UK Universities Suffer Most APT Attacks in 2015

FireEye’s just released its latest stats on APT attacks in the first half of the year, with the UK dropping down one place from fourth to prop up to the top five most attacked countries in EMEA.

However, of particular interest was the stat that education was the most targeted sector in the UK followed by energy/utilities and financial services, as I wrote in this Infosecurity piece.

I get the other two, but education? I asked FireEye threat expert Jens Monrad for more detail.

“If we look into the motive, there are three key types of threat actors who want to target education. Advanced Persistent Threat (APT) groups will likely seek to use a university’s network infrastructure as a staging ground from which to launch cyber operations against targets in other industries, on the assumption that their activity will appear less suspicious if it originates from a reputable university network,” he told me.

“These threat actors may also target educational institutions to gain access to sensitive intellectual property, such as from university research centres for the purpose of economic espionage.”

Aside from APT attackers, there’s also a risk to schools and universities from financially-motivated cybercriminals looking to steal sensitive personal and financial information from students, faculty, and staff, he added.

“And hacktivists could deface and disrupt university websites as a method of protest or way to call attention to a certain cause,” Monrad concluded.

Universities conducting research with a “potentially high economic pay-off” or those supporting sensitive government contracts are most at risk from APT groups, he added.

So what kind of malware have these institutions been facing?

Publicly available remote access tool (RAT), LV /NjRat, for one. This little nasty is capable of keystroke logging, credential harvesting, reverse shell access, file uploads and downloads, and file and registry modifications, Monrad explained.

“This RAT also offers threat actors a ‘builder’ feature, allowing them to create new variants based on configurations of command and control servers, specified filenames, options to spread via USB, designated campaign names for internal tracking, and other customisation options,” he added.

“Additionally, this RAT gathers and sends important information about infected machines to its command and control server, possibly using a custom protocol over port 80, to include NetBIOS name, user, date, locale, and Windows OS name.”

FireEye has seen cases where individual students were targeted, with the attacker taking screen captures when they opened specific documents.

Educational institutions have also been targeted with StickyFingers, aka QUICKBALL. This is a DLL backdoor favoured by Chinese APT attackers to gain reverse shell access to targeted systems.

With the caveat that this is only information gleaned from one security vendor’s customers, there still seems to be plenty for infosecurity bosses at the UK’s universities and colleges to mull over.

Security Experts Find Fault with Google OnHub

Google’s new OnHub Wi-Fi router promises to shake up the staid home and SOHO router market, but experts I spoke to for Infosecurity Magazine were divided over whether it will be more secure.

The radical new coffee cup (or pint glass if you’re me) design crams in 13 antennas and has been praised for offering not only a more svelte appearance but faster wireless speeds in the house.

But the most talked-about features from a usability and security point of view are the fact it is managed entirely from the Google On app, with security updates automatically delivered over the air.

In fact, the device won’t work unless it’s running the latest version.

On the face of it, this is a massive improvement on the traditional router experience, where the user would have to switch it off and on again, and if the colour of the blinking lights on the front still haven’t changed, put in a helpdesk call.

There have also been several research reports already this year pointing to major flaws in popular home routers, which are usually ignored for months by the vendors. And when patches do become available it’s unlikely a home or SOHO/SMB user would have the time, inclination or skill to apply them.

That’s why automatic updates seem like a good idea, according to MWR InfoSecurity security consultant, Guillermo Lafuente.

“The security of products is often undermined when they rely upon end users to perform actions such as installing updates,” he told me by email.

“Most end users stop caring about the management of their products once they have finished setting them up. When talking about a router the most likely scenario is that they will plug it in, switch it on, and remember that it exists only when their Internet is not working.”

However, the ability to manage the device from an app may also expose it to greater risk, Alert Logic chief security evangelist, Stephen Coty, explained.

“This also gives the potential attacker, who is comprising the mobile device or update server, the ability to gain access into the network through pushed updates or mobile configuration updates,” he told me.

“This will allow them to open up ports or services in which they can gain access to the network. This is a pattern which we see a lot with the conveniences that Internet of Things devices introduce in our day to day lives. It’s convenient to make our lives easier, but if compromised could lead to data leakage.”

For Imperva CTO, Amichai Shulman, automatic updates don’t necessarily make a device any more secure, although they “might be a good thing for home users.”

“I think that most problems with home routers (as well as most vulnerable business routers) has to do with bad configuration, back door accounts and weak passwords,” he argued by email.

To lock down risk, users should choose strong passwords and ensure the management interface is only accessible from the internal network, he added.

“I think that the biggest advantage of this new offering (which I deeply regard as an end user) is simplicity,” Shulman concluded.

“An average home today is becoming a complex networking environment with mobile devices, smart TVs, media streaming and what not. I do believe that vendors who solve the ease-of-deployment and ease-of-maintenance problem for home users are going to rule this market.”