HBGary emails out Morgan Stanley as Aurora victim

By

The global financial services firm was targeted by the same Chinese hackers that attacked systems at Google and Adobe, according to internal emails stolen from HB Gary.

Chinese hackers that attacked systems at Google and Adobe also infiltrated global financial services firm Morgan Stanley, according to internal emails stolen from HBGary, a security firm that was working with the bank.


In the emails, made public earlier this month by the activist hacker group Anonymous following a vengeful hack, an HBGary researcher said Morgan Stanley provided him details of the attack but asked that the information be kept secret.

The financial institution was one of those targeted in a series of coordinated attacks that have been dubbed “Operation Aurora.” Bloomberg News first reported this story on Monday.

“They were hit hard by the real Aurora attacks (not the crap in the news),” Phil Wallisch, senior security engineer at HBGary, wrote in a June 4 email to HBGary President Penny Leavy-Hoglund.

The attacks leveraged a previously unknown vulnerability in Internet Explorer to compromise systems at Google, Adobe and dozens of other companies. Morgan Stanley is the first financial institution to be identified as a victim.

“They have given me access to a very sensitive report on their Aurora experience,” Wallisch wrote in a May 10 email to Leavy-Hoglund.

In the same email, Wallisch said Morgan Stanley requested that he not share the information with anyone.  

In a statement sent to SCMagazineUS.com on Tuesday, Morgan Stanley said the incident occurred more than a year ago and the bank has notified regulators, law enforcement and a “handful” of clients who may have been affected.

“Morgan Stanley invests significantly in IT security and manages a robust program to deal with malware and attempted computer compromises,” the statement said. “Like any other company in our industry, we deal with these matters in the normal course of conducting business.”

Dmitri Alperovitch, vice president of threat research at McAfee said Operation Aurora-style attacks were happening on a daily basis but most were never disclosed.

“Most major global companies have come under these persistent and targeted attacks over the last few years and many have been successfully compromised,” Alperovitch said.

Operation Aurora is unique, he said, because of all the details that have emerged about the attacks.

Last January, Google disclosed that its systems were compromised to steal intellectual property on behalf of Chinese hackers. Adobe, Juniper Networks and Rackspace have also confirmed that their systems were targeted in the attacks. According to reports, Yahoo, Symantec, Northrop Grumman and Dow Chemical also were among the victims.

HBGary's internal emails, which out Morgan Stanley as a victim, were stolen last month by Anonymous after Aaron Barr, CEO of HBGary Federal, a sister firm to HBGary, told the Financial Times he planned to reveal his research around the activist collective at an upcoming security conference.

He never did. Barr has since resigned so he could repair his reputation.

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Victoria's Secret pulls down website amid security incident

Victoria's Secret pulls down website amid security incident

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?