In a recent blog posting, Seculert  discussed a new malware threat which they have dubbed "Magic Malware." Magic Malware uses a proprietary communications protocol which evades detection by evasion detection software which monitors regular communications protocols.  Seculert observed: This “magic malware” — as we’ve dubbed it — is active, persistent and had remained undetected on the targeted machines for the past 11 months. ... The real intention of the attackers behind this magic malware ... is yet to be known. As the malware is capable of setting up a backdoor, stealing information, and injecting HTML into the browser, we believe that [...]

In a recent Computerworld article entitled Security tools can't keep hackers at bay, Jaikumar Vijayan writes about malware that struck Schnucks supermarket chain.  It took the experts from Mandiant two weeks to plug the security holes exploited by this malware. Why was this malware so difficult to  find and fix? Because the bad guys are using ever more sophisticated means to hide their evil work. The article quotes Avivah Litan, an analyst at Gartner: Increasingly, attackers are resorting to techniques like hiding stolen data inside legitimate files and encrypting data to evade detection. They cloak their malware or hide it within seemingly innocuous files so that [...]

The Twitter feeds of the BBC, the AP and the Guardian have all been compromised.  This fake tweet from the real AP Twitter account: caused $140 billion in stock market losses. In response to these events, Twitter issued a memo to the press  in which Twitter gives various recommendations on how to deal with the spearphishing problem. While this memo gives sound advice, the recommendations do not address the core spearphishing problem. What is the core spearphishing problem? Deception is the core spearphishing problem. In spearphishing, the bad guys send socially engineered emails which initiate a process which steals credentials.  The spearphisher's [...]

Yesterday, April 23, the twitter account of the AP wire service was compromised.  The perpetrators sent out a fake tweet from the real AP account saying that the President had been injured in a bombing at the White House.  There was no bombing. Jay Carney Confirms President is Fine This is the tweet that cost $140 billion in lost stock market value. How could this have happened?  It happened because a spearphishing email tricked an employee of AP into compromising the credentials to AP's twitter account.  With the credentials in hand, the attackers were free to use the twitter [...]

On April 17, 2013, FireEye reported on a series of spearphishing attacks against government agencies and aerospace, defense, telecommunications companies in India and the United States. The attachments which installed the malware varied considerably.  Some were blank, some were unreadable, some purported to contain contact data for a U.S. serviceman.  And some of the attachments were infected copies of an Indian researcher's report on the Pakistani drone program. FireEye reports on the various techniques that the attackers uses to prevent detection.  FireEye identified this evasion methods: The file specifies fake properties, pretending to be Google or Microsoft. The file is [...]

After an investigation which commenced in autumn of 2011, yesterday (April 11, 2013) Kaspersky Labs announced the results of its investigation into malware in the gaming industry. Kaspersky has identified the attackers as the Winnti organization. Kaspersky observed: It’s tempting to assume that Advanced Persistent Threats (APTs) primarily target high-level institutions: government agencies, ministries, the military, political organizations, power stations, chemical plants, critical infrastructure networks and so on. In this context it seems unlikely that a commercial company would be at risk unless it was operating on the scale of Google, Adobe or The New York Times, which was recently [...]

After a spearphishing email deceives a recipient into introducing malware into a network, diverse protective strategies kick into action. These defensive strategies monitor activity and flag unusual activities. The goal of the attacker is to "stay below the radar" and avoid detection. FireEye has discovered malware which seeks to hide behind legitimate activity to evade detection. FireEye reports that, unsurprisingly, this malware is introduced as an attachment to a spearphishing email. After the malware, dubbed "Trojan.APT.BaneChant", is installed, the malware engages in a multi-tiered defensive strategy to evade detection.  FireEye summarized the malware's detection evasion strategies: 1. Evade sandbox by [...]

In testimony before the United States Senate Armed Services Committee, Subcommittee on Emerging Threats and Capabilities, cyber security experts from Mandiant told the Senators that intruders often use  deceptive emails to compromise systems. Kevin Mandia said, They're leveraging human weaknesses and human vulnerability and trust to break into these organizations. Mandia told the senators that it is difficult to defend against deception. It is easy to deceive people.  This is an example of a deceptive spearphishing email. What looked like a routine FedEx email was, in fact, a cyber attack that compromised the New York Times. Your personnel will receive [...]