January 18, 2008:
Corporate security
officials have been delivering some bad news to the U.S. Department of Defense,
and American intelligence agencies. It seems that the Internet criminals are
putting more effort, and skill, into seeking out corporate secrets. Why should
that trouble the Pentagon? Mainly because many of the corporate secrets sought
are all about military technology, and the U.S. government uses the same kind
of networks and software, and security tools, that corporations use. Worse,
corporate security tends to be better than what's found in government
organizations. So if the Black Hats (criminal hackers) are getting into
corporate systems, they can burrow into the Pentagon, and other government
agencies, as well.
The latest wave of attacks on
corporations are targeted. The hackers are going after specific people, who
have access to a limited set of valuable information. This is often done with
email that appears authentic, but actually contains hidden software that gives
the hackers access to the victims PC. Such messages will often be sent to
hundreds, or thousands, of people working in a part of the corporation that the
data thieves want to plunder. The hidden software is well crafted, and quite
capable of keeping itself hidden. This stuff is not invulnerable, but corporate
network guardians are appalled at how difficult some of it is to find and
remove. Sometimes the targets are a mystery as well. There has been quite a lot
of activity directed at health care records, which are being stolen and
transmitted to foreign locations. This is either to propagate some illegal drug
scam, or seek secret data on new drugs being developed.
From a military point of view, the fear
is that these thieves would hire themselves out to a foreign nation, to perform
espionage, or allow their hacking techniques and software to be used for
military purposes. No one will admit exactly how good the criminal hacking
tools and techniques are. But the implication is that it's more powerful than
what the military hackers have.
