Attacks/Breaches

1/30/2018
03:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Phishing Campaign Underscores Threat from Low Budget, Low Skilled Attackers

For just over $1,000, a phishing operation successfully spied on members of the Tibetan community for 19 months, Toronto University's Citizen Lab found.

A recent digital spying operation targeted at the Tibetan community once again revealed just how little it takes for attackers to mount an effective malicious campaign these days.

Researchers at the University of Toronto's Citizen Lab were able to gain an inside view of the phishing campaign by taking advantage of some sloppy mistakes by the operator.

Over a period of eight months the researchers observed the operator setting up phishing lures, building fake Web pages, registering dozens of decoy domains, and sending emails to targeted individuals and organizations within the Tibetan community.

They estimated that during the 19 months when the operation was active, the attackers likely spent a mere $1,068 on infrastructure costs: $878 for domain registration and $190 for renting servers. Citizen Lab's researchers found that it took just basic Web development and system admin skills to run the operation, which though sloppy, was still surprisingly successful.

The attackers managed to compromise the email accounts of at least two of their intended targets and used their contact lists to send phishing lures to other targets. "We suspect there were likely other successful compromises beyond these accounts based on decoy documents we collected that appear to be private files likely extracted from compromised accounts," Citizen Lab's director Ronald Deibert said in a blog Tuesday.

According to Deibert, Citizen Lab was unable to find any evidence directly linking the operation to a specific criminal group or nation-state sponsor. But the group's targeting strongly suggests a China link: besides Tibetan activists, the operators also appeared to be interested in people from within China's Uyghur minority community, as well as a media group founded by members of the Falun Gong religious group, and other groups in Hong Kong and Burma.

It is possible the group behind the phishing campaign were freelancers or independent contractors working on behalf of a government agency in China. The sloppiness of the campaign suggests the threat actors were operating with little fear of getting caught. "The profile of the operator suggests it may be a low-level contractor," says Masashi Nishihata, research manager at Citizen Lab. "It is unclear how the operators selected targets. Nor is it clear if the operators had a specific sponsor and who was the ultimate consumer of data collected."

Citizen Lab's research showed how in addition to conducting malicious campaigns on the cheap, threat actors also often will use only what is necessary to meet their objectives. Few will ever resort to using sophisticated costly tools and attack methods if they can break into a target system using inexpensive, basic techniques. "This case shows that it doesn't take deep pockets or sophisticated technical skills to mount an effective digital spying operation. While the operation was done on the cheap, it had some successes," Nishihata says.

On a Low Budget

The Citizen Lab findings are similar to other reports that also have shown the enormous returns that criminals and cyber spies can garner from relatively meager investments. Last November, a Recorded Future report dissecting the costs of cybercrime operations found that an individual or group willing to spend between $3,500 and $5,000 on a botnet operation could easily net between 400% and 600% in direct and indirect returns.

Just like Citizen Lab discovered with the Tibetan phishing campaign, Recorded Future's researchers found that threat actors often require little technical skills to carry out lucrative campaigns. So many tools and services are available - and in such a wide price range - on the Dark Web that anyone from a newbie to a sophisticated nation-state actor can find something for their needs, Recorded Future found.

A Trend Micro report last October found that in some underground cyber markets — like those catering to the Middle East and North African threat community — there is almost no bar for entry for malicious actors. Many common attack tools, including those used for SQL injection, keystroke logging, and malware obfuscation, are available for free to members on these networks.

This trend highlights the need for organizations to pay attention to the basics, experts say. Contrary to perception, adversaries often apply low-level tools and tactics to carry out attacks so basic practices such as timely patching and strong authentication can help mitigate them as well.

The Tibetan phishing campaign is one example. "Addressing this problem requires raising the low bar and making digital spying more expensive for adversaries," Nishihata says. "Much of the threat posed by the basic phishing techniques used in this operation could be blunted through use of security features like two-factor authentication."

Related Content:

 

 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8651
PUBLISHED: 2018-12-12
A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVE-2018-8652
PUBLISHED: 2018-12-12
A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVE-2018-8617
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8618
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8619
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, aka "Internet Explorer Remote Code Execution Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Exp...