Symantec confirms Reader exploits targeted defense companies
November attacks delivered in malicious PDFs attached to messages promising a contract guide for 2012
Computerworld - Security researchers at Symantec today confirmed that exploits of an unpatched Adobe Reader vulnerability targeted defense contractors, among other businesses.
"We've seen [this targeting] people at telecommunications, manufacturing, computer hardware and chemical companies, as well as those in the defense sector," said Joshua Talbot, senior security manager in Symantec's security response group, in an interview Wednesday.
Symantec mined its global network of honeypots and security detectors -- and located email messages with attached malicious PDF documents -- to come to that conclusion.
The inclusion of defense contractors was not unexpected.
Yesterday, when Adobe warned Reader and Acrobat users that hackers were exploiting a "zero-day" bug on Windows PCs, it credited Lockheed Martin's security response team and the Defense Security Information Exchange (DSIE), a group of major defense contractors that share information about computer attacks, with reporting the vulnerability.
The DSIE is composed of companies that are also part of what the federal government calls the "Defense Industrial Base," or DIB. Among the DIB's members are some of the country's largest defense contractors, including Boeing, General Dynamics, Lockheed Martin, Northrup Grumman, Pratt & Whitney and Raytheon.
Symantec found attack emails dated Nov. 1 and Nov. 5, 2011.
It also published an image of a redacted email of the attack's bait -- the promise of a 2012 guide to policies on new contract awards -- that it said was a sample of the pitches that tried to dupe recipients into opening the attached PDF document.
The message's subject heading read, "FY12 XXXXX Contract Guide," and the body simply stated, "FY12 XXXXX contract guide is now available for all contractors of XXXXX. The new guide contains update information of XXXXX policy on contract award process.
Opening the attached attack PDF also executed the malicious code -- likely malformed 3-D graphics data -- hidden in the PDF, compromising the targeted PC and letting the attacker infect the machine with malware.
That malware, Talbot said, was identical to what was used in early 2010 by hackers exploiting a then-unpatched bug in Microsoft's Internet Explorer 6 (IE6) and IE7.
Symantec labeled the malware "Sykipot" last year.
"It's not overly sophisticated," said Talbot. "It's a general-purpose backdoor. One of the interesting things about it is that it does use a form of encryption of the stolen information, which helps the attack hide what information is stolen."
Sykipot encrypts the pilfered data after it has been retrieved from the victimized firm but while it is still stored on the company's network, as well as when it's transmitted to a hacker-controlled server.
Those command-and-control (C&C) servers are still operating, Talbot said.
Because of the similarities -- using Sykipot, which isn't widely in play, and exploiting zero-day vulnerabilities -- Symantec suspects that the same group of hackers who launched the attacks against IE6 and IE7 last year were also responsible for the Reader-based attacks seen last month.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!