How malicious hackers get away with data
This is from a great piece at Infoworld that explores some of the possible methods that a malicious hacker could use to get sensitive data from a compromised network to the outside world.
1. Using well-known ports: Just because data is going out over a familiar port doesn’t mean its data was meant for that port. Attackers will use common ports such as 80 (HTTP) or 53 (UDP) to send sensitive data outside a network. Administrators should monitor traffic flows through these ports to spot suspicious data leaving the network.
2. Encrypting data: Wary of getting caught sending data in the clear, many attackers use encryption to mix up the bits before sending them outside the network. Although SSL and symmetric key encryption such as DES are sometimes used to hide the data, many attackers use far simpler XOR or bitwise encryption to disguise their booty. Why? With few admins even noticing the data leaving the network, why waste time with more complex encryption schemes?
3. Unmonitored protocols: Malicious programs often hide data in obscure Internet protocols that few network admins are looking for. For example, attackers could hide data in ICMP (Internet Control Message Protocol) echo requests — aka “pings” — that are captured and decoded by specially configured systems on the other end.
4. Throttled data transfers: Monitoring network flows in and out of your network is a great way to spot suspicious activity, but it’s not foolproof. Sophisticated attackers who are aware that you’re monitoring netflows might choose to throttle data transmissions so as not to arouse suspicions.
5. Hiding data in other traffic: Failing all else, attackers can hide data in normal network traffic — an art known as “steganography.” For example, attackers might pack stolen data into image files or documents that are then sent outside of the network.