Forensic Investigators Track Times Attack Step By Step

The cybercriminals targeting The New York Times had specific instructions to attack two employees and, although they gained access to the account credentials of every employee, they stuck to their mission, according to the computer forensics team that investigated the incident.

The breach, which began with a spearphishing email laced with malware, targeted two reporters in the Times newsroom working on a story about Chinese Prime Minister Wen Jiabao and his business dealings. The attackers used custom tools, but the techniques used to find their ultimate target are common in most advanced persistent threats, said Richard Bejtlich, chief security officer of Alexandria, Va.-based Mandiant, the forensics firm hired by the Times to investigate the attack.

"They could have accessed hundreds of computers but they scoped it to only 53 and, even more specifically, they paid most of their attention to these two reporters who were working on a story that was of intense interest to the Chinese government," Bejtlich told CRN. "It's not consistent with a lot of other intrusions that we've seen, although this group that perpetrated this action had been active in hundreds of other companies."

[Related: China Attack On The New York Times By The Numbers ]

The intrusion lasted four months. Bejtlich said investigators could deduce what the tasking order looked like: Find out what the two reporters were going to say; find out who their sources were; and find out who they were speaking with.

Although the attackers used the same hacking techniques used in previous targeted attacks against Google, RSA, the Security Division of EMC and hundreds of other firms, the tools used by the cybercriminals linked them to a gang being tracked by security researchers, Bejtlich said.

Investigators found the forensic evidence linking the first victim of the attack. They then found the Trojan dropper used to establish a command post to remotely link up with the cybercriminal gang believed to be hired to conduct the operation. In total, more than 45 pieces of custom malware were used in the attack, mainly to remain stealthy on the Times' corporate systems, Bejtlich said.

"They used the tools they needed to get from one system to another," he said. "In this case we saw some custom tools to parse the reporter's email to look for data of interest."

NEXT: Anatomy Of The Attack Yields Ways For Better Defenses

Most cybercriminals begin their attack targeting the low-hanging fruit, Bejtlich said. Sophisticated methods are not necessarily needed to gain access to systems and files being targeted.

"These cases start out with the simplest thing you can do to get in the enterprise," Bejtlich said. "Once the adversary senses that you have found them and you start to kick them out, they switch to other tactics and they escalate to a better command and control, stealthier persistence and so forth."

It took a warning to alert the Times that something was amiss. The Times reporters were advised by an official with the Chinese government that there would be consequences if the stories were published. The Times reached out to its Internet service provider, AT&T, which indicated that it saw signs of network traffic that came from a Chinese threat group being tracked by its security researchers. The forensics team was then brought in to determine if a breach had occurred and eradicate any signs of cybercriminal activity on the network.

The attack on the Times and reportedly The Wall Street Journal as well, demonstrates the need for IT teams to monitor systems closely and have a rapid incident response plan when a potential problem is spotted, Bejtlich said. At the Times, the attackers moved throughout the company's systems, eventually gaining access to a domain controller containing the passwords of every employee of the company.

Bejtlich said rapid detection and response is important to contain and control the scope of the problem. Network segmentation is important to hinder an attacker's ability to move throughout corporate systems using legitimate account credentials. A third best practice is to have credentials that are not static, he said. Rather than using an employee's account credentials for IT assistance, temporary passwords can be used by IT administrators to remotely access employee computers.

"If you are monitoring your activity and you see people jumping from computer to computer, that is not consistent with normal business activity," Bejtlich said. "If you can detect that quickly and then contain it you can keep the bad guy from accomplishing his mission."

PUBLISHED FEB. 1, 2013