Slashdot Mirror
Espionage Campaign Targets Corporate Executives Traveling Abroad
An anonymous reader writes Kaspersky Lab researched the Darkhotel espionage campaign, which has lurked in the shadows for at least four years while stealing sensitive data from selected corporate executives traveling abroad. Darkhotel hits its targets while they are staying in luxury hotels. The crew never goes after the same target twice; they operate with surgical precision, obtaining all the valuable data they can from the first contact, deleting traces of their work and fading into the background to await the next high profile target. The most recent traveling targets include top executives from the USA and Asia doing business and investing in the APAC region: CEOs, senior vice presidents, sales and marketing directors and top R&D staff. This threat actor is still active.
Any corporate executive traveling will have encrypted communications from their company as a matter of course.
This post is nothing but a weak attempt at Kaspersky marketing.
blindly antisocialist = antisocial
One always hears about attempts to steal intellectual property, but (assuming this isn’t hype by Kaspersky) could these types of attacks be about insider trading? Could nation-states being playing the markets with this info?
Letter To Iran
I hope that Kaspersky manages to cheat these executives out of tons of money based on this nebulous threat.
... at least, outside of the US, it seems. Many countries have a policy that basically boils down to "if you can grab it, then it's yours, and it's impolite for another company to point fingers and claim you stole it." Not as litigious perhaps, but certainly less trustworthy. I got the standard 4 hour class from at least two companies; don't talk to folks on planes about it, don't talk to folks at the hotels, they'll arrange friendly people to sit next to you, or have a room next to you, or to flirt or whatever. Act as if your laptop/other hardware WILL be stolen or sabotaged. Keep one for travel with only the minimum relevant information on it, and so on.
I worked for a company once that did big data analysis for the semiconductor industry. Boosted yield rates by anywhere from 3 to 15%, which is a big deal. It was a service, not a software product, so we took their data, did our analysis, and the product was suggestions to correct their process, with proof. Obviously we had a lot of special software on the backend which represented our core IP, and we protected that.
When we went to China, we rewrote the executable so it was encrypted, plus locked to the CPU id.
Part of our process required about 18-20 hours to run on the puny laptops we had available, and the folks we met actually laughed when they told us we couldn't stay the night, nor take the systems back to the hotel with us because they had been exposed to their internal network. So we chained it to a desk, and the next morning, the system had died, and it looked like someone had removed the hard drive while the thing was running. Apparently after a day in a half of processing later, they realized they couldn't get their copy to run, and explained that they had to keep our machine, forever, but they would provide us with one that was equivalent - loaded with virii and spyware no doubt.
One of the individuals actually begged us to stop when we took apart our laptop and ground the hard drive and cpu up and shattered the boards. Total lack of composure, I assume he was losing his job at that point.
However, that was just par for the course for much of Asia, barring Japan.
Everyone knows there is No Such Agency.
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
Didn't Apple and Google both assure us that our data was safe in their clouds? That even they couldn't read it? What could possibly go wrong?
Oh, I'm sorry sir, I thought you were referring to me, Mr. Wensleydale.
Agreed. I always wiped my machine and installed the few things I really needed before going to Asia. Since I had to do some software development, I'd have an encrypted VM with a compiler. Only while there I'd download the git repository over an encrypted connection, use it, push the changes, then wipe the image before going back. If someone decided to take the machine, there was nothing useful on it. The VM was encrypted so that if a "maid" took it, or, more likely, someone on public transportation, the image would be useless to the thief.
A successful API design takes a mixture of software design and pedagogy.
Most top level executives don't know DES from GPG or IDEA.
What they do understand is when you send them an email with links to to three Wall Street Journal articles, Target, TJ Maxx, and Home Depot, then say "to prevent this from happening to our company, we need to have the following policies in place:".
I'm a client systems person (yes, yes, I know, the desktop is dead and everyone is going to be writing Excel macros on their iPhones...I'm aware of it.) But, having worked for a couple of companies' IT departments doing this, and for a service provider doing this for other customers, I am absolutely not shocked that corporate execs are being targeted for this. Almost everywhere I've worked, executives have overriden the rules and required that they have full admin access to their laptops. Combining this with BYOD and users travelling onto untrusted networks is a nightmare. All it takes is one time not carefully thinking about a prompt to update something from a non-legitimate source. Once that's done, all the full-disk encryption and other good stuff goes out the window.
