hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015C&C: See Command and ControlCabirThe first malware written for mobile devices, first detected in 2004. Cabir was a worm thattargeted the Nokia Series 60 Symbian platform and spread via the Bluetooth® OBEX protocol toother phones. It was proof-of-concept malware created by the virus writing group 29A.ClickjackingA technique used to make a user take an action of an attacker’s choice by clicking on partof a webpage. While the user may believe they are clicking on something innocuous, ineffect they are performing an action that is required by the attacker in order to achieve theirgoal—for example, by taking the action of clicking on a particular object on a page, a usermay inadvertently execute a script or comply with a request to grant a particular type of riskyactivity.Command and control (C&C)As with many terms used in computer security, this term has been borrowed from themilitary. Similar to the military use of the term it means a method of exercising authorityover resources, for example, a commanding officer commanding his troops. This term isoften used in the context of malware and botnets in particular, where a structure is set up tocommand and control many compromised computers from either a centralized, or is somecases, decentralized position. A centralized command and control structure might be a singleserver that compromised computers connect to in order to receive commands. A decentralizedcommand and control structure could be where compromised computers connect to a peer-topeernetwork, where commands are spread through the network from many possible nodes.Command and control may also be known as C2.Command injectionCommand injection occurs when an attacker is able to pass unsafe data to a system shell viaa vulnerable application so that the unsafe data is then executed on the targeted system. Theresult therefore of a successful command injection attack is the execution of arbitrary attackersuppliedcode on a targeted system. The risk of command injection attacks can be mitigated byappropriate input checking and validation.Cross-frame scriptingA form of cross-site scripting attack, in which an attacker exploits a vulnerability in a Webbrowser in order to load malicious third-party content that they control in the frame of awebpage on another site. This attack may allow an attacker to steal sensitive information,such as login details, that may be input into the frame because the targeted user believes therequest for login details came from the legitimate site.Cross-site scriptingAn attack that occurs when an attacker exploits a vulnerability in Web applications in order toinject malicious code into client-side code that is delivered from a compromised website to anunsuspecting user. This code that is delivered to the user is trusted, and hence executed, asit appears to come from a legitimate source. These types of attack occur due to insufficientchecking and validation of user-supplier input. Attackers may use this type of attack in order tobypass access controls or steal sensitive data.CryptoLockerA type of malware known as ransomware. Ransomware is malicious software that locks auser’s computer in some way and then demands a ransom in order for service to be restored. Inthe case of CryptoLocker, as the name suggests, users’ files are encrypted using an asymmetricencryption algorithm. A ransom is then demanded from affected users in order to decrypt andtherefore restore their files. CryptoLocker was first discovered in the wild by researchers in2013. It was reported to have been propagated via the Gameover Zeus botnet. The “success”of ransomware such as CryptoLocker has spawned many copycat programs. The best way toavoid being the victim of ransomware is to ensure that regular backups of your files are createdand maintained, and then stored in an unrelated system; thus, if files are encrypted, they can berestored from backup.70