Trend Micro – Threat Trends RSA2015
April 2015 – At RSA 2015 we had a chance to sitdown with Trend Micro to discuss the threat trends for 2015. The challenge for IT is protecting systems and users that are using thin client end points with the main data and applications in the cloud. The issues remain for both public and private cloud configurations. The cloud environment is much more difficult to protect, as it is designed as a multiuser access application, so there are limits on securing access to the devices.
These cloud systems almost always feature VMs. These Virtual Machines are targeted for malware and viruses not only in the application space, but also in the hypervisor that manages the VM. The VM have to be protected not only from malware from similar OS devices, but also from the large variety of mobile devices and their OS. These remote devices are attacking the cloud computing environment through the placement of malware in the form of a remote access Trojan (RAT) which provide unauthorized access to data and the server systems.
Trend Micro – Structure of a Watering Hole Attack
A major trend is targeted attacks rather than broad based attacks such as DDoS. Currently almost 25% of the cloud attacks are Watering Hole attacks. These are aimed at high profile and high value asset companies. The structure of a Watering Hole attack (description courtesy of Trend Micro):
1. Attackers gather strategic information that they can use to gain entry into their targeted organization. This step can be compared to a military reconnaissance mission. The information gathered may include insights on trusted websites often visited by the employees or members of their targeted entity. The process of selecting websites to compromise was initially dubbed “strategic web compromises.”
2. Attackers insert an exploit into the selected sites.
3. Once targeted victims visit the compromised site, the exploit takes advantage of software vulnerabilities, either old or new, to drop malware. The dropped malware may be in the form of a remote access Trojan (RAT), which allows attackers to access sensitive data and take control of the vulnerable system.
A second major trend attacking both cloud configurations and mobile devices is Ransomware. This is a kind of malware that keeps the attacked system or users from gaining access to their own system. The attack is designed to force the victims to pay a ransom through certain online payment method to get access back to their system. The ransom prices vary, ranging from payment is $USD or its bitcoin equivalent. Rather than delete the files, some ransomware encrypts files – this is called a Cryptolocker. It is important to note, in many cases, that paying for the ransom does not guarantee that users can regain access to the infected system and data. Ransomware is becoming a threat of choice for systems that have engaged in high levels of physical access security.
Trend Micro – Typical Crytolocker/Ransomware message
One of the reasons these threat systems are gaining in popularity is the increasing challenge in manual patching of systems. With cloud based applications, the IT group now has to coordinate patching for the servers, the VMs, the physically attached (desktop/laptop) clients on the VPN, and mobile devices. This diversity in Operating Systems and applications accessing the server as well the increase in the number of devices that need to be tested and updated creates a delay in the distribution and installation of critical security patches which now increases the amount of time a system vulnerability is exposed to potential attack.
