ENISA Threat Landscape mid year 2013

In theory, the process of risk management is an ongoing iterative process. However, practical observations show that iteration is often neglected in risk management. There are always “good reasons” to avoid iteration of existing assessments: shift of focus, budget cuts, planning cycles, changing strategic priorities, reorganisations, to name but a few. This is unfortunate because iteration is the only path to maturity improvement: it enhances available knowledge, leads to better assessments, to corrective measures and improves the quality of subsequent assessments. All in all, it helps in understanding reality and smoothly adapting mitigation strategies. In the dynamic cyber security ecosystem this is THE key capability. Bertolt Brecht understood this long before information technology, risk and threat analysis:

“Taught only by reality can reality be changed”

With this in mind, ENISA presents in this short paper a first “taste” of current developments related to the Threat Landscape 2013. The objectives of this short report are the following: - To get better: Improve our assessment capabilities with regard to emerging trends in cyber security by validating 2012’s assessed threat trends ; - To reflect the reality: Deliver a consolidated view of the current threat landscape while at the same time providing the grounds for observed deviations; - To flag new developments: Inform the public as early as possible about developments from our on-going information collection. The collected information comes mainly from reports published st during 2013 and covers the 1 half of 2013.

The reality check of 2012’s assessment is depicted in Figure 1. The notation used for this reality check is the following: - The prioritization of threats has been taken “as is” from the 2012 assessment. - Changes in trends - indicated through the arrows - are commented on in the accompanying text. - We then briefly comment on important issues identified in 2013 regarding the top threats along with references to relevant sources.

An updated prioritization, detailed analysis of threats, trends, threat agents and attack vectors will be delivered in the full ENISA Threat Landscape report to be published before the end of 2013.

Page 1

ENISA Threat Landscape, Mid-year 2013

                         

ENISA Threat Landscape, Mid-year 2013

Changes in threat trends and interesting developments

Through the ongoing information collection and analysis exercise, ENISA has identified the following changes/interesting developments regarding the threats identified in 2012:

Drive-by-exploits: There is a shift from Botnets to malicious URLs as the preferred means to distribute malware . An advantage of URLs as a distribution mechanism lies in the fact that URLs are not such an easy target for law enforcement takedowns. It has been reported that there is an increase in the rate of suspicious URLs compared with 2012 . Concluding, one can say that browserbased attacks still remain the most repored threats, whereas Java remains the most exploited 4,5 software for the materialization of this threat.

Code Injection: A notable issue with regard to this threat is attacks against popular Content Management Systems (CMSs). Due to their wide use, popular CMSs make up a considerable attack 6,7 surface that has drawn the attention of cyber-criminals . Although no important changes have been reported in 2013 regarding this threat, it is worth noting that cloud service provider networks are used increasingly to host tools for automated attacks , thus implementing an important step in code injection attack vectors.

Botnets: Although there is a shift to URLs for malware infection (see Drive-by-exploits above), there are further interesting developments with regard to this threat. Although not new, an interesting aspect of botnet activity reported, is the use of botnet infrastructure to mine Bitcoins . Another important development is the increased use of P2P botnets . Such botnets are difficult (yet not 11 12 impossible ) to locate and take down. Moreover, in Internet Census 2012 it has been demonstrated how easy is to create botnet infrastructures by misusing weaknesses in security of massively deployed devices. The Browser-Based botnets is yet another example on how easy is to create a very large botnet infrastructure . Finally it is interesting to observe a rise in TOR-based botnets , while more “traditional” botnet operations seem to be in decline, reportedly due the low interest in “traditional” botnet “business cases” .

ENISA Threat Landscape, Mid-year 2013

Rogueware/Scareware: In 2013 there was an increase in rogueware/scareware reported. Despite recent law enforcement advances , the reports analysed provide strong evidence that there is an increase in ransomware threat. One reason for the growth is the expansion of ransomware and fake 22,23 Antivirus distribution to mobile platforms, such as Android . In all cases, the availability of anonymous payment services to channel illegal profits obtained from this threat is a key enabler for this kind of fraud .

Targeted Attacks: In first half of 2013, targeted attacks demonstrated their effectivenes in achieving their objectives. In particular, cyber espionage attacks reached a dimension that went far beyond expectations . Again, the proliferation of mobile devices delivers a wide exploitation surface for this kind of threats . It is worth mentioning that mobile spyware applications might become strong tools for APTs targeting Bring Your Own Device environments .

Identity Theft: This threat led to some of the most successful attacks by abusing SMS-forwarders to achieve significant financial fraud . These attacks were based on known financial trojans (e.g. Zeus, SpyEye, Citadel ) that have been implemented on mobile platforms and attack 2-factor 30 31 authentication . A significant source for applying this threat remains social media . It is worth mentioning that an increase in malicious browser extensions has been registered, aimed at taking over social network accounts .

Search Engine Poisoning: In the first half of this year not many references to this threat have been found. One reference about better defence levels against this threat stated that the relevant defences of Google seemed to reduce this threat. As with many other threats, Search Engine Poisoning has also gone mobile: some reports on malicious mobile apps performing Search Engine

ENISA Threat Landscape, Mid-year 2013

Concluding remarks

When we look at 2013 and beyond, the following developments regarding the threat landscape can be observed:  Cyber-criminals increasingly use advanced methods to implement attack vectors that are non-traceable and difficult to take down. An important role in this play: anonymization technologies and the use of distributed technologies for more “resilient” infrastructures, such as P2P.  It is clear that mobile technology is, and will increasingly become, exploited by cybercriminals. Threats of all kinds that were encountered in the more traditional arena of IT will prevail on mobile devices and the services available on these platforms. The proliferation of mobile devices will lead to an amplification of abuse based on knowledge/attack vectors targeting to social media.  The consumerization of malware, cyber-hacking tools and services, together with the availability of digital currencies and anonymous payment services, will open up new avenues for cyber-fraud and criminal activity.  There is a real possibility of large impact events when attacks combining the above threats are successfully launched. A characteristic impact from such attacks is described in the risk of digital wildfires that was assessed in the beginning of 2013 . 37 th  As reported by ENISA , cyber-attacks are the 6 most important cause of outages in telecommunication infrastructures, with an impact on considerable numbers of users in this sector. Taking into account incidents of the first half of this year, and also developments in the denial of service threat, we see an increase of infrastructure threats in 2013. When additional sectors and assets are being considered, the impact of cyber-attacks will be better analysed and understood.