Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    July 2013
    S M T W T F S
    « Jun   Aug »
  • Email Subscription

  • About Us

    Archive for July 11th, 2013

    A later stage of  advanced persistent threats (APT) attacks is the  “lateral movement” stage, where attackers typically use legitimate computer features to move within the network undetected. This takes place after the initial breach and the establishment of command-and-control links back to the attacker. We earlier discussed the steps in an APT attack in the infographic, Connecting the APT Dots.

    As shown below, the impact attackers can have on networks grows larger as APTs go deeper. Upon reaching the lateral stage, attackers are now virtually undetected by traditional security methods. This allows them to gain even more access privileges and move on to the next APT attack stages.

    Figure 1. Graph of APT Stage vs. Impact to Network

    Lateral Movement Tactics

    The lateral movement stage of APT attacks can be further divided into three major steps: reconnaissance, credentials stealing, and computer intrusions.

    The first step allows attackers to collect vital intelligence for their next attacks by using built-in OS tools and other popular utilities. These tools may include the netstat command for connection information and port scanning for open ports.

    Once well-informed, APTs will then steal legitimate credentials to establish control. Attackers can do this in various ways, such as: spoofing ARP protocol packets, using keyloggers, pass the hash attacks or hooking login authentication processes.

    After acquiring legitimate credentials, attackers will target other computers to move closer to their real target. They are more likely to use remote access or administration tools that leave few traces to accomplish this.

    What Enterprises Can Do

    The use of legitimate computer features can defeat basic perimeter-based and blacklisting security methods. However, there are many measures enterprises can still use to fortify their security, including: the use of application control, security and information event management (SIEM), and adapting a custom defense solution.

    Enterprises need to establish solid threat intelligence from internal knowledge of their network and other external indicators. Threat intelligence partnered with the use of custom defense technology will empower IT personnel in detecting anomalous use of legitimate computer features; thus, securing their networks from APT-related activities.
    Find out more about these tools and measures as highlighted in the infographic The Danger of Compromise.

    You can also read more about the steps APTs take during the lateral movement stage in the Security in Context paper, How Do Threat Actors Move Deeper into Your Network.

    Posted in Targeted Attacks | Comments Off on Building Threat Intelligence to Detect APTs in Lateral Movement

    6:49 am (UTC-7)   |    by

    Recently, Trend Micro and INTERPOL announced that Trend Micro will help train law enforcement personnel from participating countries all over the world to help them cope with today’s cybercrime threats. We are honored to help INTERPOL in its fight against cybercrime; this is completely in line with our vision of creating “A World Safe for Exchanging Digital Information.”

    The details of our collaboration are in our press releases, but I want to use this topic to discuss, more broadly, how and why Trend Micro works with law enforcement agencies around the world to stop cybercrime.

    Why is it so important that law enforcement and security companies like Trend Micro work closely together to deal with today’s threats? The answer is: each group brings very different skillsets – and mindsets – to the table. By working together, they are able to work best to become effective against cybercrime.

    Security researchers have a wide variety of information at their disposal. They have threat information from their company’s operations, as well as underground information – frequently from the “social networks” they form while visiting underground forums undercover.

    In addition, researchers typically work as teams which are multinational, have a wide reach of knowledge and specialties available to them, and used to making decisions quickly. All these traits are quite helpful in keeping up with cybercriminals.

    However, security researchers can only go so far. Law enforcement has access to powers that are needed to truly identify those responsible for attacks. Servers can be seized, communications (electronic or otherwise) can be monitored, as provided for by courts. This in-depth information allows for the identification of the actual persons behind online crimes, who can then be arrested and brought to trial.

    In the absence of cooperation, a wide variety of problems can occur. Researchers may release information into the public, which may interfere with in-progress investigations by police. The released information may not even result in anything of significance, as the researchers cannot enforce laws. Meanwhile, law enforcement can’t deal with cybercrime: it moves fast, it’s not clear “where” it actually takes place, and depending on local laws it may not be “crime” in the first place.

    While it is essential for law enforcement to partner with security companies to catch cybercriminals, they also need to be careful in choosing their partners. Some companies are perceived (rightly or wrongly) to be close to certain governments. The partners also need to be discreet in releasing information to the public; prematurely released information can seriously damage long-running investigations and cause promising leads to go cold. Picking the wrong partner can also hurt, not help, the fight against cybercrime.

    As a company, we work very hard to ensure that we have good relationships with law enforcement agencies from all over the world. We meet at conferences, internal meetings, and other events on a regular basis that serve as a way for us to exchange information. An example of the fruits of our cooperation was the recent arrest of a key figure in ransomware gangs. By working closely with Spanish law enforcement, Trend Micro was able to gather actionable information that led to arrests in this case.

    We strongly believe that by working with law enforcement, we are able to go after cybercriminals directly. Instead of targeting their hosting infrastructure – both infected machines and malicious servers can be replaced easily enough – we go after the true suspects, the persons responsible for various attacks. Going after these perpetrators, we believe, is the best way to ensure a safer Internet for everyone.

    Posted in Malware | Comments Off on Law Enforcement Cooperation And Trend Micro


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice