Slashdot Mirror
Trojan Built for Industrial Espionage
xPertCodert writes "Some of the largest Israeli companies are involved in the major industral espionage case, in which private investigators implanted specially crafted Trojan horses on the computers at unsuspecting companies in a bid to obtain priviledged financial and technical data. Given the current state of Windows security and advances in spyware, probably any company has become a very easy target for such spy attack from competitors"
maybe such incidents will start companies (and Microsoft in particular) to start taking spyware more seriously
spies are more likely to do industrial espionage compared to spying on gov'ts. it is apparently a lot easier to get info from companies about gov't plans (through contracts, ect) than trying to spy on the NSA or CIA
but then again, this is what i have read, so take it for what it is worth
Did any of their officers graduate from Stanford or Harvard Business School?
http://www.nsa.gov/selinux/ Security-Enhanced Linux!
By its verry nature, a trogen is a program that APPREARS to be good but has an evil payload. once again, the problem is gullible users and/or techs and/or admins. not windows per-se.
I thought that Trojans were programs that pretended to be something legit but weren't. Other than finding them and putting them in a list of programs to delete in a virus scanner, is there a way to be "secure" with these?
If the company you are tailoring these trojans to runs Linux, aren't you, as the evil terrorist hacker, going to tailor the trojan to run on Linux?
Send 90% of the CEOs out there an email that says 'click here for a free iPod!' and we all know what they're going to do, whether they run Windows, Linux, or OS X.
Pulp Audio Weekly - Geek News and Reviews
Smart people shouldn't have that kind of data on a computer that could be attacked by spyware. Keep it on a network segregated from the internet and you keep it to an insider-only problem.
If the entire scandal was percipitated by Bezek (the reigning ILEC/MaBell of Israel). Bezek was complacent about the coming of the cell phone in the early '90s and was so late to the game that it's practically a non-player.
To the contrary, Pele-Phone trademark name actually became Israeli "xerox" - every cell phone is called a "pelephone" in the vernacular. So if Bezek wanted to hurt the ungrateful competitors' market share, the trojan scandal would do nicely.
Any fool can criticize... And many do.
Not to mention their new anti-virus business (a subscription service which couples MS anti-virus with their anti-spyware). Am I the only one that sees the conflict of interests here?
Beware of he who would deny you access to information, for in his heart he dreams himself your master.
I've dealt with Linux security enough to know security is work for any OS, especially when you are not just running servers for developers or apps. When you get into linux desktop users, security takes a lot of work and attention.
Mine is Good
"... [The authorities] found dozens of FTP servers in Israel and overseas, including the US. Haephrati is suspected of transferring stolen material from other computers to these FTP servers. The police realized the extent of the affair when they examined some of the files..."
If there was ever a time to be using encrypted volumes to store files, that was one of them.
The guy has fileservers full of self-incriminating evidence, but he can't even get his act together enough to strongly encrypt the thing? That's pretty damn sloppy.
If you did it right, all the cops would have was a bunch of bits, not stuff to put you away for a long time. This tells me the guy wasn't really trying hard enough. He needs to do it again, with feeling.
http://www.thebricktestament.com/the_law/when_to_
Yep. But there are ways to reduce the potential there.
#1. The email client should NOT under ANY circumstances automatically run scripts or executables. This was a MAJOR problem with previous versions of Outlook.
#2. The regular user should NOT under ANY circumstances be able to run a program from his user directory/temp directory.
Now, since Linux does not have any equivalent to Outlook in example #1, that means that Linux machines are far more difficult to infect. But not impossible.
Once you've implemented example #2, then the ONLY way for a trojan to get onto a system is if the user has the root password AND goes through the regular install process.
Now, each step that the user must perform is another chance for the trojan to fail.
If, on Linux, the end user has to go through half a dozen steps or so, then Linux is going be resistant to all but the most dedicated of idiots.
And remember, the infection rate has to be higher than the removal rate otherwise the trojan dies, like any virus or worm would.
Linux can be less than 100% perfectly secure, yet still have no live trojans, viruses or worms in the wild.
I know this sounds almost like cussing, but could one obfuscate so efficiently a source code, to hide a trojan inside it?
That would be diabolic because it would give the false feeling of security (after all, it's "open" source, right?) and therefore be even more devastating to unsuspecting users.
Sigged!
In Israel, workstations in all large corporate networks are very well protected.
;-)
It's much cheaper to find a dirty sysadmin that will push a small MSI to all AD clients then actually writing a full blown Trojan that should first of all plant itself on the target computer, taking the risk of being discovered by some techy user.
So keep MS bashing for another article
Did it involve an exploit?
Yep, although not a buffer overflow it is an exploit on the system design that allows executing and installation of programs without the users specific consent. Not much unlike the days when you could email an Active-X control to people and it would automatically execute just by viewing the message.
Users are led to believe these files are safe to open. When in fact they should be viewed as are they safe to execute.
So the bad guys exploited the misperception that (Microsoft) document files are data files safe to "open".
The best and strongest firewalls can't protect unsuspecting users from installing trojans by themselves.
Hell, it doesn't even matter what operating system you use. If you run a trojan/keylogger, the data will leak. It doesn't matter if you're in user mode, all the information you can access can leak outside.
Surely an easily exploitable system will generally be more prone to this, without user interaction.
