9 March 2012	

CRYPTREC Symposium 2012 	

What’s happening out there?
Global Information Security Threats Trends

Dr. Yoichi SHINODA
Professor
Dependable Network Innovation Center
Japan Advanced Institute of Science and Technology
Advisor on Information Security
National Information Security Center (NISC)
Cabinet Secretariat, Government of Japan

> 100G	
Largest bandwidth in “bps” observed in 2010 for a single DDoS
attack incident. It is 102% increase compared to 2009 record, and1000% increase compared to 2008 record.!
Source: Arbor Networks “Network Infrastructure Report Vol. VI”, Feb. 2011,
http://www.arbornetworks.com/report	

+ 200%	
Increase in number of matching patterns for malwares targeted forAndroid smart phones in one month. (243 for Sep. to 533 for Oct.
2011)!
Source: Trend Micro “ Virus Buster Mobile for Android”	

1 / 300	
In Oct. 2011, one out of every 300 e-mails contained malware
attachments. 47% of these malwares contained links to malicious
web sites.	
Source: Symantec white paper “The Changing face of Malware Threats”, Nov.
2011.	

98%	Customer web sites of a diagnostic service, with some degree ofvulnerability; “low” level detected for 7%, “medium” detected for
23%, “High” detected for 37%, multiple “high” detected for 33%.	
Source: Secure Sky Technologies actual service record for Jan. 2007 – Dec. 2008	

The Outline
1. Changes In The Long Term Threat Trend
2. Trends 2010-2011
3. Trends 2011-2012
4. Change of Game
5. Concluding Remarksπ	
61. Changes in The Long Term Trend

7

A Taxonomy of Information Security Threat
Threats from the attack vector perspectiveA) Network Layer AttackB) Web Application Layer AttackC) Malware Infection
D) Abuse of Client Side ApplicationE) Social Engineering

Abuse of Client Side App.

Network Layer Attack

Web App. Layer Attack

Hackers	 Malware Infection

Social Engineering8Changes In The Attack ModelØ Most major companies in Japan have firewalls on the front of theirsystem now.
1st Change of Attack model	
n Around 2005, Many web application layer attacks were reported.
(Massive SQL Injection)
Ø Many web site owner checked the security holes of their web
application and fixed them.
Ø However, There are still security holes in their web application
today.
2nd Change of Attack model	n In 2009, Web-based Malware became widespread.
Ø Even If the defense of network layer and web application layer are inplace, the risk of this attack still remains.
Ø The defense should be in place not only on the server-side, but also
on the client-side. And this fact makes it difficult to fix this problem.

n 2010~ : Combined to form sophisticated attacks.	

n Around 2000, Network layer attack was very common and many incidentof network layer attack were reported.

9

Changes In The Target Area
In 2009, The attack target area is getting larger in spite of the fact that
other area is not covered adequately.
We need to choose the cost-effective security measures.	

Intranet System	

Internet System	

Attack target area in 2000	

FTP	

Attack target area in 2005	
Attack target area in 2009	

VPN	
Remote Access	
10

2. Trends 2010-2011

11

Drive-by Download & The Gumblarll

Drive-by download is an act of unauthorized downloading of(often malicious) piece of software.
The Gumblar (late 2009 ~ 2010) combined several exploits:llContent management system for a web server is infected by drive-by
downloading.

l

Passwords for the web server is stolen.

lLinks to drive-by download site are injected into the web server.

l

End users visit the infected (injected) site, forced to drive-by download.

l

If the user’s system is another CMS, then the Cycle repeats.

The Gumblar introduced a new class of attack model: Web-based
malware.
lMeasures for the web-based malware is very difficult. It requires integrated
approach on both PCs and servers.
12

Stuxnet and Its Impactl

Stuxnet is an windows worm that spreads through mountable external storage
devices (USB memory, smart phones, digital picture frames, voice recorders) andsometimes through network shared storage.

l

Looks for a specific system (Siemens FA systems).

l

Utilizes 5 exploits, of 2 are zero-day.

l

Signed by stolen certificate (looks like a legitimate piece of software).

lFirst appearance is believed to be around Jan. 2009, but it was not found until
June 2010.

l

The impact of the Stuxnet is very serious:ll

It penetrate and spread into what so called “closed, physically isolated, dedicatedsystems” (has some level of commonality with Conficker).
It is intended to attack FA systems (including critical infrastructure control systems).	
13

