U.S. Chamber Of Commerce Hit By Chinese Cyberspies
Targeted attack against the nation's business lobbying organization zeroed in on Asian policy intelligence, according to The Wall Street Journal.
The latest casualty in China's alleged cyberespionage campaign against U.S. interests? The U.S. Chamber of Commerce.
Information on the Chamber's 3 million members, representing most of the top companies in the U.S., was potentially exposed in a targeted attack that might have been in operation for more than a year and was eventually halted by the Chamber in May 2010, according to a report inThe Wall Street Journal.
The Chamber poses an attractive target for spies with its corporate membership representing U.S. business interests, so it's no surprise it would be in the bull's eye of so-called advanced persistent threat (APT) actors, security experts say.
"It doesn't surprise me at all," said Jeff Schmidt, founder and CEO of JAS Global Advisors. "It's an amalgamation of American businesses: What better place [for these attackers] to go than the U.S. Chamber?"
What was most striking about this attack was evidence that the perpetrators specifically went after four employees of the lobbying organization who work on Asia policy, pilfering six weeks' worth of their emails. The six-month-long campaign involved some 300 IP addresses and compromised email of close to 50 members, who were told about the breach. Among the information exposed in the emails were trade policy documents, meeting notes, trip reports, schedules, and the names of members who are in contact with the Chamber, according to the article.
The Chamber's Asian group, among other things, helps U.S. businesses conduct business in China and Hong Kong. "That would be incredibly valuable information from a strategic perspective," said Anthony Bargar, executive VP of cybersecurity solutions for Foreground Security. "It's not only what data was stolen [here], but we should not discount what [may have been] manipulated to steer companies into China."
It's time to get going on data center automation. The cloud requires automation, and it'll free resources for other priorities. Download InformationWeek's Data Center Automation special supplement now. (Free registration required.)
Published: 2015-04-21 The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitive information via unspecified vectors.
Published: 2015-04-21 Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) start, (2) stop, or (3) restart services via a request to remote/serverServices.aspx.
Published: 2015-04-21 Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDragon before 126.96.36.19927 allows remote attackers to read or possibly delete arbitrary files via a .. (dot dot) in the QUERY_STRING to cfchart.cfchart.
Published: 2015-04-21 Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.
Published: 2015-04-21 XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.