The Russians have compromised the Democratic National Committee's systems.  Press reports indicate that the Russians obtained the entire DNC database on Donald Trump.  The Russians were in the DNC systems for about a year and were able to read emails and chats. DNC Chair Debbie Wasserman Schultz So, how did they do it?  Crowdstrike reports that the intrusion was accomplished using spearphishing.  After gaining access to the DNC systems, one of the of the techniques used to achieve the attacker's objectives was "living off the land" techniques in which the attackers use native system functions, such as powershell, [...]

FireEye has discovered how the point of sale systems of over 100 North American retail, restaurant and hospitality organizations were compromised. These compromised exposed payment card data to bad guys. In its report, Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks, FireEye describes in great detail how two zero day exploits are used to steal the payment data.  The first exploit allows the attacker to escalate the attacker's system privileges. The second exploit allows the bad guy to steal data out of the memory of Point of Sale (POS) systems. In order for these new exploits to do anything, the [...]

The FBI issued a warning about Business Email Compromise (BEC) spearphishing attacks.  The FBI describes the attacks: The schemers go to great lengths to spoof company e-mail or use social engineering to assume the identity of the CEO, a company attorney, or trusted vendor. They research employees who manage money and use language specific to the company they are targeting, then they request a wire fraud transfer using dollar amounts that lend legitimacy. The FBI reports that between October 2013 and February 2016 this scam has netted over $2.3 billion. The scammers target victims with deceptive emails.  Unmask the deception [...]

Our last blog posting discussed the warning from the IRS about the threat of fake emails being used to steal employee payroll data.  The following high profile companies have fallen victim to this scam. Click on the logos to read their stories. Do you notice what is missing in each of these cyberattacks?  Malware.  There is no malware involved in these data breaches.  The bad guys used spearphishing to trick the authorized users into divulging the desired information.

On March 1, 2016, the IRS issued an alert to HR professionals warning that criminals are targeting HR professionals in order to steal employee data.  The fake email appears to come from a company executive requesting employee payroll data. The IRS reports that the scam  has several variations, all aimed at getting crucial personal information about employees. The scams include: Kindly send me the individual 2015 W-2 (PDF) and earnings summary of all W-2 of our company staff for a quick review. Can you send me the updated list of employees with full details (Name, Social Security Number, Date of Birth, [...]

Personal information about tens of thousands of FBI and Homeland Security employees appears to have been compromised. This report from The Telegraph relates some details: [The hacker] managed to download the details of about 30,000 US government employees from the FBI and Homeland Security, as well as 200GB of data. The data includes more sensitive information like credit card numbers and military emails, he said. How did he do it?  The Telegraph reports that the method was spearphishing.  Again.    

On February 2, 2016, the U.S. Justice Department announced that Charles Harvey Eccleston, a former employee of the the U.S. Nuclear Regulatory Commission (NRC), pleaded guilty to an attempted e-mail “spearphishing” attack that targeted dozens of Department of Energy (DOE) employee e-mail accounts. “Eccleston admitted that he attempted to compromise, exploit and damage U.S. government computer systems that contained sensitive nuclear weapon-related information with the intent of allowing foreign nations to gain access to that information or to damage essential systems,” said Assistant Attorney General Carlin. What technology was Eccleston using?  Spearphishing. Thinking he was dealing with foreign agents, Eccleston assembled lists of [...]