The New York Times has recently reported the news related to a (yet another) targeted cyber-attack against JAXA (Japan Aerospace Exploration Agency). This targeted attack has allegedly led to the exfiltration of sensitive information related to Epsilon, a solid-fuel rocket prototype supposed to be used also for military applications, suggesting the targeted attack is probably part of a cyber-espionage campaign.
The targeted attack has been carried on by mean of a malware installed in a computer at Tsukuba Space Center. Before being discovered, on November 21, the malicious executable has secretly collected data and sent it outside the agency.
This is the second known targeted attack against JAXA in less than eleven months: on January 13, 2012, a computer virus infected a data terminal at Japan’s Space Agency, causing a leak of potentially sensitive information including JAXA’s H-2 Transfer Vehicle, an unmanned vessel that ferries cargo to the International Space Station. In that circumstance officials said that information about the robotic spacecraft and its operations might have been compromised.
Unfortunately the above cyber-attacks are not episodic circumstances, confirming that Japan is a hot zone from an information security perspective, and a coveted target for cyber espionage campaigns. Undoubtedly, the strategic importance of this country in the global chessboard and hence its internal secrets and the intellectual property of its industries are more than a good reason for such similar targeted cyber-attacks.
The list is quite long…
19 September 2011: Mitsubishi Heavy Industries, Japan’s biggest defense contractor, reveals that it suffered a hacker attack in August 2011 that caused some of its networks to be infected by malware. According to the company 45 network servers and 38 PCs became infected with malware at ten facilities across Japan. The infected sites included its submarine manufacturing plant in Kobe and the Nagoya Guidance & Propulsion System Works, which makes engine parts for missiles.
24 October 2011: An internal investigation on the Cyber Attack against Mitsubishi finds signs that the information has been transmitted outside the company’s computer network “with the strong possibility that an outsider was involved”. As a consequence, sensitive information concerning vital defense equipment, such as fighter jets, as well as nuclear power plant design and safety plans, was apparently stolen.
25 October 2011: According to local media reports, computers in Japan’s lower house of parliament were hit by cyber-attacks from a server based in China that left information exposed for at least a month. A trojan horse was emailed to a Lower House member in July of the same year, the Trojan horse then downloaded malware from a server based in China, allowing remote hackers to secretly spy on email communications and steal usernames and passwords from lawmakers for at least a month.
27 October 2011: The Japanese Foreign Ministry launches an investigation to find out the consequences of a cyber-attack targeting dozens of computers used at Japanese diplomatic offices in nine countries. Many of the targeted computers were found to have been infected with a backdoor since the summer of the same year. The infection was allegedly caused by a spear-phishing attack targeting the ministry’s confidential diplomatic information. Suspects are directed to China.
2 November 2011: Japan’s parliament comes under cyber attack again, apparently from the same emails linked to China that already hit the lawmakers’ computers in Japan’s lower house of parliament. In this circumstance, malicious emails are found on computers used in the upper chamber of the Japanese parliament.
13 January 2012: Officials announce that a computer virus infected a data terminal at Japan’s space agency, causing a leak of potentially sensitive information. The malware was discovered on January 6 on a terminal used by one of its employees. The employee in question worked on JAXA’s H-2 Transfer Vehicle, an unmanned vessel that ferries cargo to the International Space Station. Information about the robotic spacecraft and its operations may thus have been compromised and in fact the investigation shows that the computer virus had gathered information from the machine.
20 July 2012: The Japanese Finance Ministry declares to have found that some of its computers have been infected with a virus since 2010 to 2011 and admits that some information may have been leaked. 123 computers on 2,000 have been found infected and, according to the investigation, the contagion started in January 2010, suggesting that information could have been leaked for over two years. The last infection occurred in November 2011, after which the apparent attack suddenly stopped.
Update December 26: 2011 is nearly gone and hence, here it is One Year Of Lulz (Part II)
This month I am a little late for the December Cyber Attacks Timeline. In the meantime, I decided to collect on a single table the main Cyber Attacks for this unforgettable year.
In this post I cover the first half (more or less), ranging from January to July 2011. This period has seen the infamous RSA Breach, the huge Sony and Epsilon breaches, the rise and fall of the LulzSec Group and the beginning of the hot summer of Anonymous agsainst the Law Enforcement Agencies and Cyber Contractors. Korea was also affected by a huge breach. The total cost of all the breaches occurred inthis period (computed with Ponemon Institute’s estimates according to which the cost of a single record is around 214$) is more than 25 billion USD.
As usual after the page break you find all the references.
Sony states than a total of 93,000 accounts corrsesponding to one tenth of one percent (i.e. 0.1%) of their PSN, SEN and SOE consumers may have been affected (PSN/SEN: approximately 60,000 accounts; SOE: approximately 33,000). In these cases the attempts succeeded in verifying valid sign-in IDs and passwords, so the accounts were temporalily locked. As a preventative measure, Sony will be sending email notifications to these account holders and will be requiring secure password resets or informing consumers of password reset procedures.
