Study: Simulated Attacks Uncover Real-World Problems in IT Security

Study: Simulated Attacks Uncover Real-World Problems in IT SecuritySome 70% of simulated attacks on real networks were able to move laterally within the network, while more than half infiltrated the perimeter and exfiltrated data.Organizations continue to focus on protecting the perimeter while neglecting to monitor bad guys getting inside and ultimately pilfering data, says a security researcher at SafeBreach, which released a new report today.
In 3,400 breach methods used for 11.5 million attack simulations, SafeBreach in its new Hacker’s Playbook Findings Report found that virtual attackers had a more than a 60% success rate of using malware to infiltrate networks. And once in, the malware could move laterally roughly 70% of the time. In half the cases, they could exit networks with data, according to simulated attacks SafeBreach conducted on its customers.
“The most surprising thing is that there is so much focus on the hard-candy shell of the perimeter without paying enough attention to the soft, squishy middle,” says Chris Webber, a security strategist at SafeBreach. “It is not that hard to get past the perimeter and once the attacker is in, it is really easy to move around laterally and then exfiltrate out.” 
Webber points to the amount of money and solutions he has seen customers pour into protecting the perimeter, yet the majority of simulated malware attacks were still able to move around and steal information.
When it comes to malware infiltration methods, the research found nesting, or “packing,” malware executables fooled security controllers more than 50% of the time. For example, packed executables inside JavaScript had a 60.9% success rate of infiltrating a network, while an executable inside a VBScript (VBS) using HTTP managed to make it in 56.5%, and an executable inside a compiled HTML file format (CHM) extension had a 55.9% success rate.
But WannaCry 2.0’s method of exploiting a server message block (SMB) vulnerability in Windows achieved a 63.4% success rate in simulated attacks SafeBreach performed, pushing it to the top of successful infiltration methods.
Financial malware Carbanak, which relies on Google’s App Script, Sheets, and Forms cloud-based services to communicate its malware commands, also ranked among the top five infiltration methods used in the study. 
“So, in the case of Carbanak, the infiltration ‘move’ we highlighted was indeed the transfer of the specific Carbanak malware file via HTTP,” Webber says. “This could be stopped, for example, by network controllers configured to scan for malicious files and block them before they make their way to the endpoints/hosts for installation to disk.”
Concerns over lateral movement appear to be overlooked by a number of organizations, says Webber.
“Folks are focused on keeping things out and not worrying about the other phases of the kill chain,” Webber says.
广告软件与免费的防病毒软件
That approach could be a problem, the report notes, given Petya and EternalRocks were both identified as having worm-burrowing capabilities that could move laterally in the network.
Data exfiltration is the last hurdle cyberthieves face, and they usually opt for the easiest method of stealing data, the report found. Traditional clear or encrypted Web traffic, or traditional Web ports, are the preferred method for attackers to exit the network with their cache of data, according to the report.

“A lot of outbound traffic is making its way out through Port 443 (HTTPS) and Port 123 (NTP),” Webber says. “They are pumping out all of your data past your controls by stuffing the data into encrypted packets that look like packets for things like keeping time on your computer and sending it out over NTP [Network Time Protocal].”
Port 123 had a 63.1% exfiltration success rate and Port 443 had 53.7%, according to the report.
商业竞争企业之间互相挖角是很常见的,为了防止跳槽到同行业竞争对手的员工带走公司的核心机密,需要加强用户权限管理,只给用户完成其工作所需最少权限。对离职员工,及时停止各系统的访问权限并签订保密协定。
Fixing the Links
Webber says it is not enough to try to stop attackers from breaking into the network, nor is it adequate to try to box them in by preventing their entry and exit. Paying attention to lateral moves within the network is also important, he notes.
However, organizations face limited resources. “It comes down to understanding each company. If you have a ton of credit card data, then you spend all the more time from preventing them from exiting the network. But if you have a manufacturing company, then you are more concerned about getting hit with a ransomware attack that can stop your operations. You would probably care more about internal segmentation to prevent worms from moving across your system,” he says.
He adds that the best moves companies can take to secure their systems is to optimize their current security solutions, constantly update the configurations as needed, and then test the changes they make.
Related Content:
Automated Lateral Movement: Targeted Attack Tools for the Masses
Wannacry Inspires Worm-like Module in Trickbot
Cloud AV Can Serve as an Avenue for Exfiltration
越来越多的行业会使用互联网来推动业务的开展,网站的安全问题和业务的成功以及组织的长远发展息息相关,不容忽视和半点马虎。

猜您喜欢

上海青浦区召开学前儿童看护点消防安全整治工作协调会
CyberSecurity网络安全宣传——个人信息保护
Security-Frontline-安全前线
教育部:高中纳入义务教育条件不具备 取消中考不实
TEH-SONG EXPRESSMETALS
网络安全公益短片防范社工电话诈骗