Yesterday  60 Minutes on CBS broadcast The Great Brain Robbery: Economic espionage sponsored by the Chinese government is costing U.S. corporations hundreds of billions of dollars and more than two million jobs. On the 60 Minutes website is posted extra content called "Correspondent Candid" which is embedded below. In this segment, we learn exactly how the Chinese steal our stuff.  At 47 seconds the big secret is revealed. No surprise -- spearphishing.  At Spearphishing – The Movie former FBI agent Eric Fiterman gives us a deeper dive into spearphishing technology. What we see is how bad guys use technology to access the key control element of [...]

ESET is reporting that on December 23, 2015, about half of the 1.4 million residents of Ukraine's Ivano-Frankivsk region were left without power as the result of a spearphishing attack being attributed to Russia. Ukraine Utility Prykarpattya Oblenergo The attack on Prykarpattya Oblenergo was the classic spearphishing attack. The targeted individual received an email masquerading as from a trusted sender. In this case, the purported sender was the Ukrainian parliament. The email had an attachment. The attachment was crafted to induce the victim to enable scripts.  The scripts then compromised the victim's system. It is important to focus on the user to understand how this attack [...]

Kaspersky just released its 2015 Top Security Stories. The major theme is the growth of targeted attacks. In the targeted attack, the bad guy infiltrates systems by socially engineering the users. Kaspersky created this graphic which shows how a gang of cybercriminals stole $1 billion. As you can see, the infection phase uses a spearphishing email to gain the entry into the systems. This report from Kaspersky emphasizes the need to provide users with tools that help them fight spearphishing attacks. That is where SP Guard from Iconix adds a new layer of security by helping employees identify malicious emails.

A recent article posted at techviral describes how Indian cyberattackers are using spearphishing to attack Pakistani and UAE websites. The post discusses how the Indian hacking groups called the Shakti Campaign and the VVV use deceptive emails to gain control of targeted computers. It's a fact pattern we have seen many times before.  The victim receives a deceptive email pretending to be from a trusted source. The victim clicks a link or opens an attachment, launching a sequence of events that gives system access to the attacker. The crucial step in these attacks is the user's intervention -- the user must be deceived [...]

In a recent Wall Street Journal interview, Adm. Mike Rogers, the Director of the NSA, suggested that people who fall for spearphishing attacks, such as the four people who compromised the Joint Staff, should be subject to court-martial. He drew this analogy: If someone had said to me, “Hey, it’s lonely on post. It’s the middle of the night out in the middle of nowhere. I just pulled my gun out because I wanted to quick draw,” we would never accept that. So why are we willing to accept this kind of behavior in the cyberworld? The problem with this [...]

The FBI and Secret Service are investigating reports that the private email accounts of CIA Director John Brennan and Homeland Security Secretary Jeh Johnson were "hacked." So, how did the hacker do it?  Hacking is malware, right? This case demonstrates that hacking is not malware.  Hacking is the theft of credentials.  Credentials can be stolen with malware. However, credentials can be stolen in other ways. This hacker is talking to the press. He told The New York Post that the way he stole the credentials was "social engineering." Rather than attacking systems, social engineering manipulates people. The hacker wanted the login credentials. In order [...]

The secret behind Chinese hacking has been revealed by ThreatConnect. CNN Money reports: The hackers' techniques don't sound very sophisticated: They send innocent-looking emails to unsuspecting recipients, whose computers then get infected with malware that trawls for sensitive information. This graphic from ThreatConnect shows the key role played by spearphishing. Source: ThreatConnect This simple technique is devastatingly effective because it is easy to create an email that deceives users into taking the actions desired by the attackers. In its September 24, 2015 first page story, "Sleuths Link Hacker to China’s Military," the Wall Street Journal describes how a spearphishing email [...]