Two days ago, I launched this to the press:
"NOXS Press Release (May 15 2007) : Targeted attacks are underestimated in Belgium.
Targeted spyware attacks found in the neighborhood of a well known shopping area in Brussels,Belgium
Eddy Willems, Anti-Malware Technology Expert NOXS, recently found out that some companies in the neighborhood of a well known shopping area in Brussels have been constantly under attack. Several tens of new and at that moment undetectable trojans, spyware and botnets were found in two companies. Willems continues: ‘ If people and companies are not changing their mindset from reactive to proactive we will have more problems than before compared to the mass-mailing worm years. In this particular case the companies were picked out as targets because they got old security solutions in place. This is a growing problem. ’
It can be seen that across most industry sectors, virus attacks have diminished, with only a few notable exceptions. The reason for this is that the attack profile has shifted considerably in the past 12 months. Gone are the days of the large scale mass-mailed virus outbreaks such as MyDoom and Sobig, belying the trend towards more small-scale targeted attacks.
These attacks are typically for the purposes of industrial espionage or intellectual property theft. In the last year the scope of these attacks has widened considerably, especially targeting small to medium sized businesses that are often the weaker link in a much larger supply chain. Throughout the last months NOXS continued to observe an increase in the level of sophistication in the nature of the targeted attacks facing businesses worldwide. Each targeted attack is very much tailored to particular needs in terms of which exploit is used, the social engineering techniques employed as well as which source IPs are used and what the targets will be. The number of low-level targeted attacks against businesses will continue to rise throughout the year, reaching levels of as many as 20 such attacks per day worldwide. These new kind of attacks are using one or two specifically crafted emails send out to one or two users inside the targeted company. By opening the email the user is mostly redirected to a new website which is using several exploits to trigger a download of a new backdoor to the user’s pc. After this the companies network is wide open to the other new created malware and spyware which can be dropped to the pc’s. The companies network at that moment can be used to target other companies networks, send out spam, gathering information and private data which will be misused again in future attacks. The value of the private information from a small to medium sized business is sometimes worth ten thousands of Euro’s which is high compared to the low investments for creation of the new malware.
The real problem however is to find these attacks as early as possible by some proactive approaches like Intrusion Prevention and other intelligent blocking techniques. Otherwise those newly created malware will be used in some attacks to other companies before they will be detected by the patterns of the anti-malware vendors. And this is problematic as the honey pots from the anti-malware or anti-virus vendors will not detect these in an early stage. A lot of companies are underestimating these new problems and are just continuing using old anti-virus technologies as their main protection. Traditional anti-virus solutions that are signature-based provide a reactive approach and require signature updates to be effective, providing little or no defense from these kinds of often unique targeted attacks, which may only be sent to one or two targets. Studies have shown that the typical time for signatures to appear for targeted trojans is still several weeks or even months. Companies need to realize that they cannot rely solely on traditional reactive methods and need to be proactive in their approach."
What do you think? Was the media capable of picking this up? Caused this the 'so needed warning' to the public?
Of course it did not, because it's just a small problem for two small companies... at least that's what was visible. When will people and media learn that even small things could be quite problematic for everyone. I predict hereby that this kind of attacks will becoming more and more problematic as small business are definitely not using the best protection and even this statement is an understatement.
You can find the original press release at the Belgium NOXS 'Expert News page' which you can find at
http://www.noxs.be .
And it's not the first time that such things appear. After publishing I got a reaction from a reader of my 'NOXS Expert News' Maarten Van Horenbeeck who saw the same things happening as well.
He wrote something about it at his website:
http://www.daemon.be/maarten/targetedattacks.html So it's like I told you: Targeted attacks are underestimated in Belgium. They are a problem worldwide! When will this stop?
The last two days I was visiting Amsterdam for a consultancy job. I visited as well the HQ of McAfee Netherlands to have a good chat with my friends George Doukatelis and Marius van Oers. When I arrived at my hotel I was asking for a wireless internet connection. 'It's not a problem' told the receptionist. 'It will cost you 5 Euro's for each hour as it was not included in the price of your room.' I rejected and wanted to find out if I could find maybe some other open connections. You guessed it: over 50 connections could be found at my hotel room with about 25 open (unprotected) wireless connections. So the internet connection was very cheap for me or my company... well I didn't try anything bad of course ... but it's indeed terrible. I tried to walk up on the street where I did find loads of other open connections. It seems that Amsterdam is not only well known for the openess about sex but also for the wide open wireless connections: the real hacker's paradise in my opinion. In the evening I went to a nice Michelin Guide recommended restaurant (see picture) with fair prices. I must say that I personally also recommend this good restaurant to anybody visiting Amsterdam. It's called 'Het TuynHuys' and it's located at the Reguliersdwarsstraat 28. And you can even pickup over there open wireless connections...sigh.
