Slashdot Mirror
Spear Phishing Campaign Hits Dozens of Chemical, Defense Firms
Orome1 writes "Nearly 50 (and quite possibly more) companies in the chemical, defense, and other sectors have been hit with a spear phishing campaign carrying a backdoor Trojan with the ultimate goal of exfiltrating R&D and manufacturing information, revealed Symantec in a newly released report. The attacks against these companies started in late July 2011 and lasted until the middle of September 2011, but the attackers are thought to be the same ones who targeted human rights related NGOs and companies in the motor industry in May." Here's a link to the report itself (PDF).
It's time to recognise that the West is in another Cold War with China. The steps taken to keep industrial information out of Soviet hands crimped trade and imposed costly burdens on US business, but they were at least somewhat effective. Let's try to do better, but for fuck's sake let's do something! How about starting by dropping all packets from China at the border? If nothing else it ought to get their attention.
The only way to protect a network is user education. The bad guys will visit in person, call on the phone, email and find a way onto the network. Not even closed networks can be secured. Only a well educated computer user base will work.
It seems to me that a well edited summary of the story might give us an idea of what Spear Phishing is.. at least, why is it different than normal phishing?
Is it because it has a trojan? What? huh?
help us out a bit here
So all it takes is to send emails to the employees telling them to execute an *.exe file? No wonder the Chinese are able to do it, this thing requires almost no skill, only enough numbers of people churning out emails. I wonder when the Chinese will stop bothering with the malware part, and just ask the employees to upload all the sensitive data.
The attacks were traced back to a computer system that was a virtual private server (VPS) located in the United States. However, the system was owned by a 20-something male located in the Hebei region in China.
I don't usually overgeneralize, but "20-something male" pretty much describes 99% of the blackhats out there.
Attacks like this make me wonder why should users even be able to execute *.exe files. I've started to see the point of non-executable partitions in Linux.
All email is Text you AC moron.
Technically correct, but misses the point and intent entirely. In other words, a typical Slashdot post. Well done!
#DeleteChrome
Because users occasionally need to actually, you know, use the computer to do their job?
"Attacks like this make me wonder why should users even be able to execute *.exe files [in user writable space like \users\ or \temp\]. I've started to see the point of non-executable partitions in Linux." /home/ noexec on a linux machine and allow users to only run programs installed by the sysadmin. Still not perfect, but it would prevent a huge portion of malware out there now.
Fixed for GP. It's pretty easy to set
So all it takes is to send emails to the employees telling them to execute an *.exe file? No wonder the Chinese are able to do it, this thing requires almost no skill, only enough numbers of people churning out emails. I wonder when the Chinese will stop bothering with the malware part, and just ask the employees to upload all the sensitive data.
Actually, you're comment is not that far off the mark. I once was helping a company bring a new product to market, and as part of that would call the potential competitors and ask a whole lot of questions about their products, plans etc. I told them upfront exactly what we were doing - and they still gladly answered my questions. Once I reached the engineers designing the products they would talk my ears off about their product; it also helped that as an engineer I also could talk intelligently with them on a technical basis.
But yes, I would not be surprised if an "Please send me everything about..." got a positive reply.
I'm a consultant - I convert gibberish into cash-flow.
I meant they shouldn't be able to execute files that are not put there by the admin. That's what non-executable partitions are in Linux. Your root partition is executable, but your home partition is not. Your browser, word processor, etc. are in the executable partition so you can execute them. But if someone sent you an executable file you have to put it in your own home partition, and you can't execute it from there. And you can't move it to the root partition, because you don't have write permissions.
That choice means they don't care about security. Ridicule is perfectly appropriate in this case.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Is it just me, or did Symantec take a normal spear phishing attack, by the usual suspects, with the usual tools, and turn it into an advertisement? They gave it a name, wrote a paper on it, made sure it was clear CHEMICALS were involved, and then sent it to the news outlets. I guess this is only to be expected given how much publicity they got from their stuxnet and duqu analysis. Oh well. *sigh*
I do security
Stagdot?
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."