Review of Information Security Threats 2011

Release Date: 3 Jan 2012 5823 Views

Over the year Information Security threats are continuously growing, we summarized and recapped it below. We can learn from the past and equipped ourselves to fight off the new challenge next year.

New Dimension of Motivations of Cyber Attack

Since 2005, the dominating motivation of cyber attacks is financial. Attackers are organized cybercriminals who control millions of compromised computers (or the botnet) to make money.

In 2011, two new dimensions of attacks become more prevalent: (1) hacktivism and (2) targeted attacks on critical infrastructure.

Hacktivists are internationally collaborated activists who use hacking to make well publicized protests. Anonymous and Lulsec hacktivist groups are typical examples. In January 2011, Anonymous launched DDoS attack against Amazon and other companies which acted against Wikileaks. Lulsec had targeted Sony¹, Sega, CIA, U.K.-based Serious Organized Crime Agency. Their objective was to steal and leak any classified government and high profile institution (e.g. bank) information. Because of the high profile attack, some members of the two groups were arrested in 2011. However, they had already set an example to hacktivism.

Stuxnet, a complex computer worm discovered in 2010, was reported to have infiltrated into the Iranian nuclear plants and caused disruption. In October 2011, a similar worm Duqu was found. Its link with Stuxnet was confirmed by security researchers. Stuxnet and Duqu were made to exploit the vulnerability in Supervisory Control and Data Acquisition (SCADA) and critical infrastructure systems.² The complexity and use of stolen digital certificates mark the professionalism and organization behind. The threat is escalated to the national level and some have pointed out that these are state sponsored attack and we are at the eve of cyber war.

The critical infrastructure for the trust the Internet was also challenged in 2011. More than ten Certificate Authorities (CA) were comprised this year. Certificates issued by the comprised CA cannot be trusted. This affected more than 500 web sites including Google, Microsoft and others.³

Botnet

Botnet continues to be the launch pad of distributed denial-of-service (DDoS) attacks, phishing, malware hosting and spam mail. They enabled cybercrime as a service and have greatly impacted the health and safety of the Internet. The size and complexity of Botnet are increasing.

On the other hand, we have seen very successful botnet takedowns in 2011. Law enforcement, security researchers, CERTs, software vendors collaborated to take down the command and control centres of a number of major botnets: Rustock (March), Coreflood (April) and Kelihos (September). ⁴ The amount of spam mail was found to drop significantly immediately after the takedowns, indicating the power of the collaborative efforts. Of course, the uncleaned bots machines are still around and needed to be found out. HKCERT and CERTs around the world are working hard to proactively locate those compromised computers and assist the owners to clean up their machines.

Highlighted Cyber Attacks to Hong Kong

The most significant cyber attack to Hong Kong was the DDoS attack against the News web site of Hong Kong Stock Exchange (HKEx) in August. The attack caused disruption of that web service. HKEx had to suspend trading of seven stocks.⁵ It was believed that the attack was careful planned and coordinated.

Phishing attacks continue to increase rapidly. It masquerades as a real email or SMS from a legitimate financial institutes and lures user to enter their account information, such as username and password. More than ten phishing emails and fraudulent bank web sites cases were published by Hong Kong Monetary Authority this year.⁶

From a third party source Zone-H, there were more than 1000 web site defaced in Hong Kong in 2011.⁷

In July and August, there was a large scale code injection attack targeting osCommerce, a web shopping cart application. HKCERT observed that over 45,000 web pages in Hong Kong were infected as we used Google to search for infected web pages. The infected web sites were injected scripts to direct users to malware hosting websites.

Data Leakage

Data leakage has been the public concern in the previous years due to data breaches via Foxy, lost or stolen USB drives. The concern is increasing with the rising popularity of social networking sites and mobile application.

In 2011 there are still a lot of data leakage incidents in public and private organization being reported. Although we have seen a lot of efforst on developing guidelines and promoting awareness education, it seems that more ongoing efforts are still required. Foxy, once a popular P2P software, was shut down by the order of court in Taiwan in October.⁸ However, alternative Foxy download sites in simplified Chinese and English versions are still active.

Malware

This year mobile malware is apparently increasing and especially targeting the Android system because of the lack of checking mechanism in the official Android Market. Malware infects mobile devices such as smart phone and handheld tablet devices. The malware collect personal information and send to the attacker via SMS. When malware were found in Android Market, Google removed it right away and suspended the associated developer accounts.⁹

For PCs, rogue security software is still popular. The type of malware pretends to be legitimate software to help users protecting their computer system. Actually it installs malicious software on computers to steal personal information or corrupt users computer system.¹⁰

Cloud Computing

Cloud computing is a very hot topic this year. It not only provides lower cost and flexibility for user and SME, but also opens up an easy channel for cybercrime. The availability and confidentiality of cloud services are big concerns for end users.

Attackers are using cloud as a platform to host malware and to crack passwords. Cloud vulnerabilities are also reported under attack in 2011.