10 ways to prevent breaches and minimise impact

Attackers are increasingly able to avoid detection by adapting their techniques to the tools security defenders are using, according to Jibran Ilyas, vice-president of cyber resilience at Stroz Friedberg.

A classic example of this is that attackers are relying less on malware and using administrative tools built into operating systems such as Microsoft Windows instead, he told the Palo Alto Networks Ignite ‘17  conference in Vancouver, Canada.

“Attackers are using tools like PowerShell to launch attacks rather than malware, and as a result they are going undetected because no security technology is going to block a legitimate administration tool.”

Similarly, fewer attackers are using round the clock communications with their command and control servers to avoid detection by security tools that monitor for such communications.

“Because attackers are finding it relatively easy to get into networks, they are going in, moving laterally, finding the data they are interested in, exfiltrating it and then shutting down operations without using any malware at all,” said Ilyas.

Attackers are also developing anti-forensics techniques, he said, by determining what artefacts such tools are using and then either avoiding using them or ensuring that they wipe then as part of the attack.

Increasingly common ways of getting into organisations, says Ilyas, include carrying out phishing attacks through compromised email accounts of the friend, partners, clients and colleagues of their target person and through subscribed mailing lists that tend to be trusted by recipients.

Stroz Friedberg is also seeing the use of publicly available information from a variety of sources to be able to reset account passwords to take control or to create subdomains of legitimate organisations to trick people into sharing their usernames and passwords.

“This is why it is becoming critical to use at least two-factor authentication to stop attackers from accessing accounts to send phishing emails or to hack domain registrars to manipulate subdomains,” said Ilyas.

Cyber defenders should also be aware that attackers are increasingly breaching branch or overseas office networks so they can use various techniques to hop over to the main network and exploiting undisclosed vulnerabilities in publicly available portals, such as password reset portals.

Stroz Friedberg is seeing attackers using a webshell on web servers to issue commands, using tools such as Mimikatz and Mimikittenz to extract passwords from computer memory, using task scheduler to execute commands, using tunnelling tools such as Tunna Webshell on a compromised webserver to hop around networks, and using signed binaries to run malicious code in dynamic link libraries (DLLs).