Risk
2/3/2012
04:24 PM
Connect Directly
RSS
E-Mail
50%
50%

Virus Hits Part Of U.S. Commerce Dept.

Economic Development Administration has disabled its website and email while attack is investigated.

Best Government Web Sites
(click image for larger view)
Slideshow: Best Government Web Sites
A virus has caused the Department of Commerce's Economic Development Administration (EDA) to disable its email and Internet access indefinitely while the nature and origin of the attack is investigated.

Visitors to the EDA's website are greeted with a banner across the top with the message that the agency's site and email system is "experiencing a disruption in service."

"The agency is working to address the issue and resume normal operations as soon as possible," according to the message.

In the meantime, the EDA--which awards business-development grants to communities that need economic stimulation--has put up a simple, temporary website giving people access to key information, such as funding opportunities and contact information.

[ FBI warns that hack attacks will increase. See Cyber Attacks Becoming Top Terror Threat, FBI Says. ]

"We continue to operate as fully as possible to meet our core mission," the agency said in an emailed statement, adding that it is still processing grant applications and serving customers. Staffers will be working using phone and fax lines until service is restored.

Commerce spokeswoman Jennifer Friedman confirmed in an interview Friday that the department isolated the network and systems by disconnecting them out of caution on Jan. 24 after a virus attack. The attack is still under investigation by the department's IT team, the United States Computer Emergency Readiness Team (US-CERT), and an outside team of experts.

Officials don't have details on the scope of the attack nor do they know when the systems will be back online, she said.

The virus initially was discovered Jan. 20, after which EDA IT staff issued McAfee system updates to all EDA staff computers over the next several days. However, the EDA discovered additional virus contamination, which led to the disconnection of the systems.

The feds haven't had the best luck lately keeping their websites at the top of their service, but this has been mainly due to back-end issues rather than security woes.

Sites that have experienced service disruptions over the last several months include the Defense Information System Agency, USA.gov, and CIO.gov.

However, security was the cause of a shutdown of Internet access at another federal department website in the last year. A phishing attack on the Department of Energy's Oak Ridge National Laboratory last April caused the lab to shut down Internet and email access for more than a week.

InformationWeek's 2012 Government IT Innovators program will feature the most innovative government IT organizations in the 2012 InformationWeek 500 issue and on InformationWeek.com. Does your organization have what it takes? The nomination period for 2012 Government IT Innovators closes April 27.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
h4zzmatt@yahoo.com
50%
50%
h4zzmatt@yahoo.com,
User Rank: Apprentice
2/4/2012 | 2:51:16 PM
re: Virus Hits Part Of U.S. Commerce Dept.
They shut the network down because of a simple virus? There is something missing from this article. People do not shut down networks and turn off email for simple viruses anymore. They stopped doing that back in the 90s. Either an IT admin is incompetent at his job or there is something else going on here, some sort of APT attack perhaps. Unfortunately there is not enough detail in the article to know for sure.

-h4zzmatt
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3587
Published: 2014-08-22
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists bec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.