How malicious hackers get away with data

Compromising sensitive networks is only half the battle for malicious hackers or spies. Once they’re on the network, and have the data they want, they must find a way to get it back outside. Unfortunately, malicious hackers have a number of tools at their disposal, and with lax enterprise oversight of outbound data flows, the chances of getting caught using them are slim, according to Rob Murawski, a member of the CERT Coordination Center. Here are a few common techniques for data “exfiltration” — the technique of stealing data and slipping it past the perimeter — presented by Murawksi at the Virus Bulletin 2006 conference:

Using well-known ports: Just because data is going out over a familiar port doesn’t mean its data was meant for that port. Attackers will use common ports such as 80 (HTTP) or 53 (UDP) to send sensitive data outside a network. Administrators should monitor traffic flows through these ports to spot suspicious data leaving the network.

Encrypting data: Wary of getting caught sending data in the clear, many attackers use encryption to mix up the bits before sending them outside the network. Although SSL and symmetric key encryption such as DES are sometimes used to hide the data, many attackers use far simpler XOR or bitwise encryption to disguise their booty. Why? With few admins even noticing the data leaving the network, why waste time with more complex encryption schemes?

Unmonitored protocols: Malicious programs often hide data in obscure Internet protocols that few network admins are looking for. For example, attackers could hide data in ICMP (Internet Control Message Protocol) echo requests — aka “pings” — that are captured and decoded by specially configured systems on the other end.

Throttled data transfers: Monitoring network flows in and out of your network is a great way to spot suspicious activity, but it’s not foolproof. Sophisticated attackers who are aware that you’re monitoring netflows might choose to throttle data transmissions so as not to arouse suspicions.

Hiding data in other traffic: Failing all else, attackers can hide data in normal network traffic — an art known as “steganography.” For example, attackers might pack stolen data into image files or documents that are then sent outside of the network.