Posts
All Comments
"While tools have existed for individual users, this is the only free tool -- and the most comprehensive one -- available for enterprises like federal and state government and private sector networks to determine the extent to which their systems are infected by this worm," said US-CERT director Mischel Kwon.
"Our experts at US-CERT are working around the clock to increase our capabilities to address the cyber risk to our nation's critical networks and systems, both from this threat and all others," he added.
The worm is suspected to have infected millions of computers running the Windows operating system and Windows maker Microsoft has offered a $250,000 bounty for those responsible for the worm.
US-CERT recommended that Windows users apply Microsoft security patch MS08-067 to help provide protection against the worm.
The patch is designed to prevent an attacker from remotely taking control of an infected computer system and installing additional malicious software.
Malware could be triggered to steal data, generate spam attacks or turn control of infected computers over to hackers amassing "zombie" machines into "botnet" armies.
The worm is programmed to modify itself on Wednesday, April Fool's Day, according to computer security specialists.
Conficker had been programmed to reach out to 250 websites daily to download commands from its masters, they said, but on Wednesday it will begin connecting with 50,000 websites daily for instructions.
The hackers behind the worm have yet to give it any specific orders.
"That's the interesting thing. The only thing the worm is being asked to do is to ask for further instructions," Steve Trilling, vice president of security firm Symantec, told the CBS program "60 Minutes" in a story aired on Sunday.
The Philippines is one of the 103 countries where classified documents from government and private organizations, including the computers of the Dalai Lama and Tibetan exiles, have been hacked into, according to the Information Warfare Monitor (IWM).
IWM is composed of researchers from Ottawa-based think tank SecDev Group and University of Toronto’s Munk Center for International Studies.
The Canadian researchers detected a cyber espionage network involving more than 1,295 compromised computers from the ministries of foreign affairs of the Philippines, Iran, Bangladesh, Latvia, Indonesia, Brunei, Barbados and Bhutan.
The researchers also discovered hacked systems in the embassies of India, South Korea, Indonesia, Romania, Cyprus, Malta, Thailand, Taiwan, Portugal, Germany and Pakistan.
Asked about the China-based spy network that infiltrated the DFA’s computer system, Philippine National Security Adviser Norberto Gonzales said: “I haven’t received any official report on that. But I will check if it’s true and what particular computer system was compromised.”
The DFA, for its part, said it was looking into the cyber-espionage exposé, adding that it was doing all it can to protect its information technology software and networks.
Malicious software
Once the hackers infiltrate the systems, they gain control using malicious software or malware, which they install in the compromised computers, and send and receive data from them, the IWM researchers said.
In a report titled “Tracking ‘GhostNet’: Investigating a Cyber Espionage Network” to be released online on Sunday, the researchers said the system was being controlled from computers based almost exclusively in China, but that they could not say conclusively that the Chinese government was involved.
Calls to China’s foreign ministry and industry and information ministry went unanswered on Sunday. The Chinese Embassy in Toronto did not immediately return calls for comment on Saturday.
The researchers had been asked by the office of the Dalai Lama, the exiled Tibetan leader whom China regularly denounces, to examine its computers for signs of malware.
Real-time evidence
IMW’s sleuthing opened a window into a broader operation that, in less than two years, has infiltrated more than a thousand computers in over 100 countries, including the Dalai Lama’s Tibetan exile centers in India, Brussels, London and New York.
“We uncovered real-time evidence of malware that had penetrated Tibetan computer systems, extracting sensitive documents from the private office of the Dalai Lama,” IMW investigator Greg Walton said.
The Dalai Lama fled over the Himalaya mountains into exile 50 years ago when China quashed an uprising in Tibet, placing the kingdom under its direct rule for the first time. The spiritual leader and the Tibetan government in exile are based in Dharmsala, India.
Students For a Free Tibet activist Bhutila Karpoche said her organization’s computers had been hacked into numerous times over the past four or five years, and particularly in the past year.
Viruses
Karpoche said she often got e-mail that contained viruses that crashed the group’s computers.
