Click for larger graphic
“Everybody has their trigger. A good social engineer will find that trigger.” — Bruce M. Snell, director of technical marketing at McAfee Security Systems
National Security community government and corporate networks being targeted. From the Washington Post’s series “Zero Day: The Threat in Cyberspace“–
In cyberattacks, hacking humans is highly effective way to access systems
. . . . Emerging details about the e-mails show how social engineering — long favored by con artists, identity thieves and spammers — has become one of the leading threats to government and corporate networks in cyberspace.
The technique involves tricking people to subvert a network’s security. It often relies on well-known scams involving e-mail, known as “spear phishing,” or phony Web pages.
But such ploys now serve as the pointed tips of far more sophisticated efforts by cyberwarriors to penetrate networks and steal military and trade secrets.
The e-mails this spring and summer appear to be part of a long-running espionage campaign by a hacker group in China, according to interviews with security researchers and documents obtained by The Washington Post.
Some of the e-mails, including those sent to the Chertoff Group and EnergySec, were caught by suspicious employees. Others hit home.
“Multiple natural gas pipeline sector organizations have reported either attempted or successful network intrusions related to this campaign,” officials at the Department of Homeland Security said in a confidential alert obtained by The Post.
The May 15 alert, by the department’s specialists in industrial control systems, said “the number of persons targeted appears to be tightly focused. In addition, the email messages have been convincingly crafted to appear as though they were sent from a trusted member internal to the organization.”
Social-engineering attacks revolve around an instant when a computer user decides whether to click on a link, open a document or visit a Web page. But the preparation can take weeks or longer.
Serious hackers investigate their targets online and draw on troves of personal information people share about themselves, their friends and their social networks.
Facebook, Twitter and other social media have become prime sources for the hackers, specialists said.
“Everybody has their trigger,” said Bruce M. Snell, director of technical marketing at McAfee Security Systems. “A good social engineer will find that trigger.” . . . .
. . . . .Temmingh demonstrated Maltego’s utility not long ago by looking for a person to target at Fort Meade, home to the super-secret NSA.
He typed in Fort Meade’s latitude and longitude and searched for Twitter users.
In a couple of steps, Maltego quickly delivered the name of a person who tweeted at the Fort Meade location.
With that, Maltego searched MySpace, a dating Web site and other resources to build a rich profile: a young Army private who served in South Korea, likes to smoke and drink, divorced and looking for a “serious relationship.”
She likes Harry Potter movies and “The Cosby Show.”
Maltego also turned up her name, address and birthdate. . . . [Read more]
