A New Era of Cyber Illusions as Attackers Manipulate Time and Data Integrity

Morpheus asks Neo in the 1999 film The Matrix what is real and how he would define it. Rick McElroy, Principal Cybersecurity Strategist at VMware, argues that the same question now applies online. As the physical and digital worlds merge, telling what is genuine in cyberspace grows harder, and attackers have learned to use manipulation and deception to distort data until even the basic integrity of the digital world is in doubt.

He cites VMware's 2021 Global Incident Response Threat Report, which found that destructive attacks and attacks on integrity now happen more than half of the time. Through business communication compromise, time manipulation or deepfakes, attackers are finding new ways to get into victims' infrastructure and then to take it over and use it to attack others.

Time as a single point of failure

Defenders have traditionally judged whether something digital is real by its data integrity: confidence that the information has not been corrupted and that only authorised people can read or change it. Because integrity is central to data security, organisations work hard to protect it. In 2019 the Singapore Government set up a Public Sector Data Security Review Committee to safeguard data integrity and stop data being altered maliciously in transit.

Security systems and protocols depend on data integrity to provide a "single source of truth". McElroy points out that all of them also depend on one thing that can fail: time. Because time cannot be changed, it underpins security, and timestamps, date records and the order of events have come to serve as proof that something is authentic.

Criminals now exploit that trust by altering timestamps, in what are called Chronos attacks. Almost 60 percent of the report's respondents had seen them. Separate research found that 41 percent of financial institutions had observed timestamp manipulation as criminals tried to change the value of capital or trades.

McElroy considers manipulation of the environment, time included, especially dangerous. Attackers who can hide from every time-based query escape detection and block the response. They corrupt data sets and erode security teams' trust in them, which makes it harder to rely on time to confirm what is true.

Active defence, without hacking back

With attacks now aimed at the reality of the data itself, some defenders want to strike back. Incident responders are increasingly ready to use offensive methods for defence: the same report found that 81 percent of respondents intend to use active defence techniques in the following 12 months. These run from deception to disruption, for example deception grids, micro-sharing of data and making the environment hostile for intruders.

McElroy accepts that such methods help but advises against hacking back. His preference is for constant vigilance that reaches every part of the organisation, and he recommends four tactics for CISOs.

Four tactics for CISOs

1. Track identities as they move and use multi-factor authentication

Many attacks now happen quietly, with intruders slipping into systems unseen. Just-in-time administration and multi-factor authentication, he says, are what make it possible to follow identities as they move and stop attackers early. Vietnam's government stresses two-factor authentication for safe use of the internet in its recent handbook "Information Security during the Covid-19 pandemic". Yet according to the Cyber Security Agency of Singapore, fewer than half of Singaporeans protect their online accounts with two-factor authentication, even though it is widely offered, and McElroy sees this as a gap that organisations and individuals need to close.

2. Audit every dependency on time regularly

If attackers are going after data integrity, security teams have to focus on it too. Regular audits should already be happening, and he wants them to give more weight to the redundancy and resilience of time. Endpoint detection and response should be set up with time manipulation in mind and concentrate on time-based dependencies to protect the integrity of upstream data sets. The audits should consider the attack vectors and scenarios that could disrupt or tamper with timing infrastructure, and include real-world tests of time manipulation.

3. Hunt for threats every week

Security teams should assume attackers already have several routes into the organisation and behave accordingly. McElroy recommends weekly threat hunting across all devices as a core part of any security strategy.

Bug bounty programmes are catching on in APAC as a result. Lazada has launched one in Southeast Asia paying up to US$10,000 per bounty, and Singapore's GovTech pays white hat hackers up to S$5,000 for finding vulnerabilities in the public sector. Such programmes help teams spot unusual behaviour, since attackers can stay hidden inside a system for a long time while they carry out reconnaissance.

Threat hunting should also extend beyond the organisation. The high-profile supply chain attacks on the US Colonial Pipeline and SolarWinds showed that an organisation is only as strong as the weakest link in its supply chain. McElroy suggests defenders include outside general counsel, managed service providers and even marketing or public relations agencies.

4. Use micro-segmentation

Just as in a high-security bank vault, getting through the front door should not give an attacker immediate access to sensitive data. A Zero Trust approach with micro-segmentation creates zones inside the perimeter and limits how far an attacker can move sideways. Each attempt to cross from one zone to another means passing a trust boundary, and each crossing is a chance to detect and stop the intruder.

McElroy expects attackers to find even more insidious ways to break in before long. That, in his view, makes a defensive mindset at the top of the organisation more important than ever, followed by teamwork, with everyone from the CISO to frontline staff working together to keep ahead of attackers.