Forgot your password?
typodupeerror
Businesses Security IT

How Cyber Spies Infiltrate Business Systems 83

Posted by kdawson
from the hire-the-baddest-pen-testers-you-can dept.
snydeq writes "InfoWorld's Bob Violino reports on the quiet threat to today's business: cyber spies on network systems. According to observers, 75 percent of companies have been infected with undetected, targeted attacks — ones that typically exploit multiple weaknesses with the ultimate goal of compromising a specific account. Such attacks often begin by correlating publicly available information to access a single system. From there, the entire environment can be gradually traversed enabling attackers to place monitoring software in out-of-the-way systems, such as log servers, where IT often doesn't look for intrusions. 'They collect the data and send it out, such as via FTP, in small amounts over time, so they don't rise over the noise of normal traffic and call attention to themselves,' Violino writes. 'There's probably no way you can completely protect your organization against the increasingly sophisticated attacks by foreign and domestic spies. That's especially true if the attacks are coming from foreign governments, because nations have resources that most companies do not possess.'"
This discussion has been archived. No new comments can be posted.

How Cyber Spies Infiltrate Business Systems

Comments Filter:
  • by Anonymous Coward
    Don't use that older version, the new version of Windows is way more secure.
    • Re: (Score:1, Funny)

      by Anonymous Coward
      So, which do you work for? MS or the Chinese gov.
  • Cyber Spies (Score:5, Insightful)

    by omni123 (1622083) on Monday July 26, 2010 @07:11PM (#33037940) Homepage

    When are we going to get over this cyber prefix bs?

    A spy is a spy a spy. You don't call them "gun spies" or "explosive spies". Technology is a tool like anything else.

    • Re: (Score:3, Interesting)

      by bsDaemon (87307)

      No, but I saw on NOVA one time that they were going to have "Astro Spies," but that satellite technology good good enough fast enough to cancel the project (Manned Orbital Lab). James Bamford who also wrote a bunch of really good books on the NSA researched the thing. But, back on topic, I think "cyber" is used to indicate that the spying isn't being done in "meat space" as the kids say. Why it isn't just deemed a logical extension of signals intelligence, or just calling it "hacking" like they used to,

      • by teh moges (875080) on Monday July 26, 2010 @07:59PM (#33038470) Homepage
        I like your idea of calling non-cyberspies 'meatspies' from now on.
      • Re: (Score:3, Informative)

        by gtall (79522)

        To go back further, it was called "cracking". "Hacking" was reserved for taking a program and modifying it or merely writing a program, there was no malfeasance implied.

        • by bsDaemon (87307)

          Well, the media seems to have always lumped it in as hacking, hence the air quotes. The media and the people who want to get air time are also the ones pushing this "cyber" crap. Although, the military now has its "Cyber Command" (whatever that is, but apparently the Director of the NSA gets to be in charge of it, too). Its spreading.

    • s/cyber/blogosphere/g

      Amazingly enough, it has the exact same relevance.

    • Re: (Score:3, Funny)

      by RJFerret (1279530)

      When are we going to get over this cyber prefix bs?

      Yes, let's get with the modern era and lingo, they will henceforth be known by the friendlier tech term: iSpy.

    • Re:Cyber Spies (Score:5, Informative)

      by Trepidity (597) <delirium-slashdot@h a c k i sh.org> on Monday July 26, 2010 @11:14PM (#33040070)

      Here's what Ted Nelson [wikipedia.org] had to say [xanadu.com.au] about it:

      "Cyber-" means 'I do not know what I am talking about'

      "Cyber-" is from the Greek root for "steersman" (kybernetikos). Norbert Wiener coined the term "cybernetics" for anything which used feedback to correct things, in the way that you continually steer to left or right to correct the direction of a bicycle or a car. So "cybernetics" really refers to control linkages, the way things are connected to control things.

      Because he was writing in the nineteen-forties, and all of this was new, Wiener believed that computers would be principally used for control linkages-- which is if course one area of their use.

      But the term "cybernetics" has caused hopeless confusion, as it was used by the uninformed to refer to every area of computers. And people would coin silly words beginning with "cyber-" to expand ideas they did not understand. Words like "cyberware", "cyberculture", "cyberlife" hardly mean anything. In general, then, words beginning with "cyber-" mean "either I do not know what I am talking about, or I am trying to fool and confuse you" (as in my suggested cybercrud).

      • Re: (Score:2, Funny)

        by Sr. Zezinho (16813)

        So cybersex is an example of proper usage of the prefix?

        • by sbjornda (199447)

          So cybersex is an example of proper usage of the prefix?

          Are you thinking it's proper because of the gp's statement about

          linkages

          or his phrase

          I do not know what I am talking about

          ?

          --
          .nosig

  • by Meshach (578918) on Monday July 26, 2010 @07:12PM (#33037948)
    From the FA:

    If your company has the resources and the expertise, consider developing your own specialized tools to help thwart attacks.

    Unless your company is a security or firewall provider I find it hard to believe that anything developed in-house will be better than a commercially available product.

  • Clearly they infiltrate them by sapping their sentries.
  • Oh noes! (Score:5, Insightful)

    by countSudoku() (1047544) on Monday July 26, 2010 @07:15PM (#33038006) Homepage

    The packets are coming from INSIDE YOUR NETWORK!!1! GET OUT FAST!!1!

    Seriously, just fire up nmap and start scanning your internal work networks and some key systems. If the security and network admins don't show up in your cube within 30 minutes, you might have a problem that no amount of products from CA/Symantec could ever hope to solve. Yet, they WILL sell them to you nonetheless.

    Knowledge beats paranoia
    Spock smashes Scissors and vaporizes Rock

    Your mileage may vary.

    • Seriously, just fire up nmap and start scanning your internal work networks and some key systems. If the security and network admins don't show up in your cube within 30 minutes, you might have a problem that no amount of products from CA/Symantec could ever hope to solve.

      Four jobs ago, I used to fire up nmap and scan the internal network, then tell the network admins where the trojans were! (No, I never put them there.)

      • Re: (Score:3, Funny)

        by mandelbr0t (1015855)

        Four jobs ago, I used to fire up nmap and scan the internal network, then tell the network admins where the trojans were! (No, I never put them there.)

        That would explain why it was four jobs ago...

    • Our network admins would catch you, but only because our firewalls go down when you portscan through them :-(

    • by sbjornda (199447)

      Seriously, just fire up nmap and start scanning your internal work networks and some key systems.

      If you try that in my shop you will be violating written policy and we will escort you to the door.

      --
      .nosig

  • by StCredZero (169093) on Monday July 26, 2010 @07:17PM (#33038020)

    I thought of this sort of thing in 2004 with some coworkers. The scenario we came up with would be for a disgruntled employee to query trading app databases (unencrypted) and export the data in dribs and drabs using FTP. Outgoing FTP was wide open. The place where we were working (major petroleum multinational) the information could have been used by competitors to make a killing doing commodity trading, possibly even corner a market.

    The problem's not the technology. There's always security holes. It's relatively easy to get your hands on something illegally. It's safely making money off of it which is the problem. No way I'd want the kind of heat a major petroleum multinational could hire going after my ass!

    • by bsDaemon (87307) on Monday July 26, 2010 @07:21PM (#33038058)

      I know... they might upload a virus into their shipping fleet's ballast control computers and blame it on you so the government can trash your shit for them. But it should all work out in the end, though, and you'll get the girl.

      • Actually, a whole bunch of people I've worked with have worked on apps that route global shipping fleets. Ballast is controlled by a local, non-networked shipboard mechanisms.

    • I recently arrived as the "paid IT guy" at a small private university.

      I just took as fact that systems were already being attacked and rooted.

      Educational systems which nobody thinks twice about are already owned and have the least chance to fight off any concerted state or insert group name here sponsored attack.
      Its now a nice game of wack a mole as I watch the firewalls which now have egress logging on ports. Its interesting to see the "businesses" that connect to my systems daily.
      Nobody filters out going

  • Wait what? (Score:4, Informative)

    by moogied (1175879) on Monday July 26, 2010 @07:39PM (#33038262)
    Maybe its because I work for a large state's DOJ... but whos firewalls are just letting out random FTP connections? In our environment nothing goes in or out unless we directly state it should be. Its all very controlled... that and a pretty hefty usage of enterprise level AV scans on each box, then IDS, then AV on emails, filtering on emails(can only go to certain addresses).. etc etc. I guess we take the "Large amount of work in exchange for very tightly controlled systems" approach. Maybe other places should too?
    • Re:Wait what? (Score:5, Interesting)

      by shaitand (626655) on Monday July 26, 2010 @08:24PM (#33038752) Journal

      These days I work for a network security monitoring company. We have only fortune 500 customers and a number of large state organizations.

      All I can say is ROFL. That made my day, really, it did it made my day.

      State is even worse than corporate and corporate is bad enough. They have so many ridiculous security policies mandated while leaving gaping holes the size of Texas open. It's all about keeping the illusion of security really.

