The value of 20/20 hindsight in cybersecurity

On March 27, 2018, US-CERT publicly disclosed widespread cyber-attacks on domestic energy and other infrastructure locations.  These attacks had been occurring since at least March 2016 and had successfully compromised a number of locations including some nuclear facilities, water, and aviation locations.

This was not a typical drive-by attack. It was a systematic, multi-staged effort that advanced up the kill chain and utilized several sophisticated targeting techniques including spear-phishing, watering-hole domains, and ultimately the targeting of industrial control systems infrastructure.

Some details of this attack became known to the targets by at least September 2017, approximately six months before the public disclosure.

Arming yourself against future attacks

The emergency readiness team produced a comprehensive document that described the full strategy and tactics used by the attackers. This included details of the entire kill chain, from the reconnaissance phase, through lateral spread to other devices on their network.   When they published their findings, they highlighted important “indicators of compromise” (IOCs) including:

• Suspicious URLs
• Suspicious IP addresses
• MD5 Hashs and filenames associated with a malware attack

With these IOCs, organizations can arm themselves against similar attacks in the future.  These can be used to provide network security tools, including firewalls, IPS/IDS, and web proxies with a list of the IP addresses and URLs to interfere with the communication lines for this attack.  In addition, the MD5 hashes allow network and endpoint solutions to be aware of the malware associated with this group.

The challenge is that once these IOCs are known, it becomes less likely that these same adversaries will continue to use them.  This is because it becomes more difficult to use the same strategy once your targets become aware of your tactics.  Some copycat adversaries may use this as a blueprint for ways to launch similar attacks, but these adversaries are often less resourceful than the originators of the attack.

So, while having public disclosure of the details and IOCs are useful, often the security operations team is left wondering what they may have prevented had they been informed of these IOCs six months earlier and not after they become less valuable.

Hindsight is key to good threat hunting

An organization would be able to use these IOCs to discover new attacks using the same techniques – and to look into the past to identify whether these important markers were present before you became aware of them. Unfortunately, most organizations do not have easy access to this information, and you can’t start after there has been a big discovery. 

The US-CERT announcement should be the wake-up call to not just monitor and track the information frequently associated with IOCs, but also to include a simple and consolidated method to search for these following an announcement like this. 

Many organizations already log this data but isn’t always collected, archived and maintained in a system that is easily queried.  As a result, this data is used in forensics to determine how a serious breach occurred, once it is discovered, but it isn’t often the vehicle that enables this detection itself. 

Now is the time to ask yourself: 

• If there is a new discovery, where can I go to discover if there was any evidence of it in my environment?
• Where can I go to look for URLs, domain names and remote IP addresses?
• Where can I obtain a list of all new MD5 hashes downloaded into my network and on which systems did they land?

Once your team has this information, the next step is to develop a process around which new discoveries are investigated:

• How and when are new discoveries investigated?
• If your team does discover a hidden threat, exposed by this new information, does eliminating the threat on the discovered device also eradicate it throughout your entire network?
• What can you learn from this discovered device to ensure there are no other threats lying dormant in your environment?

Ultimately, you can only depend on real-time detection techniques to a point, but study newly discovered IOCs will help uncover the more important threat:  The ones hidden on your network.