Hi everyone.
I'm Chris.
And welcome back to my.
Course on Enterprise Security fundamentals in this lesson we are going to discuss about the attackers
objective so let's briefly have an overview of this concept when developing a red team versus blue team
exercise.
It is important to specify the red team's objective.
The objective is the overall aim of the exercise and red teams may have more than one objective in an
exercise.
When organizations are starting out with red team blue team exercises they should limit the objective
so that exercises do not become overly complicated.
Was the red team blue team exercises become more established.
The outcome of the exercises with more complex and difficult objectives will become clearer in both
red team and blue team are unexperienced and the red team is pursuing a set of complex objectives.
It will be difficult to conclude whether the organizational infrastructure is indeed secure or if the
red team wasn't just organized or capable enough to be able to exploit vulnerabilities attackers and
red teams can have more than one objective in an exercise when engaging Red Team says penetration testers
from outside the organization.
Ensure that the objectives are clearly stated before the exercise begins.
A red team blue team exercise is different from a security audit for example where an external group
of penetration testers examines an organization's configuration and generates a report detailing the
vulnerabilities and problems.
There are a set of common objectives that the attacker pursue whether it's in a red team blue team exercise
or in real life.
So these are persist presence steal data hex torsion ransomware Quinn Quinn miners and destroy systems.
We will go through each of these objectives in just a short period.
But I would like to discuss and a little bit about them like an overall idea and also some examples.
So what is the attackers objective well what the objective of the attacker is really depends on the
attacker.
And sort like asking how long's a piece of strength.
First thing is to try to understand you are dealing.
If you are dealing with amateurs that is people are into doing it because that's their profession or
they're part of a team that actually does this for a living.
Is it a disinterested person.
Does doing a one off attack or someone that's actually trying to monetize their attack and is doing
it professionally.
And the truth is that the vast majority of attackers are not doing it professionally.
Now their initial objective might be just to get in and see what's available.
That is their reconnaissance ing your network and they get persists presence and like figure out what
they're doing from their
let's take an example and see all is this organization a good ransomware target.
And as we learned from the previous lessons when we were discussing ransomware it could be that we know
that the organization have an effective backup strategy and that makes the organization a poor ransomware
target because they will be unlikely to be the ransom so maybe the attacker decides to disrupt the backup
process or maybe not.
Or it might be there.
There's a whole lot of powerful use and use that they're just sitting there in the organization's data
center that really aren't being taxed.
And you know this might make a good little earner of crypto currency
if their objective is to steal data.
Well most of the time when someone wants to steal data are they actually know what the data is.
If they want to steal data and basically this type of attacks is much more frequent with insiders because
the insider knows what data is that they want and then they're going to go and steal the data.
It might be some sales information.
It might be some confidential information that they sell it to your competitor but if you're outside
the organization and you don't know anything about the organization you're not going to have a really
good idea about the sort of data that they're hosting.
It is possible that they might just attack an organization to get in and then it's like finding the
needle in the haystack.
They just scroll around through there find something interesting.
But most attackers don't have that sort of time because there are so many targets out there unless you've
got a really really targeted attack stealing data is something that you usually do when you know what
the data is before you try and steal it extortion with extortion or let's think about it this way with
extortion attacks.
It's things like the person for example who pulled the infidelity website credentials and was using
that as a threat against the Web site and saying look you need to close down or we're going to basically
spill your customer data all over the Internet.
So they were trying to achieve a particular objective and they were going to achieve that objective
through threats another example of extortion would be when the attackers got access to on air the episodes
of Game of Thrones and they threatened to release them unless they were beat a particular feat.
And of course the way that company dealt with it is they refused to go and be the then we've got ransomware
or and as we have previously learned
ransomware of course goes and encrypted data.
But we also know from the previous lessons that we had
about ransomware that only 37 percent of organizations paid the ransom and of that started thirty seven
percent.
Only half got access to the files in the end.
Are in the past.
Ransomware has been lucrative enough that there are assumed to be several ransomware billionaires in
the world so that could be the attackers objective because to a certain extent there's never going to
be that every organization gets its back up house in order.
But you would think after suffering several ransomware attacks that they figured out how to recover
from one without actually paying the ransom itself.
Now as I said let's go through each and one of these concepts that we talked about with examples and
get a better understanding of them.
Persist presence when an attacker can persist their presence on Target's organization information systems.
It means that they have reliable remote access via backdoor to the target organization systems.
This compromise system is also termed beachhead or a foothold in security language as it is the initial
location through which the attacker gains access to the target organization's network rather than executing
the attack.
