Today is D-Day for for banks and the City of Johannesburg to pay ransom demands that were sent through by hackers last week. It is alleged that two separate groups of hackers are threatening to close down the finance sector and local government at a time when South Africans would be paying municipal bills and gaining access to their bank accounts.<\/p>\n\n\n\n
Last Wednesday, one group sent a ransom note to a number of banks, claiming if it was not paid two Bitcoins (R219,000), it would launch a Distributed Denial of Service (DDoS) attack. <\/p>\n\n\n\n
Meanwhile, another group of hackers is threatening to release City of Joburg customer information if it was not paid four Bitcoins by today (Monday).<\/p>\n\n\n\n
Bryan Hamman, Regional Director at NETSCOUT, which offers NETSCOUT Arbor<\/strong>, specialising in advanced DDos protection solutions, has offered offers this explanation of DDoS attacks in the broader cybersecurity landscape.<\/p>\n\n\n\n Cyberattacks have been around since the dawn of the Internet. What initially started off as curiosity or bragging rights, quickly escalated to monetising the activity. In a world where every piece of personal data is of value, the more you have, the more you can bank.<\/p>\n\n\n\n Historically, internet service providers\nwould merely \u2018blackhole\u2019 any attack traffic. This rudimentary tactic would drop\nthe attack traffic but also any valid traffic towards the intended target. In\nmany cases this would merely achieve what the attacker wanted, which was to\ntake the target offline.<\/p>\n\n\n\n In around 2000, a team of students from the University of Michigan began working on a better way to tackle the problem. In the coming years, the company they formed, namely Arbor Networks, pioneered the fight against cyberattacks and quickly became the leading provider of attack mitigation for service providers globally. <\/p>\n\n\n\n The idea, although simple in principle, was\nfar more challenging in execution as attackers constantly evolved as well. The\ngoal of the solution was to clean all attack traffic without any impact to the\nvalid traffic to one or more victims of cyberattacks. Using a non-inline device,\nArbor pioneered the local scrubbing of malicious traffic within service\nprovider environments. <\/p>\n\n\n\n This became a game changer and today Arbor (now a part of NETSCOUT) actively works with, and is the vendor of choice for, over 90% of the top Tier 1 and Tier 2 ISPs in the world. <\/p>\n\n\n\n Later in 2007, a collaborative effort began\nbetween Arbor and its ISP customers to share data on the type of malicious\ntraffic seen across the globe. The idea was to reverse- engineer, curate and\ncreate unique \u2018fingerprints\u2019 of the bad traffic and share it with other\nproviders, so that as a group they could more easily identify and block this traffic\nat the edge of their respective networks. <\/p>\n\n\n\n Today, ATLAS boasts over 380 ISPs who are sharing\ndata. This unique collaboration is translated into the intelligence feed that\nArbor sends back into its products as the real-world visibility of what is\nhappening. NETSCOUT enterprise and ISP customers use the cybersecurity\nintelligence feed from Arbor to keep their networks and customers safe. This\nvalue proposition is unmatched in the fight against cyberattacks. <\/p>\n\n\n\n With the rise of the Internet of Things (IOT),\nthe rapid increase in last mile connectivity and the shift to global ecommerce,\nenterprises have more frequently become the targets of various forms of\ncyberattacks. The problem, however, is that traditional vendors of firewalls,\nIPS, WAF and such are ill-equipped to handle these new and emerging threats. <\/p>\n\n\n\n Firstly, they are often the victim of the attack, as state and application-based attacks are frequently used to target security appliances that by design have to track sessions. These devices have a limited amount of memory and CPU, which translates to a fixed number of sessions or packets the device can handle. Attacks can be crafted to expose those weaknesses. A far simpler method would be to just saturate the last mile of connectivity. <\/p>\n\n\n\n Regardless of dropping traffic on the customer side, the entire customer site would be affected. <\/p>\n\n\n\n NETSCOUT | Arbor has a globally unique\nsolution in not only blocking both inbound and outbound connections that are\ndeemed to be suspicious, but it also has the ability to work with Arbor-enabled\nservice providers to facilitate automated local \u2018cloud\u2019 scrubbing for the enterprise\ncustomers, with no changes required to the infrastructure or routing. <\/p>\n\n\n\n This is of major benefit over the use of\nDNS or BGP methods used with cloud scrubbing, as there is no additional latency\nnot only to the valid traffic to the attack victim, but also as regards all\nother traffic that would be affected when using BGP due to the \/24 minimum\nblock requirement. Enterprise customers can procure the device themselves or, in\nthe majority of cases, as part of a managed service from their upstream ISP.