What information are hackers looking for during recon?

Cyber-attacks keep increasing and evolving but, regardless of
the degree of complexity used by hackers to gain access, get a
foothold, cloak their malware, execute their payload or exfiltrate
data, their attack will begin with reconnaissance. They will do
their utmost to uncover exposed assets and probe their target’s
attack surface for gaps that can be used as entry points.

So, the first line of defense is to limit the potentially useful
information available to a potential attacker as much as possible.
As always, the tug of war between operational necessity and
security concerns needs to be taken into account, which requires a
better understanding of the type of information typically
leveraged.

What information are hackers looking for during recon?

When running recon on an organization, hackers – whether white
or black hats – are “casing a joint.” To plan their attack, they
will try and uncover as much information as possible about:

Your infrastructure

• The types of technologies you use – As there
  is no flawless technology, learning about those used to build and
  manage your infrastructure is hackers’ first step. They aim to find
  vulnerabilities to penetrate your infrastructure and shield
  themselves from detection. Hackers can gain information about your
  technologies and how they are used through listening to
  conversations in tech forums. DevOps participating in such
  discussions should refrain from divulging their real identity or
  information that might identify the organization.
• Your internet-facing servers – servers hold
  your organization’s vital information. Hackers will attempt to find
  vulnerabilities ranging from unused or unpatched services to open
  ports.
• Any system used as a server on a public network is a target, so
  system administrators must be extra vigilant in:

Keeping all services current Opting for secure protocols whenever
possible Limiting the type of network per machine to a strict
minimum, preferably one per machine Monitoring all servers for
suspicious activity

• Your Operating System (OS) – Each OS has its
  own vulnerabilities. Windows, Linux, Apple, and other OS regularly
  publish newly uncovered vulnerabilities and patches. This publicly
  available information is exploited by cyber-attackers once they
  know what OS you use.
• For example, a forum conversation where Joe Blog, your
  accountant, explains how to use a function on a Windows 8 Excel
  Spreadsheet tells the hacker that Joe Blog uses Windows and has not
  updated his OS for ages.
• This tidbit encourages the cyber-attacker to dig further as, if
  an employee with access to your organization’s financial
  information is allowed to work on an endpoint that is rarely, if
  ever, updated, employees’ endpoint security is lax.
• Your security maturity – Hackers are humans
  and, as such, tend to be lazy. A hacker on a recon mission who
  finds out that you are using an XSPM (Extended Security Posture
  Management)^[1] platform knows that,
  even if there is an exploitable entry point, escalation will be
  hampered at every step, and achieving the malicious action will
  require a superior level of planning. This discourages most
  potential cyber-attackers.

Credentials

• Email addresses – as the human mind is the
  hardest software to upgrade and patch, phishing remains the number
  one penetration vector for hackers. Though some email addresses,
  such as info, support, sales, etc., must be public, employees’
  personal email can be leveraged by hackers for generic phishing
  messages and spear phishing.
• Usernames & passwords – Darknet hackers’
  shopping malls are full of credentials for sale at ridiculously low
  prices, hence the recommendation to change your password
  regularly.
• For system admin and other users with high privilege access,
  maintaining stellar password hygiene – and MFA! – is an absolute
  must as, should their credentials fall into the hands of a hacker,
  the entire system could be irremediably compromised.

Can you spot a hacker recon?

Forewarned is fore-armed, so it might be a clever idea to listen
for signs of hostile recon activity. Recon activity can be
classified into two categories:

• Active recon: hackers using tools or spyware
  to peak into your system. This should trigger alerts from properly
  configured detection tools, informing security information teams
  that hackers are “casing” them.
• This should prompt launching a security validation exercise to
  ensure that potential security gaps are adequately monitored and
  scheduled for priority patching.
• Passive recon: hackers “stalking” you by
  collecting publicly available information about your
  infrastructure’s technological details or email addresses. This is,
  in effect, undetectable.

What Does a Hacker do with the information Gathered During
Recon?

Cyber-attackers’ goals fall under four broad categories:

• Theft – by far the largest category in terms
  of numbers, attacks aimed at stealing can be subdivided into more
  categories matching what the theft aim is:

Data – data is 21st century’s currency, and any
data in the right hand can be translated into value. From Credit
Card details to users’ personal information to generic data such as
traveling habits, all data can be misappropriated for commercial,
strategic, or even military purposes. Intellectual
Property – IP gives an edge to many organizations and
businesses. Competitors, for example, have an immediate interest in
obtaining that information. Computing resources –
the resources used to power your infrastructure are costly,
therefore attractive. Today, stolen resources’ main usage is crypto
mining.

• Extortion – best known as ransomware,
  ransomware hijacks parts or all the infrastructure, encrypts the
  data, and requires payment in crypto-currency to decrypt the
  affected data. Exfiltrating data and threatening to sell them is
  also part of ransomware threats.
• Information gathering – a stealthy type of
  attack that might remain undetected for extended periods.
  Typically, those are commandeered by nation-states, political
  opponents, or business competitors.
• Destruction / taking over the infrastructure –
  attacks aimed at overtaking or destroying are typically led by
  nation-states targeting critical infrastructure, particularly
  aggressive competitors, or hacktivists.

Given the range of damages that can result from a cyber-attack,
making recon as fruitless or daunting as possible for scouting
cyber-attackers is a good policy. This explains the current trend
toward better Attack Surface Management^[2] (ASM).

Note: This article is written by Sasha Gohman, VP Research at
Cymulate.