Forest Global Training Partners

Cyber Risks · Krebs on Security

Bit9 Breach Began in July 2012

Summary: Bit9, a Waltham, Massachusetts security firm, was breached via an SQL injection attack on an Internet-facing Web server beginning in July 2012, and attackers stole a private digital certificate used to sign some 33 malicious files, three of which were sent to three of the company's customers. Bit9 says it first learned of the breach on Jan. 29, 2013, and the malware's control server traced to Taiwan, with the malicious media.exe compiled using Simplified Chinese characters and beaconing to an address in Singapore.

Bottom line: The attackers used a security vendor's own trusted signing certificate as the delivery mechanism, so the three affected customers received malware that their defenses were built to trust rather than block. Bit9 has declined to name those customers, describing them only as three non-critical infrastructure entities.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related