third Cyber Security Assessment Netherlands - NCSC

get the script kiddies started. One example is the SQL injection tool
Havij that can be used to call up databases on insufficiently secure
websites with just a couple of mouse clicks. [41]
Humannet example
In April 2012, a report by the television programme Zembla
revealed that security of the internet application Humannet
that is used by absence management companies to process
customer, medical and absenteeism data, was not effective.
Behind the scenes, the application still offered access to an
old log-in page that did not have the latest security patches.
It seemed that the application was relatively easy to hack into
using SQL injection. As a result, the details of 300,000 patients
were compromised. The fact that the application was run and
the data stored by an external company does not exempt the
employer and owner, in this case the absence management
companies, from the responsibility of ensuring data security.
3.1.3 Increase in the volume of unique malware
There has been a sharp increase in the number of incidences of
unique malware in recent years. The AV-TEST Institute records more
than 200,000 new instances every day. [42] This sustained increase is
presumably the result of lots of (automatically generated) versions
of the same type of malware and the morphing (reshaping) of
malware. As a result, analysing and recognising malware signatures
has become technically impossible. Several anti-virus solutions are
therefore looking at common ways in which malware behaves to
aid detection.
3.1.4 Security solution attacks bypass security
An alternative approach is to refer to a list of reliable software
(‘white-listing’) as a tool. If software (in which case it is assumed to
be malware) does not appear on the list, it should not be installed.
However it was noticed at the beginning of 2013 that malicious
parties were temporarily able to contaminate the white list provided
by the software security company Bit9 because they had gained illegal
access to a facility where they could digitally certify software samples
as bona fide. [43] Some of their customers were still able to recognise
these samples as malware thanks to other anti-virus solutions.
41 http://www.troyhunt.com/2012/10/hacking-is-childs-play-sql-injection.html
42 www.AVtest.org, data collated on 14 May 2013
43 http://krebsonsecurity.com/2013/02/security-firm-bit9-hacked-used-to-spread-malware/
44 https://www.security.nl/artikel/45214/1/Nederlands_politievirus_dreigt_met_niet_
bestaande_wet.html,
https://www.security.nl/artikel/45117/1/Nederlands_politievirus_krijgt_makeover_%2Aupdate%2A.html
45 http://malwarealert.org/trojanandroidginmaster-a/
46 https://www.botnets.fr/index.php/Citadel_ZeuS_bot
3.1.5 Ransomware
Ransomware is not a new phenomenon, but last year users also
received extortion demands for alleged offences such as computer
criminality, genuine or fictitious visits to pornography sites and
child pornography. Using crude forms of pressure such as displaying
police logos, and child pornography together with the user (via
their webcam), intensified the impact on the victims. Even more so
than hacking, skimming and fraud involving internet banking, this
had a direct impact on individual citizens’ sense of security.
Ransomware hijacks the infected system’s functionality, for example
by encrypting files or blocking the operating system from working.
The malware demands a payment from the user to restore the
blocked functionality and generally puts the user under pressure
not to report it. The criminals use encryption and virtual digital
money so that they can remain beneath the radar. There are now
various updated versions of ‘police ransomware’ targeted
specifically at the Netherlands (Reveton and Urausy) [44] that lock
computers in saying this has been done by the police.
3.1.6 Mobile malware
The increased threat to mobile platforms continues. Android is
the main target. [46: Sophos 2012] The most common forms of attack are
scams, spam and phishing. [1: Blue Coat 2013] While the methods are still
relatively simple, they are clearly profitable. Users are tempted into
installing fake anti-virus and fake apps (for example Angry Birds
Space or Instagram). These apps install malware on the device or
send unwanted and unauthorised SMS messages to premium rate
numbers. [50: TM 2013] Gaining unrestricted access rights to the data on
a mobile device is something else malware aims to do (for example
GinMaster [45] ).
Furthermore, just as last year there are also various variants of
malware directed at financial services: Zitmo, Spitmo, the mobile
variants of ZeuS and SpyEye. These focus on a broad range of
information, including incoming SMS messages, passwords and
contact details. Although these forms of attack are on the rise, the
volume of malware directed at mobile platforms is currently still
just a fraction of the malware directed at standard computers.
3.1.7 Botnets
Botnets are networks of collaborating devices, generally private
or business computers that are known as ‘bots’ and are infected
with the same malware. Criminals can control a botnet centrally
to use the computing capacity for their own purposes. Botnets are
frequently used to send spam and to carry out DDoS attacks.
The malware landscape used to create botnets is currently dominated
by a number of malware families. The most familiar is the
ZeuS family. One group derived from this [46] yet still separate are the
botnets based on Citadel malware, such as Pobelka and Plitfi.
The Citadel botnets enjoyed media attention in the Netherlands
following on from incidents surrounding Dorifel and Pobelka.
Botnets are known for being used by criminals to manipulate
financial transactions. However the Pobelka botnet demonstrated
28