Anti-Malware , Breach Response , Cybersecurity

Experts Detail Lessons Learned, SCADA Cybersecurity Inaction Mathew J. Schwartz (euroinfosec) • January 6, 2016     Power plant control room (Source: Magnetic Rahim/Creative Commons)

Reports to date about the hack of Ukrainian energy supplier Prykarpattyaoblenergo last month have so far left many crucial questions unanswered. Who was responsible? Did malware directly trigger a three-hour blackout? Are other power suppliers are at risk from similar attacks (see Ukrainian Power Grid: Hacked)?

See Also: 2015 Financial Services Cybersecurity Agenda: An Inside Out Look at a New Risk Mitigation Approach

The Computer Emergency Response Team of Ukraine - CERT-UA - has confirmed to Information Security Media Group that that it is investigating the blackouts, which involved hackers gaining remote access to power production systems. The agency also confirms reports that the BlackEnergy espionage Trojan - and KillDisk wiper malware - infected systems of the hacked energy supplier, which suffered a three-hour electricity blackout on Dec. 23, after multiple electrical substations went offline, leaving about 1.4 million homes in the country's western Ivano-Frankivsk region without power. Ukrainian officials have blamed the blackout on Russia, but as yet released no evidence to back up that claim.

Multiple cybersecurity experts say that these are the questions they're now asking in the wake of the Ukrainian hack attack reports:

1. Who's Surprised?

Cybersecurity experts have warned for years that the supervisory control and data acquisition - SCADA - systems that provide remote control and monitoring of industrial environments are too often insecure, yet also Internet-connected and easy pickings for would-be hackers.

Indeed, a 2004 Congressional Research Service report - prepared for the U.S. Congress - includes warnings from industrial control system cybersecurity expert Joe Weiss that the industry desperately needs to develop and implement "firewalls, intrusion detection, encryption, and other technology" to safeguard control systems. Such systems are used in numerous industries, ranging from energy production and chemical plants to train networks and inside aircraft.

More than a decade later, however, Weiss says too little has been done, and that the industry continues to build, deploy and rely on systems that remain too easy for attackers to remotely exploit. "The real question," he says, is "why are people so unprepared for cyber threats to industrial infrastructures?"

Making such systems remotely controllable also hasn't led to increased security, warns Mark Weatherford, chief cybersecurity strategist for data security firm vArmour, and a former Deputy Undersecretary for Cybersecurity at the U.S. Department of Homeland Security, as well as CSO for NERC, the North American Electric Reliability Corp. "There are still too many control systems connected to the Internet," he says. "It's convenient and makes economic sense, but it's dumb from a security perspective." He urges anyone who's operating an Internet-connected ICS to "at least be monitoring egress attack paths to see what is leaving," as well as to plan "in advance" how they'll respond if they do suffer an attack.

2. Did Wiper Malware Directly Trigger Blackout?

What's still not yet known about the Ukraine hack, however, is exactly how the attack and the blackouts might be connected. So far, CERT-UA has confirmed a report from security firm ESET that BlackEnergy had been used to install wiper malware called KillDisk, a.k.a. Disakil, which is designed to delete computer hard drives and leave systems unbootable.

"I am still trying to piece this together," says Dublin-based information security consultant Brian Honan, who is a cybersecurity adviser to the association of European police agencies known as Europol. "We have reports of a power outage and reports of systems being infected with a computer virus, but no connection - at least a publicly acknowledged one - that the two are related. In other words, how would a wiper-type virus stop the station from producing power?"

3. Did Attackers Blend Techniques?

Michael Assante, formerly a CSO at NERC, says in a Jan. 5 SANS Institute newsletter that attackers likely blended multiple techniques to trigger and extend the disruption. "A file-wiper function can certainly disrupt the SCADA system, but that alone does not account for the outage," he says. "We suspect an attacker manually interacted with an infected machine, like an HMI - human-machine interface - to command breakers to open," although adds that this is still just a theory. "The wiper function could then have been used to extend the outage by denying the SCADA system, but the impacted Ukrainian utility was still capable of resorting to manual operations to re-close breakers and energize their system."

