UK Critical Structures Targeted by Trojan Attacks

ElGanzoLoco writes "The UK's National Infrastructure Security Coordination Centre is reporting that key british infrastructures (government, telecom, transports, banks among others) are under attack by specific, targeted e-mail trojans. According to their report (PDF), 'the emails use social engineering to appear credible, with subject lines often referring to news articles that would be of interest to the recipient. In fact they are "spoofed", making them appear to originate from trusted contacts, news agencies or Government departments.'. The attackers are apparently trying to gather sensitive or secret data. While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia."

Comments

So are these the..?

[Bongoots]

Are these the Korean or Chinese hackers we have been told about in the recent geek fables?

Re:So are these the..?

[afterteatime]

Well since only old people target UK critical structures I'd say a good bet would be Korea

lol?

[Anonymous Coward]

If this is a sustained attack:
1) block these emails
2) educate staff to be aware of this atleast in the short-term
3) hold educated staff atleast partly responsible for any infections that result from this attack
4) we need to vote in a government that actually knows how to use a computer

Re:lol?

[technoextreme]

You know. I must have been spoofed about a hundred times from people wanting my bank account information. Unfortunately, the emails weren't from the right bank. Also, after a while I got curious and clicked on the spoofing links. The website was dead. If all spoofers are the same then I'd suggest that people should seriously think about firing those idiots in the UK. Also, where is the antivirus software???

Re:lol?

[BiggyP]

It could be that a lot of these links, the ones that appear dead, do so only because the spoofing vulnerability in use doesn't work in the browser you're using.

Imagine if the UK government stopped wasting vast amounts of money licensing windows for their end users and switched to something a little less bug ridden.

Re:lol?

[goatan]

A reply to both parent and grand parent.

If this is a sustained attack: 1) block these emails

That's why they put out this warning so those responsible can do this

2) educate staff to be aware of this atleast in the short-term

That's why they put out this warning so those responsible can do this

3) hold educated staff atleast partly responsible for any infections that result from this attack

We do.

4) we need to vote in a government that actually knows how to use a computer

No arguments here.

If all spoofers are the same then I'd suggest that people should seriously think about firing those idiots in the UK.

How do you meen all spoofers the same? Same person? Same site? Same trick? I think you mean the address, we had some of these where I work they weren't all from the same address but we had already been warned so nobody apend them. Why should someone be fired as the attacks have been unsuccessful because of these warnings. I could understand it if any damage was done but they have been successfully stopped from doing damage or getting information

Also, where is the antivirus software???

If you had read the link you would know that AV is not fully effective against this attack.

Re:lol?

[Bob3141592]

At least we can be confident that the highly trained, tech savy American Homeland Security systems will be perfectly secure.

Re:lol?

[budgenator]

1. antivirus software works by looking for signatures, modify the virus and you can change the signature. if the virus writer has up-to-date sigs, they can test the modifications to see if they have made the virus undetectable.
2. by targeting the virus to a limited range of targets, it's more difficult for the antivirus to find the new signatures for the virus
3. users in a protected enrivonment have a false sense of security making successful attacks more likely.
4. if the website is dead either law-enforcement shut it down or the operator shut it down having enough data to make the risk of capture higher than the value of continued operation.
5. how many businesses have actual training programs to instruct employees about fraud, espionage and subvertion anyways.

Re:lol?

[technoextreme]

It could be that a lot of these links, the ones that appear dead, do so only because the spoofing vulnerability in use doesn't work in the browser you're using. You mean Internet Explorer????? They actually fixed the phishing problem????? Nah.. More than likely the website was shut down.

Re:lol?

[denissmith]

4) we need to vote in a government that actually knows how to use a computer
And the Tories can? Besides most of the staff are non-politicals, changing governments won't change that.

Re:lol?

[Anonymous Coward]

"4) we need to vote in a government that actually knows how to use a computer"

Damn right you do:

12. Trojans often communicate back to the attackers using standard
application ports (for example TCP port 80, used for web traffic) making it very
difficult to detect the data they send and receive amongst legitimate network
traffic. Firewalls that allow access to these outbound ports will not block such
data.
13. NISCC is working with CERTs worldwide to neutralise IP addresses
used to send and control trojans used in these attacks.

I'm just a low level tech droid, but couldn't they just attempt to block these addresses at operator's backbones or shit like that?
More importantly, they have word firewall + IP addresses very close together in the text, but not just in same context.
Their firewalls cannot block ip addresses, because the port used is 80 and that makes it very difficult?? Indeed, is that what these jolly old chaps are talking about???

Of course it wouldn't solve the problem for good, but you know, it just might be that these people never get caught and could be doing this for a long time. Of course, TFA doesn't exclipitly say they are _not_ doing these things I mentioned already.

Re:lol?

[Sinus0idal]

It only makes it difficult because in general, the firewalls are set up to allow * out with a destination port 80. If they could be arsed, they could still block IP addresses. That said, then the attacker would just change IP or proxy. I also question how they know that most of the attackers are in a certain area. Could it not just be that the majority of open proxies are in that area, and that attackers from all over the world tend to use these proxies? Just a thought..

