Cyberattack ‘platforms’ call for defense in depth – and breadth
Connecting state and local government leaders
The new level of advanced persistent threats – some lasting for a decade or more – calls for agencies to extend their defensive measures to cover threats to partners well outside the enterprise.
It’s getting a lot harder to be impressed by the latest piece of malware or cyber threat that hits the streets, given the already formidable arsenal that has been created for hackers to choose from. The every day distributed denial of service (DDoS) threat now seems almost quaint. Then along comes Regin.
To be more precise, along comes Backdoor.Regin, recently discovered and described in detail by Symantec. What astounds about this Trojan is not just its complexity, but the time it’s taken for it to mature into its current state.
Symantec has traced attacks back to at least 2008, and some reports suggest components of Regin go as far back as 2003.
That takes the definition of Advanced Persistent Threat (APT) to a new level. And it may go even further since Symantec warns that analysis of it will probably reveal much more.
“Threats of this nature are rare and only comparable to the Stuxnet/Duqu family of malware,” it said. “Many components of Regin remain undiscovered, and additional functionality and versions may exist.”
The company describes Backdoor.Regin as a multi-staged threat, with all but the first stage hidden and encrypted. It also uses a modular approach and can be tailored with custom features for specific targets. Based on what’s been discovered so far, it has dozens of potential payloads.
In its own analysis, security researcher Kaspersky Labs said malware is not an accurate description of Regin. It should instead be seen as a cyberattack platform, which attackers deploy to gain total remote control of networks at all levels. According to Kaspersky, Regin is one of the most sophisticated it has analyzed.
“The ability of this [Regin] group to penetrate and monitor [Global System for Mobile] networks is perhaps the most unusual and interesting aspect of these operations,” the company said. “Although GSM networks have mechanisms embedded that allow entities such as law enforcement to track suspects, there are other parties which can gain this ability and then abuse it to launch other types of attacks against mobile users.”
GSM is the most widespread mobile standard, and has over a 90 percent share of the world’s mobile market. Other than the United States, which primarily uses the Code Division Multiple Access (CDMA) standard, most countries that have mobile networks use GSM.
At first glance, one would think that makes the United States safe from Regin attacks. Looking at the list of infections so far, big countries such as Russia and Germany are among the victims, along with some smaller ones. The United States is notably absent.
But as it turns out, that shouldn’t necessarily offer any comfort. As a recent column here indicated, many of the most sophisticated attacks now come through the exploitation of privileged network accounts. That means that while government organizations may not be direct victims of an attack, if attackers get into the network of a trusted partner, they can eventually get to government data.
With the kind of global reach that government agencies now have to have to do business – even at the state and local level – no one should presume they are safe from bad guys getting into their networks and systems and stealing data.
And even if they haven’t been directly attacked, that doesn’t mean their partners have not been, nor the trusted partners of those partners and so on down the line.
Defense-in-depth has become the solution du jour for protecting data from malware and Trojans such as Regin that organizations now have to assume will penetrate their networks. Perhaps that should now be extended to a “defense-in-breadth” in order to cover vulnerabilities posed by threats outside the organization.
Modern organizations, including government agencies, have to do business with those lateral partners, so it should make sense to have such protections in place.
NEXT STORY: App-level approach to mobile management