News Analysis: The recent Nitro attacks didn't use new technology or even a new vector for spreading malware. All that happened is that a hacker took advantage of poor training and security practices in companies and agencies that should know better.
news from Symantec that a
cyber-attacker used an off-the-shelf Trojan
called PoisonIvy to extract
intellectual property from
U.S. chemical and defense industries
as reported by eWEEK
's Fahmida Rashid is more depressing than anything else.
ease with which the hacker, named "Covert Grove" by Symantec, used
crude social engineering to get employees at his target companies to open
infected emails is equally disheartening. One has to wonder if the affected
companies have learned anything about security over the last 20 years and if
they have, whether they've done anything at all to train their employees.
PoisonIvy Trojan is a well-known piece of malware that can't infect a computer
on its own. It requires someone to run the program and that the program be
given administrative rights. To accomplish this, the Trojan is embedded in an email
that usually tells the user that it's a security update. In the example
provided by Symantec, the email is signed by the "Department of Security."
PoisonIvy is designed to attack Windows machines, the same social engineering
will work just as effectively in
attacks on Linux or Macintosh computers
if someone were to decide to attack
companies using those computers. While I was told on no uncertain terms that
Macintosh computers are immune to malware when I wrote that story last week,
the fact is they're not. The PoisonIvy Trojan requires the same user actions as
Tsunami, and it works in very much the same way.
any of these Trojans to work, what's required are users who are not paying
attention to what they're getting in their email, and then clicking on the
right button and filling in the information to provide administrator access, if
they don't already have it. This perfect combination of events points to a lack
of proper security consciousness in the companies involved and poor or lazy IT
practices when implementing computers for employees.
almost hate to go through this again, because it's clear that for these Trojans
to have infected the companies they did, the security staff and the IT
department weren't doing their jobs. It's also clear that the employees weren't
trained in even the most basic of security measures. So let's go through them
again. I'll try to use short words and simple sentences so maybe this time it