By Gopal Ratnam and Juliann Neher
July 9 (Bloomberg) -- U.S. government and private company websites were attacked during the July 4 holiday weekend and early this week by hackers who haven’t been identified, officials said.
Web sites of the U.S. departments of State, Treasury and Transportation as well NYSE Euronext, the world’s largest owner of stock exchanges, were affected. The exchange said it was notified by authorities that it had been the target of a cyber attack aimed at slowing or shutting down its Web site. Market data and trading systems were not at risk, it said.
The Department of Homeland Security was aware of the attacks and its Computer Emergency Readiness Team, or CERT, was advising government agencies and private companies on “steps to take to mitigate against such attacks,” Amy Kudwa, a spokeswoman for the department, said in an e-mail yesterday.
The attacks are known as distributed denial of service, a common practice by hackers who commandeer remote computers to flood targeted Web sites with a large volume of data that renders the sites inaccessible to other users. Kudwa said she didn’t have information on reports by Seoul-based Yonhap News that North Korea may have orchestrated the effort.
The attack on the State Department’s state.gov site started July 5, department spokesman Ian Kelly said at the daily briefing with reporters yesterday. “It’s still ongoing, but I’m told it’s much reduced right now,” he said. He also said that he hadn’t noticed “any real difficulties” in accessing the site. He declined to speculate on who was responsible.
‘Particularly Aggressive’
Although attacks that lead to service denials are common, the assault on government and private networks that began during the weekend “was particularly aggressive,” Representative Jim Langevin, a Rhode Island Democrat and a member of the House Intelligence Committee, said in a phone interview.
Government agencies and private companies are working “very well together and are getting better at identifying and improving our ability to respond,” Langevin said. Eventually, with better coordination, such attacks can be prevented, he said.
Langevin said it was premature to say the attacks came from any one country. The National Security Agency is working to identify the perpetrators and “I’m very confident we will have a very good sense of where it originated and who’s responsible,” he said.
Attacks Every Day
“We see attacks on federal networks every single day,” said Nick Shapiro, a White House spokesman. Preventive measures have minimized impact and the assault “had absolutely no effect on the White House’s day-to-day operations,” he said.
The Washington Post reported yesterday that its site had been targeted. A Treasury Department aide speaking on condition of anonymity said the agency’s Web sites were operational after an attack during the weekend.
The design of NYSE Euronext’s Web site meant the exchange experienced no problems with its nyse.com Web site or other services provided to issuers and traders through the Internet, said Ray Pellecchia, a spokesman for the New York-based company.
Department of Transportation spokeswoman Sasha Johnson said in an e-mail that the agency was “experiencing minimal network incidents this past weekend. We are working with the U.S. Computer Emergency Readiness Team at this time.”
The Federal Trade Commission’s site was “down a couple of days ago due to technical problems,” Peter Kaplan, an FTC spokesman, said in a phone interview. He wouldn’t say whether an outside attack was responsible for an outage on the commission’s Web site.
Almost Doubled
Security breaches on U.S. and private networks reported to the Department of Homeland Security almost doubled to 72,000 for the year fiscal year ending in September 2008, from 37,000 the previous year.
President Barack Obama said in May he will appoint a White House adviser to oversee the security of all government and business computer networks in response to widespread breaches and theft of information.
Several sites in South Korea were targeted and the country’s National Intelligence Service in a statement attributed the attacks to a group or a state, according to Yonhap News, a South Korean news agency.
Referring to North Korea, Bruce Klingner, a North-East Asia analyst at the Washington-based Heritage Foundation, said in a statement, “If Pyongyang were behind the recent cyber attacks, it would mark another escalation in North Korean provocations against Washington and Seoul.”
No ‘Hard Evidence’
North Korea has an “extensive and capable cyber terrorism Effort,” though it has a poor technology infrastructure, Klingner said. He said there was no “hard evidence” linking North Korea to the attacks.
The weekend’s security intrusion “is not very different from the daily attacks” on U.S. computer networks, Marcus Sachs, Washington-based director of the SANS Internet Storm Center, said in an interview. The all-volunteer group of computer experts acts as a watchdog monitoring Internet attacks worldwide.
The weekend security breach appeared to be a “reprogrammed old worm allowed to spread on autopilot,” or malicious software code that seeks a target list of sites on its own, Sachs said.
As with most computer attacks, proving the hackers’ origins or nationality is difficult, Sachs said. “If South Korea says this is coming from North Korea, I say prove it. Drawing conclusions is truly a fantasy at this moment.”
To contact the reporters on this story: Gopal Ratnam in Washington at gratnam1@bloomberg.net; Juliann Neher in Washington at jneher@bloomberg.net.
Last Updated: July 9, 2009 00:01 EDT
HOME
