Feeds

UK under cyber blitz

Far East Trojan attack targets 'commercial and economic' secrets

  • alert
  • submit to reddit

Security for virtualized datacentres

Hackers are targeting British workers with a series of specially crafted Trojan horse attacks. The attacks are delivered either through email attachments or through links to maliciously-constructed websites, the UK's National Infrastructure Security Co-ordination Centre (NISCC) warned on Thursday.

Approximately 300 UK government departments and businesses critical to the country's infrastructure have been the subject of Trojan horse attacks, many reportedly originating in the Far East. "The attackers' aim appears to be covert gathering or transmitting of commercially or economically valuable information," NISCC warns.

The attacks seek to compromise computers so that remote hackers can steal privileged information and potentially launch further attacks. Infected email employ social engineering tricks, for example posing as information relevant to a target's job. "Once installed on a user's machine, Trojans may be used to obtain passwords, scan networks, exfiltrate [send out] information and launch further attacks," according to NISCC. "Anti-virus software and firewalls do not give complete protection. Trojans may communicate with the attackers using common ports (eg HTTP, DNS, SSL) and can be modified to avoid anti-virus detection."

Paul King, principal security consultant at Cisco Systems UK, said the attacks demonstrated how conventional anti-virus scanning software was ineffective at stopping new and unknown attacks. "The role of anti-virus has become to throw away known bad stuff. Other technologies, such as host-based intrusion prevention, are needed to defend against previously unseen attacks."

NISCC said the attacks had being going on for some time but have recently become more sophisticated. Mark Sunner, CTO of UK-based email security firm MessageLabs, said it had recorded instances of the attacks for more than a year. "These are targeted attacks, very low in number and often featuring hand-crafted exploits. They're barely on the radar. These are not mass mailers. We only see between 10 and 100 infected emails per attack and around two attacks per week.

"There's no rhyme or reason to the industry sectors targeted, certainly they aren't particularly focused on financial institutions." Although similar methods are been used, NISSC said they are distinct from an industrial espionage scandal targeting Israeli firms that emerged with the arrest of 21 people in the UK, Israel and elsewhere last month. It said the majority of the attacks seen so far had targeted central government though private sector firms are also under fire.

NISCC has documented the attack and put together a set of recommendations on defence strategies in a nine-page document here. An appendix details the designation given by anti-virus firms for Trojans used in the attack. All listed Trojans at the time of writing are Windows specific. ®

Related stories

Hackers plot to create massive botnet
ISPs urged to throttle spam zombies
Duo charged over DDoS for hire scam
Britain tops zombie PC charts
Israel unmasks spyware ring

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.