Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/19/2011
04:29 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

APT Attackers Hit Japan's Biggest Defense Contractor

Targeted attack against Mitsubishi Heavy Industries demonstrates how APTs aren't just going after U.S. companies

Mitsubishi Heavy Industries became the latest high-profile target of cyberespionage -- driving home the reality that the advanced persistent threat (APT) isn't just a U.S. problem.

This isn't the first time a Japanese defense contractor has been hit by APT attackers -- it's just the first time such an attack has gone public, security experts say. News of the attack was first reported in the Japanese press and was then picked up by Reuters today.

According to a translated statement by Mitsubishi Heavy Industries, which builds submarines, missiles, and nuclear power components, the company first detected the intrusion in mid-August.

"We've found out that some system information such as IP addresses have been leaked and that's creepy enough," a spokesman for Mitsubishi Heavy is quoted as saying in a Reuters report. "We can't rule out small possibilities of further information leakage but so far crucial data about our products or technologies have been kept safe."

Some 80 machines were infected with malware at the firm's Tokyo headquarters and manufacturing and research and development facilities: Kobe Shipyard & Machinery Works, Nagasaki Shipyard & Machinery Works and Nagoya Guidance & Propulsion System Works were among the sites reported to have been infiltrated by attackers. Around eight different types of malware were detected on the various machines, the reports said.

Richard Bejtlich, chief security officer and vice president at Mandiant, says the Japanese have been working on an initiative to defend against APT-type attacks. "There's no doubt that Japan is worried about Chinese espionage … I understand that there's an initiative starting next year to help their industry resist those attacks," Bejtlich says.

While the attack on a high-profile industrial power in Japan isn't really a surprise, it confirms theories that these types of attacks are a global problem. "It's validation that this isn't simply a U.S. problem," Bejtlich says. "Hopefully, people [worldwide] will realize this isn't a manufactured threat, but it's a real problem and fairly widespread."

Mitsubishi Heavy Industries, meanwhile, said in a statement that network addresses might have been leaked and that it's still investigating the attack and the extent of the data exposure.

"I don't suppose we need another wake-up call, but this news leaves a disconcerting after-taste," says Will Irace, director of research for Fidelis. "There are some good technologies available to help advanced persistent defenders safeguard their enterprises. But it still feels like we're fighting blind because targeted companies are reluctant to come forward with details on how they were victimized."

Irace says he'd like victims to cooperate more closely to share information. "The deck is stacked against them: Strategy is going to be at least as important as technology if they're going to catch up," Irace says.

Mandiant's Bejtlich says while the Mitsubishi attack isn't likely to help spur more cooperation among victim organizations around the world, it could encourage some diplomatic cooperation. "At the diplomatic level, it makes a difference," he says. "It continues to point to the Chinese as doing something that is not considered to be responsible."

There's really no technical way to resolve the cyberespionage problem, he says, but it could be addressed at the national and diplomatic levels.

Meanwhile, details were scarce about how the attackers got in and how far they got. Adam Powers, chief technology officer for Lancope, says it appears Mitsubishi Heavy Industries relied too heavily on its perimeter security. "Many organizations place the bulk of their cyberdefense technology at the perimeter of the network. Unfortunately, once the attackers breach the perimeter defenses, it's easy to compromise additional unprotected resources behind the outer wall. Once the attackers have a persistent foothold within the network, detection and remediation can become very difficult," Powers says. "Given the scope of the attack on Mitsubishi Heavy Industries, it may be months before all of the breached resources are discovered."

Mitsubishi Heavy Industries had $3.4 billion in contracts with Japan's Ministry of Defence for the year as of March – one-fourth of the agency's spending for the year, according to Reuters. The company makes surface-to-air Patriot missiles and AIM-7 Sparrow air-to-air missiles, and manufactures wings for Boeing's 787 Dreamliner jet.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Data Loss Spikes Under COVID-19 Lockdowns
Seth Rosenblatt, Contributing Writer,  5/28/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13777
PUBLISHED: 2020-06-04
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TL...
CVE-2020-10548
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10549
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10546
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
CVE-2020-10547
PUBLISHED: 2020-06-04
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.