RSA Europe 2013 Cyber-espionage groups are too numerous to count and are often far less skilled than their reputation suggests, according to threat-trackers.
Costin Raiu, director of global research at Kaspersky Lab, estimated that anything between 100 to 200 hacking crews operate in China alone.
Despite the hype abut zero-day attacks, many successful assaults relied on rudimentary attacks that successfully took advantage of poor patching practices and other rudimentary security mistakes, Raiu said during a panel session at the RSA Europe Conference.
"Lots of attacks are successful but not advanced," Raiu said. "They start with the most common stuff before they go up the ladder."
"They don't want to use zero-days, exposing them in the process, unless they need to," he added.
Jaime Blasco, Director, AlienVault Labs, said it was more meaningful to talk abut effective attacks than the commonly used industry term of Advanced Persistent Threats.
Blasco said: "There are different groups with different skills sets and different intentions," adding that the infamous APT1 (Comment Crew) group is "not skilled" even though it is very successful.
Europol's Jaap van Oss, team leader of the international police agency's cybercrime division, added that the widely varying skill set of the criminal world is akin to that occupied by state-sponsored hackers.
Neil Thacker, infosec and strategy officer at Websense, said that the threat of APTs "helped me to get a budget for a project". Thacker's job gives him a role equivalent at a CISO at a firm outside the IT sector.
The quartet made their comments during a packed panel session, entitled Cut Through the Hype to Expose the Truth About Advanced Persistent Threats at the RSA Conference Europe on Tuesday.
Thacker added that although everyone wanted to know the source of APT attacks assigning attribution was difficult. "Everybody wants information on who’s attacking, but attribution isn’t easy," Thacker said.
Raiu spoke of gangs from outside China renting domains through Chinese registrars in order to disguise the true origin of attacks under a false flag. “They are opening stolen documents on virtual machines without any internet connection to avoid exposing themselves that way,” he added.
Hacking back (active defence) against attackers is one possible response to cyber-espionage. This might involve disrupting systems linked to a particular attack, for example. However the panelists were wary about the idea. “In order to have strong security you might need to have a strong offence, but legal tell me [not to] do it," Thacker said.
All the panelists agreed that breaches of one sort of another are inevitable, so the trick becomes detecting a malware attack quickly and isolating compromised systems before more damage can be done. You can’t defeat attacks but "you can profile them and learn about the techniques and tools in play before developing better incident response", according to Blasco.
The vast majority (90-95 per cent) of attacks involve some aspect of social engineering, such as phishing attacks that trick users into handing over their passwords to a fake site.
Common evidence sniffed out at many scenes of breaches include Win XP boxes with no antivirus installed, weak patching and systems where everyone is operating with admin privileges. ®