Earlier this year, investigators revealed that hackers had successfully infiltrated the network underlying the Nasdaq Stock Exchange. Although the gravity of the cyberattack was largely unknown at the time, new details have emerged to suggest that the perpetrators likely installed malicious software that has allowed them to spy on the directors of several publicly-traded companies.
In February, federal authorities told the Wall Street Journal that the Nasdaq's computer systems had been "repeatedly penetrated" by hackers throughout 2010. The infrastructure directly related to trade execution remained unharmed, but the full extent of the damage and potential motives for the attacks were not readily apparent.
"Many sophisticated hackers don't immediately try to monetize the situation," former World Bank security official Tom Kellerman told the Journal. "They oftentimes do what's called local information gathering, almost like collecting intelligence, to ascertain what would be the best way in the long term to monetize their presence."
A report released by Reuters last week has confirmed these suspicions.
Although the main trading platform remained unaffected, investigators discovered that hackers successfully infiltrated a web-based software program called Directors Desk. According to Reuters, corporate boards routinely used the program to share documents and communicate with executives from other firms. By successfully installing malicious applications within the system, hackers may have been able to monitor the business activities of "scores" of companies.
The data security loophole was first discovered in October of last year, but officials remain uncertain as to how long hackers had been targeting the vulnerability.
"God knows exactly what they have done," Kellerman told Reuters. "The long-term impact of such attack is still unknown."
Although National Security Administration security analysts have been managing the investigation, one private sector expert has offered speculation on the nature of the attack.
"Gaining remote access to confidential data held within the Directors Desk application could have been through SQL injection, broken authentication and session management, and URL restriction failures," Internet security analyst Gunter Ollman told CIO Today. "In my years of running penetration tests against Fortune 500 companies, these were the most common vulnerabilities that could be exploited to reveal this level of confidential data."
Although these web-based applications can offer companies impressive collaboration features and enhanced productivity, it is important to remember that they need to be protected with the same vigilant and proactive security measures as any other component of IT infrastructure.
Data Security News from SimplySecurity.com by Trend Micro