Video source: YouTube, FireEye
By Christopher Bing and Joseph Menn
(Reuters) – FireEye, one of the largest cybersecurity companies in the United States, said on Tuesday that it has been hacked, likely by a government, leading to the theft of an arsenal of internal hacking tools typically reserved to privately test the cyber defenses of its clients.
The hack of FireEye, a company with an array of business contracts across the national security space both in the United States and its allies, is among the most significant breaches in recent memory. The company’s shares dropped 8% in after-hours trading.
The FireEye breach was disclosed in a public filing with the Securities and Exchange Commission citing CEO Kevin Mandia. It said “red team tools” were stolen as part of a highly sophisticated, likely government-backed hacking operation that used previously unseen techniques.
It is not clear exactly when the hack initially took place, but a person familiar with the events said the company has been resetting user passwords over the past two weeks.
Beyond the tool theft, the hackers also appeared to be interested in a subset of FireEye customers: government agencies. “We hope that by sharing the details of our investigation, the entire community will be better equipped to fight and defeat cyber attacks,” Mandia wrote.
There is no evidence yet that FireEye’s hacking tools have been used or that client data was exfiltrated. But the Federal Bureau of Investigation and Microsoft Corp are helping to look.
“The FBI is investigating the incident and preliminary indications show an actor with a high level of sophistication consistent with a nation state,” said Matt Gorham, assistant FBI director for the Cyber Division.
Other security companies have been successfully hacked before, including Bit9, Kaspersky Lab and RSA, underscoring the difficulty in keeping anything digital away from the most sophisticated hackers.
“Plenty of similar companies have also been popped like this,” said a Western security official who asked not to be named.
“The goal of these operations is typically to collect valuable intelligence that can help them defeat security countermeasures and enable hacking of organizations all over the world,” said Dmitri Alperovitch, co-founder and former chief technology officer at top rival CrowdStrike.
FireEye disclosing what happened and which tools were taken, is “helping to minimize the chances of others getting compromised as a result of this breach.”
FireEye said it has been working to shore up defenses against its own tools with different software makers. The stolen computer espionage kit targets a myriad of different vulnerabilities in popular software products. It is not yet clear exactly which systems may be affected. But Mandia wrote that none of the red team tools exploited so-called “zero-day vulnerabilities,” meaning the relevant flaws should already be public.
Past hacking attacks on government agencies and contractors have captured such higher-value hacking tools, and some of those tools have been published, wrecking their effectiveness as defenses are put in place.
Both the NSA and CIA have been burned this way in the past decade, with Russia a key suspect. Russian and Iranian tools have been hacked and published more recently. Private surveillance software makers have also been targeted. Experts said it is hard to estimate the impact of a tool leak that focuses on known software vulnerabilities, but it could make attackers’ jobs easier.
“Exploitation tools in the wrong hands will lead to more victimization of people who don’t see it coming, and there’s already enough problems like that,” said Paul Ferguson, threat intelligence principal at security company Gigamon. “We don’t really need more exploitation tools floating around making it easier–Look at ransomware.”
Whenever private companies learn of a vulnerability in their software products, they often offer a “patch” or upgrade that nullifies the issue. But many users do not install these patches at once, and some do not for months or longer. “We are not sure if the attacker intends to use our Red Team tools or to publicly disclose them,” Mandia wrote.
Reporting by Christopher Bing, Joseph Menn and Jack Stubbs; Editing by Lisa Shumaker