Some Incidents Can Make Life Interesting

摘要

No Security manager wishes for a security incident. They can be costly, disruptive and a professional black mark. But getting to the bottom of a minor event - one that causes no real harm or has a minimal effect but isn't run-of-the-mill and therefore requires a bit of investigating - can make the job more challenging. You have to figure out just what happened so that you can prevent a recurrence, and you have to do it quickly so that damage is kept to a minimum. It's a time-sensitive task that requires quick thinking and expertise. We just had an incident of that sort, and it's an interesting story. It all started with a call to our HR department from the company that provides our 401(k) services. As happens from time to time, a rogue server had been identified by law enforcement. In extracting evidence from the server, they discovered that it contained connection information for the 401(k) administration site and the IP address of my company's corporate firewall. (We translate all of our internal desktop IP addresses to that external address.) Within the logs was a reference to ANTI-VIRXP08, which is a piece of malware that disguises itself as a virus detection tool. When a user is tricked into installing it, the malware will do nasty things, such as capture keystrokes and then "call home" with all the data entered or submitted by the victim.