GSN Aug/Sept Digital Edition

Hackers control compromised systems through customizedcommand-and-control (C&C) systems. C&Ctraffic can trigger intrusion detection systems, whichhackers try – often successfully – to evade.One technique is to encrypt the C&C traffic, whichof course requires decryption by the target system.Another technique, called steganography, is to hidethe C&C traffic inside a file – often an image file – thatappears innocuous. [2]Some malware combines these techniques by encryptingthe C&C traffic before “smuggling” it inthrough an image (or other) file.Encrypting and Compressing Stolen DataData loss prevention (DLP) systems can detect whendata is moving to places it should not go, so APTs encryptthe ex-filtrated data to avoid triggering the DLPmechanism. As with the C&C traffic, APTs will takethe extra step of embedding the purloined informationin an image file using steganography. To add fuelto the fire, some APTs use multiple encryption methods,further complicating the detection, analysis anderadication processes.APTs also compress stolen data for several reasons.First, smaller quantities of data are less likely to be noticedby humans or by automated detection systems.Second, it adds another layer of obfuscation to thedata. Third, it is simply a more efficient way to transferlarge quantities of information. Again, as with encryption,APTs will make life difficult for the victimby using multiple compression algorithms. Moreover,the algorithms, both for encryption and compression,are often rare and are used in ever-varying combinations.[3]MisdirectionOkay, this element is not terribly advanced, but it’sworth mentioning. Some malware will embed signaturesor tell-tale signs of other well-known hackergroups. For instance, the Duqu 2.0, malware, whichrecently infected Kaspersky Labs, included referencesto a Romanian hacker group. Researchers quickly realizedhowever, that the malware could not have comefrom that group. [4]Use of Zero-Day ExploitsIn the hacker world, zero-day exploits are boughtand sold regularly. Modern malware will leveragezero-day attacks, often using multiple exploits in complexcombinations, to remain undetected as long aspossible.Other sophisticated design features include:- Virtual file systems;- Modular design to customize the malware to thetarget;- Code obfuscation to hamper reverse engineering;- Avoidance of resource starvation (run “low andslow”);- File-less installation (e.g., Windows can run codedirectly from the registry);- Cloud deployment, or “malware-as-a-service” (itwas just a matter of time)27MitigationIt’s all well and good to understand APTs, but the mainquestion is how to protect your systems from intrusionfrom modern malware. As we have seen, APTs use alarge array of attack techniques, so the best protectioncomes from a wide array of defenses. Start with thebasics: limit and monitor administrative privileges,keep the operating system and applications patched,perform regular vulnerability scans and employ applicationwhitelisting when possible. Encrypt your data,so if it does get exfiltrated, the attackers will need tosteal keys as well. You may not stop them, but leastmake their task as difficult as possible. Use as manyoverlapping defenses as you can afford, but preparefor the worst and know what to do if you are compro-