‘Top 5 + 5’ Security Issues for 2015

The year 2014 ended with reports on attacks involving the Korea Hydro and Nuclear Power (KHNP) resulted in a privacy breach and another incident targeted at the Milan-headquartered Hacking Team caused private data being made public. Both these incidents became the center of attention. These attacks highlighted a serious need to mitigate from of unknown malware attacks and advanced persistent threats (APT). These attacks also revealed a growing black market that trades in development for purchase or rental of ‘zero-day vulnerabilities’ as high value cyber attack weapons.

As we start the year 2015, the first half progressed without major incidents that have caused massive privacy information leaks or network paralysis in Korea. Nevertheless, we need to pay special attention to the fact that there were threats predicted by cyber security experts and have been validated by discrete incidents during this period. For example, Ransomware, was one of these predicted incidents. Ransomware, which was not previously prominent in Korea, has become very active in recent months.
AhnLab predicts that in the second half of 2015, there will be an increase in attacks from malware-embedded applications targeting mobile devices. Mobile devices are particularly vulnerable as mobile device security is in its nascent stage, while on the other hand; there is a significant growth in smartphone users and an increase in mobile usage for business.
Another area of concern in this period is an intensification of zero-day attacks that target application vulnerabilities.
In this report, we provide information about the five most significant security issues that have been detected in 2015 so far. Then, we provide a forecast of the major threats expected in the second half of 2015 based on research conducted by the AhnLab Security Emergency Response Center (ASEC).

 

 
Top 5 Threats in the First Half of 2015

 

01 Ransomware attacks in Korea
CryptoLocker, a ransomware attack was detected in April 2015 that was commonly spread by using banner links on Korean community websites. CryptoLocker was first identified in 2013 and was one of the hottest security issues in 2014. Based on our threat analysis, Ransomware featured as the top security issue heading into the first half of 2015.
Ransomware attacks are mainly delivered in e-mails but as experienced in the Korean incident, webpage vulnerabilities are also exploited, such as banners. A ransomware attack encrypts specific files and then provides instructions to the victim. The instructions describe how to restore the files and make the ransom payment to the attacker. The most notorious ransomware detected in Korea is CryptoLocker. Other examples of ransomware include:
• TeslaCrypt, which targets computer game files
• Nabucur, which encodes rather than encrypts files
• CryptoWall, which is a common attack tool detected in Korea that is spread by e-mail.
Files affected by TeslaCrypt and Nabucur can be restored by anti-virus programs. However, victims must proceed with caution when they are restoring files affected by other ransomware attacks because they cannot be restored without specific key values.
Incidents involving ransomware attacks that target mobile devices have not been detected in Korea yet. However, mobile ransomware that restricts mobile device usage accompanied by a demand for payment from the victim to lift the restriction has been discovered overseas and continued to spread.

 

02 Financial fraud incidents occur frequently
The second major security issue experienced in the first half of 2015 was the attack that attempted to illegally obtain financial information.
Propagated through a malware named Dyre, which was first detected in 2014, the attack has continued to spread and is prevalent in many of the attacks on financial institutions overseas. A Dyre attack attaches the malware Downloader.Upatre to a spam message, and when the attachment is executed it commences stealing personal and financial information.
Another malware that has been detected and continues to expose systems to pharming attacks in Korea is Banki. Malwares like Banki continuously evolve to evade being detected by anti-virus (AV) solutions. They employ methods such as DLL planting to remotely execute code in applications or to inject malicious codes into system files.
The security environment is currently responding to attack methods, which are becoming increasingly diverse albeit reactively. These diverse tactics include drive-by-download attacks that exploit security vulnerabilities and modify module update processes to introduce potentially unwanted programs.

 

03 Diverse attack methods include malicious e-mails
Despite issuing warnings to prevent opening suspicious e-mail attachments, infections from e-mail attachments continue to be regularly detected. The classic methods of spreading malwares, such as e-mails disguised as communication from international shipping or financial companies, continue to be used and have increased in the frequency of infection.
E-mail content incorporates current breaking news or social issues to lure the recipient. Recent examples include references to Middle Eastern Respiratory Syndrome (MERS) and attractive financial propositions. In the first half of 2015, the types of malware disseminated by e-mail were mostly ransomware, back door, and downloader malwares. These attacks resulted in unwanted file encryption and stolen financial information and caused havoc on users.
Of particular concern are the malicious e-mails that target specific people or groups. These attacks are known as "spear phishing" and continue to evolve into forms that are more technically advanced and meticulously planned. So the users need to pay attention to when checking e-mails.

