Civil society organisations (CSOs) are being bombarded with the same persistent and disruptive targeted cyber attacks which hit industry and Government.
According to a report by Citizen Lab, and the Munk School of Global Affairs at the University of Toronto, CSOs who work to protect human rights and civil liberties around the world are attacked heavily, yet have far fewer resources to deal with the problem and rarely receive the same attention as the former.
The report claimed that it “consistently” observes sophisticated social engineering and well-informed targeting, rather than a high degree of technical sophistication in the malware used. It claimed that the malware is only as technically advanced as it needs to be to generate results, requiring fewer resources to rely on known exploits so long as their targets remain susceptible to them for behavioural reasons.
“This approach works because key factors determining whether a compromise occurs are typically behavioural rather than technical in nature,” it said. “Once the compromise occurs, basic malware is no less dangerous than more advanced malware—even unsophisticated exploits can permit installation of RATs providing the ability to search for and exfiltrate files and contacts, activate a device’s video and audio recording, and log keystrokes.”
However it did find that attackers are adaptive, typically modifying or designing attacks for use against specific software (including mobile applications) and hardware to reflect new and emerging methods of communication among their targets.
“Attackers exhibit an evolving awareness of civil society technical trends and defences, which is reflected in their attack techniques,” it said. “As a general practice, attackers make improvements to the malware they employ. For numerous malware samples in our study we observed several versions of the malware appearing over time, showing evidence of technical improvements. Adaptations, however, go well beyond malware maintenance. They encompass a wide range of responses to new platforms and behaviours.”
This included a documented increase in Mobile and Mac malware, and specifically observed malware designed for OS X and Android.
Conducted over a four-year period, researchers watched as attackers modified their malicious software and other attack techniques based on the CSOs’ choices of operating systems, and specifically flagged Skype, Twitter and Gmail as vectors of malicious activity.
Professor Ron Deibert, director of the Citizen Lab, said: “It is well known that computer espionage is a problem facing Fortune 500 companies and government agencies. Less well known and researched, however, are the ways in which these same type of attacks affect smaller organisations promoting human rights, freedom of speech, and access to information. We set out to fill this gap in knowledge.”
The report also said that CSOs are hard-pressed to resolve matters themselves, as they reported that they have an understanding of some of the digital risks they face, but in many cases noted a lack of capacity and resources to dedicate to the problem.
With rare exceptions, there is a lack of funding to hire technical security experts, or the opportunity to engage with Government on digital defence or overall policy in a manner that protects their security and confidentiality needs. Some bar
ely have dedicated IT staff, let alone experts to deal with the targeted attacks.
“Even if CSOs are able to undertake basic remediation after an attack, they are unlikely to be able to conduct the technical investigation and training necessary to fully understand and mitigate future threats,” it said.
