Operation Shady Rat ( Remote Access Tool )

Jane of Blacksuit Computing was brought on as a junior developer into the organization to replace another individual who left on “okay” terms. Given a workstation laptop (at the end of the Christmas holiday), Jane was advised that she could download any software required for development purposes. However, the organization’s Network Security Monitoring team reported suspicious traffic to and from her computer. This was the triggering event leading to the authorization of a forensic investigation to identify the source of the suspicious traffic and determine whether any sensitive corporate data was compromised.

In conclusion, this paper discussed the popular topic of active defense and how traditional defenses aren’t very adequate anymore. Next this paper discussed honeypots used to deceive attackers. This paper also discussed Computer Network Attack and Computer Network Defense and the legal impacts between the two. Lastly this paper discussed the pros and cons of active

After initial intrusion malicious software is installed on victim host that is re-ferred as RAT (remote access Trojan). RAT takes the responsibility to connect with attacker and regularly performed the actions that instructed by attacker. At this intruder take the full command and control (C2) over target host. The fact is that the initial connection is established by victim host, not by the attacker [6]. This will happens mainly for two reasons: (i) organizations firewall usually allows the connections initialized by internal hosts, and (ii) this will help the attacker to not to detected easily. Because intrusion detection systems [7] can easily detect the extremely suspicious activity such as downloads from outside hosts.

The most common operating system, Microsoft Windows is used to connect the systems to the internet and hence contains various vulnerabilities. Internet Explorer, MS-SQL, file serving and message processing services are the most commonly exploited services of the operating system. There is no operating system that does not contains vulnerabilities and exposures and cannot be targeted by the hackers and viruses. The vulnerabilities in Windows are more popular because of the huge number of machines running it. (Zibstev

Malware, or “malicious software”, has taken different forms and names for years. Spyware and viruses are just a few of the common titles attributed to this devastating means of cyber attack, the main purpose of which is to ultimately compromise a rival's computer infrastructure. State-sponsored attacks have typically been perpetrated by means of malware. Spear-phishing is one particularly popular means of malware, where by a target is fooled into opening a corrupted email or file, only to unwittingly download a compromising piece of malware onto their computer (XX). Once this malware is installed, control of the computer is placed in the hands of the hacker, allowing them to hack other networks while proving impossible to track down (XX18). China has been a prime culprit for spear-phishing attacks, often following current events to target respective dignitaries. For instance, the 2010 G20 Summit saw thousands of spear-phishing campaigns against officials, with email titles labelled in relation to the Summit itself (XX). Countless departments, institutions, and governments have fallen victim to spear-phishing campaigns, at the count of millions of dollars and priceless information

On December 15, 2013, Target released a statement confirming that malware had been installed and that most of it eliminated. Accordingly, reports indicated that Fazio computer approved the proposal of project management and the intruders’ compromised agreement publicizing to the company reportedly, the report reads. Besides, media reports indicated victimization of Fazio for phishing email comprising the malware Target used for installing another malware on the system of target, together with Target’s Point of Sale (POS) system used in recording transactions of cards and all payments. Cybercrime or internet hacking, according to Computer Crime Research Center Aghatise E. Joseph, is an internet crime committed using a computer as a tool or a victim targeted. Notably, it is much challenging to categorize general internet crimes into distinct groups since most cybercrimes evolve on a daily basis.

Times have changed what was known as organized crime has been replaced by Cybercrimes (Heists: Cybercrimes with Ben Hammersley). Cybercrimes have risen dramatically in recent years and have become a major issue the United States and company’s face today jeopardizing as well as threatening the critical infrastructure of America (Cyberwar Threat, 2005). Sadly, the status quo of cyber security is very unstable with the advancements and growth which has put most individuals and businesses into an enormous threat (Agustina, 2015).

