Most businesses are defenseless against the types of attacks that recently hit Google and at least 33 other companies, according to a report to be published Monday that estimates the actual number of targeted companies could top 100.
The attackers behind the cyber assault dubbed Aurora patiently stalked their hand-chosen victims over a matter of months in a campaign to identify specific end users and applications that could be targeted to gain entry to corporate networks, the report, prepared by security firm iSec Partners, concluded. Emails or instant messages that appeared to come from friends and trusted colleagues were combined with potent zero-day vulnerabilities targeting common applications. In many cases, exploits were tweaked to circumvent specific versions of anti-virus programs.
The findings are significant because they suggest that many of the best practices corporate IT departments have been following for years are ineffective against the attacks, which Google said were successful at piercing its defenses and accessing its trade secrets. iSec founding partner Alex Stamos said that with the exception of Google and a handful of other organizations with budgets to support expensive information security teams, companies are unprepared to defend themselves against this new caliber of attacks.
"Attackers are willing to spend months attacking people in these companies, and they write custom malware specific to those companies," he told The Register. "The malware for each of these companies has been customized based on the versions of vulnerable software they're running, as well as what kind of anti-virus they're using. The problem is to defend against that level of attacker - the game is completely different than what most companies are doing."
In the days immediately following Google's January admission, investigators said as many as 33 other companies were hit by the same attacks. But according to Stamos, that estimate was based on the analysis of just one command and control channel under the control of the attackers. After sifting through the contents of another 60 or so additional channels, Stamos said the number of compromised companies could be as high as 100, many with woefully unprepared IT departments.
The attackers showed painstaking perseverance in gathering information about vulnerable end users, often casing social networks to learn the identities of friends and business associates so instant messages and emails with poisoned links will appear more innocuous. They also employed an encyclopedic knowledge of corporate networking weaknesses that allowed them to convert a compromise of a single computer into a vector that would surrender unfettered access to a company's most valuable crown jewels.
"These guys really understand how to take control of one laptop and turn it into domain admin access," Stamos explained. "People are not well prepared for this kind of stuff."
For companies to reverse the tide, they will have to make fundamental changes to the way they think about and manage security inside their network perimeters. Chief among the changes is disabling all services that despite repeated warnings often remain on, such as LAN Manager Hash. Other recommendations include logging and inspecting all queries made to internal domain name system servers and building safeguards into the network that prevent key resources from being accessed even when a client on the system has been commandeered.
Windows machines, the authors also recommend, should only be run in unprivileged mode for the vast majority of users. A PDF of the report is here. ®