From those that brought you

[Trigun]

success through spam-jacking, comes the hit U.K. blockbuster 'Concerted Distributed National Espionage'. Let's get Nick Cage to play Tony Blair.

Obligatory

[Kelbear]

Shall I be the first to hail our new "Far-Eastern" overlords?

Far East Asia?

[EQ]

Perhaps the fabled North Korean Super Hackers at work?

Although why woudl they want anything to do with the UK? Isnt it the USA thats their bete noir?

Re:Far East Asia?

[koi88]

Although why woudl they want anything to do with the UK? Isnt it the USA thats their bete noir?

Maybe they're after James Bond...

Re:Far East Asia?

[oliverthered]

Like, the far east has super secure systems that hackers can't break into and use for sending out, spam, trojans etc...

Tracking something out of Asia is like tracking something in the black hole of Calcutta.

Re:Far East Asia?

[DrSkwid]

Although why woudl they want anything to do with the UK? Isnt it the USA thats their bete noir?

web of trust

Re:Far East Asia?

[jim_v2000]

Perhaps the fabled North Korean Super Hackers at work?

So sending mass spoofed emails is what it takes to be a North Korean Super Hacker, eh? Now those are 1337 H@x0rz.

Re:Far East Asia?

[Have Blue]

If you want to be as paranoid as possible, just for kicks, this is a trial run ;)

Re:Far East Asia?

[SmurfButcher Bob]

Well DUH,

If ANY foreigner tries to attack a computer in the US, they know Dubya will freakin INVADE!

Shocking

[Anonymous Coward]

that the UK is only now finding out about email scam tactics.
If we had been watching the rest of the world, we would have known the sorts of things to expect.

Makes me somewhat ashamed to be English sometimes...

Re:Shocking

[LiquidCoooled]

I've got some balls alright, I simply tabbed once to often.

We have seen major phishing attemps on the big US corporations for a while now, and people have been faking mails from ebay and the banks and everywhere else.

Only now that UK organisations are targeted do they start moaning.

There should be a concerted effort to stamp out this kind of shit targeting whichever organisation WORLDWIDE, not just a namby pamby "oh look our companies is getting done over".
Organisations and ISPs should supply enough information about online fraud to everyone who needs it, and shouldnt wait until they get hit.

Re:Shocking

[goatan]

I've got some balls alright, I simply tabbed once to often.

We have seen major phishing attemps on the big US corporations for a while now, and people have been faking mails from ebay and the banks and everywhere else.

Only now that UK organisations are targeted do they start moaning.

There should be a concerted effort to stamp out this kind of shit targeting whichever organisation WORLDWIDE, not just a namby pamby "oh look our companies is getting done over". Organisations and ISPs should supply enough information about online fraud to everyone who needs it, and shouldnt wait until they get hit.

Umm these sort of attacks have been known about for a long time this is information about a specific problem its called a warning it alows others to be aware that there is a new round of attacks going on and to be prepared if these e-mails come there way, that way less damage is done.

Do you think it's better that no one knows about this latest round of attacks or should we twiddle our thumbs saying "everyone else should know about this we have no responsibility to help"?

Re:Shocking

[krowten21]

First of all phishing is an attack against account holders of "Major US Corporations" not against those organizations. Vulnerability to targeted attacks using modified Trojans, while not new, is the weak underbelly of corporate security. No amount of security awareness training is going to stop somone from opening an email apparently from their boss that says: "Here is your performance appraisal, open immediately". There was a concerted (unreported in the media) attack against 5 big banks in New York a year ago. Customized viruses were used. It took major pressure to get the AV vendors to add sigs for these "non-wild" viruses. more at http://www.threatchaos.com/

Political Spin?

[Kinky Bass Junk]

While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia.

There's no doubt that these attacks will create a political spin, which could be their target in the first place. We all know there are many tensions between western and easter countries, particularly North Korea & China, and U.K. & U.S.A. This also goes hand-in-hand with previous stories saying there are highly skilled cracker armies in North Korea. I would say without a doubt that these are politically motivated.

Re:Political Spin?

[SenseiLeNoir]

Yes, but Tony B-Liar will have a MUCH tougher time trying to convince the rest of parliament and the UK Public to go after NKorea, or China just because of a few trojan emails.

The british public will blame the government for the lack of security than blame N.Korea, et al for this.

Mind you, this may be good for Linux Adoption!

Just like spam

[Anonymous Coward]

like most spam seems to originate in China but in reality its American spam gangs sending spam via China
iam sure this is no different

Re:Just like spam

[scsirob]

I would be very interested to know how they find ways to hop the Great Firewall of China twice...

Re:Just like spam

[1u3hr]

I would be very interested to know how they find ways to hop the Great Firewall of China twice...

