How to tell if you've been hacked

According to the UK Government’s 2014 cybersecurity survey, 81% of large businesses have suffered malicious data breaches. That suggests almost one in five didn’t. But how can those companies be sure?

Working out whether you’ve been hacked by cybercriminals is like leaving your diary in your bag while you visit the bathroom. When you get back, everything might still be in your bag, but you can’t be certain that no one sneaked a peek.

“In this context, it’s impractical to prove a negative,” said Lenny Zeltser, a senior faculty member at the SANS Institute, who teaches malware defence and analysis there. “A company responding to signs of infection can conclude that it has been breached,” he points out. “However, the lack of visible signs of a compromise doesn’t indicate that the enterprise has not been breached.”

Or to quote Donald Rumsfeld, when thinking about hackers, companies will always have to cope with those pesky unknown unknowns.

In the early days of cyber intrusion, many hackers were crying out to be known. They were eager to crow about what they had done, and often revealed themselves in spectacular fashion by deleting files or defacing websites. These attackers still exist, and are often driven to make a political point.

Types of hackers

“If a hacktivist attacks you, you’re going to know about it within 24 hours, because they’re going for the glory,” said Harry Sverdlove, CTO of IT security firm Bit9 + Carbon Black. “They’ll paste your passwords onto Pastebin, and they’ll mess up your website,” he said.

There are other types of cybercriminal too, though, Sverdlove warns. “There are criminal enterprises, and there’s espionage, which may be corporate or nation state. It’s that last category that wants to stay silent, because they want to stay in [your network] as long as possible.”

These attackers are after your intellectual property. They want to pilfer your patents, and steal your negotiating documents. But organised criminals are also eager to stay inside your system as long as possible, too, siphoning off valuable data such as customer information and credit card details.

Whatever the motive, the stealthy attacker will use a variety of tricks to avoid detection. They want to avoid changing anything too much, lest it draw unwanted attention from alert systems administrators.

One way they do this is by “living off the land”, said Sverdlove. Stealth attackers will sometimes use programs that are already on a victim’s computer network to do their dirty work, rather than installing malicious software.

Installing custom malware to send stolen data to a remote server halfway across the world can risk detection. Instead, he has seen criminals using brand-name online storage services to upload sensitive data from their victims’ networks.

“They use common applications. It wasn’t a piece of malware, and so it wasn’t going to get flagged by antivirus,” Sverdlove said. These applications might be used by any legitimate employee, making them hard to spot.

Smart hackers may also send their stolen data at peak times of the day, so that they can blend in with everyone else’s internet traffic on the company network. This is safer than sending gigabytes of data at night, when no one else is using the network, Sverdlove said. Hackers may also trickle data out of the organisation slowly, rather than in a torrent, to help stay below the radar.

Stealthy hackers are a lot like black holes. They suck in all of the material they can find, and you can’t see them directly. So perhaps we can learn something from astronomers. Instead of looking at the black hole directly, they find evidence of a black hole based on what’s happening to things around it.

Have you been pwned?

Sometimes, that evidence may not even be on your own network. Zeltser realised that social media chatter can often throw up information about suspicious activity concerning your company online.

With tongue firmly in cheek, he set up a proof of concept website: Was Company Hacked? It performs a custom Twitter search based on a brand name entered by the user, along with some appropriate security hashtags, to see if there is any chatter in the Twitterverse about attacks on the company.

Australian security expert Troy Hunt has taken things a step further with Have I Been Pwned? Instead of looking for social media chatter, this site gathers two sets of data. The first comes from large data breaches that have been publicly disclosed. The second comes from what he calls ‘pastes’.

One of the first places for personal data to appear after it has been stolen is on Pastebin. This site allows people to paste information publically and anonymously. Many people paste legitimate things on Pastebin. Some post novels. Others, resignation letters, or their carefully compiled list of every single video game, ever.

But others post more contentious documents. Anonymous members have posted missives urging attacks against companies there. And some others post stolen customer details, such as email addresses and encrypted passwords. Lots of them.

