Author Archives: Kenneth Geers

About Kenneth Geers

Kenneth Geers (PhD, CISSP) is a Senior Global Threat Analyst at FireEye. Dr. Geers spent twenty years in the U.S. Government, with lengthy tours at NSA, NCIS, and NATO. Kenneth was the first U.S. Representative to the NATO Cooperative Cyber Defence Centre of Excellence in Estonia and is the author of "Strategic Cyber Security", Editor of "The Virtual Battlefield: Perspectives on Cyber Warfare", Technical Expert for the "Tallinn Manual on the International Law Applicable to Cyber Warfare", and author of more than twenty articles and chapters on cyber conflict. Follow him on Twitter @KennethGeers.

Strategic Analysis: As Russia-Ukraine Conflict Continues, Malware Activity Rises

| By | Threat Intelligence, Threat Research |
Comments
0

Cyber conflicts are a reflection of traditional, “real life” human conflicts. And the more serious the conflict in the “real world,” the more conspicuous its cyber shadow is likely to be. So let’s look at a serious, current international conflict – the one between Russia and Ukraine – to see if we can find its reflection in cyberspace.

One of the most reliable ways to discover computer network operations is to look for malware “callbacks” – the communications initiated from compromised computers to an attacker’s first-stage command-and-control (C2) server. At FireEye, we detect and analyze millions of such callbacks every year.

Table 1, below, shows the top 20 countries to receive first-stage malware callbacks over the last 16 months, according to the latest FireEye data.

ru1

Table 1 – Callback Infrastructure: the Last 16 Months

As we track the evolution of callbacks during this period, we see a likely correlation between the overall number of callbacks both to Russia and to Ukraine, and the intensification of the crisis between the two nations. The two key indicators we see are:

  • In 2013, Russia was, on average, #7 on this list; in 2014, its average rank is #5.
  • In 2013, Ukraine was, on average, #12 on this list; in 2014, its average rank is #9.

The biggest single monthly jump occurred in March 2014, when Russia moved from #7 to #3. In that same month, the following events also took place in Russia and Ukraine:

  • Russia’s parliament authorized the use of military force in Ukraine;
  • Vladimir Putin signed a bill incorporating the Crimean peninsula into the Russian Federation;
  • The U.S. and EU imposed travel bans and asset freezes on some senior Russian officials;
  • Russian military forces massed along the Ukrainian border; and
  • Russian energy giant Gazprom threatened to cut off Ukraine’s supply of gas.

The graphs below provide a closer look at the crucial month of March 2014, specifically comparing it to malware callback data from February.

Figure 1 shows a significant rise in malware callbacks to Russia from three of the top four source countries in February: Canada, South Korea, and the U.S. (Great Britain had a slight decline).

ru2

Figure 1 – Callbacks to Russia in Feb/Mar 2014: Top Four Countries

Figure 2 depicts the same, general rise in callbacks to Russia from many other countries around the world.

ru3

Figure 2 – Callbacks to Russia in Feb/Mar 2014: Rest of World

Figure 3 shows that the sharp rise in callbacks to Russia in March 2014 was seen in every FireEye industry vertical.

ru4

Figure 3 – Callbacks to Russia in Feb/Mar 2014: Industry Verticals

Tables 2 and 3, below, compare the rise in callbacks to Russia and Ukraine against the rise in callbacks to other countries for February and March 2014. It is important to note that nearly half of the world’s countries experienced a decrease in callbacks during this same time frame.

