“Hey Alice, look at the pics I took of us last weekend at the picnic. Bob”. That Facebook message, sent last fall between co-workers at a large U.S. financial firm, rang true enough. Alice had, in fact, attended a picnic with Bob, who mentioned the outing on his ‘Facebook’ profile page.
So Alice clicked on the accompanying Web link, expecting to see Bob’s photos. But the message had come from some ‘bad guys’ who had hijacked Bob’s Facebook account. And the link carried an infection. With a click of her mouse, Alice let the attackers usurp control of her Facebook account and company laptop. Later, they used Alice’s company logon to slip deep inside the financial firm’s network, where they roamed for weeks. They had managed to grab control of two servers, and were probing deeper, when they were detected.
Now let us see this closely, on how did this layered approach by so called ‘not-so-good guys’ tricked to get into the corporate network.
The attack on the picnicking co-workers at the financial firm illustrates how targeted attacks work. Last fall, attackers somehow got access to Bob’s Facebook account, logged into it, grabbed his contact list of 50 to 60 friends and began manually reviewing messages and postings on his profile page. Noting discussions about a recent picnic, the attackers next sent individual messages, purporting to carry a link to picnic photos, to about a dozen of Bob’s closest Facebook friends, including Alice. The link in each message led to a malicious executable file, a small computer program.
Upon clicking on the bad file, Alice unknowingly downloaded a rudimentary keystroke logger, a program designed to save everything she typed at her keyboard and, once an hour, send a text file of her keystrokes to a free Gmail account controlled by the attacker. The keystroke logger was of a type that is widely available for free on the Internet.
The attackers reviewed the hourly keystroke reports from Alice’s laptop and took note when she logged into a virtual private network account to access her company’s network. With her username and password, the attackers logged on to the financial firm’s network and roamed around it for two weeks.
First they ran a program, called a port scan, to map out key network connection points. Next they systematically scanned all of the company’s computer servers looking for any that were not current on Windows security patches. Companies often leave servers unpatched, relying on perimeter firewalls to keep intruders at bay. The attackers eventually found a vulnerable server, and breached it, gaining a foothold to go deeper.
A short time later, the attackers were discovered and cut off. One of Bob’s Facebook friends mentioned to Bob that the picnic photos he had sent had failed to render. That raised suspicions. A technician took a closer look at daily logs of data traffic on the company’s network and spotted the vulnerability scans.The attack lasted as long as 2 weeks. If the attackers’ vulnerability scans had not been so “noisy”, they may not have been noticed, and the company could have suffered severe losses in terms of costly data breaches and corrupted databases, as well as system repairs.
What’s interesting in this story is that the initial attack on the employees’ Facebook friends is pretty hard to defend against, since nothing seemed out of the ordinary. There really was a corporate picnic!
So, before clicking on a link, provided by your friends, do grill your cerebrum to have precautive measures like cross-checking the message by the sender etc., as you may not be the only one who would be affected , yet you will be ‘leading the hierarchy’ !