'Nitro' hackers use stock malware to steal chemical, defense secrets
Symantec traces one command-and-control server to China
Computerworld - Attackers used an off-the-shelf Trojan horse to sniff out secrets from nearly 50 companies, many of them in the chemical and defense industries, Symantec researchers said today.
The attack campaign -- which Symantec tagged as "Nitro" -- started no later than last July and continued until mid-September, targeting an unknown number of companies and infecting at least 48 firms with the "Poison Ivy" remote-access Trojan (RAT).
Poison Ivy, which was created by a Chinese hacker, is widely available on the Internet, including from a dedicated website.
The malware has been implicated in numerous attacks, including the March campaign that hacked the network of RSA Security and swiped information about that company's SecurID authentication token technology.
In a paper published today (download PDF), Symantec researchers spelled out their analysis of the Nitro attacks and the use of Poison Ivy.
"Nitro wasn't at the level of sophistication of a Stuxnet," said Jeff Wilhelm, a senior researcher with Symantec's security response, in an interview today. "But there are similarities with other advanced threats."
Among those common traits, said Wilhelm, was the attack's narrow focus.
Poison Ivy was planted on Windows PCs whose owners fell for a dodge delivered via email, said Symantec. Those emails, which were delivered in small numbers -- sometimes to only a few people in a company -- touted meeting requests from reputable business partners, or in some cases, as updates to antivirus software or for Adobe Flash Player.
When users fell for the trick and opened the message attachment, they unknowingly installed Poison Ivy on their machines. After that, the attackers were able to issue instructions to the compromised computers, troll for higher-level passwords to gain access to servers hosting confidential information, and eventually offload the stolen content to hacker-controlled systems.
Many of the same techniques, including substantial time spent scouting targets and crafting individual emails, have characterized a number of notable attacks in the last two years, including the 2009-2010 "Aurora" campaign against Google and dozens of other Western firms, and the attacks against RSA this year.
Wilhelm declined to connect the dots between Nitro and the RSA attack, but did admit that there were similarities.
Twenty-nine of the 48 firms that were successfully attacked were in the chemical and advanced materials trade -- some of the latter with connections to military vehicles -- while the other 19 were in a variety of fields, including the defense sector.
A dozen of the targeted organizations were U.S.-based, said Symantec, while five were headquartered in the U.K. and others in Denmark, Italy, the Netherlands and Japan.
Symantec declined to comment on whether the sole Japanese firm was Mitsubishi Heavy, that country's largest defense contractor. Last month, Mitsubishi confirmed that scores of its servers had been infected with malware in August, a time right in the middle of the Nitro two-and-a-half-month run.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts