Command & Control: Understanding, Denying and Detecting

One of the leading problems in cyber security today is the emergence of targeted attacks conducted by adversaries with access to sophisticated tools, sometimes referred to as Advanced Persistent Threats (APTs). These attacks target specific organisations or individuals and aim at establishing a continuous and undetected presence in the targeted infrastructure. The goal of these attacks is often espionage: stealing valuable intellectual property and confidential documents. As trends and anecdotal evidence show, providing effective defences against targeted attacks is a challenging task. In this report, we restrict our attention to a specific part of this problem: specifically, we look at the Command and Control (C2) channel establishment, which, as we will see, is an essential step of current attacks. Our goals are to understand C2 establishment techniques, and to review approaches for the detection and disruption of C2 channels. More precisely, we first briefly review the current state of cyber attacks, highlighting significant recent changes in how and why such attacks are performed. This knowledge is foundational to understand C2 techniques and to design effective countermeasures. We then investigate the “mechanics” of C2 establishment: we provide a comprehensive review of the techniques used by attackers to set up such a channel and to hide its presence from the attacked parties and the security tools they use. Finally, we switch to the defensive side of the problem, and review approaches that have been proposed for the detection and disruption of C2 channels. We also map such techniques to widely-adopted security controls, emphasizing gaps or limitations (and success stories) in current best practices. We would like to acknowledge the help and support of CPNI in researching this topic and producing the accompanying products. PAGE 2 Command & Control: Understanding, Denying and Detecting FEBRUARY 2014 University of Birmingham | CPNI.gov.uk