Feeds

Leaked memo says Conficker pwns Parliament

House of Commons systems borked

Beginner's guide to SSL certificates

Updated The House of Commons IT systems has reportedly been infected by the infamous Conficker superworm, which has previously infected millions of Windows PCs and affected the operation of hospitals, military and large corporate systems.

Political blog Dizzy Thinks first reported that a memo (below) sent out to parliamentary IT network users on Tuesday night warned that Conficker had disrupted the operation of parliamentary systems.

The infection has reportedly prompted a clean-up operation as well as a temporary ban on the use of mass storage devices, including MP3 players, on parliamentary systems.

To: All users connecting directly to the Parliamentary Network

The Parliamentary Network has been affected by a virus known as conficker. This virus affects users by slowing down the Network and by locking out some accounts. We are continuining [sic] to work with our third party partners to manage its removal and we need to act swiftly to clean computers that are infected.

We are scanning the Network and if we identify any equipment which we believe is infected with the virus then we will contact you to ensure that the device is either removed from the Network or cleaned and loaded with the correct software to prevent this infection reoccurring.

You can help us to contain this problem and prevent new infection by adhering to the following advice:

* We are unable to clean PCs and portable computers which are either not switched on or which are not authorised devices. We therefore ask that if you are running a PC or portable computer not authorised to be on the Network that you take it off immediately.

* An additional characteristic of this virus is that for some types of files it can skip direct to the Network from a USB memory stick or other portable storage device (e.g. mp3 players) without hitting the virus checker software. We ask that for the time being you do not use memory sticks or any other portable storage devices on the Parliamentary Network.

* If you do identify a problem with the equipment you are running, please contact the PICT Service Desk on 020 7219 **** when it reopens on Wednesday 25 March from 8am.

* If you are connecting using one of our remote access services, from a Constituency Office for example, a separate communication will be sent to you.

Director of Parliamentary ICT.

Our call to the service desk was referred upwards. We've left a message with ICT management. Inquiries to the All Parliamentary Internet Group and parliamentary IT lobby group Eurim are also yet to shed any light on the matter.

However one House of Commons source, who requested anonymity, confirmed to El Reg that the memo is genuine. He added that the House of Commons network had been "slow for most of the week" and acting like it was "hand cranked", although its performance had improved a bit by Friday once the clean-up operation got under way. The prohibition of plugging mobile devices into the network was likely to inconvience MPs and other who synchronised their phones with their desktops, he added.

The memo came from a credible source who has shed light on other goings-on involving parliamentary IT systems.

Dizzy Thinks previously reported that the Parliamentary ICT department had told users that PGP was incompatible with its remote access software, for reasons neither El Reg nor PGP have been able to unravel to date.

Earlier this month El Reg reported that police failed to record a crime, much less investigate, when Alun Michael MP reported a computer in his office was infected with malware. Michael was able to detect and remove the malware himself.

It's unclear what strain of malware was involved in that attack, much less whether the two reported incidents are somehow linked.

The security of parliamentary PCs is more sensitive than those of regular office system because of the confidentiality of MPs' correspondence with their constituents, to say nothing of the effect that borked systems might have on the day-to-day business of Parliament.

It's known that Colt Telecom supplies the connectivity and that MessageLabs, a security sub-contractor, handles the anti-spam and anti-virus filtering on the parliamentary internet connection.

Conficker spreads through several update mechanisms, a well-known Windows vulnerability and tainted USB drives being just two. Once it secures a foothold on an infected network, the worm can spread widely across network shares by exploiting weak password security, a major factor in its high prevalence within corporate systems. Spreading by email isn't one of the infection vectors used by Conficker.

Nonetheless, as a security sub-contractor you'd expect MessageLabs, with a noted team of anti-virus experts, to be among the third-party partners asked to roll its sleeves up and sort out the apparent virus infection problems on parliamentary systems. If so MessageLabs is staying schtum, perhaps for understandable reasons of client confidentiality.

We asked MessageLabs for comment on Thursday on the issue, but we're yet to hear back.

News of the reported infection of parliamentary systems comes at a time when Conficker is back under the spotlight, as security watchers count down to the start of a new update mechanism, due to come online for systems infected by the latest variant of the malware from 1 April. Whether this event will coincide with the activation of the botnet for malign purposes, such as sending spam, remains unclear. Even in the simple act of spreading the worm has caused huge disruption.

The UK's Ministry of Defence reported that that the worm had spread across some of its offices, as well as desktops aboard various Royal Navy warships. Hospitals in Sheffield reported infection of over 800 computers back in February. Other corporate victims of the malware include judicial systems in the city of Houston and the Bundeswehr (German Army).

A handy FAQ on Conficker by F-secure can be found here. A technical analysis of the worm can be found in a paper by SRI International here. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Managing SSL certificates with ease
The lack of operational efficiencies and compliance pitfalls associated with poor SSL certificate management, and how the right SSL certificate management tool can help.