Just as we have cybersecurity professionals working diligently to secure organizations and prevent the loss of information assets, there are also threat actors that offer offensive services such as commercial cyber surveillance or spyware as a service. Similarly, government-backed actors are acting at the behest of state surveillance agencies. Another breed of cyber threat actors identifying themselves as Hack-for-hire groups is also actively operating in the current cyber ecosystem. Below is more information on who they are, how they work, and what organizations and individuals can do to keep them at bay.

Who are the Hack-for-hire Groups?

Hackers as a whole need no introduction. As a subgroup, Hack-for-hire groups constitute experts who offer hacking as a service to entities not having the skills or the capability to do so. For instance, police and law enforcement agencies engage hackers to help them get breakthroughs in cybercrime. These kinds of experts are referred to as ethical hackers. On the flip side, different groups are offering hacking services to various entities to also carry out  illegal or illegitimate activities.

While ethical hackers offer services to genuine organizations to ward off infiltration from malicious actors, ‘hackers for hire’ groups generally offer their services to various entities in order to spy on their rivals and steal or corrupt sensitive information. For instance, when there is litigation between two companies, one of them may use the services of a Hack-for-hire group to infiltrate their opponent’s email account or information systems as a way to predict their next moves or learn something they can leverage against their competitors.

The Hack-for-hire entities either offer their services to a limited audience or advertise their services to anyone willing to provide proper remuneration, regardless of the final objective. Google’s Threat Analysis Group (TAG) has identified ‘Hack-for-hire’ groups from India, the UAE, and Russia to be among the foremost actors in this activity sphere.

Some Hack-for-hire groups masquerade as private investigators, whereas some work with the freelancing community to avoid employing their personnel directly. 

Are the Hack-for-hire Groups Similar to Commercial Surveillance Vendors?

Though the activities are similar, commercial surveillance vendors are different from Hack-for-hire groups because these companies sell their product to the user in order to operate and secure their information systems from cyber-attacks. On the other hand, the Hack-for-hire groups conduct cyber-attacks by exploiting security vulnerabilities and taking advantage of known cybersecurity flaws when undertaking their campaigns. As mentioned above, Hack-for-hire services usually help one entity to exfiltrate crucial data of its opponent. Therefore, they are also known as cyber mercenaries. The similarity of both these vendors is that they sell their services to others.

Whom do these Hack-for-hire Groups Target?

Hack-for-hire groups generally target high profile individuals, journalists, political activists, human rights activists, and other high-risk users globally, compromising their privacy, safety, and security. Besides, these cyber threat actors conduct cyber espionage and trade secret theft. Hack-for-hire services are not only offered at the corporate  levels but also at the individual level. The below graph shows the typical pricing for various hacking services. It could be hacking social media, changing grades on an educational institution network, or infiltrating personal computer systems to steal information. In essence, anyone can be a target for the Hack-for-hire groups. The following graph shows the average prices threat actors charge for providing hacking services, among which personal attacks, website hacking, and grades change are among the ones with the highest costs (Prices are in USD, converted from Bitcoin). 

(Image Source: comparitech.com)

How do the Hack-for-hire Groups Work?

TheHack-for-hire groups work in various ways. Google’s TAG has observed that the Indian Hack-for-hire entities use freelance actors and try to avoid getting involved directly. They also work with third-party investigative services as a way to maintain some form of distance between their work. Below are some examples that would help you understand how they work.

The Indian Hack-for-hire Entity

TAG has observed an Indian hand in the recent targeting of an IT business service provider in Cyprus, a Nigerian educational institution, a shopping mall in Israel, and a Balkan fintech company.

TAG has been tailing the Indian Hack-for-hire actors since 2012. It was found that the threat     actors have worked previously for Indian offensive security service providers like Belltrox and Appin. Additionally, a specific group belonging to them has targeted healthcare, government, and telecom sectors in Saudi Arabia, the UAE, and Bahrain with credential phishing campaigns. 