<\/p>\n\n\n\n The AED is an inline layer 2 transparent\ndevice that by design is stateless in nature. It has the ability to block both\ninbound attacks and outbound dubious communications. The AED is backup by a\nnear real-time intelligence feed from the ATLAS research team, allowing the\ndevice is identify and stop new and emerging threats. Insertion into existing\nnetworks requires no changes to the underlying architecture. <\/p>\n\n\n\n Looking at the local footprint we have seen\na drastic increase in cyberattacks, and this is something that local companies\nhave historically not given much consideration to. The publicly-documented\ncases at Cool Ideas, Cybersmart and various South African public services\nillustrate that more and more attacks can be expected. The growing level and\nfrequency of attacks are not only limited to local ISP and enterprises, but\neven global giants have been taken down in recent weeks with successful attacks\nagainst Google and AWS.<\/p>\n\n\n\n NETSCOUT | Arbor releases a Cyber Threat\nIntelligence report every six months based on the work done by ASERT, the Arbor\nSecurity Engineering and Research Team. The statistics over the past six months\ncompared to 2018 show a clear and dangerous trend in both the size and\nfrequency of attacks.<\/p>\n\n\n\n Overall, there was an increase in attacks in the first six months of 2019, with a slight drop in the maximum size of the attack compared with the first half of 2018.<\/p>\n\n\n\n Meanwhile, Matt Walmsley, Head of EMEA Marketing at Vectra<\/strong>, says extortion is a well-established approach for cyber criminals and is used through tactics that include threatening denial of service, doxing, and ransomware.<\/p>\n\n\n\n “In the reported case of the city of Johannesburg, the four Bitcoin ransom (circa US$30,00) is meaningful but not particularly high and so may be pitched at that level to encourage a decision to pay. <\/p>\n\n\n\n “Cyber criminals are increasingly making rational economic decisions around targeting organisations and demand ransom levels that they believe will have a higher likelihood of payment. <\/p>\n\n\n\n “Cybersecurity teams supporting the city will undoubtedly be working flat out to confirm the extent of any attack to aid officials in deciding if they should pay. The same learning needs to be applied to their future risk mitigation of any techniques the attackers used. <\/p>\n\n\n\n “All too often we are reminded that defensive controls are imperfect, and the ability to quickly detect and respond to live attacks that have successfully penetrated an organisation can make the difference between a contained incident and damaging breach.”<\/p>\n\n\n\n Craig Freer, Executive Head: Cloud and Managed Services at Vox Telecom<\/strong>, says that security ‘is no longer a luxury’ and is something that must take top priority at every organisation. <\/p>\n\n\n\n “Cybersecurity must be addressed at a board level and not left being \u2018relegated\u2019 to an IT decision-maker,” he said.<\/p>\n\n\n\n \u201cCompanies need to conduct an extensive audit of their entire IT environment, invest in getting the right cybersecurity infrastructure in place and ensure their systems are updated to factor in emerging threats. <\/p>\n\n\n\n “They also need to continually assess their ability to effectively deal with attacks. In our experience, most companies are not geared to repel any type of attack, much less recover effectively from one. It has become a case of businesses being sitting ducks.<\/p>\n\n\n\n \u201cVery\nfew SMEs really understand their vulnerabilities and it can be quite complex\nfor them to secure themselves as best as possible. It really is a case of they\ndo not know what they do not know.<\/p>\n\n\n\n \u201cCybersecurity at an organisation is not a snapshot in time but evolves as the threat landscape changes. Businesses must do more to educate themselves about the threats they face and take the necessary steps to protect themselves.”<\/p>\n\n\n\n Anna Collard, Managing Director at Popcorn Training, a KnowBe4 company<\/strong>, says breaches occur on a regular basis.<\/p>\n\n\n\n “While large ones hit the headlines, small ones are continuous like a dripping tap,” she said.