High-Profile Companies Fail to Take Even Basic Security Measures

News Analysis: The recent Nitro attacks didn't use new technology or even a new vector for spreading malware. All that happened is that a hacker took advantage of poor training and security practices in companies and agencies that should know better.

The news from Symantec that a cyber-attacker used an off-the-shelf Trojan called PoisonIvy to extract intellectual property from U.S. chemical and defense industries as reported by eWEEK's Fahmida Rashid is more depressing than anything else.

The ease with which the hacker, named "Covert Grove" by Symantec, used crude social engineering to get employees at his target companies to open infected emails is equally disheartening. One has to wonder if the affected companies have learned anything about security over the last 20 years and if they have, whether they've done anything at all to train their employees.

The PoisonIvy Trojan is a well-known piece of malware that can't infect a computer on its own. It requires someone to run the program and that the program be given administrative rights. To accomplish this, the Trojan is embedded in an email that usually tells the user that it's a security update. In the example provided by Symantec, the email is signed by the "Department of Security."

While PoisonIvy is designed to attack Windows machines, the same social engineering will work just as effectively in attacks on Linux or Macintosh computers if someone were to decide to attack companies using those computers. While I was told on no uncertain terms that Macintosh computers are immune to malware when I wrote that story last week, the fact is they're not. The PoisonIvy Trojan requires the same user actions as Tsunami, and it works in very much the same way.

For any of these Trojans to work, what's required are users who are not paying attention to what they're getting in their email, and then clicking on the right button and filling in the information to provide administrator access, if they don't already have it. This perfect combination of events points to a lack of proper security consciousness in the companies involved and poor or lazy IT practices when implementing computers for employees.

I almost hate to go through this again, because it's clear that for these Trojans to have infected the companies they did, the security staff and the IT department weren't doing their jobs. It's also clear that the employees weren't trained in even the most basic of security measures. So let's go through them again. I'll try to use short words and simple sentences so maybe this time it will penetrate.