China doesn't really care about through traffic, but about what their citizens are reading and writing. The "firewall" is just a wordplay, not a useful metaphor for how China manages its part of the net.

"Secret" data?

[ssimpson]

According to UK Government operational and configuration guidelines for classified system (primarily JSP440), any system containing CONFIDENTIAL or data with high protective marking just won't be connected to the internet so therefore won't get the mails and therefore won't be able to leak to the internet?

So how the hell would these PC leak SECRET data at all?

Re:"Secret" data?

[Kinky Bass Junk]

So how the hell would these PC leak SECRET data at all?

IANA, but in my understanding if a PC is compromised by a trojan, there is a lot it can do. Now confidential data may only be held on secure systems, but what happens when Joe from upstairs needs a copy of this, and for ease of work Jim (with a compromised machine) emails it to him, after getting it manualy? A combination of social engineering and use of compromised machines could get you a plethora of sensitive information.

Re:"Secret" data?

[ssimpson]

The program then needs to magically send data back out from the classified network to the internet, somehow. These networks (certainly all networks containing SECRET data and above) are physically disconnected from other networks and the internet, so I don't understand how this would occur....

Re:"Secret" data?

[Kinky Bass Junk]

What I meant was users with physical access to the disconnected networks pass on the information to co-workers through the internet-connected network. It's quite likely, really.

Re:"Secret" data?

[ssimpson]

Sorry, are you saying 1) someone gets and e-mail, transfers it to the SECRET network and then someone runs a trojan or 2) that the unclassified network will contain SECRET data copied either accidentally or maliciously by users

If 1) then my comment stands - the data has no way to get out from the air-gapped SECRET network

If 2), then this would be surprising. Most government employees that have sufficient clearance and have been granted access to SECRET material on a need to know basis are pretty well informed about the required Operating Procedures

Re:"Secret" data?

[FidelCatsro]

Trojans can do a fair bit of damage , but i don't yet think they have one which can print out a robot to go and swap the network cables around to put it on the internet... which raises the question of how it would get on a secure computer in the first place unless James Bond has gone rouge

Re:"Secret" data?

[Kinky Bass Junk]

I meant #2

If 2), then this would be surprising. Most government employees that have sufficient clearance and have been granted access to SECRET material on a need to know basis are pretty well informed about the required Operating Procedures

I was assuming (yes, i know, assumptions...) that users are still going to converse, possibly about the sensitive data, and as such may leak through these trojans monitoring emails.

I think that makes sense.

Re:"Secret" data?

[kc0re]

No, what's he's saying is.. SECRET and CONFIDENTIAL machines are connected to a "net" but not /the/ net. See there are other "nets" that never ever touch the internet. So his question is, how did information on a totally seperate net get onto the internet... The answer to that question is thumbdrives, floppies, or god forbit, a SECRET machine plugged into the Internet.

Re:"Secret" data?

[ssimpson]

Based upon work at a few highly secure sites, I am very confident that "business systems" networks don't knowingly contain protectively marked data, but I can imagine it happens accidentally from time to time. But in terabyte after terabyte of data on a non-classified network, it's going to be unlikely that a trojan just so happens to leak the protectively marked material.

I really had a lot of respect at how seriously DV people (the top clearance in UK) took protection of classified material. Even secretaries etc knew the rules.

Re:"Secret" data?

[goatan]

What I meant was users with physical access to the disconnected networks pass on the information to co-workers through the internet-connected network. It's quite likely, really

If they want to keep there job they won't do this, there are more secure ways that aren't much slower to get data to collegues. Also if someone wants data from the systems they need to supply a production request approved by the environment owner an approved e-mail request won't do.

Re:"Secret" data?

[ssimpson]

On sites with this level of security, thumbdrives, floppies etc are prohibited items. All staff that access SECRET material will be DV cleared and acutely aware that breaching Operating Procedures will result in instant dismisal and possible prosecution under the OSA.

Seriously, in normal business having lapse security is usual. In facilities that contain SECRET or greater material, the IT & business staff are generally anal about securing data and IT systems. USB ports disabled or removed, all hard drives locked in aproved cabinets over night, edge based routing and network authentication etc etc suplemented by random searches etc.

Re:"Secret" data?

[Anonymous Coward]

I think what he's saying is "So Bill, what do you think of section 1.4.b of , especially the section that says "All your base are belong to us"" Essentially learning about documents through side channels. Still highly doubtful given the operating procedures but for sure more likely to happen.

Re:"Secret" data?

[Stonehand]

Of course, as we all know from the reports of the mess at Los Alamos National Laboratories, it's very possible for a lab culture to be extremely casual about frequently breaching the mandated air gap. Just because the regulations exist doesn't mean that they're even remotely followed.

Re:"Secret" data?

[Jon Chatow]

All government departments now live on email - email over the Internet, that is - including with non-governmental parties and non-secure systems, all the time. The idea that they could function without being connected to the Internet, but simply some private internet, is unworkable.

