Hacking Threat to Law Firms Pressures Corporate Counsel

Corporate counsel for law firms appear to be coming under alert to hacking threats. The implications, for instance, of Baker & McKenzie being hacked would be broad for both B&M and their client, Sony, in fallout over the PlayStation data-breach. Douglas Woods, attorney with the New York Office of Reed Smith LLP, places responsibility for strategic measures to prevent corporate hacking squarely with corporate counsel. Writing for Corporate Counsel on Law.com, Wood’s four-point advice for counsel includes:

1. Check the company's security systems. Chances are, they're not state of the art. Considering the potential damage a successful hacker attack can cause, only the best system will do.

2. Retain an ethical hacker, and perform a penetration test.

3. Assemble a crisis-management team that includes your legal, public relations, and government-affairs departments, along with an IT warrior. Hold simulations.

4. Audit the company's data security policies.

McAfee Threats Report: Androids Become #1 Target in Q2. New Hacker Tools Released.

The McAfee Threats Report for Q2 released today, reviews an unquestionably busy quarter for info-security worldwide including:

Chronology of the Anonymous/LulzSec split: detailing infighting and escalated hacktavist actions worldwide.

Android phone malware: android OS-based malware becomes the most popular phone malware for the first time, taking the lead over Java ME by a factor of 3X.

Cybercrime: Whether in Russia, Australia, or the US, the going rate for 1M stolen emails appears to be $25.00.

Crimeware tools: McAfee essentially prices and reviews new releases in Q2 for hacker tools and exploit kits, most notably Eleonore Version 1.6.5, with two 2011 exploits, and Best Pack, with one 2011 exploit.

Actions against cybercriminals: including the shutdown of the Coreflood botnet: “During an 11-month period starting in March 2009, Coreflood siphoned some 190GB worth of banking passwords and other sensitive data from more than 413,000 infected systems as users browsed the Internet, authorities said.”

Cyberwar: Access gained to the Oak Ridge National Laboratory supercomputer through phishing emails sent to 573 lab staff in April. Other incidents in Norway, Russia, and S. Korea.

Spam, Malware, Exploits: spam down, malware on a hockey stick, and exploits flat.

$20M Bank Heist Ring Busted in Ukraine. Hackers Face Two Years in Prison.

In addition to ranking the top 50 worst webhosts for repeat cybercrime, Host Exploit reports on the $20M theft from US and foreign banks at the hands of a Ukrainian hacker ring. As announced today by Ukraine authorities, the four initial members arrested face two years in prison:

The Ukrainian law enforcement agency said in a press statement that a long-term operation, held jointly with the U.S., led to the discovery of an extensive network of hackers involving more than 20 people of different nationalities who used high-tech equipment to steal from the bank accounts of unsuspecting customers.

The gang are said to have used specialized computer programs to gain access to confidential card information which they then used to make fake bank cards and to carry out the unauthorized transactions from the bank accounts of victims in a number of different countries. Stolen funds were transferred to bank accounts set up by other members of the group.

Council on Foreign Relations Reports on Massive Theft of Intellectual Property

Jonathan Masters, writing for the Council on Foreign Relations, interviews McAfee’s Dmitri Alperovitch over his intelligence threat report investigating wide-scale intellectual property theft over the net:

What do you say to the critics who claim that this notion of cyberwarfare is exaggerated and that organizations like MacAfee are potentially engaging in hyperbole because they stand to profit?

You can accuse us of whatever intentions you want, but try to dispute the facts that we're reporting - that massive sectors of our economy have been compromised and valuable intellectual property has been stolen (NYT). We're not the only ones saying that.

Google was very courageous in announcing their intrusions back in January 2010, and just recently RSA has announced intrusions (Bloomberg), as have Lockheed [Martin] and others. We're not the only ones pointing a finger at this problem. And when you go and talk to an official off-the-record, or even on the record, some will tell you the exact same thing - that it's a massive problem.

What percentage of cyberattacks - the ones discovered by the target entities - are reported?

Below 1 percent. And we've been involved in hundreds of investigations over the years. The reason we could not disclose most of them publicly is because of nondisclosure agreements. None of the companies have ever come forward. Most of the disclosures you've seen in the media, even this year, have been accidental leaks.