Sample AWS Phishing Interface

(Image Source: Threat Analysis Group | Google)

They have links with Rebsec, an entity that has openly advertised offering corporate espionage on its website. 

Rebsec’s Offerings

(Image Source: Threat Analysis Group | Google)

The Russian Hack-for-hire Connection

Russia is generally considered a major source of cybercrime as many cyber incidents over the past decades have originated there. Google’s TAG has encountered a Russian threat actor targeting journalists, politicians, and various NGOs and non-profit organizations while investigating a 2017 credential phishing campaign. However, investigations revealed that the targets included many people or entities not affiliated with these organizations. This ‘Hack-for-hire’ actor has been referred to as Void Balaur.

The campaigns usually start with a credential phishing email that includes a link to a phishing page. Usually, it consists of notifications and messages spoofing Russian government agencies. Once the user’s system is compromised, the cyber attackers continue to break down security measures by granting an OAuth (Open Authorization) token to themselves on genuine email applications like Thunderbird. They may also link the user’s account to that of an attacker on a third-party provider network. They can then access email contents via IMAP (Internet Message Access Protocol) using a custom tool.

Russian Phishing Message

(Image Source: Threat Analysis Group | Google)

TAG also observed that the hacker website(s) advertised their capabilities for hacking and claimed it had received positive reviews from Russian underground forums like Probiv.cc and Dublikat.

Hacker Service Pricing List

(Image Source: Threat Analysis Group | Google)

The United Arab Emirates Hack-for-hire Modus Operandi

TAG has found out that the UAE Hack-for-hire group is usually active in the Middle East countries and North Africa (MENA region). Generally, they target government organizations, educational institutions, and political entities. The modus operandi involves using fake Google or OWA (Outlook Web App) password reset emails to filter out credentials from their targets. 

While many Hack-for-hire malicious groups use open-source phishing frameworks, the UAE group uses a dedicated suite of tools, like Selenium, to automate web browsers. Additionally, this group works similar to the Russian entity by presenting OAuth tokens or linking the compromised target’s email account to the adversary-controlled account on a third-party email service provider. 

Investigations revealed that the UAE Hack-for-hire group had connections with the original developers of the H-Worm and njRAT. 

Fake Google Alert for Phishing

(Image Source: Threat Analysis Group | Google)

Preventive Measures to Protect from the Hack-for-hire Actors

Here are the preventive measures one can take to protect their information assets from these ‘Hack-for-hire’ actors.

• Phishing protection: You will notice a pattern if you watch the modus operandi of these Hack-for-hire actors. The attacks usually begin with a phishing email; therefore, a preventive measure is to increase awareness of phishing and similar fraudulent activities.
• Multi-factor authentication: Users can opt for 2FA (2-Factor Authentication) or Multi-factor authentication (MFA) as an additional layer of security against these threat actors. 
• Updates and advanced protection: Google TAG recommends that high-risk users update their devices and enable Advanced Protection on their accounts. It also advises allowing Google Account Level Enhanced Safe Browsing.
• Spoofing precaution: Email spoofing is another crucial area of concern. As a user, one must be careful while accessing websites via search engines or any other source that cannot authenticate the genuineness of the website, for example, through a random email from an unknown source. 

Generally, Hack-for-hire actors do not go further than compromising the email inbox and exfiltrating data. They mainly concentrate on social engineering attacks rather than introducing any malware. However, it would be best if you remained cautious as we cannot rule out instances of increased severity from malicious actors.

Final Words

Hack-for-hire groups are not a new phenomenon. As long as the objective is honorable with good intentions, such as fighting cybercrime, there should not be a problem with the Hack-for-hire actors as it falls within the ambit of ethical hacking. However, if their intentions are malicious, these groups have the potential to cause harm, as seen in various examples in the article. Thus, the need of the hour for organizations and even the general public is to take necessary countermeasures to prevent becoming targets of such malicious groups.