Table 2 shows the countries that received the highest increase, from February to March 2014, in the number of source countries sending callbacks to them. Ukraine and Russia both placed in the top ten countries worldwide, with Ukraine jumping from 29 source countries to 39, and Russia moving from 45 to 53.

ru5

Table 2 – Callbacks in 2014: Number of Source Countries

Table 3 shows the increase in the number of malware signatures associated with the callbacks to each country for February and March 2014. Ukraine does not appear in the top ten (it tied for #15), but Russia was #4 on this list (again, nearly half of the world’s countries showed no increase or a decrease).

ru6

Table 3 – Callbacks in 2014: Number of Malware Signatures

It is not my intention here to suggest that Russia and/or Ukraine are the sole threat actors within this data set. I also do not want to speculate too much on the precise motives of the attackers behind all of these callbacks. Within such a large volume of malware activity, there are likely to be lone hackers, “patriotic hackers,” cyber criminals, Russian and Ukrainian government operations, and cyber operations initiated by other nations.

What I want to convey in this blog is that generic, high-level traffic analysis – for which it is not always necessary to know the exact content or the original source of individual communications – might be used to draw a link between large-scale malware activity and important geopolitical events. In other words, the rise in callbacks to Russia and Ukraine (or to any other country or region of the world) during high levels of geopolitical tension suggests strongly that computer network operations are being used as one way to gain competitive advantage in the conflict.

In the near future, we will apply this methodology to other global occurrences to further identify patterns that could provide valuable advanced threat protection insights.

Cybercriminals Continue to Target Retail Sector

| By | Advanced Threat Trends, Security News, Targeted Attack, Threat Intelligence

A series of spectacular cyber attacks have breached big-name retail stores in recent months, including Target, Nieman Marcus, and Michaels. These incidents are the only latest in what has become an alarming trend.

In 2013, for example, the U.S. Department of Justice (DoJ) profiled a financial hacking scheme in which four Russians and one Ukrainian penetrated the computer networks of retail organizations. This series of attacks yielded more than 160 million credit card numbers — and cost corporations and consumers hundreds of millions of dollars. The cybercriminals sold the credit card data (which was stored on computers scattered around the globe) and sold it via hacker forums. They charged $10 for American cards and $50 for European cards.

The FireEye Dynamic Threat Intelligence™ team can confirm that the retail sector faces an increased risk from actors using point-of-sale (POS) malware to steal customer credit card data. Ongoing attacks against our retail clients align closely with the DoJ revelations and recent headlines. FireEye is actively tracking one financial threat group that we believe is associated with Russian and Ukrainian attackers.

Continue reading »

The 2013 FireEye Advanced Threat Report!

| By | Advanced Malware, Threat Research

FireEye has just released its 2013 Advanced Threat Report (ATR), which provides a high-level overview of the computer network attacks that FireEye discovered last year.

In this ATR, we focused almost exclusively on a small, but very important subset of our overall data analysis – the advanced persistent threat (APT).

APTs, due to their organizational structure, mission focus, and likely some level of nation-state support, often pose a more serious danger to enterprises than a lone hacker or hacker group ever could.

Over the long term, APTs are capable of cyber attacks that can rise to a strategic level, including widespread intellectual property theft, espionage, and attacks on national critical infrastructures.

The data contained in this report is gleaned from the FireEye Dynamic Threat Intelligence (DTI) cloud, and is based on attack metrics shared by FireEye customers around the world.

Its insight is derived from:

  • 39,504 cyber security incidents
  • 17,995 malware infections
  • 4,192 APT incidents
  • 22 million command and control (CnC) communications
  • 159 APT-associated malware families
  • CnC infrastructure in 206 countries and territories Continue reading »

Targeted Attacks in 2013: Asia Pacific

| By and | Advanced Malware, Advanced Threat Trends, Targeted Attack, Threat Intelligence

Here at FireEye, the New Year gives us an opportunity to look back at 2013 and analyze what happened in cyber security from a high-level and strategic perspective.

Let’s start with Asia. Cyber attacks against government websites in Southeast Asia and Australia made the front-page news, reminding security professionals that cyber threats are both a global and a regional issue.

