National Cyber Threat Assessment 2018

Executive summary

In our highly connected digital society, Canadians and Canadian organizations rely on the Internet for both personal and professional activities. It is in this context that we assess cyber threats to Canadian individuals, businesses, and critical infrastructure, including government.

Cyber threat activity against Canadians often has financial or privacy implications. Yet cyber threat activity against Canadian businesses and critical infrastructure can have more far-reaching consequences, such as operational disruptions to the financial sector, large-scale theft of personal information, and even potential damage to infrastructure.

Key judgements

• Cybercrime is the cyber threat most likely to affect Canadians and Canadian businesses in 2019. Cybercrime is evolving as cybercriminals take advantage of growing online markets for illicit goods and services in order to maximize their profits. Cybercriminals tend to be opportunistic when looking for targets, exploiting both technical vulnerabilities and human error.
• Cyber threat actors — of all sophistication levels — will increase the scale of their activities to steal large amounts of personal and commercial data. Data, such as intellectual property and Canadians’ personal information, are used for theft and resale, fraud, extortion, or espionage.
• Canadians are very likely to encounter malicious online influence activity in 2019. In the coming year, we anticipate state-sponsored cyber threat actors will attempt to advance their national strategic objectives by targeting Canadians’ opinions through malicious online influence activity.
• State-sponsored cyber threat actors will continue to conduct cyber espionage against Canadian businesses and critical infrastructure to advance their national strategic objectives. More nationstates are developing cyber tools designed to conduct cyber espionage.
• It is very unlikely that, absent international hostilities, state-sponsored cyber threat actors would intentionally disrupt Canadian critical infrastructure. However, we also assess that as all manners of critical infrastructure providers connect more devices to the Internet, they become increasingly susceptible to less-sophisticated cyber threat actors, such as cybercriminals.
• Sophisticated cyber threat actors will likely continue to exploit the trusted relationships between businesses and their suppliers and service providers for espionage and cybercrime purposes.
• Cyber threat actors are adopting more advanced methods, such as compromising hardware and software supply chains, making detection and attribution more difficult.

Long description

Adopting even basic cyber security practices can help thwart cyber threat actors and reduce the threats to Canadians and Canadian businesses

About this document

This document highlights the cyber threats facing individuals, businesses, and critical infrastructure in Canada. We recommend reading this assessment along with the Introduction to the Cyber Threat Environment. This introduction provides a basic overview of cyber threat actors, their motivations, cyber tools, and an appendix of key cyber security tools and techniques referred to in this assessment.

As envisioned in the National Cyber Security Strategy, we prepared this document to help Canadians shape and sustain our nation’s cyber resilience. It is only when we work together — government, the private sector, and the public — that we can build resilience to cyber threats in Canada.

Limitations

This assessment does not provide an exhaustive list of all cyber threat activity in Canada or mitigation advice. As a threat assessment, the purpose of this document is to describe and evaluate the threats facing Canada. We focus on understanding the current cyber threat environment and how threat activity can affect Canadians and Canadian organizations. General guidance can be found on the Cyber Centre’s website in documents such as the Top 10 IT Security Actions and the Get Cyber Safe Campaign.

Sources

The key judgements in this assessment rely on reporting from multiple sources, both classified and unclassified. The judgements are based on the Cyber Centre’s knowledge and expertise in cyber security. Defending the Government of Canada’s information systems provides the Cyber Centre with a unique perspective to observe trends in the cyber threat environment, which also informs our assessment. CSE’s foreign intelligence mandate provides us with valuable insights into adversary behaviour in cyberspace. While we must always protect classified sources and methods, we provide the reader with as much justification as possible for our judgements.

Assessment process

Our cyber threat assessments are based on an analytical process that includes evaluating the quality of available information, exploring alternative explanations, mitigating biases, and using probabilistic language. We use the terms “we assess” or “we judge” to convey an analytic assessment. We use qualifiers such as “possibly,” “likely,” and “very likely” to convey probability.

This threat assessment is based on information available as of 15 October 2018.

Effects of cyber threat activity

Canadians and Canadian organizations are connecting more of what they value most to the Internet. Malicious cyber threat actors — many of whom operate outside our borders — take advantage of security gaps, low cyber security awareness, and new technological developments as they try to compromise cyber systems. In this assessment, we look at cyber threat activity according to how it can affect Canadian individuals, businesses, and critical infrastructure.^Endnote1

Cyber threat actors target anything connected to, or residing on, the Internet including:

• Technology, such as personal devices and industrial equipment;
• Information, such as intellectual property and personal and confidential details;
• Resources, such as financial assets and productivity;
• Relationships, such as supply chains and essential services; and
• Our opinions and reputations.

