UK Critical Structures Targeted by Trojan Attacks

ElGanzoLoco writes "The UK's National Infrastructure Security Coordination Centre is reporting that key british infrastructures (government, telecom, transports, banks among others) are under attack by specific, targeted e-mail trojans. According to their report (PDF), 'the emails use social engineering to appear credible, with subject lines often referring to news articles that would be of interest to the recipient. In fact they are "spoofed", making them appear to originate from trusted contacts, news agencies or Government departments.'. The attackers are apparently trying to gather sensitive or secret data. While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia."

Comments

lol?

[Anonymous Coward]

If this is a sustained attack:
1) block these emails
2) educate staff to be aware of this atleast in the short-term
3) hold educated staff atleast partly responsible for any infections that result from this attack
4) we need to vote in a government that actually knows how to use a computer

Re:lol?

[BiggyP]

It could be that a lot of these links, the ones that appear dead, do so only because the spoofing vulnerability in use doesn't work in the browser you're using.

Imagine if the UK government stopped wasting vast amounts of money licensing windows for their end users and switched to something a little less bug ridden.

Far East Asia?

[EQ]

Perhaps the fabled North Korean Super Hackers at work?

Although why woudl they want anything to do with the UK? Isnt it the USA thats their bete noir?

Re:Far East Asia?

[koi88]

Although why woudl they want anything to do with the UK? Isnt it the USA thats their bete noir?

Maybe they're after James Bond...

Political Spin?

[Kinky Bass Junk]

While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia.

There's no doubt that these attacks will create a political spin, which could be their target in the first place. We all know there are many tensions between western and easter countries, particularly North Korea & China, and U.K. & U.S.A. This also goes hand-in-hand with previous stories saying there are highly skilled cracker armies in North Korea. I would say without a doubt that these are politically motivated.

"Secret" data?

[ssimpson]

According to UK Government operational and configuration guidelines for classified system (primarily JSP440), any system containing CONFIDENTIAL or data with high protective marking just won't be connected to the internet so therefore won't get the mails and therefore won't be able to leak to the internet?

So how the hell would these PC leak SECRET data at all?

There's a lot coming from 222.136.55.64

[NigelJohnstone]

Seems to be a lot coming from one IP address.

----------------------
"Rejected mail, The original message was received at Fri, 17 Jun 2005 08:05:12 +0800 from uniontrib.com [121.206.16.100]."
Actually its a trojan (a.COM) in a zip file.
Comes from 222.136.55.64 = China
-----------------------

"RETURNED MAIL: SEE TRANSCRIPT FOR DETAILS"
Another from 222.136.55.64 ....

I think they're just paranoid, we have nothing to do with security or government, yet we get these trojans all the time too.

China and Russia according to Radio 4

[lxdbxr]

On the Radio 4 "Today" program this morning they covered this story, the correspondent basically said that NISCC knows where the attacks are coming from (& I would be surprised if they didn't, NISCC are pretty competent people), but did not spell it out in the report to avoid diplomatic complications. The Radio 4 guy reckoned that these specific, targeted attacks (mostly against gov.uk) were coming from China and Russia, though whether private or state actors he didn't say.

No mention of North Korean superhackers, I was a little disappointed :-)

British government hit by spam! Declares emergency

[khasim]

A number of open source3 and bespoke trojans, altered to avoid antivirus
detection, have been used. The wide variety and constant evolution of
the trojans used appears to be an attacker strategy to identify the conditions
needed to successfully penetrate a network.

Sounds like the regular spam and virus crap I get.

Maybe the "far eastern" enemies think I'm part of the British government?

Investigate anomalous slow-running machines, looking for unknown processes or unexpected Internet connections, as this may be an indication of malicious programs operating in the background. User reports of such behaviour should be encouraged and fully investigated.

Oh yeah. That's going to be GREAT!

No more of those "reboot and see if it fixes the problem" comments. Now it has to be "fully investigated".

Implement spam filtering to guard against infrastructures commonly used by the attackers. Anti-spam measures such as greylisting/blacklisting of dial-ups, open proxies and open relays, in addition to more sophisticated methods (e.g. Bayesian filtering) can be effective protective measures.

But I already do that.

Wow, my email system is more "secure" than the British governments! Who would have guessed!

SANS Community

[kc0re]

The SANS community broke this news yesterday on the DShield listserv... Check out Incidents.org for the current news concerning it. As well as the ongoing investigation.

British or Global problem?

[Claws Of Doom]

I question the tone of the headline and the content. The implication is that British sites are being targetted exclusively. Being a British Government publication, this would have been their remit. I think that if the net was thrown wider you'd see that this is a general problem for the internet as a whole, and also for personal as well as business and Government computers. The article is correct in so far as it goes, but is far to narrow its view to be newsworthy. It would have been far more interesting if they'd found that other territories weren't being targetted. My suspicion is that there isn't any targetting - only carpet bombing.

Send in Austin Powers, he knows Trojans

[digitaldc]

The obvious solution to this problem is to recruit Austin Powers and have him go back in time to around 1995 to Microsoft Headquarters and take over their security services department. Then by sheer mojo, he will re-engineer the software to prevent these types of intrusions. Problem solved, the Queen is saved!

Re:Just like spam

[1u3hr]

I would be very interested to know how they find ways to hop the Great Firewall of China twice...

China doesn't really care about through traffic, but about what their citizens are reading and writing. The "firewall" is just a wordplay, not a useful metaphor for how China manages its part of the net.

Ahh Social Engineering

[snortCrush69]

Once again charisma and believabilty > Technology. So many Network Admins become enamored with firewalls, IDS, and other kinds of tech savvy protection, that they usually will hold the door open for social engineers. Until employees and users are better educated and social engineering becomes part of the corporate threat model, we're going to see these types of attacks continue to grow in number