Targeted threats are a class of malware destined for one specific organization or industry. A type of crimeware, these threats are of particular concern because they are designed to capture sensitive information. Targeted attacks may include threats delivered via SMTP e-mail, port attacks, zero day attack vulnerability exploits or phishing messages. Government organisations are the most targeted sector.[1] Financial industries are the second most targeted sector, most likely because cybercriminals desire to profit from the confidential, sensitive information the financial industry IT infrastructure houses.[2] Similarly, online brokerage accounts have also been targeted by such attacks.[3]
Impact
The impact of targeted attacks can be far-reaching. In addition to regulatory sanctions imposed by HIPAA, Sarbanes-Oxley, the Gramm-Leach-Bliley Act and other laws, they can lead to the loss of revenue, focus and corporate momentum. They not only expose sensitive customer data, but damage corporate reputations and incur potential lawsuits.[4]
Detection and prevention
In contrast to a widespread spam attack, which are widely noticed, because targeted attacks are only sent to a limited number of organizations, these crimeware threats tend to not be reported and thus elude malware scanners.[5]
- Heuristics
- Multiple-layered pattern scanning
- Traffic-origin scanning. Targets known bad locations or traffic anomalies.
- Behavior observation. Including desktop emulator solutions and virtual machine behavior analysis.
Examples
- In one instance, Trojan horses were used as a targeted threat so that Israeli companies could conduct corporate espionage on each other.[6]
- The Hotword Trojan, the Ginwui and the PPDropper Trojans are additional examples of Trojans used for corporate espionage.[7]
- Targeted destination attacks use harvested IP addresses to send messages directly to recipients without an MX record lookup. It aims for specific sites and users by defeating hosted protection services and internal gateways to deliver e-mail with malicious payloads.[8]
External links
- An analysis of Targeted Attacks
Notes
- ^ "Email Security.cloud - Symantec Enterprise".
- ^ Symantec Corp., Symantec Internet Security Threat Report, Vol X, Sep. 2006, p. 9.
- ^ Comisión de Seguridad y Cambio. "Cuentas de corretaje en línea: qué puede hacer para proteger su dinero y su información personal". https://www.sec.gov/investor/pubs/onlinebrokerage.htm
- ^ Williams, Amrit T., Hallawell, Arabella, et al., "Hype Cycle for Cyberthreats, 2006", Gartner, Inc., 13 de septiembre de 2006, pág. 17
- ^ Shipp, Alex citado en Gibbs, Wayt. "The Rise of Crimeware.", 23 de febrero de 2006. "The Rise of CrimewareBLOG: SciAm Observations: Un blog de los editores de Scientific American". Archivado desde el original el 6 de diciembre de 2006 . Consultado el 28 de noviembre de 2006 .
- ^ Williams, Dan. "Israel retiene a una pareja en un caso de espionaje corporativo". "http://www.computerworld.com/securitytopics/security/virus/story/0,10801,108225,00.html?from=story_kc, 31 de enero de 2006
- ^ Symantec Corp., Informe de amenazas a la seguridad en Internet de Symantec, volumen X, septiembre de 2006, pág. 4.
- ^ Avinti, Inc. "Ataques de destino dirigidos". Septiembre de 2005. "Copia archivada" (PDF) . Archivado desde el original (PDF) el 15 de febrero de 2012 . Consultado el 28 de noviembre de 2006 .
{{cite web}}: Mantenimiento CS1: copia archivada como título ( enlace )
