Page 1 of 2
The cybercriminals targeting The New York Times had specific instructions to attack two employees and, although they gained access to the account credentials of every employee, they stuck to their mission, according to the computer forensics team that investigated the incident.
The breach, which began with a spearphishing email laced with malware, targeted two reporters in the Times newsroom working on a story about Chinese Prime Minister Wen Jiabao and his business dealings. The attackers used custom tools, but the techniques used to find their ultimate target are common in most advanced persistent threats, said Richard Bejtlich, chief security officer of Alexandria, Va.-based Mandiant, the forensics firm hired by the Times to investigate the attack.
"They could have accessed hundreds of computers but they scoped it to only 53 and, even more specifically, they paid most of their attention to these two reporters who were working on a story that was of intense interest to the Chinese government," Bejtlich told CRN. "It's not consistent with a lot of other intrusions that we've seen, although this group that perpetrated this action had been active in hundreds of other companies."
[Related: China Attack On The New York Times By The Numbers]
The intrusion lasted four months. Bejtlich said investigators could deduce what the tasking order looked like: Find out what the two reporters were going to say; find out who their sources were; and find out who they were speaking with.
Although the attackers used the same hacking techniques used in previous targeted attacks against Google, RSA, the Security Division of EMC and hundreds of other firms, the tools used by the cybercriminals linked them to a gang being tracked by security researchers, Bejtlich said.
Investigators found the forensic evidence linking the first victim of the attack. They then found the Trojan dropper used to establish a command post to remotely link up with the cybercriminal gang believed to be hired to conduct the operation. In total, more than 45 pieces of custom malware were used in the attack, mainly to remain stealthy on the Times' corporate systems, Bejtlich said.
"They used the tools they needed to get from one system to another," he said. "In this case we saw some custom tools to parse the reporter's email to look for data of interest."
NEXT: Anatomy Of The Attack Yields Ways For Better Defenses
1
|
2
|
Next >>
