There's A Simple Way To Protect Against Chinese Hackers

There's a pretty simple way to keep your trade secrets secret from China's army of clever hackers: pause, breathe, and hover your mouse pointer over that email from a coworker.

Cybersecurity firm Mandiant has concluded that the onslaught of complicated Chinese Tactics, Techniques and Procedures to exploit systems and run your business into the ground starts with just a click — in particular, your click.

Imagine this: The names and emails of your staff, to include your executives, are either listed publicly, or accessible via the web in a matter of five diligent minutes.

Once you're targeted, and a hacker has that info, he then signs up for a dummy email account, named after your boss, your Chief Financial Officer or your fellow worker (often all three). Then you start to get emails from those dummy accounts, containing language commonly seen in the workplace.

The tactic is called "Spear Phishing," and it relies the user and reflexive clicking.

From Mandiant:

On some occasions, unsuspecting email recipients have replied to the spear phishing messages, believing they were communicating with their acquaintances. In one case a person replied, “I’m not sure if this is legit, so I didn’t open it.” Within 20 minutes, someone in APT1 responded with a terse email back: “It’s legit.”

The solution to this is simple: calm down, breath, and hover that mouse. Most browsers and email platforms allow users to identify the exact email of a sender.

So for example: If Henry Blodget emails me from hblodget@businessinsider.com, I'd know that from Henry's email. On the flip side, if he emails me from henry.blodget@rocketmail.com, then I shouldn't click.

Rather, I should contact Henry and ask him if he's been using a new email account.

These emails can also come from other sources, like faux PayPal (subject: "account disabled!") or credit card dummy accounts.

Within these emails is usually a harmless looking word document or excel spreadsheet which actually contains malicious code.

Once the code has penetrated the system, it becomes markedly more difficult for IT Officers to clean up the mess.

So the simplest defense begins with education of employees and personnel, not to click reflexively on seemingly "legit" emails — first hover, verify the source — generally emails from coworkers are over company platforms. Same goes for credit card companies: they don't shoot customers sensitive account emails from platforms like @rocketfish.com.

Now this isn't a guarantee, but according to Mandiant, it'll go a long way toward guarding secrets. So be smart, be patient, and avoid the reflexive click — your business may depend on it.