Cyber spies have infiltrated the US

WASHINGTON — Foreign spies have infiltrated the US electrical grid, leaving behind software programs that could disrupt the system in a time of war, American national security officials have claimed.

The intruders from countries including China and Russia, were believed to be attempting to map the US electrical system and work out how it was controlled, according to reports in the Wall Street Journal.

Officials said the cyber spies had not tried to damage the grid, but warned they could during a crisis or war. “The Chinese have attempted to map our infrastructure, such as the electrical grid,” a senior intelligence official told the paper. “So have the Russians.”

The intrusion spread across the country and did not target any specific companies or regions, a former Department of Homeland Security official said.

Several of the intrusions were detected by US intelligence agencies and not by the companies in charge of the infrastructure, the officials said.

The breaches come as concern grows among the intelligence community over cyber attackers taking control of electrical facilities, a nuclear power plant or financial networks via the Internet.

More worrying was the discovery that the cyber spies had left behind software tools that could be used to destroy infrastructure components, the senior intelligence official said. He told the Wall Street Journal: “If we go to war with them, they will try to turn them on.”

Director of National Intelligence Dennis Blair recently told politicians: “A number of nations, including Russia and China, can disrupt elements of the US information infrastructure.”

The sophisticated cyber intrusions suggest China and Russia, say cyber security specialists. Terrorist groups have yet to mount such an attack, although they could develop the ability to do so. Russian and Chinese officials have denied any involvement.

The Daily Telegraph


From TODAY, World – Thursday, 09-April-2009

Conficker worm active, security experts say

AFP - Friday, April 10

WASHINGTON (AFP) - - The Conficker worm, believed to have burrowed into millions of computers around the world, has sent an encrypted data message to infected machines, according to a computer security firm.

Trend Micro said the purpose of the mysterious update, sent to other infected machines using peer-to-peer (P2P) file transfer software, was not immediately clear.

Ivan Macalintal, a Trend Micro advanced threats researcher, said Conficker began showing activity on Tuesday, nearly a week after the expected April 1 activation date that had computer security experts on alert around the world.

"As expected, the P2P communications of the Downad/Conficker botnet may have just been used to serve an update," Macalintal wrote in a post late Wednesday on the TrendLabs Malware blog. "The Conficker/Downad P2P communications is now running in full swing!"

Macalintal said the worm was connecting to MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com to detect whether a host computer is connected to the Web.

After performing the test, it deletes any traces of itself in the infected machine, he said, adding that it is scheduled to stop running the test on May 3.

"It runs and deletes all traces, no files, no registries etc," he said.
The worm remains present on an infected machine, however, and could be activated at a later date.

Trend Micro is monitoring the worm on an infected computer as part of the Conficker Working Group of security experts.

A task force assembled by Microsoft has been working to stamp out Conficker, also referred to as DownAdUp, and the software colossus has placed a bounty of 250,000 dollars on the heads of those responsible for the threat.

The worm, a self-replicating program, takes advantage of networks or computers that haven't kept up to date with security patches for Windows.

It can infect machines from the Internet or by hiding on USB memory sticks carrying data from one computer to another.

Conficker could be triggered to steal data or turn control of infected computers over to hackers amassing "zombie" machines into "botnet" armies.

Microsoft has modified its free Malicious Software Removal Tool to detect and remove Conficker. Security firms, including Trend Micro, Symantec and F-Secure, provide Conficker removal services at their websites.

The tell-tale signs that a computer is infected includes the worm blocking efforts to connect with websites of security firms providing online tools for removing the virus.


The original article is found here.