Computerworld is reporting that the nasty malware Duqu is back.  After being undetected for several months, Symantec discovered a new driver release on February 23, 2012. Liam O Murchu, manager of operations at Symantec's security response team, is quoted as saying that the functionality of the new driver was "more or less the same" as earlier versions, including the one spotted last October and another from late 2010 that later surfaced. According to O Murchu, It's hard to tell whether they really did take several months off, and if so, why. It's installed on a very small number of computers, and that [...]

On March 7, 2012, senior officials of the Obama administration conducted a cyberattack simulation for 50 United States Senators.  The Washington Post Blog described the simulation: The scenario: a computer attack on the electricity grid in New York City during a summer heat wave. Using PowerPoint graphics, officials explained that the attack is launched by a software virus inserted into the system when an unsuspecting power company employee clicks on an infected attachment in an e-mail — a technique known as “spear phishing.” The virus spreads unchecked through the system, causing power outages and blackouts. The effects, officials said, could [...]

Eric Fiterman of Rogue Networks/Methodvue demonstrates how to construct a malicious email that effectively impersonates President Obama. Using malware delivered in an attachment, Fiterman takes control of the recipient’s computer. Watch as he steals passwords, searches for files and even takes a picture of his victim using the computer’s camera.   What permits Fiterman to infiltrate this computer?  The recipient can't distinguish a real email from the President from a fake email from the President.  People need to know if an email is really from the President. They need to know if an email is really from a co-worker.  SP Guard from Iconix [...]

Hackers frequently infiltrate networks by attacking the people who use the network rather than the network itself.  How do the hacker's attack the people? A common method is spearphishing, in which a highly personalized email is sent to a small number of people. Because the email appears to be real -- it contains personalized information -- the recipient responds to the email. This creates a relationship of trust between the victim and the hacker. CNN Money reports on how security researcher Ryan O'Horo of IOActive used Linked-In to obtain personal information about a firm's employees.  He used Linked-In to figure out the corporate [...]

Just before Christmas 2011, Stratfor was hacked by Anonymous. The means of that attack are unknown. Government Computer News is now reporting that the stolen Stratfor data are being used to send deceptive targeted emails to government email addresses. Microsoft has published technical details of the attack, including this sample fake email: The fake email delivers a malicious attachment in the form of a pdf file with a virus.  Microsoft elaborated on the attack: The link displayed in the emails appears legitimate at first glance, but looking closely at the target address, you notice that it doesn't originate from the [...]

FireEye has just released research showing that spearphishers increase their attacks during holidays.  This graphic from FireEye shows the number of incoming malicious email attachments that evaded detection by the initial Anti-Virus and Anti-Spam defenses. FireEye says that the trend to mount attacks during national holidays suggests that the bad guys are attacking at times when IT operations are lightly staffed, thereby increasing the probability of avoiding detection.  Firewire observed that the national holiday attacks are well-coordinated: Prior to the start of the actual holiday, attackers appear to experiment with multiple campaigns, as illustrated by the smaller spikes in traffic, leading [...]

After Zscaler and Seculert independently identified targeted attacks that used  Remote Access Tool (RAT) malware to compromise  several government-related organizations, the firms collaborated to analyze the attacks.  Using their combined resources, Zscaler and Seculert were able to link the current attacks to previous  targeted attacks that have been occurring since early 2009.  They identified the threat vector as highly targeted spearphishing emails with malicious attachments, providing several examples of the social engineering that went into creating a compelling email.  They announced their findings in a January 31, 2012 blog posting.  They also issued a detailed joint technical report. Zscaler and Seculert termed this new class [...]

The press is widely reporting on Anonymous eavesdropping on a phone call between the FBI and Scotland Yard and other non-U.S. police agencies.  The sixteen minute phone call is currently posted here. How did Anonymous do it?  The FBI sent the link to the conference call to more than three dozen people at the FBI, Scotland Yard, and agencies in France, Germany, Ireland, the Netherlands and Sweden. One of the people who received the conference call log-in data forwarded the email to his personal account. That personal account had been hacked by Anonymous.  By accessing the hacked email account, Anonymous obtained the [...]