Chapter 2 Cyber Threats in Focus: Common Cyber Threats in Singapore COMMAND & CONTROL (C&C) SERVERS AND DISTRIBUTED DENIAL OF SERVICE (DDOS) Definition: A C&C server is a machine operated by hackers to communicate with devices that have been infected with malware. Instructions are communicated to the group of infected devices, collectively known as a botnet, to perform malicious activities such as DDoS attacks. A DDoS attack occurs when a system is bombarded with large volumes of data or specially-crafted malicious traffic sent from a botnet, affecting the system’s ability to respond to legitimate users in a timely manner. Motivation: Conduct malicious activities such as data theft, e-mail spam campaigns and DDoS attacks. DDoS attacks create disruptions to victim’s business operations, and/ or distract victim from the “real” cyber-attack such as a data breach. Target(s): Any organisation, although those in the financial and gaming industries are commonly targeted. 34 “SSDP, DNS AND NTP ACCOUNT FOR 70 PER CENT OF VULNERABLE SERVICES IN SINGAPORE THAT CAN BE USED IN A DDOS ATTACK” Number of Unique C&C Servers observed per month in Singapore More than 60 C&C servers were observed within Singapore’s cyberspace in 2016. The number of C&C servers was observed to be growing gradually in the first eight months of 2016, peaking in August, before decreasing towards the end of the year. Such servers often serve as the launch pad for cyber-attacks, including DDoS attacks. Whenever a new C&C server is detected, SingCERT will inform the respective Web-hosting providers to rectify the issue. 2016 also saw the growth of DDoS extortion threats. Organisations receive e-mails from hackers threatening to launch a DDoS attack against them unless payment is made, usually via Bitcoin. A number of organisations in Singapore have received such threats. Misconfigured services on servers continued to be seen in Singapore’s cyberspace throughout 2016. Simple Service Discovery Protocol (SSDP), In 2016, DDoS attacks globally DNS and Network Time Protocol crossed the peak attack volume (NTP) are some of the services of 1 Tbps (DDoS attacks commonly that, if not configured properly, fall in the 10 – 50 Gigabit per can be used to facilitate DDoS second range). Attacks of this attacks. Remediation for these scale were enabled through new vulnerabilities can be as simple malware (e.g. Mirai) that exploited as unchecking an option in the vulnerabilities in unsecured server settings. IoT devices, such as webcams, routers and printers. The malware essentially would hijack these devices, causing them to generate malicious traffic that can be directed at specific systems. SingCERT published an advisory in Oct 2016 to inform business and individuals of the need to enhance the security of IoT devices. This could reduce the likelihood of that these devices are leveraged to conduct widespread DDoS attacks. Some measures include: • Ensuring that remote access capabilities were disabled; and • Changing device usernames and passwords from the default. 35