New breed of hack attack

March 8, 2008 – 6:54 PM

Hackers appear to have stepped up their efforts to trick corporate executives into downloading malicious software programs that can steal company data over the past year.

That’s according to security vendor MessageLabs, which caught an average of 10 e-mails per day in May targeted at people in senior management positions, up from just one a day a year prior, said Mark Sunner, chief security analyst.

Those 10 emails are a very small percentage of the 200 million emails that MessageLabs scans every day, but the composition of those messages is what’s alarming, Sunner said.

Many of the emails contained the name and title of the executive in the subject line, as well as a malicious Microsoft Word document containing executable code. The hackers are trying to trick the victim into thinking the messages comes from someone they know, in the hope that the victim will willingly install, for example, a program that can record keystrokes.

MessageLabs won’t reveal what companies have been targeted of late, but it has contacted executives who have been targeted and heard their family members have also received messages on their own, non-corporate e-mail accounts, Sunner said.

Those methods suggests that hackers may be researching victims and culling data from social networking sites such as Linked In, MySpace or Facebook, Sunner said.

“If you really want to work out somebody’s background … you can actually find out a lot,” Sunner said.

Tricking a relative into installing malicious code would offer the hacker another way to collect sensitive data, if an executive decides to do some work on a home computer, Sunner said.

During June, MessageLabs picked up more than 500 of these targeted messages, with some 30 percent aimed at chief investment officers – a position that can include handling acquisitions and mergers. Other positions targeted include directors of research and development, company presidents, CEOs, CIOs and CFOs.

Another danger is that the targeted messages are often just single messages sent to a single person, rather than a mass spam run. When hackers send out millions of messages, security companies often either update their software or change their spam filters to trap the bad messages.

But single messages have a higher chance of slipping through, although Sunner said MessageLabs’ filtering service catches the messages by analysing the e-mail’s attachment and determining whether it is potentially harmful. Other security companies catch malware by updating their software with indicators, or signatures, to detect harmful code or block code from running based on what it does on a computer, a technology called behavioural detection.

Tracing where the messages come from is difficult, since the sender’s name is always fake, Sunner said. The IP address from which the messages were sent indicate computers that are located around the world. Hackers often use networks of computers they already control, called botnets, to send e-mails.

“Certainly, people need to raise the level of vigilance,” Sunner said.

www.techworld.com/security/news/index.cfm