He also referenced reports that the Ivano-Frankivsk region suffered a cellular telephone network denial-of-service attack at the same time as the power outages. Such an attack could have prevented energy operators from remotely controlling the affected systems as well as coordinating their response.

"The Ukraine has had power grid reliability problems in the past, so that probably means they were dependent on remote access," Weiss says, noting that such remote access may be provided just not via the Internet, but also via cellular networks.

4. Was Ukraine Attack Targeted?

What's also unclear is whether attackers were directly targeting the Ukrainian power supplier. "Was this a targeted attack, or did some systems get infected in some way? If so how?" Honan asks. "Were the infected systems Internet-connected? If so why? Are there other power stations around the world running similar infrastructure that should take lessons from this?"

If BlackEnergy malware - or another piece of malware that the Trojan loaded onto infected systems - was used to disrupt energy generation systems, it would represent an escalation in the types of attacks that have been seen targeting energy firms (see Hackers Target Energy Firms). "Until now, BlackEnergy has focused on exfiltrating information, not infrastructure impact," Weiss says. He also cautions that such malware "targets Siemens and GE systems," meaning it could be used to disrupt more than just power providers.

5. Why Does Industry Still Lack Forensics?

One complicating factor when investigating these types of outages, however, is that too many control systems still lack any kind of logging or digital-forensic review capabilities, Weiss says. "There have been many demonstrations of vulnerabilities in control systems and there have been many control system incidents - attacks and unintentional incidents. But we have minimal control system forensics when you get below the Windows/IP layer," he says. "So ... if the lights go out, you don't necessarily know if you've been hacked."

6. Was Hack a Military Test?

While the Ukrainian blackout might seem like a nuisance-level type of attack - no one was reportedly injured, nothing exploded - SANS Institute director of research Alan Paller says that such disruptions have military applications. "Cyber weapons can be pre-positioned inside power companies to do the job of a missile, before a nation even knows it is under attack," he writes in the Jan. 5 SANS newsletter. "Once power and communications are disabled, a country's ability to coordinate defense and mount counterattacks is severely disabled."

7. Will Government Agencies Do Something?

But those risks have long been known, Weiss says, and regularly detailed to the likes of Congress and the U.S. Department of Energy and Department of Homeland Security. "Obviously, DOE and DHS haven't been very successful at improving the cybersecurity of the electric grid, because our grids and other critical infrastructure are still really vulnerable, and there have been more than 250 actual control system cyber incidents to date," Weiss says. "And are [those systems] vulnerable to BlackEnergy? Yes."

8. Will ICS Vendors Improve Their Security?

If government agencies have been ineffective, Weiss says ICS providers and users often fail to identify many incidents as being cyber-related, as well as to eliminate simple flaws from their products. This week, for example, researchers presenting at the Chaos Communication Congress in Hamburg released the latest version of SCADAPass, which details hardcoded and known passwords in 100 different ICS and SCADA products - including switches, controllers, programmable logic controllers, Web servers, wireless management stations - from such manufacturers as B&B Electronics, Emerson, Rockwell Automation, Samsung, Schneider Electric and Siemens.

Special #SCADAPASS #32C3 Release. Please contribute. Vendors! Don't use default passwords in industrial systems. https://t.co/ed7RtCkDhl

Last month, meanwhile, DHS warned that multiple Schneider Electric PLC products have a zero-day vulnerability that attackers could remotely exploit to take control of the devices. The devices are used in numerous different types of environments, including power plants, nuclear reactors, and for water and wastewater treatment.

9. What Will Trigger Changes?

If government agencies have so far proven to be ineffective at helping bring about ICS security, Weiss says there's hope from another source: ratings services (see Moody's Warns Cyber Risks Could Impact Credit Ratings).

"Moody's and Standard and Poor's and the insurance companies are beginning to realize that cyber risks to critical infrastructure can be very significant," Weiss says.

But he adds that too often, DHS has done too little, citing the example of the recently revealed 2013 hack attack against a dam in Rye, New York, in which Iranian hackers reportedly gained access to the dam's flood gates, although failed to gain access to the full control system.

"DHS had not disclosed this information to the city of Rye for more than a year," Weiss says. "The system is broken."

The Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool is already being integrated into regulators' cybersecurity examinations, says financial fraud and cybersecurity expert Avivah Litan, a distinguished analyst at consultancy Gartner.

But the tool has fallen short, she says, causing more confusion than clarity. Litan contends the FFIEC must enhance the tool in 2016. This is just one of the top banking/security trends Litan identifies in an interview with Information Security Media Group.

"In principle, it all started out very well and good," Litan says. "But we have been getting lots of calls from our clients about how the process itself doesn't seem to live up to the spirit of the guidance and the regulation."

The FFIEC issued the tool in July 2015. It was designed to move banking institutions from a mentality of "checkbox" compliance to one of a multilayered risk-based approach, allowing institutions to assess the maturity level of their risk-assessment processes, she explains.

But in spite of the tool's aim to create a platform by which banks and credit unions may take a "hard look" at their own cybersecurity weaknesses, the tool is nothing more than a series of questions that ultimately add up to checkbox compliance, she says.

"It still ends up being a series of yes and no questions within these categories, and there's no room, from what I've been told, to put in any kind of thought and context and text to explain: 'Well, no, we're not compliant in this specific subcategory, and this is the reason we're not; we don't think we need to be,'" Litan explains. "If two out of 10 questions are answered with a 'no,' and eight out of 10 questions are answered with a 'yes,' the whole category is considered a negative for the bank."

What's more, banking institutions have not been provided resources or guidance to help them figure out how to address this concern. Given that it is now a part of regulators' cyber assessment processes, the FFIEC needs to tweak the tool this year, Litan adds.

"I think that what we are witnessing is phase one of this new tool, and hopefully phase two will allow more judgment, more context, and will be accompanied with outgoing and proactive education," Litan says. "There should be working groups and conferences, and I'm not seeing any of that yet."

During this interview, Litan also discusses:

Lessons the FFIEC could learn from the PCI Security Standards Council, where educating the financial community about new regulatory tools and guidance is concerned; Why the EMV chip and PIN debate has quickly become a moot topic in the U.S.; and Why the compromise of personally identifiable information is posing big authentication challenges for banks.

Litan, a vice president at Gartner Research, is a recognized authority on financial fraud. She has more than 30 years of experience in the IT industry. Her areas of expertise include financial fraud; authentication; access management; identity proofing; identity theft; fraud detection and prevention applications; and other areas of information security and risk. She also covers security issues related to payment systems and PCI compliance.

Breach Notification , Breach Response , Data Breach

Firm Agrees to Encrypt GPS Information, Better Safeguard Customer Data Mathew J. Schwartz (euroinfosec) • January 8, 2016    

Any U.S. organization that delays issuing a data breach notification to breach victims risks having its information security policies get reviewed - and potentially overhauled - by state regulators, not to mention being fined.

See Also: Stop Fraud, Not Customers: Focus On Good User Experience

Those are just some of the takeaways from the settlement and $20,000 fine announced by the New York Attorney General's Office on Jan. 6 with taxi-hailing mobile platform Uber. The settlement relates to the company's failure to restrict access to riders and drivers' personally identifiable information, as well as a five-month delay between Uber discovering that its drivers' PII had been exposed in a data breach, and its notifying victims (see Uber Breach Affects 50,000 Drivers).

Uber runs a mobile platform that allow riders to connect with drivers, and which tracks their geographic coordinates in real time. As part of its registration process, Uber also collects PII from riders, including name, email address, phone number and payment type. Likewise, it also collects drivers' driver license details, vehicle registration and licensing information, and vehicle inspection documentation.

As part of the settlement, Uber has now agreed to encrypt riders' geo-location information, classify and restrict internal access to personally identifiable information and other sensitive data about riders, and employ multi-factor authentication to safeguard data access, amongst other changes.

"This settlement protects the personal information of Uber riders from potential abuse by company executives and staff, including the real-time locations of riders in an Uber vehicle," says New York Attorney General Eric T. Schneiderman. "We are committed to protecting the privacy of consumers and customers of any product in New York State, as well as that of employees of any company operating here."

Uber didn't immediately respond to a request for comment about the settlement agreement.