<\/p>\n\n\n\n “This is mainly because a lot of the breaches occur at small companies or merchants. The full scale of these breaches can\u2019t be fully appreciated until looked at in totality as this breach shows.<\/p>\n\n\n\n “For companies of all sizes, having good security control is absolutely vital. For the most part, this would mean having the fundamental security controls which can prevent, protect, and respond to threats. <\/p>\n\n\n\n “Beyond that, companies should look at what the biggest threats to them are, and how those threats materialise. In the majority of cases, this will boil down to social engineering attacks, taking advantage of unpatched software, or authentication attacks. By investing in these controls, most companies can reduce the likelihood of being successfully compromised.”<\/p>\n\n\n\n Anton Ivanov, Security Researcher at Kaspersky<\/strong>, says that the threat of ransomware remains as powerful as ever and the company’s detection data shows that larger organisations, such as city authorities and enterprises, are the fastest-growing target.<\/p>\n\n\n\n “According to our data, attacks on employees of large organisations have gone up 17.9% in the last 12 months (from 198,334 in the period June 2017 to end May 2018, to 233,763 for June 2018 to end May 2019), compared to an increase of just 3% in attacks on individual consumers,” said Ivanov.<\/p>\n\n\n\n “Attacks on urban infrastructure are often worryingly successful, with far reaching impact on essential systems and processes, affecting not just the authority itself but local businesses and citizens. What makes cities a target? It could be the fact that they run vast networks of connected technology that can be hard to update, manage and patch effectively, or because the attackers believe they may be more inclined to pay the ransom to avoid recovery costs that can be many times higher than the ransom fee. <\/p>\n\n\n\n “To protect city infrastructure against the threat of ransomware, Kaspersky recommends securing all data, devices and networks with robust security software. <\/p>\n\n\n\n “But with many non-technical employees, located across many different sites, employee training and awareness is probably the greatest priority.<\/p>\n\n\n\n A useful checklist\ncould be:<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" Today is D-Day for for banks and the City of Johannesburg to pay ransom demands that were sent through by hackers last week. It is alleged that two separate groups of hackers are threatening to close down the finance sector and local government at a time when South Africans would be paying municipal bills and […]<\/p>\n","protected":false},"author":25,"featured_media":29784,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4950,565,5,6,19,9059,13],"tags":[11525,5475,11530,560,11523,619,11524,11520,561,11521,11519,11526,6044,5374,1145,859,388,11527,1053,11533,563,160,622,6781,390,8983,226,11534,11531,11532,8584,2261,11076,11528,8179,5473,2318,150,11522,10947,5372,11529,1524],"class_list":["post-29782","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analysis","category-banking-finance","category-enterprise-security","category-insights","category-regional-news","category-south-africa","category-top-stories","tag-aed","tag-anna-collard","tag-anton-ivanov","tag-arbor-networks","tag-atlas","tag-aws","tag-bgp","tag-bitcoins","tag-bryan-hamman","tag-city-of-joburg","tag-city-of-johannesburg","tag-cool-ideas","tag-cpu","tag-craig-freer","tag-cyber-threat-intelligence","tag-cyberattacks","tag-cybersecurity","tag-cybersmart","tag-ddos","tag-default-deny","tag-distributed-denial-of-service","tag-dns","tag-google","tag-hackers","tag-iot","tag-ips","tag-kaspersky","tag-kaspersky-anti-targeted-attack-platform","tag-kaspersky-anti-ransomware-tool-for-business","tag-kaspersky-embedded-system-security","tag-kaspersky-endpoint-detection-and-response","tag-kaspersky-endpoint-security-for-business","tag-knowbe4","tag-matt-walmsley","tag-netscout-arbor","tag-popcorn-training","tag-ransom","tag-smes","tag-university-of-michigan","tag-vectra","tag-vox","tag-vox-telecom","tag-waf"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/29782","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=29782"}],"version-history":[{"count":5,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/29782\/revisions"}],"predecessor-version":[{"id":29789,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/29782\/revisions\/29789"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/29784"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=29782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=29782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=29782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}