Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
Network Security
Cisco UCS Invicta Series flash memory systems
Average Rating:
Rate this article:  
Labor Department Web Site Hacked, Malware Uploaded
Labor Department Web Site Hacked, Malware Uploaded

By Jennifer LeClaire
May 1, 2013 2:04PM

    Bookmark and Share
"It's difficult to discern the intent of a criminal targeting visitors to such a specific Web site, but clearly this was planned well in advance, and was not intended to reach a wide audience of potential victims," said security researcher Andrew Brandt. A relatively obscure portion of the U.S. Department of Labor Web site was hacked, and malware placed there.
 


The U.S. Department of Labor's Web site was hacked on Tuesday. Malicious code was placed on the site in the process.

According to security information and event management firm AlienVault, the government site has been serving out malicious code since Wednesday. That code then works to install malware on victim computers. The Labor Department could not be reached immediately but news reports indicate the hack has been resolved.

Some security firms are pointing the finger at DeepPanda, a Thai non-governmental organization with a human rights mandate. DeepPanda has been connected with a number of advanced persistent threat attacks.

Behind the Hack Attack

Andrew Brandt, director of Threat Research at Solera Networks, said although he was not sure what time the Labor Department site was modified, he he was made aware Tuesday that code that was suspicious in appearance had been uploaded to the department's "Site Exposure Matrices" (SEM) Web site.

"The page is offline at the moment, and I had never heard of the SEM before, but the SEM page described it as 'a repository of information gathered from a variety of sources regarding toxic substances present at Department of Energy (DOE) and Radiation Exposure Compensation Act (RECA) facilities," Brandt told us.

"The code that was added to the foot of the page caused a site visitor to load a script hosted on a server elsewhere. The page loaded the script from a page at the domain dol.ns01.us -- but the ns01.us domain is actually owned by a dynamic DNS service called ChangeIP.com. The domain name pointed to a server hosted in Los Angeles, as of last night."

What Was the Motive?

Among the malicious code pushed down to victims' computers was a binary data file with a .png extension. Brandt didn't manage to obtain this file through visiting the site. Instead, another researcher provided the file. That researcher claimed this binary file was the initial malware payload of the attack.

According to Brandt, upon execution, the malware tried to contact another ChangeIP.com dynamic DNS hostname -- microsoftUpdate.ns1.name. As of this morning, he explained, that hostname had been blackholed and the malware has been unable to "phone home" since.

"It's difficult to discern the intent of a criminal targeting visitors to such a specific Web site, but clearly this was planned well in advance, and was not intended to reach a wide audience of potential victims," Brandt said. "The reality is that the public, and possibly even the webmasters at the Labor Department, may never know who carried out the attack or why, or just how successful it was."
 

Tell Us What You Think
Comment:

Name:

Terrie Barrie, Alliance:

Posted: 2013-05-01 @ 2:33pm PT
As an advocate for the sick nuclear weapons workers, this attack is beyond concerning. Advocates, claimants and DOL personnel frequently use the database to locate information to assist in proving an illness was the result of toxic exposures at a DOE plant. How many personal computers have been infected? Since DOL claims examiners use this database, have personal identifying information such as Social Security numbers been compromised?



Get Powerful App Acceleration with Cisco. In a world where time is money, you need to accelerate the speed at which data moves through your data center. Cisco UCS Invicta delivers powerful, easy-to-manage application acceleration for data-intensive workloads. So you can make decisions faster and outpace the competition. Learn More.


 Network Security
1.   Microsoft Ruling Raises Privacy Concern
2.   Twitter Buys Password Manager Mitro
3.   Gov't User Data Requests Skyrocket
4.   Retailers Hacked by New Malware
5.   IBM Beefs Up Identity Intelligence


advertisement
Twitter Buys Password Manager Mitro
Startup to release code as open source.
Average Rating:
Gov't User Data Requests Skyrocket
Twitter: From U.S. and around the globe.
Average Rating:
IBM Beefs Up Identity Intelligence
To offer biz better security products.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Ruling Against Microsoft Raises E-Mail Privacy Concern
Microsoft has been ordered to hand over e-mails to law enforcers in the United States as part of a criminal investigation, even though the e-mail is stored at a data center in Dublin,Ireland.
 
Twitter Buys Password Manager Startup Mitro
Following on the heels of another acquisition earlier this week, Twitter is adding to its fold a password-manager security startup called Mitro, which in turn is releasing its code as open source.
 
Government Requests for Customer Data Skyrocket
Requests for customer data from the government jumped 50 percent in the first half of 2014, according to Twitter, which received more than 2,000 requests for user info from gov't agencies.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.