proofpoint has just released a whitepaper describing the latest innovation in APT cyberattacks -- longline phishing. proofpoint describes the latest innovations that attackers are using to ply their craft.  In order to evade cyber defenses, the APT cyberattacker has three objectives: Maintain low volume attacks to evade detection. Customize the attack to optimize victim response. Deliver unique malware to evade malware defenses. In order to accomplish these three objectives, historically the attackers had to devote significant effort to each attack.  That effort imposed a cost/volume trade-off on the attackers.  Describing longline phishing, proofpoint observes: ... today’s advanced phishing tactics may [...]

We just attended the RSA Conference 2013 in San Francisco.  The conference presented a vast array of products and technologies to defend systems. We think the most important security information did not come from the RSA Conference -- it came from Mandiant. Mandiant's groundbreaking report APT1 - Exposing One of China's Cyberespionage Units provides a case study of the process we have termed Chasing What's Already Gone - the cycle of: spearphishing attack unique exploit installation surreptitious command & control discovery remediation repeat How did the bad guys respond to the Mandiant report?  They used the report itself as spearphishing bait to [...]

On February 12, 2013, President Obama issued an executive order regarding cybersecurity. One of the most useful tools in the cyber attackers' arsenal is email. Email was the means of attack used in simulated attacks conducted by the Department of Homeland Security for the Senate.  Email was the means of attack used against the White House Military Office, the Department of Defense, the U.S. Natural Gas Pipeline Infrastructure, Military Drone Contractors and many others. The reason that attacks use email is because deceptive emails are very effective method to deliver malware into organizations. Iconix has released a new whitepaper, Email [...]

The U.S. aerospace industry is being attacked with zero day exploits of Adobe Flash. How did the attackers install the malware on victims' systems?  The attackers used targeted spearphishing emails.  In this case, the attackers sent an email with an attachment that was the schedule for an upcoming industry conference.  There was no reason for an aerospace engineer to doubt the validity of an email about an upcoming industry conference.  When the victim opened this attachment, the malware was installed.  This is the evil attachment: Of course, because the attachment looks completely benign, the victim has no idea what has [...]

It is being widely reported that the New York Times and the Wall Street Journal were the subjects of cyberattacks that compromised their networks.  These attacks appear to have infiltrated the networks with spearphishing emails.  CNN quotes Thomas Parenty, a former employee of the U.S. National Security Agency: To do a spear-phishing attack of this kind is a well-established move in attacks against Google and various U.S. defense contractors from China. You could say the tools are sort of stock-in-trade. How bad is this problem?  Secretary of State John Kerry, at his recent confirmation hearings, said foreign cyber-threats are “the modern day, [...]

On January 17, 2013, Kaspersky Labs released, The Red October Campaign - An Advanced Cyber Espionage Network Targeting Diplomatic and Government Agencies. The Kaspersky research discloses a massive network of command and control servers which has, over the past five years, infiltrated computer worldwide at governmental, diplomatic and scientific research organizations. Red October gathered information from computer systems, mobile devices and network equipment. Kaspersky details the technical means used to evade detection for 5 years. The creators of this software used many clever techniques to cover their tracks and regain control of systems that had been partially disinfected. What is [...]

We read about the work of security researchers at Georgia Tech Research Institute (GTRI) with great interest and even greater skepticism. We wholeheartedly concur with this observation of Andrew Howard, a GTRI research scientist who heads up the organization's malware unit: Organizations can spend millions and millions of dollars to protect their networks, but all it takes is one carefully-crafted email to let someone into it. It's very difficult to put technical controls into place to prevent humans from making a mistake. To keep these attacks out, email users have to do the right thing every single time. The place where we part [...]

On January 3, 2013, Trend Micro published a research paper describing the newly discovered HeartBeat APT campaign. Trend Micro reports that the HeartBeat campaign appears to targeted at South Korea.  The attack is estimated to have started in November of 2009.  The HeartBeat campaign targets the following sectors: Political parties Media outfits A national policy research institute A military branch of South Korean armed forces A small business sector organization Branches of South Korean government The attack used a custom RAT (remote access tool).  Trend Micro summarizes what the RAT does: These commands give the attackers complete control over their [...]