Among this year’s biggest news stories: epic hardware vulnerabilities, a more lethal form of DDoS attack, Olympic ‘false flags,’ hijacked home routers, fileless malware – and a new world’s record for data breaches.
It was a year that shook IT security experts and users out of their post-holiday cheer as soon as they got back to their desks after the new year began, with the disclosure of a new and widespread class of hardware attack that affected most computers worldwide.
In addition, the long tail of the now-infamous Spectre and Meltdown vulns continued to haunt the security industry all year, with more findings exposing security flaws in hardware and related side-channel attack scenarios. Mass updates to operating systems, browsers, and firmware ensued – often with performance trade-offs.
A researcher at Black Hat USA this summer also added a new spin to hardware hacking when he demonstrated how he cracked CPU security controls to gain kernel-level control, aka “God mode.”
What else? Deceptive cyberattacks became a new M.O. for nation-states this year: Russia’s GRU military hacking team posed as North Korean hackers in a widespread targeted attack against the Winter Olympics in South Korea. They employed destructive malware to knock out the games’ IT systems, Wi-Fi, monitors, and ticketing website.
Meanwhile, Russia was up to its old tricks with another novel and destructive campaign: Some 500,000 home and small-office routers and network-attached storage (NAS) devices worldwide were discovered infected as part of a massive botnet. The so-called VPNFilter attack infrastructure included stealthy, modular components that infect, spy, steal, and self-destruct. The initial target appeared to be Ukraine, where the majority of infected Internet of Things (IoT) devices were found, but the losing battle of getting consumers to update or patch their home and IoT devices was a chilling wake-up call.
2018 also featured a new more damaging form of distributed denial-of-service (DDoS) attack that exploits unprotected Memcached servers, as well as the new reality of attackers “living off the land” with so-called fileless malware attacks, using legitimate tools such as PowerShell to do their hacking. These malware-free attacks increased by 94% in the first half of the year, and they don’t show any signs of slowing down.
And those are just some of the biggest news stories of 2018. For a closer look at yet another year to remember, check out Dark Reading’s new report, “The Year in Security: 2018,”
Source: https://www.darkreading.com/threat-intelligence/2018-in-the-rearview-mirror/a/d-id/1333532