Nor, for that matter, could they do what bits of the Armed Forces do - all emails to the outside world go to a special room where trained security operatives read the outbound email on one screen (a computer on the white network) and type it into another machine (on the black network), checking for release of documents. This is because "Here is today's draft of the Green Paper - any further comments", with a 500-page confidential document attached, is not something that can be readily re-typed. For "confidential"-tagged (and even sometimes "secret"-tagged) such situations, think of the CSRs (comprehensive spending reviews), where the Treasury gets terribly uppity about security.

Re:"Secret" data?

[budgenator]

I didn't find in the actual report PDF where they used the word secret or confidential as in government classified SECRET or CONFIDENTIAL, so the implication is the government data was as the report said sensitive or as it implied a business secret.
Also it may be that somebody wants to turn an employee so putting him in financial difficulty or learning an embarassing personal secret can have great rewards.

Re:"Secret" data?

[Beryllium Sphere(tm)]

Most government employees that have sufficient clearance and have been granted access to SECRET material on a need to know basis are pretty well informed about the required Operating Procedures

All it takes is one who thinks the rules don't matter or that he is above them. The USA had a CIA deputy director who took a laptop home with classified data and put it on the Internet

Re:"Secret" data?

[Afrosheen]

"unless James Bond has gone rouge"

I don't think he'd look too good in red. The black tuxedo is a good trademark for Bond.

Re:"Secret" data?

[Cally]

Yeah, yeah, you're very clever.

Commercial organisations have plenty of small-ess secret data that others would be interested to see. Same goes for government. (Consider a typical leak of info on, say, transport dept plans for road charging (random example) to the press.

Disclaimer: I work for Messagelabs; read the Register story to see the connection.

There's a lot coming from 222.136.55.64

[NigelJohnstone]

Seems to be a lot coming from one IP address.

----------------------
"Rejected mail, The original message was received at Fri, 17 Jun 2005 08:05:12 +0800 from uniontrib.com [121.206.16.100]."
Actually its a trojan (a.COM) in a zip file.
Comes from 222.136.55.64 = China
-----------------------

"RETURNED MAIL: SEE TRANSCRIPT FOR DETAILS"
Another from 222.136.55.64 ....

I think they're just paranoid, we have nothing to do with security or government, yet we get these trojans all the time too.

Re:There's a lot coming from 222.136.55.64

[Cally]

This is not about the stuff your spam filters or anti-virus software detect. Read the NISCC advisory. Lond doc short: they're hand-optimised apps, each used for a specific, targetted organisation. Signature-based virus scanners won't detect these (which is why Dr Evil is producing them and only usnig them for a small number of targets before moving on to the next one.)

Disclaimer: I work for Messagelabs (hint: we have our own in-house scanning technologies that work differently to typical a/v, and... well, go read the Register story as well for the ML connection.

Posting on behalf of myself only, of course.

China and Russia according to Radio 4

[lxdbxr]

On the Radio 4 "Today" program this morning they covered this story, the correspondent basically said that NISCC knows where the attacks are coming from (& I would be surprised if they didn't, NISCC are pretty competent people), but did not spell it out in the report to avoid diplomatic complications. The Radio 4 guy reckoned that these specific, targeted attacks (mostly against gov.uk) were coming from China and Russia, though whether private or state actors he didn't say.

No mention of North Korean superhackers, I was a little disappointed :-)

Re:China and Russia according to Radio 4

[Anonymous Coward]

No mention of North Korean superhackers, I was a little disappointed

North Korea doesn't have any direct international inter-connections because of sanctions so they piggy back off their big brother; China.

British government hit by spam! Declares emergency

[khasim]

A number of open source3 and bespoke trojans, altered to avoid antivirus
detection, have been used. The wide variety and constant evolution of
the trojans used appears to be an attacker strategy to identify the conditions
needed to successfully penetrate a network.

Sounds like the regular spam and virus crap I get.

Maybe the "far eastern" enemies think I'm part of the British government?

Investigate anomalous slow-running machines, looking for unknown processes or unexpected Internet connections, as this may be an indication of malicious programs operating in the background. User reports of such behaviour should be encouraged and fully investigated.

Oh yeah. That's going to be GREAT!

No more of those "reboot and see if it fixes the problem" comments. Now it has to be "fully investigated".

Implement spam filtering to guard against infrastructures commonly used by the attackers. Anti-spam measures such as greylisting/blacklisting of dial-ups, open proxies and open relays, in addition to more sophisticated methods (e.g. Bayesian filtering) can be effective protective measures.

But I already do that.

Wow, my email system is more "secure" than the British governments! Who would have guessed!

By way of the user

[Animaether]

So how the hell would these PC leak SECRET data at all

By way of the user behind it

Who needs access to the actual data files when you can trick the person behind the machine into giving the data (be it the files, be it just some quotes/numbers, be it whatever) to you ?

That's how the vast majority of these things work after all.

This is fucking retarded.

