Scenario 2 - Flight Safety Foundation

download report

Transcript Scenario 2 - Flight Safety Foundation

Threats to the Aviation Sector

Stu Solomon, iSIGHT Partners Vice President, Technical Services and Client Operations

iSIGHT Partners

200+ experts, 16 Countries, 24 Languages, 1 Mission Global Reach ThreatScape ® - Adversary Focused Intelligence Research: threats, groups; determine/capture motivation and intent

Cyber Crime Cyber Espionage Denial-of-Service Enterprise Analysis: Hacktivism Industrial Control Systems Fuse knowledge across methods, campaigns, affiliations, historical context Proven Intelligence Methodology Mobile Vulnerability and Exploitation Dissemination: Deliver high fidelity, high-impact, contextual, actionable insights 2

iSIGHT Partners

Formal Process  Rich, Contextual Threat Intelligence • Human Intelligence • Open Sources • Community Engagement • Underground Marketplaces • Technical Sources iSIGHT Partners Research Team Research Repository iSIGHT Partners Analysis Team iSIGHT Partners Customers 1. Research Team submits data based on collection requirements set by analysts and customers – tagged with source veracity 2. Analysis Team applies a best of-breed methodology to fuse all source intelligence into validated reporting linked to indicators 3. Customer feedback and ad-hoc requests for information complete the loop of a dynamic information collection process


Todays Global Threat Landscape

    Active & Global – Transcends Geographies and Sectors Multiple Motivations – Cyber Crime, Espionage, Hacktivism, Destruction, etc.

Low Barriers for Entry – Actors use tools that work; not necessarily sophisticated methods – Open marketplace providing capabilities Structured & Vibrant – Ecosystem providing better tools, infrastructure, sharing ideas and methods, pooling resources


The Threat Focus Trap

Cross-Over Attacks Zeus Trojan: – – – – Most Popular Credential Collection Malware Originally Created by Russian Cyber Criminals Cross-over to Cyber Espionage Multiple benefits DarkComet & University of Washington – Key logging trojan affiliated with cyber espionage campaigns with a nexus to Iran – – Cross-over to cyber crime Ultimate goal: compromise financial credentials or personally identifiable information (PII) to perform fraud or identity theft


Aviation Sector Threats

Multiple Adversary Motivations 6

Cyber Espionage

  Competitive Advantage – Targets aviation and aerospace engineering firms – Locates intellectual property for commercial or military advantage Locational Info of Dissidents – Travel dates and location information on individuals of interest


China: National Priorities and Targeting






Internal Security Maintaining the regime Separatist/Splitists B.





External Security Regional threats B.


Global security Military modernization A.

Economic Growth Energy Development and Conservation New-Generation IT Industry Biology Industry High-End Equipment Manufacturing New Energy


Chinese Teams – Conference Crew

    Highly focused on Defense Industrial Base Identifiable by unique malware/infrastructure Targeting of US and Taiwan Uses conference attendee lists – – Military events Vendors lists


Cyber Crime: Credential and Identity Theft

  Airline-Themed Phishing – – Fake offers for discounted airline tickets Lures for the installation of credential theft malware Monetization Method – Airlines abused as a cash-out function to support other criminal schemes – Actors may compromise airline systems directly


Targeted Lures

   AIAA materials used to entice recipients to click on malware embedded emails Asprox malware campaign Credential theft


Hacktivism: Harassment

  Hacktivists may target aerospace engineering firms for the promotion of ideological/political beliefs Commercial aviation is generally less affected by this type of actor


Hacktivism: Disruption & Destruction

 Terrorism – – This remains theoretical at this time Control of aviation industrial control systems could be used to enable kinetic attacks – Hacktivists engage in information gathering   Conduct an attack Monitor persons of interest


ADS-B Vulnerabilities

  The Automatic Dependent Surveillance Broadcast (ADS-B) system is subject to spoofing attacks. Multiple spoofing operations possible: – Scenario 1: An ADS-B system could be spoofed to generate a false hijacking code, one that could then be rescinded and creating a conflicting picture.

– Scenario 2: An ADS-B spoofing operation could generate a screen full of fake (ghost image) aircraft heading toward a private jet, while a regular radar signal from the vicinity of the jet shows a perfectly normal situation.


Additional Risks

    Availability of 3 rd Party Information – The Impact of Published Vulnerability Research Common set of standards, international policy – Shared responsibility between governments, airlines, airports, and manufacturers Access Control – – Insider Threat Part of an ecosystem; Internet connectivity Balance Safety and Security


Challenges to the Aviation Industry

     Many victims of economic espionage are unaware of the crime until years after loss of the information – Inadequate or non-existent monitoring and incident response to even detect activity Most companies don’t report intrusions in fear it could tarnish a company’s reputation Won’t accuse corporate rivals or foreign governments of stealing its secrets due to fear of offending potential customers and partners Hard to assign monetary value to some types of information Many CIOs don’t focus on cyber security and are unaware of the true threats


Lessons Learned From Other Industries

         Establish strong information sharing protocols Drive Public/Private Partnership Enable a culture of (Information) Security Change the conversation to include business context Employ basic information security hygiene Continuously seek to understand the evolving threat Recognize that you are not unique Understand third party connections Agree on standards and support them as a community


iSIGHT Partners



E-mail: [email protected]

Information: [email protected]