Digital Doa reports that on July 1, the networks of Battelle Memorial Institute Pacific Northwest National Laboratory and An undisclosed national laboratory suffered sophisticated attacks.  As of today, July 7, Pacific Northwest National Laboratory (www.pnnl.gov) was still off-line. Battelle manages several Department of Energy labs including: Brookhaven National Laboratory Idaho National Laboratory National Renewable Energy Laboratory Oak Ridge National Laboratory Pacific Northwest National Laboratory Lawrence Livermore National Laboratory Computer World reports that  although the specifics of the attacks have not been disclosed, they were probably perpetrated by spear-phishing email, in the manner of the attack on Oak Ridge National Laboratory earlier this year. [...]

Bloomberg reported on data security studies conducted by the U.S. Department of Homeland Security (DHS).   The article discussed how easy it is to mislead people into taking actions that compromise systems.   The Bloomberg article was widely quoted about the finding that 60% of employees who found a thumbdrive in the parking lot plugged it into their computers.  Bloomberg reported the figure was 90% if the thumbdrive was stamped with a government logo. DHS has now refuted the story.  DHS reports that the research was not conducted by DHS. DHS said that the actual rate at which employees plugged in [...]

Bloomberg is reporting that the International Monetary Fund ("IMF") has been infiltrated, probably by a spear-phishing attack.  Spear-phishing is a scheme of deception in which the perpetrator uses personalized information about the email recipient to heighten the perceived value of the email's call to action, thereby inducing the recipient to take detrimental action.    Bloomberg reports that a large quantity of data, including documents and emails, had been compromised.  The Bloomberg article cites one IMF memo which said that the IMF had disconnected its network connection to the World Bank as the result of the attack. Bloomberg reports that on June 1, 2011, [...]

The recent compromise of the email accounts of U.S. Government officials has been widely reported.  As the New York Times reported, these emails appeared to come from trusted colleagues.  The content was consistent with what was expected from real emails.  Because of the apparent source of the emails and the relevant content, the recipient was deceived into taking compromising actions.  How hard is it to create a compelling email?  What do these spear-phishing emails look like?   We find the answer at contagio, where several examples of these malicious emails are posted.  Here are two: The first example shows how the content was [...]

On Thursday, June 2, 2011, Secretary of State Hillary Clinton said that the FBI would investigate Google's accusation that Gmail accounts were hacked by China. Secretary of State Clinton Addresses Spear-PhishingThe New York Times cites Lt. Col. Gregory Conti, a computer security expert at West Point  as saying that the  momentum is on the side of the attackers.  He observed that it is becoming harder and harder to detect fraudulent emails because the bad guys were able to gather so much information about their targets from the Internet, particularly from social networks like Facebook.    “What’s ‘wrong‘ with these e-mails is very, [...]

Today it has been widely reported that gmail accounts of U.S. Goverment officials were accessed by hackers.  The Washington Post reported: Google said Wednesday that personal Gmail accounts of several hundred people, including senior U.S. government officials, military personnel and political activists, had been exposed. Google traced the origin of the attacks to Jinan, China, the home city of a military vocational school whose computers were linked to a more sophisticated assault on Google’s systems 17 months ago. The two attacks are not believed to be linked. The security blog contagio first reported on this problem on February 17, 2011.  The [...]

Today Iconix released a whitepaper entitled, “Defending Against Advanced Persistent Threats.” As the whitepaper describes, the United States, its allies and its industries are engaged in cyber warfare.  A leaked secret State Department cable describes a cyberwarfare attack: Since late 2002, USG organizations have been targeted with social-engineering online attacks by BC [Byzantine Condor] actors. … BC actors typically gain initial access with the use of highly targeted socially engineered e-mail messages, which fool recipients into inadvertently compromising their systems [spear-phishing]. The intruders then install malware such as customized keystroke-logging software and command-and-control (C&C) utilities onto the compromised systems and exfiltrate [...]

“Target – The Human” in the May 2011 issue of Information Security provides a detailed discussion of the social engineering schemes that are being used to compromise data processing systems. The article quotes Shawn Moyer, managing principal research consultant with Accuvant LABS R&D team: A common mistake enterprise security managers make is focusing on infrastructure and system defenses instead of people. A lot of defenders still think in terms of an attacker on the Internet externally trying to find a way in. … The reality is, if I’m the outside threat, I find an insider and that insider becomes your [...]

Today Iconix released a whitepaper entitled, “Phishing Training – A Losing Cyberwar Strategy.” As the whitepaper describes, the United States, its allies and its industries are engaged in cyber warfare.  A leaked secret State Department cable describes a cyberwarfare attack: Since late 2002, USG organizations have been targeted with social-engineering online attacks by BC [Byzantine Condor] actors. ... BC actors typically gain initial access with the use of highly targeted socially engineered e-mail messages, which fool recipients into inadvertently compromising their systems [spear-phishing]. The intruders then install malware such as customized keystroke-logging software and command-and-control (C&C) utilities onto the compromised systems [...]