Slashdot Mirror
US Defense Contractors and Universities Targeted In Cyberattacks
Trailrunner7 writes, quoting Threatpost: "Researchers have identified an ongoing series of attacks, possibly emanating from China, that are targeting a number of high-profile organizations, including SCADA security companies, universities and defense contractors. The attacks are using highly customized malicious files to entice targeted users into opening them and starting the compromise. The attack campaign is using a series of hacked servers as command-and-control points and researchers say that the tactics and tools used by the attackers indicates that they may be located in China. The first evidence of the campaign was an attack on Digitalbond, a company that provides security services for ICS systems. ... In addition to the attack on Digitalbond, researchers have found that the campaign also has hit users at Carnegie Mellon University, Purdue University and the University of Rhode Island."
It's probably anonymous disguising themselves as a Chinese attack. hihi
This is absolutely nothing new
"Peaceful rise", my foot.
Why is every "cyber attack" from supposedly from China? Maybe some country we've been "cyber attacking" like Iran is just trying to fight back?
... if we aren't making our chips here, how can we ever expect to be able to secure our milatary secerets? I hate how goverment subsidies to an industry are pretty much impossible to repeal after they are created, but national security should genereally take front stage.
The weakest link in security is trust.
Get rid of any external consultant and hire the proper people to do the job.
PS: CAs suck ass
When we start using cyberweapons against people without constraint and then post a whole bunch of articles about how cost effective it is, other nations see that as a reason enough to use them against us. Most states cant afford enough money to build $35 million dollar fighter jets or spy satilites, but can slip some script kiddies a few bucks to send out some spam with exploits in it.
This is low level Cyber warfare and its starting to ramp up. this is like the introduction of planes in WWI. At first they waived at each other on their scouting mission. then someone brought a pistol, then a rifle. Then it was gunners and machineguns until we get the Red Baron and Fighter Aces. Next thing we know its jet Propulsions and heat Seakers, Stealth fighters launching! Make no mistake, Stuxnet was the First pistol at 1000 feet, what comes next no one can guess.
what is obvious is that Information Assutrance is no longer a support service, somewhere behind tech support and first to be cut, IA is now a front line warfighter task. Lets just hope the bean countes realize in time!
Papa Legba come and open the gate
How dare China try to hack another country's computers, infect them with malware, and otherwise snoop on us!
Only a ROGUE STATE would do such a thing!!!
Oxymoron?
No offense, but posts like these are nonsensical --- or maybe propaganda for the next war by design?????
So maybe the blog poster should contact Boeing (Narus), Packet Forensics, and all the other sleazoid American corporate whores about selling them all that surveillance tech, huh???
And please let us never forget about Jerry Yang and his Yahoo crimes (we've heard of one, but that doesn't mean there's many, many more unheard of....)
http://www.amnestyusa.org/our-work/cases/china-shi-tao
...they need to stock up on copious amounts of gold to stave off the cyberarmy, or else be "deleted".
FTFS: "Researchers have identified an ongoing series of attacks, possibly emanating from China, that are targeting a number of high-profile organizations, including SCADA security companies, universities and defense contractors."
While Willie Sutton never actually said "that's where the money is" when it came to robbing banks, the truth in general about that statement couldn't be more apropos regarding this situation.
Data=Wealth.
--
BMO
That's why we have administrator-level access and ultra-restrictive GPOs in the first place, right? In the hopes that the few people who can actually do damage to computers and servers aren't monkeys banging away in the hopes of producing Shakespeare?
As a final note, I would like to point out that ending my post with a question mark makes it seem more poingant and totally deserving a five. Except I spoiled it. Crap.
First of all, let he who is without sin cast the first stone.
It's only bad if the shit is flying in the wrong direction.
Second of all, we got no end of idiots claiming that Martians are sending pictures back from Mars, because the Opportunity Rover is located on Mars.
If "cyberwar" was actually a real threat they cared about, they would shift to Linux and thin-client desktops forthwith. Hell, they could get more government money for doing so. "It's for security!" That they are not doing so shows that this is not a real threat, but trumped-up nonsense to try to look like there's a problem. Which they need more money to deal with.
http://rocknerd.co.uk
"Researchers have identified an ongoing series of attacks, possibly emanating from China, that are targeting a number of high-profile organizations, including SCADA security companies
Just who in their right minds connects a SCADA unit directly to the Internet. Lets have a contest too see how long someone can write about Internet security without once mentioning Microsoft Windows.
"In Digitlbond's case, the file is called "Leveraging_Ethernet_Card_Vulnerabilities_in_Field_Devices.pdf.exe" and when it's opened, the file installs a Trojan downloader called spoolsvr.exe "
AccountKiller
"5 years ago I worked at a Defense contractor and we had a carefully crafted spear phishing attack .. A fake site was crafted"
A Defense contractor that can be compromised by a click-and-download-this-executable hack shouldn't be in the defense industry.
