In a blog entry posted today, Patrik Runald of Websense writes, "What is Scaring Businesses the Most? Spear-phishing."  The post explains the difference between high volume spam email and the social engineering used to create highly targeted emails. The post describes a spearphishing technique in which the attackers use clever timing of different cyberattack tools to defeat cyber-defenses: A typical attack of this type would have the bad guy doing the following: Find a URL that can be easily compromised… but do nothing at that time. Leave it ‘as is’ for now. Craft an email that will not trigger spam, AV [...]

On September 26, 2012, The Washington Post investigations team published an article entitled, "In cyberattacks, hacking humans is highly effective way to access systems." The authors prepared a fascinating graphical description of a highly targeted email attack.  The graphic shows how the hacker starts by using data readily available on the internet to gather information about the target.  The attacker than crafts an email that will be enticing to the target.  When the target takes the action requested in the targeted email, malware is installed in the victim's system.  At this point, the attacker is free to steal data and disrupt systems. Demonstrating the [...]

Last week, we wrote about a cyber attack on Bank of America. The FBI, in association with the Financial Services Information Sharing and Analysis Center (FS-ISAC), and the Internet Crime Complaint Center (IC3), has issued a Fraud Alert which provides more details about the attacks. The Fraud Alert provides details on the attack methods: The actor(s) primarily used spam and phishing e-mails to target their victims. Once compromised, keyloggers and RATs installed on the financial institution employee’s computer provided the actor(s) with complete access to internal networks and logins to third party systems. Variants of ZeuS malware were used to steal the employee’s credentials in [...]

Fox Business News is reporting that cyber hackers, apparently from Eastern Europe, are stealing money from Bank of America customer accounts in coordinated cyberattacks.  The hackers use spearphishing emails to steal employee credentials.   Using the stolen credentials they steal customers' money.  They then send fake emails posing as bank administrators approving the wrongful transfers.  Finally, the hackers mount a denial of service attack on the bank's website to distract to stop the bank from catching the fake wire transfers.  In same instances the criminals have stolen up to $1,000,000. You can view the news report here: How can a [...]

In October of 2011 Symantec discovered the Nitro Attacks, a series of spearphishing emails that installed command and control software to steal intellectual property from chemical companies. Symantec is now reporting on a new series of Nitro Attacks.  In the first round of Nitro Attacks, the hackers sent highly targeted emails which delivered a malicious attachment.  Symantec has found: In these latest attacks, the attackers have developed a somewhat more sophisticated technique. They are using a Java zero-day, hosted as a .jar file on websites, to infect victims. As in the previous documented attacks, the attackers are using Backdoor.Darkmoon, re-using [...]

On September 4,  2012, FireEye released its Advanced Threat Report 1H 2012.  The report had five key findings. The amount of malware that is by-passing traditional malware defenses is exploding. Some industries are being attacked more than others. Email based attacks use both malicious attachments and malicious links, favoring the methods that most effectively evade detection at any given time. The use of throw-away domains to send spearphishing emails is becoming the prevalent attack profile. Cybercriminals are changing the malware delivered in malicious attachments more quickly in order to avoid detection. While all of these trends are alarming, let us [...]

Radware announced that its researchers have discovered new malware.  The malware is spread as a malicious email attachment.  When the email recipient opens the email attachment, a keylogger is installed that collects passwords, credit card data and other sensitive information. Showing the continuing cat and mouse game in which bad guys discover new forms of attack to evade security measures, The Admin.HLP Trojan is hidden within a standard windows help file named Amministrazione.hlp and it is attached to emails. This standard help file does not activate any installed anti-virus programs, and therefore it goes under the radar of standard anti-virus [...]

Trusteer discovered that the internal network of an unidentified US airport has been compromised. The airport uses a common remote access method -VPN - to allow remote access to its network.  In the current case, the attackers used screen capture software to steal user login in data.  Computerworld reported the details of how the login credentials were stolen: [T]he attack involved an innovative mixture of standard VPN login grabbing using the Citadel Trojan followed by screen scraping to discover the one-time password (OTP) presented by the gateway authentication system. The OTP presented was in the form of an on-screen CAPTCHA [...]