Hackers Using Targeted Attacks To Steal Firms' Customer Data
Just as viruses mutate and become harder to attack, hackers have mutated their methods of stealing personal data.
In May, an intruder stole 40 million MasterCard and Visa-branded accounts stored in electronic vaults owned by CardSystems in Tucson, Ariz. The data broker acts as middleman between merchants and banks.
Rather than hunt and peck for security holes across a swath of companies as most hackers do, the intruder targeted CardSystems specifically. A series of instructions was injected into the company's computers from an off-site location in September 2004. Eight months later, on May 22, the script did its work. It extracted the credit card data, packed them into a zip file and exported them to the intruder's Internet address.
"Targeted attacks are the growth path of the future," said John Pescatore, a research analyst at Gartner, during a recent security conference put on by RSA Security. "Companies have gotten better at patching holes and catching worms. Targeted attacks are the next step up the food chain."
