UK Critical Structures Targeted by Trojan Attacks

ElGanzoLoco writes "The UK's National Infrastructure Security Coordination Centre is reporting that key british infrastructures (government, telecom, transports, banks among others) are under attack by specific, targeted e-mail trojans. According to their report (PDF), 'the emails use social engineering to appear credible, with subject lines often referring to news articles that would be of interest to the recipient. In fact they are "spoofed", making them appear to originate from trusted contacts, news agencies or Government departments.'. The attackers are apparently trying to gather sensitive or secret data. While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia."

Comments

Political Spin?

[Kinky Bass Junk]

While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia.

There's no doubt that these attacks will create a political spin, which could be their target in the first place. We all know there are many tensions between western and easter countries, particularly North Korea & China, and U.K. & U.S.A. This also goes hand-in-hand with previous stories saying there are highly skilled cracker armies in North Korea. I would say without a doubt that these are politically motivated.

British government hit by spam! Declares emergency

[khasim]

A number of open source3 and bespoke trojans, altered to avoid antivirus
detection, have been used. The wide variety and constant evolution of
the trojans used appears to be an attacker strategy to identify the conditions
needed to successfully penetrate a network.

Sounds like the regular spam and virus crap I get.

Maybe the "far eastern" enemies think I'm part of the British government?

Investigate anomalous slow-running machines, looking for unknown processes or unexpected Internet connections, as this may be an indication of malicious programs operating in the background. User reports of such behaviour should be encouraged and fully investigated.

Oh yeah. That's going to be GREAT!

No more of those "reboot and see if it fixes the problem" comments. Now it has to be "fully investigated".

Implement spam filtering to guard against infrastructures commonly used by the attackers. Anti-spam measures such as greylisting/blacklisting of dial-ups, open proxies and open relays, in addition to more sophisticated methods (e.g. Bayesian filtering) can be effective protective measures.

But I already do that.

Wow, my email system is more "secure" than the British governments! Who would have guessed!