      We have live security staff monitoring their systems and we do it. We monitor and in some cases manage firewalls and have IDS/IDP systems in place and we monitor those as well. Additionally, we sell security and some enterprise grade network gear.

      So here is how it goes. An IDS at undisclosed location flags a SQL attack sequence in the form on a major website. We get the alert, determine a complex SQL sequence in network traffic is pretty distinct and not usually a false positive.

      So I put down my putting iron and run to the phone to notify the customer during the 15 minute SLA.

      Joe "This is Joe, help desk, may I have your name?"

      Me "Hey Joe, this is lord vader at company x. We have detected an attack in your network stream. Our automated systems detected and blocked this attack but we highly recommend having the appropriate admins check your web/SQL servers and firewall logs for any suspicious activity."

      Joe "I'm not really sure what all that means but I'll submit a ticket."

      24 hours later I get a notification that Joe closed his ticket, there are no updates from any admins.

      It's a joke, most companies think that having 'enterprise' AV means they don't have viruses/malware and having IDS means they are safe from network attack. They think having overzealous security policy means they are secure.

      The reality is no automated system replaces attentive personal and any security policy that interferes with day to day business will be bypassed in some fashion or worked around at any opportunity.

      Another example from back when I did service work. We had a bank call us. They were just inspected and the security inspector told them they had to have a firewall with intrusion detection. They called us because they had to be in compliance. They basically had NO security and no a single firewall in the shop. They even had remote access setup on systems with modems on the banking network!

      So we prepare a proposal that would get them a solid firewall and an intrusion detection system and lock down the glaring security holes.

      They turn us down. Instead they bought one copy of Norton Internet Security and installed it on a system. Technically, they had a firewall that lists intrusion detection as a feature now and this brought them into compliance.

      • To be fair, an unsuccessful attack on a web server from the Internet is as common as breathing these days. What do you expect people to do? If I chased all of those down, I would never ever get to do anything else ever.

        • by shaitand (626655)

          I suppose that would depend on whether you are security staff getting paid to do nothing else, ever.

    • Re: (Score:1, Insightful)

      by Anonymous Coward

      Maybe its because I work for a large state's DOJ... but whos firewalls are just letting out random FTP connections?

      Maybe it's because you work for a large state's DOJ that you don't recognize that any reasonably smart piece of software would attempt to transmit information on a selection of available ports via a number of recognized protocols. You let out HTTP, don't you? How well do you suppose that is filtered? And even if it is, do you know how difficult it would be to distinguish between someone uplo

    • by Ostracus (1354233)

      Maybe its because I work for a large state's DOJ...

      Prosecuting any powerful people or dealing with large sums of money?

      Maybe other places should too?

      Is the public at large willing to shoulder the cost, especially considering most don't understand the threat?

    • by dbIII (701233) on Monday July 26, 2010 @09:13PM (#33039100)
      Anywhere that deals with large files allows "random" FTP connections so employees can pick up data from clients. Email is a crappy way to send large files so FTP still fills the gap. Using something like sftp would of course be vastly better but not many people even know it exists.
      • by soliptic (665417)

        Email is a crappy way to send large files so FTP still fills the gap.

        That's not exactly a great justification for "random" FTP connections.

        At my place I have a legitimate need for FTP, so do a few other people. These people submit a business case to IT and get FTP access. Everybody else does not. It may also be limited to specific sites, I'm not sure.

        Btw (and I probably shouldn't say this, considering I'm going through their proxy, and they are probably reading this) - this is coming from a company whose IT dept appear to consider "reboot the server" as a decent first lin

        • by dbIII (701233)
          Yes it is. That's how large tender documents travel due to a habit of clients or their hosting services setting email attachment sizes to ridiculously low values.
      • by IICV (652597)

        You wouldn't believe the number of people who think you can use Internet Explorer to access an SFTP or FTPS site. It's not even funny.

        Of course, Internet Explorer itself doesn't help - if you click on a link in the form of "sftp://" or "ftps://", IE goes "oh hey I know how to handle this!" and tries to open it even though it has no idea what it's doing.

        And of course, the users don't realize that there's a difference between FTP and SFTP/FTPS, so they say "hey why do I need to download some other program? In

    • by jeff4747 (256583)

      Replace "FTP" in the example with "HTTP" or "HTTPS". Still sure you're covered? Do you have to explicitly whitelist every web site you can access from work? Even then, are you sure every web site on your whitelist is absolutely secure?

  • undetected attacks (Score:2, Insightful)

    by Gitcho (761501)

    According to observers, 75 percent of companies have been infected with undetected, targeted attacks

    anyone else wonder how that's measurable?