Settled: Two Separate Investigations

The settlement and fine relate to two separate investigations launched by Schneiderman's office. The first was launched after entertainment news site Buzzfeed reporter Johana Bhuiyan alleged that when she arrived at Uber headquarters in an Uber-chartered car, the company's New York General Manager Josh Mohrer greeted her as she emerged from the car by saying: "There you are. I was tracking you."

Bhuiyan reported that Mohrer was referring to a capability that the company refers to internally as "god view" - in reference to real-time strategy games that provide an aerial view of everything happening on the ground below - that provides Uber's operations team with a real-time look at the location of all of its cars, so that it can better juggle supply and demand. After the AG's office launched its investigation, Uber stopped displaying riders' PII as part of its god view.

The second investigation launched by the AG related to Uber informing Schneiderman's office on Feb. 26, 2015, that it had discovered in September 2014 that one of its databases had been accessed by an unauthorized third party in May 2014.

At the same time that Uber notified the AG's office, Katherine Tassi, Uber's managing counsel of data privacy, notified 50,000 drivers that some of their personal details appeared to have been compromised. According to a related "John Doe" lawsuit filed by Uber at the time, and since confirmed by the AG's office, an Uber employee had accidentally published one of the company's APIs - providing access to its mobile ride-sharing platform - to the GitHub code-sharing service, where it was publicly accessible. Uber says that the API was used, once, to access PII being stored for the 50,000 drivers.

At the time, Tassi gave no explanation for the five-month delay between finding the breach and warning affected drivers, which drew the ire of New York regulators, since the state's General Business Law requires breached organizations to alert the state Attorney General's office "in the most expedient time possible and without unreasonable delay."

Security, Privacy Program Changes

The Uber settlement provides a useful template for any organization that stores PII. For example, some of the information security and privacy changes that Uber has agreed to implement include:

Restricting access to geo-location information to employees who have demonstrated a legitimate "need to know" business purpose, and enforcing this via both policies and technical access controls; Designating one or more employees to coordinate and supervise Uber's privacy and security program; Training employees who handle PII, annually, about how to comply with Uber's data security practices; Implementing multi-factor authentication or similar access control technologies to restrict access to PII; Encrypting all PII, whether it's being stored, accessed or transferred; Regularly reviewing Uber's security processes and procedures and their effectiveness; Detailing on the Uber website all location information the company collects from its riders, and specifying in its privacy policy how it protects that information.

"I strongly encourage all technology companies to regularly review and amend their own policies and procedures to better protect their customers' and employees' private information," New York Attorney General Schneiderman says.

Indeed, information security consultant Brian Honan, who advises the association of European police agencies - Europol - on cybersecurity matters, says that any organization that handles PII should be encrypting as well as restricting access to all of that information (see TalkTalk Lesson: Prepare for Breaches). In part, that's because almost any type of PII today - not just payment card numbers - can be monetized by cybercriminals, experts warn.

Geo-Location Privacy Dangers

Uber isn't the first firm to get slammed for its handling of users' geo-location details. For example, the 2015 breach of online dating service Ashley Madison - tagline: "Life is short, have an affair" - revealed that the Toronto-based company was storing GPS coordinates for many of its 37 million current and former users.

Whoever attacked Ashley Madison leaked that data, and Australian data security expert Troy Hunt found that it included many members' latitude and longitude details, logged down to five decimal places, meaning the information was accurate to a range of about 1 meter, or 3.3 feet. Anecdotal reports say that information was used to help unmask users of the site, for example by spouses (see 2016 Breach Prevention: Time to Purge Data).

Anti-Malware , Cybersecurity , Technology

Blackouts Tied to Malware Attack Against Power Provider Mathew J. Schwartz (euroinfosec) • January 5, 2016    

A power blackout that recently affected about 1.4 million Ukrainians has been tied to the espionage Trojan known as BlackEnergy. The attack appears to be the first time that malware has been used to facilitate a large-scale power disruption.

