Hackers never sleep, it seems. Just when you think you’ve battened down the hatches and fully protected yourself or your business from electronic security risks, along comes a new exploit to keep you up at night. It might be an SMS text message with a malevolent payload or a stalker who dogs your every step online. Or maybe it’s an emerging technology like in-car Wi-Fi that suddenly creates a whole new attack vector.
Whether you’re an IT manager protecting employees and corporate systems or you’re simply trying to keep your own personal data safe, these threats, some rapidly growing and others still emerging, pose a potential risk.
Fortunately, there are some security procedures and tools available to help you win the fight against the bad guys.
1. Text message malware
While smartphone viruses are still fairly rare, text messaging attacks are becoming more common, according to Rodney Joffe, senior vice president and senior technologist at mobile messaging company Neustar and director of the Conficker Working Group coalition of security researchers.
PCs are now fairly well protected, he says, so some hackers have moved on to mobile devices. Their incentive is mostly financial. Text messaging provides a way for them to break in and make money.
Khoi Nguyen, group product manager for mobile security at Symantec, confirmed that text message attacks aimed at smartphone operating systems are becoming more common as people rely more on mobile devices. It’s not just consumers who are at risk from these attacks, he adds. Any employee who falls for a text message ruse using a company smartphone can jeopardise the business’s network and data, and perhaps cause a compliance violation.
“This is a similar type of attack as [is used on] a computer. An SMS or MMS message that includes an attachment, disguised as a funny or sexy picture, which asks the user to open it,” Nguyen explains. “Once they download the picture, it will install malware on the device. Once loaded, it would acquire access privileges, and it spreads through contacts on the phone, [who] would then get a message from that user.”
In this way, says Joffe, hackers create botnets for sending text message spam with links to a product the hacker is selling, usually charging you per message. In some cases, he adds, the malware even starts buying ringtones that are charged on your wireless bill, lining the pockets of the hacker selling the ringtones.
Another ruse, says Nguyen, is a text message link to download an app that supposedly allows free Internet access, but is actually a Trojan that sends hundreds of thousands of SMS messages (usually at “premium SMS” rates) from the phone.
Wireless carriers say they do try to stave off the attacks. For instance, Verizon spokeswoman Brenda Raney says the company scans for known malware attacks and isolates them on the cellular network, and even engages with police to block attacks.
Still, as Joffe notes jokingly, there is “no defence against being stupid” or against employee errors. For example, he recounts that he and other security professionals training corporate employees one-on-one about cell phone dangers would send them messages with a fake worm. And right after the training session, he says, many employees would still click the link.
To keep such malware off users’ phones, Joffe recommends that businesses institute strict corporate policies limiting whom employees can text using company networks and phones, and what kind of work can be done via text. Another option is a policy that disallows text messaging entirely, at least until the industry figures out how to deal with the threats.
For consumers, common sense is the best defence. Avoid clicking on text message links or attachments from anyone you don’t know, and use extreme caution even with messages from known contacts, who might unwittingly be part of a botnet.
2. Hacking into smart grids
A common misconception is that only an open network, say your corporate wireless LAN for visitor access, is hackable. Not true, says Justin Morehouse, a principal consultant at Stratum Security, who spoke about network security at last year’s DefCon security conference. Morehouse says it’s actually not that difficult to find an access point into a so-called closed system.
For example, the Stuxnet worm last year infected tens of thousands of Windows PCs running Siemens SCADA systems in manufacturing and utility companies, most notably in Iran, and it was largely spread via infected USB flash drives. Even some nuclear plants and power grids have wireless networks for employees to use.
“Stuxnet proved that it is relatively simple to cause potentially catastrophic damage” to an industrial control network, says Neustar’s Joffe.
According to Morehouse, another new attack point will be smart grids, which use electronic metering to streamline power management. Utility companies around the world have begun testing and rolling out smart meters to customers’ homes and businesses. The technology, which can send data to and receive it from a central system, can also be very helpful for IT: You can open a console to see the power usage for one section of a building, for example.
But smart grids might be vulnerable to attacks that would allow hackers to cut off electricity to homes and businesses, and create other kinds of havoc. One possible attack vector is a smart grid’s communications infrastructure. For example, Morehouse says, a German utility company called Yello Strom uses a consumer smart grid system that works like a home automation kit, the sensors report energy usage back to the central server via the user’s home Wi-Fi network.
Because of this, Morehouse says, it is possible for end users to tap into their own networks and gain access to the substation used for delivering power. “Often it’s the case that these types of networks are not properly segmented or protected,” he says. “Once in, the attacker may be treated as a trusted user and have access to other areas. Is there the potential that they could disrupt the substation or city? Absolutely. They may plant a back door that could allow the grid to be powered down at a particular time.”
Utilities in the US tend to use their own proprietary wired or wireless connections to sensors, but Morehouse is concerned that some may follow Yello Strom’s example and use home networks instead.
Another concern is vulnerabilities in the smart meters themselves, a problem that affects corporate smart grids as well. Researchers from security services vendor IOActive, for instance, discovered several bugs in smart grid devices that hackers could exploit to access the smart grid network and cut power to customers.
“Hackers use press releases to find out the technologies [used in corporate smart grids] and go back to the infrastructure and find vulnerabilities. So, for example, if Wal-Mart announces a smart grid using Siemens technology, a hacker suddenly has many of the answers they need to find that controller and break in,” Morehouse says.
The most effective preventive measure, says Morehouse, is rigid isolation. A smart grid should not touch any other network, ever. He says there is an urgent need for penetration testing and making sure the firewall in a closed network is secure because of the possible dangers of gaining access to the power grid. He advises using tools such as Core Impact and Metasploit.
The “rigid isolation” rule applies to home users as well. “Consumers should never bridge smart grid networks with their home networks,” says Morehouse. He also advises home users to become familiar with their smart meters so they can recognise whether they have been tampered with, and to ask their utility providers what security measures are in place to protect the meters and network.
Like this:
Like Loading...
