Commentary

Thomas Claburn
 

Google Friends Surveilled For Cyber Attack

Cardinal Richelieu, chief minister of France's King Louis XIII, is generally credited with saying, "If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him." Richelieu's claim attests to the ease with which information can be misused. It's a lesson that Internet users might want to revisit in this age of online insecurity.

Cardinal Richelieu, chief minister of France's King Louis XIII, is generally credited with saying, "If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him."

Richelieu's claim attests to the ease with which information can be misused. It's a lesson that Internet users might want to revisit in this age of online insecurity.The cyber attack from China that hit Google and at least 33 other companies began with a targeted phishing, or spear-phishing attack. Attacks of this sort typically consist of a forged e-mail message that appears to have come from a friend. The recipient opens it and clicks on the malicious link or opens the malicious attachment because he or she trusts the purported sender.


More Internet Insights

White Papers

More >>

Reports

More >>

Webcasts

More >>

According to a report published in the Financial Times on Monday, personal friends of employees at Google, Adobe, and other companies targeted in the attacks were "spied on" in order to make forged e-mail messages more plausible to the recipients at these companies.

This of course is how convincing spear-phishing attacks are crafted. An attacker isn't going to get convince anyone that he's a friend if he sends a message titled "thanks for celine dion tickets" and the recipient happens to loathe Celine Dion.

Such cybercrime missteps can be avoided though, thanks to vast quantity of information that people post to their Web sites and social networking pages.

And it's not just indiscreet college kids posting information that can hang them, so to speak. Far too many Internet users, in the business world and elsewhere, have revealed far too much online.

Consider the other breaking security story on Monday: At least three U.S oil companies were hit by targeted attacks from China. The Christian Science Monitor quotes an unidentified oil company source as saying, "We've seen real, targeted attacks on our C-level [most senior] executives."

Where, I wonder, might cybercriminals be getting the information they need to launch these attacks?

As Richelieu might say, give me six search results describing the most honest of men and I'll find something in them to "pwn" him.


Related Reading




Currently we allow the following HTML tags in comments:

Single tags

These tags can be used alone and don't need an ending tag.

<br> Defines a single line break

<hr> Defines a horizontal line

Matching tags

These require an ending tag - e.g. <i>italic text</i>

<a> Defines an anchor

<b> Defines bold text

<big> Defines big text

<blockquote> Defines a long quotation

<caption> Defines a table caption

<cite> Defines a citation

<code> Defines computer code text

<em> Defines emphasized text

<fieldset> Defines a border around elements in a form

<h1> This is heading 1

<h2> This is heading 2

<h3> This is heading 3

<h4> This is heading 4

<h5> This is heading 5

<h6> This is heading 6

<i> Defines italic text

<p> Defines a paragraph

<pre> Defines preformatted text

<q> Defines a short quotation

<samp> Defines sample computer code text

<small> Defines small text

<span> Defines a section in a document

<s> Defines strikethrough text

<strike> Defines strikethrough text

<strong> Defines strong text

<sub> Defines subscripted text

<sup> Defines superscripted text

<u> Defines underlined text

InformationWeek encourages readers to engage in spirited, healthy debate, including taking us to task. However, InformationWeek moderates all comments posted to our site, and reserves the right to modify or remove any content that it determines to be derogatory, offensive, inflammatory, vulgar, irrelevant/off-topic, racist or obvious marketing/SPAM. InformationWeek further reserves the right to disable the profile of any commenter participating in said activities.

Disqus Tips To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy.
T-Shirt Giveaway T-Shirt Giveaway: Each week we're selecting one great comment from our readers. The author of the comment will receive an InformaitonWeek Community t-shirt. So get posting!
Subscribe to RSS

Resource Links