Hackers attack forensics tools
Christopher Novak, Principal, Verizon Business, said: “We're increasingly seeing hackers not only attempt to avoid detection, but actually attack forensic investigators. For example, there are several toolkits out there that actively defeat forensics tools by crashing the system when recognised tools are booted. Anti-forensics techniques are a clear and present danger.”
Overall, anti-forensics techniques such as wiping of data have become a factor in 88 per cent of cases handled by Verizon Business. Additionally, the techniques are becoming more successful, according to Novak, demonstrated by the fact that 63 per cent of businesses are typically taking months rather than days to discover data leaks.
“Investigations are taking longer, due to techniques ranging from simple wiping of data to corrupting altering or obfuscating log files. We're also seeing increasing interest in and use of encryption and steganography to hide attack tools and secure stolen data from other hackers”, said Novak in his presentation 'Cyber CSI: How Criminals Manipulate Anti-Forensics to Foil the Crime Scene'
However, Novak was keen to point out that the last year has seen a shift from externalised threats to internal issues due to increased security and awareness. “We often find now that it's a businesses partners or third parties that are the source of problems”, he said.