Under Attack: Your Bank, Your Grid, Yourself
By Katie Benner
Bloomberg.com
Nov 13, 2014
Years ago hackers planted malicious software on computer systems that control parts of the United States’ critical infrastructure, including pieces of the electrical grid, gas and water systems. The malware, which the Department of Homeland Security warned about only last month, was dubbed BlackEnergy and traced back to the Russian government.
Whatever they were up to, the cyber-infiltrators didn’t use the digital weapons they’d planted to do any damage.
“This suggests that attackers are collecting detailed information on systems and processes running the vital infrastructure of the U.S.…to coordinate further attacks,” says Pierluigi Paganini, a security analyst who publishes the blog SecurityAffairs. The DHS conjectured that attackers planted the threat to deter a future U.S. attack. (Remember Stuxnet?)
The BlackEnergy intrusion is the kind of stuff that national governments typically do in attacks against one another, but it was also reminiscent of a recent corporate hack that hit banking giant JPMorgan last summer. Intruders nosed around the bank’s systems from June to August, undiscovered and uninterrupted. They didn’t take sensitive information like credit card and Social Security numbers, the stuff that sells for a lot of money on the black market. But they did leave malware in the network that could possibly let them further exploit or control the company’s system any time they wanted.
BlackEnergy and the JPMorgan hack have given researchers, government authorities and corporate guardians ample reason to wonder if we’re watching a nascent but significant shift in the security landscape – one that suggests that Corporate America is now subject to cyber-hacks and cyber-attacks once reserved for governments and critical infrastructure.
The recent hacks, as well as others involving Target and the United States Postal Service, show that attackers can squat on a network, undetected, for months. If motivated to do so, they could enter a system, study it and learn how to do more than just steal information.
The Rest…HERE
