UK Critical Structures Targeted by Trojan Attacks

ElGanzoLoco writes "The UK's National Infrastructure Security Coordination Centre is reporting that key british infrastructures (government, telecom, transports, banks among others) are under attack by specific, targeted e-mail trojans. According to their report (PDF), 'the emails use social engineering to appear credible, with subject lines often referring to news articles that would be of interest to the recipient. In fact they are "spoofed", making them appear to originate from trusted contacts, news agencies or Government departments.'. The attackers are apparently trying to gather sensitive or secret data. While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia."

Comments

Political Spin?

[Kinky Bass Junk]

While the NISCC has not been able to precisely trace the attacks' origins, most IPs seem to trace back to Far-East Asia.

There's no doubt that these attacks will create a political spin, which could be their target in the first place. We all know there are many tensions between western and easter countries, particularly North Korea & China, and U.K. & U.S.A. This also goes hand-in-hand with previous stories saying there are highly skilled cracker armies in North Korea. I would say without a doubt that these are politically motivated.

"Secret" data?

[ssimpson]

According to UK Government operational and configuration guidelines for classified system (primarily JSP440), any system containing CONFIDENTIAL or data with high protective marking just won't be connected to the internet so therefore won't get the mails and therefore won't be able to leak to the internet?

So how the hell would these PC leak SECRET data at all?

There's a lot coming from 222.136.55.64

[NigelJohnstone]

Seems to be a lot coming from one IP address.

----------------------
"Rejected mail, The original message was received at Fri, 17 Jun 2005 08:05:12 +0800 from uniontrib.com [121.206.16.100]."
Actually its a trojan (a.COM) in a zip file.
Comes from 222.136.55.64 = China
-----------------------

"RETURNED MAIL: SEE TRANSCRIPT FOR DETAILS"
Another from 222.136.55.64 ....

I think they're just paranoid, we have nothing to do with security or government, yet we get these trojans all the time too.

China and Russia according to Radio 4

[lxdbxr]

On the Radio 4 "Today" program this morning they covered this story, the correspondent basically said that NISCC knows where the attacks are coming from (& I would be surprised if they didn't, NISCC are pretty competent people), but did not spell it out in the report to avoid diplomatic complications. The Radio 4 guy reckoned that these specific, targeted attacks (mostly against gov.uk) were coming from China and Russia, though whether private or state actors he didn't say.

No mention of North Korean superhackers, I was a little disappointed :-)

British government hit by spam! Declares emergency

[khasim]

A number of open source3 and bespoke trojans, altered to avoid antivirus
detection, have been used. The wide variety and constant evolution of
the trojans used appears to be an attacker strategy to identify the conditions
needed to successfully penetrate a network.

Sounds like the regular spam and virus crap I get.

Maybe the "far eastern" enemies think I'm part of the British government?

Investigate anomalous slow-running machines, looking for unknown processes or unexpected Internet connections, as this may be an indication of malicious programs operating in the background. User reports of such behaviour should be encouraged and fully investigated.

Oh yeah. That's going to be GREAT!

No more of those "reboot and see if it fixes the problem" comments. Now it has to be "fully investigated".

Implement spam filtering to guard against infrastructures commonly used by the attackers. Anti-spam measures such as greylisting/blacklisting of dial-ups, open proxies and open relays, in addition to more sophisticated methods (e.g. Bayesian filtering) can be effective protective measures.

But I already do that.

Wow, my email system is more "secure" than the British governments! Who would have guessed!

Re:Far East Asia?

[koi88]

Although why woudl they want anything to do with the UK? Isnt it the USA thats their bete noir?

Maybe they're after James Bond...

SANS Community

[kc0re]

The SANS community broke this news yesterday on the DShield listserv... Check out Incidents.org for the current news concerning it. As well as the ongoing investigation.

Send in Austin Powers, he knows Trojans

[digitaldc]

The obvious solution to this problem is to recruit Austin Powers and have him go back in time to around 1995 to Microsoft Headquarters and take over their security services department. Then by sheer mojo, he will re-engineer the software to prevent these types of intrusions. Problem solved, the Queen is saved!