On July 20, 2012, President Obama wrote in the Wall Street Journal: Nuclear power plants must have fences and defenses to thwart a terrorist attack. Water treatment plants must test their water regularly for contaminants. Airplanes must have secure cockpit doors. We all understand the need for these kinds of physical security measures. It would be the height of irresponsibility to leave a digital backdoor wide open to our cyber adversaries. The most widely used backdoor into data systems is the Advanced Persistent Threat (APT).  The most commonly used attack vector in APT is spearphishing – a deceptive email created by [...]

The most widely used and effective means to infiltrate a data processing system is spearphishing. Trend Micro recently reported that over 90% of targeted attacks use spearphishing to infiltrate the systems.  The core of spearphishing is social engineering - the attacker using his own human experiences and dishonesty to trick other people.  In spearphishing, the victim is tricked using email.  In a non-cyber example of how easy it is to fool people, Frank Abagnale, Jr., the conman portrayed in "Catch Me If You Can", related this story in a recent interview with the Minneapolis/St.  Paul Business Journal: I was sitting [...]

Search Security reports that the South Carolina Department of Revenue's systems were compromised by a spearphishing attack which exposed millions of Social Security numbers, bank account information and thousands of credit and debit card numbers. Details of the attack are spelled out in a detailed incident report posted on the State of South Carolina's website.  The attacker used a spearphishing email with a malicious link.  When the employee clicked on the link a series of unfortunate events unfolded.  First, the employee's log-in credentials were stolen. From there, the attacker leveraged the stolen credentials in a series of clever moves that ultimately [...]

Our friends at Trend Micro have just released a study called "Spear-Phishing Email: Most Favored APT Attack Bait" discussing the methods used to infiltrate systems in APT - Advanced Persistent Attacks.  The findings?  91% of targeted attacks arrive via email.   Spearphishing emails deliver their malware using three different delivery methods: Malicious Attachments, which, when opened, install malware Malicious Links, which, when clicked and followed, install malware Other Methods, such as instructions to visit a website or call a telephone number. Of these methods, the overwhelming favorite used by attackers was malicious attachments. Source: Trend Micro In addition to revealing [...]

It is being widely reported that France is accusing the US of cyberespionage.  Techspot reports the details of how the spies were able to infiltrate the computers of President Sarkozy's advisors to steal information. In order to pull off the attack, the hackers leveraged their social engineering skills. First, they used Facebook to identify individuals close to Sarkozy and his team. Those hackers then crafted a bogus yet effectively indistinguishable clone of Elysee Palace's website and sent phishing emails to lure Sarkozy's advisers into logging on. When Sarkozy's trusted cohorts attempted to log on to the fake page, hackers recorded [...]

In a story entitled Coke Gets Hacked and Doesn't Tell Anyone, Bloomberg reports on the growing problem of cyber industrial espionage undermining the value of companies.  The article illustrates the central role of spearphishing in cyber-industrial espionage: The Coca-Cola report provides a rare and chilling account of the intricate and determined ways that hackers raided its files -- from pilfering internal e-mails to gaining the ability to access almost any Microsoft (MSFT) Windows server, work station or laptop on the network with full remote control. Computer hackers made daily incursions through Coca-Cola networks over a period of at least one [...]

TrendMicro has discovered a spearphishing attack that compromised the Israeli police.  The attack forced all police computers to be taken offline. In a textbook example of effective social engineering, the attackers crafted this email which spoofed the name of a trusted sender (Benny Gantz, the head of the Israel Defense Forces), had text that was a strong call to action (in this case, a subject of immediate interest to Israeli security forces) and delivered an attachment with zero day exploits. When the recipients opened the email, they were offered the opportunity to download the enticing attachment.  The attachment installed malware [...]

Cyberwar is upon us.  Last month it was disclosed that the White House Military Office had been attacked.  Thousands of sensitive records have been stolen from the Pentagon.  Major banks have been compromised. The administration has introduced legislation to address these threats.  Among the provisions of The Cybersecurity Act are data sharing rules.  In his Cyberwar Pearl Harbor speech,  Secretary of Defense Panetta explained data sharing: Ultimately, no one has a greater interest in cybersecurity than the businesses that depend on a safe, secure and resilient global, digital infrastructure. Particularly those who operate the critical networks that we must help defend.  [...]

On October 11, 2012, Leon Panetta, the US Secretary of Defense, spoke about the cyberthreats against the United States. He called cyberthreats a potential cyber Pearl Harbor. You can read a transcript of his remarks here. The Secretary spoke about the recent denial of service attack on financial institutions. He disclosed a previous classified attack on US oil interests: But even more alarming is an attack that happened two months ago when a very sophisticated virus called Shamoon infected computers in the Saudi Arabian State Oil Company Aramco.  Shamoon included a routine called a ‘wiper’, coded to self-execute.  This routine replaced [...]