Enterprises across transportation, communications and energy experience a five-time increase in targeted attacks in 2014
Symantec’s Internet Security Threat Report (ISTR), Volume 20 exposes a tactical shift by cyberattackers: They are infiltrating networks and evading detection by hijacking the infrastructure of major corporations and using it against them.
“Attackers don’t need to break down the door to a company’s network when the keys are readily available,” said Tarun Kaura, Director – Technology Sales, India, Symantec. “We’re seeing attackers trick companies into infecting themselves by Trojanizing software updates to common programs and patiently waiting for their targets to download them—giving attackers unfettered access to the corporate network.”
Attackers Succeed With Speed and Precision
In a record-setting year for zero-day vulnerabilities, Symantec research reveals that it took software companies an average of 59 days to create and roll out patches—up from only four days in 2013. Attackers took advantage of the delay and, in the case of Heartbleed, leapt to exploit the vulnerability within four hours. There were 24 total zero-day vulnerabilities discovered in 2014, leaving an open playing field for attackers to exploit known security gaps before they were patched.
Globally, advanced attackers continued to breach networks with highly-targeted spear-phishing attacks, which increased a total of eight percent in 2014. What makes last year particularly interesting is the precision of these attacks which used 20 percent fewer emails to successfully reach their targets and incorporated more drive-by malware downloads and other web-based exploits.
Additionally, Symantec observed attackers:
Using stolen email accounts from one corporate victim to spear-phish other victims higher up the food chain
Taking advantage of companies’ management tools and procedures to move stolen IP around the corporate network before exfiltration
Building custom attack software inside the network of their victims to further disguise their activities
Key India Highlights
In 2014, India launched the ambitious Digital India initiative and development of Smart Cities, increasing the use of technology in all walks of life. On the sidelines of this digitization, cybercriminals were unrelenting in their efforts, attacking big and small targets alike. Although India continued to rank 3rd and experienced a slight dip in the overall percentage of global detections for malicious activity, the cybercriminals continue to persist and evolve:
Businesses Dealing With Critical Infrastructure On The Cybercriminals’ Radar
Symantec saw an increase in the number of attacks on key sectors such as financial services (17.1 percent; up from 11.1 percent in 2013), transportation and communications (4.4 percent; up from .8 percent in 2013). Of these, the transportation, communications, electricity and gas industry saw a five time increase in the targeted attacks. Additionally, sectors like mining, which includes oil and gas exploration, were preferred by attackers of all types as they received the highest number of phishing mails and second highest number of virus-bearing emails in 2014.
Bots Infections Concentrated In Metros
Last year, India moved up five places to become the 16th most bot infected country worldwide. However, despite higher security awareness; the Indian metros reported close to 65 percent of infections across cities like Mumbai, Bangalore, Cochin, Hyderabad, Pune and Delhi. Countries that have a high number of bot infected machines are often a source for Distributed Denial of Service (DDoS) attacks that attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. Symantec reported in a recent whitepaper that India was the top source globally for ‘originating DDoS traffic.’
Small Businesses, Big Opportunities for Cybercriminals
Small businesses often have fewer resources to invest in security, and many are still not adopting simple and basic best practices such as blocking executable files and screensaver email attachments. This opens up big avenues for cybercriminals, and puts businesses and their partners at higher risk. Small businesses were the target of a third (34 percent) of all targeted attacks in 2014. These businesses also received twice as many phishing and virus-bearing mails compared to large corporations.
Digital Extortion On The Rise
Email remains a significant attack vector for cybercriminals, but they continue to experiment with new attack methods across mobile devices and social networks to reach more people, with less effort. India’s growing social media population proved to be a ready base for cybercriminals last year, making it the second most targeted country in the world for social media scams.
“Cybercriminals are inherently lazy; they prefer automated tools and the help of unwitting consumers to do their dirty work,” added Tarun Kaura, Director, Technology Sales at Symantec, India. “Last year, India had the second highest number of social media scams globally. Over 80 percent of these scams were shared manually, as attackers took advantage of people’s willingness to trust content shared by their friends.”
While social media scams can provide cybercriminals with quick cash, some rely on lucrative and aggressive attack methods like ransomware. Ransomware rose globally by 113 percent last year. India reported the third highest ransomware in Asia, with an average of more than seven attacks every hour. Instead of pretending to be law enforcement seeking a fine for stolen content, as we have seen with traditional ransomware, the more vicious crypto-ransomware attack style holds a victim’s files, photos and other digital content hostage without masking the attacker’s intention. In India, a staggering 86 percent of all ransomware were crypto-ransomware – posing a threat to consumers and enterprises alike.
Secure It, Don’t Lose It!
There are many steps businesses and consumers can take to protect themselves. As a starting point, Symantec recommends the following best practices:
For Businesses:
Don’t get caught flat-footed: Use advanced threat intelligence solutions to help you find indicators of compromise and respond faster to incidents.
Employ a strong security posture: Implement multi-layered endpoint security, network security, encryption, strong authentication and reputation-based technologies. Partner with a managed security service provider to extend your IT team.
Prepare for the worst: Incident management ensures your security framework is optimized, measureable and repeatable, and that lessons learned improve your security posture. Consider adding a retainer with a third-party expert to help manage crises.
Provide ongoing education and training: Establish guidelines and company policies and procedures for protecting sensitive data on personal and corporate devices. Regularly assess internal investigation teams—and run practice drills—to ensure you have the skills necessary to combat cyber threats.
