With such an array of security incidents in 2014—from large-scale data breaches to vulnerabilities in the very foundation of the web—it’s difficult to know which to prioritize. Which developments were merely interesting and which speak of larger trends in the online security space? Which threats are remnants from the past and which are the indications for what the future holds?
The following are four of the most important developments in the online security arena over the past year, what we learned (or should have learned) from them, and what they portend for the coming year.
The discovery of the Heartbleed and ShellShockBash Bug vulnerabilities
In spring 2014, the Heartbleed vulnerability was discovered. Heartbleed is a serious vulnerability in OpenSSL, one of the most common implementations of the SSL and TLS protocols and used across many major websites. Heartbleed allows attackers to steal sensitive information such as login credentials, personal data, or even decryption keys that can lead to the decryption of secure communications.
Then, in early fall, a vulnerability was found in Bash, a common component known as a shell, which is included in most versions of the Linux and Unix operating systems, in addition to Mac OS X (which is, itself, based around Unix).
Known as ShellShock or the Bash Bug, this vulnerability allows an attacker to not only steal data from a compromised computer, but also to gain control over the computer itself, potentially providing them with access to other computers on the network.
Heartbleed and ShellShock turned the spotlight on the security of open-source software and how it is at the core of so many systems that we rely on for e-commerce. For vulnerabilities in proprietary software we just need to rely on a single vendor to provide a patch. However, when it comes to open-source software, that software may be integrated into any number of applications and systems. This means that an administrator has to depend on a variety of vendors to supply patches. With ShellShock and Heartbleed there was a lot of confusion regarding the availability and effectiveness of patches. Hopefully this will serve as a wake-up call for how we need greater coordinated responses to open-source vulnerabilities, similar to the MAPP program.
Moving forward, new threats like these will continue to be discovered in open-source programs. But while this is potentially a rich, new area for attackers, the greatest risk continues to come from vulnerabilities that are known, but where the appropriate patches aren’t being applied. This year’s Internet Security Threat Report showed that 77 percent of legitimate websites had exploitable vulnerabilities. So, yes, in 2015 we’ll see attackers using Heartbleed or ShellShock, but there are hundreds of other unpatched vulnerabilities that hackers will continue to exploit with impunity.
Coordinated cyberespionage and potential cybersabotage: Dragonfly and Turla
The Dragonfly group, which appears to have been in operation since at least 2011, initially targeted defense and aviation companies in the US and Canada, before shifting its focus mainly to energy firms in early 2013. Capable of launching attacks through several different vectors, its most ambitious attack campaign compromised a number of industrial control system (ICS) equipment providers, infecting their software with a remote access-type Trojan. This gave the attackers full access to systems where this software was installed. While this provided the attackers with a beachhead into target organizations in order to carry out espionage activities, many of these systems were running ICS programs used to control critical infrastructure such as petroleum pipelines and energy grids. While no cybersabotage was seen in these attacks, no doubt the attackers had the ability and could have launched such attacks at any time. Perhaps they chose to lie in wait and were interrupted before they could move on.
Dragonfly also used targeted spam email campaigns and watering hole attacks to infect targeted organizations. Similarly, the group behind the Turla malware also uses a multi-pronged attack strategy to infect victims through spear-phishing emails and watering hole attacks. The watering hole attacks display extremely targeted compromise capabilities, with the attackers compromising a range of legitimate websites and only delivering malware to victims visiting from pre-selected IP address ranges. The attackers would also save their most sophisticated surveillance tools for high-value targets. Turla’s motives are different to Dragonfly, however. The Turla attackers are carrying out long-term surveillance against embassies and government departments, a very traditional form of espionage.
Both the Dragonfly and Turla campaigns bear the hallmarks of state-sponsored operations, displaying a high degree of technical capability and resources. They are able to mount attacks through multiple vectors and compromised numerous third-party websites, with their apparent purpose being cyberespionage—and sabotage as a secondary capability for Dragonfly.
These campaigns are just examples of the many espionage campaigns we see on an almost daily basis. This is a global problem and shows no sign of abating, with attacks such as Sandworm also leveraging a number of zero-day vulnerabilities. Given the evidence of deep technical and financial resources these attacks are very likely state-sponsored.
Credit cards in the crosshairs
The lucrative business of selling stolen credit or debit card data on the black market makes these cards a prime target for bad guys. 2014 saw several high-profile attacks targeting point-of-sale (POS) systems to obtain consumers’ payment card information. One factor making the US a prime target is the failure to adopt the chip-and-PIN system, known as EMV (Europay, MasterCard and VISA), which offers more security than magnetic stripe-based cards. The attacks used malware which can steal the information from the payment card’s magnetic stripe as it is read by the computer and before it is encrypted. This stolen information can then be used to clone that card. Because EMV card transaction information is uniquely encoded every time, it’s harder for criminals to pick up useful payment data pieces and use them again for another purchase. However, EMV cards are just as susceptible to being used for fraudulent online purchases.
Apple Pay, which basically turns your mobile phone into a “virtual wallet” by using near-field communication (NFC) technology, was also launched in 2014. NFC is a type of communication that involves wirelessly transmitting data from one hardware device to another physical object nearby, in this case a cash register.
While NFC payment systems have been around for a while now, we expect to see an uptick in consumer adoption of this technology in the coming year, as more smartphones support the NFC standard. It’s worth noting that while NFC systems are more secure than magnetic stripes, there is still a possibility of hackers exploiting them, although this would require the bad guys to target individual cards and wouldn’t result in large scale breaches or theft like we have seen in the US. However, the payment technology used won’t protect against retailers who aren’t storing payment card data securely, they’ll still need to be vigilant in protecting stored data.
Increased collaboration with law enforcement
Now, for a bit of good news: 2014 saw many examples of international law enforcement teams taking a more active and aggressive stance on cybercrime by increasingly collaborating with the online security industry to take down cybercriminals.
Blackshades is a popular and powerful remote access Trojan (RAT) that is used by a wide spectrum of threat actors, from entry-level hackers right up to sophisticated cybercriminal groups. In May of 2014, the FBI, Europol, and several other law enforcement agencies arrested dozens of individuals suspected of cybercriminal activity centered on the use of Blackshades (also known as W32.Shadesrat). Symantec worked closely with the FBI in this coordinated takedown effort, providing information that allowed the agency to track down those suspected of involvement.
Just one month later, the FBI, the UK’s National Crime Agency, and a number of international law enforcement agencies, working in tandem with Symantec and other private sector parties, significantly disrupted two of the world’s most dangerous financial fraud operations: the Gameover Zeus botnet and the Cryptolocker ransomware network. This resulted in the FBI seizing a large amount of infrastructure used by both threats.
While these takedowns are part of an ongoing effort, we won’t see cybercrime disappearing overnight. Both private industry and law enforcement will need to continue to cooperate to have long-lasting impact. As the rate and sophistication of cyberattacks grows, we expect to see a continuation of this trend of collaboration to track down cybercriminals and stop them in their tracks.
So, there you have it, my take on the four most important online security events of 2014. Of course, there’s still a few weeks left before we ring in 2015, so we may yet see other events arise, but you can trust that Symantec is here and that we’ve got your back, no matter what the future may bring!