It was another eventful week in security, with another big revelation in the story of a hack of box retailer Target Inc. That update – which accompanied Target’s fourth quarter earnings guidance – nearly doubled the number of known victims of that attack. It also revealed that credit card data was not the only information stolen by hackers, who also made off with customer names, mailing addresses and emails. In this latest installment of Security Ledger’s Security Week in Review, we spoke with Jody Brazil, the President of the security firm FireMon about the week’s events. Jody is a seasoned security professional who works day-in-day-out with companies that are trying to manage their risk. He said that even large companies like Target can fall victim to sophisticated attacks, but the IT security may be too quick to give up on traditional defensive technologies. Jody and I had an interesting chat about […]
Fireeye
Malware Supply Chain Links Eleven Attacks
Fresh off their discovery of a previously unknown (‘zero day’) security hole in Microsoft’s Internet Explorer web browser, researchers at the security firm Fireeye say that they have evidence that a string of sophisticated attacks have a common origin. In a report released on Monday (PDF), the firm said that many seemingly unrelated cyber attacks identified in the last year appear to be part of a “broader offensive fueled by a shared development and logistics infrastructure” — what Fireeye terms a ‘supply chain’ for advanced persistent threat (APT) attacks. At least 11 APT campaigns targeting “a wide swath of industries” in recent months were found to be built on a the same infrastructure of malicious applications and services, including shared malware tools and malicious binaries with the same timestamps and digital certificates. “Taken together, these commonalities point to centralized APT planning and development,” Fireeye wrote. The attacks link at least 11 separate […]
Ephemeral, In-Memory Attack Used With New IE 0Day
It was just last week that we wrote about research from the security firm Triumfant that found evidence for the growing use of ephemeral “diskless” malware. That point was driven home over the weekend, with a report from the firm Fireeye that found a new Internet Explorer zero day vulnerability was being used in conjunction with a disk-less variant of the Hydraq (aka “McRAT”) Trojan horse program. Fireeye first called attention to the existence of attacks exploiting new, “zero day” (or previously unknown) vulnerabilities in the Internet Explorer web browser on Friday. The company discovered the malicious activity on the web site of a “strategically important website” that was being used as a “watering hole” to attack visitors who were “interested in national and international security policy.” The company described two IE vulnerabilities: an information leakage hole and an IE out-of-bounds memory access vulnerability. The information leak affects Windows XP […]
