'Night Dragon' attacks from China strike energy companies

McAfee said the intrusions targeted intellectual property and have been going on for as long as four years

By , IDG News Service |  Security

"I don’t want to say it’s the thing right under the nose that you miss but it's the very reality that things get through due to the depth and scope of the world we have to deal with today," Day said. "We keep seeing all kinds of infiltration because of that challenge."

The attacks often focused on the companies' public-facing Web sites, which were attacked using methods such as SQL injection, where hackers try to get backend databases to reply to commands that should be blocked. SQL injection attacks can often return sensitive information or allow for different kinds of attacks.

Once a web server had been compromised, the attackers would then upload programs such as remote administration tools (RATs). Those tools are often used by system administrators to fix computers from afar, as they allow complete access to a machine and let administrators see the system as if they were sitting right in front of it.

From there, the hackers would browse around other areas such as Active Directory, a Microsoft system used to provision network access to employees on corporate networks. They used password-cracking tools to get privileged access to other services on the network containing sensitive information such as market intelligence reports and information on operational production systems, Day said.

Send news tips and comments to jeremy_kirk@idg.com

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Ask a Question