References

1. Huntley, S. (2022, June 30). Countering hack-for-hire groups. Threat Analysis Group. https://blog.google/threat-analysis-group/countering-hack-for-hire-groups/
2. Glover, C. (2022, June 30). Investigation reveals network of Indian ‘hack-for-hire’ groups who steal data for paying clients. TechMonitor. https://techmonitor.ai/technology/cybersecurity/hack-for-hire-indian-cyber-mercenary
3. Pernet, C. (2022, July 1). The business of hackers-for-hire threat actors. TechRepublic. https://www.techrepublic.com/article/what-are-hackers-for-hire/ 

#Google #phishing #threats #hacking #vicarius_blog

Amid the chaos on the world stage, the macroeconomic backdrop is full of uncertainties. But there is one thing we’re absolutely certain of: cybersecurity solutions will become much more prominent over the next few months and years as global cyberwarfare sets the stage for cybersecurity’s permanent elevation at both the national and corporate levels. 

Companies and governments are being hacked mercilessly in 2022. Even cybersecurity giants such as Entrust are being breached. The firm revealed that parts of its system were hacked on June 18. Before that, Okta was hit, impacting more than 366 of its corporate customers.

That’s just scratching the surface amid a sea change where cybersecurity solutions go from “optional” to “necessary.” This shift is starting today, but it will play out over the next several years. As it does, global cybersecurity spending will substantially accelerate. So will the need to understand the Common Vulnerability Scoring System (CVSS).

Let’s explore how the scoring system works and even how it doesn’t work.

What Is CVSS

The Common Vulnerability Scoring System is a scoring system for vulnerabilities created by FIRST.org. CVSS communicates the severity of vulnerabilities through three top-level metrics: base, temporal, and environmental:  

Base Metrics

On the base level, you’ll see a score that ranges from 0-10 (but can be modified by scores in the other categories). Base factors, in a nutshell, represent the characteristics of the vulnerability. Base CVSS scores are readily available, as enterprises can use them as a starting point to prioritize threats. 

CVSS can create a pathway to accurate and consistent vulnerability scoring, which is why it’s used as the standard of measurement. Right now, CVSSv3.1 is used the most, although not everyone has kind things to say about it (we’ll get to that in a bit). 

For now, let’s focus on how CVSS works, starting with its scoring methodology which runs from 0.0 to 10.0 in 0.1 increments. 

As a system, the two most prevalent use cases are in 1) calculating and ranking threats based on severity of impact to your system environment, and 2) prioritizing which vulnerabilities to remediate first.

This is where it gets complex. For instance, CVSSv3.1 uses an “Access Vector” to represent vuln severity as a function of how difficult it is to connect to a system in a targeted environment. 

Let’s unpack that by considering two situations: one in which many thousands are running that system through a network, and a second in which very few are running a system that requires physical adjacency to exploit. The second situation would score as less severe than the situation reliant on network access. 

But there are many variables to consider. For example, the Access Vector variables include network, adjacent, local, and physical. And there are many more levels, which we will explore in future CVSS articles.

The important part to focus on is the permutations of scores. That is, is there a unique score for every possible variable combination? In short, no. There are roughly 101 values to map variable levels to, and more than 2,000 possible variables.

Further, CVSS base metrics comprise three subscores: exploitability, scope, and impact. Within these subscores are several more sub-components, which differ depending on the subscore. For instance, the “impact” score focuses on what outcome could be achieved by a successful exploit, and leverages confidentiality (how much data the attacker has access to), integrity (the ability of the attacker to edit data), and availability (whether it impacts use of systems for a large or small number of users). 

Temporal Metrics

There are also “temporal” metrics that can change over time. As such, they’re intended to measure how exploitable a vulnerability is right now and the availability of remediating factors. As such, CVSS temporal metrics contain several sub-levels, including the following:

• Exploit code maturity: how stable/mature is the code used to exploit a particular vulnerability.
• Remediation level: how widely available are patches and other workarounds over time.
• Report confidence: the validity of the vulnerability and its exploit.

