IDG News Service (London Bureau) — Hackers appear to have stepped up their efforts over the past year to trick corporate executives into downloading malicious software programs that can steal company data, according to new data released Monday.
MessageLabs, a security vendor that offers e-mail filtering services to catch spam and malicious attachments, caught an average of 10 e-mails per day in May targeted at people in senior management positions, up from just one a day a year earlier, said Mark Sunner, chief security analyst.
Those 10 e-mails are a very small percentage of the 200 million e-mails that MessageLabs scans every day, but the composition of those messages is what's alarming, Sunner said.
Many of the e-mails contained the name and title of the executive in the subject line, as well as a malicious Microsoft Word document containing executable code. The hackers are trying to trick the victim into thinking the messages comes from someone they know, in the hope that the victim will willingly install, for example, a program that can record keystrokes.
MessageLabs won't reveal what companies have been targeted of late, but it has contacted executives who have been targeted and heard their family members have also received messages on their own, non-corporate e-mail accounts, Sunner said.
Those methods suggest that hackers may be researching victims and culling data from social networking sites such as Linked In, MySpace or Facebook, Sunner said.
"If you really want to work out somebody's background...you can actually find out a lot," Sunner said.
Tricking a relative into installing malicious code would offer the hacker another way to collect sensitive data, if an executive decides to do some work on a home computer, Sunner said.
During June, MessageLabs picked up more than 500 of these targeted messages, with some 30 percent aimed at chief investment officers—a position that can include handling acquisitions and mergers. Other positions targeted include directors of research and development, company presidents, CEOs, CIOs and CFOs.
Another danger is that the targeted messages are often just single messages sent to a single person, rather than a mass spam run. When hackers send out millions of messages, security companies often either update their software or change their spam filters to trap the bad messages.
But single messages have a higher chance of slipping through, although Sunner said MessageLabs' filtering service catches the messages by analyzing the e-mail's attachment and determining whether it is potentially harmful. Other security companies catch malware by updating their software with indicators, or signatures, to detect harmful code or block code from running based on what it does on a computer, a technology called behavioral detection.
Tracing where the messages come from is difficult, since the sender's name is always fake, Sunner said. The IP address from which the messages were sent indicates computers that are located around the world. Hackers often use networks of computers they already control, called botnets, to send e-mails.
"Certainly, people need to raise the level of vigilance," Sunner said.
