Threats to the Aviation Sector Stu Solomon, iSIGHT Partners Vice President, Technical Services and Client Operations

iSIGHT Partners 200+ experts, 16 Countries, 24 Languages, 1 Mission Global Reach ThreatScape® - Adversary Focused Intelligence Cyber Crime Cyber Espionage Denial-of-Service Enterprise Hacktivism Industrial Control Systems Mobile Vulnerability and Exploitation Research: threats, groups; determine/capture motivation and intent Analysis: Fuse knowledge across methods, campaigns, affiliations, historical context Dissemination: Deliver high-fidelity, high-impact, contextual, actionable insights Proven Intelligence Methodology www.isightpartners.com

iSIGHT Partners Formal Process  Rich, Contextual Threat Intelligence Human Intelligence Open Sources Community Engagement Underground Marketplaces Technical Sources iSIGHT Partners Research Team Research Repository iSIGHT Partners Analysis Team iSIGHT Partners Customers 1. Research Team submits data based on collection requirements set by analysts and customers – tagged with source veracity 2. Analysis Team applies a best-of-breed methodology to fuse all-source intelligence into validated reporting linked to indicators 3. Customer feedback and ad-hoc requests for information complete the loop of a dynamic information collection process www.isightpartners.com

Todays Global Threat Landscape Active & Global Transcends Geographies and Sectors Multiple Motivations Cyber Crime, Espionage, Hacktivism, Destruction, etc. Low Barriers for Entry Actors use tools that work; not necessarily sophisticated methods Open marketplace providing capabilities Structured & Vibrant Ecosystem providing better tools, infrastructure, sharing ideas and methods, pooling resources www.isightpartners.com

The Threat Focus Trap Cross-Over Attacks Zeus Trojan: Most Popular Credential Collection Malware Originally Created by Russian Cyber Criminals Cross-over to Cyber Espionage Multiple benefits DarkComet & University of Washington Key logging trojan affiliated with cyber espionage campaigns with a nexus to Iran Cross-over to cyber crime Ultimate goal: compromise financial credentials or personally identifiable information (PII) to perform fraud or identity theft Intel-844872 Zeus Trojan: Most Popular Credential Collection Malware Originally Created by Russian Cyber Criminals Cross-over to Cyber Espionage Multiple benefits: proven effective, readily available, novel use provides obfuscation Chronology: Developed in 2006 with focus on online banking credentials and credit card data Between 2009 – 2012 espionage actors used it targeted USG Agencies and DIB via spearphishing DarkComet & University of Washington Key logging trojan affiliated with cyber espionage campaigns with a nexus to Iran Cross-over to cyber crime Feb. 7, 2014, a sensitive source reported that a faculty webpage at the University of Washington was hosting a lure page and an associated malicious payload Decryption and analysis of the payload revealed strings identifying the Trojan as DarkComet The ultimate goal in this campaign most likely was to compromise financial credentials or personally identifiable information (PII) to perform fraud or identity theft. www.isightpartners.com

Aviation Sector Threats Multiple Adversary Motivations Hactivism Cyber Crime Cyber Espionage www.isightpartners.com

Cyber Espionage Cyber Espionage Competitive Advantage Targets aviation and aerospace engineering firms Locates intellectual property for commercial or military advantage Locational Info of Dissidents Travel dates and location information on individuals of interest Cyber Espionage Motivation: Competitive Advantage Target: aviation and aerospace engineering firms Goal: locate intellectual property for commercial or military advantage. Motivation: Location Info on Dissidents Information commercial airlines may possess, including travel dates and location information on individuals of interest (for example, political dissidents) may also represent a high value target of interest to such actors. www.isightpartners.com

China: National Priorities and Targeting Internal Security Maintaining the regime Separatist/Splitists External Security Regional threats Global security Military modernization Economic Growth Energy Development and Conservation New-Generation IT Industry Biology Industry High-End Equipment Manufacturing New Energy www.isightpartners.com

Chinese Teams – Conference Crew Highly focused on Defense Industrial Base Identifiable by unique malware/infrastructure Targeting of US and Taiwan Uses conference attendee lists Military events Vendors lists www.isightpartners.com

Cyber Crime: Credential and Identity Theft Airline-Themed Phishing Fake offers for discounted airline tickets Lures for the installation of credential theft malware Monetization Method Airlines abused as a cash-out function to support other criminal schemes Actors may compromise airline systems directly Cyber Crime www.isightpartners.com

Targeted Lures AIAA materials used to entice recipients to click on malware embedded emails Asprox malware campaign Credential theft www.isightpartners.com

Hacktivism: Harassment Hacktivists may target aerospace engineering firms for the promotion of ideological/political beliefs Commercial aviation is generally less affected by this type of actor Hacktivism www.isightpartners.com

Hacktivism: Disruption & Destruction Terrorism This remains theoretical at this time Control of aviation industrial control systems could be used to enable kinetic attacks Hacktivists engage in information gathering Conduct an attack Monitor persons of interest Hacktivism www.isightpartners.com

ADS-B Vulnerabilities The Automatic Dependent Surveillance-Broadcast (ADS-B) system is subject to spoofing attacks. Multiple spoofing operations possible: Scenario 1: An ADS-B system could be spoofed to generate a false hijacking code, one that could then be rescinded and creating a conflicting picture. Scenario 2: An ADS-B spoofing operation could generate a screen full of fake (ghost image) aircraft heading toward a private jet, while a regular radar signal from the vicinity of the jet shows a perfectly normal situation. www.isightpartners.com

Additional Risks Availability of 3rd Party Information The Impact of Published Vulnerability Research Common set of standards, international policy Shared responsibility between governments, airlines, airports, and manufacturers Access Control Insider Threat Part of an ecosystem; Internet connectivity Balance Safety and Security The Impact of Published Vulnerability Research Update difficulties intrinsic to many control system components and software means that even vulnerabilities found through legitimate security research often lead to increased threats Common Set of Standards “Ensuring a secured aviation system and staying ahead of evolving cyber threats is a shared responsibility, involving governments, airlines, airports, and manufacturers. It is critical that all of these members adopt a collaborative, risk-informed decision-making model to set goals and define a cybersecurity framework and roadmap to strengthen the aviation system’s resilience against attacks. “—The Connectivity Challenge: Protecting Critical Assets in a Networked World, page 5 Access Control “Security of an airplane, hence, includes the ability to ensure that both data and the operational capabilities of the aircraft can only be accessed when authorized, and further, that, security of a system installed in an airplane includes the ability to ensure that both data and the operational capabilities of the system can only be accessed when authorized.”— Cyber Security for Aeronautical Networked Platforms – What does it mean to me in commercial aviation design?, page 8 www.isightpartners.com

Challenges to the Aviation Industry Many victims of economic espionage are unaware of the crime until years after loss of the information Inadequate or non-existent monitoring and incident response to even detect activity Most companies don’t report intrusions in fear it could tarnish a company’s reputation Won’t accuse corporate rivals or foreign governments of stealing its secrets due to fear of offending potential customers and partners Hard to assign monetary value to some types of information Many CIOs don’t focus on cyber security and are unaware of the true threats www.isightpartners.com

Lessons Learned From Other Industries Establish strong information sharing protocols Drive Public/Private Partnership Enable a culture of (Information) Security Change the conversation to include business context Employ basic information security hygiene Continuously seek to understand the evolving threat Recognize that you are not unique Understand third party connections Agree on standards and support them as a community www.isightpartners.com

Questions? iSIGHT Partners Website: www.isightpartners.com E-mail: ssolomon@isightpartners.com Information: info@isightpartners.com www.isightpartners.com