Ira Winkler: Shady Rat Case Shows Vendors As Big a Problem As APT Itself

Computerworld — McAfee reports a hack of unprecedented proportions , an attack referred to as an "advanced persistent threat" (APT), which potentially involved dozens of companies and organizations.

McAfee is then accused of trying to drum up business for its security services, and its competitors question whether this attack was really all that severe .

And I'm left wondering whether everyone isn't missing the point.

It's hardly news that vendors overstate the importance of their studies. But if what is being referred to as Operation Shady Rat isn't the worst, the biggest or the most damaging hack in history, the fact remains that APT is a chronic problem affecting organizations around the world. And when APT is involved, there are no minor attacks.

But instead of acknowledging that it's a serious matter that such attacks are, indeed, a chronic problem, Symantec (SYMC) treats that as a big yawn.

"While this attack is indeed significant, it is one of many similar attacks taking place daily," said Symantec researcher Hon Lau. "Even as we speak, there are other malware groups targeting many other organizations in a similar manner in order to gain entry and pilfer secrets."

Lau's point seems to be that McAfee shouldn't be trying to cause a stir with its report, because what it's reporting is nothing new, and that McAfee is no more on top of the APT situation than Symantec.

Meanwhile, Kaspersky stated that calling Shady Rat the "biggest attack is premature" when McAfee has provided very little information about what was actually compromised. It wants to see the details of what was compromised before it publicly entertains the notion. This is disingenuous. Kaspersky knows that a responsible security company, upon uncovering a major breach, would hand the investigation over to law enforcement. Assuming that's what McAfee has done, then it's not in a position to make public information that could compromise that investigation.

Most laughable is the Symantec line of attack that tries to puncture the seriousness of Shady Rat by questioning whether it constituted an APT.

"Is the attack described in Operation Shady RAT a truly advanced persistent threat?" asked Lau. He then calls the attackers sloppy, noting that they left their own command-and-control servers open to probing and used "relatively non-sophisticated malware and techniques."

This is a prime example of missing the point. Do Lau and Symantec not realize that "APT" is just a moniker, and not a definition of the attacks? The word "advanced" is not meant to imply that every element of the attack is state of the art, but only that a high level of resources and coordination is exhibited in the attacks. Whether the hackers achieved their goals through advanced techniques or were in fact sloppy is beside the point; they do seem to have achieved their goals. Likewise, if Lau has an issue with an APT server being hacked, all he has to do is remember Shawn Carpenter, the network security analyst at Sandia National Laboratories who five years back was the first publicly confirmed APT anti-hacker after hacking a variety of APT servers to uncover a treasure trove of counterintelligence.

Continue Reading