hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015Threat actors2014 saw a shift in how technology was used in local and regional uprisings. Though hacktivismcan be said to have declined—prompted by a decrease in anonymous activity followingseveral high-profile arrests 3 —we saw an increase in the malicious use of technology both inand against protests. Attackers, reportedly from China, used remote access Trojans (RATs)masquerading as custom Android apps against protesters in Hong Kong. 4 China also reportedlyintercepted Apple iCloud traffic to collect usernames and passwords. 5 Elsewhere, the TORnetwork was hacked by unknown entities and its users were identified. 6 As we closed the editingcycle for this Report, a massive data breach involving Sony Pictures Entertainment captivatedworld attention, though the provenance of that attack was unclear at press time. 7Attacks originating from groups based in China continued to target Western interests. Althoughhistorically these groups have focused on intellectual property theft, we observed a changein targets this year to focus on identity information as well. One high-profile example involvedCommunity Health Systems, which disclosed a breach allegedly by a China-based groupknown as APT 18. In that breach, the Social Security numbers and other personal informationof 4.5 million patients was compromised. 8 This was the largest loss of patient data since theU.S. Department of Health and Human Services began keeping records of breaches in 2009.Adversaries acted quickly when observed: Mandiant reported that APT1, on which it hadpublished an initial report one year before, immediately abandoned the command-and-control(C2) structure described in that report and set up a new one. 93http://www.wired.com/2014/06/anonymoussabu/.4https://www.lacoon.com/chinese-government-targets-hong-kong-protesters-android-mrat-spyware/.5https://zh.greatfire.org/blog/2014/oct/china-collecting-apple-icloud-data-attack-coincides-launch-new-iphone.6https://blog.torproject.org/blog/tor-securityadvisory-relay-early-traffic-confirmation-attack.7http://www.nbcnews.com/storyline/sony-hack/north-korea-behind-sony-hack-if-so-it-hadhelp-n271341.8http://www.reuters.com/article/2014/08/18/us-community-health-cybersecurityidUSKBN0GI16N20140818.9http://www.rsaconference.com/events/us14/agenda/sessions/1342/state-of-the-hack-oneyear-after-the-apt1-report.10http://www.justice.gov/opa/pr/us-charges-five-chinese-military-hackers-cyber-espionage-against-us-corporations-and-lab.11 http://www.novetta.com/files/9714/1446/8199/Executive_Summary-Final_1.pdf.12https://www.europol.europa.eu/content/worldwide-operation-against-cybercriminals.13 http://www.fbi.gov/news/stories/2014/may/international-blackshades-malware-takedown/international-blackshades-malware-takedown.14http://www.fbi.gov/news/stories/2014/june/gameover-zeus-botnet-disrupted.15 https://www.europol.europa.eu/content/globalaction-against-dark-markets-tor-network.2014 saw an increased response to this type of attacker group. In May 2014 the U.S. JusticeDepartment charged five officers in Unit 61398 of the Third Department of the Chinese People’sLiberation Army (PLA) with hacking into U.S. entities for the purpose of intellectual propertytheft. 10 In October, Novetta published reports on a cyber-espionage interdiction operation(referred to as Operation SMN), in which Novetta worked with U.S. security partners to takedown 43,000 installations of tools used by a group called Axiom. It identified similarities inattacks seen as far back as Operation Aurora that could be attributed to this group. Evidencesuggests that this group targeted organizations in China in addition to those in the West. 11International law enforcement agencies increasingly worked together as well. In May Europoland the FBI conducted raids targeting users of the Blackshades RAT. 12 13 The same month, aninternational effort identified the leader of a group responsible for the notorious GameoverZeus botnet and CryptoLocker, leading to the dismantling of those networks. 14 In November,agencies from 16 European countries, along with representatives from the United States,took down over 400 hidden services on the dark Web, including many carding and illegaldrug markets. 15Nation-state supported activityIn 2014, we examined the state-sponsored or state-condoned cyber activity of actors in threenations: Iran, North Korea, and Turkey. Among those nations we found three different levelsof state involvement in cyber activity: indirect operational involvement, direct operationalinvolvement, and condoning with plausible deniability of operational involvement. The degreeof apparent state involvement was derived based on several factors, including:• Evidence of state sponsorship of actor training• The nation’s cyber warfare infrastructure, capabilities, or doctrine• The nation’s cyber laws• Threat actor group ties to government or military entities8