Adobe has released a software update that addresses a number of critical vulnerabilities in its products. There is a good overview of this patch and what you need to do in order to apply it on security researcher Brian Krebs’ blog, Krebs on Security. Krebs has noted that the update comes a week after Adobe warned that a number of miscreants were exploiting the Flash vulnerability to launch targeted attacks on users. Cyber criminals have also discovered how to exploit a user’s Google Alert to gain access to sensitive information. Let’s explore how.

Targeted Attacks

The concept of targeted attacks and the use of this technique to punch through the security defenses of organizations is gaining momentum. This week, for example, we’ve seen a lot of coverage about yet another targeted attack against a large enterprise: RSA.

When reading about these attacks, it’s worth keeping in mind that most do not make the news for several reasons. One obvious reason is the fact that many of them have not yet been discovered. When an enterprise does discover an attack, those involved often fail to understand its implications. They simply disinfect their system and move on. IBM has been researching targeted attacks for years, and we have concluded that these types of attacks represent the future of online fraud and financial industry darkware.

To demonstrate the power of targeted attacks and why we should take them so seriously, I’d like to share with you one example of a simple and very effective targeted attack method. We’re in no way suggesting that this attack hit RSA, and we do not have any information about that particular attack. Let’s call this attack example Vanity Infection from Google News Searches (VIGNS). The purpose of the VIGNS attack is to place under-the-radar malware on a computer owned by an executive who has access to sensitive corporate information. Once the malware is on the executive’s computer, it can transmit information on an ongoing basis to an IP address of the hacker’s choice.

The attack process, as with any targeted attack, starts with some form of reconnaissance. The attacker searches the business social networking site LinkedIn for executives at the targeted organization. LinkedIn is the perfect tool for that: Cyber criminals can find victims easily by searching the company name and the role they are after. An attacker then reads the victim’s professional profile and decides whether he or she is a good fit. If the executive is a good fit, then all the attacker needs to continue the attack is the name of the victim.

Next, the attacker needs to build a Web page that infects its visitors. It doesn’t matter where the page is placed; criminals we have observed have access to a large number of compromised servers. The page itself exploits a zero-day or recently discovered browser or browser add-on vulnerability. The recently announced Adobe vulnerabilities are a perfect example and can be used to achieve this goal easily.

At any given time, it’s easy to find vulnerabilities that can be used for this purpose. The attackers now have a Web page that can be used to infect visitors with malware and the name of the victim whose computer they want to compromise.

Download Free e-Book: Stopping Zero-Day Exploits For Dummies

Using a Google Alert to Lure Victims

But how do they get the victim to visit this page? With the help of Google and their own vanity. Most executives tend to have a Google Alert set up on their name. By placing the victim’s name within the malicious Web page, it is possible to get Google to index the page and generate a Google Alert on the executive’s name. The executive will receive the alert and will most likely click the link to check on who is mentioning him or her. Clicking the link will take the executive to a malicious Web page that will then infect their computer — simple.

Here’s where it gets interesting. Our researchers have discovered a number of ways to get this attack to fly under the radar of IT security software. The first method is to delay posting the exploit on the Web page until after Google’s indexing systems have visited the page in question. This will minimize the time frame that the exploit is active and detectable. The attackers can easily check when Google visits the malicious Web page and turn on the exploit only after the search engine has made its pass.

The second method is to take the Web page off immediately after the malware reports back that it gained access to the executive’s computer. The malware will know where it has landed by looking at information such as the email account on the computer. This approach minimizes the time of exposure for the malicious Web page, as well.

The next method is to have the malicious Web page redirect to an old news page that legitimately mentions the executive’s name. When the executive accesses the malicious page the malware infects the computer, but since only an old news page appears, the victim does not suspect any problems.

Another method involves blocking any bots from visiting the malicious website other than those that the attacker wants to let in, such as Google. This prevents bots that are looking for compromised Web pages from tagging the page as infected or otherwise malicious.

It’s also worth noting that it is possible to apply a number of hacker techniques to ensure that the malware goes undetected. Even if the cyber criminals decide to use a known malware kit such as Zeus or SpyEye, they can generate a variant that is undetectable by antivirus products without much trouble. After testing the code with anti-malware software, they can limit its distribution to only the specified — and malicious — Web page. This will keep antivirus solutions from classifying it as a threat. The cyber criminals can even make the attack harder to detect by programming the malware to remove itself if it reaches the wrong computer, again by looking at simple parameters such as the email account configured on the computer.

For those readers who think we may be teaching criminals how to execute a targeted attack, rest assured that our research suggests that the criminals are much more sophisticated. This is, as I mentioned, a simple targeted attack, and we have seen far more complex and sophisticated attacks in the wild.

Protecting Yourself and Your Enterprise

So how do you protect against this type of attack? Being cautious is not enough. I consider myself to be fairly sophisticated when it comes to security awareness, yet even I would fall for this type of attack. Keeping systems and antivirus software up to date won’t help, either. The attack uses zero-day unpatched exploits and the malware is completely unknown to antivirus vendors.

One possible solution is to use tools that specialize in zero-day attack prevention, such as IBM Security Trusteer Apex Advanced Malware Protection. Our R&D teams are continuously incorporating new knowledge into the Secure Web Access product to block zero-day malware.

The difference between Trusteer Apex and other desktop security solutions is in our data-centric approach. We look at sensitive data and applications on the computer and identify unknown pieces of software that attempt to access them. Our software can then block access, report the attempt or remove the violating software from the computer. Since all of these attacks are ultimately looking for sensitive information, this approach is the most likely to detect and block any malicious software that has not yet been seen.

The methodology I have presented above is just one in a series of sophisticated targeted attacks we expect will be launched against organizations in the near future. We strongly recommend that organizations reevaluate their approach to targeted attacks. As we have witnessed with various incidents in the press, they represent the most dangerous type of threat to their business.