(in) Security - Academic Conferences Limited

6.1 The tactic theme
Eric Filiol
Let us suppose that the WorldLeaderInManyThings company – a non European industrial consortium --
wants to take control over its commercial competitor the EuropeanLeaderInOneThing company. The
latter is struggling to develop a high-technology product – called StarWay project-- in critical field for the
European community which wants to equip Europe with its own system and therefore gain its strategic
independence. Indeed, Europe is currently depending on the WorldLeaderInManyThings company’s
country for that technology.
EuropeanLeaderInOneThing’s engineers, its CEO and CTO are frequently visiting European entities
both in Brussels and Luxembourg. Upon failure on developing this sensitive technology, the company will
face major financial problems and is likely to look for industrial partnerships. They are always lodging in
the FourGoldenStar Hotel with which they have a commercial agreement.
The deadline to deliver the technology is the end of November 2010. Then the industrial development
must begin.
6.2 The course of events
In March 2010, a major one-week meeting in Brussels takes place with the European technical
supervisors of the StarWay Project and the EuropeanLeaderInOneThing’s engineer team and
executive staff. A number of critical issues are to be discussed.
At the beginning of April, the EuropeanLeaderInOneThing company suffers from a series of computer
problems that jeopardize the project: data loss, development servers’ failure and unavailability... More
worrying, the business press and later the general press in Europe spread the news according to which
the StarWay Project will have to suffer from major delays and tremendous cost overruns. As a
consequence, the EuropeanLeaderInOneThing company shares are suddenly down of nearly 30 %
over the April month. The CTO is dismissed. The European commission asks for a financial investigation
and a technical evaluation of the situation. Two months later, an official announcement is made by the
EC: the StarWay Project is moved back at least one year while an addition of 1.5 billion of euros to the
project budget has to be made. The EuropeanLeaderInOneThing company shares are immediately
plunging after the annoucement (40 % down more). The company CEO is dismissed. A major crisis is
about to strike the company. At the beginning of september, the WorldLeaderInManyThings company
makes a takeover bid over the EuropeanLeaderInOneThing company. The shareholders massively
accept and the takeover is a success. The European commission delayed the StarWay Project until
further notice.
6.3 Course of events analysis
In reality all those events and the final outcome result from multi-level, multi-step computer intelligence
and computer attacks by the WorldLeaderInManyThings company against the
EuropeanLeaderInOneThing company. Its aim was first to get rid of a commercial competitor
(commercial interest) and second to make sure that the StarWay Project is questioned (strategic interest
for its home country). For that purpose, it has hired a few intelligence experts and hackers. We will call
them the A-Team.
In a first intelligence step, the A-Team has analyzed the habits of the EuropeanLeaderInOneThing
company engineers and staff that regularly traveled and stay in Brussels and Luxembourg for the
StarWay Project. The A-team quickly noticed that they were regularly using the wire internet accesses in
the Hotel business lounge or in the cyber cafe near the bar and restaurant they frequented downtown.
Listening to their discussions, they determined that the EuropeanLeaderInOneThing company CSO
strongly forbade the use of wireless network. Taking control over the hotel and Internet cafe computers
the A-team first installed computer surveillance. Hence it has been possible to gain a precise insight of
the security in force in the EuropeanLeaderInOneThing company. The A-team manage to steal
passwords of EuropeanLeaderInOneThing company email accounts, to collect a lot of sensitive
information on their USB key (including deleted ones).
In a second step the attack against the EuropeanLeaderInOneThing company LAN network has been
initiated. USB keys used by their engineers and CTO have been infected with malware that could not be
detected by the antivirus in place). Infecting Word and PDF documents was sufficient. A few days later,
111