From: Nextgov
By Aliya Sternstein
Unprotected computers at a cybersecurity contractor that services the Defense Information Systems Agency and many other federal agencies were compromised in a way that enabled the company’s product to run viruses on customer networks.
The incident echoes a 2011 hack job at security vendor RSA where outsiders stole the contractor’s proprietary login technology to gain access to RSA-protected defense companies’ networks. This time, the target was Bit9, a firm specializing in so-called application whitelisting, which is intended to allow only those software programs listed as safe to operate. Reporter Brian Krebs of the blog Krebs on Security broke the news of the breach Friday afternoon.
DISA, the departments of Justice and Commerce, Immigration and Customs Enforcement (an arm of the Homeland Security Department), the National Transportation Safety Board, Centers for Disease Control and Prevention, and General Services Administration recently acquired Bit9 tools, according to contract records, agency reports, and government spending databases reviewed by Nextgov.
Five of the top 10 aerospace and defense companies, along with more than 20 federal, civilian, Pentagon and intelligence agencies are Bit9 customers, the company’s website states.
Application whitelisting works under the premise that letting in only trusted, “signed” applications is safer than trying to block infections through anti-virus software, which does not spot viruses until they are discovered by researchers.
To undermine Bit9’s technology, intruders grabbed signed certificates from the company’s computers and used them on malicious software to trick customers’ Bit9-protected systems into executing what the systems thought were trusted applications.
Leave a Reply