Oh dear, another big organization has fallen foul to the whole RSA SecurID hack – it seems that way anyway. In combination with a Spear Phishing attack (similar to the one carried out on high level US officials via Gmail recently) hackers have busted the IMF wide open.
It seems to be a very targeted attack and most likely uses multiple attack vectors rolled into one. The IMF has had to severe network connections with the World Bank as a precaution against further damage. Although they say it’s not linked to RSA SecurID – how can we be sure really?
The main problem with this situation? The IMF hold some EXTREMELY sensitive information about all kinds of nations and their economies.
The International Monetary Fund (IMF) has reportedly become the target of a concerted hack attack.
The resulting breach was severe enough for the economic development agency to temporarily suspend network connections with the World Bank, as a precaution. The link was quickly restored.
According to internal emails leaked to Bloomberg the precautionary disconnection followed the detection of “suspicious file transfers”. “[A] subsequent investigation established that a Fund desktop computer had been compromised and used to access some Fund systems. At this point, we have no reason to believe that any personal information was sought for fraud purposes.”
The IMF reported told staff on or around 8 June that it planned to replace RSA SecurID tokens used for remote authentication. RSA last week publicly offered to replace two factor authentication token after defence contractor Lockheed Martin said it had come under attack from hackers using information gleaned from an earlier high-profile attack on RSA back in March.
However an IMF staffer told the New York Times that the attack on its systems is not linked to the earlier RSA breach. Unconfirmed reports suggest that the IMF was the target of a spear phishing attack designed to plant malware inside its systems.
And the info about it not being linked to RSA SecurID comes from someone who actually works at the IMF, so it should be fairly legitimate info.
As per usual, in these kinds of situations – the IMF isn’t really saying a whole lot about what’s going on – unsurprisingly so. What we do know though is a senior official has stated that it was a “very major breach”.
It wouldn’t surprise me as well if they did get owned by a very accurate, targeted and personalized phishing attack.
If so – and it’s a big if – then the IMF has come under the type of attack previously faced by both a French economics ministry and its Canadian counterpart over recent months. Both the Canadian and French hack coincided with international government leader conferences.
The IMF itself is saying little about the attack other than to confirm that it is under investigation. The motives, much less the identity of attackers, remain unclear.
David Beesley, managing director of security consultancy Network Defence, said that targeted (spear phishing) attacks of the type that might have been launched can be very tricky but not impossible to thwart.
“Spear phishing is difficult to defend against because it primarily targets users not PCs, and the information that attackers can gather from social networking sites makes the phishing emails look very convincing,” Beesley said. “As we’ve seen, it makes these attacks effective against any size of organisation.”
“Really, firms need to use a mix of user education and layered security solutions to defend themselves. Employees should be aware that even plausible-looking emails should be treated with suspicion, and IT teams should look at their AV and anti-spam solutions to try and stop malware propagating,” he added.
So far we don’t know what the hackers were able to access and where the attack originated from (geographically speaking).
And well, it’s extremely unlikely they are going to publish details – because well that just doesn’t happen does it?
We’ll keep our ears to the ground anyway and see if anything else comes to the surface.
Source: The Register
nn says
dead to IMF!