Search Security reports that the South Carolina Department of Revenue's systems were compromised by a spearphishing attack which exposed millions of Social Security numbers, bank account information and thousands of credit and debit card numbers. Details of the attack are spelled out in a detailed incident report posted on the State of South Carolina's website.  The attacker used a spearphishing email with a malicious link.  When the employee clicked on the link a series of unfortunate events unfolded.  First, the employee's log-in credentials were stolen. From there, the attacker leveraged the stolen credentials in a series of clever moves that ultimately [...]

Our friends at Trend Micro have just released a study called "Spear-Phishing Email: Most Favored APT Attack Bait" discussing the methods used to infiltrate systems in APT - Advanced Persistent Attacks.  The findings?  91% of targeted attacks arrive via email.   Spearphishing emails deliver their malware using three different delivery methods: Malicious Attachments, which, when opened, install malware Malicious Links, which, when clicked and followed, install malware Other Methods, such as instructions to visit a website or call a telephone number. Of these methods, the overwhelming favorite used by attackers was malicious attachments. Source: Trend Micro In addition to revealing [...]

It is being widely reported that France is accusing the US of cyberespionage.  Techspot reports the details of how the spies were able to infiltrate the computers of President Sarkozy's advisors to steal information. In order to pull off the attack, the hackers leveraged their social engineering skills. First, they used Facebook to identify individuals close to Sarkozy and his team. Those hackers then crafted a bogus yet effectively indistinguishable clone of Elysee Palace's website and sent phishing emails to lure Sarkozy's advisers into logging on. When Sarkozy's trusted cohorts attempted to log on to the fake page, hackers recorded [...]

In a story entitled Coke Gets Hacked and Doesn't Tell Anyone, Bloomberg reports on the growing problem of cyber industrial espionage undermining the value of companies.  The article illustrates the central role of spearphishing in cyber-industrial espionage: The Coca-Cola report provides a rare and chilling account of the intricate and determined ways that hackers raided its files -- from pilfering internal e-mails to gaining the ability to access almost any Microsoft (MSFT) Windows server, work station or laptop on the network with full remote control. Computer hackers made daily incursions through Coca-Cola networks over a period of at least one [...]

TrendMicro has discovered a spearphishing attack that compromised the Israeli police.  The attack forced all police computers to be taken offline. In a textbook example of effective social engineering, the attackers crafted this email which spoofed the name of a trusted sender (Benny Gantz, the head of the Israel Defense Forces), had text that was a strong call to action (in this case, a subject of immediate interest to Israeli security forces) and delivered an attachment with zero day exploits. When the recipients opened the email, they were offered the opportunity to download the enticing attachment.  The attachment installed malware [...]

Cyberwar is upon us.  Last month it was disclosed that the White House Military Office had been attacked.  Thousands of sensitive records have been stolen from the Pentagon.  Major banks have been compromised. The administration has introduced legislation to address these threats.  Among the provisions of The Cybersecurity Act are data sharing rules.  In his Cyberwar Pearl Harbor speech,  Secretary of Defense Panetta explained data sharing: Ultimately, no one has a greater interest in cybersecurity than the businesses that depend on a safe, secure and resilient global, digital infrastructure. Particularly those who operate the critical networks that we must help defend.  [...]

On October 11, 2012, Leon Panetta, the US Secretary of Defense, spoke about the cyberthreats against the United States. He called cyberthreats a potential cyber Pearl Harbor. You can read a transcript of his remarks here. The Secretary spoke about the recent denial of service attack on financial institutions. He disclosed a previous classified attack on US oil interests: But even more alarming is an attack that happened two months ago when a very sophisticated virus called Shamoon infected computers in the Saudi Arabian State Oil Company Aramco.  Shamoon included a routine called a ‘wiper’, coded to self-execute.  This routine replaced [...]

In a blog entry posted today, Patrik Runald of Websense writes, "What is Scaring Businesses the Most? Spear-phishing."  The post explains the difference between high volume spam email and the social engineering used to create highly targeted emails. The post describes a spearphishing technique in which the attackers use clever timing of different cyberattack tools to defeat cyber-defenses: A typical attack of this type would have the bad guy doing the following: Find a URL that can be easily compromised… but do nothing at that time. Leave it ‘as is’ for now. Craft an email that will not trigger spam, AV [...]

On September 26, 2012, The Washington Post investigations team published an article entitled, "In cyberattacks, hacking humans is highly effective way to access systems." The authors prepared a fascinating graphical description of a highly targeted email attack.  The graphic shows how the hacker starts by using data readily available on the internet to gather information about the target.  The attacker than crafts an email that will be enticing to the target.  When the target takes the action requested in the targeted email, malware is installed in the victim's system.  At this point, the attacker is free to steal data and disrupt systems. Demonstrating the [...]