How Cyber Spies Infiltrate Business Systems 83
snydeq writes "InfoWorld's Bob Violino reports on the quiet threat to today's business: cyber spies on network systems. According to observers, 75 percent of companies have been infected with undetected, targeted attacks — ones that typically exploit multiple weaknesses with the ultimate goal of compromising a specific account. Such attacks often begin by correlating publicly available information to access a single system. From there, the entire environment can be gradually traversed enabling attackers to place monitoring software in out-of-the-way systems, such as log servers, where IT often doesn't look for intrusions. 'They collect the data and send it out, such as via FTP, in small amounts over time, so they don't rise over the noise of normal traffic and call attention to themselves,' Violino writes. 'There's probably no way you can completely protect your organization against the increasingly sophisticated attacks by foreign and domestic spies. That's especially true if the attacks are coming from foreign governments, because nations have resources that most companies do not possess.'"
Re:Cyber Spies (Score:3, Interesting)
No, but I saw on NOVA one time that they were going to have "Astro Spies," but that satellite technology good good enough fast enough to cancel the project (Manned Orbital Lab). James Bamford who also wrote a bunch of really good books on the NSA researched the thing. But, back on topic, I think "cyber" is used to indicate that the spying isn't being done in "meat space" as the kids say. Why it isn't just deemed a logical extension of signals intelligence, or just calling it "hacking" like they used to, is somewhat of a mystery however.
fire up nmap and start scanning (Re:Oh noes!) (Score:3, Interesting)
Seriously, just fire up nmap and start scanning your internal work networks and some key systems. If the security and network admins don't show up in your cube within 30 minutes, you might have a problem that no amount of products from CA/Symantec could ever hope to solve.
Four jobs ago, I used to fire up nmap and scan the internal network, then tell the network admins where the trojans were! (No, I never put them there.)
Re:Article says to do it in-house? (Score:5, Interesting)
Yes it will. Hackers/Hacking organizations have limited resources just like companies do. They spend their time finding and educating themselves on exploits in the most popular commercially available products because it yields the most bang for the buck.
In fact, many of these attacks begin with a scan to seek out vulnerable software.
Commercial? LOL !!!! (Score:4, Interesting)
We use a 3rd party to monitor our sites and their IDS device runs snort.
The best stuff out there is Open.
Re:Wait what? (Score:5, Interesting)
These days I work for a network security monitoring company. We have only fortune 500 customers and a number of large state organizations.
All I can say is ROFL. That made my day, really, it did it made my day.
State is even worse than corporate and corporate is bad enough. They have so many ridiculous security policies mandated while leaving gaping holes the size of Texas open. It's all about keeping the illusion of security really.
We have live security staff monitoring their systems and we do it. We monitor and in some cases manage firewalls and have IDS/IDP systems in place and we monitor those as well. Additionally, we sell security and some enterprise grade network gear.
So here is how it goes. An IDS at undisclosed location flags a SQL attack sequence in the form on a major website. We get the alert, determine a complex SQL sequence in network traffic is pretty distinct and not usually a false positive.
So I put down my putting iron and run to the phone to notify the customer during the 15 minute SLA.
Joe "This is Joe, help desk, may I have your name?"
Me "Hey Joe, this is lord vader at company x. We have detected an attack in your network stream. Our automated systems detected and blocked this attack but we highly recommend having the appropriate admins check your web/SQL servers and firewall logs for any suspicious activity."
Joe "I'm not really sure what all that means but I'll submit a ticket."
24 hours later I get a notification that Joe closed his ticket, there are no updates from any admins.
It's a joke, most companies think that having 'enterprise' AV means they don't have viruses/malware and having IDS means they are safe from network attack. They think having overzealous security policy means they are secure.
The reality is no automated system replaces attentive personal and any security policy that interferes with day to day business will be bypassed in some fashion or worked around at any opportunity.
Another example from back when I did service work. We had a bank call us. They were just inspected and the security inspector told them they had to have a firewall with intrusion detection. They called us because they had to be in compliance. They basically had NO security and no a single firewall in the shop. They even had remote access setup on systems with modems on the banking network!
So we prepare a proposal that would get them a solid firewall and an intrusion detection system and lock down the glaring security holes.
They turn us down. Instead they bought one copy of Norton Internet Security and installed it on a system. Technically, they had a firewall that lists intrusion detection as a feature now and this brought them into compliance.