{"id":7093,"date":"2020-12-10T14:36:17","date_gmt":"2020-12-10T14:36:17","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7093"},"modified":"2021-03-10T08:45:24","modified_gmt":"2021-03-10T08:45:24","slug":"fireeye-cyber-attack-an-attack-of-the-hgihest-level","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/fireeye-cyber-attack-an-attack-of-the-hgihest-level\/","title":{"rendered":"FireEye Cyber Attack: It Takes a Nation State Actor to Get a Good Cybersecurity Company Down"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7093\" class=\"elementor elementor-7093\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">As cyber security professionals, we constantly remind the people around us that it\u2019s not <\/span><b>if<\/b><span style=\"font-weight: 400;\"> a cyber attack will happen, it\u2019s <\/span><b>when <\/b><span style=\"font-weight: 400;\">a cyber attack will take place. No organisation is exempt from at least an attempt to hack them, and the <\/span><a href=\"https:\/\/www.fireeye.com\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">FireEye<\/span><\/a><span style=\"font-weight: 400;\"> cyber attack, on one of the world\u2019s leading cybersecurity firms is no exception.<\/span><\/p>\n<p style=\"font-weight: 400;\">\n<\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">FireEye announced this week that the company was breached by attackers. Without naming names, they also said that the attackers were a nation state with top-tier attacking ability (some commentators suggest Russian state agencies were behind the attack). Of most concern, the FireEye cyber attack used never seen before techniques to grab FireEye\u2019s toolkit. The concern is whether they can be used in future attacks on FireEye\u2019s customers, or other organisations.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">FireEye are more used to being the protector, not the victim. As well as several governments and government agencies around the world, they are used by high profile international companies who have turned to them when they have suffered a cyber attack. FireEye worked with <\/span><a href=\"https:\/\/www.vox.com\/2015\/1\/20\/18089084\/sony-hack-north-korea\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Sony<\/span><\/a><span style=\"font-weight: 400;\"> after they were attacked by North Korea in 2014, and with <\/span><a href=\"https:\/\/www.cnet.com\/news\/equifaxs-hack-one-year-later-a-look-back-at-how-it-happened-and-whats-changed\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Equifax<\/span><\/a><span style=\"font-weight: 400;\"> who suffered a major data breach in 2017, affecting millions of individuals worldwide.&nbsp;<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The FireEye cyber attack put them on the other side. As an attack on one of the most respected cybersecurity companies in the world, this breach will have significance for the entire cybersecurity community.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">What happened in the FireEye cyber attack?<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">FireEye\u2019s CEO Kevin Mandia <\/span><a href=\"https:\/\/www.fireeye.com\/blog\/products-and-services\/2020\/12\/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">released a blog<\/span><\/a><span style=\"font-weight: 400;\"> setting out FireEye\u2019s story. In this blog, he wrote that the attackers were able to get hold of FireEye\u2019s \u2018Red Team Tools\u2019, the tools that they use to replicate hacking tools when they are testing their clients\u2019 systems. These tools were built by FireEye based on their cybersecurity work. They don\u2019t contain any zero-day exploits (attacks for which there aren\u2019t any solutions), and FireEye say that they are of limited use to a threat actor.&nbsp;<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Mandia was also quick to point out that the attackers tried to access information about government customers, but that to date they can\u2019t see any evidence that the attackers were able to access any customer information.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">The FireEye cyber attack: sophisticated and new<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The FireEye hack is a hack at the highest level. The attack was carried out by a team of sophisticated threat actors, who showed incredible discipline and operational security, and used techniques that FireEye have never seen before. This was a targeted attack tailored specifically to attack FireEye.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">In order to carry out the attack, they created several thousand internet protocol (IP) addresses which had never been used in attacks before so they were entirely off the radar. Many of these IP addresses were US based addresses, hiding their location, and not raising red flags. They appear to have used considerable experience to move clandestinely through FireEye\u2019s systems and avoid detection.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Why were FireEye hacked?<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">This FireEye cyber attack has echoes of an attack way back in 2011. In that case stolen data from a <\/span><a href=\"https:\/\/gcn.com\/articles\/2011\/06\/07\/rsa-confirms-tokens-used-to-hack-lockheed.aspx?m=1\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">cyber attack on RSA Security<\/span><\/a><span style=\"font-weight: 400;\"> was then used to attack defence contractor Lockheed Martin. The threat actors had stolen SecurID authentication tokens and then used them on one of the company\u2019s high profile customers. At the time it was felt that the purpose of the attack on RSA Security was solely to access information pertaining to defence contractors.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">While the motive of the FireEye hack is unknown, it could well be that their customer list of governments and their agencies are in fact the ultimate target. That could be why FireEye responded the way they did. In the aftermath of the attack, FireEye published <\/span><a href=\"https:\/\/github.com\/fireeye\/red_team_tool_countermeasures\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">key parts of their stolen Red Team tools<\/span><\/a><span style=\"font-weight: 400;\">, and also released information of over 300 countermeasures to enable organisations to recognise their tools should they encounter them in the wild, and arm themselves against an attack using the stolen tools.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">The importance of cybersecurity protection<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">This attack is significant as it shows that no organisation is exempt from attack. It also shows just how far threat actors are willing to go in order to breach an organisation\u2019s defences.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">In the FireEye cyber attack, their Red Team Tools may have been stolen, but their defences were able to prevent the attackers from accessing customer information, which would have had far more significant consequences for FireEye, their customers, and cybersecurity as a whole.&nbsp;<\/span><\/p>\n<p style=\"font-weight: 400;\"><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/\"><span style=\"font-weight: 400;\">Infrastructure<\/span><\/a><span style=\"font-weight: 400;\"> and <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">network security<\/span><\/a><span style=\"font-weight: 400;\"> is key to ensuring that when a cyber attack does occur, the impacts are limited as far as possible, and the organisation is able to get back to business as usual as fast as possible.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Stay safe.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>As cyber security professionals, we constantly remind the people around us that it\u2019s not if a cyber attack will happen, it\u2019s when a cyber attack will take place. No organisation is exempt from at least an attempt to hack them, and the FireEye cyber attack, on one of the world\u2019s leading cybersecurity firms is no&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7100,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7093"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7093"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7093\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7100"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7093"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7093"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}