Cyber Attacks Spike in Finland Before Trump-Putin Meeting

Figure 1: Trendline of attacks against Finland

To get a sense of how infrequently Finland is attacked, we compared a week of attacks from 7/10/2018 – 7/16/2018, against what Canada received in that same time period (Canada is routinely a top 10 attacked country, but not typically in the top 3–5). Aside from the attacks on 7/12 and 7/14, Finland doesn’t even register on the chart.

Figure 2: Finland attack traffic in comparison to Canada

Top Attack Source Countries

China is typically the top attacking country on a regular basis (see 5/12/2018 – 7/13/2018 in the table below). This was also the case during the spike in attack traffic around the Trump-Putin meeting (7/14/2018 – 7/16/2018), however during that time, China launched a higher percentage of the attacks than normal. The US was consistently in the number two attacking position. Russia fell from its #3 baseline position to #5 during the attack spike. Given that the targeted meeting included Putin, it is not surprising that Russia would back off their attacks. Noticeably, Italy and Germany jumped from their 13th and 14th positions into the 4th and 7th positions respectively during the Trump-Putin traffic spike.

Attacking Networks

F5 Labs continually monitors top attacking networks. A handful of networks shown in the table below (highlighted in yellow) are not consistently top threat actor networks (see F5 Labs IoT Hunt research series). This indicates consistency of threat actors, and the networks they choose to launch their attacks from.

ChinaNet was the top attacking network both before the Trump-Putin meeting and during the attack spike. ChinaNet is also consistently at the top of the threat actor network list globally. It is our opinion that since attacks from China go unpunished, threat actors from around the world feel confident to use their networks to launch attacks, as well.

Attacked Ports

The top 5 attacked ports before and during the Finland attack spike were SSH, SMB, SIP, HTTP, and MySQL. SSH brute force attacks are commonly used to exploit systems and IoT devices online. They accounted for the majority of the attacks against Finland and are something we see consistently across global attack traffic. This is why we choose to publish the top 50 admin credentials used in SSH brute force attacks in our Hunt for IoT report series.

Note: We have no data to suggest the attacks against Finland were successful. That would require access to the targeted systems, which is illegal. We collect attack data and publish the threat intelligence in an effort to educate the security community on attackers’ efforts and targets so they can protect themselves.

The common use of the ports shown in the table below is an indicator of what the attackers are after. IoT devices are moving to SSH for remote administration because it’s more secure than Telnet—although “protecting” with default admin credentials doesn’t secure anything. Just check out the top attacked admin credentials list, which typically includes default username and passwords that are the name of the manufacturer or software provider. The SIP protocol, although in the top 3, did not account for a large percentage of the attacks in the Finland attacks. Since we are not aware of a SIP vulnerability that would give attackers instant access to a phone inside a meeting room, we’re not surprised SSH attacks accounted for the majority of the attacks surrounding the Trump-Putin meeting.

Conclusion

Using technology—most specifically, IoT devices—to target people of interest or spy on large portions of populations isn’t new. This practice should be expected, but we write the stories to prove a point about the necessity for security that impacts everyone from the President of the United States to an unassuming civilian standing by a hacked wireless IP camera. You don’t need a smart home to be personally impacted by insecure technology. Every business is impacted by insecure technology as they become attack pivots, relays, and botnet hosts that attack businesses, which drives up the costs of doing business for everyone.

All businesses should be securing all of their Internet connected infrastructure. All? This spans from servers in a rack in a data center (and everything installed on them), to security cameras, wireless access points, phone systems (including mobile devices), video conferencing systems, entertainment systems, TVs, DVRs, HVAC systems, fish tanks, vending machines, etc. Every “thing” that is Internet-connected.

At a minimum, securing means:

• Protect remote administration to any device on your network with a firewall, VPN, or restrict to a specified management network. Never allow open communication to the entire Internet.
• For home IoT, leverage network address translation (NAT) if you can’t install a home firewall (note that home firewalls have also been targeted by thingbots).
• Always change vendor default administration credentials.
• Stay up to date with any security patches released by the manufacturer.