{"id":4102,"date":"2013-11-04T13:43:13","date_gmt":"2013-11-04T21:43:13","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=4102"},"modified":"2013-11-05T16:18:57","modified_gmt":"2013-11-06T00:18:57","slug":"anonymous-targeting-asian-government-sites","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2013\/11\/anonymous-targeting-asian-government-sites\/","title":{"rendered":"Anonymous Targeting Asian Government Sites"},"content":{"rendered":"

Guy Fawkes Day is Tuesday, and a variety of loosely affiliated movements from Occupy to Anonymous are joining to commemorate the day with a Million Mask March. However, it seems that Anonymous or at least Anonymous affiliated hackers in Asia have decided to get an early start on the festivities with a variety of attacks against government websites<\/a> in Australia, Singapore, and the Philippines.<\/p>\n

Thus far, these attacks all bear the unmistakable signs of hacktivism, in that the compromised sites were defaced with political messages. Obviously, these sorts of attacks are nothing new, and we have been seeing a bit of their resurgence in the past few months. Prior to this action from Anonymous, the Syrian Electronic Army or SEA had claimed responsibility for a string of attacks targeting large news media organizations ranging from the New York Times to Twitter.<\/p>\n

Whenever one of these attacks makes the news, it always seems to spur questions about how such a thing can continue to happen. I wanted to briefly share some of the more common tactics we are seeing against legitimate websites.<\/p>\n

Direct Attack
\n<\/b>First, it\u2019s important to realize that websites, and more specifically web servers, are very common targets for attackers. If the website accepts input from an end-user, that site can be subject to a variety of injection techniques that can allow an attacker to compromise data that the website serves, or ultimately compromise the server itself. These attacks will typically exploit a weakness in the way that the website or application validates a user\u2019s input, which allows an attacker to send specially crafted input to compromise the webserver or application. These attacks are extremely common, and are generally mitigated through a combination of IPS to detection injection attacks, web-application firewalling to detect specific attacks against web applications, vulnerability testing of websites, and training to ensure secure coding and web development practices.<\/p>\n

Password Compromise
\n<\/b>Ultimately, people manage websites, and those people will have passwords to authenticate themselves when managing the site. If an attacker can compromise those credentials, then the attacker gains all the privileges and access of the administrator. This technique was heavily utilized earlier in the year when the SEA was able to steal Twitter credentials for news organizations and was able to send out fake news updates that caused significant movement in financial markets.<\/p>\n

This approach can somewhat bridge the gap between hacktivism and the more advanced threats or APTs. To steal a valid user\u2019s credentials, attackers will send targeted phishing emails in order to lure the user into entering their credentials into the attacker\u2019s website or to deliver malware to the target that will steal the user\u2019s password from the local machine. This approach includes some of the basics of an APT, but ultimately the goal is still to gain notoriety for the attacker. Mitigating these attacks requires a complete approach to cybersecurity capable of blocking all types of malicious traffic and content ranging from drive-by downloads, exploits and malware to command and control traffic and malicious URLs, as well as proactive testing of any unknown files or traffic to expose hidden threats. Additionally, end-user training can help users learn to recognize phishing attempts, and two-factor authentication should be implemented to protect web resources from simple password compromises.<\/p>\n

DNS Hijack and Redirect
\n<\/b>Stealing passwords can be useful for an attacker in a variety of ways. The SEA attacks against the New York Times and variety of other sites provided a stark case in point earlier this year. In that case, instead of stealing passwords from the New York Times directly, the attackers targeted the DNS registrar that the Times uses for its websites. In short, the attackers didn\u2019t really attack the New York Times directly at all \u2013 they simply broke in to Melbourne IT (the DNS registrar for the New York Times) and changed the DNS record for nytimes.com to point to an IP address in Syria.<\/p>\n

An attack such as this is obviously hard to control from an IT perspective simply because the attack never directly touches the intended target. That underscores the importance of choosing a registrar that asks thorough, pointed questions about how security is handled by the vendor. Many registrars will offer additional safeguards and locks that make it far more difficult and time-consuming to make any domain level changes to an account, although not all registrars do this.<\/p>\n

Ultimately, there are plenty of methods that can be used by hacktivists to compromise a site and its data. Hacktivism season seems once again in full swing, so it\u2019s crucial to know what you\u2019re up against and safeguard your data as much as possible.<\/p>\n

<\/div>\n","protected":false},"excerpt":{"rendered":"

Guy Fawkes Day is Tuesday, and a variety of loosely affiliated movements from Occupy to Anonymous are joining to commemorate the day with a Million Mask March. However, it seems that Anonymous …<\/p>\n","protected":false},"author":40,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[155],"tags":[206,205,207],"coauthors":[889],"class_list":["post-4102","post","type-post","status-publish","format-standard","hentry","category-cybersecurity-2","tag-guy-fawkes-day","tag-hacktivism","tag-million-mask-march"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/4102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/40"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=4102"}],"version-history":[{"count":2,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/4102\/revisions"}],"predecessor-version":[{"id":4104,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/4102\/revisions\/4104"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=4102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=4102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=4102"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=4102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}