Welcome Guest. | Log In| Register | Membership Benefits
  • Email this page E-mail this page
  • |  Print Print this page
  • |   Bookmark and Share

APT Attackers Hit Japan's Biggest Defense Contractor

Targeted attack against Mitsubishi Heavy Industries demonstrates how APTs aren't just going after U.S. companies

Sep 19, 2011 | 04:29 PM | 0 Comments

By Kelly Jackson Higgins
Dark Reading
Mitsubishi Heavy Industries became the latest high-profile target of cyberespionage -- driving home the reality that the advanced persistent threat (APT) isn't just a U.S. problem.

This isn't the first time a Japanese defense contractor has been hit by APT attackers -- it's just the first time such an attack has gone public, security experts say. News of the attack was first reported in the Japanese press and was then picked up by Reuters today.

According to a translated statement by Mitsubishi Heavy Industries, which builds submarines, missiles, and nuclear power components, the company first detected the intrusion in mid-August.

"We've found out that some system information such as IP addresses have been leaked and that's creepy enough," a spokesman for Mitsubishi Heavy is quoted as saying in a Reuters report. "We can't rule out small possibilities of further information leakage but so far crucial data about our products or technologies have been kept safe."

Some 80 machines were infected with malware at the firm's Tokyo headquarters and manufacturing and research and development facilities: Kobe Shipyard & Machinery Works, Nagasaki Shipyard & Machinery Works and Nagoya Guidance & Propulsion System Works were among the sites reported to have been infiltrated by attackers. Around eight different types of malware were detected on the various machines, the reports said.

Richard Bejtlich, chief security officer and vice president at Mandiant, says the Japanese have been working on an initiative to defend against APT-type attacks. "There's no doubt that Japan is worried about Chinese espionage … I understand that there's an initiative starting next year to help their industry resist those attacks," Bejtlich says.

While the attack on a high-profile industrial power in Japan isn't really a surprise, it confirms theories that these types of attacks are a global problem. "It's validation that this isn't simply a U.S. problem," Bejtlich says. "Hopefully, people [worldwide] will realize this isn't a manufactured threat, but it's a real problem and fairly widespread."

Mitsubishi Heavy Industries, meanwhile, said in a statement that network addresses might have been leaked and that it's still investigating the attack and the extent of the data exposure.

"I don't suppose we need another wake-up call, but this news leaves a disconcerting after-taste," says Will Irace, director of research for Fidelis. "There are some good technologies available to help advanced persistent defenders safeguard their enterprises. But it still feels like we're fighting blind because targeted companies are reluctant to come forward with details on how they were victimized."

Irace says he'd like victims to cooperate more closely to share information. "The deck is stacked against them: Strategy is going to be at least as important as technology if they're going to catch up," Irace says.

Mandiant's Bejtlich says while the Mitsubishi attack isn't likely to help spur more cooperation among victim organizations around the world, it could encourage some diplomatic cooperation. "At the diplomatic level, it makes a difference," he says. "It continues to point to the Chinese as doing something that is not considered to be responsible."

There's really no technical way to resolve the cyberespionage problem, he says, but it could be addressed at the national and diplomatic levels.

Meanwhile, details were scarce about how the attackers got in and how far they got. Adam Powers, chief technology officer for Lancope, says it appears Mitsubishi Heavy Industries relied too heavily on its perimeter security. "Many organizations place the bulk of their cyberdefense technology at the perimeter of the network. Unfortunately, once the attackers breach the perimeter defenses, it's easy to compromise additional unprotected resources behind the outer wall. Once the attackers have a persistent foothold within the network, detection and remediation can become very difficult," Powers says. "Given the scope of the attack on Mitsubishi Heavy Industries, it may be months before all of the breached resources are discovered."

Mitsubishi Heavy Industries had $3.4 billion in contracts with Japan's Ministry of Defence for the year as of March – one-fourth of the agency's spending for the year, according to Reuters. The company makes surface-to-air Patriot missiles and AIM-7 Sparrow air-to-air missiles, and manufactures wings for Boeing's 787 Dreamliner jet.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.


Care to Comment?



Type the characters you see in the picture above.



Subscribe to RSS



Advanced Threats Reports

report Stuxnet Reality Check: Are You Prepared for a Similar Attack?
Stuxnet is a sophisticated, targeted weapon that proved utilities' seemingly isolated SCADA networks could be compromised, potentially disrupting energy production and distribution. In this report, we'll explain how Stuxnet penetrated Iranian nuclear facilities and propagated through their networks, and guide you in protecting against a comparable attack on your organization.

report Malware War: How Malicious Code Authors Battle to Evade Detection
The stakes have never been higher in the fight for control of corporate and consumer devices between malicious code and the antimalware software designed to detect and stop it. It's a war of one-upsmanship, as security labs work 'round the clock to analyze malicious code and the bad guys design new, ingenious ways to frustrate analysts and automated tools. This Tech Center report covers the key methods malware writers use to thwart analysis and evade detection.

Related Content

White Paper: Rationalizing AppSec Using Fortify
An evaluation of Fortify's software security assurance (SSA) solutions in context of the cumulative impact of software security vulnerabilities and the investments made to address them. Read IANS' assessment and key insights from end users in real-world enterprise software development environments.

Aberdeen Benchmark Report: Securing Your Applications
Is application security actually "free?" Aberdeen's research confirms that the annual cost of application security initiatives is outweighed by the benefits. Review how all respondents, from Best-in-Class to Laggards, experienced a positive return on their annual application security investments.

A Mainstay Partners Study: Does Application Security Pay?
Measuring the Business Impact of Software Security Assurance Solutions: a study of 17 organizations that implemented solutions from Fortify Software, combining industry research and benchmark analysis to identify, qualify, and quantify the full range of benefits seen from their SSA investments.

Expert Guide to Application Security - Real-time Hybrid Analysis
Explore the next generation of hybrid security analysis - what it is, how it works, and its benefits. This white paper details how hybrid application security enables organizations to resolve critical software security issues faster and at a lower cost than any other available technology.

Proactively Eliminate Risk in Software: HP Fortify Software Security Center
With business software virtually accessible from anywhere, applications now overreach standard perimeter defenses. Enterprises are finding that the effective way to secure software is by employing a Software Security Assurance (SSA) program to proactively eradicate risk.