iSIGHT Partners has discovered a long-running cyberespionage operation in which Iranians are creating fake personas on popular social network sites.  The attackers use the fake personas to create trusted relationships with intended victims.   iSIGHT elaborates: iSIGHT has recently uncovered activity, which we call NEWSCASTER, that has quietly carried out cyber espionage since 2011, while eschewing methods preferred by many of its peers. NEWSCASTER is distinctive for its reliance on social networks, and the intricate network of false personas that exists on several of these platforms. Most notably, several of these personas are legitimized by a front news organization called NewsOnAir.org. These [...]

In March of this year, the RSA Conference was held in San Francisco. During that conference, security expert Ira Winkler belittled the hacking skills of the Syrian Electronic Army (SEA) and called them "the cockroaches of the Internet." Brian Krebs is now reporting that soon after Winkler's comments were posted online, the SEA commandeered the RSA Conference website. How did they do it? They determined that the RSA Conference website was hosted by a third party provider which used an analytics package called "Lucky Orange." Lucky Orange communicates with a server hosted by codoro.com.  The SEA spearphished the employees of [...]

Yesterday, U.S. Attorney General Eric Holder announced the indictment of five Chinese military officers accused of committing economic cyber espionage against the United States. You can download the indictment here. The indictment describes what "hacking" means in the context of Chinese cyber espionage: The indictment continues by providing details of the anti-forensic tactics used by the accused to evade detection. Your personnel will receive deceptive emails.  Your security hangs in the balance when an employee decides to click a link or open an attachment.  Telling employees to avoid suspicious emails is good advice.  The attackers use this same guidance — that [...]

Symantec has released their 2014 Internet Security Threat Report. Some of the key findings: 91% increase in targeted attacks campaigns in 2013 62% increase in the number of breaches in 2013 Over 552M identities were exposed via breaches in 2013 23 zero-day vulnerabilities discovered 1 in 392 emails contain a phishing attacks This Symantec infographic is particularly revealing:     The attackers have modified their attack methodology to stay below the radar.  How can you defend against spearphishing when the attackers are creating fewer forensic artifacts?   You can implement a defense that works at the point of the attack - [...]

On March 12, 2014, the annual HP sponsored Pwn2Own hacking competition took place at the CanSecWest security conference in Vancouver, British Columbia.  During the two day hacking event 35 exploits were used to launch 12 successful attacks.  A major theme of the exploits was the limitation of sandboxing technology. Search Security reported: Sandboxing isn't a security cure-all, Dormann [Will Dormann, vulnerability analyst with the Carnegie Mellon University Software Engineering Institute's CERT Division] said, but a sandbox does significantly increase the difficulty of crafting a successful exploit... "Nobody is using software that is flawless. If you have a significantly motivated attacker, they are probably [...]

We attended RSA 2014. Big Data was a big theme.  Collect everything and find anomalies.  The pitch -- our solution collects more and finds anomalies faster. Standing out from the big data big noise was  the keynote of Hewlett-Packard's Senior Vice President Art Gilliland, who explained that the best bang for the security buck was found in the human factors -  security training and processes. Walking the floor we saw one solution that implemented this theme.  All the big data guys offer a DLP solution that will find all the mistakes that people make using outbound email.  Errors like sending sensitive [...]