Yesterday (July 5, 2102), the United States Court of Appeals for the First Circuit issued its much anticipated ruling in Patco Construction Company vs. People's United Bank d.b.a. Ocean Bank.  The court summarized the facts as follows: Over seven days in May 2009, Ocean Bank, a southern Maine community bank, authorized six apparently fraudulent withdrawals, totaling $588,851.26, from an account held by Patco Construction Company, after the perpetrators correctly supplied Patco's customized answers to security questions. Although the bank's security system flagged each of these transactions as unusually "high-risk" because they were inconsistent with the timing, value, and geographic location [...]

McAfee and Guardian Analytics have released a new whitepaper entitled, Dissecting Operation High Roller.  In the whitepaper, they describe a massive global attack that is stealing tens of millions of dollars banks, institutions and wealthy individuals. Unlike standard SpyEye and Zeus attacks that typically feature live (manual) interventions, we have discovered at least a dozen groups now using server-side components and heavy automation. The fraudsters’ objective in these attacks is to siphon large amounts from high balance accounts, hence the name chosen for this research: Operation High Roller. With no human participation required, each attack moves quickly and scales neatly. [...]

On June 14, 2012, Mark Weatherford, DHS's deputy under secretary for cybersecurity, provided at least the third formal cybersecurity presentation to the United States Senate.  The demonstration was part of the Obama Administration's efforts to pass cybersecurity slated to come to the Senate floor in the next three weeks.  This demonstration again focused on a spear phishing attack against the Homeland Security Department. The demonstration reflected the reality of the recent attack against the U.S. Natural Gas Pipeline infrastracture. Secretary Weatherford said the purpose of the demonstration was not to scare Senators and staff, but to enlighten them about how easy it [...]

This week DigitalBond, a firm that specializes in security for Industrial Control Systems (ICS), reported that it had been the victim of a spearphishing cyberattack.  Demonstrating the clever personalization that social engineering requires, DigitalBond reported: It’s a bit concerning that a company whose sole focus is securing industrial control systems should be spear phished.  The attacker clearly went to enough trouble to try to understand ICS security lingo to get the employee to open the link, and had to compromise a DNS server. This is the spearphishing email: Security Week  reports that this attack was part of a series of [...]

In a new video, American Banker discusses the ease with which hackers can deceive email recipients. In the video, the reporters discuss how a security expert crafted an email from one reporter to the other.  The recipient, being deceived into believing that the hacker was a colleague, opened the fake email.  Why?  Because it is impossible to easily determine that the fake email was fake. American Banker concludes: Social engineering attacks — also known as phishing and spear-phishing — are on the rise against banks and their corporate customers. The stakes are high and rising for both. Social engineering deceives users into becoming [...]

Today Iconix released its whitepaper, "Defending Against Spoofed Domain Spearphishing Attacks."  In this whitepaper,  Iconix discusses the ease with which hackers can use spoofed email addresses to deceive email recipients. Spoofed domain spearphishing is occurring because technology favors the social engineering schemes employed in spearphishing that are used to deceive recipients.  It is technically easy to fake the sending email address that is displayed to the recipient.  You can see a demonstration of how easy it is to spoof a sending domain at Spearphishing -- The Movie.  A little internet research yields substantial personal information that can be used to [...]

Flame is in the news.  What is Flame?  It is a large piece of malware that is used to spy on its victims.  Flame takes numerous cyberspying techniques and packages them together into a comprehensive suite of bad news.  Flame can record keystrokes, screen shots and SKYPE sessions.  It can turn on your microphone and listen in on conversations.  It can hijack bluetooth devices. You can watch a discussion about Flame between a former CIA official and a security expert on the PBS Newshour. Flame also demonstrates the general problem with anti-virus.  Until the malware is identified, it operates undetected. [...]

KnowBe4 has released information about the most widespread spearphishing scams targeting businesses. Spearphishing is the hacking technique in which highly targeted socially engineered emails are sent to a very small number of people.  The purpose of a spearphishing email is to deceive the recipient into taking an action, such as following a link or opening an attachment, that will compromise the security of the recipient's systems. KnowBe4 cites these five scams: 5. Better Business Bureau Complaint – The recipient receives an official-looking email that is made it appear the Better Business Bureau.  The recipient is instructed to click on a [...]

In a story first reported by The Christian Science Monitor, The United States Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has issued a warning about an active "spear phishing" campaign targeting companies in the natural gas pipeline sector. The article cites an April 13 confidential ICS-CERT alert: ICS-CERT has recently identified an active series of cyber intrusions targeting natural gas pipeline sector companies.  Multiple natural gas pipeline organizations have reported either attempts or intrusions related to this campaign. The campaign appears to have started in late December 2011 and is active today. The public ICS-CERT report states: Analysis shows [...]

ZDNet UK is reporting that British defense firms are being targeted by spearphishing attacks. Cabinet Office Minister Francis Maude Discloses SpearphishingPhoto credit: BIS Cabinet Office Minister Francis Maude stated that British defense contractors were being targeted by a sophisticated campaign that uses highly targeted emails to compromise systems.  The Minister announced that these attacks had been identified through a data sharing arrangement between business and government under the new UK cybersecurity strategy that was announced in November of 2011. The Minister noted, "UK government networks continue to be regularly targeted by foreign intelligence agencies, or groups working on their [...]