[t_allardyce]

There's no way this could work without shear stupidity - are they using Outlook? is it running scripts? are they opening executable attachments? For fucks sake, why is my tax money being wasted when it clearly needs to be spent, today, on some 30 minute training, to educate government computer users on some very simple and very effective ways of defeating this sort of crap. This country used to be run like clockwork, its going down the drain.

Re:This is fucking retarded.

[dissolved]

You're assuming the outsourcer that is given the huge contracts to supply and support is actually interested in preventing these issues. When contracts worth millions are sold around 24/7 support at a predicted level why would they want rid of end user tomfoolery?

Re:This is fucking retarded.

[c_g_hills]

There's always the possibility that someone other than the intended recipient reads the mail, such as a temp, who hasn't been trained against espionage. Most of these attempts fail but occassionally they do work! The more you try the better chance you have of succeeding.

Re:This is fucking retarded.

[t_allardyce]

Yes and this is why privatisation of the government is a stupid idea. Why should greedy idiots get public funds so they can cut corners and turn a profit, when the whole point of the government is to organise and run the bloody country themselves - that's what we pay them for, or at least that's what we should be paying them for.

Yes I know how capitalism works, I just think the government is generally an exception.

Re:This is fucking retarded.

[kilodelta]

Government agencies in the United States are Microsoft Lapdogs.

And yes, they use Outlook. Until Mozilla Lightning comes out there won't really be any viable options.

But what really has to happen is for a drop-in replacement for MS Exchange with it's calendaring, groups, etc.

From what I recall, the Mozilla folks are working on that but it's a project thats 5 years down the pike.

SANS Community

[kc0re]

The SANS community broke this news yesterday on the DShield listserv... Check out Incidents.org for the current news concerning it. As well as the ongoing investigation.

British or Global problem?

[Claws Of Doom]

I question the tone of the headline and the content. The implication is that British sites are being targetted exclusively. Being a British Government publication, this would have been their remit. I think that if the net was thrown wider you'd see that this is a general problem for the internet as a whole, and also for personal as well as business and Government computers. The article is correct in so far as it goes, but is far to narrow its view to be newsworthy. It would have been far more interesting if they'd found that other territories weren't being targetted. My suspicion is that there isn't any targetting - only carpet bombing.

Re:British or Global problem?

[budgenator]

perhaps specific targets are targeted initialy, then a carpet-bombing to cover their tracks? or even more likely since everybody is being carpet-bombed, a specialized attack might just fly under the radar.

Send in Austin Powers, he knows Trojans

[digitaldc]

The obvious solution to this problem is to recruit Austin Powers and have him go back in time to around 1995 to Microsoft Headquarters and take over their security services department. Then by sheer mojo, he will re-engineer the software to prevent these types of intrusions. Problem solved, the Queen is saved!

Why on Earth are these machines running Win32?

[SysKoll]

From the article: Implement operating system and software updates to patch the vulnerabilities exploited by these trojans. As Microsoft Office vulnerabilities have been particularly exploited, advice contained in all Microsoft security bulletins should be followed. These can be found at: Microsoft Security Bulletin Search http://www.microsoft.com/technet/security/current. aspx

Maybe I am missing something, but why do the Brit spooks perform classified work and put secret documents on Windows machines? If all they want is to provide a click-and-drool interface to their secretaries, the Mac is perfect, not to mention open-source OSes.

So why are the British taxpayers allowing them to weaken national security and waste their money, just to enrich a non-UK software company? Isn't it betrayal?

Re:Why on Earth are these machines running Win32?

[Turn-X Alphonse]

Welcome to the Government here. No matter what we say they ignore us, bullshit idiots then ignore them again for another 4 years.

We're sick of it just like everyone else is, it's just that we can't do anything. We all opposed a war yet we still took part for example.

People have given up on politics and the government has given up on common sense and the citizens.

Re:Why on Earth are these machines running Win32?

[vrai]

This isn't flamebait, it's the truth. The UK would be a much better place if all our politians were wiped out in some kind of terrorist attack/lucky accident.

Targeted Attacks

[mulhall]

The real issue is that they are describing massive targetted attacks, which is why it's not regular spam/worm/trojan stuff. Supposedly the targets are government and financial sector businesses.

Given past experience....

[Anonymous Coward]

... I've got a pretty good idea what these "convincing emails from government officials" look like.

GOOD DAY

MY NAME IS PRINCE NARIB ABDULLAH HERZEGOVINA OOGA-BOOGA. I RUN AN OIL COMPANY IN NIGERIA. I AM CONTACTING YOU BECAUSE I NEED YOUR HELP.

I HAVE $20,000,000 WHICH I NEED TO GET OUT OF NIGERIA AND INTO THE UK. I WANT TO USE YOUR BANK ACCOUNT IN ORDER TO DO THIS.

I HAVE GIVEN THIS MUCH THOUGHT AND I AM PREPARED TO OFFER YOU 20% ($4,000,000) FOR THIS SERVICE.

PLEASE CONTACT ME AT YOUR EARLIEST CONVENIENCE SO WE CAN DISCUSS THIS!!!oneoneoneOMGWTFBBQ!!

nope..

