Zero Day
The Threat in Cyberspace: To succeed in addressing risks in the digital universe, global leaders must understand one of the most complex, man-made creations on Earth: cyberspace. View the series.
Government and business leaders in the United States and around the world are rushing to build better defenses -- and to prepare for the coming battles in the digital universe. To succeed, they must understand one of the most complex, man-made environments on Earth: cyberspace. (Whitney Shefte, Sohail Al-Jamea and Robert O'Harrow Jr./The Washington Post)
The e-mails arrived like poison darts from cyberspace.
Some went to the Chertoff Group, a national security consulting firm in Washington. Others targeted intelligence contractors, gas pipeline executives and industrial-control security specialists. Each note came with the personal touches of a friend or colleague.
Hackers penetrate secure networks by attacking the weakest links in cyberspace: human beings.
Explore some of the technological advances that led to cyberspace, along with notable hacks.
A look at some of the notable viruses and worms to plague computers around the world.
“Attach[ed] is a quote for the Social Media training we discussed,” said one message sent on July 3 to the vice president of EnergySec, a federally funded group in Oregon that focuses on the cybersecurity of the nation’s power grid.
But like much of the digital universe, the e-mails were not what they seemed. They were cyberweapons, part of a devastating kind of attack known as “social engineering.”
Emerging details about the e-mails show how social engineering — long favored by con artists, identity thieves and spammers — has become one of the leading threats to government and corporate networks in cyberspace.
The technique involves tricking people to subvert a network’s security. It often relies on well-known scams involving e-mail, known as “spear phishing,” or phony Web pages. But such ploys now serve as the pointed tips of far more sophisticated efforts by cyberwarriors to penetrate networks and steal military and trade secrets.
The e-mails this spring and summer appear to be part of a long-running espionage campaign by a hacker group in China, according to interviews with security researchers and documents obtained by The Washington Post. Some of the e-mails, including those sent to the Chertoff Group and EnergySec, were caught by suspicious employees. Others hit home.
“Multiple natural gas pipeline sector organizations have reported either attempted or successful network intrusions related to this campaign,” officials at the Department of Homeland Security said in a confidential alert obtained by The Post.
The May 15 alert, by the department’s specialists in industrial control systems, said “the number of persons targeted appears to be tightly focused. In addition, the email messages have been convincingly crafted to appear as though they were sent from a trusted member internal to the organization.”
Social-engineering attacks revolve around an instant when a computer user decides whether to click on a link, open a document or visit a Web page. But the preparation can take weeks or longer.
Serious hackers investigate their targets online and draw on troves of personal information people share about themselves, their friends and their social networks. Facebook, Twitter and other social media have become prime sources for the hackers, specialists said.
“Everybody has their trigger,” said Bruce M. Snell, director of technical marketing at McAfee Security Systems. “A good social engineer will find that trigger.”
Once malicious software code is delivered, it burrows in and hides in a targeted network. That code, known as malware, can lurk for years in intelligence or attack schemes that are sometimes known as “advanced persistent threats.” Eventually, the code reaches back out to the hackers for instructions, often cloaking the communication through encryption or masking it to seem like innocuous Web browsing by an employee.
The Post MostMost-viewed stories, videos, and galleries in the past two hours
Loading...
Comments