A report compiled by security firm McAfee, has revealed that hackers have run rampant through the networks of at least five oil and gas firms for years. The hackers exploited weaknesses by means of a combination of con tricks, computer vulnerabilities and weak security controls to gain access to the unamed multinational firms and steal secrets, it says.
The attacks used to break into all the networks were built around code and tools widely available in the undernet , said Greg Day, director of security strategy at McAfee. In this respect, they were not the most sophisticated of attacks but they were still extremely effective. In its report detailing what it dubbed the Night Dragon attacks, McAfee said the series of co-ordinated attempts to penetrate at least a dozen multinational oil, gas and energy companies began in November 2009. Five firms had confirmed the attacks, said McAfee.
In a long-running campaign, the attacks continued and the hackers methodically worked to penetrate the computer networks of these firms.
The first stage of the attack was to compromise the external server running a company’s website. Hacker tools were then loaded on the compromised machine and used to lever open access to internal networks. Then, cracking tools were used to gather usernames and passwords and get deeper access.
Once embedded, the hackers disabled internal network settings so they could get remote access to machines on the corporate networks. Via this route, sensitive documents, proprietary production data and other files were found and pilfered.
McAfee said the information stolen was “tremendously sensitive and would be worth a huge amount of money to competitors”.
Iran nuclear programme, AP The concerted attacks on oil firms resemble other specific attacks such as Stuxnet which targeted Iran
Mr Day said that although corporates were under attack all the time, the Night Dragon attack was no run of the mill incident.
“What makes this different is the very specific ongoing targeting of specific organisations with a very distinct purpose to what they were trying to achieve,” he said.
In that sense, he added, the attacks seemed to have a motive in common with that behind the Operation Aurora attacks on Google in China and the Stuxnet virus, which targeted industrial plant and machinery, and is thought to have been designed to attack Iran’s nuclear programme.
It was not clear if the Night Dragon attacks were state-sponsored, said Mr Day. Circumstantial evidence, such as the fact that all the attack activity took place during the Chinese business day, suggested China was involved but it was by no means conclusive.
Equally, the fact that during its investigation McAfee uncovered the identity of one individual based in China who provided invaluable aid and computer resources to those behind the attacks did not mean everything was backed by China.
The clues could be misdirection, said Mr Day.
“The attackers did not seem to be at all careful in covering their trail,” he said. “Was that just they were not that skilled or were they trying to leave a bread crumb trail to paint a false picture?”
Corporates were going to have to get much better at analysing the attacks hitting them, said Mr Day, if they were to avoid falling victim in a similar way.
“We have had a decade of cyber crime all about ‘write it, randomly spray it and see who falls foul’,” he said. “In the next decade many attacks will have a more specific purpose and they will keep going until they are successful.”