Feeds

UK under cyber blitz

Far East Trojan attack targets 'commercial and economic' secrets

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

Hackers are targeting British workers with a series of specially crafted Trojan horse attacks. The attacks are delivered either through email attachments or through links to maliciously-constructed websites, the UK's National Infrastructure Security Co-ordination Centre (NISCC) warned on Thursday.

Approximately 300 UK government departments and businesses critical to the country's infrastructure have been the subject of Trojan horse attacks, many reportedly originating in the Far East. "The attackers' aim appears to be covert gathering or transmitting of commercially or economically valuable information," NISCC warns.

The attacks seek to compromise computers so that remote hackers can steal privileged information and potentially launch further attacks. Infected email employ social engineering tricks, for example posing as information relevant to a target's job. "Once installed on a user's machine, Trojans may be used to obtain passwords, scan networks, exfiltrate [send out] information and launch further attacks," according to NISCC. "Anti-virus software and firewalls do not give complete protection. Trojans may communicate with the attackers using common ports (eg HTTP, DNS, SSL) and can be modified to avoid anti-virus detection."

Paul King, principal security consultant at Cisco Systems UK, said the attacks demonstrated how conventional anti-virus scanning software was ineffective at stopping new and unknown attacks. "The role of anti-virus has become to throw away known bad stuff. Other technologies, such as host-based intrusion prevention, are needed to defend against previously unseen attacks."

NISCC said the attacks had being going on for some time but have recently become more sophisticated. Mark Sunner, CTO of UK-based email security firm MessageLabs, said it had recorded instances of the attacks for more than a year. "These are targeted attacks, very low in number and often featuring hand-crafted exploits. They're barely on the radar. These are not mass mailers. We only see between 10 and 100 infected emails per attack and around two attacks per week.

"There's no rhyme or reason to the industry sectors targeted, certainly they aren't particularly focused on financial institutions." Although similar methods are been used, NISSC said they are distinct from an industrial espionage scandal targeting Israeli firms that emerged with the arrest of 21 people in the UK, Israel and elsewhere last month. It said the majority of the attacks seen so far had targeted central government though private sector firms are also under fire.

NISCC has documented the attack and put together a set of recommendations on defence strategies in a nine-page document here. An appendix details the designation given by anti-virus firms for Trojans used in the attack. All listed Trojans at the time of writing are Windows specific. ®

Related stories

Hackers plot to create massive botnet
ISPs urged to throttle spam zombies
Duo charged over DDoS for hire scam
Britain tops zombie PC charts
Israel unmasks spyware ring

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.