 

04 Attacks on routers and home networking products are increasing
2015 has been plagued by the consequences of the DDoS attacks conducted by the hacking group Lizard Squad in November and December of 2014. These attacks targeted Xbox Live and Sony PlayStation Network by infecting internet routers with malware.
This type of attack has extended to target the vulnerabilities in other devices, such as IP cameras (baby monitors) and CCTV. This is also reflected in Korea as shown by the number of incidents that exploit the security vulnerabilities of internet routers. Vulnerabilities that are exploited include changing DNS addresses to direct users to fake websites that mimic trusted websites or distribute malware and are occurring on a regular basis. Although device manufacturers provide firmware updates to resolve these vulnerabilities, most users either do not realize the importance of updating the firmware or do not know how to update it. Attacks on devices connected to the internet are expected to rise.
Similar tactics are used to attack Android mobile devices. False alerts notify users to install malicious applications that purport to be application updates such as Chrome. In the first half of 2015, many examples of this type of malicious application have been detected. When these applications are installed, they steal the user's personal and financial information. 

05 Application vulnerabilities are increasing
When vulnerabilities in the cryptography library OpenSSL - referred to as HeartBleed (or CVE-2014-0160), was detected in April 2014, a series of vulnerabilities in commonly used protocols were also subsequently detected. The Bash Shell vulnerability Shellshock (or CVE-2014-6271) was detected in September 2014, and the SSL 3.0 protocol vulnerability Poodle (or CVE-2014-3566) was detected in October 2014. Shellshock continues to be a significant threat because it downloads and executes malwares.
A variety of application vulnerabilities have been identified in the first half of 2015. The GLIBC library function had a buffer overflow vulnerability called Ghost (or CVE-2015-0235) that was identified in early January 2015. Then, in March, an SSL protocol vulnerability known as Freak (or CVE-2015-0204) was also reported. Further activity in application vulnerabilities was identified in April and involved MS15-034 (or CVE-2015-1635) that exploited remote execution vulnerability in HTTP.sys code. The identification of MS15-034 followed a pattern of attacks that manipulated a simple HTTP protocol range header.
All of these application vulnerabilities exist primarily in servers and have raised the level of anxiety among security advisors and server administrators that are responsible for preparing emergency patches. Based on the level of activity, more application vulnerabilities are forecasted for the second half of 2015. To combat this, the maintenance of emergency patch process tools will be required.

 

 

 
Top 5 Threats of the Second Half of 2015

01 Malware targets mobile payment services
FinTech (Financial Technology) is undergoing considerable growth as electronic payment services are migrating from PC to mobile platforms. The outcome of the development will result in a smartphone functioning as a credit card and an increase in priority for mobile communication security.
Examples of some existing vulnerabilities were provided by the Chinese payment giant, Alipay. The Alipay experience alerted the security industry to issues involving duplicate payments and criminal activity with the Apple Pay system. These examples are useful intelligence as FinTech services emerge in Korea. Samsung, Naver, and Kakao are some of the companies developing payment solutions in Korea.
At this early stage, malware and vulnerabilities have not yet been discovered in Korean FinTech services. However, based on normal threat patterns and the attraction that the criminal community has for financial transaction environments, this will be a target for developers of malware. It is anticipated that FinTech firms will be continually assessing the risks and responding rapidly to security threats as they arise.

