CHAPTER 1 SPOTLIGHT ON CYBER THREATS COMMAND AND CONTROL SERVERS AND BOTNET DRONES In 2018, CSA observed about 300 unique C&C servers in Singapore, a 60 per cent decrease from 2017. SingCERT is responsible for the prevention, detection and resolution of cybersecurity incidents in Singapore, acting on information provided by government agencies, international counterparts and the public. When SingCERT receives information regarding C&C servers hosted in Singapore, the team first confirms the locations of the servers, and then asks the relevant agencies such as the Info-communications Media Development Authority (IMDA) or relevant abuse team of the local hosting providers to take them down and restore legitimate services. When the hosting provider is located overseas, SingCERT collaborates with the relevant foreign Computer Emergency Response Teams (CERTs) to do the same. FEATURED TOPIC OPEN PORTS 0101001 1011101 0101110 1010000 0101010 1010101 0000000 0101010 1010101 0101010 1010101 0101010 1010101 0000000 0101010 1010101 0101010 1010101 0000000 0101010 1010101 0101010 1 1 1 1 010010101 0100101010010011 0100101010010011 0100101010010011 0100101010010011 0100101010010011 0100101010010011 Open ports attract malware infection and may be used to launch cyber-attacks, such as Distributed Denial-of-Service (DDoS) attacks. DDoS attacks inundate websites and services with incoming traffic, causing them to become unavailable. In February 2018, the two largest DDoS attacks recorded in history occurred just five days apart from each other. Unlike large-scale DDoS attacks that usually employ malware-driven botnets, these two attacks stemmed from servers where specific ports were left open unnecessarily.6 The first attack peaked at 1.35 Tbps and targeted the developer platform, GitHub. The peak was 30 per cent higher than the previous record set by the attack targeting Dyn in 2016. The second attack targeted a US-based service provider, and set the current peak record of 1.7 Tbps. If users must utilise open ports for their work, they should always safeguard them by avoiding default credentials, and close the open ports promptly when not in use. Gamarue Conficker Mirai WannaCry Gamut Others 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC On average, five common malware accounted for over half the daily infections in 2018. On average, nearly 2,900 botnet drones with Singapore IP addresses were observed daily.7 About 470 malware variants were detected, but the top five malware observed – Gamarue, Conficker, Mirai, Wannacry, and Gamut – accounted for over half of observed infections, echoing trends observed in previous years. These are not new malware; Conficker, in particular, dates back to 2008. The top malware, Gamarue, steals personal information and can also function as a medium to distribute other malicious programs. Although Gamarue’s infrastructure was largely dismantled in an international operation in December 2017, efforts to wipe it out completely had been slow and challenging,8 and Gamarue had continued to infect systems throughout 2018.9 The persistence of Gamarue infections into 2018 suggests that many users have yet to patch their devices, or use antivirus software, to prevent infections. This is also the likely explanation for how WannaCry – the ransomware that wrecked havoc across the globe in 2017 that can now be easily detected by antivirus software – continued to persist on local systems and computers. Separately, the Mirai malware had been linked to botnet campaigns targeting unpatched Internet of Things (IoT) devices. A number of malicious campaigns are increasingly leveraging open-source Mirai malware – shared openly on the Internet – to conduct brute-force attacks with common usernames and passwords. The observations indicate that many users do not change default login credentials of their smart devices. 7 Based on unique Internet Protocol (IP) addresses (the numerical code assigned to each device that can connect to the Internet or other networks), about 115,000 botnet drones were observed in Singapore in 2018. 8 Parrish, Kevin. “The Andromeda botnet still lingers as nations struggle to clean infected PCs,” Digital Trends, 14 August 2018, https://www.digitaltrends.com/computing/andromeda-botnet-still-infects-pcs-africa-asia. Specifically, memcached servers, used for speeding up networks and improving performance of web applications, were instead hijacked to carry out the two DDoS attacks. 6 18 9 Brumaghin, Edward and Unterbrink, Holger with contributions from Tacheau, Emmanuel. “Old dog, new tricks – Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox,” Cisco Talos Blog, 15 October 2018, https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html. 19