The malware in question was harvesting passwords and financial information, and relaying that information to a server in Russia.
The malware in question was harvesting passwords and financial information, and relaying that information to a server in Russia.
Unfortunately, some energy companies appear to view insurance as a replacement for (rather than a supplement to) robust information security. Insurance companies who offer cyber security policies are increasingly turning down these potentially lucrative contracts due to the risk of a loss.
The "Olympic Games" hack involving Stuxnet showed the danger hackers pose to critical infrastructure. Even though Stuxnet was originally targeted at Iran's secretive nuclear program, the virus escaped into the wild and has been found in unrelated and surprising places.
Hopefully the refusal of cyber insurance will be a wake up call to energy and other infrastructure companies. Updates need to be applied, security needs to be designed in, and critical components may need to be separated from the network by an air gap.
Much of the information that is being reported has been sourced to a document that has been published on the Internet. At this point, Mt Gox has not validated the document, but many reports believe it to be genuine.
Reports have centered around a known weakness in the Bitcoin infrastructure, known as "malleability." In attacks based on malleability, hackers slightly vary the information in packets about legitimate transactions and flood the exchange with fraudulent information. The exchanges then need to validate every transaction to see which transactions are valid. Most exchanges have built in safeguards to deal with attacks based on malleability.
Serious allegations are being raised that fraud within Mt Gox may itself have been responsible for at least some of the loss. In 2012, Mt Gox reported about USD $380k in revenue. But in 2013, the company had to pay out a USD $5 million fine. Financial reporters are not clear on how Mt Gox was able to keep its doors open after this fine, but there are several reports of slow payments after the fine was paid. Financial reporters have noted that some consider this to be an early warning of a company doing business on a fraudulent basis.
At the very least, it appears clear that Mt Gox continued to do business even after discovering that it was vulnerable to a hacking attack.
Fortunately, the virus can be blocked by following good WiFi security practices. Unfortunately, many WiFi networks are not set up in a secure way.
Fortunately, the steps to secure a home WiFi network are not particularly difficult:
Beyond securing your own routers, you need to keep in mind that public routers may also have been infected. There are some steps you can take to protect yourself when connecting to public WiFi routers. Be aware that public networks are by definition insecure, whether WiFi or wired. There is little or nothing to stop a miscreant from trying to snoop your connection.
While researching the whitepaper, Websense used their methodology to identify a new targeted attack against a mobile network provider and a government agency, and a new Zeus-based POS (Point of Sale terminal) attack.
Of course this is extortion. But Symantec estimates that 3% of victims pay up, which is enough to net the extortionists millions of dollars per month.
Recently, a law firm's entire store of legal files was encrypted and unable to be decrypted. Consider the potential implications of being legally responsible for these documents and being responsible for their destruction through negligence.
Removing the infection from the computer is relatively straightforward. There are free tools, such as this tool from Sophos. Alternatively, you can roll your system back using Windows System Restore, if you had enabled that feature before you were infected. Other, more intrusive methods may be needed, if these do not work. These tools can remove the infection, but decrypting the encrypted user files is not likely to be possible.
If your files have been encrypted, you are going to need to recover from backup. Once your PC has been disinfected, you can attempt to recover files from Shadow Volume Copies (which is part of Windows' System Restore). But you are most likely to be successful if you have been backing up to a system that did not allow the infected PC to overwrite your backups.
Fazio Mechanical, Target's HVAC vendor, had access to Target's network in order to monitor the temperatures in the stores and the health of the HVAC equipment. It is less clear why access was allowed with weak authentication, and why there was no network segmentation between the HVAC units and the POS terminals.
The only really sophisticated part of the attack was the memory-scraping software actually used in the POS terminals. The rest appears to have been a combination of standard attack methods.
One of the key user accounts used to consolidate and move data around Target's network was the "best1_user" account, which is an account name usually associated with the Performance Assurance for Microsoft Servers agent of BMC Software's Patrol product.
It appears that a SQL injection attack was a key part of compromising servers to place the malware and recover the stolen data.
Target has stated that it intends to invest heavily in chip card technology. This would help with "card present" attacks (ie attacks based on cloning a physical card), but would not do much for "card absent" attacks (where a purchase is made from a remote location).