The higher the rank, the less they know or care about information security. It's a losing battle too, because (a) they don't want some lowly IT guy telling them what's best for them, and (b) the heavy-handed approach doesn't work because they don't believe there's a threat.
Hotel networks are especially interesting because the system is most likely some turnkey thing like a Cisco or Juniper appliance that gets wired up, thrown in a closet and forgotten about. That's the perfect target for compromise because it never gets updated, bugs never get fixed, and all you have to do to get physical access to the device is get a job as a cleaner or maintenance person.
The same guys who are having their data stolen are the ones buying data that was stolen from some other guy. It's a sociopath feeding frenzy, and the criminals are cashing in.
The only thing worse than a Democrat is a Republican.
Since it is your job to protect them from these risks, not to produce stupid policies that get in the way of their "work". I managed to get a few nice laptops from my wife's former bosses. They were so loaded with malware that the barely functioned. Rather than admit that they were responsible, the point hairs simply bought new laptops and discarded the old ones.
Suddenly this is the new thing. You could simply say "the thief" or "the bad guy" or "the spy", but then you wouldn't sound all Matrix.
Lighten up, Slashdot.
That term is commonly used in the security industry, specifically because it is more generic than "virus writer", "thief", "foreign intelligence service", or "disgruntled worker".
I always wiped my machine and installed the few things I really needed before going to Asia.
You should do that for coming back. You never know when customs will steal your machine. Always travel with throwaway items, and always give false information where possible and practical. This is what today's institutions reward while the honest weep in their jail cells.
“He’s not deformed, he’s just drunk!”
What about giving the execs a Linux notebook with a password protected Bios, a Linux distro with full hard drive encryption + home directory encryption a VPN connection and a VM? Too much for an exec to handle? What about Chromebooks? As far as I know, they'll alert you if they've been tampered (as people that have installed Crouton can attest to), it stores nothing locally and can be wiped out from the other side of the planet? I know that execs can be...fickle. But there are alternatives.
I use BitLocker with TPM+PIN+USB flash drive, when I fly to other countries.
This way protects me on three fronts:
1: If I have physical control of my USB flash drive, I know the data is not getting accessed, even if the laptop is stolen.
2: If I get everything stolen, too many wrong PIN guesses, and the TPM will refuse to deceypt.
3: A "maid" decides to update the MBR or GPT, the machine isn't going to boot.
From there, I mainly use a Citrix instance to access what data I need, as the encryption is to ensure tamper resistance as opposed to data protection. That way, if the laptop is seized on bogus pretexts, the data is not going to be there. I also use DeepFreeze, to ensure anything put on the machine before it leaves the US doesn't get tampered with.
Of course, XKCD panel 538 applies, but anything less than overt rubber hose coercion, the data remains secured.
It's funny how none of you shills ever post from a real account.
If the exec has too many passwords at work to remember easily, of course they will write them down.
Solutions to that include SSO, IDM, etc.
I wonder how hard it would be to dump something on there that "looks" like the real deal, but deliberately delivers poor performance, bad output, or even a cleverly hidden security hole.
Let them steal it, and then see if you can use those to your advantage when they make use of the subtly broken tech.
I guess you didn't read the Snowden allegations
FTFY.
If you think the USA is somehow on a moral high ground here, I really wonder why.
See my title - China has been proven to do it while Snowden hasn't even gone to a US court. The only people that think that the US has lost any moral ground are those that oppose the US, and/or additionally support Snowden's allegations.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
The AC post was not I, but I do agree with it.
Eugene Kaspersky is Putin's sauna buddy and their AV product is engaging in funky behavior. Unfortunately, my company's IT decided to ditch our old AV and go with Kaspersky instead. Not because it is better, less a performance drag, more compatible, or anything - quite contrary. The decision was made because we need some AV to check off a box on a list for management and do so by spending the least amount of money. Leaves us cubicle dwellers wondering who ships GB of data every night to a data center in Canada...it is Kaspersky AV! We asked why and got no response. Since that database server may hold customer data at times we cut the cord for Kaspersky and since then the nights are quiet. Since then I disregard anything Kaspersky or its mouthholes claim even more than before. Might as well install some Chinese AV or any other malware that downloads gobs of data for 'our protection'.