See Also: Healthcare Breaches - The Next Digital Epidemic

Ukrainian news outlet TSN first reported on the Dec. 23, 2015, power outage, which it said left about half of all homes in the country's western Ivano-Frankivsk region without power for a few hours. It said that government investigators believed that the outage was tied to a "virus" that had been employed as part of a "hacker attack" that involved remote access to industrial control systems at a local energy supplier called Prykarpattyaoblenergo.

But Slovakian information security firm ESET now reports that the attacks - and potential outages - were much more widespread than originally believed. "We have discovered that the reported case was not an isolated incident and that [several] other energy companies in Ukraine were targeted by cybercriminals at the same time," ESET researchers tell Information Security Media Group, although it's not clear if energy generation at those firms was likewise disrupted.

ESET says the malware used in the attacks was the BlackEnergy Trojan, which has previously been tied to Russian attackers, and which is often used to install additional attack modules on victims' systems. After infecting these ICS systems, for example, this particular BlackEnergy variant was then designed to install wiper malware called KillDisk, which overwrites or deletes data on hard drives and can also render them unbootable. ESET has released indicators of compromise tied to the attacks, which other organizations can use to help detect and block related - or copycat - exploits.

"This is the first time we have proof and can tie malware to a particular outage," Kyle Wilhoit, a senior researcher at security firm Trend Micro, tells Reuters. "It is pretty scary."

Ukraine's state security service - SBU - has blamed Russia for the attacks, and the country's energy ministry, based in Kyiv, has set up a special commission to investigate, Reuters reports.

The BlackEnergy Trojan first appeared in 2007. While it has never been directly tied to the Russian government, security experts say that past operators appear to have been Russians, and that related botnets have been deployed "in a manner consistent with Russian doctrine" (see Russians Suspected in Ukraine Hack). U.S. officials have previously pointed to the Russian government tapping "patriotic hackers" as cyber-ancillaries for their intelligence and military operations.

Ties to Sandworm?

In 2009, meanwhile, a group of attackers dubbed the Sandworm team - because of encoded references in the malware to the fictitious desert-dwelling creature from the science fiction classic Dune - were tied to attacks that used the BlackEnergy Trojan. But it's not clear if the recent BlackEnergy attacks against Ukraine targets is the work of the same advanced persistent threat group.

"Please be aware that there is a large lack of data right now with the Ukrainian cyber attack," says security expert Robert Lee, CEO of consultancy Dragos Security and a former cyberwarfare operations officer for the U.S. Air Force, in a Jan. 5 blog post. "Links to BlackEnergy (the malware) from the identified sample on the network are fine - but need time to be analyzed. The further linking of BlackEnergy (the malware not the campaign) to the Sandworm team (the people) that used BlackEnergy is a big analytical leap. It is likely a good one - it will likely be found to be true - but it is not definitive right now."

In other words, just because an adversary is using BlackEnergy malware does not mean they are the same actors from the Sandworm campaign

BlackEnergy has previously been tied to attacks not only against Ukraine, but also against multiple European governments including Poland, NATO, a French telecommunications provider, a Polish energy company and an American university, among many others.

Inside KillDisk

The Ukrainian Computer Emergency Response Team, CERT-UA, warned in November that it had discovered KillDisk - which had never been seen before - being used in attacks, and being installed by the BlackEnergy malware. "In that instance, a number of news media companies were attacked at the time of the 2015 Ukrainian local elections," ESET malware researcher Anton Cherepanov says in a blog post. "The report claims that a large number of video materials and various documents were destroyed as a result of the attack."

The KillDesk variant deployed against media organizations appeared to be designed for mass data deletion - it was programmed to delete 4,000 different file types, ESET says. But the version deployed against energy firms was different, in part because it only targeted 35 different types of file extensions. "As well as being able to delete system files to make the system unbootable - functionality typical for such destructive Trojans - the KillDisk variant detected in the electricity distribution companies also appears to contain some additional functionality specifically intended to sabotage industrial systems," Cherepanov says.

Attackers Target ICS

But the big change was the addition of code designed to disrupt industrial control systems, by terminating two apparently ICS-related processes and then overwriting them with random data. One of those processes is named "sec_service.exe," which appears to relate to either a piece of software called ASEM Ubiquity - used in ICS environments - or to the ELTIMA Serial to Ethernet Connector, Cherepanov says.

