Russian hackers used compromised systems at the Executive Office of the President to access the President's schedule. How could Russian hackers get to the President's schedule?  CNN reports: As in many hacks, investigators believe the White House intrusion began with a phishing email that was launched using a State Department email account that the hackers had taken over, according to the U.S. officials. All the advanced cyber-defenses used to protect the White House were defeated by tricking users with deceptive emails. Spearphishing is not a casual hit and miss activity, it is the precise application of Military Deception. This is the [...]

On April Fools' Day President Obama issued an executive order entitled, "BLOCKING THE PROPERTY OF CERTAIN PERSONS ENGAGING IN SIGNIFICANT MALICIOUS CYBER-ENABLED ACTIVITIES." This was not an April Fools' prank. In the executive order the President observes that cyber-enabled threats "constitute an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States." In the executive order, the President declares a national emergency to deal with this threat. It is well-known that the most common method used by foreign powers to infiltrate U.S. Government systems is spearphishing.

Writing in TechCrunch, Tom Chapman, director of cyber operations of Edgewave, describes how terrorists can apply the same techniques used against Anthem, Sony and many others to engage in cyberterrorism. What could these technique be? Spearphishing. Chapman writes: As groups like ISIS become more tech-savvy and recruit members from Western countries, they will gain the ability to conduct effective spear-phishing attacks. What they will attempt to do inside corporate or government systems is hard to say. Hacking the controls for nuclear power plants, traffic systems and other vital infrastructure after a spear-phishing breach requires significant skill, but that skill level [...]

Premera, a leading health insurance company, has suffered a cyber breach impacting 11 million people. The company's announcement says it has been the victim of a "sophisticated cyberattack." What could this sophisticated attack have been? We turn to Brian Krebs to give us the details. The sophistication of this attack was not computer science, it was psychology. The attackers applied principles of deception to trick users into compromising their systems. In this case, the deception consisted of sending targeted emails to employees in which the double letter "n" was substituted for the letter "m", thereby displaying "prennera.com" instead of "premera.com".  This [...]

We have released a new white paper entitled "Spearphishing Defense Using Deception Countermeasures." This paper discusses how technical defenses (such as email filtering, malware detection, firewalls, limited user privileges, and system monitoring) leave systems unnecessarily exposed to phishing attacks because the human attack surface remains easily accessible and subject to successful attacks based on principles of psychology which are exploited using military deception. We propose deception countermeasures which modify the email interface, thereby making the user less susceptible to email-based deception. You will find the paper on our White Papers page.

Brian Krebs, writing in KrebsonSecurity, describes a scam in which criminals use email to impersonate company executives. The thieves use fake emails to issue bogus payment instructions to  finance and accounting staff. This is one example cited in Spoofing the Boss Turns Thieves a Tidy Profit: In February, con artists made off with a whopping $17.2 million from one of Omaha, Nebraska’s oldest companies — The Scoular Co., an employee-owned commodities trader. According to Omaha.com, an executive with the 800-employee company wired the money in installments last summer to a bank in China after receiving emails ordering him to do so. Wells [...]

Three Months Later, State Department Hasn’t Rooted Out Hackers. This headline from yesterday's Wall Street Journal speaks volumes about cyber security.  Back in November of 2014, it was discovered that someone had compromised the unclassified email system of the U.S. State Department. Since that time, a process which Iconix calls "The Chase" has played out in which the good guys try to remove the bad guys from systems while the bad guys undertake to maintain their evil presence.  In this case, the National Security Agency is chasing Russian? infiltrators. NSA Director Adm. Rogers How did these hackers get into the [...]

The Telegraph is reporting that Kaspersky labs has uncovered "what is thought to be the biggest ever cybercrime with more than £650 million going missing from banks around the world." The article relates a number of methods the attackers used to steal $1 billion from more than 100 financial institutions. Our favorite was instructing ATM machines to spit out cash.  How did they do it?  Clearly, they had to use pretty clever software and knowledge of the banks' systems. But, not matter how clever they are, the first problem is breaking into the banks systems.  How did they infiltrate the banks?  How did [...]

Brian Krebs, the author of the must-read Krebs on Security Blog, has reported new information about the Anthem breach. Krebs reports two new facts: The breach actually started in April 2014, not December 10, 2014, as previously reported. Thus, the January 27, 2015, discovery represented a breach of many months instead of a few weeks. The method of intrusion was spearphishing. This diagram from Crowdstrike is reproduced on Krebs on Security: Krebs observed that in this detailed diagram of the attack elements (right down to the IP addresses), one element is redacted. What could this redacted item be? Krebs concludes that it is the [...]