04:24 PM

Virus Hits Part Of U.S. Commerce Dept.

Economic Development Administration has disabled its website and email while attack is investigated.

Best Government Web Sites
(click image for larger view)
Slideshow: Best Government Web Sites
A virus has caused the Department of Commerce's Economic Development Administration (EDA) to disable its email and Internet access indefinitely while the nature and origin of the attack is investigated.

Visitors to the EDA's website are greeted with a banner across the top with the message that the agency's site and email system is "experiencing a disruption in service."

"The agency is working to address the issue and resume normal operations as soon as possible," according to the message.

In the meantime, the EDA--which awards business-development grants to communities that need economic stimulation--has put up a simple, temporary website giving people access to key information, such as funding opportunities and contact information.

[ FBI warns that hack attacks will increase. See Cyber Attacks Becoming Top Terror Threat, FBI Says. ]

"We continue to operate as fully as possible to meet our core mission," the agency said in an emailed statement, adding that it is still processing grant applications and serving customers. Staffers will be working using phone and fax lines until service is restored.

Commerce spokeswoman Jennifer Friedman confirmed in an interview Friday that the department isolated the network and systems by disconnecting them out of caution on Jan. 24 after a virus attack. The attack is still under investigation by the department's IT team, the United States Computer Emergency Readiness Team (US-CERT), and an outside team of experts.

Officials don't have details on the scope of the attack nor do they know when the systems will be back online, she said.

The virus initially was discovered Jan. 20, after which EDA IT staff issued McAfee system updates to all EDA staff computers over the next several days. However, the EDA discovered additional virus contamination, which led to the disconnection of the systems.

The feds haven't had the best luck lately keeping their websites at the top of their service, but this has been mainly due to back-end issues rather than security woes.

Sites that have experienced service disruptions over the last several months include the Defense Information System Agency, USA.gov, and CIO.gov.

However, security was the cause of a shutdown of Internet access at another federal department website in the last year. A phishing attack on the Department of Energy's Oak Ridge National Laboratory last April caused the lab to shut down Internet and email access for more than a week.

InformationWeek's 2012 Government IT Innovators program will feature the most innovative government IT organizations in the 2012 InformationWeek 500 issue and on InformationWeek.com. Does your organization have what it takes? The nomination period for 2012 Government IT Innovators closes April 27.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
2/4/2012 | 2:51:16 PM
re: Virus Hits Part Of U.S. Commerce Dept.
They shut the network down because of a simple virus? There is something missing from this article. People do not shut down networks and turn off email for simple viruses anymore. They stopped doing that back in the 90s. Either an IT admin is incompetent at his job or there is something else going on here, some sort of APT attack perhaps. Unfortunately there is not enough detail in the article to know for sure.

Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-09
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.

Published: 2015-10-09
The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone-call restrictions via unspecified vectors.

Published: 2015-10-09
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.

Published: 2015-10-09
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.

Published: 2015-10-09
The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.