100,000 Tweets in 1 Day ? How One Company Discovered a Security Breach using Big

Posted by Lauren Ellis on August 11th, 2014

As the recent breach involving millions of Target customer credit cards illustrates, security breaches leave a pattern of activity that is mathematically unusual. As cyber criminals increasingly use the cloud as an attack vector, these attacks also create anomalous activities that indicate something is wrong. In mathematical terms, they produce outliers that are several standard deviations away from normal user activity. A breach is usually at the edge of the bell curve and stands out as unusual.

The challenge for today’s companies is to identify these anomalous events quickly and then take immediate steps to investigate, take action, and limit the damage.  With billions of transactions to look at, how do companies find the needles in very large haystacks? They need scalable cloud analytics to analyze large volumes of transaction data and automatically find anomalous activity.

Interesting Usage Anomalies Actually Evidence of Breaches

Using Skyhigh’s cloud analytics, Fortune 2000 companies have identified security breaches and taken corrective action before they threatened their businesses. Here are some of the most creative attacks we’ve uncovered:

1. Malware stealing data via Twitter – At a large financial institution, Skyhigh identified a single IP address at the company that was sending over 100,000 tweets per day. The corporate Twitter account only had few thousand tweets since inception. Investigating further, they discovered that it was malware exfilterating data 140 characters at a time via a Twitter account.
2. Command and control using GoToMyPC – At a retail company, Skyhigh identified a single device attempting to connect to GoToMyPC 11 million times in a single week. After investigating, they discovered the computer was infected with malware and attempting to connect so it could be used to infiltrate the company.
3. Blocked attempts to use Facebook – At an energy company, a single device made 3.8 million attempts to access Facebook, all of which were blocked. The computer was infected with malware and was attempting to connect to exfiltrate data from the company.

Author :
Lauren Ellis is a research analyst covering the technology industry’s top trends & topics, focusing on Cloud Security, Cloud Computing, Data Loss Prevention etc.,