For a long time, we’ve been covering different methods by which, the bad guys access your data, steal it, or take control over your network. Living Off The Land attacks too, are a method that allows hackers to take control of your computers and other connected devices. The only thing different is that using Living off the Land attacks, they don’t have to download files to your computer all the time. The compromise happens once, and from there, your computer will work for hackers without you knowing it because antivirus software cannot detect such attacks.
What are Living Off The Land attacks
Living Off The Land means working using the tools already on your computer. That way, antimalware cannot detect it. In other cases, hackers send/receive continuous data to the machine they are trying to hack. But because the data is coming from outside, there are methods that can identify the attacks and stop them.
In the case of Living off the Land attacks, no such action is required. Once compromised, the bad guys just use the tools on your own computer to get things done in a way that nobody notices it. It means that the hackers use your own computer tools against you. That’s called a Living Off The Land attack.
How do Living Off The Land attacks work
The term Land refers to elements in your computer – both software and hardware. The hackers need not install anything in addition and hence the name – Living Off The Land attacks. These fall under the category Fileless Attacks.
The first thing in this method is to take over your machine by running some script. The baits usually come with unsolicited emails. These emails have a document laden with one or more VB-script macros. The Macro virus in the document runs on its own as soon as anyone opens the document, compromising the computer on which, the email was opened. Thereafter, hackers can easily use your computer via stealth files located in Windows Management Instrument or deep somewhere in the Windows Registry. Nothing new is installed on the computer so the antivirus cannot find anything out of order.
Most of us do not open documents unless they are from a trusted source. So a bit of social engineering is involved. The bad guys just need to convince you that the document is safe so that you can open it. They may or may not contain anything typed. Once the document is opened, the macro in the file runs a script to give the computer’s control to the hacker. All Living-off-the-Land work is done remotely, using the tools on your computer. These are mostly system files and utilities, so they pass through antimalware checks with ease, without any flags.
How to avoid Living Off The Land attacks
The best thing to do to avoid such Living off the Land attacks is NOT TO OPEN any documents from people whom you don’t know. If you have to open, make sure the documents’ extensions are not .dotm. Any file with docm extension is a macro-enabled document.
Sometimes hackers place an icon on your desktop instead of running macros to take over your machine. If you see any new icon on your computer desktop, don’t simply click it to run it. Instead, right-click on it and opt to see the file in the folder where it leads. If the target is some file other than that mentioned in the icon (.LNK files), simply delete the icon and the target file. If in doubt about the authenticity, you may check on the Internet by searching the target file in .LNK.
Summary
Living off the Land attacks are not easily found because hackers hide their files somewhere deep in the Registry or at places where the antimalware software doesn’t reach. You can avoid such attacks by not opening any type of attachments in emails. Do not click any new icon files (.LNK files) without safely checking its target file. Living off-the-land attacks are hard to detect because normal tools for malware cannot figure it out as an attack.
The above explains Living Off The Land Attacks and tells you how to stay safe. We’ll be happy to hear from you if you have anything to add.
Read next: Password Spray Attack Definition.
