The Network Security. Org

RSS Feed

← Sex, Spies and Hard Drives, Wipe Data Properly Why one virus engine is not enough →

How malicious hackers get away with data

November 11th, 2006 · No Comments


Compromising sensitive networks is only half the battle for malicious hackers or spies. Once they’re virus.jpgon the network, and have the data they want, they must find a way to get it back outside. Unfortunately, malicious hackers have a number of tools at their disposal, and with lax enterprise oversight of outbound data flows, the chances of getting caught using them are slim, according to Rob Murawski, a member of the CERT Coordination Center. Here are a few common techniques for data “exfiltration” — the technique of stealing data and slipping it past the perimeter — presented by Murawksi at the Virus Bulletin 2006 conference:

Using well-known ports: Just because data is going out over a familiar port doesn’t mean its data was meant for that port. Attackers will use common ports such as 80 (HTTP) or 53 (UDP) to send sensitive data outside a network. Administrators should monitor traffic flows through these ports to spot suspicious data leaving the network.

Encrypting data: Wary of getting caught sending data in the clear, many attackers use encryption to mix up the bits before sending them outside the network. Although SSL and symmetric key encryption such as DES are sometimes used to hide the data, many attackers use far simpler XOR or bitwise encryption to disguise their booty. Why? With few admins even noticing the data leaving the network, why waste time with more complex encryption schemes? How malicious hackers get away with data | InfoWorld | Analysis | 2006-10-30 | By Paul F. Roberts

From around the Web

  • Advertisments