AccountKiller
And clearly, spelling 'R not U, Mr. Hyporacy.
Remember this when you see "Made in China"
And the sad thing is that due to incompetence and/or greed, the DoD not only permits Windows on its networks, it actually ENCOURAGES it. Many of the security reqs are written such that only Windows can really do all them(basically they throw in some pointless shit that only windows does but doesnt offer any security and call it a major issue). The PLA really should write Redmond a thank you letter for writing such shitty software then lobbying the hell out of the people in power to get it installed everywhere at the DoD. Redmonds incompetence is allowing the PLA to access 10s of billions of dollars worth of defense research for free.
Monstar L
Before I am going to elaborate, yes - technology will be only part of the fix. But technology will be a major part of better security ! Here is my list of security technologies:
Sandboxing:Google Chrome's Sandbox is an excellent example of how to limit damage from faulty code. Much more could be done by using this approach in many other file formats and use cases. Other interesting approaches are AppArmor, SE Linux and Linux Security Modules in general.
Formal Proofs:The problem with sandboxes and operating systems is of course their correctness. If the sandbox has exploitable bugs, it is obviously of little use. It would make a lot of sense for governments to pay for formally verified operating systems,VMs, sandboxes and compilers. And of course for research towards cost reductions in formal verification, as it is currently extremely time-consuming, difficult and expensive.
Memory Safe Programming Languages:The best part of all security issues can be directly blamed to the insecure-by-default approach of C/C++. Buffer overruns, uninitialized pointers accessed, freed pointers accessed, pointers doubly freed and similar issues are responsible for the majority of exploits. Just using memory-safe programming languages such as Spark Ada, Perl, C#, Java or Sappeur (created by myself, see http://sourceforge.net/projects/sappeurcompiler/) would immediately reduce the number of exploitable bugs by at least 60%.
In many application fields you cannot use sandboxes. Think of indexing engines that index the web - by definition a hostile place. It is quite inefficient to start a new indexing process for each and every document crawled.
Virtualization:If you have a properly (ie. no exploitable bugs) implemented virtual machine, this could act like a Sandbox on the operating system level. Unfortunately, as the HB Gary hacks have exposed, current virtual machine technology is not safe enough. Governments could possibly finance verification efforts here, too. (Private companies don't really have a strong incentive to do that from a money-point-of-view)
Research:Clearly, extensive research into security technologies and their application in real-world-scenarios is required. Security technologies must be nicely enmeshed into user's business processes. Overly restrictive or overly time-consuming technologies/approaches will be circumvented by users. A lot of work in how to make security tech actually ergonomic has yet to be done.
...that it is NOT *.exe attachments. These days are long over. Attackers use PDF or MS Office documents attached to emails. So you are Wally Blacksmith of Killcorp Inc. Your job entails developing novel radar systems. One nice, sunny morning you get a nicely worded email about "Innovations in low-observable Radar" and it writes about a conference in Napes, Italy. The sender appears to be james.smith@britishradar.com. So you can't wait to see that the brits are up to an you click on that PDF. Acrobat Reader opens, displays some more bogus Radar stuff (culled from public sources) and then it also starts a process which will nicely index all the files on your harddrive and all mounted SMB shares. Then it does the same thing for all ODBC connections it can open. As an added bonus, it will look into Wally's internet history for local websites and index them also.
The index will be sent via Gmail to an account controlled by the attacker. Based on the index, the juicy files of Mr Blacksmith (and Killcorp) will be identified and uploaded to Gmail. All nicely SSL encrypted, so that the admins of the Killcorp firewall can't look into it. (don't tell me Killcorp does not allow for that).
Attackers could possibly also use exploits in web browsers and send HTML emails, so that Wally doesn't even have to click an attachment.
The DOJ uses IE 6 and SP2 which stopped receiving security updates only 2 years ago!
How could this possibly happen?
http://saveie6.com/
I think somone (from asia ?) recently did exactly this to RSA Security, whose key generators were used by Lockheed-Martin to secure their F22 R&D information. The supposed asians thereby got a shortcut on their own stealth R&D efforts.
..that is why Windows is the only "viable" alternative. Especially when some exec bathroom renovation is concerned.
After the implication that the U.S. created Stuxnet, I got the feeling that it's now "Game On" for cyberwarfare. Am I alone in this? Of course, there have been attacks for decades but it just seems so open? brazen? unapologetic?
just saying
made it to ppl who know one thing about trojans and security. I love how he explains that "Leveraging_Ethernet_Card_Vulnerabilities_in_Field_Devices.pdf.exe" installs spoolsvr.exe ... this email would not even make it to someones mailbox and if the email makes it and that someone is a "programmer" or "security expert" and did not
understand that this is most probably a trojan then .... f*c|$
"Attacks Targeting US Defense Contractors and Universities Tied to China" is a really bad title