 |
 |
|
|
|
 |
 |
Home | What's New | FAQ | Site Contents | Contact Us | Search |
|
|
About Us | Alerts | Education and Training | Events | FTP Archives | Improving Security | Other Resources | Reports | Survivability Research |
|
|
|
|
|||
Cyber Infrastructure and Malicious Expectations during the Y2K Transition PeriodInternational Y2K Workshop This document is the product of the Threat Analysis Working Group at the International Y2K Workshop, held at the Renaissance London Gatwick Hotel in Gatwick, England, 26-28 October 1999. The International Y2K Workshop was sponsored by the Y2K Information Coordination Center (ICC), and was led by the CERT® Coordination Center (CERT/CC).
Threat Summary The authors of this assessment expect both real and reported increases in malicious cyber activity, encouraged by the heightened awareness of and media focus on malicious activity during the period. Further, the authors see significant opportunity for malicious activity in the large numbers of systems that experienced Y2K remediation efforts. The increase in malicious activity during the Y2K period could generate additional problems in infrastructure systems, beyond genuine Y2K-generated issues and the normal level of infrastructure concerns. The authors believe that users and system administrators will encounter and should be able to correct small-scale Y2K incidents throughout the cyber and physical infrastructures. Similarly, the authors anticipate encountering both known and probably new viruses and exploits. However, limitations exist in the collective community's ability to predict, prevent, and immediately detect malicious activity and distinguish between genuine Y2K events and malicious intrusions. At worst, the authors can envision the relatively wide dissemination of several new, possibly destructive viruses, and the successful exploitation of both corporate and national security information systems. But even these worst-case scenarios reflect the same kinds of malicious activity that is seen and acted upon today.
Key Messages In framing the discussion of cyber assurance against the coming Y2K transition period, the authors conclude the following:
Activity during the Y2K period will predominantly exhibit known characteristics. Most of the malicious cyber activity expected during the Y2K transition period is the same kind of activity seen in the past and present; the actors will remain insiders, individual intruders and intruder groups, corporate and state espionage, criminals, and terrorists.
Media attention and associated reactions and misperceptions will generate additional incentive for malicious activity. This could be aggravated by genuine failures of Y2K remediated systems and/or problems with some Y2K remediation efforts.
It is not expected that malicious activity will impact physical or cyber infrastructure systems on a regional or national scale.
Malicious activity will generate an increased volume of cyber "noise." Malicious activity will generate and provide increased opportunity for localized incidents to be successful.
The challenge posed by the Y2K transition period will be met by applying effectively and rigorously the same expertise and techniques required now to strengthen public and private information systems alike in an evolving age of electronic business and commerce. Y2K represents a real challenge to the ongoing process of large-scale cyber-systems security.
The cyber assurance community will be challenged during the Y2K transition period in terms of the increased information flow, assessment, and responsiveness required. INTENT AND CAPABILITY Who The Y2K period provides an unusual opportunity for cyber-attack groups, including the following types of actors:
The particular motivation for elements of this group over the Y2K transition period is for simple attention – adding to and exploiting the chaos. They will be further fueled by the hype surrounding the millennial period and the opportunity for increased media attention. However, some elements may prefer to remain covert using the increased opportunities of the Y2K event to avoid detection.
The Y2K period may provide significant opportunity and cover for criminal activity. For example, illegal activity such as billing fraud may be misdiagnosed as a Y2K transition problem.
The term "hacktivist" is used to describe groups or individuals using cyberspace to promote their agendas. Attacks may be coordinated or focused on specific targets (e.g. ".gov" or ".mil" sites) or support a specific cause such as organized protests (e.g. the London J18 protests).
The Y2K transition period provides a significant media event that could prove attractive to terrorists; however, the authors currently see no reason to expect concerted attacks of this kind during the Y2K period.
Actors sponsored by nation-states or industry competitors may look to the Y2K transition period as an opportunity for espionage activities. Professional data miners may use it to cover their activity, while perceived attention to security during the period could serve as a disincentive.
Insiders – those who use legitimate access for malicious ends – exist as threats both alone (as individuals) and as part of any of the groups mentioned above. Motivation varies from disgruntled employees to simple theft to industrial and national espionage.
Particular opportunities over the Y2K period The Y2K transition period provides a particular focus with a number of unique characteristics:
The most likely scenario is one with an increased noise level with several new viruses or exploits, where the main players are independent intruders. Attention-seeking attacks will include graffiti and viruses. There will be increased probing of systems, as there is at any time of heightened attention. Although individually these attacks can be dealt with locally in the usual manner, there is a danger that the increased volume of attacks will create its own momentum and make timely remediation difficult. This could lead to instability or denial of service through congestion. In the extreme, this could precipitate a system shut down. Interdependencies between systems could result in collateral damage not anticipated by the attacker.
TYPES OF ATTACKS The types of attacks seen during the Y2K transition period will most likely include the following:
A Trojan horse program is an executable file that performs an unauthorized action on your computer. Harmless Trojan horse programs may simply display a picture on the screen or have humorous actions such as making letters fall off the screen. Malicious Trojan horse programs, on the other hand, can surreptitiously damage and/or erase files, disable security features, and reformat hard disk drives. NOTE: If you suspect that your system may have been compromised by a disgruntled employee or anyone else that has had access to the system, the best solution is to low-level reformat the drive and reload the operating system from the original software distribution.
It is possible that the advent of the millennium will see the distribution of new forms of malicious software in the form of new computer viruses. A virus is a computer program designed to conceal itself on the system and infect other computers on the network or by sharing of magnetic media (e.g. disk transfer). The virus itself may be malicious (e.g. deleting or destroying system integrity) or be innocuous. Virus development is relatively simple, with toolkits being available on the Internet to even inexperienced users. The self-replicating component(s) of the virus may remain standard and unaltered by the developer, while the malicious element (payload) is determined by the writer and could provide exploitation routes for subsequent attacks. Experience has shown that such viruses may be distributed largely by email as attachments, which in turn are either executed by the recipient through opening the attachment, or are automatically re-distributed to the recipient’s current e-mail mailing list. NOTE: There are a number of excellent anti-virus programs designed to detect and delete known programs. The best defense against such threats is to enforce a policy requiring the use of current anti-virus software and prohibiting the opening or sending of unknown attachments.
Intruders are often able to break into network systems by taking advantage of vulnerabilities in the operating system. Such vulnerabilities and the tools used to exploit them are often publicized and distributed throughout the Internet. In addition to weaknesses in the operating system, network programs running on servers (ftp servers, time servers, etc.) can also provide additional exploitable vulnerabilities. Therefore, it is important that any unnecessary programs and services be removed from the server. NOTE: It is imperative that system administrators always maintain their systems with the current version of the operating system as well as insuring that all security patches to the OS are applied in a timely manner. Special care should be exercised in obtaining the patches from a secure site.
Password compromise is a classic way of obtaining unauthorized access to a system. Two popular methods for obtaining the passwords are sniffing the network (monitoring all traffic on the network and capturing authorized users’ login names and passwords) and dictionary attacks on weak passwords. Weak passwords include names, places, and other personal descriptors. NOTE: Two suggested ways of creating recallable secure passwords would be to use two or more words separated by non-alpha characters or create a phrase and use the first letter from each work in the phrase. <<THIS SECTION APPLICABLE TO U.S. GOVERNMENT USERS ONLY>> Where applicable, U.S. government users should create passwords from a U.S. government-approved algorithm. It also is suggested that warning banners be installed and displayed wherever users connect to a system and are prompted for login information. While the banners should not contain any information related to the identity of the system, they should advise users that unauthorized access is prohibited and subject to prosecution.<<END U.S. GOVERNMENT-ONLY SECTION>>
"Social engineering" is another way of saying that a system administrator or user has been tricked into providing an intruder with information about the system or about a user account. A classic example of this is when an attacker impersonates a user and calls a "help desk" asking that his/her forgotten password be reset. NOTE: It is imperative that administrators not release information regarding a system or user account without first ensuring that the person they are speaking with is who they claim to be (authenticated).
Certain specialized computing systems require particular attention at this time as system administrators often fail to adequately secure them. Domain Name Servers (DNS) and routers are principal amongst these. Successful exploitation of these systems facilitates more sophisticated intrusions and denial of service attacks on other, connected computer systems. A DNS server is a computer that runs a program called "named." Its purpose is to translate a system name into an IP address. A corrupted or suborned DNS server enables an intruder to redirect connections to an alternate system. The DNS server should be dedicated; absolutely no other services should be allowed to run on it other than the "named" program. Secondly, the system administrator needs to fine tune the default configuration to prevent outside systems from performing unwanted updates to the list of server names and addresses as well as preventing unauthorized zone transfers. A router is a switch used to connect a LAN to the wider network. An exploited router enables an intruder to redirect connections and disrupt network connectivity as well as use the router as a point of entry into the LAN. Routers should be configured to reject "telnet" connections from unauthorized users. Additional configuration safeguards can be performed to reduce the chances that the router can be exploited for use as a gateway for denial of service attacks. Contact your router manufacturer for suggested configuration guidelines.
CONCLUSIONS
Recommendations for the public
Recommendations for system managers
Recommendations for policymakers (e.g., CEOs, public affairs staff)
Credits International Y2K Workshop - Threat Analysis Working Group participants
|