Securing Corporate Data in a Law Office's Computer Network

Note: An excellent article, and a serious subject... When is the last time your law firm had a Cyber TSCM sweep? Ever? Contact me, I can help. ~JDL

law.com

The dramatic rise in electronic economic espionage against U.S. corporations came into full view with a report on the trend issued by the U.S. government last November. That same month, the Federal Bureau of Investigation held a meeting in New York City with some of the weaker links in the online spy game: law firms.

It’s an issue that should be getting the attention of in-house counsel, especially as they share sensitive--and potentially valuable--data with outside counsel.

Rich with client information, law firms are often much less equipped to fend off cyberattacks than the corporations they represent. Ergo “a hacker can hit a law firm and it’s a much, much easier quarry,” Mary Galligan, head of the cyber division in the FBI’s New York City office told Bloomberg. Likewise, in a series of blog posts on this issue currently running in Forbes, cybersecurity expert Alan Paller says: “The important files relating to clients’ international activities are usually much easier to find in the law firms’ files than in the corporate files.”

Digital risk consultancy Stroz Friedberg has advised both law firms and corporate clients on this growing problem. Firms need to take a risk-oriented approach to protecting client information, says company co-president Eric Friedberg, a former federal prosecutor and an expert in cybercrime response. At the same time, he says, there are important questions in-house counsel can ask about how their files will be protected (seeCounsel’s Dozen list below).

“Attackers go where the money is,” says Friedberg. These days, law firms should assume that hackers will infiltrate their network, and they should identify which digital assets are most at risk and put the most security around those areas, he says.


More...

Cyber Attacks May Be Revealed to Investors as SEC Rules Push Disclosures

Note: This was bound to happen as more and more companies become victims of Cyber Espionage. Has your company become a victim of Cyber Espionage? And, more importantly, does your company have a Cyber TSCM / Cyber Counterespionage strategy in place to mitigate this risk? 
Contact me, I can help. ~JDL

bloomberg.com

China-based hackers rifled the computers of DuPont Co. (DD) at least twice in 2009 and 2010, hunting the technological secrets that made the company one of the world’s most successful chemical makers.

It’s not something investors would have learned from DuPont’sregulatory filings, or from those of other companies victimized by hackers. The 10-K’s DuPont submitted to the U.S. Securities and Exchange Commission over the period don’t identify hacking as even a significant risk, much less reveal what two U.S. intelligence officials later said was a successful case of industrial espionage.

Over the next three months, as publicly traded companies file 10-K’s, investors may see new admissions of corporate networks being hacked after the SEC said companies can’t continue to hold back the details of those incidents.

As cyberspies from China, Russia and other countries ransack the computer networks of one major U.S. and European firm after the next, the SEC in October offered its new interpretation of disclosure requirements as applied to cybercrime. The amount of information that’s forthcoming will depend on whether company lawyers determine the incidents had, or will have, a material effect on the enterprise.

Daniel Turner, a spokesman for Wilmington, Delaware-based DuPont, said, regarding the previously-reported hack, “We let our disclosures speak for themselves.”

More...

Brute force tools crack Wi-Fi security in hours, millions of wireless routers vulnerable

computerworld.com

If you set WPA/WPA2 security protocol on your home or small business wireless router, and you think your Wi-Fi is secure, there two recently released brute force tools that attackers may use to bypass your encryption and burst your security bubble. The irony is that the vulnerability which can be exploited was intended to be a security strength, a usability issue to help the technically clueless setup encryption on their wireless networks. Wi-Fi Protected Setup (WPS) is enabled by default on most major brands of wireless routers including Belkin, Buffalo, D-Link, Cisco's Linksys and Netgear, leaving millions of wireless routers around the world vulnerable to brute force attacks which can crack the Wi-Fi router's security in two to ten hours.

Most wireless routers come with a WPS personal identification number (PIN) printed on the device. When a user is setting up a wireless home network via a network setup wizard, enabling encryption is often as easy as pushing a button on the router and then entering the eight digit PIN which came with it. When an attacker is attempting to brute force the PIN and an incorrect value was entered, a message is sent that basically tells an attacker if the first half of the PIN was right or not. Additionally, according to Stefan Viehbock, the security researcher who reported the flaw, "The 8th digit of the PIN is always the checksum of digit one to digit seven," meaning it only takes an attacker about 11,000 brute force guesses to own the password. Unfortunately most wireless routers don't have a lockout policy after several failed password attempts.

More...

Anonymous exposes 75,000 credit card numbers

washingtonpost.com

Hacker collective Anonymous has just dumped 200 GB of names, email addresses and passwords for around 860,000 Stratfor users. Anonymous also exposed credit card numbers for 75,000 paying customers of Stratfor.

Stratfor, a security think tank, provides reports on international security and related threats to government and military personnel as well as to the private sector. It is unknown whether Anonymous gained access to other, more sensitive information during the Stratfor hacks, which occurred on December 24.

“The time for talk is over,” wrote Anonymous last night on Pastebin.

“It’s time to dump the full 75,000 names, addresses, CCs and md5 hashed passwords to every customer that has ever paid Stratfor. But that’s not all: we’re also dumping ~860,000 usernames, email addresses, and md5 hashed passwords for everyone who’s ever registered on Stratfor’s site… Did you notice 50,000 of these email addresses are .mil and .gov?”

Anonymous’ motives for the attack are also somewhat hazy. In last night’s statement, representatives of the movement wrote, “All our lives we have been robbed blindly and brutalized by corrupted politicians, establishmentarians and government agencies sex shops, and now it’s time to take it back.”

In addition to the Stratfor attack and exposure, Anonymous is threatening a new action on New Year’s Eve, December 31.

More...

The Spy Who Hacked Me

infosecurity-magazine.com


James Bond was more of a jock than a nerd, and he probably wouldn’t have known how to use a computer, says Danny Bradbury. How things have changed…

It was perhaps the first time that evidence had publicly emerged linking the Chinese with specific cyberwarfare and espionage practices. A Chinese documentary, The Internet Storm Is Coming, recently became available online. Buried in the program around 11 minutes in was B-roll footage of a tool enabling users to attack selected websites via a distributed denial-of-service technique. The clip, later pulled by the Chinese government, gave even more credence to the idea that the state was deliberately involved in cyberwarfare and espionage.

We’ve come a long way from Cold War espionage, when microdots, miniature cameras, and drop zones defined the shady world of spying. Today, misappropriating information from your enemies is more often than not an online affair. But the origins of cyber espionage stretch back to the Cold War.

Markus Hess, a German citizen employed by the KGB, was convicted of hacking his way into US government systems to find information about the Strategic Defense Initiative and other nuclear programs. Hess used the ARPANET, a precursor to the modern internet, but was captured after Clifford Stoll, a systems administrator at the Lawrence Berkeley National Laboratory, was asked to investigate a small accounting error in the usage billing for the laboratory’s computer system. Stoll wrote up the resulting investigation, involving a complex honeypot operation designed to trap Hess and reveal his identity, in a book called The Cuckoo’s Egg.

More...

China ‘Incredibly Aggressive’ in Cyber Theft

cnbc.com
China is stealing online information from the United States and feeding the data to homegrown companies for commercial benefit, Michael Hayden, Former Director of the Central Intelligence Agency said at the Black Hat Technical Security Conference in Abu Dhabi on Wednesday.

He pointed out that as an intelligence officer, he was "impressed" with the sophistication of Chinese cyber espionage, although spying in cyber space is an activity that all states, including the United States, take part in.

According to Hayden, "We steal secrets, you bet. But we steal secrets that are essential for American security and safety. We don't steal secrets for American commerce, for American profit. There are many other countries in the world that do not so self limit."

Despite the difficulty in tracing the origins of cyber attacks, Hayden believes China is the culprit behind various incidents of data theft.

"The body of evidence makes me quite comfortable and confident in saying that there's an incredibly large amount of this cyber activity coming from China," he told CNBC on the sidelines of the conference.

The retired general, who also served as the Director of the National Security Agency, added that, "I have come to the conclusion that the Chinese, the Chinese state and others in China are incredibly aggressive in the cyber domain, when it comes to the theft of property: state on state or against commercial targets."

More...

Government Investigates Cellphone Wiretapping

theatlantic.com
As the government begins an investigation into Carrier IQ's cell phone-tracking software, memories of its own wiretapping scandal resurface


"Spy on unsuspecting Americans? That's our job," you can imagine federal officials indignantly declaring as they investigate cell-phone tracking by the mobile software company, Carrier IQ. The National Security Agency began secret, illegal surveillance of our phone calls and Internet activities in 2001, as we belatedly learned in 2005. Yes, 2005 is a long time ago these days, when yesterday seems like old news; but the NSA scandal deserves to be remembered, especially when the government presumes to be outraged by telecom spying.  

When it began spying on us after 9/11, the Bush Administration enlisted the assistance of telecoms willing to engage in illegal activities at its behest. (Former Qwuest CEO Joseph Nacchio later claimed that after he declined to cooperate with the surveillance program, in 2001, the government retaliated, denying the company lucrative contracts. In 2007, Nacchio was convicted of insider trading.) After the NSA program was exposed, complicit telecoms faced the risks of losing expensive civil suits. AT&T, in particular, was badly exposed, thanks to incriminating documents released by a whistleblower and a lawsuit filed by the Electronic Frontier Foundation. But not surprisingly, Congress intervened. In 2007, it retroactivelyimmunized the companies for illegal activities authorized by the president. As the late, disgraced Richard Nixon explained, prematurely, "when the President does it, it's not illegal." Voting in favor of telecom immunity, then candidate and Senator Obama apparently agreed.


More...

Apple iTunes flaw 'allowed government spying for 3 years'

telegraph.co.uk
An unpatched security flaw in Apple’s iTunes software allowed intelligence agencies and police to hack into users’ computers for more than three years, it’s claimed.

A British company called Gamma International marketed hacking software to governments that exploited the vulnerability via a bogus update to iTunes, Apple's media player, which is installed on more than 250 million machines worldwide.

The hacking software, FinFisher, is used to spy on intelligence targets’ computers. It is known to be used by British agencies and earlier this year records were discovered in abandoned offices of that showed it had been offered to Egypt’s feared secret police.

Apple was informed about the relevant flaw in iTunes in 2008, according to Brian Krebs, a security writer, but did not patch the software until earlier this month, a delay of more than three years.

“A prominent security researcher warned Apple about this dangerous vulnerability in mid-2008, yet the company waited more than 1,200 days to fix the flaw,” he said in a blog post.

"The disclosure raises questions about whether and when Apple knew about the Trojan offering, and its timing in choosing to sew up the security hole in this ubiquitous software title."

More...

Cyber attack on water utility an 'eye-opener' for security professionals

securitydirectornews.com

YARMOUTH, Maine—A cyber attack that apparently originated in Russia and targeted a water utility in Illinois may be the purview of IT security specialists, but it should be of concern to all security professionals with responsibilities over vital infrastructure, say utility security experts who spoke with Security Director News.

The cyber attack, which targeted the Curran-Gardner Township Public Water District, apparently took place on Nov. 8 and was traced to an IP address in Russia. By taking remote control of the Supervisory Control and Data Acquisition (SCADA) systems, the attackers were able to burn out a water pump. However, the event wasn't widely reported until Nov. 17, when Joe Weiss, a well-known expert on cyber security of utilities, wrote about the attack, citing a report from the Illinois Statewide Terrorism and Intelligence Center.

Though the cyber attack's only result was a burned-out pump at a small Illinois water utility, Allan Wick, security manager for the Tri-State Generation and Transmission Association and chairman of the ASIS Utilities Security Council, told Security Director News it's a very significant event. "This is the first documented instance in the United States of a SCADA system of a critical infrastructure being compromised," he said.

People have been talking about the potential for such an attack for years, Wick said, but not everyone in the utilities sector took the threat seriously. The event should be an "eye-opener" for security professionals with responsibility over vital infrastructure, Wick said. "Take the threat seriously," he said. "It's not someone crying wolf."

More...

Facebook Hacked: Porn and Graphic Material Floods Users' Accounts

christianpost.com

Facebook has been under heavy attack the last two or three days as the popular social networking site has become the victim of a severe hacking spree affecting nearly every user on the site.

The hacks do not seem to have specific targets but happen at random with some user’s newsfeeds being littered with objectionable content and others not seeing anything.

Some of the hacks happen in the form of "click' spam being sent out. A popular spam involves Kim Kardashian with a link to a video. It will say something like "After watching this video I lost all respect for Kim." Upon clicking, the link takes the unsuspecting person nowhere, and hacks the account sending the same spam to all of the user’s friends.

Other spams include mass messages and tagged photos leading people to believe they are in the link or involved with it because it is not personalized. Those will also have the same result, and continue the spamming of others walls.

More...

Cyber spy campaign targets chemical industry: Symantec

(AFP)

SAN FRANCISCO — US Internet security firm Symantec on Monday exposed a cyber spying campaign targeting trade secrets at top chemical firms and linked the industrial espionage to a man in China.

At least 48 companies, including some that make advanced materials for military vehicles, were targeted in a campaign Symantec dubbed "Nitro" given the type of information at risk.

"Attacks on the chemical industry are merely their latest attack wave," Symantec security response team members Eric Chien and Gavin O'Gorman said in a report released on Monday.

The attacks targeted NGOs supporting human rights from late April to early May before switching to the motor industry, according to the report.

Major chemical firms, mainly in the United States, Britain, and Bangladesh, came under fire by cyber spies from late July to mid September, Symantec said.

Nitro was aimed at stealing intellectual property for competitive advantage, according to Chien and O'Gorman.

Attackers researched firms, sending selected workers booby-trapped emails that, once opened, secretly infected computers with malicious "Poison Ivy" software designed to steal information.

While various ruses were used to trick workers into opening email attachments to unleash spy software in machines, a typical pretext was to fake a meeting invitation from an established business partner.

Another tactic used by cyber spies was to send employees email purporting to be a security software update that needed to be installed in computers, according to Symantec.

Poison Ivy code was written by a Chinese speaker and Nitro attacks were traced to a server located in the United States but owned by a "20-something male" in the Hebei region of China, the report said.

More...

Facebook hack attacks strike 600,000 times per day, security firm reports

nydailynews.com

Social media company admits to massive lapse in security

Facebook accounts are hacked 600,000 times daily during users’ log-in, the social networking site conceded this week.

The Internet powerhouse said that it records more than 1 billion log-ons each day, and that .06% of those log-ons are compromised.

The shocking lapse in security was first reported by UK-based computer security firm Sophos.

Facebook could not be reached late Friday, although a note that accompanied the startling statistic said, “At Facebook, we take the privacy and safety of the people who use our site very seriously.

“Using a combination of technological innovations...we’re working 24/7 to ensure everyone’s information is safe and secure.”

The scary scope of the security breach was conceded by Facebook on a hard-to-find graphic accompanying a note dilating on its newest efforts to combat Internet piracy.

The post, authored by “Facebook Security” is entitled, “National Cybersecurity Awareness Month Updates,” and can be found on the site.

Read more...

Over 700 Companies Infiltrated by Cyber-Attack

mobiledia.com

At least 760 companies' networks were compromised by the same breach that affected security firm RSA, elevating concern over data security.

Bedford, Mass.-based RSA, the security division of EMC, provides security, risk and compliance solutions to major corporations and disclosed a data breach in March.

Security analyst Brian Krebs' blog identifies hundreds of business and organizations, including 20 percent of Fortune 500 companies, believed to be affected by the RSA security breach.

Krebs' list includes Abbott Labs, Cisco Systems, eBay, the European Space Agency, Facebook, Google, IBM, Intel, the IRS, Motorola, Research in Motion and Wells Fargo.

His list reveals the RSA attack was greater than previously understood, underscoring the challenges of detecting a breach and identifying the parties behind it, especially when the intrusion goes unnoticed until activated.

Shortly after hackers compromised RSA's network, it became clear the security firm wasn't the only corporation victimized in the attack, as dozens of other multinational companies were infiltrated using many of the same tools.

More...

U.S. DHS expects Anonymous to attack infrastructure

net-security.org
Anonymous is eyeing industrial control systems for future attacks, says the U.S. Department of Homeland Security, but its members have yet to demonstrate a capability to inflict damage to these systems.

"The information available on Anonymous suggests they currently have a limited ability to conduct attacks targeting ICS," says in thesecurity bulletin recently compiled by DHS' National Cybersecurity and Communications Integration Center. "However, experienced and skilled members of Anonymous in hacking could be able to develop capabilities to gain access and trespass on control system networks very quickly."

Aware that vulnerabilities in industrial control systems are plentiful, the DHS warns that common penetration testing software already uses control system exploits and packet inspection tools now support industrial protocols, so they can be taken advantage of for mounting attacks.

"In addition, there are control systems that are currently accessible directly from the Internet and easy to locate through internet search engine tools and applications," says the DHS experts. "These systems could be easily located and accessed with minimal skills in order to trespass, carry out nefarious activities, or conduct reconnaissance activities to be used in future operations."

Anonymous has still not targeted industrial control systems, but the DHS expects them to start in the near future as the collective has already made it known that its members should be targeting energy companies that don't seem to make an effort towards a "greener" production.


More...

Social media for corporate networking or corporate espionage?

informationweek.in

Today, corporates are looking at social media like Twitter, LinkedIn and Facebook to broaden their online outreach. In a session at INTEROP Mumbai 2011, Abilash Sonwane, Senior-VP, Elitecore Technologies, talked about how social media networks are the next frontier of corporate espionage



Around 13 percent of corporate losses occur due to corporate espionage, as per a recent KPMG report. The number is less as most of the companies usually don’t admit it. In a session at INTEROP Mumbai 2011, Abilash Sonwane, Senior-VP, Elitecore Technologies, talked about how social media networks are the next frontier of corporate espionage.
Today, corporates are looking at social media like Twitter, LinkedIn and Facebook to broaden their online outreach. As per Nielsen Online study, social networking is now officially more popular then e-mail. Considering the popularity of social media among corporates, Elitecore Technologies did a research on 20 companies to find out how social media can be used for corporate espionage.
To conduct the research, Elitecore selected companies that were active on social media from a mix of industries and geographies. The company found out that though on one hand social media can enable an enterprise to enhance its relationship with customers, on the other hand it can adversely affect a company’s reputation.

More...

In face of massive cybersecurity threat, government security dawdles

networkworld.com

Despite efforts to improve, GAO report says most government agencies are at risk of security attack.

At a time when the cyberthreat level is at its peak, many federal agencies continue to struggle with IT security.

Weaknesses in information security policies and practices at 24 major federal agencies continue to place the confidentiality, integrity and availability of sensitive information and information systems at risk. Consistent with this risk, reports of security incidents from federal agencies are on the rise, increasing more than 650% over the past five years, concluded a report from the watchdogs at the Government Accountability Office this week.

"Each of the 24 agencies -- including the Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security and the IRS -- reviewed had weaknesses in information security controls. An underlying reason for these weaknesses is that agencies have not fully implemented their information security programs. As a result, they have limited assurance that controls are in place and operating as intended to protect their information resources, thereby leaving them vulnerable to attack or compromise," the report stated.

More...

McAfee reveals ‘Shady RAT’ espionage ring

c4isrjournal.com

The massive cyber espionage operation disclosed by the security company McAfee began with its 2009 discovery of a suspicious command-and-control server.

The server contained logs showing the Internet Protocol addresses for the firewalls and email gateways of dozens of companies and organizations around the world.

Intruders possibly working for a “state actor” used this server to steal secrets from at least 72 victims in 14 countries, according to McAfee’s new report, “Revealed: Operation Shady RAT.” Rat is the cyber industry’s term for the remote access tools used by the intruders.

McAfee will not say which country it suspects might be behind the intrusions or provide details about the server, except to say it was located in a Western country and that the IP logs were acquired legally.

After the 2009 discovery, the company began quietly notifying law enforcement agencies and signing nondisclosure agreements with some of the victims. McAfee said it has briefed foreign governments, congressional staff members and White House officials.

Because of countermeasures, the Shady RAT intruders have adjusted their tactics, but their operation is “still going on today,” McAfee’s Dmitri Alperovitch, vice president for threat research, said in a teleconference with reporters in August.

More...

Business travelers should be on alert for cyber-spying

dailyherald.com

Packing for business in China? Bring your passport and business cards, but maybe not that laptop loaded with contacts and corporate memos.

China’s massive market beckons to American businesses — the nation is the United States’ second-largest trading partner — but many are increasingly concerned about working amid electronic surveillance that is sophisticated and pervasive.

Security experts also warn about Russia, Israel and even France, which in the 1990s reportedly bugged first-class airplane cabins to capture business travelers’ conversations. Many other countries, including the United States, spy on one another for national security purposes.

But China’s brazen use of cyber-espionage stands out because the focus is often corporate, part of a broader government strategy to help develop the country’s economy, according to experts who advise American businesses and government agencies.

“I’ve been told that if you use an iPhone or BlackBerry, everything on it — contacts, calendar, emails — can be downloaded in a second. All it takes is someone sitting near you on a subway waiting for you to turn it on, and they’ve got it,” said Kenneth Lieberthal, a former senior White House official for Asia who is at the Brookings Institution.

More...

Pentagon seeks probe of the cost of hacking

washingtontimes.com

The Pentagon is asking the nation’s 16 spy agencies to investigate the cost of theft of commercial secrets by foreign computer hackers, a loss some analysts say could be costing the U.S. economy hundreds of billions of dollars a year.

“We expect it is very substantial — substantial in monetary terms, substantial in security terms,” said James N. Miller, principal deputy undersecretary of defense for policy. “The nation has a substantial interest in protecting intellectual property.”

The Pentagon’s request for an estimate went to the National Intelligence Council, which produces National Intelligence Estimates (NIEs), said Deputy Secretary of Defense William J. Lynn, adding that its report will likely be classified when the assessment is complete.

Security specialists say that hackers, many thought to be operating on behalf of communist China, are stealing vast quantities of proprietary data from U.S. defense, energy and other firms every year, compromising the nation’s security and economic advantage.

“It is a massive transfer of wealth,” said Phyllis Schneck, chief technology officer for public-sector business at computer security firm McAfee Inc.“Things that would have created money and jobs for one company in one country are instead creating them for other companies in another country.”

More...

The Best Spies Money Can Buy

darkreading.com

Security firms have found evidence that espionage agents are buying time on leased botnets: Will cybercriminals services lead to more efficient spying?

During the past decade, cybercriminals have specialized in the various tasks needed to compromise computers, steal data, and make money. Now, more elusive nation-state attackers could be using rented botnets and cybercriminal services to streamline their own operations, security experts say.

In June, security firm FireEye detected evidence of such a connection when it found instances of a remote-access Trojan whose code seemed to have been reused to infect machines with fake antivirus software. In another incident, cybercriminals sold access to compromised military and government computers, allowing would-be cyberspies to get direct access to their targets, says Darien Kindlund, senior staff scientist at FireEye.

The two examples are part of a building body of evidence that suggests attackers representing what the military and security industry refer to as the advanced persistent threat (APT) are not shying away from using criminals' resources to help them in their missions.

"If military and government hosts are being sold on the black market, who are the most likely buyers -- spammers?' No, they could buy something cheaper on a different network. But for APT?'Yes, it meets their mission objectives," Kindlund says.

More...