Transcript Scenario 2 - Flight Safety Foundation
Threats to the Aviation Sector
Stu Solomon, iSIGHT Partners Vice President, Technical Services and Client Operations
200+ experts, 16 Countries, 24 Languages, 1 Mission Global Reach ThreatScape ® - Adversary Focused Intelligence Research: threats, groups; determine/capture motivation and intent
Cyber Crime Cyber Espionage Denial-of-Service Enterprise Analysis: Hacktivism Industrial Control Systems Fuse knowledge across methods, campaigns, affiliations, historical context Proven Intelligence Methodology Mobile Vulnerability and Exploitation Dissemination: Deliver high fidelity, high-impact, contextual, actionable insights 2
Formal Process Rich, Contextual Threat Intelligence • Human Intelligence • Open Sources • Community Engagement • Underground Marketplaces • Technical Sources iSIGHT Partners Research Team Research Repository iSIGHT Partners Analysis Team iSIGHT Partners Customers 1. Research Team submits data based on collection requirements set by analysts and customers – tagged with source veracity 2. Analysis Team applies a best of-breed methodology to fuse all source intelligence into validated reporting linked to indicators 3. Customer feedback and ad-hoc requests for information complete the loop of a dynamic information collection process
Todays Global Threat Landscape
Active & Global – Transcends Geographies and Sectors Multiple Motivations – Cyber Crime, Espionage, Hacktivism, Destruction, etc.
Low Barriers for Entry – Actors use tools that work; not necessarily sophisticated methods – Open marketplace providing capabilities Structured & Vibrant – Ecosystem providing better tools, infrastructure, sharing ideas and methods, pooling resources
The Threat Focus Trap
Cross-Over Attacks Zeus Trojan: – – – – Most Popular Credential Collection Malware Originally Created by Russian Cyber Criminals Cross-over to Cyber Espionage Multiple benefits DarkComet & University of Washington – Key logging trojan affiliated with cyber espionage campaigns with a nexus to Iran – – Cross-over to cyber crime Ultimate goal: compromise financial credentials or personally identifiable information (PII) to perform fraud or identity theft
Aviation Sector Threats
Multiple Adversary Motivations 6
Competitive Advantage – Targets aviation and aerospace engineering firms – Locates intellectual property for commercial or military advantage Locational Info of Dissidents – Travel dates and location information on individuals of interest
China: National Priorities and Targeting
Internal Security Maintaining the regime Separatist/Splitists B.
External Security Regional threats B.
Global security Military modernization A.
Economic Growth Energy Development and Conservation New-Generation IT Industry Biology Industry High-End Equipment Manufacturing New Energy
Chinese Teams – Conference Crew
Highly focused on Defense Industrial Base Identifiable by unique malware/infrastructure Targeting of US and Taiwan Uses conference attendee lists – – Military events Vendors lists
Cyber Crime: Credential and Identity Theft
Airline-Themed Phishing – – Fake offers for discounted airline tickets Lures for the installation of credential theft malware Monetization Method – Airlines abused as a cash-out function to support other criminal schemes – Actors may compromise airline systems directly
AIAA materials used to entice recipients to click on malware embedded emails Asprox malware campaign Credential theft
Hacktivists may target aerospace engineering firms for the promotion of ideological/political beliefs Commercial aviation is generally less affected by this type of actor
Hacktivism: Disruption & Destruction
Terrorism – – This remains theoretical at this time Control of aviation industrial control systems could be used to enable kinetic attacks – Hacktivists engage in information gathering Conduct an attack Monitor persons of interest
The Automatic Dependent Surveillance Broadcast (ADS-B) system is subject to spoofing attacks. Multiple spoofing operations possible: – Scenario 1: An ADS-B system could be spoofed to generate a false hijacking code, one that could then be rescinded and creating a conflicting picture.
– Scenario 2: An ADS-B spoofing operation could generate a screen full of fake (ghost image) aircraft heading toward a private jet, while a regular radar signal from the vicinity of the jet shows a perfectly normal situation.
Availability of 3 rd Party Information – The Impact of Published Vulnerability Research Common set of standards, international policy – Shared responsibility between governments, airlines, airports, and manufacturers Access Control – – Insider Threat Part of an ecosystem; Internet connectivity Balance Safety and Security
Challenges to the Aviation Industry
Many victims of economic espionage are unaware of the crime until years after loss of the information – Inadequate or non-existent monitoring and incident response to even detect activity Most companies don’t report intrusions in fear it could tarnish a company’s reputation Won’t accuse corporate rivals or foreign governments of stealing its secrets due to fear of offending potential customers and partners Hard to assign monetary value to some types of information Many CIOs don’t focus on cyber security and are unaware of the true threats
Lessons Learned From Other Industries
Establish strong information sharing protocols Drive Public/Private Partnership Enable a culture of (Information) Security Change the conversation to include business context Employ basic information security hygiene Continuously seek to understand the evolving threat Recognize that you are not unique Understand third party connections Agree on standards and support them as a community
E-mail: [email protected]
Information: [email protected]