It’s happening right now in clandestine labs around the world: an old warehouse in an abandoned industrial park in Russia, a government-supported facility in North Korea, maybe even the basement of an unremarkable house in a working-class St. Louis neighborhood. The outward appearance doesn’t matter, nor does the location. Inside the building is some of the best technology money can buy, and the people are skilled and proficient at what they do. Are they trying to create the next synthetic “designer” drug? Are they some off-the-grid genetics lab engaged in unregulated research, or terrorists developing a bio-weapon?
These people are (hypothetically, of course) developing a pathogen of sorts, an extremely virulent pathogen. Once it is released it has the potential to infect nearly 100 percent of the systems to which it is introduced, and as is the case with many novel infections, this one will run wild until we find a reliable method to detect it and render it harmless. But it’s not a germ, and humans are not the target hosts.
It’s known as a zero-day vulnerability or exploit – a new, previously unknown hardware or software vulnerability that will allow its user unauthorized (and at least initially undetected) access to your systems. There are some correlations between it and a new pathogen in humans. A novel virus introduced into a virgin human population would likely have an extremely high morbidity rate because the people would have no natural immunity to it. Their immune systems don’t recognize it and require time to adapt. Likewise, a computer system that does not recognize malware, a worm, or a virus will allow it to run in the same manner. Up until well into the 19th Century, Cholera outbreaks were spread by contaminated water, and only after people discovered contaminated water was the vector for infection did serious inroads against Cholera begin. A zero-day vulnerability acts similarly, like a vector for the infection of your network. If you don’t recognize the vector – the vulnerability that makes this infection possible – how can you repair it? And let’s face it: our ever-more-closely connected world is the ideal delivery system for a cyber-weapon. Click on the wrong link or open the wrong email and congratulations, you’re infected, even though there may be no “symptoms” and you may not realize it for some time.
If the bad guys have figured out a way into your system, how and when would you find out about it? If a threat actor has already accessed your network – right now – are you aware?
And once they’re in there, what are their intentions? Do they want to steal your data? Sure, that’s probably the most prominent concern. You don’t have to look very far or very hard to find stories about huge data breaches both here in the U.S. (Target, for example, or the breach of the federal government’s Office of Personnel Management database) and abroad (as evidenced by the March 2015 breach of the voter database in the Philippines). Destroy your data? Also a possibility; it’s tough to conduct any kind of business if you suddenly find yourself without your customer, personnel, or financial records. And if those haven’t been backed up or are not otherwise recoverable?
It’s not discussed often, but what if someone is intent on altering or manipulating your data – showing you information that isn’t real or isn’t accurate but which you still consider legitimate because it’s part of your system and you are unaware of the intrusion. Think about that for a moment. We’re understandably concerned with threat actors stealing our data – removing something – but are we looking just as hard for an unauthorized change or addition? Might your organization be about to make decisions based on data that appears to be authentic but has just been altered? Maybe you’re a pharmaceutical company and the drug you have under development – a drug which showed such early promise – turns out to be a dead end. Your stock price plummets and your investors fade away. You discover months later that someone accessed your system and altered research and development results from positive to negative. Of course, the damage has already been done.
A patient’s medical history is altered and a drug to which he or she is deathly allergic is administered anyway. A contractor submits sealed bids in which the pricing has been changed; the company loses business they should have been awarded. The email account of a company CEO is accessed, and emails from months and months ago are altered to make him or her appear to be a bigot. Those emails are then made public. “I was hacked!” contends the CEO, but everyone says that. The possibilities are endless.
You can change someone’s physical environment if you can change their cyber-environment. Think of everything you can do from your smartphone: turn on the lights in your home, set your thermostat, start your car, activate or deactivate your security system. An existing zero-day vulnerability on your phone might allow a cyber-criminal the exact same level of access and control, plus access to whatever else is linked to that device (your email accounts, your bank accounts, etc.).
Perhaps most frightening of all, it appears as though these zero-day exploits are becoming a commodity. The people who find or create them are not the end users. They are suppliers, selling the how-to-do-it instructions to the highest bidder in a fashion similar to the ransomware-as-a-service (RaaS) model that is becoming more and more pervasive. Ransomware encrypts all the files on an infected computer, and the malicious payload is generally delivered when the user clicks on what he or she believes to be a legitimate link. To receive the key that will decrypt your files, you have to pay a “ransom” via Bitcoin or similar crypto-currency. RaaS works when the actual author or developer of the ransomware is not the end user. The author intentionally develops the ransomware to be so very user-friendly that, once in their possession, anyone can deploy it. The original author and deployer then split whatever “profit” is obtained when people pay the ransom. A variation entails the developer loading the ransomware to a stand-alone server and then “renting” that server to a cyber-criminal or criminal organization for a specified period of time.
Intrusion detection will be critical. If a threat actor is accessing your system right now, do you know about it? If not, how long will it take you to detect that intrusion, and what damage will the bad guys be able to do within that time frame?
Jim Sharp, MPCP, is the vice president and chief training officer for Aegis Emergency Management. He is a highly sought trainer and speaker, consulting with organizations around the world on matters of emergency preparedness and operational resilience.
