Cyber reconnaissance techniques

Abstract

ALMOST EVERY DAY, security frms and mass media report news about successful cyber attacks, which are growing in terms of complexity and volume. According to Industry Week, in 2018 spear-phishing and spoofng attempts of business emails increased of 70% and 250%, respectively, and ransomware campaigns targeting enterprises had an impressive 350% growth.19 In general, economic damages are relevant, as there is the need of detecting and investigating the attack as well as restoring the compromised hardware and software.15 To give an idea of the impact of the problem, the average cost of a data breach has risen from 4.9 million in 2017 to 7.5 million in 2018.19 To make things worse, attackers can now use a wide range of tools for compromising hosts, network appliances and Internet of Things (IoT) devices in a simple and effective manner, for example, via a Crime-as-a-Service business model.11 Usually, each cyber threat has its own degree of sophistication and not every attack has the same goal, impact, or extension. However, the literature agrees that an attack can be decomposed into some general phases as depicted in Figure 1. As shown, the Tao of Network Security Monitoring subdivides the attacks in to fve stages6 and the Cyber Kill Chain in to seven stages,26 whereas the ATT&CK framework proposes a more fne-grained partitioning.27 Despite the reference model, the frst step always requires gathering information on the target and it is commonly defned as "reconnaissance."Its ultimate goals are the identifcation of weak points of the targeted system and the setup of an effective attack plan.