Cyber security is critical in any business or organization. The purpose for cyber security is in the name, “security”. All types of information that are important or ment to be secured requires cyber security to defend it. For example if you submitted personal information online regarding maybe your address or even perhaps your social security number, you would not want that information falling into the wrong hands. So I will begin to talk about a cyberattack and how it was executed. The OPM data breach ( office of personal management ). 21 million current and former federal employees had their personal and highly sensitive private information stolen in a massive data breach that highly affected

In 1997 the National Security Agency (NSA) tested the Pentagon’s cyber security in an exercise named “Eligible Receiver”. Within two days of the exercise, the NSA team had penetrated the classified command network and was in complete control of network. Two years later, the United States Air Force experienced a computer breach in which huge amounts of data were being exfiltrated from research files located on airbases. “Gigantic amounts of data were being shipped out from a lot of computers in the Defense Network and from many data systems in the national nuclear laboratories of the Energy Department.” (Clarke, p. 111) File case named “Moonlight Maze”, by the FBI day-lighted two important aspects of information security. Computer specialist

The information within this report will give the reader an in depth look into the cyber-mercenary group known as the ‘Desert Falcons’. They operate out of the Middle East, particularly Palestine, Egypt and Israel and are distinctly interested in the political and information landscape of their region. The Desert Falcons display limited scope for attacks against major powers at this point in time, rather, they concentrate their attacks on local power players. This includes local government and military targets in addition to powerful individuals in the area. The group has been credited as having had designed a native scripting language and being capable of complex social engineering attacks. The information taken from the targets is usually of a sensitive or confidential nature and, therefore, is used by Desert Falcons to blackmail the people and organisations the information was taken from. The main technique used to gain this information is that of a Trojan virus embedded within a social engineering attack that gains the trust of the victim before unloading the Trojan virus’s payload. Attacks against targets include high ranking military personnel, financial, media and even government departments and pivotal personnel have been recognised as the Desert Falcons because they have taken responsibility over them and have demanded ransoms for the attacks. The Desert Falcons face several different limitations within their organisation. These limitations stem

Two of the common known attacks on computing systems are the deployment of computer viruses and malware.

Advanced Research Corporation (ARC) has grown quickly in the last five years. During that time, ARC has seen a large expansion in its data and communications network. Because of its success, ARC has seen cyber-attacks on its network with attempts to steal its

Cyber-attacks are common in the defense industry, but in January 2010, a sophisticated, advanced persistent threat hacked into the commercial sector forever changing the face of cyber security. Dubbed “Operation Aurora” by McAfee, the attack targeted specific high profile corporations to obtain valuable intellectual property. Google, Yahoo, Juniper Networks and Adobe Systems were also among the victims of this highly coordinated cyber heist. By manipulating computer codes the attackers were able to exploit the Microsoft Internet Explorer vulnerabilities to gain access and obtain valuable sensitive information from over thirty high profile companies. Operation Aurora proves that the world is entering into a high-risk era where

As technology improves, opportunities and challenges also increase. We have become a technology-dependent society because of the numerous benefits it brings. However, it has become a focal point for cyber-attacks, cybercrime, and industrial espionage. Cases of ransomware have increased since most of the cybercriminals have now developed tougher-to-prevent means of creating money through cyber-attacks. For an organization who has been a victim of such attacks, the damage caused can be very severe. For example, the ransomware can paralyze business activities of an organization. These attacks are not only target corporates but may also target small business and specific people. Any company or individual with access to critical data should worry

Just like a biological virus, a computer virus is able to infect and ruin lives. This malicious software constitutes more than just simple viruses but also includes other types of software including worms, Trojan horses, and ransomware. Malware has been around since the late 1980’s. Originally, people became hackers to gain notoriety online, but today, it has become more of a business. Cyber attacks originate from all around the world, and it is not just individual people that benefit from it. In two decades, numerous cyber crime syndicates have been created, and states all over the world sponsor hacker groups. Over the past twenty-five years, malware has become less about checking the integrity of computer security and gaining notoriety in the underground cyber society, and it has become more of a chaos creating, money making business that many people and institutions take part in.