Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security

You Have Around 20 Minutes To Contain a Russian APT Attack (zdnet.com) 123

Posted by msmash from the small-window dept.
When a Russian nation-state actor attacks a government or a private organization, they have about 20 minutes to detect and contain the attack. From a report: New statistics published today by US cyber-security firm Crowdstrike ranked threat groups based on their "breakout time." "Breakout time" refers to the time a hacker group takes from gaining initial access to a victim's computer to moving laterally through its network. This includes the time the attacker spends scanning the local network and deploying exploits in order to escalate his access to other nearby computers.

[...] According to data gathered from 2018 hack investigations, CrowdStrike says Russian hackers (which the company calls internally "Bears") have been the most prolific and efficient hacker groups last year, with an average breakout time of 18 minutes and 49 seconds.
This discussion has been archived. No new comments can be posted.

You Have Around 20 Minutes To Contain a Russian APT Attack More

You Have Around 20 Minutes To Contain a Russian APT Attack

Comments Filter:

  • 20 minutes? (Score:3)

    by 110010001000 ( 697113 ) on Tuesday February 19, 2019 @11:25AM (#58145136) Homepage Journal
    With enough vodka I do it in 10.

  • 'APT' attack? (Score:3, Interesting)

    by Necron69 ( 35644 ) <jscott...farrow@@@gmail...com> on Tuesday February 19, 2019 @11:35AM (#58145200)

    I admit I had to Google that one. Stupid article doesn't explain the name at all, and here I was thinking we had some big new Debian/Ubuntu vulnerability.

    - Necron69

    • Re:'APT' attack? (Score:4, Interesting)

      by aaarrrgggh ( 9205 ) on Tuesday February 19, 2019 @11:44AM (#58145252)

      While it didn’t register, I was able to come up with Advanced Persistant Threat on my own given the summary.

    • Arrogant President Trump (Score:1)

      by Anonymous Coward

      Will mock handicapped reporters and tweet insults that make you feel sick

  • Honeypots (Score:5, Insightful)

    by goombah99 ( 560566 ) on Tuesday February 19, 2019 @11:46AM (#58145268)

    I've wondered for some time why Honeypots are not a near-universal solution to this. That is, each router can host a bunch of fake servers with real IP addresses on the network then watch for intrusion attempted or real on these fake nodes. You don' t need a lot of horsepower backing the fake nodes since they are not doing anything except mimicking a normal level of net traffic to other computers so it's not a burden on the system or the routers. And if one was worried the hackers could eventually learn to spot these virtual nodes in the routers (perhapsvia hacking the router itself), then one could also sprinkle in a few real computers on the network acting as honey pots.

    In any event, any attempt to break in or a successful one on a honey pot, is 100% evidence the network is experiencing lateral intrusions and you just shut it down immediately.

    What's the catch?

    • What's the catch?

      Headlines, drama, intrigue, excitement! We need these stories to keep our eyes on the prize.

    • Re: (Score:2)

      by Shaitan ( 22585 )

      "What's the catch?"

      Time, effort, resources. This is all very very expensive in all three areas since devs are being used as part-time admins it only gets worse.

    • Re: (Score:3)

      by N1AK ( 864906 )
      I can't help but think there will be some obvious answer, but for once this is a suggestion on Slashdot that does seem to make quite a lot of sense. You can put a lot of security in place, but a lot of the escalated response steps are often manual. If my firewall IPS detects something it can stop that traffic, but a larger response would need to be triggered by an employee and we don't have a24/7 IT Ops desk so it could be 10+ hours between the first IPS and someone acting. If you're typical attack happens

    • Re:Honeypots (Score:5, Insightful)

      by jbmartin6 ( 1232050 ) on Tuesday February 19, 2019 @12:35PM (#58145634)
      It's not quite so simple. From what I've seen in pen tests and attacks, fake network nodes are not effective. Attackers aren't blindly flailing around breaking into whatever host they find. They are following various bits of information which they find on each link in the chain. Either by examining domain structures, local documents on a workstations, and the like. At least you would have to add your honeypots to AD or other information sources so attackers would find them, then tune out all the noise from legitimate tools and processes which try to access your honeypots for network inventory, vulnerability scans, host management, etc. Deception as a defense strategy is not a bad idea, it just takes some thought to put it where attackers are likely to find it but legitimate process or curious users don't stumble across it. Meanwhile, AD and system admins are cautious about injecting anomalous data into their babies.

      Some folks are using virtual infrastructure to place fake workstations around, so that attackers in the early 'get any Windows credential hash and see where it leads' can trip across them and set off alarms. This is aimed at tools like Responder and the like which try to get other nodes to send them an authentication exchange. One thing that should exist, and AFAIK does not, is a way to add well disguised fake credentials to the local Windows system, since that is usually the first place an attacker will look once they gain their foothold. Their are commercial tools which will do this, for a price, but no reliable way to make a convincing decoy on the cheap.

