Christmas Card Steals Sensitive Information. Information Security Experts Fear Cyber Espionage

By Author: Peter Martin
Total Articles: 211
Comment this article

Recently, information security professionals identified data breach by cybercriminals. The offenders reportedly sent e-mails to government employees and contracted professionals. The e-mail address was spoofed to make it appear as sent from whitehouse.gov domain. The e-mail message thanked the staff for their contribution and conveyed greetings for the holidays. The message also contained a greeting card link. While the staff may have overjoyed on receiving e-mail from white house, they were actually victims of a spear phishing attack, wherein sensitive information was stolen from their computers.

Experts have identified that a variant of Zeus Trojan was used to install malware in computer systems. When unwary recipients clicked on the greeting card link, they were prompted to open a .zip file. As users opened the .Zip file, their systems were infected by the Trojan. The Trojan stole passwords and documents such as PDF files, word and excel documents to upload them to a remote server. The server was allegedly ...
... based in Belarus. IT Security experts have expressed the possibility of cyber-espionage as the victims included an Intelligence analyst of Massachusetts State Police, an employee of National Science Foundation's (NSF) Office of Cyber Infrastructure and an employee of Financial Action Task force. The compromised data includes cell-phone intercepts, document on protection national security information and grant applications to NSF for new technologies.

Ironically, the attack comes at a time, when governments across the world are dealing with chaos created by WikiLeaks disclosure. The attack highlights the imminent threat to information security and confidentiality of crucial documents of national interest.

Governments across the world must assess their IT security apparatus and revamp the infrastructure to secure classified documents and information. Government bodies, intelligence agencies, scientific departments and organizations must regular conduct security evaluation tests through ethical hacking, vulnerability assessment, penetration testing and security audits to mitigate the vulnerabilities prior to their exploitation by hackers. The latest spear phishing attack demonstrates that specially-crafted and targeted e-mails can dupe even security experts and intelligence officials. As such, governments must initiate measures to create information security awareness among employees and cultivate a culture of secured IT practices.