How Cybercriminals Are Getting Initial Access into Your System
This article covers the main techniques cybercriminals use at the initial stage of attacks against enterprise networks.
There are several dangerous phases of cyberattacks targeting the corporate segment. The first one encountered by businesses boils down to getting initial access into their systems. The malefactor’s goal at this point is to deposit some malicious code onto the system and make sure it can be executed further on.
Drive-by downloads
Description: The gist of this technique is to dupe the victim into opening a website hosting various browser and plugin exploits, obfuscated frames or malicious JavaScript files that can be downloaded to the target system beyond the user’s awareness.
How to protect yourself:
- Use up-to-date web browsers and plugins and run an antimalware solution. Microsoft recommends using Enhanced Mitigation Experience Toolkit (EMET) and Windows Defender Exploit Guard (WDEG.)
Exploiting public-facing applications
Description: This method involves known glitches, bugs and vulnerabilities in applications with open network ports (SSH network services, web servers, SMB2, etc.) The top 10 web application vulnerabilities are being regularly published by OWASP.
How to protect yourself:
- Use firewalls.
- Perform network segmentation with DMZ.
- Follow safe software development practices.
- Avoid issues documented by CWE and OWASP.
- Scan the network perimeter for vulnerabilities.
- Monitor logs and traffic for anomalous activity.
Hardware additions
Description: Computers, network appliances and computer accessories may go with covert hardware components tasked with providing initial access. Both open-source and commercial products may include features for stealth network connection, MITM (man-in-the-middle) attacks implementation for encryption cracking, keystroke injection, reading kernel memory via DMA, adding a new wireless network, etc.
How to protect yourself:
- Adopt policies for network access control such as certificates for devices and IEEE 802.1X standard.
- Restrict the use of DHCP to registered devices only.
- (Read more...)
*** This is a Security Bloggers Network syndicated blog from The State of Security authored by Tripwire Guest Authors. Read the original post at: https://www.tripwire.com/state-of-security/security-data-protection/how-cybercriminals-getting-initial-access-system/