FireEye has just released research showing that spearphishers increase their attacks during holidays.  This graphic from FireEye shows the number of incoming malicious email attachments that evaded detection by the initial Anti-Virus and Anti-Spam defenses. FireEye says that the trend to mount attacks during national holidays suggests that the bad guys are attacking at times when IT operations are lightly staffed, thereby increasing the probability of avoiding detection.  Firewire observed that the national holiday attacks are well-coordinated: Prior to the start of the actual holiday, attackers appear to experiment with multiple campaigns, as illustrated by the smaller spikes in traffic, leading [...]

After Zscaler and Seculert independently identified targeted attacks that used  Remote Access Tool (RAT) malware to compromise  several government-related organizations, the firms collaborated to analyze the attacks.  Using their combined resources, Zscaler and Seculert were able to link the current attacks to previous  targeted attacks that have been occurring since early 2009.  They identified the threat vector as highly targeted spearphishing emails with malicious attachments, providing several examples of the social engineering that went into creating a compelling email.  They announced their findings in a January 31, 2012 blog posting.  They also issued a detailed joint technical report. Zscaler and Seculert termed this new class [...]

The press is widely reporting on Anonymous eavesdropping on a phone call between the FBI and Scotland Yard and other non-U.S. police agencies.  The sixteen minute phone call is currently posted here. How did Anonymous do it?  The FBI sent the link to the conference call to more than three dozen people at the FBI, Scotland Yard, and agencies in France, Germany, Ireland, the Netherlands and Sweden. One of the people who received the conference call log-in data forwarded the email to his personal account. That personal account had been hacked by Anonymous.  By accessing the hacked email account, Anonymous obtained the [...]

Mashable has posted a video describing the latest twist on the Sykipot targeted attack. As an added layer of IT  defense, the U.S. Government has adopted smart cards control access to data systems.  In this attack, the hackers attack the users by sending spearphishing emails that install malware which hijacks the smart cards.  Once activated, the malware by-passes the smart card protection. The technical details are reported by AlienVault.  AlienVault concludes: As defenses get better, attackers will continue to change their tactics to adapt, and as seen here, will hijack the very systems designed to provide more security, if necessary. An [...]

In order to compromise data networks, a point of entry is required.  An effective point of entry is the people who use the systems.   The Wall Street Journal's recent article, You Are A Security Risk, provides a nice discussion of this topic.  Ironically, the criminals use publicity about cyber intrusions to dupe careful people into their trap.  For example, there is a fake security alert purporting to be from CERT.  There is another current targeted attack using emails allegedly from the Stratfor’s CEO George Friedman, urging recipients to provide personal information in response to the recent compromise of Stratfor [...]

Nextgov is reporting that someone has been conducting a targeted attack against federal agencies and contractors. It appears that the attackers are trying to infiltrate aircraft designers’ computers in order to spy on the U.S. government's plans for remotely piloted aircraft. Alienvault Labs has studied this attack, dubbed “Sykipot”, and reported on it in detail. Alienvault Labs found: The modus operandi is simple, they send emails with a malicious attachment or link, sometimes using a zero-day exploit to key employees of different organizations. The attack, which has been running since at least September of 2011, uses images such as these as [...]

The Wall Street Journal is reporting that Chinese hackers accessed data of the U.S. Chamber from November of 2009 until May of 2010. Using a network of over 300 IP addresses, the hackers gained access to everything stored on its systems, including information about its three million members and lobbying efforts of the Chamber. The attack probably started with a spearphishing email. In a stark demonstration of how hard it is to detect malicious activity, The Wall Street Journal reported: It is possible the hackers had access to the network for more than a year before the breach was uncovered, according [...]

Timeline, the new feature just announced by Facebook, will make it even easier for bad guys to mine the Facebook social network for personal information they can use to launch malicious attacks. As this blog has noted many times, the most important element of an effective spearphishing attack is the persuasiveness of the fake email. Social networks are an ideal source of personal information that can be used to craft a spearphishing attack. Networkworld quotes Sophos security expert Chet Wisniewski: "Timeline makes it a heck of a lot easier [for attackers] to collect information on people.  It's not that the [...]

backtosecurity.com has written a step by step description of how it used social networking data that it discovered on Facebook to craft a spearphishing attack on an Australian advertising agency.  This was a whitehat hack. The posting describes how the hacker used information from the target's website to learn about the management structure and key names.  The hacker then correlated the employee names with Facebook profiles to locate a likely person to exploit.   The hacker targeted an executive's assistant for the attack.   The hacker was able to easily determine which executives of the firm did not have Facebook accounts.  The [...]