Last week, we wrote about a cyber attack on Bank of America. The FBI, in association with the Financial Services Information Sharing and Analysis Center (FS-ISAC), and the Internet Crime Complaint Center (IC3), has issued a Fraud Alert which provides more details about the attacks. The Fraud Alert provides details on the attack methods: The actor(s) primarily used spam and phishing e-mails to target their victims. Once compromised, keyloggers and RATs installed on the financial institution employee’s computer provided the actor(s) with complete access to internal networks and logins to third party systems. Variants of ZeuS malware were used to steal the employee’s credentials in [...]

Fox Business News is reporting that cyber hackers, apparently from Eastern Europe, are stealing money from Bank of America customer accounts in coordinated cyberattacks.  The hackers use spearphishing emails to steal employee credentials.   Using the stolen credentials they steal customers' money.  They then send fake emails posing as bank administrators approving the wrongful transfers.  Finally, the hackers mount a denial of service attack on the bank's website to distract to stop the bank from catching the fake wire transfers.  In same instances the criminals have stolen up to $1,000,000. You can view the news report here: How can a [...]

In October of 2011 Symantec discovered the Nitro Attacks, a series of spearphishing emails that installed command and control software to steal intellectual property from chemical companies. Symantec is now reporting on a new series of Nitro Attacks.  In the first round of Nitro Attacks, the hackers sent highly targeted emails which delivered a malicious attachment.  Symantec has found: In these latest attacks, the attackers have developed a somewhat more sophisticated technique. They are using a Java zero-day, hosted as a .jar file on websites, to infect victims. As in the previous documented attacks, the attackers are using Backdoor.Darkmoon, re-using [...]

On September 4,  2012, FireEye released its Advanced Threat Report 1H 2012.  The report had five key findings. The amount of malware that is by-passing traditional malware defenses is exploding. Some industries are being attacked more than others. Email based attacks use both malicious attachments and malicious links, favoring the methods that most effectively evade detection at any given time. The use of throw-away domains to send spearphishing emails is becoming the prevalent attack profile. Cybercriminals are changing the malware delivered in malicious attachments more quickly in order to avoid detection. While all of these trends are alarming, let us [...]

Radware announced that its researchers have discovered new malware.  The malware is spread as a malicious email attachment.  When the email recipient opens the email attachment, a keylogger is installed that collects passwords, credit card data and other sensitive information. Showing the continuing cat and mouse game in which bad guys discover new forms of attack to evade security measures, The Admin.HLP Trojan is hidden within a standard windows help file named Amministrazione.hlp and it is attached to emails. This standard help file does not activate any installed anti-virus programs, and therefore it goes under the radar of standard anti-virus [...]

Trusteer discovered that the internal network of an unidentified US airport has been compromised. The airport uses a common remote access method -VPN - to allow remote access to its network.  In the current case, the attackers used screen capture software to steal user login in data.  Computerworld reported the details of how the login credentials were stolen: [T]he attack involved an innovative mixture of standard VPN login grabbing using the Citadel Trojan followed by screen scraping to discover the one-time password (OTP) presented by the gateway authentication system. The OTP presented was in the form of an on-screen CAPTCHA [...]

One front in the civil war in Syria has gone unreported in the press -- the cyber front. Strategy Page is reporting that cyberspace has become part of the battlefield in Syria.  Strategy Page reports: [I]t was recently discovered that someone was targeting pro-rebel websites and individuals outside of Syria. The attack came in the form of phony email addressed to a specific individual and made to appear it was from another rebel sympathizer or activist that the recipient knew. There was a file attached which, when opened, secretly installed monitoring software. Thus the infected computer could be secretly monitored [...]

In the July 19, 2012 edition of The Wall Street Journal, President Obama wrote about cybersecurity. The President wrote: ... foreign governments, criminal syndicates and lone individuals are probing our financial, energy and public safety systems every day. Last year, a water plant in Texas disconnected its control system from the Internet after a hacker posted pictures of the facility's internal controls. More recently, hackers penetrated the networks of companies that operate our natural-gas pipelines. Computer systems in critical sectors of our economy—including the nuclear and chemical industries—are being increasingly targeted. He observed: Nuclear power plants must have fences and [...]

In research reported last year in Kaspersky's threatpost, Aaron Higbee, the Chief Technology Officer at Intrepidus Group, stated that 70% to 80% of employees are fooled into taking compromising actions when they receive test spearphishing emails. Spearphishing is a scheme in which targeted emails are sent to individuals to deceive the recipient into taking compromising actions, such as visiting a malicious website, disclosing sensitive information or installing malware.  You can see a demonstration of spearphishing at Spearphishing - The Movie. The Kaspersky posting contains two specific suggestions.  First, train your employees to spot and avoid spearphishing emails.  Second, use email authentication.  At Iconix, [...]

The International Business Times recently reported on the ways cybercriminals are defeating corporate IT security. First, the new malware being used by attackers is harder to detect. Citing IDC research, the article states, "traditional forms of computer security, including antivirus software and firewalls, are only effective against 30 to 50 percent of the malware found today." Second, attackers are becoming far more effective in delivering malware into the enterprise through the use of spearphishing. Instead of using crudely crafted messages that are sent to large numbers of people in hopes that a few people will be deceived, in spearphishing the attacker gathers [...]