Chinese hackers launched a major attack on the U.K. Parliament
earlier this month, the governmentb s email filtering company
MessageLabs Ltd. has confirmed.
The attack, which occurred on Jan. 2, attempted to exploit the
Windows Meta File (WMF) vulnerability to hijack the PCs of more
than 70 named individuals, including researchers, secretaries and
members of parliament (MPs) themselves.
Emails were sent to staff, with an attachment that contained the
WMF-exploiting Setabortproc Trojan. Anyone opening this attachment
would have enabled attackers to browse files, and possibly install
a key-logging program to attempt the theft of passwords. None of
the emails got through to the intended targets, MessageLabs said,
but the U.K. authorities were alerted.
The WMF flaw was first made public in November and only patched
by Microsoft on Jan. 5. Given that the first exploit was reported
on Dec. 29, this offered the attackers a "zero day" window in which
to launch the Trojan assault.
MessageLabs was reported by The Guardian newspaper -- which
broke the story -- as saying the source of the emails had been
traced to servers in Chinab s Guangdong Province, hence the
suspicion that the latest attack was part of a more general
campaign of electronic subversion.
This is not the first time the U.K. government has come under
Trojan attack from China. Last summer, the National Infrastructure
Security Co-ordination Centre (NISCC) reported that U.K. government
departments had been hit by a wave of Trojans originating in
China.
At the time, the organization was more circumspect in
attributing blame, however, describing the source in general terms
as "often linked to the Far East". There appear to be no such
sensitivities this time around.
The use of targeted Trojans to carry out espionage was first
reported by Techworld last May, when Israeli authorities uncovered
a massive electronic spying operation by a large number of the
countryb s companies to steal files from their business rivals. On
that occasion, the information theft had succeeded on a scale
involving tens of thousands of documents.
It is hard to say who looks worst from the latest news.
Microsoft Corp. will be severely embarrassed that a major customer
was attacked using a flaw the company had warned of but not managed
to patch. Likewise, the fact the attack is being openly attributed
to China must be uncomfortable for the authorities there, who know
they are assumed to approve any sophisticated use of the Internet
in the country.
icon.
