4 min read
Silent hacker attacks and the need for detection mechanisms
DriveLock May 26, 2020 2:00:00 AM
Summary
- Silent Hacker Attacks: Unlike more obvious attacks like ransomware, silent hacker attacks aim to remain unnoticed for long periods. These attacks focus on gathering valuable information, conducting industrial espionage, or preparing for a larger attack without immediately disrupting systems.
- Common Types of Silent Attacks: Various attack methods, including Denial-of-Service (DoS), password hacking, DNS spoofing, and Trojan horses, are utilized to compromise systems. These attacks often exploit vulnerabilities in web applications or rely on deceptive tactics like URL interpretation or drive-by attacks.
- Living-off-the-Land (LotL) Attacks: This sophisticated method uses tools and resources already present in an IT environment, bypassing traditional security measures like antivirus software. These attacks are challenging to detect because they utilize legitimate programs, making identification and attribution difficult.
- Importance of Behavior Analysis: Detecting silent hacker attacks requires constant monitoring of endpoints and analyzing system events for unusual behavior. This helps identify potential intrusions, misbehaving employees, or security gaps that traditional cybersecurity tools might miss.
- Endpoint Detection and Response (EDR) Solutions: EDR platforms are essential for modern cybersecurity, offering features like real-time detection, incident investigation, containment, and recovery options. They also provide predictions about potential breaches, improving system defense through continuous monitoring and adaptive responses.
Again and again, we read about hacking incidents where attackers can spy on a company, an authority or a ministry and remain unnoticed for months without affecting the systems. In this blog post we are explaining what a silent hacker attack is and how you can prevent it!
TABLE OF CONTENT |
Imagine the following scenario: A company has been infiltrated but knows nothing about it. Sensitive data flows into the hands of cybercriminals; either intellectual property (industrial espionage) or personal data used for criminal activities such as credit card fraud through identity theft. If the infiltration is noticed and becomes public, it is already too late for the company concerned. the costs of rescuing the systems and eliminating the defects are performed by data protection law penalties and the reputation damage of the company's image toward their customers, suppliers and other business partners.
A. Silent hacker attacks: why do they take place undercover?
- Targets of the cyberattacks are e.g. the targeted spying for a later attack,
- the collection of valuable information (e.g. for later sale) or
- (industrial) espionage.
So we are not dealing with quick and obvious blackmail by data encryption or a compromise of the systems, which means an immediate loss of work and data. At least not yet.
B. How do you recognise the intruder during silent hacker attack?
Let's take a step back. Did the controls fail before?
Experts largely agree that despite protective measures such as firewalls, anti-virus protection, application or interface controls, 100% protection is not possible against silent hacker attack. Malware and attack methods are simply evolving rapidly and people are falling into (increasingly sophisticated) traps.
C. 9 Common types of silent hacker attack
- DoS and DDoS attacks – they are known as denial-of-service (DoS) and distributed denial-of-service. They are design to overcome resources of the system to drain them until it is unable to reply to a legitimate service request.
- Password hacker attacks – this type of hacker attack is based on either by intercepting network transition or by simply guessing target’s password.
- URL Interpretation – is altering and fabricating URLs in order of getting an access to site’s backend.
- DNS Spoofing – is known as a Domain Name System Spoofing which is based on altering its records and sending traffic to a fake website.
- Web attacks – this sort of attack is referred to the threads that target vulnerabilities in web-based applications.
- Trojan horses’ attacks – they are one of the most known hackers attacks types. Trojan horse attack is based on adding a malicious, hidden program into superficially good-looking one. It took its name from Greek attack into Troy.
- Drive-by attacks – in this type, an attacker adds malicious code into an insecure website. While users are visiting the page, implemented code immediately infects computer.
- Eavesdropping hacker attacks – they are based on the inserting a piece of hacker’s software into the network traffic path to get your data so attacker can ‘eardrop’ your actions.
- Birthday attacks – in this type of attack, hacker tries to abuse hash algorithms (known as your digital signatures) which are the ones verifying the message’s authenticity.
D. Silent hacker attacks: Living-off-the-Land-Attacks
Furthermore, not all silent hacker attacks are carried out by explicit malware. So-called Living-off-the-Land (LotL) methods largely make use of what is already present in the environment. There is no need to develop malicious files from scratch. Rather, they exploit entry points that already exist in IT systems.
This tactic can achieve several things: First, they often bypass traditional protection systems - virus scanners do not raise an alarm when software appears to be secure. In this way, they allow cybercriminals to infiltrate IT systems unobtrusively and thus often unnoticed. Even if an infiltration case is detected, under these circumstances it is much more difficult to identify where the attack comes from. Many traditional cyber security solutions are not able to detect dangerous behaviour when performed with tools that are considered legitimate.
E. How can you track silent hacker attacks?
The analysis of behaviour and the search for abnormalities are particularly relevant in this context. Endpoints (end devices such as PCs, laptops, mobile devices) must be continuously monitored.
Events on the end devices and in the system should be analysed to identify traces of hackers, determine employee misconduct and detect security gaps.
With the help of definable rules, security managers should be able to set up which events can be reacted to with which behaviour, e.g. by defensive behaviour such as shutting down processes. This relieves the burden on IT departments, which are often deployed on many fronts.
Find out more on EDR Security Platform in our blog post!
F. What are the features of an EDR solution?
- Detection and containment security incidents, not just file-based malware.
- Security incident investigation and threat detection.
- Provision of response options for recovery after a security incident.
- Prediction of potential security breaches, e.g. the current security status of an endpoint is displayed and advice is given on how to avoid threats.
From Myth to Malware: The Evolution of Trojan Horse Viruses
In the vast landscape of cybersecurity threats, few adversaries have proven as cunning and adaptable as the Trojan horse virus. Like its namesake...
EDR - the Sherlock Holmes of cyber security
In our last blog post " Silent hacker attacks and the need for detection mechanisms" we talked about covert cyber attacks and the need for...