hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015The cyber undergroundActivity in the cyber underground primarily consists of cyber crime involving identity theftand other crimes that can be easily monetized. There have been other motivations observedthough, as was the case in August when suspected Russian hackers stole gigabytes of customerdata from U.S.-based JPMorgan Chase during a period of escalated tension between Russiaand the United States, in which Russia was amassing troops on the border with Ukraine and theUnited States had imposed economic sanctions against Russia in response. Reports stated thatthe FBI believed the attackers to be state-sponsored. 49Recent credit-card information breachesoccurred in point-of-sale (POS) systemsused by retailers, which proved tobe a target-richenvironment for many attackers.In September, F-Secure published research on “Quedagh,” a Russian cyber crime organization,and its use of BlackEnergy malware to target Ukranian government organizations to stealinformation. 50 In its research it found evidence to suggest that this group could have beenoperating during the 2008 Russo-Georgian war, in which cyber operations paralleled militaryoffensives.In October, FireEye published research showing likely Russian state sponsorship of attackstargeting various organizations, with a focus on Georgia and the Caucasus, and primarily usingspear-phishing techniques with embedded malware. 51 The research indicated that this groupmay have been acting as far back as 2004.However, one of the biggest stories this year was the ongoing spate of credit-card informationbreaches targeting U.S. retailers, including Staples, Kmart, Dairy Queen, Jimmy John’s, HomeDepot, PF Chang’s, Goodwill, Sally Beauty Supply, Michaels, and Neiman Marcus. This followedthe major Target breach during the 2013 holiday season. Many of the cards stolen from thesestores ended up on carding forums being sold in groups by Russian actors. 52 These breachesoccurred in point-of-sale (POS) systems used by retailers, which proved to be a target-richenvironment for many attackers. More detailed discussion is found later in this Report.ConclusionThere’s the Internet that we see and the Internet that most of us don’t, and even though it ismostly invisible, the darker side of the Internet is pervasive and influential. Our investigationscertainly suggest that the machinations and maneuvers of criminals and state-sponsoredcyber operators in the cyber underground have significant and lasting effects on the securityof the greater Internet and society at large. Looking into nation-state-sponsored cyber activityhighlights the many levels at which cyber operations and state -sanctioned activity can occur,and how malware and the tools and techniques of cyber criminals can be utilized in differentways to accomplish different goals. (The same techniques nation states might use to stifleprotest or target opposing state interests can just as easily be used by criminals to perpetratefraud or steal intellectual property.)49http://www.bloomberg.com/news/2014-08-28/russian-hackers-said-to-loot-gigabytes-of-bigbank-data.html.50http://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf.51http://www.fireeye.com/blog/technical/2014/10/apt28-a-window-intorussias-cyber-espionage-operations.html.52http://krebsonsecurity.com/2013/12/whosselling-credit-cards-from-target/.53http://www.ipcommission.org/report/ip_commission_report_052213.pdf.Of most concern to enterprises, intellectual property continues to be targeted by Chineseinterests in particular. 53 In 2014, responses to this long-recognized threat, and internationalcooperation to address these attacks, improved and continued to gain momentum. Cyber crimecomes in many flavors but it remains vastly driven by financial interests. We expect attackersto continue to focus on intellectual property, identity data, and card information. While systemssuch as “chip and pin” are likely to prove more resistant to breach as particular points in financialprocesses get hardened, other points become more attractive to attackers. In a similar vein, astechnology develops to improve the security of systems, it also conversely develops to makeparticular targets increasingly accessible. We expect escalations in this area to continue.12