Examples of Attacks

Hackers, cyberspies and cybercriminals employ many vectors of attack to break into computer networks and steal intellectual property, customer information, sensitive personally-identifiable information (such as social security numbers and credit card numbers), medical and health insurance records, personnel records, tax records, strategic business plans and any other potentially valuable or exploitable data. Everyone is a target, regardless of size, industry or location.

• Emails with Attachments Containing Viruses/Malware

One of the most well-known methods of disseminating malware, the malicious software is hidden in a email attachment. Once the attachment is opened, the malicious software executes and/or downloads onto the computer.

• Emails with Links to Poisoned or Malicious Websites

Often referred to as “phishing,” these emails appear (or attempt to appear) as legitimate correspondence from a financial or other institution that the recipient would tend to trust and respond to. The links in these emails, however, lead to a fake website in an attempt to trick the recipient into entering sensitive information such as passwords and financial account numbers. Alternatively or in addition, the malicious website may attempt to install malware, viruses or spyware on the recipient’s computer.

• Social Networking Pages/Profiles with Links to Malicious Websites

Similar to emails with links, this method is becoming more popular, particularly with the widespread use of social networking sites such as Facebook, Twitter and LinkedIn. This technique can be pretty effective, since people tend to let down their guard and be less wary on social network sites than other websites. With this method, a fake profile entices real users into following links to malicious websites or even into giving up sensitive personal information.

• Probing Firewalls/IPSs/IDSs for Backdoors and Other Weaknesses

Here hackers simply send out transmissions en masse, in hopes of compromising any firewall/IDS/IPS they may chance across and thereby gaining access to the computer system behind it. This method is a pure numbers game with millions of transmissions going out in hopes of catching the malfunctioning, misconfigured or un-patched equipment. This type of attack is very difficult to trace without packet capture.

• Inserting Malicious Packets into Legitimate Communication Streams

This is a newer technique, which relies on access to a stable of “zombie computers” in order to send out large quantities of packets to a large number of recipients, targeting a specific port. The hope is to, by chance, to hit upon a router/firewall with that particular port open and in use and thereby gain a way in. This type of attack is very difficult, if not impossible, to trace without packet capture.

• Advertisements Disseminating Malware to Viewers

This method of attack is harder to avoid, given the ubiquity of paid advertisements across the internet. Cybercriminals can place ads containing malicious code on legitimate websites that most visitors would tend to trust. They accomplish this either by purchasing ads directly, hijacking the ad server or hacking someone else’s ad account.

• Pre-Installed Malware

The past few years have yielded numerous reports of foreign-manufactured IT equipment, such as computers, routers and switches, arriving out of the box with malware pre-installed. In September 2012, Microsoft announced that it found new computers in China sold with malware pre-installed, and in April 2012 HP revealed that the previous year some of its switches shipped with malware-laden Flash cards.

• Malware Sold as Legitimate Software

Buying malware from no-name sellers can present dangers as well. Though it may provide the promised function, it also may be embedded with malicious software. Fake antivirus programs have infected millions of computers in this fashion with anything from trojans to spyware. In research IPCopper conducted in early 2013, we found several instances of free software available through the internet (such as free video/audio players) that included malicious executables (learn more in our report: Marketing Cybercrime to Infect America).

• Advanced Persistent Threats (APTs)

The term APT does not entail any specific type of attack or infiltration technique, rather it refers to a sustained (persistent) multi-pronged attempt to break into a specific organization’s or institution’s data networks. With APTs, hackers utilize any number of attack vectors from the mundane to the creative, even going so far as to send fake promotional materials, such as a “free” flash drive, to an executive within the organization. When used, it would upload and install a malicious file on the computer. APTs are generally employed by teams of hackers intent on specific information and take place over the long term, lasting months and years.

Preventive Measures

Full packet capture are crucial counterparts to breach-prevention measures.

While preventive measures such as firewalls and antivirus are standard tools for protecting computers and data networks, they are not foolproof. One must be pragmatic and give up the tantalizing idea that firewalls, IDSs, IPSs, SIEMs and antiviruses are all you need and will keep out the network threats. This mindset plays directly into the hackers’ hands as they constantly develop and re-develop their attack techniques precisely to fool those exact same firewalls, IDSs, IPSs, SIEMs and antiviruses, however fancy and expensive they may be.

The reality is, hackers know the capabilities of the devices organizations and individuals use to protect their networks and can run any and all of their virus, trojan and other malware against their libraries of signatures to see what works. It’s a continuous cycle in which the firewall and antivirus companies are always the ones a step behind, reacting to the new threats, sometimes as they appear and sometimes not at all (some malware variants are not discovered until years later and some not at all).

Hackers also know that every data network has a number of unpredictable weaknesses: the human users. This is where the social engineered attacks, the phishing emails and emails with malicious attachments come into play. It only takes one slip-up on the part of a user to let the baddies in past the firewall security. Once the hacker has gained a foothold inside the perimeter defenses, they are in. Why is this? Firewalls and the like are outward facing measures – they do not check or regulate the communications leaving a network. Likewise, if an piece of equipment inside the network sends communications, say a download request, to an external web location, the resulting data streams back and forth are generally considered “ok” since they were initiated from within.

This is not to say that we should scrap all firewalls, antivirus and so on (we shouldn't), but that we should give up the notion that they are sufficient unto themselves. As data networks become faster, larger and more complex and hackers develop newer and sneakier techniques, breaches and other network incidents have become a matter of when, not if. Just as no amount of preventive medicine can keep away the common cold, no amount of perimeter security can guarantee a breach-free network. Network surveillance and monitoring — packet capture — are critical for effective response when that breach does occur.

The Role of Packet Capture

While convenience stores operators figured out long ago that surveillance is useful for when someone breaks the locks on the doors, the majority of businesses have no way to detect if and when threats get past their firewalls and other protective measures. Hackers do not tend to announce when they have breached a network (the well-publicized Anonymous notwithstanding). They are after as much as they can get and the longer they can avoid attracting notice to their activities, the more sensitive data they can grab. With the increasing speed of processors and internet connections and the increasing skill sets in the hacking world, hackers are getting better at hiding infections from the computer user. They do their best to make their malware operations look like routine and legitimate tasks, and connections to the hackers' command-and-control server may only take place in the middle of the night or at such times that the computer is not in use.

In this environment and in light of the liabilities and penalties that can accrue for every stolen record from a credit card processor, merchant, medical organization, school and so on, network operators must give up their blind faith in perimeter security and pragmatically employ network surveillance to see what is really going on. Firewalls and other intrusion prevention systems will fail one day, either due to human error, to technical inadequacy or for some other reason, and the organizations the best weather the fallout are the ones who collect comprehensive network activity data – that is, full packet capture – and therefore have the security intelligence necessary to recognize that a breach occurred and that data had been stolen. They will know the best way forward and conduct the best and most effective incident response and breach mitigation.

Once a network has been breached, the key to any course of mitigation or incident response is detection. Without a way to detect network intrusions, data leakage, and other incidents, network administrators essentially operate blindly, not knowing what is actually happening on the networks they are supposed to monitor and protect.

IPCopper packet capture appliances provide comprehensive, historical knowledge of all network activity. They have no blindspots and never take vacation or sick days, but give you the actionable information necessary for developing a cybersecurity strategy and for detecting and responding to breaches, data leakages and other network security incidents.