    • The catch is that you need manpower to actually have someone look at the honeypots, declare there is an attack in progress, and start disconnecting stuff. However, in most IT environments, not many employees will actually do so unless they have 100% evidence to do so, for fear they will be fired for crying wolf. In fact, IT people may get fired regardless of catching the attack in progress because "it happened on their watch."

      For a small startup with C-level people, this would work and even provide some e

  • They have a few years actually building secure infrastructure instead of the insecure crap most have in place. If you are not prepared, even advanced script-kiddies can get in.

  • Once you've been breached you're at least 2-3 years too late to contain the issue. These "nation states" hackers typically aren't the best in the field. They get in through inept security IT people above all else.

    These companies have something to sell you - containment is a poor security strategy but sadly most companies won't invest until something happens so containment is their only strategy.

    • Once you've been breached you're at least 2-3 years too late to contain the issue. These "nation states" hackers typically aren't the best in the field. They get in through inept security IT people above all else.

      Seems to me then that they are exploiting the biggest un-patched vulnerability in the system. That is not a sign of lacking skill, it is a sign of intelligence. You don't launch a frontal assault on the city walls thorough a hailstorm of arrows and cannon balls when you can sneak in through the sewers and surprise the defenders. What the Russians have done is send their intelligence services after best criminal hackers and confront them with a choice, either they drop everything and go to work for the intel

    • Re: (Score:2)

      by mlyle ( 148697 )

      Oh, come on. The personnel may be uneven, but nation states both have very, very nasty toolkits to assist spread, concealment, and information extraction... and they buy zero-days.

      An initial foothold on the network can only be prevented by A) inability to be exploited by undisclosed exploits and B) perfect end-user practices to not inadvertently cooperate with attackers. Otherwise, we're in the scenario described above.

  • Well, Crowdstrike sells endpoint detection and response software, so the claim has to be taken with a grain of salt. But the real problem lies here:

    "Breakout time" refers to the time a hacker group takes from gaining initial access to a victim's computer to moving laterally through its network...The "breakout" metric is crucial for organizations, as this is the time they have to detect infections and isolate hacked computers before a simple intrusion turns into a compromise of its entire network.

    Getting lateral movement is just one of the early steps in the chain, not the game over moment. Nor does it mean 'the entire network' is compromised. Attacker still has to locate what they need on the network and then get access to it, and then exfiltrate it (for stealing data) or break it. In other words, you still have a lot more than 20 minutes to detect and

  • Let's make this about me, OK? (Score:4, Interesting)

    by CaptainDork ( 3678879 ) on Tuesday February 19, 2019 @12:47PM (#58145726)

    Mobil Oil, ca. 1986. We had a fractional T1 connecting Beaumont, Dallas and Reston, Va.

    I was senior network engineer in Beaumont. Got a call from Dallas that a hacker* was crawling all over the place.

    I pulled the Ethernet cable on my Cisco router while I was on the phone.

    Reston started calling, freaking out. It never occurred to the other blokes that bad guys ride wires.

    *The hacker was actually a Joe Cool Kollidge Kid working for us who hooked Mobil to Lamar University in Beaumont to his home computer.

    Ah, the learning days. I miss those.

  • Comment removed based on user account deletion
  • Assuming you know **it about it.

  • US, China Internet attack legitimize Russian APT. (Score:3)

    by dweller_below ( 136040 ) on Tuesday February 19, 2019 @02:08PM (#58146334)

    The US has been attacking multiple countries via the Internet for years. We did it first. We did it best. Yay US. Years ago, our doctrine was that Internet attack was a favorable option, because it had less unfortunate consequences than physical attack. But now, Internet can be much more devastating that physical attack. And the US has the most to lose in Internet attack.

    The US economy is totally dependent on the Internet. Internet attack can cripple or destroy us. We can no longer afford to legitimize Internet attack. The past aggressive internet attacks by the US, China and Russia have legitimized Internet attack for all the remaining governments. EVERYBODY who has anything valuable, now gets a chance to receive targetted, remote attack by several governments, PLUS targetted attack by the many organized crime groups.

    The US must formally cease undeclared war via the Internet. We must work with all other governments to ensure that we ALL stop waging undeclared war via the Internet.

    • Re: (Score:2)

      by _merlin ( 160982 )

      Nice sentiment, but the cat's out of the bag and you can't put the genie back in the bottle. Welcome to the brave new world where you have to assume anything connected to the Internet will be attacked, whether it's by your own government, another government, a competing business, a black hat, or kids doing it for the lulz. Yeah, I miss the old, friendly Internet as much as anyone, where we could run recursing DNS servers, open mail relays, TCP small services, and unencrypted web servers. But it hasn't ex

Slashdot Top Deals

Math is like love -- a simple idea but it can get complicated. -- R. Drabek

Close