High-Profile Companies Fail to Take Even Basic Security Measures

 
 
By Wayne Rash  |  Posted 2011-11-01 Email Print this article Print
 
 
 
 
 
 
 

News Analysis: The recent Nitro attacks didn't use new technology or even a new vector for spreading malware. All that happened is that a hacker took advantage of poor training and security practices in companies and agencies that should know better.

The news from Symantec that a cyber-attacker used an off-the-shelf Trojan called PoisonIvy to extract intellectual property from U.S. chemical and defense industries as reported by eWEEK's Fahmida Rashid is more depressing than anything else.

The ease with which the hacker, named "Covert Grove" by Symantec, used crude social engineering to get employees at his target companies to open infected emails is equally disheartening. One has to wonder if the affected companies have learned anything about security over the last 20 years and if they have, whether they've done anything at all to train their employees.

The PoisonIvy Trojan is a well-known piece of malware that can't infect a computer on its own. It requires someone to run the program and that the program be given administrative rights. To accomplish this, the Trojan is embedded in an email that usually tells the user that it's a security update. In the example provided by Symantec, the email is signed by the "Department of Security."

While PoisonIvy is designed to attack Windows machines, the same social engineering will work just as effectively in attacks on Linux or Macintosh computers if someone were to decide to attack companies using those computers. While I was told on no uncertain terms that Macintosh computers are immune to malware when I wrote that story last week, the fact is they're not. The PoisonIvy Trojan requires the same user actions as Tsunami, and it works in very much the same way.

For any of these Trojans to work, what's required are users who are not paying attention to what they're getting in their email, and then clicking on the right button and filling in the information to provide administrator access, if they don't already have it. This perfect combination of events points to a lack of proper security consciousness in the companies involved and poor or lazy IT practices when implementing computers for employees.

I almost hate to go through this again, because it's clear that for these Trojans to have infected the companies they did, the security staff and the IT department weren't doing their jobs. It's also clear that the employees weren't trained in even the most basic of security measures. So let's go through them again. I'll try to use short words and simple sentences so maybe this time it will penetrate.



 
 
 
 
Wayne Rash Wayne Rash is a Senior Analyst for eWEEK Labs and runs the magazine's Washington Bureau. Prior to joining eWEEK as a Senior Writer on wireless technology, he was a Senior Contributing Editor and previously a Senior Analyst in the InfoWorld Test Center. He was also a reviewer for Federal Computer Week and Information Security Magazine. Previously, he ran the reviews and events departments at CMP's InternetWeek.

He is a retired naval officer, a former principal at American Management Systems and a long-time columnist for Byte Magazine. He is a regular contributor to Plane & Pilot Magazine and The Washington Post.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Thanks for your registration, follow us on our social networks to keep up-to-date
Rocket Fuel