Preparing for Multi-Staged Attacks

Websense released its “Threat Report 2012: The Year in Review for Threats” and some of the key takeaways include attacks are becoming more dynamic, multi-staged, focused “sniper” attacks, and are increasingly aimed more at application vulnerabilities and less at operating systems.

The year in review shows the following:

• 82% of malicious web sites are hosted on compromised hosts
• 55% of data-stealing malware communications are web-based
• 43% of the activity inside of Facebook is categorized as streaming media
• 50% of malware connections lead to the United States
• 60% of phishing attacks are hosted in the United States
• 36% of malware is hosted in the United States

Websense identifies six stages of attacks:

Lures
Focused on exploiting human curiosity or common actions, lures target victims on social sites and through email. Since 42% of activity inside Facebook is video, video is a common attack on social sites. Lures offering appealing videos (former boyfriends or girlfriends, current news events, outrageous antics), invite users to take surveys or win free gifts. On email, lures appear as important news that a user may be waiting for like tax refund information, shipping/delivery information, confirmation emails, and urgent bank notices.

Redirects
Once a user clicks on the link, they are redirected onto a blind or hidden path for analysis by an exploit kit, to a survey, rogue AV offer, or fake web page.

Exploit kits
Instead of simply dumping malware on a users computer, the redirect may function like a sniper looking for a shot. If a vulnerability is detected, an attack may be initiated to exploit the vulnerability, otherwise the redirect may send use to a clean site and stay hidden.

Dropper files
Now a dropper file is set in motion, but since the file uses a dynamic packer, known signatures and patterns may remain hidden, so the AV protection may not detect the attack.

Call-home communications
With only one entry point, an attack may infiltrate the system and begin stealing data. Then the attacking file may call back home for malware downloads and tools. Since most AV programs are forward facing, they fail to analyze outbound traffic from infected systems.

Data theft
Then the attack begin stealing data in low volumes per request (drips), avoiding detection over a defined period of time.

With this dynamic multi-staged attack in mind, Charles Renert, Vice President, Websense Labs, says, “More than 80% of today’s attacks require multi-stage defenses for protection.” Preparing for attacks requires a dynamic data driven solution that utilizes    big data, machine analysis, and predictive defenses that assess and respond to threats in real time.

Integracon offers a robust suite of security and assessment tools that can help you keep an eye on your network, your security and your business. For more information, call us at 865-330-2323 or chat via Integracon.com.