2017年Cisco网络安全报告：攻击与防御的角力

需积分: 22 167 浏览量更新于2024-07-18 收藏 6.42MB PDF 举报

"Cisco在2017年发布的网络安全中期报告深入分析了当时的网络威胁状况，旨在提升安全团队和他们支持的企业对网络安全威胁和漏洞的认识，并提供改进安全性和网络复原力的建议。报告强调了攻击手段的日益复杂以及对手如何利用这些手段侵犯用户、窃取信息和制造混乱。报告涵盖了攻击者行为、exploit工具的演变、防御者行为的影响、Web攻击方法、间谍软件、垃圾邮件趋势、勒索软件、恶意邮件策略、恶意软件进化、Talos威胁情报、检测时间、攻击域寿命、供应链攻击以及物联网(IoT)安全等关键主题。" 网络安全是全球面临的重要问题，而Cisco的报告在2017年揭示了一些关键的发现和趋势： 1. 攻击者行为：随着技术的发展，网络攻击者越来越熟练，采用更复杂的方法来规避检测和渗透网络。他们不断调整策略，以应对防御者的行为变化。 2. Exploit工具：尽管exploit工具的活跃度有所下降，但它们并未完全消失。报告指出，这种下降可能是由于防御者采取了更有效的防护措施，但也可能意味着攻击者正在转向其他攻击方式。 3. Web攻击方法：报告表明，互联网的成熟使得Web攻击更加普遍，Web阻断活动在全球范围内呈现出不同的模式，揭示了网络犯罪的全球性。 4. 间谍软件：间谍软件的威胁被强调为与它的名字一样严重，它能悄无声息地监控用户活动，窃取敏感信息。 5. 垃圾邮件和exploit套件活动：exploit套件活动的减少影响了全球垃圾邮件趋势，显示了两者之间的关联。 6. 恶意邮件策略：恶意软件作者开始采用不同的文件类型策略，以提高其邮件的有效性和逃避检测的能力。 7. 勒索软件与企业邮箱妥协：报告提醒，虽然勒索软件引人关注，但企业邮箱妥协可能是更大的威胁，因为它们可能导致更广泛的内部破坏。 8. 恶意软件进化：通过六个月的观察，恶意软件的演变速度加快，如Nemucod、Ramnit、Kryptik和Fareit等。 9. 时间到检测（Time-to-Detection, TTD）：报告追踪了攻击者和防御者之间TTD的拉锯战，强调了快速响应的重要性。 10. 攻击域寿命和重叠：攻击者使用的域名生命周期延长，且出现重叠，这为研究攻击工具提供了新的视角。 11. 供应链攻击：单个组件的妥协可能影响多个组织，凸显了确保供应链安全的紧迫性。 12. 物联网(IoT)安全：随着物联网设备的普及，报告预示了新的安全挑战，因为这些设备往往缺乏充分的安全设计。 Cisco的2017年网络安全报告提供了对当时网络安全威胁的全面洞察，对于企业和安全专业人员来说，这些信息对于制定和更新安全策略至关重要。了解这些威胁和趋势有助于提升整体的网络安全防御能力。

Cisco 2017 Midyear Cybersecurity Report

Attacker Behavior

Hola VPN

Hola (spyware and adware) is a freemium web and mobile

application that provides a form of VPN to its users through

a peer-to-peer network. It also uses peer-to-peer caching,

making users “store” content downloaded by other users.

Hola is distributed as a client-side browser-based application.

The software is available either as a browser extension or a

standalone application.

The screenshot of Hola’s website in Figure 6 shows how the

spyware’s operators are marketing the spyware as a free, helpful

service that lets users “access any website.” They also claim that

Hola is “used by over 121 million people around the world.”

Figure 6 Screenshot of Hola VPN’s homepage

Why it is considered spyware: Hola’s functionality includes,

among other things, selling users’ bandwidth through a service

called Luminati, installing its own code-signing certificate on

users’ systems, downloading any file with an option to bypass

antivirus checking, and running code remotely.

RelevantKnowledge

RelevantKnowledge (spyware and system monitor) collects

mass quantities of information about Internet browsing

behavior, demographics, systems, and configurations.

RelevantKnowledge may be installed directly or through

software bundles, sometimes without direct user consent.

Figure 7 Screenshot of RelevantKnowledge’s homepage

Like Hola, its homepage (Figure 7) features messaging

designed to make users feel good about signing up for the

service. For example, the spyware operators claim that they

will make a tree donation to “Trees for Knowledge” in honor of

every member.

Why it is considered spyware: As mentioned earlier,

RelevantKnowledge can install software without a user’s

consent. Also, it collects information to create user profiles

that are sold, anonymously, either individually or as part of

aggregate data, to third parties for “research” purposes.

Cisco 2017 Midyear Cybersecurity Report

Attacker Behavior

Figure 10 Spyware distribution

Source: Cisco Security Research

RelevantKnowledge DNS Changer/Unlocker Hola

Date

Nov

2016

Jan

2017

Dec

Feb

Mar

0 10 20 30 40 50 60 70

Distribution Percentage

Among the three families, we found that Hola is the most

distributed—affecting more than 60 percent of the organizations

in our sample monthly during the period observed

(see Figure 10). This spyware family is also becoming more

distributed over time, albeit slowly.

DNS Unlocker, meanwhile, affects more users overall, but

across fewer organizations (Figure 10). In January, the

number of infections related to this spyware family had

increased significantly from the rate seen in November, but

has been declining since, according to our researchers.

7 To see our previous reporting on this topic, download the Cisco 2017 Annual Cybersecurity Report, available at:

cisco.com/c/m/en_au/products/security/offers/cybersecurity-reports.html.

