About these ads

1-15 July 2014 Cyber Attacks Timeline

It’s time for the first cyber attacks timeline of July reporting the main cyber events happened (or discovered) during the first half of the month.

In a short summary: if even the number of recorded attacks remains moderate, the most important events of this period are related to Cyber Espionage: eight sophisticated campaigns have been discovered, a number remarkably high for this category.

On the cyber crime front, the most important event of this period is undoubtedly the massive attacks against Boleto, the Brazilian payment system ($ 3.5 billion is the amount of money stolen by the criminals), but also the purported leak of CNET’s database (subsequently offered on sale by the criminals at the symbolic price of 1 Bitcoin) deserves a special mention. Also the African continent is on the spot with the discovery of a repeated fraud against a couple of Nigerian banks.

Nothing particularly remarkable by hacktivists, with the partial exception of the Syrian Electronic Army, back with the Specialty of the House (the account hijacking, this time against the official Twitter account of the Israel Defence Force). The hacktivistic landscape also offered some attacks against Israel, related to the events in Gaza. Nothing particularly relevant so far, but everything suggests that the number of these attacks will dramatically increase in the next timeline.

If you want to have an idea of how fragile our electronic identity is inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013 and now 2014 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

1-15 July 2014 Cyber Attacks Timeline Read more…

About these ads

June 2014 Cyber Attacks Statistics

It’s time to aggregate the Cyber Attacks Timelines of June (Part I and Part II) into statistics.

So, as usual, let’s start with the Daily Trend of Attacks chart, which shows quite an irregular trend with a sharp peak on the 11th.

Daily Attack Trend June 2014

The Motivations Behind Attacks chart confirms once again Cyber Crime at number one with 65% of occurrences. Overall the values are almost specular to the previous month. Particularly meaningful is the 11% of operations motivated by Cyber Espionage.

Motivations June 2014

The Distribution Of Attack Techniques chart shows a 27.4% of unknown attacks, a result in line with the previous month when this value was 26%. The rise of DDoS is another interesting aspects (this technique is increasingly used to blackmail victims), as also the 9.7% of targeted attacks, a relatively high value for this class, and, again, in line with the previous month.

Techniques June 2014

Once again, Industry leads the Distribution of Targets Chart with 35.5%. Governmental targets rank at number two, close to 20%, well ahead of Organizations at number three with a modest 6.5%.

Targets June 2014

Drilling down the Distribution of targets belonging to industry, shows quite an heterogeneous landscape. Software industries lead the chart with 22.7%, followed by Restaurants (??) with 13.6% and Financial Services (9.1%). All the other categories are well behind with a “flat” 4.5% each.

Industry Drill Down Jun 2014

As usual, please bear in mind that the sample must be taken very carefully since it refers only to discovered attacks included in my timelines. The sample does not pretend to be exhaustive but only aims to provide an high level overview of the “cyber landscape”, or at least of the ones that gained space in the media (yes, using an abused expression this is just the tip of the Iceberg).

Additionally, if you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013 and now 2014 (regularly updated). You may also want to have a look at the Cyber Attack Statistics.

Of course follow @paulsparrows on Twitter for the latest updates, and feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

16-31 June 2014 Cyber Attacks Timeline

I do not know if being happy or not, but it looks like the second half of June (the first timeline covering 1-15 June is here) has seen a sharp inversion of the decreasing trend recorded on the last few months. I have registered an increase of the number of attacks with particular focus on targeted attacks.

The cyber crime front offered several noticeable events, targeting, just to mention the most devastating cases: AT&T, Evernote, the State of Montana (1.3 million single individuals potentially affected), and Butler University.

Moving to hacktivism, the cyber temperature is still high in Brazil, where the hacktivists concentrated their unwelcome attentions. Other points of interest involve Pakistan, and US.

Last but not least, this period recorded an unusual number of targeted attacks spotted in the news. The list includes (but is not limited to): the British Government Secure Intranet, an US Hedge Fund, Vietnamese Ministry of Natural Resources and Environment, ICS vendors in US and Europe and a Government Agency in Taiwan.

As usual, if you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012, 2013 and now 2014 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

16-31 June 2014 Cyber Attacks Timeline rev2

Read more…

Deloitte Global Defense Outlook 2014: Cyber Operations Emerge as a Global Threat

Cyber Incident

Cyber incidents by defense spending type, 2013. Source: Deloitte Global Defense Outlook 2014

Deloitte has just released the Global Defense Outlook 2014. This independently developed report examines policies, practices, and trends affecting the defense ministries of 50 nations, and has been developed with publicly available information along with interviews with officials in government and industry, and analyses by Deloitte’s global network of defense professionals.

A section of the report is dedicated to Cyber Operations, and, as one of their publicly available data sources, Deloitte used data from my blog.

