[BreachExchange] U.S. cybersecurity firm FireEye discloses breach, theft of hacking tools

[Destry Winant]

https://www.reuters.com/article/us-fireeye-cyber/u-s-cybersecurity-firm-fireeye-discloses-breach-theft-of-hacking-tools-idUSKBN28I31E

(Reuters) -FireEye, one of the largest cybersecurity companies in the
United States, said on Tuesday that it had been hacked, likely by a
government, and that an arsenal of hacking tools used to test the
defenses of its clients had been stolen.

The hack of FireEye, a company with an array of contracts across the
national security space both in the United States and its allies, is
among the most significant breaches in recent memory. The company’s
shares dropped 8% in after-hours trading.

The FireEye breach was disclosed in a public filing with the
Securities and Exchange Commission citing CEO Kevin Mandia. A blog
post by the company here said "red team tools" were stolen as part of
a highly sophisticated, likely government-backed hacking operation
that used previously unseen techniques.

It is not clear exactly when the hack initially took place, but a
person familiar with the events said the company has been resetting
user passwords over the past two weeks.

Beyond the tool theft, the hackers also appeared to be interested in a
subset of FireEye customers: government agencies.

The chairman of the House Intelligence Committee, Rep. Adam Schiff,
said he would ask for more information. “We have asked the relevant
intelligence agencies to brief the Committee in the coming days about
this attack, any vulnerabilities that may arise from it, and actions
to mitigate the impacts.”

There is no evidence that FireEye’s hacking tools have been used or
that client data was stolen. But the Federal Bureau of Investigation
and Microsoft Corp are helping to look.

“The FBI is investigating the incident and preliminary indications
show an actor with a high level of sophistication consistent with a
nation state,” said Matt Gorham, assistant FBI director for the Cyber
Division.

A former Defense Department official familiar with the case said that
Russia was high on the early list of suspects. In the run-up to the
U.S. elections, where Russian interference was a prime concern, U.S.
officials exposed some Russian hacking techniques.

Other security companies have been successfully hacked before,
including Bit9, Kaspersky Lab and RSA, underscoring the difficulty in
keeping anything digital away from the most sophisticated hackers.

“Plenty of similar companies have also been popped like this,” said a
Western security official who asked not to be named.

“The goal of these operations is typically to collect valuable
intelligence that can help them defeat security countermeasures and
enable hacking of organizations all over the world,” said Dmitri
Alperovitch, co-founder and former chief technology officer at top
rival CrowdStrike.

FireEye disclosing what happened and which tools were taken is
“helping to minimize the chances of others getting compromised as a
result of this breach.”

FireEye said it has been working to shore up defenses against its own
tools with different software makers, and it released countermeasures
publicly.

Those showed that the tools uses modified versions of public programs,
said Vincent Liu, chief executive of security firm Bishop Fox and a
former National Security Agency analyst.

The stolen computer kit targets a myriad of different vulnerabilities
in popular software products. FireEye CEO Mandia wrote that none of
the red team tools exploited so-called “zero-day vulnerabilities,”
meaning the relevant flaws should already be public.

Past hacking attacks on government agencies and contractors have
captured such higher-value hacking tools, and some of those tools have
been published, wrecking their effectiveness as defenses are put in
place.

Both the NSA and CIA have been burned this way in the past decade,
with Russia a key suspect. Russian and Iranian tools have been hacked
and published more recently. Private surveillance software makers have
also been targeted. Experts said it is hard to estimate the impact of
a tool leak that focuses on known software vulnerabilities, but it
could make attackers’ jobs easier.

“Exploitation tools in the wrong hands will lead to more victimization
of people who don’t see it coming, and there’s already enough problems
like that,” said Paul Ferguson, threat intelligence principal at
security company Gigamon. “We don’t really need more exploitation
tools floating around making it easier - look at ransomware.”

Whenever private companies learn of a vulnerability in their software
products, they often offer a “patch” or upgrade that nullifies the
issue. But many users do not install these patches at once, and some
do not for months or longer.