8 Riskware is legitimate software that could be modified by malicious actors and used for nefarious purposes.

Spyware infections must be taken seriously

Spyware infections are rampant in many organizations, but are

not typically considered a significant security risk. However,

like adware infections—which we found in three-quarters of

the companies we surveyed in another recent study

—spyware

infections can place users and organizations at risk for

malicious activity.

Although operators may market spyware as services designed

to protect or otherwise help users, the true purpose of the

malware is to track and gather information about users and

their organizations—often without users’ direct consent or

knowledge. Spyware companies are known to sell or provide

access to the data they collect, allowing third parties to harvest

information with relative anonymity. That information can be

used to identify critical assets, map internal infrastructures in

organizations, and orchestrate targeted attacks.

Spyware infections on browsers and endpoints must be

remediated quickly. Security teams must maintain active

awareness of spyware capabilities and determine what type

of information is at risk. They should also take the time to

develop a playbook for remediating spyware, adware, and

riskware

infections and for educating end users about the

risk of PUAs. Before accepting end-user license agreements

for any PUA, users should, at minimum, take a moment to

scan sections on how their information will be collected,

stored, and shared.

Not viewing spyware masquerading as PUAs as a form of

malware can lead to more infections and security risks. The

spyware problem is poised to grow, as operators incorporate

more malicious capabilities into their software and continue to

take advantage of the lack of remediation inside organizations.

Cisco 2017 Midyear Cybersecurity Report

Attacker Behavior

Decline in exploit kit activity likely influencing global spam trends

 o see our revious reortin on this toi onloa the Cisco 2017 Annual Cybersecurity Report, available at:

cisco.com/c/m/en_au/products/security/offers/cybersecurity-reports.html.

10 “Necurs Diversifies Its Portfolio,” by Sean Baird, Edmund Brumaghin, and Earl Carter, with contributions from Jaeson Schultz, Talos blog, March 20, 2017:

blog.talosintelligence.com/2017/03/necurs-diversifies.html.

11 “Jaff Ransomware: Player 2 Has Entered the Game,” by Nick Biasini, Edmund Brumaghin, and Warren Mercer, with contributions from Colin Grady, Talos blog, May 12, 2017:

blog.talosintelligence.com/2017/05/jaff-ransomware.html.

Cisco threat researchers observed an increase in IP

connection blocks coming from the Chinese IP space from

January to May 2017. Overall spam volumes in the first half

of the year have declined and are steadying from the spam

volume highs that peaked toward the end of 2016.

Figure 11 IP blocks by country

ource: Cisco Security Research

Jan Feb Mar Apr May

Number of IP Blocks

Month

US CN VN IN DE FR MX

50M

100M

150M

200M

The overall increase in spam volume our threat researchers

have observed since August 2016

appears to coincide with

the significant decline in exploit kit activity that began around

the same time. Adversaries have been turning to other tried-

and-true methods, like email, to distribute ransomware and

malware and generate revenue (see “Exploit kits: Down, but

not likely out,” page 9).

Cisco threat researchers anticipate that the volume of spam

with malicious attachments will continue to rise while the

exploit kit landscape remains in flux. Email has the potential

to go straight to the endpoint. Adversaries also can count

on “help” from unsuspecting users to move their campaigns

beyond the inbox. Through crafty social engineering (phishing

or more targeted spear phishing), they can easily dupe users

and eventually compromise entire organizations.

Some adversaries are also relying on spam emails containing

macro-laden malicious documents to deliver ransomware.

These threats can defeat many sandboxing technologies

because they require some type of positive user interaction,

such as clicking “OK” on a dialog box, to infect systems

and deliver payloads (see “Malware evolution: A 6-month

perspective,” page 23).

Spam-sending botnets—especially the massive botnet

Necurs—are also thriving and contributing to the overall

increase in global spam volume. Earlier this year, Necurs

was sending penny stock “pump-and-dump” spam, to great

effect, and focusing less on distributing spam containing

sophisticated threats like ransomware.

Figure 12, an internal

graph generated by Cisco’s SpamCop service, shows an

example of this type of activity by Necurs. That the botnet’s

owners are relying heavily on these low-quality spam

campaigns suggest that these less resource-intensive efforts

are successfully generating revenue.

Figure 12 Necurs “pump-and-dump” spam activity

(over 24 hours)

ource: SpamCop

Reports Sent

Spam Submitted

Number of Instances

Hours

100

120

140

12:00

00:00

Necurs Botnet Sent

138 Instances of Spam

Between 3AM and 5AM

More recently, the Necurs botnet was sending Jaff, a new

variant of ransomware, through multiple, large-scale malicious

spam email campaigns. The emails included a PDF attachment

with an embedded Microsoft Word document functioning as

the initial downloader for the Jaff ransomware.

Download the 2017 graphics at: cisco.com/go/mcr2017graphics

剩余89页未读，继续阅读

josephcisco

粉丝: 0
资源: 1

2017年Cisco网络安全报告：攻击与防御的角力

Cisco Security Agent

Cisco Press: Security Monitoring with Cisco Security MARS.pdf

Security Monitoring with Cisco Security MARS (现任明教教主批注版)

Cisco Security

Cisco Security 白皮书

Cisco Security Device Manager 中文版 思科设备安全管理

Security Threat Mitigation and Response Understanding Cisco Security MARS

Cisco Press：Cisco Security Architectures.pdf

Cisco Security Device Manager 2.5

ccie.zip_All for One_CCIE Security_Cisco Security

最新资源

Cisco Security Device Manager 中文版思科设备安全管理