CyberSecurity: Origins of the Advanced Persistent Threat (APT)

For many people within the corporate security community, Google’s January 2010 disclosure that it had been targeted by a sophisticated attack, marked the beginning of the Advanced Persistent Threat (APT) era.  Although Google’s disclosure put APT into the spotlight, law enforcement, intelligence and counterintelligence communities had already been using the term for a number of years.

This is the second of a series of articles on CyberSecurity and Advanced Persistent Threats (APTs).

Origins of APT

The term APT was not originally intended to be the generic term that marketers and media have transformed it into. It was developed to refer to specific, known state-sponsored groups in the Asia-Pacific region that conducted attacks against specific targets at the direction of the US government.

The United States Air Force (USAF) coined the phrase Advanced Persistent Threat back in 2006 because teams working within the service needed a way to communicate with counterparts in the unclassified public world. Department of Defense and intelligence community members typically assign classified names to specific threat actors, and use the term intrusion set to describe activities by those threat actors. If the USAF wanted to talk about a certain intrusion set with uncleared personnel, they could not use the classified threat actor name. Therefore, the USAF developed the term APT as an unclassified moniker.^[1]

Defining Advanced Persistent Threat

Richard Bejtlich^[2], Chief Security Strategist at FireEye, defines APTs as follows:

• Advanced means the adversary can operate in the full spectrum of computer intrusion. They can use the most pedestrian publicly available exploit against a well-known vulnerability, or they can elevate their game to research new vulnerabilities and develop custom exploits, depending on the target’s posture.
• Persistent means the adversary is formally tasked to accomplish a mission. They are not opportunistic intruders. Like an intelligence unit they receive directives and work to satisfy their masters. Persistent does not necessarily mean they need to constantly execute malicious code on victim computers. Rather, they maintain the level of interaction needed to execute their objectives.
• Threat means the adversary is not a piece of mindless code. This point is crucial. Some people throw around the term “threat” with reference to malware. If malware had no human attached to it (someone to control the victim, read the stolen data, etc.), then most malware would be of little worry (as long as it didn’t degrade or deny data). Rather, the adversary here is a threat because it is organized and funded and motivated. Some people speak of multiple “groups” consisting of dedicated “crews” with various missions.

McAfee’s definition for APT is:

Advanced persistent threat (APT) — sophisticated, covert attacks bent on surreptitiously stealing valuable data from targeted and unsuspecting companies — can inflict serious harm to your business. Their relentless, persistent intrusions typically target key users within organizations to gain access to trade secrets, intellectual property, state and military secrets, computer source code, and any other valuable information available.

Evolution of APT

In the early days, attacks typically compromised only a few systems because so few systems were connected to the Internet. But even back then, governments were already targeting other governments using some form of cyber espionage.

One of the earliest publicly documented cases was a first-hand account written by Clifford Stoll’s, The Cuckoo’s Egg, which profiles a West German hacker, Markus Hess, working for the Soviet KGB who, in 1986, broke into a computer at the Lawrence Berkeley National Laboratory (LBNL).^[3]

Current APT Landscape

While APTs use many of the same techniques as traditional attacks, they differ from common botnets and malware because they target strategic users to gain undetected access to key assets.  APTs can do insidious damage long before an organization knows that it has been hit.

According to Mandiant’s 2015 M-Trends report, the median number of days that threat groups were present on a victim’s network before detection was 205.  Although this is 24 days less than the median in 2013, it demonstrates that many organizations don’t have the internal skills nor countermeasures to deal with APTs.  What’s worse is that 69% percent of victims learn from a third party that they have been compromised.^[4]

Figure 1: Intrusions by Industry.  src: Mandiant

APT Life Cycle

It has been suggested that most sophisticated attackers, regardless of their motives, funding or control, tend to operate in a certain cycle when attacking their targets.  Figure 2 shows the evolution of APTs and outlines the APT Life Cycle.

Figure 2: Evolution of APT and APT Life Cycle.  src: McAfee

APTs represent a fundamental shift compared to the high-profile hacking events of prior years that commonly targeted networks. Focusing on the weakest links of your defense chain, APTs target specific system vulnerabilities and, more importantly, specific people.

While the victimized organizations vary in size, type, and industry, the individuals they [APTs] target usually fit the same profile: people with the highest-level access to the most valuable assets and resources.^[5]

Cybersecurity professionals find themselves struggling to keep up with technical innovation as learning resources for would-be hackers have increased and are often freely available online. The Metasploit framework has revolutionized vulnerability testing, making powerful vulnerability scanners freely available to anyone who calls themselves a penetration tester.

Conclusion

Today’s organizations can’t assume that they will fly under the radar of APTs.  As exploits and methods propagate within the hacker community, more organizations will fall victim to targeted attacks and suffer potentially irrecoverable losses.

Advance incident response planning can significantly improve your chances of early detection and more effective remediation.^[6] The key to effective APT protection, detection, and response is rigorous implementation of security best practices and ongoing education with your most highly targeted users.

Bibliography

Advanced Persistent Threat, APT, APT Life Cycle, Cybersecurity, Google, Hacking, Penetration Testing, Richard Bejtlich, US, USAF Security