The IMW researchers said they believed that in addition to the spying on the Dalai Lama, the system, which they called GhostNet, was focused on the governments of South Asian and Southeast Asian countries.
Intelligence analysts said many governments, including those of China, Russia and the United States, and other parties were using sophisticated computer programs to covertly gather information.
The newly reported spying operation is by far the largest to come to light in terms of countries affected.
Whaling information
The malware is remarkable both for its sweep—in computer jargon, it has not been merely “phishing” for random consumers’ information, but “whaling” for particular important targets—and for its Big Brother-style capacities.
It can, for example, turn on the camera and audio-recording functions of an infected computer, enabling monitors to see and hear what goes on in a room.
The electronic spy game has had at least some real-world impact, according to the IMW researchers.
For example, they said, after an e-mail invitation was sent by the Dalai Lama’s office to a foreign diplomat, the Chinese government made a call to the diplomat discouraging a visit.
Transcripts
And a woman working for a group making Internet contacts between Tibetan exiles and Chinese citizens was stopped by Chinese intelligence officers on her way back to Tibet, shown transcripts of her online conversations and warned to stop her political activities.
Two researchers at Cambridge University in Britain who worked on the part of the investigation related to the Tibetans were also releasing their own report on Sunday.
In an online abstract for “The Snooping Dragon: Social Malware Surveillance of the Tibetan Movement,” Shishir Nagaraja and Ross Anderson wrote that while malware attacks were not new, these attacks should be noted for their ability to collect “actionable intelligence for use by the police and security services of a repressive state, with potentially fatal consequences for those exposed.”
The news probably isn't a huge shock to anyone who has been following the series recently. Late last year, speculators thought the show would be coming to an end when Fox tacked on a few extra hours to this year's production schedule. And with heavy promotion for Fringe, 24, and Lie to Me in full swing, it isn't hard to see who the odd man out is.
Prison Break is currently on a little vacation, as Fox beefs up its midseason schedule with the aforementioned trio and a little program called American Idol. However, Fox did schedule a return for the final episodes of Prison Break--they begin their run April 17.
According to TVGuide.com, Fox president Kevin Reilly explained, "[Prison Break] got to a point where a lot of the stories had been told," which is a kind way to say the show was running on fumes creatively. At least six hours of the drama are left to go, with the possibility of a few more hours added as Reilly said he wants the program to "finish strong."
Before fans organize a save-the-show campaign complete with an assault of freshly shaven hair and teabags, consider this: Prison Break was originally conceived as a one-season show or mini-series, but instead was stretched out to four full seasons. That's some glass-is-half-full thinking right there.
source: tv.com
Conficker first bubbled up in late 2008 and began making headlines in January as known infections topped 9 million computers. Now in its third variant, Conficker C, the worm has grown incredibly complicated, powerful, and virulent... though no one is quite sure exactly what it will do when D-Day arrives.
Thanks in part to a quarter-million-dollar bounty on the head of the writer of the worm, offered by Microsoft, security researchers are aggressively digging into the worm's code as they attempt to engineer a cure or find the writer before the deadline. What's known so far is that on April 1, all infected computers will come under the control of a master machine located somewhere across the web, at which point anything's possible. Will the zombie machines become denial of service attack pawns, steal personal information, wipe hard drives, or simply manifest more traditional malware pop-ups and extortion-like come-ons designed to sell you phony security software? No one knows.
Conficker is clever in the way it hides its tracks because it uses an enormous number of URLs to communicate with HQ. The first version of Conficker used just 250 addresses each day -- which security researchers and ICANN simply bought and/or disabled -- but Conficker C will up the ante to 50,000 addresses a day when it goes active, a number which simply can't be tracked and disabled by hand.
At this point, you should be extra vigilant about protecting your PC: Patch Windows completely through Windows Update and update your anti-malware software as well. Make sure your antivirus software is actually running too, as Conficker may have disabled it.
Microsoft also offers a free online safety scan here, which should be able to detect all Conficker versions.
source: tech.yahoo.com
