Tomorrow (October 8, 2013)  the United States will have a brand new $100 bill. Why do we need new money?  Because bad guys spoof money (also known as counterfeiting).  Nobody wants counterfeit money.  That is why it is important that people who are not Secret Service Agents are able to quickly and accurately distinguish real money from counterfeit money.  This requires two things -- *  features that are hard to spoof *  features that are easy to find You can see these features at the interactive note. Counterfeit money and spearphishing rely on the same basic function -- deceiving people. [...]

Brian Krebs, the cyber security expert, has discovered three disturbing data breaches over the last few days. Adobe.  Brian discovered the compromise of source code for several Adobe products and 3 million customer accounts. The attack appears to have started in mid-August of this year. LexisNexis/D&B/Kroll.  The databases of these three databrokers appear to have been compromised in April of this year. The bad guys installed bots that allowed them to mine data and sell the data in a massive identity theft scheme.  In addition to supporting massive identify theft, this data breach undermines the entire knowledge based authentication business. [...]

Dr. Frederick Chang, former NSA Director of Research observed: … cybersecurity is fundamentally about an adversarial engagement. Humans must defend machines that are attacked by other humans using machines. A recent blog posting by Cyveillance demonstrates this concept.  In Sophisticated DDoS Botnets Bypass Defenses,  Phil Annibale, Manager, Cyber Intelligence Division, writes about Dirt Jumper, a new Distributed Denial Of Service (DDoS) tool. Dirt Jumper is a DIY tool that is available for as little as $150 on the black market.  The humans who developed Dirt Jumper examined the defenses that human defenders deploy to defend against DDoS.  The Dirt Jumper developers then engineered [...]

On August 20, 2013, Gartner released Five Styles of Advanced Threat Defense.  This graphic from the Gartner report summarizes the defensive strategies: Gartner provides a description of each style, the strengths, weakness and players. Style 1 - Network Traffic Analysis.  These firms look at traffic patterns and seek to highlight abnormal traffic. Players include Arbor Networks, Damballa, Fidelis, Lancope and Sourcefire. Style 2 - Network Forensics.  After the bad guys are in, these tools support incidence response.  Players include Blue Coat and RSA. Style 3 - Payload Analysis.  These firms use a sandbox environment to detect malware and prevent installation. [...]

The Los Angeles Times recently posted an interview with Austin Berglas, assistant special agent in charge of the FBI's cyber branch in New York. In the interview, Special Agent Berglas discussed cyber threats against America.  Among the threats he discussed were the vulnerabilities of the banking industry and the stock exchanges.  He observed: Our message always boils down to everybody protecting themselves while on the Internet.... The No. 1 vector of attack for these bad guys is social engineering — the spear phish, the phishing e-mails ... This is certainly good advice - protect yourself from spearphishing.  But how do you [...]

NetTraveler is command and control software that is secretly installed on networks to steal data. Kaspersky Labs reported on the discovery of this threat back in June of this year. Kaspersky Labs has discovered that NetTraveler is back -- this time using spearphishing emails to target Uyghur activists.  Kaspersky provided this screen shot of an attack email:   The translation of this message is “The spokesman of the WUC made the following statement about the massacre in Karghiliq country. To the kind attention of everyone.”  A message about a local massacre is a strong call to action for Uygher activists.  When the link [...]

In order to send a highly targeted attack email, the attacker needs to identify the target.  How can an attacker identify targets?  The attacker needs names, functions, email addresses.  back | track 5r3 is a hacker tool which gives hackers the power to find those targets. This is a video that shows back | track 5r3 being used to download a list of google employees including their names,  titles, departments, office locations, and email addresses: Of course, a data dump is hard to use, so back | track 5r3 includes a feature to download the targeting data to a spearsheet. Cybersecurity is focused on defending systems. In response, almost [...]

The press is reporting that cyber attackers are using fake emails about the G20 conference to infiltrate financial, governmental and economic development organizations. No doubt it is interesting to know that bad guys are using fake G20 emails to infiltrate systems. But is that information really useful?  If you tell employees who interact with G20 materials not to open suspicious G20 materials, how do they actually do that?  The bad guys construct messaging and bait that looks real -- the entire purpose of social engineering is to look important, not suspicious.  That is why, even after being warned, the AP reporter [...]

Today the Syrian Electronic Army took over the website of the United States Marine Corps.  This was the new homepage of www.marines.com:   It has yet to be determined how the SEA took over the site.  Historically, the infiltration method used by the SEA is spearphishing. Iconix fights spearphishing. Spearphishers deceive people into making bad email decisions that compromise security. IT needs to help employees make better email processing decisions. That is where SP Guard comes into play. Using SP Guard, IT can determine a list of trusted senders and provide this information to staff in a simple and highly effective manner. You can contact [...]

Yesterday the Syrian Electronic Army attacked Twitter, Huffington Post UK and the New York Times.  Visitors to the New York Times website were greeted with this: The Washington Post characterized the attacks: The cyberattacks were among the more sophisticated in a recent series of assaults on high-profile Western media organizations, including The Washington Post and the Associated Press. Did these attacks demonstrate great technical sophistication?  No doubt the SEA has been effective in its efforts to disrupt the media. However, in reality these attacks were technically trivial.  SC Magazine is reporting that these attacks were accomplished  using  . . . . [...]