    • I suspect they meant "heretofore undetected." As in, the sysadmins didn't catch it but the security consultants did.
  • by Gavin Scott (15916) on Monday July 26, 2010 @09:11PM (#33039078)

    "According to observers, 75 percent of companies have been infected with undetected, targeted attacks"

    These "observers" wouldn't happen to be people with a vested interest in the cyber-security industry would they?

    This sounds a lot like "75% of the population has an undetectable terminal disease with no symptoms and so everyone needs to buy our miracle cure right away!"

    Or Dogbert has upgraded his invisible robots...

    http://www.hulu.com/watch/78089/dilbert-animated-cartoons-invisible-robot [hulu.com]

    Color me skeptical on this claim.

    G.

  • As long as you have a system which is open to the outside world, it can never be secure. As long as your systems which are open to the outside world are running on insecure OSes - Unix, Linux, anything written by Microsoft - your systems will not be secure. This is the long and short of it. But American corporations, and most governmental entities, are either (1) stupid, (2) incompetent, (3) unconcerned about security, or some combination thereof. Which is good if you are a security contractor/speciali
  • "'There's probably no way you can completely protect your organization against the increasingly sophisticated attacks by foreign and domestic spies. That's especially true if the attacks are coming from foreign governments, "

    ?

    what makes you think that the same action by your very own government is not an attack?

    Recently a lot of IT managers of the UN system coming from the US exclusively install US-company based products which ( would ) give US based services a nice backdoor to their IT systems.

    As man

  • Oh, FFS (Score:3, Insightful)

    by cheros (223479) on Tuesday July 27, 2010 @07:35AM (#33042458)

    Someone in need of some new fear? Products to sell or a new restrictive law coming up? Journo in need of hits?

    1 - Secure what are secrets, and please lose the idea that security is a technical problem. It's a people problem first. You have information because you work with it, and anyone able to access that data as part of their work is a potential leak in itself.

    2 - Any observation takes effort, so espionage is typically focused - stay alert if you're doing something interesting.

    3 - The more data you collect, the larger the haystack becomes for a needle to hide. What happened in 9/11 demonstrated quite clearly that HUMINT is the best, but is a lot more costly. The TSA kindly proved afterwards that doing it any other way is just a way to make a couple of people very rich, but it won't contribute to security. Oh, and it proved that you don't even need to go abroad to find an untrustworthy government..

    4 - Stop worrying people about what can go wrong. Every time of the day we are exposed to threats. The builder may have used asbestos, some driver may be on drugs and run you over, your secretary may start leaking data about your affair - prevent what you can, and plan for what you cannot, then get on with your life.

    5 - If you want security checked, use an expert. And by that I don't mean someone who can wave some certification around, that is great for clueless HR types to avoid blame for picking the wrong person, READ the CV. The good ones LIVE their work, and not all of them have bothered getting certified. Check, check again, and if it's critical have the work cross checked with someone else. Do NOT expect consultancies to be better or worse, I have seen risk management done by a Big Name setup that wasn't worth 1/10th of what a client paid for it and actually put lives at risk if there had been a crisis. Ditto with security.

    6 - Remember the law. If you let your security be tested by a setup that has been put under order to report back (UK Regulation of Investigative Powers Act springs to mind) you have just given a list of weaknesses to that same government you were so worried about. It may pay to look abroad, where such reports will have to be stored properly and cannot be accessed other than by leaving a paper trail.

    Just don't think that buying a lot of kit will sort it all out, or that there is such a thing as risk free operations. Plan for failure so you can deal with it if it happens and. do. not. forget. the. people. in. this. effort..

    • by mikein08 (1722754)
      Spot on, brother. But as I have said, ANY system open to the outside world will NEVER be secure.
      • by cheros (223479)

        You're right. But it would be nice if idiots stopped whining about it as if that is news. You need it, because having it brings more profit than running it plus the cost of managing the risks - simple business calculation, and there isn't much more to it. I'm fed up with the BS spouted by journalists and consultancies keen to flog the most expensive advice they can get away with. It's not magic..

  • http://www.timesonline.co.uk/tol/news/uk/crime/article7009749.ece [timesonline.co.uk]

    "A leaked MI5 document says that undercover intelligence officers from the People's Liberation Army and the Ministry of Public Security have also approached UK businessmen at trade fairs and exhibitions with the offer of "gifts" and "lavish hospitality".

    The gifts -- cameras and memory sticks -- have been found to contain electronic Trojan bugs which provide the Chinese with remote access to users' computers. "

    Ah, good old autoplay!

We are Microsoft. Unix is irrelevant. Openness is futile. Prepare to be assimilated.

Working...