[SolusSD]

just the same trojans that everyone gets. ;)

Many Asian servers are blind relays/open proxies

[Anonymous Coward]

Quoting the intro:
While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia.

And the only hope to trace theses is that the servers save logs and the admins know how to access them and will cough them up for people calling from the UK claiming to be investigators.

Doesn't work

[CrazyJim1]

I get emails from ebay.com, but they're sent from hackers who want my ebay information. If I was to block the email, I wouldn't get anything else further from ebay when they sent legitamate emails.

If I wasn't moral, I'd have been doing this crap since the early 90s. Luckily, so few people do it, that the FEDS could generally bust people by simply walking into the trap, then tracing the information.

The problem comes when the attack is from oversea. The feds want to bust them, but they people they want to bust are foreign hackers, hired by the government. When someone is doing some sort of trivial hate crime at you, you can't do anything but say,"please stop it." Its like little kids on the playground that get poked by someone else. Its not worthy of a punch in return, but its still annoying.

Re:Doesn't work

[Stupendoussteve]

I get emails from ebay.com, but they're sent from hackers who want my ebay information. If I was to block the email, I wouldn't get anything else further from ebay when they sent legitamate emails.

Block the IP from hitting up your SMTP servers, not the specific email address. These are not hackers, these are scammers. Scammers (and anybody else) are able to send you an email with a link that says "ebay.com" but in html says "231.12.255.255/fakeebay.cgi". They depend on uneducated people believing that links are always what they say they are.

Luckily, so few people do it, that the FEDS could generally bust people by simply walking into the trap, then tracing the information.

The Feds do next to nothing about this because so few people do it.

The feds want to bust them, but they people they want to bust are foreign hackers, hired by the government.

As mentioned, the feds don't really do anything... and saying they're "hired by the government" is being a bit forward... there's no proof of this anywhere.

Yawn, more lies

[Anonymous Coward]

Lies spun out by a lying government (Iraq/intelligence/wmds), trying to wear and grind public opinion towards the 'need' for more security and less freedoms.

If it were that mission critical and important they wouldn't have made this announcement anyway. So we can safely conclude it's just more spin.

Unfortunately no one could care less what happens to any 'critical' government institutions anyway. It's not like anyone is going to weep.

The war is over guys. Democracy has been abused and our leaders are disgraced...etc...etc...well tinfoil/conspiracy I guess...yeah but it's also one of those things that's sad but true unfortunately.

Ahh Social Engineering

[snortCrush69]

Once again charisma and believabilty > Technology. So many Network Admins become enamored with firewalls, IDS, and other kinds of tech savvy protection, that they usually will hold the door open for social engineers. Until employees and users are better educated and social engineering becomes part of the corporate threat model, we're going to see these types of attacks continue to grow in number

Re:Ahh Social Engineering

[anubi]

I think you see the condundrum for what it is...

We now have a system where it doesn't take a big investment to make a perfect impression. Just about anybody with any machine can easily produce web content that is at least equal to, and in many cases, far superior to what corporate entities can do ( as corporate entities are likely to use canned authoring solutions that are a thinly veiled coercion to force the public to use an OS which is compatible with them. ) Exact replicas of corporate logos are made with a click of the mouse. Redirection can be used to make connections to one entity look like another...

And worse upon worse, the growing enforcement of computer ignorance in the name of DRM, where the consumer is forced to rely on the honesty of the code vendor, not their own cognition of his work. Its like being asked to sign legal documents written in a language only the lawyer - by means of IP law - is allowed to understand. When we give up the right to understand what we are doing, well... as one guy noted... hilarity ensues.

Its not the system thats fubar. Computers are really quite simple things that always do exactly what they are told to do. ( barring hardware malfunction, of course )... The problem is us! We are the ones who stand by idly while special interest groups go off forming special cliques and coin languages of their own so we can't understand them.

Its kinda funny how businessmen here in Southern California can come down hard on a bunch of Mexican immigrants for using their native language in the workplace, because their communications cannot be understood by the boss... yet these same bosses readily install extremely critical computational infrastructures without having the foggiest idea how they work!!!

I don't see the problem as being computers or the internet, any more than I see fire being a problem when it comes to destroying homes... Both of these are examples of very powerful paradigms which can be very hazardous if their properties are ignored, but extremely beneficial to those who have the intelligence to understand what they are dealing with and how to use it accordingly.

This virus crap will go away when we learn the risks of being ignorant of what we feed our computers, just as many of the risks of fire are eliminated when we understand the chemistry of combustion... and know not to do things like pour gasoline around gas water heaters and the like. As long as we ignore the hazards of allowing ourselver to be ignorant of the instructions we allow others to feed our machines, we might as well be opening bottles of unknown content in the presence of our water heaters... you are gonna go boom occasionally until you learn not to do that.

Re:It was bound to happen...

[Anonymous Coward]

It'll be intresting to see if they target other countries, like canada or Aussieland.