Cybercrime

As Canadians put more of their information online, they become increasingly attractive targets for cyber threat actors. With cybercriminals continuing to adapt and improve their cyber capabilities to steal, commit fraud, or extort money from Canadians, we assess that cybercrime is the cyber threat Canadians and Canadian organizations are most likely to encounter.^Endnote2

Stealing Personal and Financial Information

Stealing personal and financial information is lucrative for cybercriminals and is very likely to increase. Cybercriminals profit at the expense of Canadians by obtaining account login credentials, credit card details, and other personal information. They exploit this information to directly steal money, to resell information on cybercrime marketplaces, to commit fraud, or for extortion. Increasingly, we see cybercriminals becoming more organized, developing business-like processes to expand their operations to take advantage of vulnerabilities in software, hardware, and human behaviour online. For example, in recent years, cybercriminals have designed banking trojans specifically for mobile phones to steal user data and target financial resources. Cybercrime is now so prevalent and sophisticated that it sustains illegal online marketplaces. These cybercrime marketplaces offer illicit goods, stolen information, and malware. Some cybercrime marketplaces even offer customer support and rating functions. More accessible and easy-to-use cyber tools help cybercrime proliferate and operate around the world, often in areas beyond the reach of Canadian law enforcement agencies.

Increasing Cyber Threat Exposure

Canadians’ exposure to cyber threats increases with the growing number of Internet-connected devices, such as televisions, home appliances, thermostats, and cars. Manufacturers have rushed to connect more types of devices to the Internet, often prioritizing ease of use over security. We regularly observe cyber threat actors exploiting security flaws in devices resulting in either disruption to device functionality or using devices as platforms to launch other malicious cyber activities.

We have also observed malware used to find system vulnerabilities, allowing cyber threat actors to carry out unauthorized activity, such as launching a botnet. In fact, we judge that cyber threat actors are likely shifting their preferred platform for botnets from personal computers to other Internet-connected devices.

Financing Criminal Enterprise

Connecting more and more devices to the Internet has also created opportunities for cybercriminals to use malware to generate or “mine” cryptocurrency. In order to do this, cybercriminals use malware that takes control of a device’s processing power for their own purposes, interfering with a device’s functionality. Depending on the type of malware, affected users may not notice anything unusual about their device, while others may experience slower performance, a rapidly drained battery, increased data charges, or a shortened device lifetime.^Endnote4 We expect that cybercriminals will continue to develop malware to conduct unauthorized cryptocurrency mining in 2019, especially if cryptocurrency values rise.

Fraud and Extortion

We have observed increasing sophistication in the types of cyber fraud and extortion attempts directed at Canadians. We expect this trend to continue as cybercriminals acquire new tools. Cyber threat actors conduct fraud by posing as legitimate organizations, such as government institutions, banks, or law firms in order to trick Canadians into clicking on malicious links or attachments that attempt to download malware onto their devices. We have also observed cyber threat actors posing as trusted software providers using pop-up ads to lure unsuspecting users into downloading malware.

Fake Canada Revenue Agency Message

Cyber threat actors posing as the Canada Revenue Agency (CRA) have sent fraudulent emails and text messages to Canadians requesting personal information, such as their social insurance number, credit card information, or passport number. Some scams allege that personal information is required so a taxpayer can receive a refund; others threaten that recipients must pay a bogus debt.^Endnote5

Scams such as these are a reminder that it is not hard for cyber threat actors to find or develop content resembling a legitimate, trusted source. Phishing messages designed to appear legitimate are a simple, common, and often very effective form of compromise. Links and documents attached to these messages are likely malicious, containing banking trojans or other malware that cyber threat actors use to steal Canadians’ money or identities.

Cybercriminals use both cyber tools and social engineering to extort money or information from Canadians.^Endnote6 The most common form of malware used for extortion is ransomware. After cybercriminals infect a device with ransomware, they try to extort money from owners by encrypting their data. Ransomware is no longer a sophisticated cyber tool. Low-sophistication cyber threat actors can now access it as a service that they rent or purchase on cybercrime marketplaces.

Cyber threat actors can also amplify — or suppress — social media content using botnets, which automate online interactions and share content with unsuspecting users. Botnets share memes, promote hashtags, and harass legitimate users to create the impression that hundreds, thousands, or even millions of people share a cyber threat actor’s views. By spreading their preferred content among large numbers of paid and legitimate users, cyber threat actors can promote their specific point of view and potentially influence Canadians. Although major web platforms are making efforts to curb the negative effects of manipulative information sharing, the opinions of Canadians will remain an attractive target for cyber threat actors seeking to influence Canada’s democratic processes.

State-sponsored cyber threat actors seeking to influence democratic processes are also capable of conducting activity against organizations involved in elections, as well as politicians, political parties, and traditional media outlets. For more analysis, see the Communications Security Establishment’s “Cyber Threats to Canada’s Democratic Process” (2017).

