Security threats: Unwrapping 2011
by Tomer Teller - Security Evangelist, Check Point - Thursday, 7 July 2011.
2011 has been a busy year so far for cyber criminals. No one can say IT security incidents went under reported, they have certainly been prominent in the headlines.

HBGary Federal, a U.S. government IT security firm, was breached in February. Targeted by a determined group of hackers, the agency saw the download and release of confidential information, thousands of company emails, malware data and financial documents belonging to its clients. The goal of the attackers – allegedly the internet activist group “Anonymous” - was to cause mere damage and embarrassment to the firm, in retaliation to its CEO’s claim that he had infiltrated their group and would disclose Anonymous members’ information.

March started with the RSA breach, a sophisticated, targeted phishing attack, where a small group of RSA employees were tricked into opening a corrupt email. The email was in fact hiding a poisoned spreadsheet. The attackers managed to compromise RSA’s SecurID authentication tokens potentially putting at risk dozens of Fortune 500 companies and cost millions of U.S. dollars.

In April, Epsilon, one of the world's largest providers of marketing-email services, dispatching some 40 billion e-mails a year to clients such as Mc Kinsey & Company, Marriott Rewards, Citibank, Walgreens, Tivo, etc, experienced one of the most severe data breaches in history, exposing millions of individual email addresses. The criminals intended to capture as much customer information as possible in order to create advanced, customized and credible spear-phishing emails scams to use later against the compromised email recipients.

Later on that month, Sony’s Playstation Network leaked the personal information of over 70 million subscribers - including email addresses, passwords, PINs, contact details, possibly credit card information and all sorts of other records – leaving Sony’s customers vulnerable to phishing campaigns and identity theft. What’s more, the company confessed to another, second breach early May, and an extra loss of 24.6 million computer game users - without disclosing further information as per what caused the breach.

Citibank revealed in June that personal and account information of an estimated 200,000 of its bankcard customers in North America has been breached. Stolen data may include credit card information, as well as customer names and email addresses.

All combined, these attacks have exposed millions of customers’ records, personal information and other sensitive organizational data. On the bright side, companies have started to take matters into their hands, and have become more proactive about security. They are reporting breaches as they happen and - in most cases – are promptly notifying their customers and people about what had happened.

Let’s look at the commonalities between these various incidents and the emerging patterns behind them.

Targeted attacks

The first diagnosis that we can establish from these breaches is the following: these attacks have been very carefully planned, orchestrated and executed. They are highly sophisticated attacks that qualify as Advanced Persistent Threats (APT), engineered specifically against target companies. The scope of organizations impacted is impressive.

With the exception of HBGary, the targeted businesses are all large corporations with over 10,000 employees, operating significant volumes of assets, customer information and confidential data - a gold mine for cyber criminals.


Most IT pros have seen potentially embarrassing information about their colleagues

More than three-quarters of IT professionals have seen and kept secret potentially embarrassing information about their colleagues, according to new research conducted by AlienVault.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Wed, Feb 10th