FBI, U.S. Marshals Service Computers Shut Down In Malware Attack

(URL: )

By Stefanie Hoffman, ChannelWeb


7:05 PM EDT Fri. May. 22, 2009


The FBI and U.S. Marshals Service were hit by malware that forced the government agencies to shut down parts of their computer systems Thursday.

An FBI spokesperson told the Associated Press that the federal agency was working to resolve the problem. Meanwhile, a spokesperson for the U.S. Marshals Service, the federal agency that initiates fugitive investigations and oversees the Witness Protection Program, confirmed that its computer systems were infected with a mysterious virus that led IT administrators to shut down e-mail and Internet access.

U.S. Marshals spokesperson Nikki Credic said that IT staff "took immediate action" Thursday by isolating the agency's network and disconnecting it from the Department of Justice's to prevent the virus from spreading. IT staff then took corrective action by updating antivirus software and pushing the updates throughout the agency's network, she said.

"Once they discovered something was going on, they immediately took action that day to resolve the problem," Credic said.

The remediation process rendered the U.S. Marshals Service without e-mail and Internet access for most of the day Thursday. However, Credic said that internal computer systems still functioned and that the agency's networks were up and running as normal on Friday.

Credic said that the cause and origin of the malware attack were still under investigation but maintained that the attack didn't entail an evident breach of sensitive information. Both federal agencies said only unclassified systems were affected by the attack.

"None of the data were at risk," Credic said. "From our understanding, no data was compromised."

The Washington, D.C.-based U.S. Marshals Service is the country's oldest law enforcement agency, serving the country since 1789, and the premier agency to apprehend foreign fugitives believed to be in the U.S. Last year, the U.S. Marshals Service apprehended more than 36,000 federal fugitives and cleared more than 39,700 felony warrants.

Reports have circulated that the malware responsible for the U.S. Marshals hack could be a variant of the Neeris worm, a copycat of the notorious Conficker worm. The Neeris worm imitates Conficker's propagation methods and exploits the same vulnerability that occurs in the way the Server Service handles RPC requests.

Neeris has been around since 2005, but resurfaced at the end of March and beginning of April, when security researchers were embroiled in Conficker issues. Like Conficker, the Neeris worm spreads on Windows Autorun, as well as over peer-to-peer networks, USB sticks and Instant Messenger by exploiting security vulnerabilities in users' unpatched systems.

Microsoft issued an emergency out-of-band patch in October, shoring up security holes that left systems vulnerable to both Conficker and Neeris.

"This is nothing new. What Neeris is doing is copycatting Conficker," said Derek Manky, project manager of cybersecurity and threat research for security firm Fortinet. "The worm was able to spread because system patches aren't up to date."

Security experts say that while Internet worms are defined by their ability to spread, they often include sophisticated features, such as backdoors and downloaders, which can drop malicious code onto users' computers.

Manky said that Neeris could contain malicious code that enables remote hackers to take control of affected systems and steal personal or financial information, which could compromise the sensitive data belonging to those infected.

"Any time you have a connection that allows [hackers] to send and receive data, there's always that possibility [of a data breach]," Manky said."After any compromise, data could breached."

Manky added that the malware discovered on the U.S. Marshals Service's systems reinforced the need for both individuals and organizations to apply patches regularly and maintain up-to-date security software.

"We really have to look at the lessons learned there because it's very much the same with Neeris," Manky said. "It's just another stark reminder that these are very real threats."


Copyright 2009 Everything Channel