Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
7/13/2015
11:50 AM
Raj Samani
Raj Samani
Partner Perspectives
Connect Directly
Twitter
RSS
100%
0%

What Morpho Means: Why Hackers Target Intellectual Property And Business-Confidential Information

A quiet, professional cyberespionage group steals what every company wants to keep secret: valuable information that drives business. Welcome to the new normal.

Corporate cyberespionage made the front page last week with the news of Morpho, also known as Wild Neutron. Regardless of what you call it, this revelation was the latest reminder of the growing prominence of corporate espionage on the cyber landscape. The group targets major IT, pharmaceutical, legal, and commodity companies spanning the globe, with concentrated efforts in the United States, Europe, and Canada. It is highly organized and homes in on victims to gather confidential information for future monetization.

Here’s the quick and dirty on how Morpho operates: The group’s modus operandi is a combination of watering-hole attacks, zero-day exploits, and multi-platform malware. It compromises websites pertinent to the target, exploits them, and delivers either a Java-based zero-day exploit or a potential Internet Explorer zero-day exploit. Bottom line: This is cyberespionage via zero-day.

What we can draw from this is that the group either has the technical know-how to discover zero-days -- which is unlikely for a small group, as Morpho is suspected to be - or it has the resources to purchase zero-day exploits on the black market. Such a reliance on what we refer to as the Cybercrime-as-a-Service marketplace would reinforce our assertion that if you are well-resourced, the “services” are available to get into the cybercrime game.

Morpho used custom remote access tools (RATs) to sniff for targeted information or other computers to infect. This group also installed back doors, allowing infected machines to communicate with command-and-control servers over encrypted connections. The smartest thing this group did, however, was clean up after itself -- once emails and confidential information was stolen, Morpho securely deleted files and event logs. It was as if it had never broken in.

It’s because of this careful cleanup and precise execution of zero-days that Morpho has successfully operated since 2011. But Morpho’s success can be attributed to one thing above all: its single-minded and professional approach to compromising, extracting, and leveraging business-confidential information and intellectual property.

Both are valuable to hackers and can spell trouble for any business if they are lost to competitors.

Breaking It Down

Intellectual property, any work or invention originating from a creative source --from art, books, designs, images, logos, and company names to source code, product designs, and pharmaceutical formulas to building blue prints -- is as much an asset as financial resources, property, or physical product. Massive resources are allocated to developing complex products and unique concepts, the loss of which constitutes billions of dollars to companies working to develop ideas that boldly impact the future.

Large industries such as pharmaceutical, chemical, and technology -- the very industries targeted by Morpho -- are popular targets because their IP is easily reproduced or monetized. But smaller, disruptive companies developing new ideas, technologies, and products to challenge existing businesses and entire industries are by no means immune to such cyberattacks.

At what cost? That’s difficult to quantify for obvious reasons. If a factory burns down, a public company is obligated to reflect that loss in its financial statements. Cyberespionage crimes are as difficult to quantify in cost as they often are to detect. But the U.S. Department of Commerce has estimated IP theft of all kinds (not just cybercrime) as a $200 to $250 billion annual hit to U.S. companies. The Organization for Economic Development (OECD) estimates that counterfeiting and piracy cost companies as much as $638 billion a year. Such numbers have prompted McAfee Labs to conclude that cyberespionage breaches are the “crimes of the century” because they impact both society’s present and future economics and progress.

Business-confidential information could include investment data, resource exploration data, and sensitive commercial data such as trade secrets, processes, and contracts, and operational information. This information is almost always valuable and actionable, making it an attractive target.

Not too long ago, business-confidential information was at the center of sports-related cyberespionage involving two professional baseball teams: the St. Louis Cardinals and the Houston Astros. As we saw there and are seeing again with Morpho, information pertinent to business plans, contracts, and transactions is as valuable a commodity (if not more so) than intellectual property. By gaining access to confidential information, Morpho and similar cybercrime groups gain insight into an organization, discovering information that can be leveraged to preempt critical business transactions, product announcements, and investment news.

The Morpho group has succeeded because it has laser-like precision in what it’s looking for and how to go about getting it. Regardless of intention, tactics used, or business model, the main point is that one key common denominator is driving this sort of cybercrime: the value of information that drives business.

And as the world’s economies grow increasingly dependent on information as critical capital, cyberespionage is simply part of the global competitive landscape upon which businesses are competing today. The Morpho and Wild Neutron revelation suggests that any other assessment by executive suites -- anything less than the business-critical need to protect intellectual property and business-confidential information -- is dangerously naïve.

For more information on the cost of cybercrimes such as espionage, please see Intel Security’s report with the Center for Strategic and International Studies (CSIS) on the economic impacts of cybercrime and cyberespionage.

Raj has previously worked as the Chief Information Security Officer for a large public sector organization in the UK. He volunteers as the Cloud Security Alliance EMEA Strategy Advisor, is on the advisory councils for Infosecurity Europe, and Infosecurity Magazine. In ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ShawnM251
50%
50%
ShawnM251,
User Rank: Apprentice
1/13/2016 | 5:54:47 AM
Well written!
Today the World Wide Web is not just a network, it is like a wild world full of dangerous places and creatures (I mean hackers) that can attack you when you don't expect it. This doesn't mean that all the hackers are bad but still most of them are criminals. I decided to research on different ways to protect yourself and your repository of important data that is believed to keep everything in safe and made virtual data room comparison. Thanks to the author for such a nice post.
Frits Jansen
50%
50%
Frits Jansen,
User Rank: Apprentice
7/25/2015 | 8:25:05 AM
hackers do valuable work
This is a very negative article. Yes, there are criminal hackers ("crackers" is a better designation for these people) but for the genuine hacker is is just a game of curiosity to find out how things work. It is nearly a kind of science. Incidentally, true security like hackers since they find weaknesses in protection that need to be repaired. "Security by obscurity" is unreliable.

More fundamentally, innovation needs a free market and the free exchange of ideas. Hackers help to create and to spread ideas. Engineers complain that if their work is intended to be patented, they are no longer allowed to exchange their ideas with colleagues (unless they enter in a complicated legal hassle of non-discolsure areements that are prohibitive for all informal communication).

But may be blasphemy for people who make their job to protect intellectual property.

 
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
10 Notable Security Acquisitions of 2019 (So Far)
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12865
PUBLISHED: 2019-06-17
In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command.
CVE-2017-10720
PUBLISHED: 2019-06-17
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi name. This application is installed o...
CVE-2017-10721
PUBLISHED: 2019-06-17
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Telnet functionality enabled by default. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car ga...
CVE-2017-10722
PUBLISHED: 2019-06-17
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to connect to the device suffers from a stack overflow if more than 26 characters are passed to it as the Wi-Fi password. This application is install...
CVE-2017-10723
PUBLISHED: 2019-06-17
Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device Wi-Fi SSID can exploit a memory corruption issue and execute remote code on the device. This device acts as an Endoscope camera that allows it...