Hackers are using a variety of weapons and exploiting errors such as default passwords and weak or misconfigured access control lists (ACLs), according to the latest Verizon Business Data Breach Investigations Report.
The follow-up to April's 2009 Data Breach Investigation Report looks under the hood of the company's probes, analyzing how breaches happen and how to protect sensitive data.
"Customers who read the
Requires Free Membership to View
SearchSecurity.co.UK members gain immediate and unlimited access to breaking UK industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.co.UK today!
Michael S. Mimoso, Editorial Director
2009 Data Breach Investigation Report said they wanted to know how these attacks take place, give some examples from our caseloads and see if those circumstances can happen to them," said Wade Baker, Verizon Business research and intelligence principal.
A quick assessment of the most common attack factors show that hackers use a combination of tools and techniques to crack into target enterprises' networks and steal millions of records. The 2009 Data Breach Investigations Supplemental Report reveals that a combination of keyloggers and spyware, backdoor command/control tools, SQL injection and packet sniffers were typically used in the attacks that yielded the richest data harvests. More often than not, the bad guys were able to take advantage of default authentication credentials and weak or misconfigured ACLs.
"If you are an attacker, you've got to figure out how to get into the network; find critical data systems," Baker said. "Then exploit those systems and get that data out. All those steps require a different approach and that's why you see these things working in tandem."
The report breaks down each of 15 threat types, describing what they do, how they gain access, what security personnel should look for and how to mitigate the risk. Each entry includes a case study of a Verizon Business investigation in which the threat type was a key factor.
Take for example, the impact of deficient access control at a consumer bank that called Verizon in to investigate card numbers and PINs being stolen through their ATM systems.
The investigators confirmed the breach in which the intruders gain initial entry through a SQL injection attack on the bank website, but that was just the start. After installing malware, the attackers located the ATM hardware security modules (HSMs), which -- jackpot! -- had no access control mechanisms. As a result, the HSMs could be accessed from hundreds of systems on the network. The attackers moved data out of the network via FTP connections for months before the breach was discovered.
The failure to detect the breach underscores a key finding of the original report -- that the data drains typically go undetected and are often discovered by third parties that notice, for example, fraudulent credit card activity. Each threat type has telltale indicators -- unauthorized access via weak/misconfigured ACLs, for example, can be uncovered through routine log monitoring or user behavioral analysis, according to Verizon. The conclusion is that enterprises aren't always paying attention.
"Most of these companies have some means of detecting events, such as log files," said Baker. "Evidence there had been a breach could have been identified.
"My sense is there is more aggregation of log data and network events than there is actual analysis and digging into and inspection of events."