Slashdot Mirror
Trojan Built for Industrial Espionage
xPertCodert writes "Some of the largest Israeli companies are involved in the major industral espionage case, in which private investigators implanted specially crafted Trojan horses on the computers at unsuspecting companies in a bid to obtain priviledged financial and technical data. Given the current state of Windows security and advances in spyware, probably any company has become a very easy target for such spy attack from competitors"
maybe such incidents will start companies (and Microsoft in particular) to start taking spyware more seriously
By its verry nature, a trogen is a program that APPREARS to be good but has an evil payload. once again, the problem is gullible users and/or techs and/or admins. not windows per-se.
I thought that Trojans were programs that pretended to be something legit but weren't. Other than finding them and putting them in a list of programs to delete in a virus scanner, is there a way to be "secure" with these?
If the company you are tailoring these trojans to runs Linux, aren't you, as the evil terrorist hacker, going to tailor the trojan to run on Linux?
Send 90% of the CEOs out there an email that says 'click here for a free iPod!' and we all know what they're going to do, whether they run Windows, Linux, or OS X.
Pulp Audio Weekly - Geek News and Reviews
Smart people shouldn't have that kind of data on a computer that could be attacked by spyware. Keep it on a network segregated from the internet and you keep it to an insider-only problem.
Microsoft sees spyware as an opportunity for profit.
The dangers of knowledge trigger emotional distress in human beings.
To quote a poster when the above is pointed out. "According to your logic, it doesn't matter if you store millions of dollars in cash under the bed, since a safe is also vulnerable to break-ins."
Ignoring the facts that security is a process, not an absolute, and technical solutions to social problems are hard. Ultimately all solutions can be twarfted, given enough time and resources. The goal however is to make whatever they want difficult enough to get, that when they do get it, it'll be worth nothing.
I've dealt with Linux security enough to know security is work for any OS, especially when you are not just running servers for developers or apps. When you get into linux desktop users, security takes a lot of work and attention.
Mine is Good
Trojans are about social engineering. The only way to stop trojans is to prevent the people that might fall for them from ever being able to execute unauthorized programs.
"... [The authorities] found dozens of FTP servers in Israel and overseas, including the US. Haephrati is suspected of transferring stolen material from other computers to these FTP servers. The police realized the extent of the affair when they examined some of the files..."
If there was ever a time to be using encrypted volumes to store files, that was one of them.
The guy has fileservers full of self-incriminating evidence, but he can't even get his act together enough to strongly encrypt the thing? That's pretty damn sloppy.
If you did it right, all the cops would have was a bunch of bits, not stuff to put you away for a long time. This tells me the guy wasn't really trying hard enough. He needs to do it again, with feeling.
http://www.thebricktestament.com/the_law/when_to_
The best and strongest firewalls can't protect unsuspecting users from installing trojans by themselves.
Hell, it doesn't even matter what operating system you use. If you run a trojan/keylogger, the data will leak. It doesn't matter if you're in user mode, all the information you can access can leak outside.
Surely an easily exploitable system will generally be more prone to this, without user interaction.
^_^
that this type of attack has most probably been going on for years, without being detected.
More sophisticated worms and trojans will happen. Think of a virus that stealthily hides on computers, moving across the network till it finds itself on a machine in domain xyz.com. Once there it promulgates quietly, doing no damage, until one of its copies finds files of the variety xxxxx.xls. Then slowly searching those files, sending bits of it back to a server on the internet disguised as mail from the user of that machine.
It gets even scarier. Imagine that virus looking for your company's cvs server?
The only thing that I can think of to combat it is to ensure that all applications are checked before being run, and that they have certification by company security infrastructure. This might prevent joe bloggs from working at home and bringing the trojan to work with him.
It can be done if the program is executed by the user without verification of certification etc.
To totally lock down your network will become very difficult in the future. Commercial antivirus vendors will have to work very closely with OS groups to actually create a secure computing environment.... and user's will not like the efforts they have to go through to participate in that secure environment.