^_^
oh please, why is it always a conspiracy theory just because you don't know about it personally? I'll even give you some Newsmax sources,
"The Chinese air force is equipped with the Harpy medium-range anti-radar missile acquired from Israel, and its new Chengdu J-10 strike fighter uses technology obtained from the canceled Israeli Lavi program. link
Here we go from the Asian Times, " Israel has also been a long-standing supplier of advanced military technologies to China. According to the findings of a past US congressional committee chaired by Representative Christopher Cox (Republican-California), Israel has "offered significant technology cooperation to the People's Republic of China, especially in aircraft and missile development", including helping China build its current F-10 fighter jet." LINK
Here's a nice article from the Jerusalem Post about the u.s. suspending cooperative development on the arrow-2 missile defence system with Israel. quote, "A source quoted by MENL explained the rationale for the encroaching US boycott: "It's all about China." As the report explained, "The Pentagon, with full support of the administration, does not want to deal with Israeli products or technology that could be sent to China."
There's plenty more information available from all your favourite right-wing sources about the chinese-israeli love affair that's been going on for 20 years. You just have to look because FoxNews & CNN are not interested in telling you about it.
that this type of attack has most probably been going on for years, without being detected.
More sophisticated worms and trojans will happen. Think of a virus that stealthily hides on computers, moving across the network till it finds itself on a machine in domain xyz.com. Once there it promulgates quietly, doing no damage, until one of its copies finds files of the variety xxxxx.xls. Then slowly searching those files, sending bits of it back to a server on the internet disguised as mail from the user of that machine.
It gets even scarier. Imagine that virus looking for your company's cvs server?
The only thing that I can think of to combat it is to ensure that all applications are checked before being run, and that they have certification by company security infrastructure. This might prevent joe bloggs from working at home and bringing the trojan to work with him.
It can be done if the program is executed by the user without verification of certification etc.
To totally lock down your network will become very difficult in the future. Commercial antivirus vendors will have to work very closely with OS groups to actually create a secure computing environment.... and user's will not like the efforts they have to go through to participate in that secure environment.
The current efforts by software vendors and groups will not even come close to stopping such spyware programs.
Well, that's how I see it anyway... who knows for sure.
Support NYCountryLawyer RIAA vs People
I live in Israel, and this topic was just on the evening news. They interviewed a secretary in one of the corporations whose computer was compromised and confidential documents were stolen from it. It was a Windows machine.
But that doesn't mean all of the infected computers had Microsoft products on them.
The media coverage is pretty thin on technical details, but it is known (and I believe is stated in TFA) that the trojan was written specifically for each corporation, by order of the competing company at a cost of about 2000 GBP. So it is possible that some trojans were written for OS systems.
A lot of the supposed loss that results from espionage is mitigated by the fact that the stolen data simply goes from one inept corporate bureaucracy to another. As much as they'd like to, most lame, ossified organizations can't do much to improve their own position regardless of the strategic worth of stolen competitor's data.
It's just 'Spy vs. Spy'; an endless expensive game that changes very little in the real world.
And regarding the use of social engineering to break into secure systems and procure passwords, it too has exagerated importance. The old fashioned tried-and-true methods of blackmail, bribery, kidnapping, and extortion work as well if not better in modern corporate and military environments as they have for hundreds of years. The stricter the corporate punishment for transgressions, the more inflexible the rules, the harder the no-tolerance policy... the cheaper and easier it is to use blackmail and bribery on the target employees. This is why the Americans can't destroy 'the base' (whose Arabic name triggers the NSA internet evesdropping software). They can't be blackmailed, bribed, or persuaded with. Hell, they can't even be found.
You want a secure corporate environment? Trust your people, pay your people reasonably, don't assume that you can judge their moral character by the molecular structure of their urine. In other words, don't act like a stupid paranoid American.
Zealot.
He didn't claim FOSS security was guaranteed as your entire post assumes. He claimed it was a better alternative than a company with an obvious vested interest.
---
Commercial software bigots - a dying breed.
It is happening elsewhere. With less publicity.
If you are not dumb, you do this kind of job only once or twice. You cover all tracks. And, holy Moses, you don't use your own company to send out e-mails and CDs with the malware.
1.The author of these trojans tried to sell them to police (and was turned down because police found out that he was selling cracker stuff).
2.He sold his trojan package to couple of "security" agencies who went ahead and stole data from several rich companies to re-sell them to the highest bidder.
3. The trojan author also used his "expertise" to steal and publish a book from his ex-father-in law.
Clearly, this guy must have been eager to get in jail. He was lucky - he could have got whacked instead.
I doubt that we will ever figure out - and I suspect that even if we did figure out we couldn't do much about it
It's folks like you who are the biggest danger to OSS - because you are unable or unwilling to discuss it's pro's and con's honestly, preferring name calling to facts. The zealot and the bigot in this conversation isn't me.
OS security doesn't matter much if you're doing your daily routine as admin/root. People who configure Windows machines tend to solve problems of "software not running" by giving the user admin priviledges. Then any stupid email attachment can install anything. You'd have the same problem if a Unix sysadmin decides to save time solving a user's problem by giving the user root privileges. And if Linux becomes more common you'd see much more of this kind of "problem solving" ("fumble with things until they work, then don't touch anything. Don't try to solve tomorrow's problem. You're paid only to solve the current problem". Of course it works and you cease to touch it when it has to many permissions...)
The way this story was revealed was that the stupid guy who planted these trojans published publicly excerpts from his ex-wife's father (or mother's husband?) that existed only on the guy's PC. Probably that PC was a private PC that was configured exactly as shipped (i.e., single admin account). Security of the OS doesn't really matter in this setting. I think the real story here was that so many big companies (telecom, sattlite TV etc.) bought services from a guy so unprofessional as to host their stuff on the same servers that he uses for revenge against his ex-wife's parent, and then to reveal enough info so that the police can get to him! Obviously he's not a pro. Any pro would have known to use separate destinations for different trojans, and not to reveal info that leads to a single source...