The structured analysis of the data confirms a trend: Cyber-operations are nowadays considered a national security threat across the globe.

  • The global threat to computer systems and information networks is earning more attention and policy response from defense ministries worldwide.
  • More than 60 percent of cyberattacks are directed against other Top 50 nations and that more than 20 percent of cyberattacks are directed against non-Top 50 nations. Developing economy status does not protect a nation against the prospect of a cyberattack.
  • Among the higher-income nations in the Top 50, industrial targets account for one-half to two-thirds of cyberattacks, while among the lower-income nations in the Top 50, most cyberattacks are directed against government targets. This difference may reflect the relatively high level of security and defensive capability around government systems in higher-income nations and the availability of potentially lucrative industrial targets. The difference may also reflect the relatively higher number of state-owned enterprises in the lower-income nations.
  • Cyber Operations are no longer the domain of higher-income Top 50 nations.
Cyber Incidents Target

Cyber incidents by target and defense spending type, 2013. Source: Deloitte Global Defense Outlook 2014

A really interesting reading, and not only for its implications in Cyber Space. The complete report can be found at this link.

2014 Cyber Attacks Timeline Master Index (at least so far…)

Thumbnail Master IndexFinally I was able to organize the timelines collected in 2014. I have created a new page with the 2014 Cyber Attacks Timeline Master Index accessible either directly or from the link in the top menu bar. Hopefully it will be regularly updated.

With this opportunity I also re-ordered the timelines and stats for 2013. Now everything should be more structured. As usual feel free to consult and share, and follow my Twitter profile @paulsparrows to get the latest updates.

1-15 June 2014 Cyber Attacks Timeline

It just looks like attackers are enjoying the beginning of the Summer, since the first half of June confirms the decreasing trends.

The controversial 2014 World Cup has revived the hacktivists, and in particular the Anonymous collective who kicked off the Operation OpWorldCup, targeting Brazilian Governmental institutions and Sponsors of the World Cup.

Looking at the Cyber Crime, the most remarkable event of the month is the extortion attempt against  Belgian and French customers of Domino’s Pizza (650,000 users affected). It is also worth to mention the wave of DDoS attacks against Feedly and Evernote, in the first case motivated by extortion, and also the compromising of a US Army database in South Korea.

Last but not least, chronicle report the details of two Cyber Espionage Operations: Operation Molerat, originating allegedly from Middle East, and yet another one from China, discovered by Crowdstrike and attributed to a group dubbed Putter Panda.

As usual, if you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012 and now 2013 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

1-15 June 2014 Cyber Attacks Timeline

Read more…

May 2014 Cyber Attack Statistics

Update on 19/06/2013: I had to update the graph since, in compiling the first timeline of June, I discovered two attacks that apparently fell off my radar: the DDoS attacks to Moz and Plenty of Fish.

I found the time to aggregate the timelines of May (part I and part II) to derive some interesting stats. As a general rule, since many readers often pose the same questions, all the stats are derived from the Cyber Attacks Timelines I publish (almost) bi-weekly.

As I noticed previously in these pages, looks like attackers are just waiting for the Summer, since the number of events in May has experienced a sensible decreease.

The Daily Trend Of Attacks chart shows quite a linear trend with two small peaks around the 15 and 30 May. Overall the activity appears quite limited.

Trend May 2014

Cyber Crime rocks! This is the outcome of the Distribution of Attacks chart, showing a 67% of attacks carried on for criminal purposes. Particularly interesting is also the 11% of reported attacks related to Cyber Espionage.

Motivations May 2014

And in (too) many cases the reason of the attacks is unknown. At least this is what the Distribution of Attack Techniques chart states. Other interesting findings include the rise of Account Hijackings and the noticeable 9% of Targeted Attack (an high incidence this month, undoubtedly related to the similar high incidence of Cyber Espionage).

Techniques May 2014

And last but not least, the Distribution of Targets chart shows a predominance of attacks against Industry (41%), twice the occurrences related to Governmental targets (20%). Targets belonging to Educational institutions rank at number three with “only” the 9%.

Distribution May 2014

Drilling down the Industrial targets provides further interesting findings. Cyber Crime rules and, maybe not a coincidence, targets related to E-Commerce rank at number one (after all this was the month of the Ebay breach) together with software industries (18.2% both). Entertainment rank at number three with 13.6% each.

Industry May 2014

As usual, please bear in mind that the sample must be taken very carefully since it refers only to discovered attacks included in my timelines. The sample does not pretend to be exhaustive but only aims to provide an high level overview of the “cyber landscape”, or at least of the ones that gained space in the media (yes, using an abused expression this is just the tip of the Iceberg).

Of course follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

Follow

Get every new post delivered to your Inbox.

Join 2,898 other followers