Route Hi-Jacking / Censorship Leakagel

Route hi-jakcking is caused by (intentional or unintentional) injection ofillegitimate route information, causing Internet packet detouring or
blackholing.

l

Examples of 2010 IncidentsllMar. 3 – 24, 2010: Routes to a censored instance of DNS root servers in China
were leaked to the Global Internet, responded to queries for censored web sites
with bogus addresses. The incident affected large number of Internet users
around the world (mostly in Asia-Pacific region).

l

Apr. 8, 2010: AS23724 CHINANET-IDC-BJ-AP IDC, China Telecom. Corp. has
accidentally originated (hi-jacked) as many as 37,000 unique prefixes for theduration of 15min.

ObservationsllClassic route hi-jacking tends to occur more frequently.
The DNS root server case above, which may represent a new class of route hijacking, need more study.
14

Good Old DoS (Denial of Service) Attacks
l

DoS attacks are very common around the world today; we can observe
artifacts from hundreds of DoS incidents everyday.

lSome are executed for economic-crime purposes and some are executedfor expressing some kind of propaganda. The latter tends to become larger.

l

Recently Observed DoS incidentslLate September, 2010l

Large DDoS and associated more sophisticated attacks were placed against wide rangeof Japanese Internet Infrastructure.

l

Minimal damage was reported.

l

Mitigation efforts
§
§

l

Gov. mitigation coordinated by NISC, in collaboration with ISPs and Security Operators.
Major ISPs are equipped with modern DoS mitigation devices, and they are experienced.

Early December, 2010 (and Continuing)l

Cyber-propaganda cross-fire between Wiki-Leaks supporters and oppositions.

15

3. Trends 2011-2012

16

“Update 2010” summaries and followups (1)l

Drive-by Download & Gumblarll

Gumblar-like attacks are observed very recently (forged anti-virus
softare; an old vector, combined with Server-PC ping-pong infection)

Stuxnet and Its Impactll

New malware utilizing Stuxnet modules are now emerging.
New initial vector is predicted; vulnerable smart devices as active
carriers.

17

“Update 2010” summaries and followups (2)l

Route Hi-Jackingll

Large incidents are not reported for 2011; small incidents are daily.

Good Old DoSlStill a very popular and handy tool for expressing an one’s or group’s
intention.

l

Mitigation technology is available in a limited manner.

l

New observationsl

Small DoS incidents are observed VERY frequently.

l

These are sometimes understood as part of a “DoS scanning”.

lIntentions behind the attacks are unknown, no clear linkage toactual large scale attacks.

18

2011 Updates (1)l

New classes of advisory partylHactivists became conspicuous.
l

l

l

l

l

Frequent activities by hactivists (loose community of hacker
activists), e.g., “Anonymous” and “Lulzsec” were observed.
The activities were triggered by impulsive events, often put largeorganizations such as national governments and global enterprises
into jeopardy.

Existence of APT (Advanced Persistent Threat) became clear.

Cyber Space now widely (and officially for some counties)
recognized as a field of confrontation, in many aspects.
Malwares targeting smart phones is showing rapid growth.
lTrend Micro Oct. 2011 report (+200% growth Sep. to Oct.)
19

Rise of the APTs
Advanced Persistent Threat (APT) usually refers to a group with both thecapability and intent to persistently and effectively target a specific entity.
l

Advanced
l

l

l

l

Operators of APTs have a full spectrum of intelligence-gathering capabilities,
including computer intrusion technologies and conventional technologies such as
wire-tapping.
Often combine multiple targeting methods to produce more sophisticatedmethods to gain and maintain access to the target.

PersistentlOperators give priority to a specific task, rather than the opportunistically seeking
gains.

l

Targets are constantly monitored, often by “low-and-slow” approach.

lOperator’s goal is to maintain long-term access to the target.

Threatll

APTs are a threat because they have both capability and intent.
The operators have a specific objective and are skilled, organized, and often wellfunded.
20

2011 Updates (2)lMore and more “previously believed-to-be-secure” things now
became (potential) threat vectors:l

Security tokens:ll

A security token vendor has disclosed that some of the internal
information was stolen.

