Subcontractors are for hackers the weakest link in security chain

Hackers use to target subcontractors to hit big enterprises due the poor level of security they offer, in the energy sector this trend is very concerning.

Let’s follow the discussion on the hacking world and the way hackers impact business with their activities. We discussed about the role of hackers for companies and their employment in cybercrime ecosystem.

Let’s try to ask ourselves how would work a hacker in order to hit a company or an organization.

The numerous incidents daily occur teach us that one of the most common way to hack an organization is trying to exploit vulnerabilities within subcontractors networks and in the process that governs the partnership with target entity.

Big enterprises and organizations in many cases have been attacked exploiting the privileges channel of subcontractors, often subcontractor systems have been vulnerable to the attack of hackers and the data of target companies were poorly defended.

The problem seems to be extended to virtually all industries, from energy to the defense, while big enterprises have adopted all the necessary countermeasures to mitigate cyber threats, the economic crisis and the erroneous perception of security as a cost has caused serious misconducts in the subcontractors.

According  experts at Alert logic the energy industry customers are targeted more often than those in any other industry, the number of cyber threats observed from Jan. 1st to May 23th is nearly 9,000 and more that 50 percent of them is a malware-based attack.

Thirty-one percent of the threats were brute force attacks, in which hackers repeatedly attempt to crack passwords, the report said.

The ICS-CERT issued in July a Monitor report that revealed an intensification for brute force attacks against control systems mainly belonging to the energy sector. The ICS-CERT received notification for more than 200 cyber attacks against critical infrastructure operators between October 2012 and May 2013.

According the ICS-CERT the victims were targeted by mostly by watering hole attacks, SQL injection, and spear phishing.

Alert logic released a security bulletin remarking the concerning trend.

“That’s higher than any other industry that’s going on out there,” “The only thing that might even come close to this would be financial.” said Stephen Coty, director of threat research for Houston-based security firm Alert Logic.

The energy sector described in the report represents a meaningful example of how company cybersecurity policies, despite being very stringent of physical security, are deficient in the definition of requirements for cyber security of subcontractors.

“I don’t think that they hold their contractors up to the same standards that they do their employees. I think that’s a growth issue, or understanding the risks.” Coty said.

Alert Logic revealed that in March that about two-thirds of its 54 energy industry clients experienced brute-force or malware attacks, an impact  higher than in other sector.

The hackers that use to target subcontractors to hit a company usually following precise steps contextualized by Alert Logic for the energy sector:

• Identify subcontractors that may have access to valuable information.
• Identify the subcontractors’ employees.
• Start spear phishing campaign or a watering hole attacks against the employees.
• The information collected is used to penetrate the target computer systems.
• The stolen credentials are used to access valuable information such as financial data or intellectual property.

Booz Allen Hamilton executive Emile Trombetti reported for example that hackers used that tactic to send a message that appeared to be from his daughter during an attack, this is the proof that attackers have collected information about him.

“They found out my daughter’s name,”“They found out what school she went to. And they found out her Yahoo address. And I get an email that says, ‘Dad, it’s an emergency.’”

Security level offered by subcontractors is crucial for companies business, subcontractors are similar to the appendices of the target company and should be carefully evaluated the process they implement for data and infrastructure protection A good starting point is to assess compliance with the standards of clients and contractors and carefully consider the information flows between the parties.

Until the subcontractors will be vulnerable, the entire chain of security is at risk!

Pierluigi Paganini

(Security Affairs –  cybersecurity, subcontractors)