third Cyber Security Assessment Netherlands - NCSC

Detailed section » 7 Vulnerability of IT
Microsoft
Windows
6%
Adobe
Reader/
Acrobat
15%
Integrated exploits for products in exploit packs
Mozilla Firefox
3%
Adobe Flash
17%
g Oracle Java
g Adobe Flash
g Microsoft Windows
g Other
Other
9%
Oracle Java
32%
Microsoft
Internet Explorer
18%
g Microsoft Internet Explorer
g Adobe Reader/Acrobat
g Mozilla Firefox
Figure 13. Software abused by exploit kits
exploiting vulnerabilities. The vulnerabilities that are abused are
often already known and not new. In some cases these are zero-day
vulnerabilities. The most notable development in the area of exploit
kits was the disproportionate number of Java vulnerabilities that
were abused.
7.3.3 Malware and infrastructure
The majority of malware focuses on collating financially attractive
data such as credit card or user ID/password details. The by-catch
– such as websites visited, details entered on forms and key strokes –
is often gathered at the same time. The average malware offers even
wider opportunities. For example it is often also possible to secretly
copy documents, take screen shots or take photos or recordings using
a built-in webcam or microphone. There have already been cases
where such techniques have been used for espionage, as well as for
blackmail or voyeurism. It is becoming easier and more appealing for
malicious attackers to capture and abuse or sell such data.
As described in the core assessment, malware is a permanent
element of cyber crime. Spreading malware is becoming increasingly
wholesale and easier. One of the latest trends is to spread
malware through legitimate websites. Malware is increasingly
targeting different platforms, including Mac OS X, mobile platforms
and in the case of state malware also specific industrial systems.
Tools for developing, spreading and managing malware and rogue
infrastructure are becoming increasingly professional. New
malware is to a limited degree being detected by virus scanners and
malware is becoming increasingly difficult to remove from a system.
The previous CSAN indicated that 30 per cent of computers are
infected with malware.
The NCSC is increasingly receiving information about malware
infections, rogue infrastructures and indicators of sophisticated
malware. However organisations often still do not have effective
detection mechanisms set up. In response, the organisations
concerned generally make do with cleansing infected systems again.
This means that it is impossible to subsequently establish the
impact of an infection.
Based on information from public sources, developments in the
area of sophisticated attacks, malware and rogue infrastructure can
be summarised as follows:
»»
An increase has been detected in state cyber espionage and
sabotage activities.
»»
Sophisticated attacks are becoming more common and are also
[48: Symantec 2013]
being carried out against smaller organisations.
»»
Sophisticated techniques used by state actors are being adopted
by organised criminals. [197]
»»
The attacker is increasingly gaining benefit. Despite various
initiatives for improvement, the defence measures, methods and
initiatives are lagging further behind the opponents’
opportunities.
7.3.4 Sophisticated malware
Since the previous CSAN, investigators have once again uncovered
forms of highly sophisticated malware. The Wiper, Flame,
Miniflame and Gauss malware are connected to previously detected
malware such as Stuxnet and Duqu. Reports often associate this
with elements of an American/Israeli espionage campaign directed
at targets on the Middle East, with the emphasis on Iran. Other
sophisticated malware recently uncovered includes Miniduke [198] ,
Itaduke, RedOctober [199] and TeamSpy [200] . According to public
sources it is highly probable that multiple states are now actively
using sophisticated malware.
It appears that the techniques used are now being copied by various
actors. The Shamoon malware uses a technique of mutilating files
that is based on the Wiper malware. Wiper was used to make Iranian
oil companies’ systems unclear. Shamoon was used in an attack on
Saudi Aramco and RasGas. [201] Whereas Wiper was a sophisticated
197 http://blogs.mcafee.com/mcafee-labs/signed-malware-you-can-runbut-you-cant-hide
https://www.securelist.com/en/blog/682/Mediyes_the_dropper_with_a_valid_signature
http://arstechnica.com/security/2012/09/
adobe-to-revoke-crypto-key-abused-to-sign-5000-malware-apps/
198 http://www.h-online.com/security/news/item/Highly-specialised-MiniDuke-malware-targetsdecision-makers-1813304.html
199 http://threatpost.com/en_us/blogs/
rocra-espionage-malware-campaign-uncovered-after-five-years-activity-011113
200 http://threatpost.com/en_us/blogs/researchers-uncover-teamspy-attack
-campaign-targeting-government-research-targets-032013
201 http://www.nytimes.com/2012/04/24/world/middleeast/iranian-oil-sites-go-offline-amidcyberattack.
html?_r=1 & http://www.theregister.co.uk/2012/08/30/rasgas_malware_outbreak/
87
»