At least this time the defense were active and the Company states it was able to stop these attempts taking steps to mitigate the activity, moreover Sony also stated that credit card numbers associated with these accounts are not at risk as a result of the unauthorized attempts.
The attempts appear to include a large amount of data obtained from one or more compromised lists from other companies, sites or sources. These were unauthorized attempts to verify valid user accounts on our services using very large sets of sign-in IDs and passwords. Between October 7 – 10 US Pacific Daylight Time, we confirmed that these were unauthorized attempts, and took steps to thwart this activity.
A couple of hot considerations:
- The Japanese giant learned the lesson. After the infamous breaches of March (with more than 100 million users affected and estimated cost of $21 billion), Sony hired Philip Reitinger (who annouced the attack on Playstation Blog), the former deputy under secretary at the U.S. Department of Homeland Security, as senior vice president and chief information security officer at Sony. The nomination was made on September but is possible that the strategy of establishing a security strategy has already been successful: it looks like the company was able to immediately detect the attack (and also is also immediately sending email notifications to the owners of the compromised accounts);
- I cannot help but notice the strategy of the attack consisting in a “very large sets of sign-In IDs and passwords obtained from on ore more compromised lists of company”. Probably read “spearphishing”: once again old techniques with new motivations. The organizations seems to have learned how to deal with these trhreats. The users are still far from that.
Hope to have more news very soon, most of all which were the compromised lists of companies (Epsilon?).
As already suggested, I considered the original 2011 Cyber Attacks Timeline graph by Thomson Reuters not enough complete since it did not show some important attacks occurred during this tremendous 2011. This is the reason why I decided to draw an enhanced version which shows, according to my personal opinion (and metric), the list of 2011 major cyber attacks both for size and impact. Moreover in this version I added the cost of the breaches (where possible), and the alleged kind of attack perpetrated.
All the data were taken from the bulletins or statements released by the victims, or from the tweets released by the attackers.
Costs were calculated, where possible, using the indications from the Ponemon’s insitute: the average cost of a Data Breach is US $214 for each compromised record, if the targeted company decided to respond immediately the cost is around UD $268 for each compromised record, which drops to US $ 174 if the company takes longer to react.
The Total Cost is an incredible number: nearly US $ 18 billion.
Useless to say, Sony achieves rank #1 with US $ 13.4 billion. In this unenviable chart, Epsilon gains the second place with an estimated cost for its breach, of US $ 4 billion.
The others breaches, although not comparable with the previous ones, if summed, allow to achieve the grand total.
Even if smaller in size, and apparently in importance, I decided to insert in the chart also the attack to Comodo Certificates, happened in March, the 24th. In this annus horribilis, it came immediately after the RSA affaire and it has decreed, together with the RSA breach, the fall of the modern bastions of Strong Authentication (in few days tokens and certificates have proved to be vulnerable). Moreover I consider the message of the author a memorable declaration of Cyberwar. On the trail of the RSA breach the wave of attacks towards US contractors is noteworthy as well.
Hackers focused on Media Sites (Fox, PBS, Sony, Sony BMG), with a clear message against censorship (and probably the neverending problem of copyright). Interesting the second attack to PBS made to show the poor skill of LuzSecs by Warv0x, one of their enemies. In the last part of June Videogame industry was the preferred target (also Epic suffered a breach) with different intentions: LulzSec attacked Nintendo and Bethesda (the second attack resulted in data breach for the victim), but offered to avenge Sega (the manufacturer of Dreamcast), after the disastrous breach.
Direct attacks to governments focused essentially on LOIC based DDoS, albeit some infamous breaches to related sites (as in case of Infoguard/FBI and NATO) lead to Data Breaches.
Last but not least, please notice the intense activity from LulzSec in their intense “50 days of living dangerously”, just before the sudden dissolution of the group happened on June, the 25th.
- What do RSA, Epsilon and Sony breaches have in common? (paulsparrows.wordpress.com)
- It was only a matter of time… (paulsparrows.wordpress.com)
- More Random Thoughts on the RSA Breach (paulsparrows.wordpress.com)
- 2011 CyberAttacks Timeline (paulsparrows.wordpress.com)
Update June 29: 2011 Cyber Attacks (and Cyber Costs) Timeline (Updated)
I found this interesting graph from an original Thomson Reuters post, showing the timeline of the major 2011 CyberAttacks.
The graph shows all the main Cyber Events of this tremendous 2011 up to June, the 16th. Actually to be perfect it should include also the infamous Epsilon Data Breach, happened on March, the 30th. Probably it had a major impact on the U.S. rather than in Europe, but it is clear that the aftermaths of this breach will last for years in terms of spear-phishing attacks tarteting the affected users.