The moment that a foothold has been reached competent attackers often set up the digital equivalent
of a base camp let's say from which they are able to reconnaissance the target's organization's infrastructure
and systems.
Many attackers spent months examining a network just to determine what existing security and monitoring
systems are in place before they actually begin to take actions that will achieve their objectives.
Once a beachhead or a foothold is established and the attackers have an accurate picture of the target's
organization infrastructure the attacker can then upload and deploy their exploit toolkit to a location
on the target's organization network.
The attacker can you then use the tools in the toolkit to move laterally across the target's network
compromising further systems and elevating privileges
the attackers the objective to steal data.
It's one of the oldest types of attacks in the
past.
In the past years
so for example in the case of the 2013 target data breach attackers were able to successfully expel
trade credit card data from the merchant and sell those credit card numbers on the dark web.
Other well-known breaches involving the stealing of data have involved the internal communication of
political parties that have later been publicly released as a method of discrediting the authors of
that communication.
There are a variety of methods that can be used to steal data from being able to extract information
from databases using SQL injection attacks through to the exfiltration of entire virtual machines when
attacker gained control of the virtualization infrastructure.
Export production virtual machines and then upload the exporting of virtual machines files to the Internet
extortion extortion is the term for the process that occurs when an attacker compromises the target's
network and then requests payment for a specific action to be taken.
This action of course might be for the attackers to destroy sensitive data they excel treated rather
than exposing that data to the public.
Another reaction might be to return command and control target organizations infrastructure to the original
owner.
Extortion can include data theft though specifically involves the financial demand being placed on an
organization rather than having the data sold or released to the public.
Without such demand being made the red team might simulate an attack where extortion is the objective
pursued either by exfil data or taking control of the target.
The organization's infrastructure as proof that the organization was vulnerable to this approach one
recent example of extortion or occurred when a group of attackers compromised the information system
of a popular television production company and threatened to release the digital copies of on air episodes
of popular TV shows to file sharing sites unless an extortion payment was made.
Another example of extortion involved attackers who attacked dating sites extracted personal data and
then threatened to expose that personal data to the public unless payments were made or certain actions
were taken.
Yet another form of extortion occurs when administrative accounts of cloud service providers are compromised.
When this occurs the attacker threatens to delete all infrastructure hosted in the account unless a
ransom is paid within a certain short period of time.
This period usually being the less time than it would take for the attacked organization to recover.
Administrative control through the cloud service providers support mechanisms.
The next one is ransomware.
Ransomware also known as crypto where encrypts files and sometimes entire organization operating systems
so that they are inaccessible unless this bus special decryption key is provided.
The attackers will provide the decryption key that can be used to recover the encrypted systems but
for a fee usually in cryptocurrency like bitcoin the red team's goal might be to install ransomware
as a method of demonstrating that the organization's infrastructure was vulnerable to this type of attack.
Ransomware is effective because many organizations do not have a comprehensive data backup and recovery
strategy.
Organizations are faced with the choice of losing almost all their data or paying the ransom fee to
have the data rapidly recoverable.
Recent surveys indicate that approximately 60 percent of organizations suffered some form of ransomware
attack back in 2016.
Reports also indicate that ransomware can be very lucrative to the attacker which is one reason why
ransomware attacks have become more prevalent
Goodall Colin Quinn miners Quinn miner.
Malware is software that it is used to perform calculations associated with crypto currencies such as
bitcoin.
Rather than run a quaint mining software on their own infrastructure with its attendant costs in hardware
and electricity coin mining attacks involve attackers running cryptocurrency mining software on the
infrastructure of the compromised organization the red team's goal in an exercise might be to install
coin mining malware simulating this type of attack.
The payoff for the attacker is that they can generate crypto currency using the compromised infrastructure
with the attacked organization providing CPR resources.
Another advantage of this type of attack is that unless an organization has a comprehensive and effective
monitoring solution it's possible for the coin miners to run quietly in the background generating income
for the attackers for some time without the target organization becoming aware that anything amiss.
And lastly destroy systems the objectives of some attackers is to destroy systems and basically destroyed
the infrastructure of the target organization.
This is possible because certain types of malware can execute code that causes harm to storage memory
CDU and networking hardware devices this code functions by pushing those devices beyond their tolerances
for example causing memory or Seaview to overheat and fail this type of attack has also been used by
state actors against industrial equipment.
For example when the Stuxnet was used to attack centrifuges in Iranian nuclear facilities
I will see you in the next lesson where we'll be diving in to the concept of the red team's skill chain.
I hope this has been informative for you.
Thank you for watching.