This sentence comes up very frequently during the pre-sales phases prior to conducting a penetration test. Companies generally reach out to us once the damage has already been done AND they have become aware of it, voicing surprise at having been targeted in the first place.
The reality is that being "small" is actually a key selection criterion for an attacker.
What is an attacker looking to do? "Steal the company's industrial data." This is the primary answer in the minds of organizations; smaller businesses therefore feel less exposed because they do not possess data as valuable as the secret blueprints of the next Airbus or the iOS source code.
And yet
This assumption is obsolete. The scope of attackers and their objectives is vastly broader. Here is a non-exhaustive list of what can motivate an attacker:
- Planting a Trojan horse (trojan) on the machine to expand their botnet network
- Intercepting traffic to uncover passwords or banking credentials
- Displaying political or religious messaging (website defacement)
- Using a server as a relay for attacks or phishing attempts
- Fun and challenge (indeed)
- Stealing confidential information to sell to a competitor or a nation-state
- Stealing confidential information to leak publicly
- Damaging a company's brand image on behalf of a competitor or out of personal conviction
- Rendering a server temporarily unavailable at a critical time (sales periods, for instance) on behalf of a competitor
Scenarios 1 through 5 primarily involve an attacker operating for their own benefit. Excluding cases of politically motivated hacking (hacktivism), experience shows that a "small" organization is far more conducive to this type of malicious activity than a large enterprise.
Indeed, a "small" website offers the following advantages:
- It was not developed with specific security requirements
- It is not subjected to regular attacks (which would otherwise compel administrators to elevate the security posture)
- It is infrequently maintained, often hosting obsolete (and thus exploitable) technologies. Updates are not deployed promptly (unless outsourced to a managed hosting provider)
- An intrusion is not easily detected (administrators rarely review event logs and do not actively look for suspicious activity)
- If an intrusion is detected, the administrator does not necessarily have the skills to properly remediate the vulnerability (typically, they might patch a flaw but fail to remove all backdoors planted by the attacker), and the company rarely files a formal complaint
- It can sometimes serve as a pivot to internal servers (as secure architecture design is not always top of mind)
Many attackers therefore operate with the objective of reselling assets on the dark web. An attacker controlling a large botnet network can monetize spam-sending or Distributed Denial of Service (DDoS) services.
Each compromised machine expands the botnet network; therefore, the easier a machine is to breach (and the more likely it is to remain compromised), the more attractive it becomes to the attacker. "Small" websites are thus prime targets.
Even activist acts such as website defacement are sometimes accompanied by fraudulent use of the underlying asset.
One case observed during our audits involved the political defacement of a website. Analyzing the server's entire file tree revealed malicious scripts designed to be injected during the exploitation of vulnerabilities such as XSS. The attacker was effectively using this site as an attack platform for third-party compromises.
In such cases, the company can face legal liability for the unlawful activities carried out from its server.
The vulnerability therefore lies in the misconception that you will only be targeted if an attacker—or a competitor hiring them—has a personal grievance against you.
Setting aside the automated bots continuously scanning the web for easily exploitable vulnerabilities, independent attackers actively seek out smaller sites because they can typically compromise them in less than a day (read our white paper on the Top 10 most common vulnerabilities identified during our audits).
Thus, an organization's small footprint and limited profile may keep it clear of targeted corporate espionage campaigns—which remain the preserve of high-profile enterprises—yet these represent only a fraction of overall attack volume (between 15% and 20% according to Verizon's 2014 Data Breach Investigations Report¹).
Becoming a target is therefore entirely democratic, affecting organizations of all sizes. You do not need to have declared adversaries to fall victim to an intrusion. Your web server holds intrinsic value independent of the data it hosts.
And as if that were not enough
Precisely this broad context brings us to a compelling development: the emergence of a new driver for opportunistic hacking, which is likely to further accelerate this trend of targeting small organizations that do not consider themselves at risk.
