Cybercrime economy: The business of hacking.

The profile of typical cyber attackers – and the interconnected nature of their underground economy – have evolved in the last several years. Adversaries are increasingly leveraging management principles in the creation and expansion of their operations to ultimately increase their impact and financial profits. Enterprises can use this inside knowledge against the attackers to disrupt the organizational structure and mitigate their risks.
 

The attackers’ value chain

Today’s adversaries often create a formalized operating model and ‘value chain’ that is very similar to legitimate businesses in structure, and delivers greater ROI for the cybercriminal organization throughout the attack lifecycle. If enterprise-level security leaders, regulators and law enforcement are to disrupt the attackers’ organization, they must first understand every step in the value chain of this cybercrime economy.
Critical elements to the attackers’ value chain models typically include:
Human resources management – Includes recruiting, vetting and paying the supporting ‘staff’ needed to deliver on specific attack requirements; the skills-based training and education of attackers also falls within this category.
Operations – The ‘management team’ that ensures the smooth flow of information and funds throughout the attack lifecycle; this group will actively seek to reduce costs and maximize ROI at every step.
Technical development – The front-line ‘workers’ providing the technical expertise required to perform any given attack, including research, vulnerability exploitation, automation, and more.
Marketing and sales – These teams ensure that the attack group’s reputation in the underground marketplace is strong and the illicit products are both known and trusted among the target audience of potential buyers.
Outbound logistics – This encompasses both the people and systems responsible for delivering purchased goods to a buyer, be it large batches of stolen credit card data, medical records, intellectual property or otherwise.
“Cybercriminals are highly professional, have robust funding, and are working together to launch concentrated attacks.”

Disrupting the chain and advancing enterprise protection

HPE recommends a number of approaches for enterprise security professionals to better defend against these organized attackers:
Reduce the profits – Limit the financial rewards adversaries can realize from an attack on the enterprise by implementing end-to-end encryption solutions. By encrypting data at rest, in motion and in use, the information is rendered useless to the attackers, restricting their ability to sell and reducing profits.
Reduce the target pool – The expansion of mobile and IoT has dramatically increased the possible attack surface for all enterprises. Organizations must build security into their development processes, and focus on protecting the interactions between data, apps and users regardless of device to better mitigate and disrupt adversary attacks.
Learn from the adversaries – New technologies such as ‘deception grids’ provide methods of trapping, monitoring and learning from attackers as they navigate their way through a realistic duplication of the network. Enterprises can use this information to better protect their real network, disrupt similar attacks before they begin, and slow down the progress of attackers.

The gravest dangers for CMS-based websites

Over a third of all websites on the Internet are powered by one of these four key open source platforms: WordPress, Joomla!, Drupal and Magento.
This makes the life of attackers looking to compromise websites much easier, as they can simply concentrate on exploiting vulnerabilities in one of them, or one of the popular plugins and extensions for them.

Sucuri, a security company that concentrates on detecting web attacks and remediating compromised websites, has recently released fresh statistics on hacked websites.

How the websites get hacked

Based on the reports by the company’s Incident Response Team and Malware Research Team, in the first quarter of this year 78 percent of the successful compromises were of websites built on WordPress. Joomla!-based sites came in at 14 percent, Magento at 5 percent, and Drupal at 2.
Magento-powered e-commerce sites are usually hit with exploits for the critical remote code execution bug patched in February 2015, and the XSS hole that can lead to e-store hijacking, plugged in January 2016. Obviously, not all admins update their installations regularly.
In fact, admins of Magento sites are the worst at this: 97 percent of the Magento installations Sucuri’s experts encountered during cleanup were out of date. WordPress admins are much better – “only” 56 percent of the installations were out of date. The three leading software vulnerabilities affecting the most websites in the first quarter were the RevSlider and GravityForms plugins, followed by the TimThumb script.”