The attacks against the power companies likely began with spear-phishing emails, ESET says. In early December, for example, Ukrainian security firm CyS Centrum published screenshots of e-mails used in BlackEnergy campaigns, which had email addresses spoofed so that they appeared to have originated from the Ukrainian parliament, called Rada, and which were designed to trick recipients into allowing a PowerPoint macro to execute. If the user allowed the macro to proceed, then their system could become infected with BlackEnergy.

To date, however, it's not clear if the KillDisk infection led to the power outages - and whether these types of attacks and infections rate as high-level critical infrastructure threats, or more of a nuisance. "The piece of malware uncovered (the KillDisk component) had the functionality to delete files," Lee says. "It has been stated that this likely caused the power outage - this is most likely very inaccurate. Deleting files, processes, or killing Windows systems will not cause a power outage in a regional control center. Kill the Windows computers and the power keeps going."

Indeed, TSN reported in the wake of the malware attack and power outage that energy provider Prykarpattyaoblenergo had begun running its energy-generation infrastructure in "manual mode" while it cleaned infected Windows systems.

A CERT-UA team member tells Information Security Media Group that the organization is continuing to investigate the hack attacks, but that information relayed from reports such ESET's is accurate.

Neither Prykarpattyaoblenergo nor the SBU could be immediately reached for comment.

Will 2016 be the year that more organizations finally begin taking significant steps to safeguard stored data and thus minimize the potential damage from data breaches?

"There's going to be a lot of collective head scratching over what we do about it," DataBreachToday Executive Editor Mathew J. Schwartz suggests in an audio blog that assesses 2016 data breach trends (click player beneath image to listen).

But one vital next step, Schwartz points out, is for organizations to minimize the amount of personally identifiable information that they store.

Revised European data privacy rules, for example, will soon require businesses - upon receiving requests from former customers - to remove their personal information from corporate servers (see EU Agrees on Data Protection Rule Reboot). Schwartz points out that if PII purging was in place at the online dating service Ashley Madison, which was the victim of a massive breach in 2015, personal details for millions of current and former customers would not have been exposed.

Purging PII is good for business, too, Schwartz says. "There is an upside for them if they can nail the security and privacy question and even if they do get breached, not lose data that is spilling personal details and personally identifiable information about so many individuals."

In this audio blog, Schwartz also predicts that breaches in 2016 will continue to highlight how embarrassing and inadequate security controls are continuing to prevent breaches or minimize their impact.

DDoS , DDoS Attacks , Fraud

Strikes Motivated by Hacktivism, Extortion Expected to Rise Tracy Kitten (FraudBlogger) • January 8, 2016    

Distributed denial-of-service attacks are growing in volume and frequency, striking a wide variety of industries and businesses. But many organizations remain ill-prepared to mitigate DDoS risks.

See Also: Public, Private & Hybrid Cloud: Why Compliance (Done Right) is the Easy Part

While DDoS attacks were once deemed primarily a nuisance, experts now say they're becoming a routine strategy cybercriminals use as part of a campaign to commit fraud or extortion.

"Amplification- or reflection-type DDoS attacks, leveraging a variety of protocols, continue to be popular among malicious actors, a trend we anticipate will continue through 2016," says John Miller, who heads up cyber-intelligence at the information security firm iSIGHT Partners.

"Over the past couple years, we have observed sustained innovation and development in this area, such as identification of new attack opportunities and development of increasingly sophisticated tools. ... Amplification attacks' popularization has involved a move away from the traditional, Windows malware botnet model for DDoS infrastructure, to broader use of server-based DDoS tactics."

In addition to the increased speed and intensity of attacks, experts say the following four DDoS trends will be top concerns in 2016:

Attacks waged by hacktivist groups, such as Anonymous, will become more common. Extortion attacks, such as those waged by DD4BC, will pose significant threats. Some attackers will exploit Internet-connected devices to wage their attacks. The cost of recovering from a DDoS attack will continue to increase.

