by clicking on the page. A slider will appear, allowing you to adjust your zoom level. Return to the original size by clicking on the page again.
the page around when zoomed in by dragging it.
the zoom using the slider on the top right.
by clicking on the zoomed-in page.
by entering text in the search field and click on "In This Issue" or "All Issues" to search the current issue or the archive of back issues respectively.
by clicking on thumbnails to select pages, and then press the print button.
this publication and page.
displays a table of sections with thumbnails and descriptions.
displays thumbnails of every page in the issue. Click on a page to jump.
allows you to browse through every available issue.
GCN : January 2015
IT’S GETTING A LOT HARDER to be impressed by the latest piece of malware or cyber threat that hits the streets, given the already formidable arsenal that has been created for hackers to choose from. The every day distributed denial of service (DDoS) threat now seems almost quaint. Then along comes Regin. To be more precise, along comes Backdoor.Regin, recently discovered and de- scribed in detail by Symantec. What astounds about this Tro- jan is not just its complexity, but the time it’s taken for it to mature into its current state. Symantec has traced at- tacks back to at least 2008, and some reports suggest components of Regin go as far back as 2003. That takes the definition of Advanced Persistent Threat (APT) to a new level. And it may go even further since Symantec warns that analy- sis of it will probably reveal much more. “Threats of this nature are rare and only comparable to the Stuxnet/Duqu family of malware,” it said. “Many components of Regin remain undiscovered, and additional functionality and versions may exist.” The company describes Backdoor.Regin as a multi- staged threat, with all but the first stage hidden and encrypted. It also uses a modular approach and can be tailored with custom features for specific targets. Based on what’s been discovered so far, it has dozens of potential payloads. In its own analysis, security researcher Kaspersky Labs said malware is not an ac- curate description of Regin. It should instead be seen as a cyberattack platform, which attackers deploy to gain total remote control of networks at all levels. According to Kaspersky, Regin is one of the most sophisticated it has analyzed. “ The ability of this [Regin] group to penetrate and moni- tor [Global System for Mo- bile] networks is perhaps the most unusual and interesting aspect of these operations,” the company said. “Although GSM networks have mecha- nisms embedded that allow entities such as law enforce- ment to track suspects, there are other parties which can gain this ability and then abuse it to launch other types of attacks against mobile users.” GSM is the most wide- spread mobile standard, and has over a 90 percent share of the world’s mobile market. Other than the United States, which primarily uses the Code Division Multiple Ac- cess (CDMA) standard, most countries that have mobile networks use GSM. At first glance, one would think that makes the United States safe from Regin at- tacks. Looking at the list of infections so far, big countries such as Russia and Germany are among the victims, along with some smaller ones. The United States is notably absent. But as it turns out, that shouldn’t necessarily of- fer any comfort. As recent column here indicated, many of the most sophisticated attacks now come through the exploitation of privileged network accounts. That means that while government organizations may not be di- rect victims of an attack, if at- tackers get into the network of a trusted partner, they can eventually get to government data. With the kind of global reach that government agencies now have to have to do business – even at the state and local level – no one should presume they are safe from bad guys getting into their networks and systems and stealing data. And even if they haven’t been directly attacked, that doesn’t mean their partners have not been, nor the trusted partners of those partners and so on down the line. Defense-in-depth has become the solution du jour for protecting data from malware and Trojans such as Regin that organizations now have to assume will penetrate their networks. Perhaps that should now be extended to a “defense-in-breadth” in order to cover vulnerabilities posed by threats outside the organization. Modern organizations, including government agen- cies, have to do business with those lateral partners, so it should make sense to have such protections in place. • What astounds about the Regin Trojan is not just its complexity, but the time it’s taken to mature; some reports suggest components of Regin go as far back as 2003. Cyberattack ‘platforms’ call for defense in depth – and breadth BY BRIAN ROBINSON CYBEREYE GCN JANUARY 2015 • GCN.COM 17 0115gcn_017.indd 17 1/8/15 4:11 PM
November and December 2014