http://www.nationaljournal.com/tech/this-defense-contractor-is-repeatedly-spear-phishing-68-000-innocent-people-20130403
By Brian Fung
National Journal
April 3, 2013
One company with deep Washington connections is running a huge online scam. It
involves tens of thousands of victims. And it's completely legal.
The business in question is Northrop Grumman, one of the country's biggest
defense firms. But before crying foul, know this: What the company's doing is
actually a good thing. No real damage is being done, and the only individuals
affected are Northrop employees.
In fact, the entire operation is itself a fraud. Cybersecurity pros within the
company are posing as outside criminals looking to breach the firm's defenses.
By sending fake e-mails to employees that encourage them to click on malicious
attachments or links—a type of attack known as phishing or spear phishing—the
firm's tech team is trying to understand how vulnerable Northrop's networks are
from real attacks. The exercise is also meant to teach employees how to
identify and report actual attempts at intrusion.
Here's how it works: Company security experts blast out a spoof e-mail to the
entire company that looks like it's coming from outside the network. In the
most recent example, 68,000 of Northrop Grumman's 70,000 employees got an
e-mail telling them they'd made an error on their tax returns. Some gullible
Northrop workers clicked the "malicious" link. Others recognized the e-mail for
the threat it was, and deleted it. But some employees reported the incident
back to the staffers who sent the test attacks.
[...]
______________________________________________
Attend #HITB2013AMS April 8th - 11th in Amsterdam.
Featuring over 42 international speakers and keynotes
by Bob Lord and Edward Schwartz http://conference.hitb.org