 

02 Mobile ransomware will become a reality
As smartphone sales continue to increase, the amount of personal information stored on them also increases. This amount of data is an attractive target for ransomware and this is reflected in the increasing number of cases involving a variety of ransomware on Android devices that are reported overseas. Android smartphones that have been targeted by ransomware have been exposed to service disruption and data encryption as the main methods of attack.
Ransom demands in attacks that took place in North America, Europe, and Russia have demanded dollars, bitcoins, and rubles to lift the smartphone restrictions. In Korea, Bankoon is the most common ransomware application to be detected. It is expected that this mobile ransomware aiming at financial benefit will continue to expand in Korea just like other parts of the world.
The most likely delivery of mobile ransomware will be a smishing attack that pretends to be a well-known anti-virus or banking application. Another likely method that has been used overseas is to use pornography to deliver the infection. Mobile ransomware is predicted to encrypt or restrict the infected device’s operation in a way that is difficult to trace and then asking for a monetary ransom to release the device.

 

03 Malicious codes will become increasingly localized
The localization of malwares has continually risen over the last 10 years. For example, an incident in Japan this May identified that malware was used to steal personal information by specifically tailoring the attack for Japanese victims.
A local attack can be tested in a geographical area by malware developers and quickly adapted and expanded to be used in other areas to increase their profits. Malware that targeted Korean internet banking services quickly moved on to use a similar attack in Japan. Dyre first appeared in Europe and then quickly moved on to target Asian banks and Korean banks from Spring 2015. The same ransomware attacks that initially focused on U.S. and European targets have then turned their attention to Korea and Japan.
By localizing malware, criminal developers can maximize profits and quickly change their focus from their original target area and expand into new areas and languages.

 

04 Advanced Persistent Threats (APT) will become more elaborate
APTs are predicted to evolve in parallel with developments in cyber intelligence sharing between countries and corporate spying. Data breaches in the U.S. Office of Personnel Management (OPM) and the German Bundestag confirm targeted attacks orchestrated by specific groups as a realistic and ongoing threat.
These attacks are likely to use customized malware that exploit zero-day vulnerabilities in commercial and open source software. A customized malware-based attack of this nature will be in an advanced format that will make it difficult to defend against. An example is the Duqu 2.0 attack on AV vendor Kaspersky and the Hacking Team data leak. If specific organizations or companies are attacked, the damage is expected to be significant.

 

05 Attacks on application vulnerabilities will become more aggressive
“Vulnerability” is a keyword at all levels of information security.
When we refer to a ‘zero-day vulnerability’ it invokes the severity and urgency to supply a security patch before the vulnerability is exploited. In fact, numerous incidents have occurred that involve a zero-day vulnerability. Oracle Java was once a popular target for zero-day attacks, but this reputation is transferring to Adobe Flash Player based on activity in this area between the second half of 2014 and the first half of 2015.
Many zero-day vulnerabilities have surfaced such as CVE-2014-0515 and CVE-2015-5119. CVE-2014-0515 appeared in ransomware circulated in a Korean community site earlier this year and more recently CVE-2015-5119 was used to steal confidential information from Hacking Team by using their zero-day vulnerability protection methods. Compared to the relatively short zero-day periods in the past, it is difficult to determine the duration of these recent attacks because it is hard to identify them before they take place.
In the second half of 2015, security issues, both major and minor, that exploit application vulnerabilities are expected to escalate and will require increased security resources to minimize the potential for damage.
​The year 2014 ended with reports on attacks involving the Korea Hydro and Nuclear Power (KHNP) resulted in a privacy breach and another incident targeted at the Milan-headquartered Hacking Team caused private data being made public. Both these incidents became the center of attention. These attacks highlighted a serious need to mitigate from of unknown malware attacks and advanced persistent threats (APT). These attacks also revealed a growing black market that trades in development for purchase or rental of ‘zero-day vulnerabilities’ as high value cyber attack weapons.

AhnLab predicts that in the second half of 2015, there will be an increase in attacks from malware-embedded applications targeting mobile devices. Mobile devices are particularly vulnerable as mobile device security is in its nascent stage, while on the other hand; there is a significant growth in smartphone users and an increase in mobile usage for business.
Another area of concern in this period is an intensification of zero-day attacks that target application vulnerabilities.
In this report, we provide information about the five most significant security issues that have been detected in 2015 so far. Then, we provide a forecast of the major threats expected in the second half of 2015 based on research conducted by the AhnLab Security Emergency Response Center (ASEC).
​