Certificate Authorities and certificates:ll

A certificate authority was compromised, and was forced to issue
forged certificates, resulting in possible vulnerabilities in multiple
major global portal sites.
Certificate revocation mechanisms are very poorly implemented in
the real world “smaller” devices; smart phones, ubiquitous devices,…

21

2011 Updates (3)lE-mails from business partners (or look a likes)ll

E-mails forged to look like they are legitimate, in terms of sender
address, subject, attachment names and body text, now may containfatal attack vectors.
In 2012, the NISC conducted a training on targeted e-mail attacks.
l
l

l

Subject: Kasumigaseki-resident government employees (60,000)
Method: Two mails were sent for each subject, one contained anattachment, another contained a web link.
Result:Attachment: 10.1% avg. (1.1 - 23.8% depending on the institution) ofsubject opened the attachment.
Web link: 3.1% avg. (0.4 – 6.1% ditto) clicked on the link.

22

2011 updates (4)	l

Non-web service targeted DoS attack is predicted.

l

New breach in a trust mechanism: a DNS resolver file.

llModifies hosts’ “resolv.conf” file to redirect all access to the network
at attacker’s will.

l

The original attacker was arrested, but the forged DNS server is stillrun by LE to prevent additional damages to victims.

Rapid shift to cloud based computing revealed non-readiness of
security operations.
l

XaaS layered service model/business makes forensic analysis
extremely difficult.

l

Networked computers made damage assessment hard, cloud makes
it even harder.
23

Did Network Attacks Become A History?
l

Question: With raise of Web-based attacks, common installation of
firewalls, and users shifting to newer operating systems, did network
attack become a history?

l

Answer: No.
l

l

l

l

l

l

New vulnerability in wide range of software and systems are still reported
everyday.
Network attack is still very active according to network monitors (such as
nicter by NICT).
Presence of the comprehensive bot networks amplifies effect of newly
found vulnerabilities (e.g.: Welch, Conficker, …)
Vulnerabilities are utilized for intranet network attacks.
Small networking devices are often under-maintained, and like to havemultiple vulnerabilities.

Likewise, Web-Application Layer attacks (SQL injections) are still very
common.
24

Web Applications are inherently vulnerable?
Web applications are inherently vulnerable to attacks:lDistributed Naturel Unlike the traditional applications, web applications inherently deals with
distributed components and services; even secure components and services
become unsecure when they depend on unsecure remote components andservices.
l Web programming facilities are often introduced with functionality (aka“richer user experience”) as the first priority; security considerations are oftenvery weak.
l The WASC (Web Application Security Consortium) has identified 34 different
classes of web application attacks and 15 different classes of weaknesses of
web applications that can be attacked.

lMarket Pressurel

Most web applications have severe TTM (Time to The Market) schedule.

l

Most web applications are believed to be “lighter” than traditional hard
coded applications, thus can be made “cheaper”.

l

Most web applications are required to “be fancy”, not “be secure”.
25

4. Change of Game

26

Awareness Rising
Awareness rising plays one of the central role in possible measures.
l

Awareness rising in different sectors
l
l
l

l

Government
Private industries and enterprises, and supply chains
General Public

Awareness rising has direct and indirect effectsllPrevent direct damages; large portion of sophisticated attacks are
triggered by careless or ignorant operations.
Incubate a common sense among people and industries, ininvestments into security aspects of ICT systems.

27

From R&D perspective
NITRD CSIA IWG "Cybersecurity Game-Change / Research andDevelopment Recommendations” (May 2010)l

Recognition of the current state of the game
l
l

l

l

The cost of attack is asymmetric, and favors the attacker.
The cost of simultaneously satisfying all the cyber security requirement of an
ideal system is prohibitive.
The lack of meaningful metrics and economically sound decision making insecurity results in a misallocation of resources.

Proposed way of changing the gamel

Make cyber assets a moving target.

l

Create a trustworthy cyberspace (subspace) model.

lCreate a framework of economic incentives to reward secure practices anddiscourage bad actors.
28

5. Concluding Remarks

29

Malware Infection Rates by Countries/Regions

1Q2011	

2Q2011	

Rates by Microsoft CCM, per 1,000 PCs.

Source: Microsoft Security Intelligence Report Volume 1130

Some (personal) notes 	l

Alice (or Bob) can be adversary now.

l

Cryptographically protected channels are making central
protection of end-points harder.

ll

IDS/IPS can not examine malicious streams.

l

Malware scanners can not examine malicious attachments.

Poorly maintained “secure” services are often vulnerabilities.

31

32