 All three plugins had a fix available over a year, with TimThumb going back multiple years (four to be exact, circa 2011). This goes to show and reiterate the challenges the community faces in making website owners aware of the issues, enabling the website owners to patch the issues, and facilitating the everyday maintenance and administration of websites by their webmasters.”
The problem with RevSlider, in particular, is that its embedded within WP themes and frameworks, and many users don’t even know they use it. It’s up to the authors of these offerings to keep the plugins updated, but too many can’t be bothered.

How hackers leverage compromised websites

Magento sites are usually hacked to get at customers’ payment information.
The rest are usually used for SEO spam (31%, and that percentage keeps rising), drive-by-download infections (60%), hosting hacking tools (exploit or DDoS tools), and phishing. Plain old defacements by hacktivists are few and far between.
In over two-thirds of cases, the cleaning team found backdoors in the websites – the attackers want to make sure that they will be able to get back in if admins attempt to clean up the site.
“On average, we clean 132 files per compromised site.”
“This shows how deep the malware can be embedded within a website. It also explains why Google sees a 30% reinfection rate via their webmaster tool, which speaks directly to the challenges website owners face when trying to fix their own infected websites.”

Making the financial sector more resilient to cyber attack

Firms across the financial and related professional services industry need to take urgent action on cyber risk. There were a reported 2.5 million cyber crimes last year, the majority of which were various forms of fraud with the loss typically borne by the financial sector. City firms have the data, money and profile to attract the full range of attackers including those seeking to undermine the financial system. Reputation and reliability are shared assets and argue for firms working collectively to reinforce the financial system’s resilience.

Investing in security

The report recognises the significant effort invested by UK authorities to encourage action on cyber risk. It finds that while larger institutions are engaged on cyber security, there is an opportunity for the industry and individual firms to enhance cyber security and resiliency after cyber breaches.
Survey evidence supports the fact that too few firms are tackling cyber in a cohesive way: only 30% of large firms have it as a top ten risk, only 39% have quantified the risk and just 30% have a response plan to a breach occurring.
“While financial incentives should never be the primary reason for a company to invest in security, anything that helps more financial services firms take security seriously is definitely a good thing. The question is whether a financial incentive is as powerful as a financial penalty,” Ryan O’Leary, VP Threat Research Centre at WhiteHat Security, told Help Net Security.
“One major concern with an incentive like this is that companies may not go far enough to put the infrastructure in place to actually fix the issues that their shiny new security solution finds. Simply ticking the box that says the firm has something in place does not guarantee any reduction in vulnerabilities. Checking that these firms are finding, and then fixing vulnerabilities would be the best way to go, but this would be impractical given the oversight that would be needed. Overall, tax breaks may help get some companies to start to seriously consider their IT security, but I’m doubtful that they would move the needle in terms of these firms actually being safer,” O’Leary added.

Key recommendations

Boards should hold management responsible for cyber risks instead of their IT departments and provides ten simple questions that management should consider. According to the report, since 95% of all cyber incidents involve human error, people and processes matter as much as technology when it comes to managing cyber threats.
The report recommends the creation of a city-wide cyber forum to promote collaboration across all firms within the financial and related professional services industry. The forum would seek broader and committed support for cyber management and the many existing initiatives that are running. Its agenda would include encouraging information and best-practice sharing, working on cyber risk aggregation and system recovery and helping to develop a strong UK cyber security sector.
Recommendations for firms:
A. Make cyber a standing item on the Board or risk committee agenda;
B. Ensure cyber risk is a part of strategy, investment cases, acquisition and appraisals;
C. Have a broad based team inputting to how cyber risk is managed;
D. Monitor cyber readiness against the ten-point cyber checklist:

• The main cyber threats for the firm have been identified and sized
• There is an action plan to improve defence and response to these threats
• Data assets are mapped and actions to secure them are clear
• Supplier, customer, employee and infrastructure cyber risks are being managed
• The plan includes independent testing against a recognised framework
• The risk appetite statement provides control of cyber concentration risk
• Insurance has been tested for its cyber coverage and counter-party risk
• Preparations have been made to respond to a successful attack
• Cyber insights are being shared and gained from peers
• Regular Board review material is provided to confirm status on the above.