Premera, a leading health insurance company, has suffered a cyber breach impacting 11 million people. The company's announcement says it has been the victim of a "sophisticated cyberattack." What could this sophisticated attack have been? We turn to Brian Krebs to give us the details. The sophistication of this attack was not computer science, it was psychology. The attackers applied principles of deception to trick users into compromising their systems. In this case, the deception consisted of sending targeted emails to employees in which the double letter "n" was substituted for the letter "m", thereby displaying "prennera.com" instead of "premera.com".  This [...]

We have released a new white paper entitled "Spearphishing Defense Using Deception Countermeasures." This paper discusses how technical defenses (such as email filtering, malware detection, firewalls, limited user privileges, and system monitoring) leave systems unnecessarily exposed to phishing attacks because the human attack surface remains easily accessible and subject to successful attacks based on principles of psychology which are exploited using military deception. We propose deception countermeasures which modify the email interface, thereby making the user less susceptible to email-based deception. You will find the paper on our White Papers page.

Brian Krebs, writing in KrebsonSecurity, describes a scam in which criminals use email to impersonate company executives. The thieves use fake emails to issue bogus payment instructions to  finance and accounting staff. This is one example cited in Spoofing the Boss Turns Thieves a Tidy Profit: In February, con artists made off with a whopping $17.2 million from one of Omaha, Nebraska’s oldest companies — The Scoular Co., an employee-owned commodities trader. According to Omaha.com, an executive with the 800-employee company wired the money in installments last summer to a bank in China after receiving emails ordering him to do so. Wells [...]

Three Months Later, State Department Hasn’t Rooted Out Hackers. This headline from yesterday's Wall Street Journal speaks volumes about cyber security.  Back in November of 2014, it was discovered that someone had compromised the unclassified email system of the U.S. State Department. Since that time, a process which Iconix calls "The Chase" has played out in which the good guys try to remove the bad guys from systems while the bad guys undertake to maintain their evil presence.  In this case, the National Security Agency is chasing Russian? infiltrators. NSA Director Adm. Rogers How did these hackers get into the [...]

The Telegraph is reporting that Kaspersky labs has uncovered "what is thought to be the biggest ever cybercrime with more than £650 million going missing from banks around the world." The article relates a number of methods the attackers used to steal $1 billion from more than 100 financial institutions. Our favorite was instructing ATM machines to spit out cash.  How did they do it?  Clearly, they had to use pretty clever software and knowledge of the banks' systems. But, not matter how clever they are, the first problem is breaking into the banks systems.  How did they infiltrate the banks?  How did [...]

Brian Krebs, the author of the must-read Krebs on Security Blog, has reported new information about the Anthem breach. Krebs reports two new facts: The breach actually started in April 2014, not December 10, 2014, as previously reported. Thus, the January 27, 2015, discovery represented a breach of many months instead of a few weeks. The method of intrusion was spearphishing. This diagram from Crowdstrike is reproduced on Krebs on Security: Krebs observed that in this detailed diagram of the attack elements (right down to the IP addresses), one element is redacted. What could this redacted item be? Krebs concludes that it is the [...]