Methodology for Detecting Advanced Persistent Threats in Oracle Databases

What are They?

APTs are sophisticated cyber attacks to get valuable information. They use custom malware to gain leverage within a network. They may use a wide variety of tools and techniques to gain access to the target. They can vary their tools and techniques used depending on the target. The attackers are persistent and adjust their tactics to get around any protection mechanism in their way. This makes them difficult to detect and stop.

How do They Work?

APT attackers use an exploitation life cycle composed of seven steps. These include reconnaissance, initial entry, escalate privilege and being persistent in the attack (CA Technologies, 2012; Mandiant, 2010). An attacker selects a target and acquires information about it that can be exploited. They use infiltration by surveillance to gain as much information about the target (Brill, 2010; Sood & Enbody, 2012). Social engineering is an easy way of getting this information. The initial entry into a database can be done using several methods. One way is by the use of Universal Serial Bus (USB) drives loaded with malware or key loggers to gain information (Brill, 2010). Also APT malware can copy itself to the USB stick and spread to other machines that the stick is placed in.

Another way is to establish a web site to store their malware and send emails to unsuspecting victims. When a user clicks on a URL they are sent to the attackers site and the malicious software is downloaded. Then the malware establishes a command and control (C&C) communications pathway back to the attacker. From here the attacker can perform actions to gather information, destroy data or deface a system. One of these actions is to update the malware code and infrastructure used in the attack. These C&C paths may be encrypted to prevent easy detection (Mandiant, 2010). Now the attacker can look around and establish higher privileges or obtain passwords. They would be interested in discovering administrator accounts since they have elevated privileges into many systems. Next the attacker can install various utilities for carrying out their attack. Now they can establish a foothold and begin stealing data and setting up staging servers. They can also create many infected sites to use. If an infected system is found and taken down, the attacker finds out and moves operations to any infected machine on the same network. They may have several infected systems to use to hide their operations. They can also rotate these around to keep from being found. Thus increasing the difficulty in detecting APTs.