Last weekend the world's largest hacking convention, Defcon, was held in Las Vegas.   Reuters reported on the conference: [H]ackers taking part in the competition on Friday and Saturday found it ridiculously easy in some cases to trick employees at some of the largest U.S. companies to reveal information that can be used in planning cyber attacks against them. This was the second year that Defcon included a contest in "social engineering," in which the hackers tried to deceive people into disclosing information or taking ill-advised actions, such as opening an infected attachment, downloading malware or visiting a malicious website. [...]

McAfee has just released a whitepaper,  "Revealed: Operation Shady RAT," in which they investigated  one of the secret command and control networks which have been surreptitiously installed in networks around the world.  McAfee reports that the purpose of these secret networks is to steal data. What we have witnessed over the past five to six years has been nothing short of a historically unprecedented transfer of wealth — closely guarded national secrets (including from classified government networks), source code, bug databases, email archives, negotiation plans and exploration details for new oil and gas field auctions, document stores, legal contracts, SCADA configurations, design [...]

Today Iconix released its whitepaper, "Online Attacks Get Personal."  In this whitepaper,  Iconix discusses the disturbing trend of email attacks moving from general, widely distributed scams to highly personalized spearphishing emails. This trend is occurring because technology favors the social engineering schemes employed in spearphishing that are used to deceive recipients.  It is technically easy to fake the sending email address that is displayed to the recipient.  A little internet research yields substantial personal information that can be used to deceive the recipient.  Email is the ideal medium for deception because the attacker has at his command all of the [...]

Cyveillance reports on a new spearphishing scam that masquerades as the National Security Agency.   The malicious email claims to be from the NSA and exploits the recent compromise of the RSA two factor authentication token to deceive the recipient.   This is an image of the scam email: Cyveillance elaborates on the power of this scam: The sender name is spoofed to appear to come from “protection@nsa.security.gov” and the links go to national-security-agency.com, a domain that was just registered yesterday. This attack is a perfect example of how deeply spear-phishers understand the psychology of social engineering users.  It invokes the authority of a respected [...]

On July 14,  2011, during a speech introducing the Pentagon's new cybersecurity strategy, Deputy Defense Secretary William J. Lynn, III disclosed that 24,000 files had been lost to "foreign intruders."  Lynn said the files contained some of the U.S.'s "most sensitive systems, including aircraft avionics, surveillance technologies." How could this happen?  FastCompany reports that this was accomplished using a spear-phishing email to deliver an email payload with a zero day exploit.  The malicious email was sent to a defense contractor, rather than the Department of Defense.  The key to a successful spear-phishing attack is creating a highly personalized email that will deceive the recipient into taking the [...]

Yesterday the U.S. Department of Defense released its cybersecurity strategy.  The DoD summarized the importance of cybersecurity: Along with the rest of the U.S. government, the Department of Defense (DoD) depends on cyberspace to function. It is difficult to overstate this reliance; DoD operates over 15,000 networks and seven million computing devices across hundreds of installations in dozens of countries around the globe. DoD uses cyberspace to enable its military, intelligence, and business operations, including the movement of personnel and material and the command and control of the full spectrum of military operations. The report stresses the role of people [...]

In  a June 27, 2011 article entitled, "Human Errors Fuel Hacking as Test Shows Nothing Stops Idiocy", Bloomberg reports that people whose systems are compromised in spear phishing scams are idiots. Spear phishing is a scam in which the miscreant sends personalized emails to deceive the recipient into comprising data. The article cites the alarming statistic that in Department of Homeland Security experiments, 60% of people who found USB drives in the parking lot plugged the devices into their computers.  The article continues that human errors negate all the time and investment in firewalls and other technical defenses.  The article [...]

Yesterday, CRN published its list of the 10 Biggest Data Breaches of 2011.  This is the summary: In the battle against spear phishing, one solution stands out -- SP Guard from Iconix.