While attention-seeking hackers are trying to attract as much press as possible, organized and resourceful cyber criminals and nation-state threat actors are capable of more advanced – and stealthy – attacks. Motivated by economic and political aims, some of the most advanced cyber attacks are designed to steal information (or, like Stuxnet, sabotage critical infrastructure) and evade detection. Therefore, this class of attacks can often go unnoticed for long periods of time. Continue reading »

Hacking a Revolution

| By | Threat Research

Ukraine-protest
Ukrainian protesters. (Credit: Ryan Anderson. Used under Creative Commons CC-BY-SA-3.0 license.)

In April 2005, General Boris Miroshnikov, head of the Russian police’s cybercrime division (Department К for “Кибер” or “Cyber”), announced that Russian hackers were the “best in the world.”  At DEF CON 13 that year, I explained how Soviet scientists had honed their reverse engineering skills on Western products for decades during the Cold War. More recently, Western reporting such as Tom Kellermann’s “Peter the Great versus Sun Tzu” and FireEye’s “World War C” suggests that Eastern European hackers are still more advanced and stealthy than their peers around the world. Ukraine was even called the world’s newest “haven for hackers.”

So, given the current political crisis in Ukraine, it seems like a good time to ask, what role is there for computer hackers in political revolutions? And could computer hacking play a decisive role in this would-be revolution? If we assume that there are two basic antagonists in this struggle – the government and the protesters – which side benefits the most from the existence of a strong hacker culture?

Continue reading »

New FireEye Report: World War C

| By | Threat Intelligence

National security decision makers need to know – is cyber war fact or fiction? When the theater of operations is invisible, hype may be our single greatest enemy.

Cyber war skeptics raise valid points, such as the current known number of human casualties caused by cyber attacks: zero. But … that’s not the end of the story, because we are only at the beginning of the Internet era.

It is true that computer hacking is a technical discipline, not a death ray. But as such, computer hacking is best understood not as an end in itself, but a potentially powerful means to a wide variety of political, military, and economic goals. Continue reading »

Syria 1982, Syria 2013: A Tale of Two Revolutions

| By | Uncategorized

Today, as international intervention in the Syrian conflict is fast approaching, the phenomenon of the world’s “patriotic hackers” (see Chechnya, Kosovo, Estonia, Georgia, etc.) continues to grow, with the pro-government “Syrian Electronic Army” believed responsible for attacks on Twitter and the New York Times.

The Internet has changed everything, including our geopolitical “battlespace.” In 1982, during a previous Syrian uprising in the city of Hama, the government obliterated parts of the city with artillery fire and killed “many thousands” of civilians. But because the government had “cut all telephone and road communication with the city” (according to renowned Syria expert Robert Fisk) it was many weeks before the extent of the atrocity was discovered. I visited Hama in 1988, and the entire story was recounted to me by a complete stranger as we strolled past countless buildings strewn with bullet holes. Continue reading »

Syrian Electronic Army Hacks Major Communications Websites

| By and | Exploits, Targeted Attack, Threat Intelligence, Vulnerabilities

Syrian Electronic Army (SEA) has recently compromised three widely-used online communications websites, each of which could have serious real-world consequences for Syria’s political opposition.

  • July 16: SEA hacked the Swedish site Truecaller, home to the world’s largest online telephone directory, with over a billion phone numbers in over 100 countries. SEA claimed this attack also gave it access codes to more than a million Facebook, Twitter, LinkedIn, and Gmail accounts. The initial attack vector was an older, vulnerable version of WordPress.
  • July 21: SEA hacked the video and text messaging service Tango, stealing more than 1.5 TB of data, including user information, true names, phone numbers, emails, and personal contacts for millions of accounts. Again, the attack vector was a vulnerable version of WordPress CMS (v 3.2.1), which gave SEA unauthorized access to the database server.
  • July 24: SEA hacked Viber, a free online calling and messaging application used by more than 200 million users in 193 countries. Viber acknowledged the attack, explaining that the initial compromise vector was an email phishing scam which enabled SEA to access two customer support sites. Thus far, the company has denied that private user information was lost.

Continue reading »