Slashdot Mirror
UK Critical Structures Targeted by Trojan Attacks
ElGanzoLoco writes "The UK's National Infrastructure Security Coordination Centre is reporting that key british infrastructures (government, telecom, transports, banks among others) are under attack by specific, targeted e-mail trojans. According to their report (PDF), 'the emails use social engineering to appear credible, with subject lines often referring to news articles that would be of interest to the recipient. In fact they are "spoofed", making them appear to originate from trusted contacts, news agencies or Government departments.'. The attackers are apparently trying to gather sensitive or secret data. While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia."
If this is a sustained attack:
1) block these emails
2) educate staff to be aware of this atleast in the short-term
3) hold educated staff atleast partly responsible for any infections that result from this attack
4) we need to vote in a government that actually knows how to use a computer
Perhaps the fabled North Korean Super Hackers at work?
Although why woudl they want anything to do with the UK? Isnt it the USA thats their bete noir?
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo! http://goo.gl/J9bkO
While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia.
There's no doubt that these attacks will create a political spin, which could be their target in the first place. We all know there are many tensions between western and easter countries, particularly North Korea & China, and U.K. & U.S.A. This also goes hand-in-hand with previous stories saying there are highly skilled cracker armies in North Korea. I would say without a doubt that these are politically motivated.
Anonymous Coward
like most spam seems to originate in China but in reality its American spam gangs sending spam via China
iam sure this is no different
According to UK Government operational and configuration guidelines for classified system (primarily JSP440), any system containing CONFIDENTIAL or data with high protective marking just won't be connected to the internet so therefore won't get the mails and therefore won't be able to leak to the internet?
So how the hell would these PC leak SECRET data at all?
"Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
Seems to be a lot coming from one IP address.
....
----------------------
"Rejected mail, The original message was received at Fri, 17 Jun 2005 08:05:12 +0800 from uniontrib.com [121.206.16.100]."
Actually its a trojan (a.COM) in a zip file.
Comes from 222.136.55.64 = China
-----------------------
"RETURNED MAIL: SEE TRANSCRIPT FOR DETAILS"
Another from 222.136.55.64
I think they're just paranoid, we have nothing to do with security or government, yet we get these trojans all the time too.
No mention of North Korean superhackers, I was a little disappointed :-)
-- Nothing unusual happened today
Maybe the "far eastern" enemies think I'm part of the British government?Oh yeah. That's going to be GREAT!
No more of those "reboot and see if it fixes the problem" comments. Now it has to be "fully investigated".But I already do that.
Wow, my email system is more "secure" than the British governments! Who would have guessed!
The SANS community broke this news yesterday on the DShield listserv... Check out Incidents.org for the current news concerning it. As well as the ongoing investigation.
I question the tone of the headline and the content. The implication is that British sites are being targetted exclusively. Being a British Government publication, this would have been their remit. I think that if the net was thrown wider you'd see that this is a general problem for the internet as a whole, and also for personal as well as business and Government computers. The article is correct in so far as it goes, but is far to narrow its view to be newsworthy. It would have been far more interesting if they'd found that other territories weren't being targetted. My suspicion is that there isn't any targetting - only carpet bombing.
The obvious solution to this problem is to recruit Austin Powers and have him go back in time to around 1995 to Microsoft Headquarters and take over their security services department. Then by sheer mojo, he will re-engineer the software to prevent these types of intrusions. Problem solved, the Queen is saved!
He who knows best knows how little he knows. - Thomas Jefferson
We have seen major phishing attemps on the big US corporations for a while now, and people have been faking mails from ebay and the banks and everywhere else.
Only now that UK organisations are targeted do they start moaning.
There should be a concerted effort to stamp out this kind of shit targeting whichever organisation WORLDWIDE, not just a namby pamby "oh look our companies is getting done over". Organisations and ISPs should supply enough information about online fraud to everyone who needs it, and shouldnt wait until they get hit.
Umm these sort of attacks have been known about for a long time this is information about a specific problem its called a warning it alows others to be aware that there is a new round of attacks going on and to be prepared if these e-mails come there way, that way less damage is done.
Do you think it's better that no one knows about this latest round of attacks or should we twiddle our thumbs saying "everyone else should know about this we have no responsibility to help"?
Saying Apple is better than MS is like saying Botulism is better than rabies.
First of all phishing is an attack against account holders of "Major US Corporations" not against those organizations. Vulnerability to targeted attacks using modified Trojans, while not new, is the weak underbelly of corporate security. No amount of security awareness training is going to stop somone from opening an email apparently from their boss that says: "Here is your performance appraisal, open immediately". There was a concerted (unreported in the media) attack against 5 big banks in New York a year ago. Customized viruses were used. It took major pressure to get the AV vendors to add sigs for these "non-wild" viruses. more at http://www.threatchaos.com/
Once again charisma and believabilty > Technology. So many Network Admins become enamored with firewalls, IDS, and other kinds of tech savvy protection, that they usually will hold the door open for social engineers. Until employees and users are better educated and social engineering becomes part of the corporate threat model, we're going to see these types of attacks continue to grow in number