Hannaford Brothers, CEO Subpoenas and the Rise of Targeted Malware
Earlier this year, customers of Hannaford Bros. grocery stores in New England learned that over 4 million of their credit and debit card numbers had been stolen by cyber criminals.
At first glance, this data breach looked all too common. After all, plenty of other companies – from Pfizer to Monster.com to TJX – have weathered similar attacks recently.
But when you dig deeper into the details of this attack, a disturbing trend emerges: Hannaford Bros. was the victim of targeted malware. Unlike most data breaches, which are opportunistic crimes triggered by things like stolen laptops or poorly secured databases, this instance involved malware written specifically to steal information from Hannaford Bros.
Criminals secretly infected servers at every single grocery store with software that intercepted card data at checkout. The information was then sent overseas.
If you think this is an isolated incident, think again. Recently, a new phishing attack has been circulating that targets not a company but a specific type of person: the corporate CEO. The CEO subpoena phishing attack looks like a valid legal document, but if CEOs fall for it, they put their company at risk. A similar attack targeted CEOs in the energy sector last year.
Then there is Trojan.Silentbanker, malware that targets the online banking accounts of approximately 400 banks. This is an especially troubling type of malware, since users believe they are secure during the banking session, having logged into their accounts using various forms of two-factor authentication.
This man-in-the-middle attack, which infects users through corrupted websites, re-routes the victim’s account to the attacker’s site. Since users have no idea that their banking session has been compromised, seeing the same screens they would during an uncompromised session, Trojan.Silentbanker is able to intercept user names, passwords, and other forms of authentication, such as security questions.
Taken together these targeted attacks beg the question: does this represent the future of malware?
If it does, we need to seriously rethink our approach to security. Research firms such as the Yankee Group have been saying for quite some time that the antivirus/perimeter approach to security is dead, and targeted attacks could very well be the final nail in the AV coffin.
Traditional security works best when hackers employ the “spray-and-pray” approach. When hackers write far-reaching malware that targets anyone and everyone, traditional security is able to counter these attacks through signatures. With a broad Internet presence, traditional AV companies collect as many instances of these types of attacks as they can, gauge their severity, study them and create signatures to stop them.
That method falls flat when it comes to targeted attacks. Since they target small groups of users, many of these attacks evade the early-warning systems that AV vendors rely on. Next, since they infect so few users, the risk isn’t deemed terribly severe, since AV vendors typically rely on infection rates rather than the severity of the attack. Finally, since they don’t believe other users will be infected, AV vendors don’t devote the resources to studying and developing signatures for targeted malware.
What then can you do to protect yourself from this kind of attack? Fortunately, there is hope. The three steps outlined below will help you stave off this new class of malware.
The first step is to evaluate your security posture – and re-evaluate it on an ongoing basis. At eEye, these targeted attacks aren’t a surprise because we’ve seen them before. As part of our Preview service, our security experts study corporate networks, pinpoint vulnerabilities and analyze whatever malware we find – and we’ve found a number of instances of targeted malware.
We’ve also learned that this type of malware is far more powerful and well-engineered than typical malware. Unfortunately, most targeted malware attacks bypass perimeter defenses, so what we have to do is rely on other layers, searching for anomalies. We review IPS logs and look for any weird activities; we review HTTP Proxy logs and try to identify any potentially malicious requests for .exe’s and such; and if everything is behind HTTPS, we occasionally have to review the logs by checking the sites manually.
It’s a cumbersome process, and one usually best outsourced unless you have a big in-house IT staff.
The next step is to rethink your approach security. Traditional security tries to find what is bad out in the world and stop it. With the rise of targeted malware, one-off malware, and automated hacking tools, this is exactly backward. It’s better to define what is good and acceptable and disallow anything beyond that. Protect yourself by employing security that blocks behaviors rather than specific, known malware variations.
Finally, find a way to correlate all of your security layers and their many alarms and logs. In other words, come up with a security management strategy and adopt powerful security management tools. If your security vendors don’t offer good security management layers, push them to address this or find a vendor that does.
Knowledge is power. Too often, though, the information that leads knowledge is buried deep in logs and drowned out by false alarms. With centralized, integrated security management and a single point of visibility into your network, you won’t be blindsided by a targeted attack.
Source: Andre Derek Protas, Director of Research and Preview Services |
News & Articles
Announcements
Tech Talk
Reader Q&A
Etcetera