We assess that cybercriminals are — and will continue to be — the greatest cyber threat facing businesses of all sizes in 2019. Cyber threat actors target Canadian businesses for their data about customers, partners and suppliers, financial information and payment systems, and proprietary information.

Stolen information is often held for ransom, sold, or used to gain a competitive advantage. Beyond financial losses from theft or ransom payments, cyber incidents can also result in reputational damage, productivity loss, intellectual property theft, operational disruptions, and recovery expenses.

Targeting Business Executives

Cyber threat actors use specific social engineering techniques against businesses. An increasingly common method is known as whaling. This term refers to spear-phishing aimed specifically at senior executives or other high profile recipients with privileged access to company resources. Whaling occurs when an executive with authority to issue large payments receives a message appearing to come from a relevant department or employee, urging them to direct funds to an account controlled by a cyber threat actor. This type of social engineering can lead to major financial losses and reputational damage, but it also requires internal information that is often difficult to obtain. Like other social engineering techniques, whaling is designed to exploit predictable human behaviour.

Data breaches

Stealing Customer and Client Data

Cyber threat actors have both the intent and capability to acquire sensitive information as demonstrated by numerous high-profile data breaches targeting the data of millions of customers around the world. Large databases containing personal information such as names, addresses, phone numbers, financial details, and employment information are valuable to cyber threat actors. The aggregation of data collected from multiple breaches can provide cyber threat actors the ability to build comprehensive profiles to conduct cyber threat activity against specific groups or individuals.

We assess that in 2019 large databases will almost certainly remain attractive targets for cyber threat actors seeking to sell information or support state-sponsored espionage.

Cyber threat actors also attempt to extort businesses by threatening to reveal confidential client information. Some businesses decide that paying a ransom is cheaper than the costs associated with ignoring a cyber ransom. Yet, cyber threat actors can decide to delete, modify, or release information, even if a payment is made. Robust cyber security and business continuity practices are required to protect valued data.

Extortion by Customer Data

In May 2018, cybercriminals contacted two Canadian banks, claiming to have accessed the personal information of tens of thousands of clients. The cybercriminals threatened to release the information unless the banks paid them $1 million ransom. Both banks refused to pay, offered clients free credit monitoring, and pledged to cover any money lost from affected bank accounts due to fraud.^Endnote12

This case shows that a business’s commitment to maintaining client confidentiality can be exploited in an attempt to extract payment. A similar operation against a business with fewer resources could inflict devastating damage by extorting funds that disable operations or releasing information and damaging its reputation.

Commercial Espionage

Canadian businesses, especially those active in strategic sectors of the economy, are subject to cyber espionage aimed at stealing intellectual property and other commercially sensitive information. Cyber threat actors target commercial information so they can copy existing products, undercut competition, or gain an advantage in business negotiations. Generally, commercial espionage requires advanced capabilities and a persistent approach.

We have observed some adversarial nation-states advance their defence and technology sectors by conducting cyber commercial espionage around the world, including in Canada. This cyber threat activity can harm Canada’s competitive business advantage and undermine our strategic position in global markets.

We assess that the threat of cyber espionage is higher for Canadian businesses when they operate abroad. Many countries have the legal and technological framework that enables their domestic police or security forces to covertly access data when it transits or resides in their country. Canadian businesses operating abroad should remain mindful of local laws, regulations, and business practices, and the threats these may present to their proprietary information, personal data, or intellectual property.

Exploiting trusted relationships

We assess that sophisticated cyber threat actors will likely continue to exploit the trusted relationships between businesses and their suppliers and service providers. Cyber threat actors can gain access to a business’s network by exploiting the equipment of a supplier prior to product delivery or by compromising a service provider’s connections to a partner or client.

Supply Chain Compromises

Many businesses rely on a complex, often globally distributed, supply chain that consists of many levels of component suppliers and developers.^Endnote14 It is likely that cyber threat actors will increasingly try to exploit supply chain vulnerabilities because security improvements have made devices and the information they contain more difficult to target directly.

Given the interdependent nature of many modern businesses, supply chain security is only as strong as its weakest link. As Figure 7 on the previous page shows, every link in a global supply chain can pose a threat to cyber security. A supply chain compromise allows cyber threat actors to exploit a device, or one of its components, even before the device is connected to a business’s secured network. Supply chain compromises can occur before or after the delivery of a product or service, or during software updates or hardware upgrades.

Managed Service Providers

We assess that in 2019 cyber threat actors will likely continue exploiting relationships of trust by identifying vulnerable parties and accessing shared networks to reach their primary target.

