Phishing emerges as major corporate security threat
Break-ins at Oak Ridge, RSA, others show that the 'low-tech' phishing attacks can have bad consequences
Computerworld - The successful use of phishing emails to breach secure organizations like Oak Ridge National Laboratory and RSA are stark reminders of the serious threat posed by what some experts have dismissed as as a low-tech method of attack.
Oak Ridge, a U.S. Department of Energy-run research lab, this week disclosed it had shut down all Internet access and email services after discovering a sophisticated data stealing malware program on its networks.
According to the lab, the breach originated in a phishing email that was sent to about 570 employees. The emails were disguised to appear as notes about benefits changes written by the lab's HR department. When a handful of employees clicked on the embedded link in the email, a malware program was downloaded onto their computers.
The malware exploited an unpatched flaw in Microsoft's Internet Explorer software, and was designed to search for and steal technical information from Oak Ridge, whose engineers are in the midst of an effort to build the world's fastest supercomputer.
A Oak Ridge official described the attack as being very similar to one that hit security vendor RSA last month.
That incident resulted in the theft of information about RSA's SecurID two-factor authentication technology. And a breach at Epsilon earlier this month, said to be the largest ever involving email addresses, is also suspected to have been caused by a targeted phishing campaign.
That hackers are able to penetrate such presumably well-protected organizations using low-tech, fake email methods points to the growing sophistication of targeted phishing campaigns and the continued tendency by enterprises to think that user education alone will mitigate the problem, analysts said.
"It doesn't surprise me at all," said Anup Ghosh founder of security firm Invincea. "Almost every publicized and self-declared Advanced Persistent Threat (APT) attack this year has been through phishing emails."
Such emails, in fact, now appear to be the preferred method for illegally breaking into corporate networks, he said.
"All you need to do is to get an email to a target. You only need a very low click through rate to establish several points of presence inside an organization," Ghosh said. "If you have 1,000 employees in your organization and you train them all on not opening untrusted attachments, you'll still have someone doing it. This is not a problem you can train yourself out of."
Exacerbating the issue is the growing sophistication of phishing campaigns, analysts note.
Increasingly, organized cybergroups have started using convincingly crafted emails to target high level executives and employees within the organizations they want to attack. In many cases, the phishing emails are personalized, localized and designed to appear like they originated from a source trusted.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts