Security Professionals Identify Malware-ridden File Possibly Sent to an Employee of a Target Firm
Government, defense and business establishments are constantly under the radar of cyber-attackers. In the recent months, attackers have frequently targeted defense contractors such as Lockheed Martin, Northrop Grumman and several national laboratories of the Department of Energy (DOE). Earlier last month, Google disrupted a Gmail account hijacking campaign targeted at senior government and military officials, and media personnel. More recently, Pentagon acknowledged leakage of 24,000 files containing military information.
Recently, security researchers at F-Secure identified a malicious PDF file sent by attackers as an e-mail attachment to the employees of the target company. When users view the PDF file through Adobe Reader, the file exploits javascript vulnerability and downloads an executable file in the computer systems. The executable file is actually a backdoor which connects to two different Internet Protocol (IP) addresses of the attackers. The PDF file contains call for papers for a Missile Systems Conference classified as ‘Secret’ by the U.S government. This is a case of spear phishing attack wherein users have no reason to suspect the authenticity of the e-mail and the contents of the PDF document. The aim of such attacks is to extract privileged information from the employees. Attackers may use extracted information to launch sophisticated attacks on the target company’s networks and computer systems. Usually, the recipients are not aware that a backdoor is inserted in their computer systems. Security researchers of the computer security company have said that they are not aware of the target company. However, as the document is related to the missile systems conference, attackers may be targeting military personnel or defense contractors.
Sophisticated cyber-attacks on critical infrastructural facilities may have disastrous consequences. They may not only bring several economic activities to a halt, but also compromise national security. Last month, in a testimony to a United States (U.S) Senate Committee, Leon Panetta, the chief of the Central Intelligence Agency (CIA) warned that the next Pearl Harbor that the country may confront may well be cyber-attacks on power systems, electrical grids, financial systems and government computer resources. Countries must encourage cyber security education and promote online IT degree programs at all levels to meet the future requirements of cyber warriors.
Governments must place high emphasis on remediating security vulnerabilities in critical infrastructural facilities and industrial control systems. Earlier in the year, a presentation on the security vulnerabilities in industrial control systems by security researchers was withdrawn from the TakeDownCon conference after the intervention of the Department of Homeland Security (DHS) and Siemens as revelation of the vulnerabilities could have had severe repercussions on human lives. The organizers of the conference acceded to the request as it was in the wider interest of the world at large. Hiring professionals qualified in security certifications and IT degree programs may help employees in identifying and mitigating security vulnerabilities.
Organizations must create awareness among employees on spear phishing and social engineering threats through cyber security awareness training programs. Employees may also self-pace their learning through iPad training and online IT courses.
Contact Press
EC-Council
Website: http://www.eccuni.us
Email: iclass@eccouncil.org
Tel: 505-341-3228
EC-Council University is based in Albuquerque, New Mexico and offers Master of Security Science (MSS) degree to students from various backgrounds such as graduates, IT Professionals, and military students amongst several others. The MSS is offered as a 100% online degree program and allows EC-Council University to reach students from not only the United States, but from all around the world.
EC-Council is a member-based organization that certifies individuals in cybersecurity and e-commerce skills. It is the owner and developer of 16 security certifications, including Certified Ethical Hacker (CEH), Computer Hacking Forensics Investigator (CHFI) and EC-Council Certified Security Analyst (ECSA)/License Penetration Tester (LPT). Its certificate programs are offered in over 60 countries around the world.
EC-Council has trained over 80,000 individuals and certified more than 30,000 members, through more than 450 training partners globally. These certifications are recognized worldwide and have received endorsements from various government agencies including the U.S. federal government via the Montgomery GI Bill, Department of Defense via DoD 8570.01-M, National Security Agency (NSA) and the Committee on National Security Systems (CNSS). EC-Council also operates the global series of Hacker Halted security conferences.
Processing your request, Please wait....
