that each customer gets is one problem, another issue is the lack of trust. Both the City of Seattle and another threat-information sharing system run by the Research and Education Networking Information Sharing and Analysis Center (REN-ISAC) have been successful because their constituents are not competitors. In the business world, that is a harder sell.

For that reason, Cyber Squared, HP, and Georgia Tech allow every member to share or restrict any information and do it anonymously.

“A big part of the challenge is getting commercial entities to cooperate,” says Lars Harvey, president of Internet Identity, which released a study on the challenges facing threat-intelligence sharing this week. “We have to figure out a way to get larger and broader exchanges going on.”

The industry also has to change the perception that it is taking information, creating a product or service, and not giving enough back, says Barmak Meftah, CEO of AlienVault. The security-management provider made its platform free to make customers more confident in their motives.

“The Achilles’ Heels of the industry is that it is very vendor driven, and each vendor has a myopic view of these attacks,” he says. Intrusion detection vendors look for signatures, vulnerability management providers look for weak points in the network, and next-generation firewalls look for signs of malware on the network. “The concept of threat capture has been very myopic and very closed and captive.”

Yet, companies have to solve these problems and find ways to work together better, says Seattle’s CISO Hamilton. The attackers are benefiting from exchanging information on attack strategies, vulnerabilities and better ways of monetizing compromises. Defenders have to do it to, he says.

“From a 30,000-foot level, this is the way that the world needs to work,” Hamilton says. “The one-stop shop for sending all you threat information to a vendor, looking to boil that ocean—that doesn’t scale. But done regionally like we are doing it—that can scale.”

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/threat-intelligence/threat-intel-sharing-services-emerge-but/240161881

SAN FRANCISCO, September 24, 2013 – Nexgate, an innovator in social media brand protection and compliance today announced the availability of a first-of-its-kind Global Social Media Spam List to root out spam across branded social media accounts, as well the release of its new 2013 State of Social Spam research report (available at http://nx.gt/SocialSpamReport) from Nexgate’s team of data scientists detailing social media spam techniques and trends taken from analysis of more than 60 million unique social posts and comments including 25 million social media user accounts.

Social media spam is a fast growing attack and exploit vector for cybercriminals. Traditional security defenses, like email and Web filtering are designed to detect spam and malicious content entering the corporate network; however, social media and its spam lives outside the corporate network and on the accounts of the brand itself, thus rendering anti-malware and anti-spam technologies from the leading providers useless.

Investment in social media advertising alone is expected to reach nearly $7 billion in 2013, as marketers scramble to engage customers, partners and prospects on Facebook, Twitter, YouTube, and the other leading social networks. As the money flows to social media, the bad guys quickly follow with Facebook spam alone generating an estimated $200 million.

According to new research just released in Nexgate’s State of Social Media Spam Report, 1 in 21 social messages contain risky content, and 15% of all social media spam contains a URL to a potentially dangerous source. Brands investing in social media face a four fold threat from this growth in spam, including diversion / dilution of their ROI by hosting spammers’ ads, exploitation of their target audience by spammers, and damage to brand trust.

Nexgate’s new Global Social Media Spam List is the first and only such list created to stop spam on branded social media pages across social networks. Available immediately as part of its enterprise social media brand protection and compliance service, the list is compiled from spam and spammers detected across more than 25 million individual social media users accounts, 10,000 branded accounts, and analysis of more than 60 million pieces of social content. Spammers are added to the list based on detection techniques using Nexgate’s patent-pending social content and application classification technology. This complete technology set includes the ability to scan content, the applications being used to publish the content, and the profile that is publishing on social media accounts to identify and automatically remove spam from brand-owned pages based on the classification of spam content, spam apps, and spammer profiles. It also includes coverage for malware, inappropriate content, confidential data, regulated data, and more. Nexgate’s new Global Social Media Spam List is enabled by default for Nexgate customers. Spammers on the list are automatically blocked from posting content to any social media account protected by Nexgate.

Additional findings in the just released Nexgate State of Social Media Spam Report include:

Since the start of 2013, social media spam has increased 355%

1 in 21 social media messages across Facebook, YouTube, Google+, and Twitter contain risky content, such adult language, hate speech, private or regulated data, or spam

1 in 200 social media messages contain spam, including lures to adult content and malware

Spammy apps, like-jacking, social bots, and fake accounts are among the most widely used methods of distributing social media spam

5% of social apps are classified as spammy

15% of all spam contains a URL

Spammers often spam at least 23 different social media accounts

“There’s no question social media spam is on the rise and is a real challenge to enterprise brands,” said Alan Webber, Principal at Asymmetric Insights. “As evidenced in Nexgate’s 2013 State of Social Media Spam report, spam volumes increase at a faster rate than content on branded pages. Thus, efficiently addressing this problem is critical to the overall success of social media personnel and brand managers who wish to effectively engage with their customers and prospects.”

“The dramatic rise in social spam is a significant burden to big brands, and is caustic to the ROI of social media marketing programs,” said Devin Redmond, Co-founder and CEO, Nexgate. “Teams that ignore spam are effectively sponsoring it and deteriorating their programs effectiveness and overall brand trust. The teams that are fighting it are typically struggling because most tools aren’t designed for the sophisticated nature of the problem, and thus they’re left to manually remove spam content via their internal teams resource or expensive outsourcing partners. Given this and the rise in spam volumes, it’s no wonder moderation costs have more than doubled. Just like spam in email, dealing with social media spam requires advanced technology to root out the bad stuff. Nexgate’s robust capabilities mean that enterprise social media teams can automatically and cost-effectively protect their brand and their audience in a more scalable way.”

More Information:

Global Social Media Spam List

State of Social Media Spam Report

Nexgate Enterprise Suite

For more information on Nexgate, its new Global Social Media Spam List, or to download the new 2013 State of Social Media Spam Research Report, visit nexgate.com.

About Nexgate

Nexgate provides cloud-based brand protection and compliance for enterprise social media accounts. Its patent-pending technology seamlessly integrates with the leading social media platforms and applications to find and audit brand affiliated accounts, control connected applications, detect and remediate compliance risks, archive communications, and detect fraud and account hacking.

Nexgate is based in San Francisco, California, and is used by some of the world’s largest financial services, pharmaceutical, Internet security, manufacturing, media, and retail organizations to discover, audit and protect their social infrastructure.

Article source: http://www.darkreading.com/applications/nexgate-releases-first-ever-global-socia/240161832