Silent hacker attacks and the need for detection mechanisms

Again and again, we read about hacking incidents where attackers can spy on a company, an authority or a ministry and remain unnoticed for months without affecting the systems. In this blog post we are explaining what a silent hacker attack is and how you can prevent it!

Imagine the following scenario: A company has been infiltrated but knows nothing about it. Sensitive data flows into the hands of cybercriminals; either intellectual property (industrial espionage) or personal data used for criminal activities such as credit card fraud through identity theft. If the infiltration is noticed and becomes public, it is already too late for the company concerned. the costs of rescuing the systems and eliminating the defects are performed by data protection law penalties and the reputation damage of the company's image toward their customers, suppliers and other business partners.

A. Silent hacker attacks: why do they take place undercover? 

• Targets of the cyberattacks are e.g. the targeted spying for a later attack,
• the collection of valuable information (e.g. for later sale) or
• (industrial) espionage.

So we are not dealing with quick and obvious blackmail by data encryption or a compromise of the systems, which means an immediate loss of work and data. At least not yet.

B. How do you recognise the intruder during silent hacker attack?

Let's take a step back. Did the controls fail before?

Experts largely agree that despite protective measures such as firewalls, anti-virus protection, application or interface controls, 100% protection is not possible against silent hacker attack. Malware and attack methods are simply evolving rapidly and people are falling into (increasingly sophisticated) traps.

C. 9 Common types of silent hacker attack

1. DoS and DDoS attacks – they are known as denial-of-service (DoS) and distributed denial-of-service. They are design to overcome resources of the system to drain them until it is unable to reply to a legitimate service request.
2. Password hacker attacks – this type of hacker attack is based on either by intercepting network transition or by simply guessing target’s password.
3. URL Interpretation – is altering and fabricating URLs in order of getting an access to site’s backend.
4. DNS Spoofing – is known as a Domain Name System Spoofing which is based on altering its records and sending traffic to a fake website.
5. Web attacks – this sort of attack is referred to the threads that target vulnerabilities in web-based applications.
6. Trojan horses’ attacks – they are one of the most known hackers attacks types. Trojan horse attack is based on adding a malicious, hidden program into superficially good-looking one. It took its name from Greek attack into Troy.
7. Drive-by attacks – in this type, an attacker adds malicious code into an insecure website. While users are visiting the page, implemented code immediately infects computer.
8. Eavesdropping hacker attacks – they are based on the inserting a piece of hacker’s software into the network traffic path to get your data so attacker can ‘eardrop’ your actions.
9. Birthday attacks – in this type of attack, hacker tries to abuse hash algorithms (known as your digital signatures) which are the ones verifying the message’s authenticity.
   
   

D. Silent hacker attacks: Living-off-the-Land-Attacks

Furthermore, not all silent hacker attacks are carried out by explicit malware. So-called Living-off-the-Land (LotL) methods largely make use of what is already present in the environment. There is no need to develop malicious files from scratch. Rather, they exploit entry points that already exist in IT systems.

This tactic can achieve several things: First, they often bypass traditional protection systems - virus scanners do not raise an alarm when software appears to be secure. In this way, they allow cybercriminals to infiltrate IT systems unobtrusively and thus often unnoticed. Even if an infiltration case is detected, under these circumstances it is much more difficult to identify where the attack comes from. Many traditional cyber security solutions are not able to detect dangerous behaviour when performed with tools that are considered legitimate.

E. How can you track silent hacker attacks?

The analysis of behaviour and the search for abnormalities are particularly relevant in this context. Endpoints (end devices such as PCs, laptops, mobile devices) must be continuously monitored.

Events on the end devices and in the system should be analysed to identify traces of hackers, determine employee misconduct and detect security gaps.

With the help of definable rules, security managers should be able to set up which events can be reacted to with which behaviour, e.g. by defensive behaviour such as shutting down processes. This relieves the burden on IT departments, which are often deployed on many fronts.

Find out more on EDR Security Platform in our blog post!

F. What are the features of an EDR solution? 

• Detection and containment security incidents, not just file-based malware.
• Security incident investigation and threat detection.
• Provision of response options for recovery after a security incident.
• Prediction of potential security breaches, e.g. the current security status of an endpoint is displayed and advice is given on how to avoid threats.