It also proves once again that the weakest link in computer security is the humans that operate them.

increase this week

[raind]

Any other admins see an increase in virus' and spoofed or phishing emails this week?

Critical National Infrastructure

[Martin Spamer]

The Critical National Infrastructure is private infrastructures such as Water Boards/Eletricity, Electricity, banks etc, it doesnt carry anything approaching a secret classification.

The CNI is completely different from the GSI (government secure intranet) which links low level government departments and
and public authorities, police, hospitals, etc.

Those are also completely different and unconnected with the GDN (Government data network) which links confidential but lowish security government departments.

The GDN has a secure overlay which allows for more secure traffic using dedicated cryptographic and scrambling technologies.

These are all complete unconnected with military and intelligency data networks.

Acts of War

[Doc Ruby]

Most "Far East" countries have all kinds of selfserving laws that let them execute and imprison people who interfere with the government policies. We've heard for years that Western governments opening trade with countries like China, Vietnam, Cambodia, Korea and their neighbors will give us more leverage to influence their policies. Usually about human rights, labor, and military agression. Well, those countries abuse their populations with those tyrannies to keep their production costs low, which has scored them huge trade surpluses with us. It's time to use that "influence" we've supposedly developed to get them to rein in the "criminals" they're allowing to attack us. Or it's time to cut off our markets, because that political/economic experiment has failed, miserably.

US ATTACKS BRITAIN OVER RELEASE OF DOWNING STREET

[wschalle]

The US has begun a targeted campaign against the british government in an attempt to uncover the person who released the so-called "Downing Street Memos" www.afterdowningstreet.org

targeted trojans

[Anonymous Coward]

The same things happen in other places, just no obligation to report how poorly agencies or companies manage their IT assets or train their people. I'll wager that nearly every small to medium sized insurance agency, bank, credit union, mortgage broker, doctor, lawyer, state tax departments, etc. that run windows OS have trojans parked in their systems, gathering data. In Minnesota a month ago, the State Department of Motor Vehicles was forced to shut down their public website after the state auditor busted them running a wireless network with ...gee...no security whatsoever...(But, they said 'Who could possibly be interested in mere driver's licenses, social security numbers, credit card payments, dobs, names, addresses, pics, etc. on drivers who renew licenses online?') der... Makes you wonder how the old utility plant guys at the local nuclear energy plant use IM and e-mail...

Wrong intent

[lommer]

Right, but even if the public doesn't condone going after North Korea, they might condone more funding or even powerful legislation that allows law enforcement more powers.

Sleep with a dog, wake up with fleas

[Daniel Phillips]

For some reason, the British Government has been a great supporter of Microsoft. The results are predictable.

Re: UK targeted by foreign attack

[DoctorPhil]

I know a fellow who has over the past 3 years analyzed several viruses created by the Chinese government and inserted into fake Falun-Gong websites, to install keyloggers into the computers of Falun-Gong practitioners overseas. So I know the Chinese government is using electronic warfare aggressively. As to whether China would go after the UK that way, I don't know.

Re:British government hit by spam! Declares emerge

[Cally]

If you'd been targetted by these attacks, you wouldn't know about it because your anti-virus software would not detect it. You seem to have read the fsckin article but not understood a word of it. Go back and read it again.

Doesn't seem to be any different

[NigelJohnstone]

http://www.niscc.gov.uk/niscc/docs/ttea.pdf

That NISCC advisory exactly describes exactly what I'm seeing. Even down to the 'newspaper article' reference, e.g. the one I shows as an example was from uniontrib.com = San Diego Union Tribune.

I don't see the difference, what they describe is exactly what is normal for this sort of attack, custom backdoor variants, social engineering, website or attachment delivery, sender spoofed, IP address typically Asian.

What exactly is this 'critical infrastructure' thats connected to the NET and why exactly is it connected to the NET when these sorts of things are so common?

Re:Doesn't seem to be any different

[Cally]

The copy of the NISCC report I have says on P3 (para 5):

Trojan capabilities suggest that the covert gathering and transmission of otherwise privileged information is a principal goal. The attacks normally focus on individuals who have jobs working with commercially or economically sensitive data.

It's clear that 'critical infrastructure' in this context doesn't just mean nuclear power-stations or the electricity grid any more. Of course such SCADA systems, and the NSA systems and the classified military stuff, as you say, doesn't touch the public network. Intangible things such as 'economic confidence', 'corporate reputation', 'social stability' - these are infrastructure of a sort. Put it this way: if you're Dr Evil and you want to blackmail the UK for ONE!!! MILLLLIOOONNN!!! SCRATCHCARDSS!!!! or whatever, imagine some sort of public demonstration that you control the networks of (say) every company in the FSE whose name starts with an 'A'. Now knock the first 10 orgs on the list off the network. (Once you're loose on an internal corporate network, it's not really trocket science to grab passwords & access to everything not air-gapped, if you know what you're doing. (Here I speak as a former pen-tester. If you've ever seen a real pentester mincing a typical corp network you'll know what I mean.)