A managed service provider (MSP) is a company used by businesses to provide IT services and reduce the cost of maintaining in-house IT personnel. To be effective, MSPs typically have extensive access to a client’s network. MSPs that have many clients become a connection point among many networks. When cyber threat actors compromise a major MSP, they can obtain access to some or all of its clients’ networks and their digital property. We assess it is very likely that MSPs will remain attractive targets for advanced cyber threat actors because of their privileged connections to businesses' networks and information.

Cyber threat activity against critical infrastructure can have consequences far more severe and wide-reaching than activity against individuals and businesses. Cyber incidents affecting Canadian critical infrastructure have the potential to compromise public safety and national security.

We judge that the proliferation of malicious cyber tools has created opportunity for less sophisticated cyber threat actors to attempt to interfere with critical infrastructure. As the number and variety of devices used to support, monitor, and control critical infrastructure become more interconnected, the likelihood of cyber threat actors disrupting critical infrastructure has increased.

For example, in several high-profile cases, cybercriminals have unwittingly compromised critical infrastructure systems while exploiting a vulnerability in a more generic context. We have observed such malware spread uncontrollably, infecting critical infrastructure networks, even when cyber threat actors did not target them specifically.

Critical infrastructure providers are vulnerable to indiscriminate cybercrime activity, but their essential role in daily life means their equipment and services are also potential targets amid hostilities between states. Statesponsored cyber threat actors have conducted cyber espionage against critical infrastructure networks in Canada and allied nations.^Endnote19 In Canada, these threat actors have conducted reconnaissance and intelligence-gathering in the energy, aerospace, and defence sectors.

However, at this time, we assess it is very unlikely that statesponsored cyber threat actors would intentionally seek to disrupt Canadian critical infrastructure and cause major damage in the absence of international hostilities.

Accessing Industrial Control Systems

An industrial control system (ICS) is a type of operational technology that monitors and controls the physical equipment used in critical infrastructure, such as the processes involved in energy generation or the management of a transportation system.

Historically, manufacturers designed ICS devices to have long-service lifetimes, and many legacy systems continue to be used today. Legacy systems were built for safety and functionality, not cyber security. In recent years, secure devices and protocols have emerged and critical infrastructure providers are deploying them on new ICS installations. We assess that cyber threat actors will likely target unsecure devices and legacy systems until aging machinery and software are phased out and replaced.

We assess that a deliberate attempt to compromise an ICS would very likely require in-depth knowledge of proprietary information, such as network design and communications protocols, and an understanding of how the equipment is used in a particular industrial process. To collect proprietary information, cyber threat actors typically need to establish a covert presence and observe network activity over time. However, as inadequately secured ICS are connected to the Internet, they can become vulnerable to less sophisticated cyber threat actors, such as cybercriminals.

Conclusion

The cyber threat environment in Canada is always changing. We expect cyber threat actors to shift their methods and targets based on their evolving priorities, motivations, and capabilities.

In this assessment, we identified current trends in the cyber threat environment. Wherever possible, we highlighted the likelihood of cyber threat activity and examined how it can affect Canadians, as well as Canadian businesses and critical infrastructure.

In general, most of the cyber threats that we discussed can be mitigated through awareness and best practices in cyber security and business continuity. Cyber threats and influence operations succeed today because they exploit deeply rooted human behaviours and social patterns, and not merely technological vulnerabilities. Defending Canada against cyber threats and related influence operations requires addressing both the technical and social elements of cyber threat activity.

As the National Cyber Security Strategy recognizes, Canadian citizens, businesses, and critical infrastructure operators need to have confidence in the cyber systems we rely on every day. We are making a difference. The Cyber Centre approach of security through collaboration brings together expertise from government, industry, and academia to tackle the toughest cyber challenges that Canada faces. Working together, we can make Canada more resilient against cyber threats.

Useful Resources

For more information about mitigating cyber threats, we strongly encourage visiting:

• An Introduction to the Cyber Threat Environment
• Top 10 IT Security Actions
• Cyber Centre’s advice on Cyber Hygiene
• Cyber Centre’s advice on Mobile Security
• Get Cyber Safe Campaign
• Little Black Book of Scams
• Security Review Program Fact Sheet
• Cyber Security Considerations for Contracting With Managed Service Providers
• Technology Supply Chain Guidelines (TSCG-01)
• Malicious Cyber Activity Targeting Managed Service Providers
• Protect Yourself Online
• Learn More about Assembly Line
• Protect your devices and networks
• Implement architectural controls for network segregation
• Keyloggers and Spyware (ITSB-49)
• How to spot misleading information online and what to do about it
• Joint Report On Publicly Available Hacking Tools
• Spotting malicious e-mails
• Phishing
• Canada.ca/taxes-fraud-prevention
• Doppelganger Campaigns and Wire Transfer Fraud