That driver is Bitcoin!
A brief reminder: Bitcoin is an open virtual currency launched in 2009 based on robust cryptography and a decentralized consensus mechanism. This "cryptocurrency" experienced explosive media attention in 2013 (its valuation surged from €8 to €800 in a single year).
One notable characteristic of this currency lies in its issuance process. Bitcoins are generated by solving increasingly complex cryptographic problems (issuance is exponential at the outset, then tapers off systematically toward an asymptote). This process is known as "mining."
A personal computer or high-performance computing cluster can be used to "mine" Bitcoins, leveraging CPU and GPU compute capacity to solve the underlying mathematical challenge. Naturally, the greater the compute capacity, the faster the production rate.
Suffice it to say that when Bitcoin surpassed the $1,000 mark, interest surged and many users entered the mining space. Alongside mainstream users purchasing high-end gaming rigs to accelerate mining performance, and hobbyists networking gaming consoles to build distributed compute clusters, came malicious hackers.
Threat actors compromise servers and hijack their resources to mine Bitcoins and exfiltrate the proceeds. All unutilized compute capacity on the compromised web server is repurposed by the attacker to generate illicit revenue.
For the victim organization, the consequences include sharply higher power consumption and accelerated hardware degradation (a server running at 100% CPU utilization around the clock generates excessive thermal stress). This is in addition to other malicious activities the threat actor may conduct, typically deploying a combined toolkit spanning phishing, botnet integration, and traffic sniffing.
This attack vector surged in 2013: according to Kaspersky Lab's 2013 Financial Cyberthreats report, 2.5 million attacks attempting to deploy Bitcoin mining software were recorded by the lab²—a fivefold increase compared to 2012, reflecting only telemetry captured by Kaspersky's own infrastructure.
It should be noted that the Bitcoin protocol is mathematically capped at a maximum supply of 21 million Bitcoins by architectural design. Mining Bitcoins therefore becomes progressively more resource-intensive, approaching a horizontal asymptote of 21 million (which industry estimates suggest may be reached around 2040).
Does this imply an eventual decline for this attack vector once all Bitcoins have been mined? Quite the contrary. Prompted by the rapid adoption of this cryptocurrency, numerous alternative coins have emerged, including Namecoin, Dogecoin, Peercoin, and Mastercoin, among others.
Certain alternatives have no supply cap; new assets are launched continually, and while valuations fluctuate, early adopters often mine significant volumes quickly due to low initial difficulty, subsequently waiting for market appreciation.
Threat actors consequently have ample opportunities to exploit this vector for the foreseeable future. Servers deemed "too small to be targeted" face an active prospect of being co-opted as unauthorized crypto-miners if this intrusion exploitation trend continues to develop.
Protecting your assets
It will be rightly argued that smaller organizations do not have access to the same cybersecurity budgets as enterprise accounts. A fair point.
The fact remains that for a hacker looking for an easy target, the range of possibilities is so vast that they won't waste time on a site that puts up even slight resistance when there are 20 others wide open.
A little bit of security keeps the lazy hacker away
Simple measures can be enough to deter an opportunistic attacker with no personal vendetta:
- Require security skills when recruiting IT and web managers
- Train website managers in secure coding practices
- Conduct security audits
- Use security monitoring solutions
Implementing just one of these recommendations will not provide total security, but it will signal that your site has implemented security measures.
A determined attacker will find a vulnerability, but unless you are specifically targeted, you will primarily face hackers looking for low-hanging fruit. They will be deterred and move on to the next site.
ITrust is committed to protecting SMEs and VSBs that lack the extensive budgets of large corporations. Thus, the security monitoring tool IKare, available upon request as a trial version, gives you the same visibility an attacker would have into your sites—and consequently, how tempting a target they represent.
Published in 2014 on ITrust.fr (and still relevant today!) – Written by D. SORIA – ITrust Security Expert