The current efforts by software vendors and groups will not even come close to stopping such spyware programs.
Well, that's how I see it anyway... who knows for sure.
Support NYCountryLawyer RIAA vs People
A lot of the supposed loss that results from espionage is mitigated by the fact that the stolen data simply goes from one inept corporate bureaucracy to another. As much as they'd like to, most lame, ossified organizations can't do much to improve their own position regardless of the strategic worth of stolen competitor's data.
It's just 'Spy vs. Spy'; an endless expensive game that changes very little in the real world.
And regarding the use of social engineering to break into secure systems and procure passwords, it too has exagerated importance. The old fashioned tried-and-true methods of blackmail, bribery, kidnapping, and extortion work as well if not better in modern corporate and military environments as they have for hundreds of years. The stricter the corporate punishment for transgressions, the more inflexible the rules, the harder the no-tolerance policy... the cheaper and easier it is to use blackmail and bribery on the target employees. This is why the Americans can't destroy 'the base' (whose Arabic name triggers the NSA internet evesdropping software). They can't be blackmailed, bribed, or persuaded with. Hell, they can't even be found.
You want a secure corporate environment? Trust your people, pay your people reasonably, don't assume that you can judge their moral character by the molecular structure of their urine. In other words, don't act like a stupid paranoid American.
How open are banks to this kind of attack ? Or Credit Companys or anyone of the other 1000's of companys that we give our personal data to.
No? Well then, you are absolutely certain that a person well known to you and who you'd trust with unlimited acess to your computer has done so?
No? Then why exactly *do* you trust this code? Because a couple of dozen random strangers have pronounced it good? Because it's been 'in the market' for a while, and no vulnerabilities have surfaced? (Yet.)
The open or closed state of the code is no gauruntee of security. (Witness the spate of recent security updates to Firefox.)
Zealot.
He didn't claim FOSS security was guaranteed as your entire post assumes. He claimed it was a better alternative than a company with an obvious vested interest.
---
Commercial software bigots - a dying breed.
It is happening elsewhere. With less publicity.
If you are not dumb, you do this kind of job only once or twice. You cover all tracks. And, holy Moses, you don't use your own company to send out e-mails and CDs with the malware.
1.The author of these trojans tried to sell them to police (and was turned down because police found out that he was selling cracker stuff).
2.He sold his trojan package to couple of "security" agencies who went ahead and stole data from several rich companies to re-sell them to the highest bidder.
3. The trojan author also used his "expertise" to steal and publish a book from his ex-father-in law.
Clearly, this guy must have been eager to get in jail. He was lucky - he could have got whacked instead.
I doubt that we will ever figure out - and I suspect that even if we did figure out we couldn't do much about it
OS security doesn't matter much if you're doing your daily routine as admin/root. People who configure Windows machines tend to solve problems of "software not running" by giving the user admin priviledges. Then any stupid email attachment can install anything. You'd have the same problem if a Unix sysadmin decides to save time solving a user's problem by giving the user root privileges. And if Linux becomes more common you'd see much more of this kind of "problem solving" ("fumble with things until they work, then don't touch anything. Don't try to solve tomorrow's problem. You're paid only to solve the current problem". Of course it works and you cease to touch it when it has to many permissions...)
The way this story was revealed was that the stupid guy who planted these trojans published publicly excerpts from his ex-wife's father (or mother's husband?) that existed only on the guy's PC. Probably that PC was a private PC that was configured exactly as shipped (i.e., single admin account). Security of the OS doesn't really matter in this setting. I think the real story here was that so many big companies (telecom, sattlite TV etc.) bought services from a guy so unprofessional as to host their stuff on the same servers that he uses for revenge against his ex-wife's parent, and then to reveal enough info so that the police can get to him! Obviously he's not a pro. Any pro would have known to use separate destinations for different trojans, and not to reveal info that leads to a single source...