Hacktivism

It has been nearly four years now since the start of a campaign of high-profile DDoS attacks against U.S. banking institutions - attacks that many observers felt were politically motivated and carried out by threat actors who became known as hacktivists (see DDoS Attacks: Worst Yet to Come?). The bank attacks receded from the spotlight in 2013, but hacktivism is alive and well, observers say.

"Hacktivism will make a comeback [in 2016], versus the percentage of criminal activity," says Dale Meyerrose, a consultant and retired U.S. Air Force General.

"I also believe that almost every major campaign that seeks to compromise an organization for hacktivism or other criminal reasons has a DDoS component," he says. "Most campaigns have three to five attack threads, one of which almost always includes a DDoS component."

Extortion

But attacks waged for extortion also are becoming pervasive (see Experts: DDoS, Extortion Fuel New Attacks on Banks and Greek Banks Face DDoS Shakedown).

Avivah Litan, an analyst at the consultancy Gartner, says DD4BC and its copycats remain very active.

"Extortion is a big game changer in the cyberthreat landscape," she says. "It was in 2015 and will only grow in 2016."

Litan says the extortion phenomena is expanding across all sectors, not just banking.

And iSIGHT Partners' Miller notes: "Criminals have performed extortive DDoS attacks for years, particularly against organizations with little recourse to law enforcement assistance, due to nebulous legal status or location in areas challenged by significant government corruption. However, the DD4BC operation during 2014 and 2015 differentiated itself from concurrent activity, in that it targeted prominent Western corporations for an extended time and drew extensive public attention. We continue to see the ripple effects of this group's actions that increased others' interest in DD4BC's tactics."

In November, the Federal Financial Institutions Examination Council issued an alert about extortion attacks linked to DDoS (see FFIEC Issues Extortion Attack Alert).

The alert apparently was issued because of DD4BC, which has been targeting online casinos, banking institutions and others with DDoS attacks that disrupt online services until a ransom is paid. Authorities still don't know - or at least haven't made public - who is behind DD4BC.

Exploiting IoT

Exploiting the vast number of Internet-connected devices will be a focus for many hackers waging DDoS attack this year, predicts Carl Herberger, vice president of security for DDoS-mitigation and security firm Radware.

"There are so many more Internet-connected devices that can be used to wage attacks, and this is fueling concern," he says. "Volumetric attacks are the biggest growth area because of the Internet of Things. I can use these things against you and you have very few good ways of controlling the muzzle of that attack, like if Grandma's thermostat is attacking you. There's not much you can do."

The Cost

Most businesses are ill-prepared for DDoS attacks, which is why it costs them so much to recover, Meyerrose says.

The cost of recovering from a DDoS attack can be more than $50,000 for small businesses, he notes, quoting data from security firm Kaspersky Labs. That cost includes business lost to downtime and technology expenses and investments associated with site recovery.

DDoS Defense Checklist

So what can be done to defend against the growing DDoS threat?

"My main strategy for defense would be making sure I could quickly detect and block all types of DDoS attacks, e.g. application or network layer, and be able to quickly redirect my users to a backup duplicate, albeit streamlined, site to keep my business running without interruption," Litan says.

Experts also recommend:

Incorporate all aspects potential risk, including DDoS, in corporate security strategies. Use continual monitoring to determine whether attackers have entered the network. When attacks are discovered, they should be monitored but allowed to run long enough so that attack data can be tracked and shared. Use a secured and managed Domain Name System that allows for seamless change of Internet protocols, when needed. Identify a trusted security intelligence provider that can share information about infected and suspicious IP. Have mechanisms in place to detect bots that use advanced techniques at the application layer. Patch software vulnerabilities in Web-facing systems to limit the potential for application-layer attacks. Properly configure Web-facing systems that may handle large amounts of traffic to ensure that they do not fail during a DDoS attack. Consider the use of a DDoS mitigation provider when dealing with high-volume attacks. Identify all Web-facing applications and ensure each is properly protected.

iSIGHT Partners' Miller also recommends that organizations designate employees responsible for handling DDoS attacks who are not also responsible for dealing with fraud.

"Attackers performing DDoS attacks for diversionary purposes have often assumed that organizations will be unable to effectively deal with simultaneous fraud attempts because the same employees are responsible for dealing with both issues," he says.