Environmental Metrics

With environmental metrics, the score essentially modifies the base group depending on a particular enterprise’s characteristics that may increase or decrease the severity of a particular vulnerability. The sub-levels that make up the environmental group are as follows:

• Modified base metrics: Organizations with compensating or mitigating controls are taken into consideration here. For example, is the vuln within a firewall-protected server? Is it within an unused, unconnected server? Or is it within an internet-connected server with public exposure? The latter is of the most severe consequence relative to the former two.
• Security requirements: These measure an asset’s “business criticality” in terms such as “confidentiality,” “integrity,” and “availability.” Confidentiality refers to whether information can be hidden from unauthorized users. Integrity refers to an ability to protect information from being altered. Availability means how accessible information is to authorized users. 

Acknowledging that we’re only scratching the surface of what CVSS is and how it’s used to prioritize exploits, we’d be remiss not to mention how limited the base score is in accounting for real-world exploits and other mitigating factors.

CVSS Criticisms

Common Vulnerability Scoring System criticisms generally comprise two groups, which include criticisms to CVSS as a risk-identifying method and criticisms to CVSS as a scoring system. Let’s get into some specific complaints…

1. The Attack Vector is not well-defined. For example, paradoxes arise when you consider the vulnerability state of a PDF, as it shows up as “local” if downloaded and opened in a browser, but shows up as “network” if it immediately opens in a browser.
2. The Attack Complexity criteria overlaps with the Temporal score. Changes over time are meant to be isolated by the Temporal score; however, the base score tends to evolve as an exploit moves from hypothesis to the real world. That’s only supposed to happen in the Temporal score. 
3. The concept of “Scope” is confusing. This is because different equations are used depending on which Scope level is at risk.
4. “High” and “low” levels of granularity for Attack Complexity are insufficient. Compare that to CVSSv2, which had three levels of “Access Complexity.” 
5. CVSSv3.1 consistently scores higher than version 2. This inflates the workload for admins.

These are just among some of the many criticisms of CVSS, but there are others to be found. 

Perhaps the most important criticism lies in how scoring systems should make up how you prioritize threats but should not be the only part. 

As such, many enterprises misuse CVSS as a ranking of risk. For example, CVSS fails to account for much of the context for vulnerabilities, such as how they can be chained, nor does it assess impact in a way that makes sense for how people might be affected by a vulnerability.

The Future of CVSS

Criticisms or not, dissent is what leads to improvements down the line, which we’ll very likely see in the next iteration of CVSS. However, from what I’ve been able to glean from my readings, CVSSv4 will likely not depart from predecessors in a meaningful way. That is, its core construction will remain in place, and many of its proposed changes mostly comprise the tweaking/adding of variables and their values.

As we head into the future, and as every datapoint and workflow in the world exists on a computer somewhere, securing those systems via cybersecurity solutions will become increasingly vital. In other words, a once-niche industry has blossomed into a burgeoning, $150-plus billion business that constitutes dozens of multi-billion-dollar companies.

To date, this industry has experienced astonishing growth. But it is nothing compared to what will come over the next decade.

The COVID-19 pandemic accelerated the global digital adoption. Such an acceleration sparked a surge in the volume of digital data and workflows in need of security. And in response to that surge, countries and companies alike significantly upped their spending on cybersecurity systems in 2021.

But the conflict in Eastern Europe has added a ton more fuel to the fire.

The reality is that the war between Russia and Ukraine (or, perhaps increasingly more accurately, the rest of the world) has emphasized that modern warfare is cyberwarfare.

And it will only escalate from here.

As it does, so will the need for education around scoring systems, and how to best use them in context with your enterprise’s specific environment. For instance, we use several scoring systems to set a baseline for criticality, but it’s important to consider how that score may change depending on your enterprise. 

A lot of vulnerability management companies do not consider such context, and that’s a huge mistake. We’re hopeful that the next iteration of CVSS addresses such limitations… but even so, it will always remain important to a degree to consider specific contexts and adjust how your threats should be prioritized.

#vicarius_blog #CVSS #vulnerabilitymanagement #vulnerabilities