When RSA Security disclosed in February that a third party had breached its networks, the company claimed that it had been hit by an advanced persistent threat. Federal research facility Oak Ridge National Laboratory also blamed its recent breach on an APT.
For both RSA and Oak Ridge, the attacks turned out to be a spear-phishing attack. In both cases, employees were tricked into opening the attached file that came with an email that looked like it came from within their organizations.
Almost all publicized and self-declared APT attacks this year have originated as spear phishing, Anup Ghosh, founder and chief scientist of Invincea, told eWEEK. Spear phishing may not be a “glamorous” way of breaching the network, but it is an extremely effective one, Ghosh said.
There is a growing feeling among security researchers that organizations were using APT as a convenient excuse when their network security has been breached. “The funny thing here is that the malware used in most of the ‘APT’ attacks we’ve seen recently isn’t really all that nefarious; it’s just the new stuff on the market,” Ghosh said.
While APTs are generally attacks that target sensitive data and are generally not opportunistic attacks, Ghosh noted that the attack methodology is not advanced at all. “Prey on the natural curiosities of the user; bank on the fact that organizations are using antiquated technology; get the user to open up the door to the network, establish residency, scan and move laterally–and all along the way, duping one user after another,” Ghosh said.
In the 2011 Data Breach Investigations Report, researchers from Verizon Business expressed some concerns about “APT hysteria” that has swept the security industry. The term’s originators intended it to refer to allegedly state-sponsored attacks from China, and others use it to describe any threat possessing “above average skill and determination,” Verizon researchers wrote.
However, it’s gotten to the point where thinking that “everyone is a target” of an APT has led to “irrational fears about the boogeyman while common thieves clean you out of house and home,” according to the report.
For more, read the eWEEK article: Advanced Cyber-Attack Claims Are Usually False, Overhyped.