The Wall Street Journal is reporting that Chinese hackers accessed data of the U.S. Chamber from November of 2009 until May of 2010. Using a network of over 300 IP addresses, the hackers gained access to everything stored on its systems, including information about its three million members and lobbying efforts of the Chamber. The attack probably started with a spearphishing email. In a stark demonstration of how hard it is to detect malicious activity, The Wall Street Journal reported: It is possible the hackers had access to the network for more than a year before the breach was uncovered, according [...]

Timeline, the new feature just announced by Facebook, will make it even easier for bad guys to mine the Facebook social network for personal information they can use to launch malicious attacks. As this blog has noted many times, the most important element of an effective spearphishing attack is the persuasiveness of the fake email. Social networks are an ideal source of personal information that can be used to craft a spearphishing attack. Networkworld quotes Sophos security expert Chet Wisniewski: "Timeline makes it a heck of a lot easier [for attackers] to collect information on people.  It's not that the [...]

backtosecurity.com has written a step by step description of how it used social networking data that it discovered on Facebook to craft a spearphishing attack on an Australian advertising agency.  This was a whitehat hack. The posting describes how the hacker used information from the target's website to learn about the management structure and key names.  The hacker then correlated the employee names with Facebook profiles to locate a likely person to exploit.   The hacker targeted an executive's assistant for the attack.   The hacker was able to easily determine which executives of the firm did not have Facebook accounts.  The [...]

Dark READING reports that a Hungarian man has pleaded guilty in a phishing scheme to blackmail  Marriott.  The plea was entered on Nov. 23, 2011. The man, Attila Nemeth, 26, used data he stole from Marriott in an effort to force them to hire him into the IT department.  Dark READING summarized the scam: The case puts a whole new spin on the targeted attack; rather than trying to cash in on the intelligence or use it for competitive purposes, the perpetrator used it as leverage. Nemeth's methods were similar to those of advanced persistent threat (APT) attackers: He got a [...]