[ISN] Guard against Titan Rain hackers

[InfoSec News]

http://www.computerworld.com/securitytopics/security/story/0,10801,105585,00.html

Opinion by Ira Winkler
OCTOBER 20, 2005
COMPUTERWORLD

At the moment, there's a dirty little secret that only a few people in
the information security world seem to be privileged to know about, or
at least take seriously. Computers around the world are systematically
being victimized by rampant hacking. This hacking is not only
widespread, but is being executed so flawlessly that the attackers
compromise a system, steal everything of value and completely erase
their tracks within 20 minutes.

When you read this, it almost sounds like the plot of a cheesy science
fiction novel, where some evil uberhacker is seeking world domination,
while a good uberhacker applies all his super brain power to save the
world. Sadly, this isn't science fiction, and we don't typically have
uberhackers on our side.

Talk of these hacks is going on within the intelligence and defense
communities in the U.S. and around the world. The attacks were even
given a code name, Titan Rain, within the U.S. government. The
attackers appear to be targeting systems with military and secret
information of any type. They are also targeting the related
technologies.

But I'm not just talking about government systems. There are a variety
of industries that support the government. For example, automobile
companies make tanks and other military equipment. Food service
companies supply military rations. Oil companies provide fuel to the
government. Companies with personal information on federal employees
can be exploited to identify undercover operatives.

That also brings up other potential targets, as the attackers are
necessarily limiting their sites on apparent military systems. Oil
companies know where potentially valuable oil reserves might be.  
Telecommunications companies have details about satellite
communications and new technologies for improving communications
reliability and bandwidth. Any organization with intellectual property
worth protecting is a potential victim of these attackers.

I only present the above facts to demonstrate that most companies can
expect to fall victim to the attackers. Way too many companies believe
that they have nothing to fear or nothing of value that sophisticated
attackers would want. The fact of the matter is that these attackers
are extremely indiscriminate in whom they compromise.

The critical issue is the identity of the attackers. The source of the
attacks will tell you how much you have to be worried about.  
Initially, the attacks were traced to China, which told investigators
very little. There are so many poorly secured computers in China that
many hackers use China-based systems as relay points for their
attacks. So despite the fact that all attacks went through China,
there was little evidence to conclude that China was responsible. That
was until Shawn Carpenter, a security analyst at Sandia National
Laboratories, decided to pursue the attacks after being told to drop
them by his superiors.

Using computer forensics techniques and hacking into the offending
systems, Carpenter was able to use the compromised systems against
themselves and find the actual origin of the attacks. Doing things
that official government agents could not, he determined that the root
of the attacks was China. He set up the attack systems to report back
to him what the attackers were doing and also performed analysis of
the attacks. Based on the volume of the attacks, he determined that
there were anywhere from six to 10 people hacking around the clock.

Given the skill and the size of the operation, there could be only two
sources of the attack: the Chinese intelligence agencies or the
Chinese triads (a.k.a., the Chinese Mafia). As I describe in my book,
Spies Among Us (Wiley, 2005), China as a government vacuums up
whatever information it can for potential value. Chinese triads
examine whatever they can get for profit potential, whether it's to
extort money or to sell to the highest bidder. Even worse for
non-Chinese entities, the Chinese government cooperates and exchanges
information with the triads.

The information is used against its victims in a variety of ways. Many
companies, both high- and low-tech, find themselves competing against
Chinese companies that somehow seemed to invent the exact same
products or technologies, but that don't seem to care about recovering
research and development costs. Companies operating in Southeast Asia
seem to be one step behind the Chinese triads and end up paying a
great deal more for their operations than they would have expected.

Companies that aren't directly involved are still enablers for the
attacks, allowing the Chinese hackers to compromise other
organizations and national security.

Despite the level of sophistication of the attacks, most of them are
completely preventable. That includes the attacks on the government
and contractor systems. They are exploiting some vulnerabilities that
are unknown to the general security community. However, they only
resort to those when all else fails, and that isn't very frequently.

Generally, though, even the "unpreventable" attacks could be prevented
in some ways. For example, unnecessary services on a computer can't be
exploited if they aren't running. Firewalls don't have to let
unnecessary traffic through. There are many things organizations can
do to protect themselves by adding defense in depth.

Given the current diplomatic situation between the U.S. and China,
Titan Rain attacks will continue to proliferate in the foreseeable
future. It's essentially a vacuum of cyberspace by the Chinese.  
Unfortunately, we are relying on uberhackers, like Shawn Carpenter,
who are few and far between, to protect us.

It's up to CIOs and other IT managers to ensure that their companies
practice good systems-hardening procedures, along with applying
defense in depth throughout their entire organization. While people
may think of Titan Rain as just applying to organizations with
high-tech or national security interests, the fact is that since every
organization faces the same wide threat landscape, you can't ignore
basic security practices.

The sad fact is that if you're hit by the Titan Rain hackers, you'll
likely never know about it. Even worse, though, is that you are more
likely to be hit by other attackers who will cause blatant damage to
your systems and business. The good news is these attackers are less
talented and can more easily be stopped by basic security measures.

-=-

Ira Winkler is president of the Internet Security Advisors Group. He
is a former National Security Agency analyst and the author of Spies
Among Us (Wiley, 2005).