Bit9 recently released its 2012 Bit9 Cyber Security Research Report. The report contains a survey of IT and Security Professionals which asks, "What method of cyber attack are you most worried about?" The answer -- spearphishing, with almost half of respondents identifying spearphishing as the threat that most concerns them. SP Guard from Iconix provides your staff with the ability to distinguish real email from spearphishing attacks.
Hackers seeking to steal confidential information from Tibetan activists are using spearphishing emails to infiltrate systems. Spearphishing occurs when hackers use socially engineered emails in order to deceive targeted email recipients into compromising their systems. In a textbook example of a spearphishing, reported by The Hacker News, hackers are pretending to send emails from the trusted security company FireEye. This is an example of one of those fake FireEye emails: In order to prevent social engineering from deceiving the email recipient, SP Guard from Iconix modifies the email client’s display to provide a visual indicator of the identity of the sender of email. [...]
Hackers use socially engineered emails in order to deceive targeted email recipients into compromising their systems. In order for a socially engineered email to deceive, it must contain a call to action that is compelling to the recipient. A current attack on Tibetan organizations demonstrates how clever hackers are able to use the news -- even news that discloses attacks -- to create a compelling call to action. Two weeks ago, SC Magazine reported that hackers in China were sending highly targeted emails to organizations in Tibet. The spearphishing message used a Tibetan religious festival as the call to action. The [...]
Antivirus software does not work against Advanced Persistent Threats. In the realm of Advanced Persistent Threats, the malware is targeted and designed for each intended victim. The attackers are hard at work creating new malware. According to Bit9: Furthermore, AV signature-based libraries are growing at 50,000 a day, with current libraries anywhere from 6 to 20 million signatures. At this pace, basing endpoint security solely on AV libraries is unsustainable in terms of sheer volume and efficient endpoint scanning – as well as a drain on IT resources. Some AV vendors now recommend downloading selective signature packs, belying the scalability problem. But more important is currency: No [...]
Our friends at Trend Micro have released a research report and an infographic that shows the global reach of espionage networks that use spearphishing to infiltrate computer networks. Spearphishing is a malicious email that is targeted to the recipient that encourages the recipient to take an action that will compromise his system. Trend Micro summarizes the problem: The number of targeted attacks has dramatically increased. Unlike largely indiscriminate attacks that focus on stealing credit card and banking information associated with cybercrime, targeted attacks noticeably differ and are better characterized as “cyber espionage.” Highly targeted attacks are computer intrusions threat actors [...]
Computerworld is reporting that the nasty malware Duqu is back. After being undetected for several months, Symantec discovered a new driver release on February 23, 2012. Liam O Murchu, manager of operations at Symantec's security response team, is quoted as saying that the functionality of the new driver was "more or less the same" as earlier versions, including the one spotted last October and another from late 2010 that later surfaced. According to O Murchu, It's hard to tell whether they really did take several months off, and if so, why. It's installed on a very small number of computers, and that [...]
On March 7, 2012, senior officials of the Obama administration conducted a cyberattack simulation for 50 United States Senators. The Washington Post Blog described the simulation: The scenario: a computer attack on the electricity grid in New York City during a summer heat wave. Using PowerPoint graphics, officials explained that the attack is launched by a software virus inserted into the system when an unsuspecting power company employee clicks on an infected attachment in an e-mail — a technique known as “spear phishing.” The virus spreads unchecked through the system, causing power outages and blackouts. The effects, officials said, could [...]
Eric Fiterman of Rogue Networks/Methodvue demonstrates how to construct a malicious email that effectively impersonates President Obama. Using malware delivered in an attachment, Fiterman takes control of the recipient’s computer. Watch as he steals passwords, searches for files and even takes a picture of his victim using the computer’s camera. What permits Fiterman to infiltrate this computer? The recipient can't distinguish a real email from the President from a fake email from the President. People need to know if an email is really from the President. They need to know if an email is really from a co-worker. SP Guard from Iconix [...]
Hackers frequently infiltrate networks by attacking the people who use the network rather than the network itself. How do the hacker's attack the people? A common method is spearphishing, in which a highly personalized email is sent to a small number of people. Because the email appears to be real -- it contains personalized information -- the recipient responds to the email. This creates a relationship of trust between the victim and the hacker. CNN Money reports on how security researcher Ryan O'Horo of IOActive used Linked-In to obtain personal information about a firm's employees. He used Linked-In to figure out the corporate [...]
Just before Christmas 2011, Stratfor was hacked by Anonymous. The means of that attack are unknown. Government Computer News is now reporting that the stolen Stratfor data are being used to send deceptive targeted emails to government email addresses. Microsoft has published technical details of the attack, including this sample fake email: The fake email delivers a malicious attachment in the form of a pdf file with a virus. Microsoft elaborated on the attack: The link displayed in the emails appears legitimate at first glance, but looking closely at the target address, you notice that it doesn't originate from the [...]
