Recent years have witnessed the surge of interest of security issues in cyber-physical systems. In this paper, we consider malicious cyber attacks in a remote state estimation application where a smart sensor node transmits data to a remote estimator equipped with a false data detector. It is assumed that all the sensor data can be observed and modified by the malicious attacker and a residue-based detection algorithm is used at the remote side to detect data anomalies. We propose a linear deception attack strategy and present the corresponding feasibility constraint which guarantees that the attacker is able to successfully inject false data without being detected. The evolution of the estimation error covariance at the remote estimator is derived and the degradation of system performance under the proposed linear attack policy is analyzed. Furthermore, we obtain a closed-form expression of the optimal attack strategy among all linear attacks. Comparison of attack strategies through simulated examples are provided to illustrate the theoretical results.