A Twitter bot called Dump Monitor collects information about these pastes and the emails in them. Hunt’s site picks those up and catalogues them.

The end result is a service that allows users to enter an email address or username that they have used online. ‘Have I Been Pwned’ tells the user whether it has turned up in any of the breaches. The site will also tell users whether that information has been posted to Pastebin by a hacker.

It’s a useful personal safety tool for internet users, but Hunt says that he’s now getting attention from companies, too.

“I’m working with a number of organisations behind the scenes that are using ‘Have I Been Pwned?’ to identify indicators of compromise, namely the appearance of their staff and customers in publicly disclosed data dumps,” he said. “Seeing the volume of hits they’re getting is alarming. Massive troves of data are turning up every day.”

Turn your gaze within

This kind of tool can be a useful weapon in the battle against stealthy hackers, but it isn’t the only place to look for possible hacking activity. “There are many, many indicators of compromise, it’s just a question of what’s being monitored,” added Hunt.

The most obvious place to look is inside your own network. Years ago, IT companies focused on the perimeter – the ‘ring of iron’ around the corporate network that was supposed to keep hackers out. That’s still important, but it’s no longer enough, say experts.

“Relying on a strong perimeter? That’s really stupid,” said Larry Ponemon, whose Ponemon Institute researches privacy and data breaches online, and consults on mitigating cyber damage. “It might only be one in a million things that get inside your firewall, but that one thing becomes very important,” he added.

How do you cope with that danger? We could take a lesson from the NSA, which knows a thing or two about unauthorised intrusion. In December 2010, Deborah Plunkett, head of the NSA’s Information Assurance Directorate, admitted that there was “no such thing as ‘secure’ anymore”. Instead, the agency works under the assumption that hackers are already inside its network.

Before becoming VP of advanced security and strategy at IT security firm Core Security, Eric Cowperthwaite was information systems for a large healthcare firm in Seattle. Assuming that the network had been hacked might have been too strong an approach for his board of directors, he said, but a strong internal focus was definitely on the menu.

“What they expected as a strategy was for me to build the best security possible, and then also have the ability to detect malicious behaviour and respond to it,” he said. “Let’s assume that the bad guy can breach our network if they’re really determined.”

The systems to detect that intrusion are many and varied. Hunt recommends security analytics tools like Arbor Networks’ Pravail, that gather network packet data and lets you visualise it to look for specious activity. Others recommend intrusion detection and prevention systems that sit on your servers or on your network, watching for clear and present dangers.

Defence in depth

Ultimately, though, detecting hackers takes an element of human intelligence. It’s about narrowing your focus, and understanding where to look first. Sun Tzu, an ancient Chinese military strategist who gets quoted by security researchers a lot, wrote a treatise on military security called The Art of War. One of its lessons was ‘know your enemy’.

“I need to have attack intelligence, so that I know how and when and where I will be attacked,” said Cowperthwaite. Part of this involves understanding the paths to the most valuable data in your organisation, so that you can both harden those paths, and also monitor them for suspicious activity. “It’s not just that there’s a web server that’s vulnerable that lets them get in, it’s the fact that the web server sits on a pathway to critical assets,” he said.

One of the advantages of looking for malice inside your network is that now you’re fighting hackers on your own turf, said Sverdlove, pointing out that it’s easy for them to hide in the wild, on the sprawling internet outside your network.

“The moment that they come into your system, the advantage switches. If you know your system, being able to detect them quickly becomes an easier challenge,” he said. This tips the balance in your favour. “Even if you assume they’re in, they’re not getting out with your jewels.”

So perhaps assuming that they’re in is a good place to start. Zeltser thinks that’s a good strategy. He makes one final quip about his ‘Was Company Hacked’ web experiment. “I am thinking about not bothering to query any services,” he joked. Instead, when people query brand names to see if they have been hacked, it might be more realistic for the site to simply always say: “Yes”.