Scribd Logo
Upload

Welcome to Scribd!

  • 51 views

    Cyber Espionage, Infiltration and Combating Techniques: - by Atul Agarwal & CERT-IN

    Uploaded by

    yawahab
    Cyber espionage involves obtaining secrets through hacking techniques like phishing and social engineering. Attackers may be cyber criminals seeking financial gain through mass attacks, or state-sponsored agents pursuing intelligence through targeted attacks known as advanced persistent threats (APTs). Notable APTs include Operation Aurora against Google and others, and Stuxnet which targeted industrial systems in Iran. Defenses include two-factor authentication, malware analysis, and safe computing practices.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Cyber Espionage, Infiltration and Combating Techniques: - by Atul Agarwal & CERT-IN

    Uploaded by

    yawahab
    51 views22 pages
    Cyber espionage involves obtaining secrets through hacking techniques like phishing and social engineering. Attackers may be cyber criminals seeking financial gain through mass attacks, or state-sponsored agents pursuing intelligence through targeted attacks known as advanced persistent threats (APTs). Notable APTs include Operation Aurora against Google and others, and Stuxnet which targeted industrial systems in Iran. Defenses include two-factor authentication, malware analysis, and safe computing practices.

    Original Description:

    CISP

    Original Title

    CIPS-2013-0128

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Cyber espionage involves obtaining secrets through hacking techniques like phishing and social engineering. Attackers may be cyber criminals seeking financial gain through mass attacks, or state-sponsored agents pursuing intelligence through targeted attacks known as advanced persistent threats (APTs). Notable APTs include Operation Aurora against Google and others, and Stuxnet which targeted industrial systems in Iran. Defenses include two-factor authentication, malware analysis, and safe computing practices.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    51 views22 pages

    Cyber Espionage, Infiltration and Combating Techniques: - by Atul Agarwal & CERT-IN

    Uploaded by

    yawahab
    Cyber espionage involves obtaining secrets through hacking techniques like phishing and social engineering. Attackers may be cyber criminals seeking financial gain through mass attacks, or state-sponsored agents pursuing intelligence through targeted attacks known as advanced persistent threats (APTs). Notable APTs include Operation Aurora against Google and others, and Stuxnet which targeted industrial systems in Iran. Defenses include two-factor authentication, malware analysis, and safe computing practices.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 22

    Cyber Espionage, Infiltration

    and Combating Techniques

    -By Atul Agarwal & CERT-IN


    What is Cyber Espionage,
    Infiltration
    • Cyber spying or Cyber espionage is the act
    or practice of obtaining secrets without
    the permission of the holder of the
    information (personal, sensitive,
    proprietary or of classified nature), from
    individuals, competitors, rivals, groups,
    governments and enemies for personal,
    economic, political or military advantage

    - Wikipedia
    How?
    • Done using exploitation methods on
    the Internet, networks or individual
    computers through the use of cracking
    techniques and malicious software
    including Trojan horses and spyware.

    - Wikipedia
    Attacking techniques
    While targeting the end users, the following
    attack techniques are commonly seen:
    • Phishing
    • Exploits
    – Drive-by downloads
    – Attachments
    • Social Engineering
    – USB Drive
    – Trojan horses / backdoored software
    Attack Types : By motive
    • Generally, cyber attacks could be
    categorized into two groups:

    – Mass attacks – Cyber Crime


    • Main motive is financial gains
    – Targeted attacks – Espionage
    • Motive is Intelligence gathering.
    Modus Operandi : Cybercrimes
    • Highly organized
    • Outsourced to specialist
    • Use off the shelf malware
    – Zeus, SpyEye
    • Use off the shelf exploit kits
    – BlackHole, CrimePack etc.
    Modus Operandi : Espionage
    • State backed / Corporate backed
    • Motive is exfiltration of national secrets
    / corporate secrets.
    • APT – Advanced Persistent Threats
    APT
    • Advanced – Operators behind the threat have a full
    spectrum of intelligence-gathering techniques at their
    disposal. These may include computer intrusion
    technologies and techniques, but also extend to
    conventional intelligence-gathering techniques such as
    telephone-interception technologies and satellite
    imaging.
    • Persistent – Operators give priority to a specific task,
    rather than opportunistically seeking information for
    financial or other gain. This distinction implies that the
    attackers are guided by external entities.
    • Threat – APTs are a threat because they have both
    capability and intent. APT attacks are executed by
    coordinated human actions, rather than by mindless and
    automated pieces of code.
    Cases Studies
    • Operation Aurora
    – Began in mid-2009 and continued through December
    2009
    – Targets
    • Google
    • Adobe Systems
    • Juniper Networks
    • Rackspace
    • Yahoo
    • Symantec
    • Northrop Grumman
    • Morgan Stanley
    • Dow Chemical
    – Internet Explorer Zero Day used
    Stuxnet
    • Exploits four unpatched Microsoft
    vulnerabilities, two for self-replication and
    two for escalation of privilege
    • Contact a command and control server (to
    download and execute code)
    • Contains a Windows rootkit that hide its
    binaries
    • Attempts to bypass security products
    • Two valid certificates: Realtek and
    • JMicron, both companies based in the same
    building in Taiwan
    Stuxnet
    • Fingerprints a specific industrial control
    system and modifies code on the Siemens
    • PLCs to potentially sabotage the system
    • Hides modified code on PLCs, essentially a
    rootkit for PLCs
    • Copies itself into Step 7 projects in such a way
    that it automatically executes when the Step 7
    project is loaded
    • Updates itself through a peer-to-peer
    mechanism within a LAN
    • Airgaps not safe! (USB was vector here)
    More APTs
    • Shadows in the cloud
    • Operation Shady RAT
    • Red October
    • Operation Hangover
    • And more..
    Zero day Market
    • Shopping For Zero-Days: A Price List For
    Hackers' Secret Software Exploits :
    Forbes
    Sources
    • zero day black market
    forums
    • zero day legitimate market
    "penetration testing" software
    advanced exploit packs
    exploit-kits
    VUPEN
    Defence contractors
    Anonymous Infra
    • “BulletProof” Servers
    • PasteBin / Free hosting etc.
    • VPN/Proxy
    • Anonymous Mass Emailing
    Anonymous Money
    • Liberty Reserve
    • Paypal
    • Other E-currencies
    • Bitcoin
    • Hawala?
    Mitigations / Problems
    • Two Factor Authentications
    • IP Whitelisting
    Basic Malware Analysis and
    Identification

    • Using Online Scanners


    • Malware - Virustotal.com
    • Malware - NoVirusThanks.com (Private
    Samples)
    • PDF's, Flash, URL's – Wepawet
    • Malware Analysis report - Anubis
    Basic Malware Analysis and
    Identification

    • Verifying integrity of executables


    • MD5, SHA Hashes and hash generation too
    • Crosschecking Whitelist hash db
    (http://isc.sans.org/tools/hashsearch.html)
    • Virustotal Hash
    • Tripwire
    Basic Malware Analysis and
    Identification

    • Virtualization and Sandboxing


    • About Virtualization and Sandboxing
    • Analyzing & using unknown binaries in
    Virtual Environments and Sandboxes
    • Using sandboxed browsers
    • Using Snapshots, non-persistant drives to
    stay safe
    Best Practices

    • Disabling Autorun
    • Using Email Safely
    • Using online document readers
    • Using safe document readers (Sumatra, OpenOffice)
    • Disable Javascript on PDF Readers
    • Using safe browsers + NoScript
    • Using OpenDNS
    • Identifying Phishing (Phishtank)
    • Identifying Executable extensions

    You might also like