Questions tagged [apt]

APT Stands for "Advanced Persistent Threat". It is usually used in reference to a threat posed by a group with the capability and intent to persistently and effectively carry out cyber attacks against specific entities. APT has been used to refer to either the perpetrators, or the actual hack itself (typically when there is no attribution).

Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below:

Advanced – Operators behind the threat have a full spectrum of intelligence gathering techniques at their disposal. These may include computer intrusion technologies and techniques, but also extend to conventional intelligence gathering techniques such as telephone interception technologies and satellite imaging. While individual components of the attack may not be classed as particularly “advanced” (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They often combine multiple targeting methods, tools and techniques in order to reach and compromise their target and maintain access to it. Operators may also demonstrate a deliberate focus on operational security that differentiates them from "less advanced" threats.

Persistent – Operators give priority to a specific task, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a “low-and-slow” approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.

Threat – APTs are a threat because they have both capability and intent. APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code. The operators have a specific objective and are skilled, motivated, organized and well funded.

From Wikipedia: Advanced Persistent Threat

48 questions
115
votes
6 answers

What would one need to do in order to hijack a satellite?

I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites. What would be required to hack a satellite (in general terms, any hack really)? Are they all basically connected in the…
Incognito
  • 5,204
  • 5
  • 27
  • 31
46
votes
3 answers

Mars Curiosity Rover Security

Does the software in the Mars Curiosity Rover have any security features built-in? I can't imagine how someone would hack into it, but if the rover does indeed have some protection against malicious hackers, what kind of attacks would it be…
pasawaya
  • 1,027
  • 1
  • 9
  • 12
36
votes
4 answers

Malware that can survive BIOS re-flashing

The well-respected security consultant Dragos Ruiu is reporting that he has been infected with mysterious malware that can survive re-installation of the OS and re-flashing of the OS. In other words, he has taken an infected machine, wiped it,…
D.W.
  • 98,420
  • 30
  • 267
  • 572
30
votes
7 answers

Protecting critical state infrastructure from the aftermath of a nuclear blast

Countries rely on computer infrastructure for a huge percentage of communications and military management, as well as utilities like electricity. Unfortunately, nuclear attacks release massive electromagnetic pulses that damage these…
Polynomial
  • 132,208
  • 43
  • 298
  • 379
27
votes
2 answers

How do big cloud providers guard against VM escape attacks?

I think it's pretty much unassailable to say that cloud computing as we know it depends on the concept of the robustness of virtual machines. Where one can depend on the security of VMs they allow workloads from multiple customers of a cloud…
mostlyinformed
  • 2,715
  • 16
  • 38
17
votes
2 answers

What are prudent security precautions to take for business travel by people with access to sensitive info?

The New York Times had a front-page article today: Traveling Light in a Time of Digital Thievery, aka "Electronic Security a Worry in an Age of Digital Espionage". Former director of US national intelligence Mike McConnell is quoted as saying “In…
nealmcb
  • 20,544
  • 6
  • 69
  • 116
16
votes
6 answers

How are attacks and APTs attributed?

It's increasingly common to see major attacks on governments and corporations attributed to a specific country or group. Typically we don't know for certain, but it's at least suspected. Given the general anonymity of the internet and the ability…
11
votes
5 answers

Government / State cyberwarfare organizations

I am working on some research regarding advanced persistent threats. Within this effort, discussion of cyber-warfare started. Looking further into the subject, I have found a plethora of links regarding the US and China when it comes to state…
Ormis
  • 1,940
  • 13
  • 18
9
votes
2 answers

Does the Mebromi BIOS flashing rootkit mean APTs for personal computers are here?

With the recent discovery of the Mebromi BIOS firmware virus/MBR rootkit in the wild are we now actually in the age of Advanced Persistent Threats (APT) for personal computers and does that imply the malware solutions of the last two decades are…
zedman9991
  • 3,377
  • 15
  • 22
9
votes
1 answer

How to verify that Google's apt signing key change is not malicious?

I have an Ansible script that setup google chrome apt repo. I keep Google's signing key together with the scripts (rather than download it every time) because I think it minimizes the chance of getting malicious key (TOFU security model). Now the…
Jan Warchoł
  • 191
  • 1
  • 5
7
votes
1 answer

Single point of failure: can US government requests for passwords be a vector for attack?

In recent news, CNET has reported requests for passwords, hashing and/or encryption algorithms and salts from U.S. government agencies: The U.S. government has demanded that major Internet companies divulge users' stored passwords, according to two…
Deer Hunter
  • 5,297
  • 5
  • 33
  • 50
6
votes
2 answers

Detecting Pass-the-Hash

I was wondering what you guys are doing to detect attacks like Pass-The-Hash within your network. I've read about Breachbox http://www.darkreading.com/monitoring/researcher-to-open-source-tools-for-find/240156749 and would be interested to hear…
t0x1c
  • 91
  • 3
6
votes
1 answer

How Google Detects State Sponsored Attacks

A user on Twitter posted a screenshot in which Google warns him as he may be targeted by state sponsored attackers. What kind of attacks can be detected by Google and how?
Ivan Todorov
  • 193
  • 1
  • 3
5
votes
5 answers

Is there a simple and highly secure office suite?

I am designing a highly restricted workstation build for a secure environment. At the minute this is planned to use Windows 7, but I am considering Linux. The users will on occasion open documents from external sources, and I need there should be…
paj28
  • 32,736
  • 8
  • 92
  • 130
5
votes
3 answers

How often do high-end attackers actually use zero-day exploits?

Earlier this week the head of the NSA's Tailored Access Operations unit rather remarkably gave a presentation at the USENIX Enigma security conference. (News coverege here and here; video of the talk here). The topic of the talk: how to defend…
mostlyinformed
  • 2,715
  • 16
  • 38
1
2 3 4