元器件交易网讯 5月20日消息，外交部就美国司法部宣布起诉5名中国军官一事发表谈话称美方蓄意捏造事实，外媒Los Angeles Times称中国军官涉嫌官向约20家美国钢铁公司员工发送恶意邮件。

　　美国司法部指控这五名军官侵入包含核能源、钢铁制造、太阳能等行业的多家美国公司电脑窃取信息，从事经济犯罪活动。起诉书共有56页，称其常用“钓鱼”手法，伪装成他人进行电子邮件诈骗。

　　美网络安全专家警告称该技术并不复杂，但不同于传统网络钓鱼，他们会伪装成熟悉的人来进行诈骗。起诉书中强调的实例包括其中一名中国军官向约20家美国钢铁公司员工发送邮件，并称自己为公司CEO。邮件中包含恶意软件，允许嫌疑人从后门侵入公司电脑。同时中国军官涉嫌发送主题为“美国钢铁行业”的伪装邮件，夹带秘密安装恶意软件的链接。（元器件交易网毛毛  摘译）

　　以下为原文：

　　that link your boss emailed you: make sureit’s actually from your boss and not a cabal of suspected Chinese militaryhackers.

　　That’s one of the biggest takeaways fromthe cyber-spying indictment unsealed Monday by the U.S. Department of Justice.In it, five Chinese military officers were accused of committing economicespionage by hacking into the computers of U.S. companies involved in nuclearenergy, steel manufacturing and solar energy.

　　One of their most common tactics, accordingto the 56-page indictment, was “spearphishing” -- a twist on traditionalphishing in which the scam email is made to look like it’s from someone youknow.

　　The technique isn’t particularlysophisticated, but cybersecurity experts warn that it can be tricky. Unliketraditional phishing, in which scammers send out a mass email hoping forsomeone to bite,  the spearphisher“thrives on familiarity” and “knows your name, your email address, and at leasta little about you,” according to the website for Norton, the malwareprevention and removal service. “The salutation on the email message is likelyto be personalized: ‘Hi Bob’ instead of ‘Dear Sir.’ ”

　　In one instance highlighted in theindictment, a Chinese officer allegedly emailed roughly 20 U.S. Steel employeespurporting to be their company's chief executive. The message included a linkthat installed malware that gave the alleged Chinese conspirators suspectsbackdoor access to the company’s computers, just weeks before the release of areport on an important trade dispute.

　　In another instance, the same Chineseofficer allegedly sent employees at the company a message with the subject line“US Steel Industry Outlook” -- also including a link that surreptitiouslyinstalled malware.

　　“Spearphishing messages were typically designed to resemble e-mailsfrom trustworthy senders, like colleagues, and encouraged the recipients toopen attached files or click on hyperlinks in the messages,” according to theindictment.

　　Spearphishers sometimes scan social mediasites, such as Facebook, to glean details about users’ friends in order to maketheir messages look more legitimate. These emails can refer to a recent onlinepurchase or a mutual friend, causing users to let their guard down and be morewilling to click or link or provide usernames, passwords or bankinginformation.

　　Jon Heimerl, a strategist for securityservices provider Solutionary, said he had one client, a CEO at a company, whobought a new BMW every three years. A hacker found out he was looking to buy,sent him an email purporting to be from a local BMW dealer and asking him tofill out a survey in exchange for a discount. Heimel said that after his clientdid so from his personal email account, a virus opened on his workcomputer  before sending out an emailfrom his work account to everyone in the company.

　　The subject line, Heimerl said, wassomething about the company getting acquired, which prompted nearly everyone toopen it.

　　“It pretty much shut them down for the better part of three days,” hesaid.

　　The best defense, experts say, is to limityour personal information posted online, keep your security software up todate, and most importantly, verify that the people sending you emails are whothey claim to be.

　　The consequences of not being careful canbe severe. One of the alleged Chinese phishers, according to the indictment,was able to steal host names and descriptions for more than 1,700 companyservers, including those that controlled physical access to the company’sfacilities and mobile access to the company’s networks.