2KKUU7ita

Chapter 8: Network Infrastructure
What you need to know about advanced malware
Advanced malware (also known as advanced
persistent threat or APT) has been all the rage
lately. Such targeted attacks are highly sophisticated
and extremely difficult to detect — that
is, unless you have the proper controls and the
network and/or host layers. I once worked on
a project where a large enterprise was targeted
by a Nation State (presumably because
of the line of work the enterprise was in) and
ended up having over 10,000 Windows servers
and workstations infected by malware. The
enterprise’s big box antivirus software was
none the wiser. The project turned out to be
an extensive exercise in incident response and
forensics. The infection was traced back to a
phishing attack that subsequently spread to all
the systems while, at the same time, installing
password-cracking tools to attempt to crack
the local SAM file on each Windows machine.
This advanced malware infection is just one of
countless examples of new advanced malware
that most organizations are not prepared to
prevent. The obvious solution to prevent such
attacks is to keep users from clicking malicious
links and preventing malware from being
“dropped” onto the system. That’s tough, if not
impossible, to prevent. The next best thing is to
use technology to your advantage. Advanced
malware monitoring and threat protection tools
such as Damballa Failsafe (www.damballa.
com/solutions/damballa_fail
safe.php), Next-Generation IPSs such as
what’s offered by Sourcefire (www.source
fire.com/security-technologies/
network-security/next-generation-
intrusion-prevention-system),
and whitelisting technologies such as Bit9’s
Parity Suite (www.bit9.com/products/
bit9-parity-suite.php) that helps
protect the host are a great way to fight this
threat.
The bottom line: Don’t underestimate the risk
and power of targeted malware attacks.
Here are some common DoS attacks that target an individual computer or
network device:
✓ SYN floods: The attacker floods a host with TCP SYN packets.
✓ Ping of Death: The attacker sends IP packets that exceed the maximum
length of 65,535 bytes, which can ultimately crash the TCP/IP stack on
many operating systems.
✓ WinNuke: This attack can disable networking on older Windows 95 and
Windows NT computers.
Distributed DoS (DDoS) attacks have an exponentially greater impact on their
victims. One of the most famous was the DDoS attack against eBay, Yahoo!,
CNN, and dozens of other websites by a hacker known as MafiaBoy. While
updating this book to the third edition, there was a highly publicized DDoS
attack against Twitter, Facebook, and other social media sites. The attack
was apparently aimed at one user from Georgia (the former Soviet country,
not the state where I live), but it affected everyone using these sites. I
couldn’t tweet, and many of my friends and family members couldn’t see
151