McAfee Says Cyber-attack Details Point to IE Security Vulnerability

 
 
By Brian Prince  |  Posted 2010-01-14 Email Print this article Print
 
 
 
 
 
 
 


title=What This Means for U.S. Policy Makers, Enterprises}

Adam Vincent, CTO for the public sector team at Layer 7 Technologies, said the incident proves the industry must continually scrutinize public cloud security procedures as well as those for its own internal network.

"People are already concerned about cyber-security; however, incidents like this one, from a purported government entity, bring a whole new dimension to cyber-security-one where corporations must not only protect themselves from malicious adversaries on the Internet but from well-organized and funded government organizations," Vincent said.

The Chinese government has been at the center of numerous allegations of cyber-attacks and spying targeting the United States.

One of the most well-known examples from 2009 is the infamous GhostNet, which was believed to have infiltrated political, economic and media organizations in more than 100 countries before it was discovered in March. There were also allegations last year that the Chinese government was involved in attempts to hack the U.S. electric grid as well as the Pentagon's $300 billion Joint Strike Force. China denied involvement in both attacks.

All this raises the question of how U.S. government and business officials should respond.

"From a policy standpoint, the United States should drive new standards in e-mail protocols that do not allow for such attacks to exist," said Sean Sullivan, security advisor for North American Labs at F-Secure. "The system has long been considered flawed, but the investment to fix it is considerable. Businesses with sensitive information to protect should consider the costs of allowing any attachments through their e-mail gateways. There are other alternatives."

People should not be surprised any government is spying on another, but what is unique about this incident is its scale, said Eli Jellenc, head of international cyber-intelligence at VeriSign's iDefense Labs.

"It has always been our presumption that attacks would reach this scale and level of sophistication at some point, but many of us did not believe it would be this soon or this brazen ... The basic method of the attacks [is] well known to us and common for Chinese corporate and strategic spies, but the level of organization and planning necessary to execute a concerted attack campaign of this complexity marks a major increase from what we've seen in the past," Jellenc said.

Editor's Note: This story was updated with new information from Microsoft.



 
 
 
 
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...

 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Rocket Fuel