Moreover, to be “ultra perfect”, it shpould also include the other attacks discovered against U.S. Defense Contractors (L-3 on April, the 6th, and Northrop Grumman on May, the 26th) should be considered as well.
Even if some attacks are missing, the graph is useful (and meaningful) to show the easiness with which our data are at risk.
Of course after June, the 16th, another cyber-attack leading to a breach was perpetrated against Sega (to be added to the list of Game Publisher), affecting 1.3 million users.
Following the Sega Breach, in these last two days, after the #Antisec Manifesto and the consequent teaming between LulzSec and Anonymous, several government sites have been hit by massive DDoS attacks, including SOCA in UK, some sites affiliated to PM Silvio Berlusconi in Italy, and some Government Sites in Brazil.
You need to give people information and transparency so that they can understand security. It’s essential to make them a part of the security process and ensure they are aware of the company security policy.
These words were told yesterday, may, the 4th 2011 on Barcelona during the Check Point Experience, by Gil Shwed, the founder and Chairman of the Information Security Vendor, for unleashing the 3D Security model of the company, a model which focuses on policy people and enforcement.
No better moment could be found for emphasizing the role of the user inside the information security process!
The dramatic events of RSA, Epsilon and Sony Data Breach are redefining the information (in)security landscape and consequently rising many questions and concerns among the security professionals for the true extent of the events. RSA tokens, whose seeds were allegedly compromised during the breach are used in more than 25.000 corporations all over the Globe. The Epsilon Data Breach involved 2% of customers: for a company which sends out over 40 billion e-mails a year on behalf of over 2,500 clients, this means millions of individuals at risk and needing to be on alert from scams and phishing for years. Last but not least Sony, for which a total of more than 100 million records were stolen during two separate waves of attack on its PlayStation Network and Qriocity Service.
Now the question is: what do Mr. Shwed’s words deal with the latter events?
Well, (too) many words have been spent so far: recalling the security concerns for cloud based services (mostly in case of Epsilon and Sony) and the role of Advanced Persistent Threats which are becoming an harmful attack vectors for Enterprises, using spear-phishing mail to overwhelm the first line of defence made by the employees. Apparently old school techniques under renewed dresses. Nevertheless there is a point which, in my opinion, has not been adequately emphasized so far, and the point is just the answer to the previous question.
Simply said the uncovered point is the role of the people in the (in)security process which led to the breach. Hopefully this is not exactly the kind of role wished by Mr. Swhed, anyway if we reverse the paradigm, the result is exactly the same: on one hand, if it is true that the individual made aware of the policy enforces the first level of security and is the core of the security process itself, it is also tue that the unaware individual is the core of the breach. This is exactly what happened in the affair of RSA and Epsilon where the people, the first line of defense of any organization, was the first line to be breached, well before the systems, and the breach in the people was the trigger for the breach in the systems as well.
RSA clearly explained this occurrence in a blog post, and the appealing subject “2011 Recruitment Plan” of the phishing e-mail, hiding a zero-day Adobe Flash vulnerability (CVE-2011-0609) embedded into an excel spreadsheet, went into the annals of Information Security. Clearly the poisoned spreadsheet injected a RAT (Remote Access Tool) used to gain privileges and move freely into the network up to the final target.
Things were not so different for Epsilon, in which individual company employees were initially targeted for email scams and used to gain access to the internal database as happened.
So far there is not evidence of a similar occurrence for Sony, however today’s Sony’s Response to the U.S. House of Representatives, written by Kazuo Hirai, Chairman of the Board of Directors of Sony Computer Entertainment America, in response to questions posed by the subcommittee members of the House Commerce Committee, in some steps closely resembles original RSA announcement.
Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack.
And in case of RSA:
Recently, our security systems identified an extremely sophisticated cyber attack in progress being mounted against RSA.
(Not too much) curiosly the two steps are very similar, and likely the adjective sophisticated was used to emphasize an external origin of the attack aimed to exclude an internal fault and the presumable consequent fall of shares), nevertheless I could not help joining the two sentences and, presumably the two events, even if so far Sony did not show the same transparency of RSA and only few details are known.
Ultimately these events (to which I should add the Night Dragon malware), show that the new cyber-attacks are targeting users, and employees inside the Organization. Not only they targeted users to achieve the attack, but also the aftermaths will keep on targeting users for years: as a matter of facts, even if the full consequences of the RSA breach are not completely clear so far, PSN and epsilon users will presumably be the targets of a new wave of spear-phishing and spam emails (so far no news have been reported of a fraudulent use of Credit Cards Number stolen, which, according to Sony, were encrypted).
In all the cases, quoting Mr. Shwed’s words, we deduce the need for the user to be the core of the security process. The security process must shift to a level which involves policy definition, people awareness and, policy enforcement, at the device level, through an appropriate configuration, and most of all at the user level, through an appropriate education.