Proofpoint recently posted its Ten Most Dangerous - Discover the Top Ten Advanced Threats Impacting Business Today. Number 1 was the media spearphish attack which compromised the Associated Press Twitter account, causing $150 billion in stock market decline. Proofpoint shows us spearphishing's devastating effectiveness:   This is like an email marketing conversion funnel, only this conversion funnel is evil.  By reducing the 70% open rate of this funnel, the downstream damage can be mitigated.  How can this conversion rate be reduced?  By reducing the power of deception used in these attacks.  In the AP case, the victim thought the malicious [...]

Anup Ghosh, writing a comment on the Securosis blog observed: The fallacy of the logic in monitoring and response is that you can detect the attack that bypassed the tools. If you could, then you would simply update the tools, which is how the security industry works (and failed) by and large. Instead, humans end up detecting artifacts of attacks long after the attack has been successful—after the damage is done—hence the [Incident Response] industry was born that attempts to perpetuate itself by saying you can’t prevent the attack. That’s the most expensive dollar in security you can spend—incident response. [...]

This is the progression of an Advanced Persistent Threat (APT) attack. Email filters fight this progression by trying to stop the delivery of spearphishing emails.  The most persistent and technically able APT attackers use their expertise to overcome the filters.  As filters become more and more effective, the amount of unwanted email that is delivered to users is reduced. Instead of a torrent of unwanted emails, what is left for the users to fend off  is a concentrated brew of the most devious, the  most technically advanced, the most toxic emails --  the Toxic Trickle. What can be done to [...]

On November 6, 2013, we wrote about a McAfee's discovery of a new Zero Day Exploit (ZDE) in Microsoft Office. Symantec is now reporting that although the good guys discovered this ZDE on October 31, 2013, the bad guys have been using it since May of 2013.  Symantec observes: After analyzing the payloads being used in this attack, we have identified that the targeted emails are part of an attack campaign known as Operation Hangover, which we covered back in May 2013 in the blog post: Operation Hangover: Q&A on Attacks. At that time, the group behind these attacks was known [...]

A new targeted attack which exploits the way Microsoft Office handles images is attacking victims in the Middle East and South Asia. darkREADING reports on the exploit in detail. Of particular interest to followers of Iconix is this observation from darkREADING: Bad guys can exploit the flaw that affects Windows, Office, and Lync by luring a victim into previewing or opening an email with a malicious file attachment or to visit a malicious URL. The end game is that the attacker can take over the machine. Microsoft has released a temporary Fix it patch for protection against attacks until it either issues a [...]

This morning's news brings two stories that demonstrate the importance of the recon phase of an APT attack in perpetrating a successful cyber attack. Recall the phases of an APT attack: Recon is not a passive activity.  The attacker gets to shape the decision space to deceive the victim.  The recon phase is the place to shape the decision space. In the first story, Networkworld reports on a penetration test in which the researchers created a false social media presence for a non-existent pretty young women.   In Fake social media ID duped security-aware IT guys, the work of Aamir Lakhani, a [...]

The Wall Street Journal is reporting that President Obama's twitter feed was infiltrated by the Syrian Electronic Army. According to an official with Organizing for Action, a group that supports the president, the Syrian Electronic Army was able to hack a service that helps OFA shorten the links it uses on its main Twitter account, @barackobama. The service, run by a third-party vendor, turns long Internet links into an “OFA.BO” format that it then uses in its tweets. Using this access, the Syrian Electronic Army was able to redirect the President's @barackobama tweets to a video entitled,“Syria Facing Terrorism.” The Syrian Electronic Army also claims to have hacked [...]

Kaspersky reports on a new trend in APT -- cyber-mercenaries who perform surgical hit and run operations.  In its report, The "Icefog" APT: A Tale of Cloak and Three Daggers, Kaspersky discusses the focus with which the Icefog attackers work.  Kaspersky provides this summary of Icefog: The attackers rely on spear-phishing and exploits for known vulnerabilities (eg. CVE-2012-0158, CVE-2012-1856, CVE-2013-0422 and CVE-2012-1723). The lure documents used in the attacks are specific to the target’s interest ...; Based on the profiles of known targets, the attackers appear to have an interest in the following sectors: military, shipbuilding and maritime operations, research companies, telecom operators, [...]