McAfee’s Operation Shady RAT exposes national cybersecurity lapses

Working with McAfee Vulnerability dark national cyber security of the RAT

2011 and the Black Hat hacker conference this week, security vendor McAfee Inc., the attacks described above can compromise the analysis has identified as the most comprehensive information and detail about the revelation, published U.S. national security and other countries.

McAfee about 72 appointed a research effort that led to the identification Currently, dealer safety, the operation was Shady RAT parties, all entries on the state of U.S. national security. or in other countries, over a period of five years in 14 different countries in a single organization is divided into 32 categories.

Recordings and take legal attacks on the security company since mid-2006, the population suffers from the scope and duration of the violation of a command and control used by attackers to access the server is started before the attack, although not open.

"I am (or soon will be) an important and valuable intellectual property and trade secrets has been committed and I am sure that all companies in every sector imaginable," Dmitri Alperovitch, research vice president of McAfee Labs threaten " In fact, those who know the danger. Two categories of Fortune Global 2000 split, and we do not know the number yet,”

UN report, a multinational Fortune 100 and national Olympic team are a wide variety of organizations, including victims, he said. Alperovitch report that a number of attacks by attacking the server looks at the records and said the organization "in the thousands."

Intrusions report, there was a fairly standard procedure with an abuser is usually the target for the organization of a spear phishing message is sent to a privileged insider who has access to a reliable, he said. For an unpatched system is on, it starts a download of malicious software, and implants. Malware can also access the Live server back door attackers infected the machine with the command and control provides a communication channel.

Such attacks in February, was acquired by Intel Corp., McAfee, at least the last five years, according to the surveys were uninterrupted. And motivation is not financial at the time, at least not to enjoy, such as computer crime, a "hunger for mystery and the intellectual property," he said.

McAfee closely guarded secret and confidential information of national plans and re-negotiate the details of the supply of oil and gas SCADA system configurations, including programs for the past five years, said the design has been compromised and many other sensitive information.

The report, missing only a major economic threat to individual companies and industry ... while "Some of the best competitor or a landmark agreement to create products that are used to explain the defeat of a rival, but an entire country." national security of these countries is very important and can be shocked the loss of top secret intelligence and defense.

The targeted countries and the attackers can attack the United States is not unique. Other in Canada, South Korea, Taiwan, Japan, Switzerland, United Kingdom, Indonesia, Vietnam, Denmark, Singapore, and Hong Kong, including Germany and India, and McAfee said single server.

But Graham Cluley, senior consultant at Sophos PLC security provider, questioned the relevance of the results of McAfee.

"To be honest, we have an interest in computer security for the McAfee report, there is nothing particularly surprising," Cluley wrote a blog on Wednesday. "What the report does not explain exactly what information was stolen from private organizations, each company the number of teams have been affected."

A player or group of intrusions carried out in this report as a specific operation, who does not want to point fingers Alperovitch tried to clarify. Behind the attacks "has no convincing evidence," he said, "then we can only speculate," he said.

"This can be changed easily go play ... and may have the potential for more dangerous activities," said Alperovitch.

"It's almost stolen the economies of many countries, no useful or interesting is a value that is exempt from the danger of organizations in all industries and sectors that affect not only large-scale problem," the report said.

Increasing public awareness of cybersecurity has shown that the former CIA official

The two researchers in black and white safety hat, the hat today, former director of operations of the Central Intelligence Agency, I get a pain warning: now an opportunity for the government to raise awareness of cyber security paradigm that has never been a higher level of national defense is structured to include threats to cybersecurity.

In a speech at the Black Hat conference in 2011, Cofer Black called the government's security community to educate and influence decision makers, most of them ignore the threat posed by cyber criminals to attack and perform in the country where a large online businesses, government agencies and for the defense industry.

"Today is very useful for policy makers on issues such as," Black said. "This is a very big," he said.

Black was the government's ongoing threat assessments, cyber attacks with biological and kinetic, said it was an important place among the different categories. In comparison, during the Cold War, intelligence agencies, bacteriological, radiological and nuclear in the past to highlight the possible chemical attack, highlight it and then, he said.

Black spent 28 years working for the CIA Counterterrorist Center and the Ministry of Foreign Affairs and the institution in 1999 was appointed director of the against-terrorism coordinator. If the Cold War, the threat of terrorism, we saw the emergence of online attacks, and now threatens industry and national security. He warned that existing signs and the possibility of physical attacks, to discuss the kinetics may be accompanied by a severe cut.

"I am here to say that the attack Stuxnet Rubicon future," says Black. "I can not say to understand how it was executed, but the important point to realize this is expensive, which means that, including a nation-state. Another important point is that the physical destruction of national resources in the world can cause things to happen. This is very important. "

Responses to cyber attacks, but because the origin of the attacks and the lack of international coordination in such cases is difficult to dispute the survey.

"Cyber ​​against nations or terrorist groups is an important component of a future conflict," said Black. "You can hear the problem. Makers to understand the threats that were never experienced in person, but I do not think."

Black open in New York and Washington, the tenth anniversary of the September 11 attacks coming little more than a month. Black collected and what is happening today on cybersecurity drew parallels between the pre-9/11 information.

Years and months before Sept. 11, Al Qaeda and Osama bin Laden Black producers decided to self-denial, there were a terrorist organization and a financier of terrorism, but remember to see the leader as more than one initiator. Al-Qaeda threat has been labeled in some government circles and the press exaggerated. It also attacks the U.S. embassy in 1998, including the escalation of the situation and attack Americans abroad remain in Tanzania and Kenya and against the USS Cole in October 2000.

Black Bush administration and the Clinton administration would be the greatest threat of terrorism from its board the power transmission points. However, the dark, but no personal experience, he said, and downplayed the threat verification. In summer 2001, the volume of close to a major attack on U.S. policymakers informed and continues to grow, "the fight" was advised to go to, but Black said there were delays in action because the threat had not yet been validated.

"Personally, I had difficulty in the minds of men the things that are not suitable," says Black.

Drawback is that the defense industry and the constant attacks carried out against other high-level goals may be similar before the 9 / 11 for the period.

"Threat to the validation came into the world," said Kelly. "There is an analogy with the world and the world situation; this technology can be much more difficult."