Hackers are now hiding behind commercial security software

A previously undisclosed hacking campaign against military targets in Israel and Europe is probably backed by a country that misused security-testing software to cover its tracks and enhance its capability, researchers said. The attack program relied on software usually sold by Boston-based Core Security to companies and other customers that want to test their own defenses, said researchers coordinated by Israel’s independent Computer Emergency Response Team, or CERT. The researchers from CrowdStrike and startup Cymmetria will present their unusual findings at the annual Chaos Communication Congress security conference in Hamburg on Saturday. Criminal hackers have made use of penetration-testing tools such as Metasploit for years, other experts said, but most major government-sponsored hacks have specially written tools supplemented by free and widely available programs. That is in part because commercial programs could be traced back to specific customers.