(tangent: when I was pentesting for a living I was never allowed to change scope to include the sort of things that I thought were the real threats facing any org big enough to be worth extorting money from: namely, social engineering, physical security and custom-made IE exploit code. You'd inject URLs into the target org - crudely, by spamming everyone, or if you were feeling subtle enough (the rewards were enough to pay for it) by planting fake stories in the trade press, or punting out stories about close competitors - anything likely to attract some traffic from the target org, basically - exploit their IE, inject a reverse shell, and away you go. I pitched this to clients as well as management & sales droids, & clients never went for it. Probably this is because CTOs, CISOs, ITDs and suchlike are not paid to make the company secure, but to protect their own particular domain - usually, their IP networks.)

Anyway. The difference is that for the last few years the majority of in-the-wild viruses and trojans boiled down to botnets, DOS, IRC and spam. These attacks spread widely & relied on the law of averages to net enough of the least-secure of the online population to make it worthwhile. The business model, and hence attack strategy, adopted by the present attackers is significantly differnt, and AFAIK this is the first time such sustained interest in 'critical [national] infrastructure', of *any* country, has been public and confirmed.

Anyway - after all that rambling - if you're in the UK and you recklon you see this stuff perhaps you should get in touch with the NISCC.

Very definitely speaking for myself only, BTW, whoever pays me at the moment ;)

Oh and 221.227.27.154 China too

[NigelJohnstone]

Add 221.227.27.154 to the list.

Except critical = indispensable

[NigelJohnstone]

Surely critical infrastructure is stuff thats critical! i.e. Indispensable.

So intangible things, economic confidence etc. aren't critical because you can live without them. (and given the state of the US$ you ARE living without economic confidence right now!).

Knock a bank off the Internet, what happens? Nothing, Citibank website was down recently, I used the telephone banking instead!

"The business model, and hence attack strategy, adopted by the present attackers is significantly differnt,"

Except it isn't, nothing NISCC describes is anyway different from a normal trojan attack. Everything from the social engineering to the customized variants of backdoors, to the delivery via attachment or website, *everything* is exactly as it is normally with these attacks.
You say they are targetting critical infrastructure, no they're not, I'm seeing it right across all my non-critical websites!

" if you're in the UK and you recklon you see this stuff perhaps you should get in touch with the NISCC"

Why? They sound like clueless newbies!

Re:Except critical = indispensable

[Cally]

Surely critical infrastructure is stuff thats critical! i.e. Indispensable.

So intangible things, economic confidence etc. aren't critical because you can live without them. (and given the state of the US$ you ARE living without economic confidence right now!).

The threat to economic confidence is a lot more significant than "a recession". Personally I've lived through 3 recessions in the UK in my lifetime, none were much fun and all of them killed people. Even if we were talking about the ability to trip the world economy into, say, a severe early 80s style world recession, there are plenty of people who would suffer. There are also plenty of people aruond now who would benefit from, or might just expect that they'd benefit from it, whether they were right or not, that they'd do that if they thought they could.

Finally even if that weren't the aim, and it's straightforward industrial espionage or blackmail, or even something boringly James Bond like the crack North Korean nuclear-powered hacking masses, it's still an attack against critical infrastructure; it's targetted, and that's new (a) on this scale (b) with this degree of sophistication (c) on organisations more extensive than imabigcorp.co.uk .

Re:Except critical = indispensable

[NigelJohnstone]

"The threat to economic confidence is a lot more significant than "a recession"."

So you're suggesting you can have a recession *AND* have economic confidence at the same time? If thats so why aren't people investing during a recession? You write as though they're unlinked.

"Personally I've lived through 3 recessions in the UK in my lifetime, none were much fun and all of them killed people."

And I've seen people kill themselves over a tax bill.

I believe lack of economic confidence is a tiny thing, and *temporary* loss of economic confidence caused by misstaken words on a website is a *microscopic* thing. Much less damage for example than wasting millions on a quango and taxing people to pay for that quango.

" it's still an attack against critical infrastructure; it's targetted,"

But its not targetted, its the normal scatter gun password sniffer backdoor stuff. If you read the webmaster boards they're all discussing the upserge in this stuff recently.

Re:Except critical = indispensable

[Cally]

So you're suggesting you can have a recession *AND* have economic confidence at the same time? If thats so why aren't people investing during a recession?

I'm talking about a much more profound loss of confidence in the economic systems than the temporary belief that one's better off sticking money on deposit or into bonds than into equities for a few years (ie a recession.) If people weren't investing during a recession there would be no employment and hence no economy. (If I pay you to sweep the streets, that's an investment.)

I don't especially want to get into a flamewar at this point, especially as no-one's reading the thread now :))...

All I can say is that this thing IS a big deal, no really it is. You talk about "webmaster forums" doesn't cut much ice; we process about 1x10^9 mails per week which gives us a pretty good insight into the state of mail-borne malware.