Yesterday, Aaron Boyd, a reporter at the Federal Times, wrote that someone tried to plant malware on his system through the use of a fake State Department email. Mr. Boyd reports: Among the many emails waiting in my inbox this morning was one that seemed to come through a State Department .gov domain address. It purported to be a fax from a State Department machine, containing a PDF file...Getting an unsolicited email or document isn't that unusual in the day-to-day of a reporter. However, the link to download the document went to a .org site (not the actual State Department site) [...]

OPM Director Katherine Archuleta resigned last week in the wake of the loss of millions of personnel records. Here’s the latest tally of lost records according to the Washington Post: Of those whose data was in the OPM background-check system, 19.7 million had applied for a security clearance. An additional 1.8 million were spouses, family members and other non-applicants, officials said. Also exposed were 1.1 million sets of fingerprints, detailed financial and health records, and computer usernames and passwords that applicants used to fill out their security-clearance forms online. Meeting with reporters last Thursday, FBI Director Comey said, It is [...]

Earlier this month, it was reported that the personnel records of 4 million federal employees had been compromised in a cyber attack on the Office of Personnel Management (OPM).  OPM is the US Government's HR department. As events unfold, it now appears that this breach was much worse than first reported.  The Washington Times is reporting that the breach may involve records of 32 million Americans. Office of Personnel Management Called Before Congress   All indications are that the attack was done by the same Chinese team that stole records from Anthem, the health insurance company, and that this attack [...]

Last week it was revealed the about 4 million former and current federal employees were impacted by a data breach at the Office of Personnel Management. Yesterday morning at a press conference in Germany, the President said, "We have known for a long time that there are significant vulnerabilities, and that these vulnerabilities are going to accelerate as time goes by, both in systems within government and within the private sector." As if acting on cue, a few hours after the President's prediction that things would get worse, things got worse. Brig. Gen. Malcolm B. Frost, U.S. Army, announced that the Army's official [...]

We attended the RSA Conference in San Francisco this week.  There are two giant convention halls filled with latest in information security.  In addition to the in-booth presentations, there are continuous presentations and panels discussing security.  Jeh Johnson, the Secretary of the Department of Homeland Security, was a keynote speaker. Yet, in this sea of the new, the most interesting thing was something patented almost a century ago. In the NSA’s booth (yes, that NSA) was this: A wooden box about the size of a toaster oven — an Enigma machine.  The Enigma machine was patented in 1919.  The Germans [...]

The personnel records of about 4 million current and former federal employees were compromised in a cyberattack on the Office of Personnel Management. This attack is being attributed to China.   Citing iSight Partners, the Washington Post attributes the attack to the group that compromised Anthem. This group uses spearphishing, highly targeted deceptive emails, to deceive people into compromising their systems. Deception takes place in the mind of the person who is being attacked. Users will decide which emails to trust. That decision can be guesswork or it can be guided by IT using SP Guard.

Carefirst, the health insurance company, reported on May 20 that approximately 1.1 million health care records were compromised in "a sophisticated cyberattack." What was the method used in the "sophisticated cyberattack"? Bryan Krebs has the details: Turns out, the same bulk registrant in China that registered the phony Premera and Anthem domains in April 2014 also registered two Carefirst look-alike domains — careflrst[dot]com (the “i” replaced with an “L”) and caref1rst[dot]com (the “i” replaced with the number “1”). Additionally, ThreatConnect has unearthed evidence showing the same tactics were used on EmpireB1ue.com (note the “L” replaced with a number “1”), a [...]

Verizon has released its Verizon 2015 Data Breach Investigations Report. We created this infographic from the report: At the conclusion of a comprehensive discussion of phishing, Verizon observes: Taking measures to block, filter, and alert on phishing e-mails at the gateway is preferred, but no technological defense is perfect, which leads us straight to…people. There is some hope in this data in that three-quarters of e-mails are not opened or interacted with. We wondered if there was a way to bump that number up (e.g., by giving users a quick way to flag potential phishes and become a detective control), so [...]

We attended the RSA Conference in San Francisco this week.  There are two giant convention halls filled with latest in information security.  In addition to the in-booth presentations, there are continuous presentations and panels discussing security.  Jeh Johnson, the Secretary of the Department of Homeland Security, was a keynote speaker. Yet, in this sea of the new, the most interesting thing was something patented almost a century ago. In the NSA’s booth (yes, that NSA) was this: A wooden box about the size of a toaster oven — an Enigma machine.  The Enigma machine was patented in 1919.  The Germans [...]

This week, FireEye released their latest APT report - APT30: The Mechanics Behind a Decade Long Cyber Espionage Operation.  The sub-title summarizes the findings: How a Cyber Threat Group Exploited Governments and Commercial Entities across Southeast Asia and India for over a Decade. What are the surprises in APT30? There are no surprises in APT30.  The bad guys engage in anti-forensics to avoid detection. APT30 tells us that the bad guys use spearphishing to make their initial infiltration: APT30 LEVERAGES MAJOR POLITICAL TRANSITION AS PHISHING LURE CONTENT IN CAMPAIGN GEARED TO KEY POLITICAL STAKEHOLDERS This is a sample of the lures used to [...]