third Cyber Security Assessment Netherlands - NCSC

An attacker can abuse devices linked to the internet in a number
of ways:
»»
Direct abuse of processing capacity, connectivity and bandwidth:
an attacker can takeover systems and then make them part
of a botnet. Botnets such as these can be used for lots of
dishonest purposes.
»»
Abuse as a stepping stone: from a system he has taken over,
an attacker can crawl and attack other systems.
»»
Steal (confidential) personal or business data: an attacker
can steal sensitive data that is stored on the system (e-mail,
documents, databases).
»»
Profiling of personal behaviour: an attacker can collate details
of a user’s behaviour from the device (location details, websites
visited, purchases made). Abuse of this information is of interest
for targeted attacks.
»»
Detecting and stealing personal identity: an attacker pretends
to be someone else (spoofing) and uses this to his benefit. An
attacker can also find out a user’s identity under a pseudonym
and abuse this (doxing).
»»
Stealing credentials for access to services: an attacker can capture
the user’s identification details (account name, password, access
code, cryptographic key) and use these to access the user’s
services (web services, e-mail, cloud services, internet shops,
banks) and send messaged or complete transactions.
»»
Denial of service, sabotage: an attacker can sabotage the device
and cause harm.
Direct abuse
Stepping
Stone
Data theft
Profiling
Identity
theft
Credentials
theft
Denial
of Service
Consumer computer devices Practice Practice Practice Practice a Practice Practice Practice
Consumer network devices Practice b Practice Practice Theory PoC Practice Practice
Mobile consumer devices
Theory
Practice
PoC / Practice c Practice Practice Theory Practice -
Fixed consumer devices Theory Theory - PoC d - - Theory
Fixed technical and
business devices
PoC e Practice Theory - - Practice PoC
Mobile technical devices - - - PoC f - - PoC
Table 6. Matrix of abuse potential per category of device
a) Consumer computer devices such as laptops and PCs generally
do not have a location sensor. However the user can be profiled
using cookies, the IP address and by using location software such
as Google Maps.
b) Consumer routers require attention with respect to security. This
was the warning the Consumers’ Association gave to its members
at the beginning of this year, alerting them to easily cracked
router passwords. [146]
c) Previously refuted rumours of a botnet on mobile devices were
later confirmed by the BBC. [147] There was further speculation from
McAfee Labs [22: McAfee 2013-2] concerning a Near Field Communication
(NFC) worm.
d) In part following on from alleged large-scale electricity metre
fraud, the European network security organisation ENISA issued a
[9: ENISA 2012]
report in May 2012 on the security of electricity networks.
e) As far back as 2010, Barnaby Jack demonstrated at the Black Hat
security conference that cash machines were vulnerable to abuse.
Abusing technical vulnerabilities would allow large amounts of
money to be obtained. [148]
f) During the RSA security conference in 2012 in San Francisco, a
security investigator demonstrated that a wireless insulin pump
could be abuse remotely to administer a lethal dose of insulin. [149]
146 Consumentenbond, Actueel, (3 January 2013), http://www.consumentenbond.nl/actueel/
nieuws/nieuwsoverzicht-2013/Half-miljoen-wifi-routers-lek/
147 BBC news, China mobile users warned about large botnet threat, (15 January 2013),
http://www.bbc.co.uk/news/technology-21026667
148 Wired Threat Level,(July 2010), Researcher Demonstrates ATM ‘Jackpotting’ at Black Hat
Conference, http://www.wired.com/threatlevel/2010/07/atms-jackpotted/ en IT SECURITY
BLOG, (Augustus 2012), Exploiting ATMs: a quick overview of recent hacks, http://security.
blogoverflow.com/2012/08/exploiting-atms-a-quick-overview-of-recent-hacks/
149 Bloomberg Tech Blog, (29 February 2012), Hacker Shows Off Lethal Attack By Controlling
Wireless Medical Device.
72