With one mouse click on a seemingly internal e-mail, your CEO could unwittingly enable a cybercriminal to mine his hard drive for credit card numbers,passwords to corporate databases or other proprietary information.
If credit card phishers are the carpet bombers of computer crime, C-level attackers are the snipers. They mine information from a relatively small number of wealthy or high-status individuals in positions of power. They are after corporate and personal data, both of which can be extremely lucrative. They can use that information to wreak havoc elsewhere, or they can sell it for profit.
These types of targeted C-level attacks are rare, but they’re on the rise, and they’re sophisticated enough to make the average IT manager’s blood run cold.
Following the Money
C-level attacks “started out about a year ago in very low numbers but have been ramping up since,” says Matt Sargeant, senior antispam technologist at MessageLabs Ltd., a security services provider in New York.
There are three reasons for that, observers say: Executives are reading their own e-mails and using their own PC applications rather than leaving those tasks to administrative assistants; they’re traveling more with less-secure digital devices in tow; and, like everyone else, they’re exploring the power of social networks, inadvertently exposing details that could make them the targets of criminals.
The results can be chilling.
Last summer, 24-year-old Russian Igor Klopov and four others were indicted by a New York grand jury for stealing $1.5 million and attempting to steal $10.7 million more from about a dozen victims. Klopov used the Forbes 400 list of the world’s wealthiest people to pick his marks.
They included Texas businessman Charles Wyly and TransUnion Credit President Anthony Pritzker.
The government charges that Klopov and his gang found information on some of their victims’ real estate holdings and lines of credit — much of which was publicly available — and used it to build dossiers on them.
The gang allegedly created and used fake IDs to contact the victims’ financial institutions (JPMorgan Chase & Co., Merrill Lynch & Co. and Fidelity Investments) to try to gain information on their accounts, get duplicate checkbooks and the like. Luckily, the institutions flagged the attempts and contacted the authorities.
An IT manager at a Fortune 500 financial institution says his company, too, recently fought off a C-level attack. In this instance, a bank executive’s laptop was hacked while he was working from home. The hacker captured passwords and log-ins and tried to access some of the bank’s accounts. The attempt, which was later traced to a Russian IP address, failed, says the IT manager, who spoke on condition of anonymity.
On Sept. 12 and 13 of 2007, MessageLabs detected 1,100 suspicious e-mails to senior executives at companies around the world. The messages, ostensibly from a recruiter, used a Microsoft error message to lure victims into clicking on a Rich Text Format attachment. That enclosure contained an executable file that would install two files on the target computer then pass information back to the perpetrator.
F-Secure Corp., a security firm in Helsinki, Finland, has followed similar threats for two years. “It’s obvious in these cases that the attackers have taken effort and time finding and researching the target,” says Mikko Hyppönen, F-Secure’s chief research officer.
In designing such messages and selecting recipients, criminals use not only relatively sophisticated software tools, but also the reams of publicly available information about corporate executives.
That data comes from U.S. Securities and Exchange Commission documents and corporate Web sites, and also from social networking sites like LinkedIn, Zoom and Facebook, where information that executives post can be seen by anyone. Details about past jobs, college affiliations and major projects can all be used to create messages that the recipients are likely to open.
“It is serious, because they [send] an e-mail from outside but make it look like it’s coming from inside the company, from someone who is in contact with the target. [And they might think] it’s someone who works two floors up,” Hyppönen says.
In such cases, an attached Word or Excel file is likely to carry a Trojan horse. “It really is a document,” Hyppönen explains, “but it’s corrupted, and it will crash your version of Word and run the exploit.”
F-Secure has seen cases where hackers were able to identify the antivirus program the target company was running and modify the exploit code just enough to go undetected.
The prospect of executives becoming targets is particularly troubling because the perpetrators often deploy sophisticated Trojan horses, and the attacks require a disturbing amount of inside corporate knowledge to work successfully. That knowledge sometimes comes from inside sources who know what data the targeted executive is privy to and which employees he might be inclined to trust.
F-Secure has seen 20 to 25 such attacks in two years, Hyppönen estimates. “It’s not awfully common, but in those cases where it happens, it’s a real nightmare,” he says.
Sometimes the breach “was discovered when the sysadmins looked at firewall logs and at where users were connecting and looked for anomalies,” Hyppönen explains. “They might see that those two workstations in the R&D department are connecting to a server in China where they shouldn’t be connecting.”
In other cases, since the exploit sometimes uses software rootkits, a user might start having PC problems. When IT then runs F-Secure’s BlackLight or another rootkit detector for debugging and finds a problem, it can detect the presence of malware.
An unforeseen consequence of the social networking trend is that it plays into the hands of C-level attackers. George Brown, a database and security consultant, says he tells CEOs to guard their private information zealously.
“It’s the Wild, Wild West out there. Publicly held companies are forced to reveal a lot of information about their executives, so that’s already out there. I tell them not to compound that by putting more information up on social networking sites,” says Brown, CEO of Database Solutions Inc. in Cherry Hill, N.J. “Don’t put anything out there that you don’t absolutely have to.”
The CIO of a Boston-area health care organization hears that message loud and clear and is extremely cautious in how she handles e-mail of any kind. “I do not open anything unless I’m absolutely sure I know where it comes from,” she notes. “If I miss something important, that person will call.”
The CIO — who says that the percentage of her organization’s IT spending on security increases every year — doesn’t participate in any business social networking sites either, and she recommends that other executives follow suit. And talking publicly about security issues? Definitely a no-no, she says (hence her anonymity), “unless you want to make yourself a target.”
Darrow, a Boston-area freelancer, can be reached at firstname.lastname@example.org.
How to Fight Back
A recurring theme among IT officials is that top execs, who are used to their positions of power and privilege, don’t like to be told how and when to use their PCs and handheld devices. They want to use these tools when and where needed, regardless of their surroundings and the attendant security (or lack thereof). But your job is to protect them from themselves. You need to make them understand the threat and show them how to mitigate it. Here are some steps to take:
Bolster security for executives, both in the office and at home.
— Make sure anti-malware software and services are up to date at the desktop, server and network levels.
— Strictly enforce basic security practices, including frequent changes of passwords.
— Immediately plug any security holes in Word, Excel or Acrobat.
— Ensure that the operating systems on handheld devices — typically beyond the scope of desktop antivirus programs — are always up to date.
Get the word out.
— Drill executives on whom to notify if they click on a Word, Excel or PDF document received via e-mail and the application appears to launch but then shuts down and relaunches. This may indicate that a Trojan horse is attempting to cloak itself behind the real application.
— Teach them to be wary when an e-mailed document requests that they run resident macros. Rule of thumb: If there is any doubt about the validity of the request, don’t do it.
Make the road safer for roaming executives.
— Insist that they always use a virtual private network when linking into company networks from outside.
— Forbid them to send confidential information of any kind — including personal information — over an unsecured Wi-Fi connection.
Be wary of social networking.
— Explain that criminals may be watching high-profile posters with something other than benign interest.
— Make them aware of social engineering tactics that could prompt them to unwittingly give away their bank account numbers or put the company at risk.