[iwar] [fc:NIPC.Daily.Report.25.September.2001]

From: Fred Cohen (fc@all.net)
Date: 2001-09-25 16:15:45
Next message: Fred Cohen: "[iwar] [fc:Bill.would.boost.info.sharing.-.between.government.and.industry]"
Previous message: Fred Cohen: "[iwar] [fc:Shiite.propaganda]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-Id: <200109252315.QAA03467@big.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Tue, 25 Sep 2001 16:15:45 -0700 (PDT)
Reply-To: iwar@yahoogroups.com
Subject: [iwar] [fc:NIPC.Daily.Report.25.September.2001]
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 8bit

NIPC Daily Report 25 September 2001

NOTE: Please understand that this is for informational purposes only and
does not constitute any verification of the information contained in the
report nor does this constitute endorsement by the NIPC or the FBI. 

Significant Changes and Assessment - NTR

Private Sector - A newly discovered mass-mailing Internet worm with an
anti-American message is in the wild, virus researchers warned on 24
September.  The worm, which experts have named W32.Vote.A@mm or simply
the Vote worm, targets Windows computer users and arrives in an e-mail
with the subject line "Fwd:Peace BeTweeN AmeriCa and IsLaM!" and bearing
an attachment named wtc.exe.  In an apparent attempt to trick users into
running the program, the message body reads "Is it a war against America
or Islam.  Lets Vote to live in peace." Details on the worm and removal
instructions can be found on major US commercial anti-virus vendor’s Web
sites.  (NIPC Comment: The NIPC has become aware of a new Internet worm
named W32.Vote.A@mm aka wtc.exe.  The worm appears to be a mass mailer
targeting users of Microsoft Outlook/Outlook Express.  The anti-virus
vendors have rated the damage as low with moderate to high distribution. 
This does not appear to be the same virus as wtc.txt.vbs identified in
the NIPC Advisory 01-020.  As stated in that advisory, users are
cautioned about opening such e-mail attachments claiming to be related
to the terrorist attacks because they may contain malicious code. 
Several major anti-virus vendors have posted new .dat files to detect
this worm.  Also, the anti-virus industry is recommending that consumers
filter incoming messages for .exe files to ensure that they don't
contain malicious code.) (Source: Newsbytes, 24 September)

Wired news reported that hackers say it's easy to take over America
Online's (AOL) Instant Messenger (AIM) accounts using several hacking
programs that are in wide circulation on the Internet.  They can then
pose as the users who accounts have been commandeered.  The AIM program
allows users to send instant text messages and transfer files to each
other.  Most AIM users create a "buddy list," a personal directory of
their friends and family who use the service.  Hackers who take over an
account have full access to that account's buddy list.  Accounts that
have been taken over can then be used to distribute viruses by sending
infected files from a "buddy." (Source: Wired News, 24 September)

Government - An expert on computer security says if the US launches
attacks in Afghanistan, watch out for cyber-terrorism.  Other experts
agree that it could become one more way for terrorists to do their dirty
work.  A comprehensive and destructive attack on a critical
infrastructure, such as the power grid or banks, could cause serious
problems.  So far, most assaults on computer systems have been "denial
of service" attacks that are more annoying than devastating.  The CIA's
top advisor on science and technology says traditional terrorists still
prefer bombs over bytes.  Lawrence Gershwin told congress that could
change, as more computer savvy recruits enter the ranks.  The FBI says
it's on the watch for cyber-terrorists.  (Source: Associated Press, 24
September)

On 24 September, Treasury Secretary Paul O’Neill said the foreign
terrorist asset tracking center at the Treasury Department is up and
running, The center identifies and investigates the financial
infrastructure of international terrorist networks.  President George W. 
Bush signed an executive order that freezes US assets of 27 entities,
including what he called terrorist organizations and individual
terrorist leaders.  “With the signing of this executive order, we have
the President’s explicit directive to block the US assets of any
domestic or foreign financial institution that refuses to cooperate with
us in blocking assets of terrorist organizations,” O’Neill said.  The
center is working with government agencies and industrialized nations to
stamp out financial networks that fund terrorism.  (Source: Government
Computer News, 24 September)

Fairfax County Virginia, fell victim to the Nimda virus, forcing it to
shut down its Web site until each of the county's 9,000 computers and
300 servers has been screened, officials said on 24 September. 
Technicians said it could be several days before the county reopens its
Web site, which receives more than a million hits a day as residents log
on for a variety of services, from paying their car taxes to renewing
library books and reserving tee times at county-owned golf courses. 
Fairfax mobilized enormous resources to battle the so-called Nimda virus
"admin" spelled backward which began its march through county computers
on 19 September.  A virus command center was set up, and approximately
150 technicians have been working round the clock to keep the Nimda
virus from spreading further.  (Source: Washington Post, 25 September)

Military - The DoD, in consultation with law-enforcement agencies, is
considering expanding its ability to take pro-active measures to thwart
would-be intruders of its computer networks.  These measures, if
adopted, would give the department the unprecedented ability to conduct
reconnaissance of non-DoD domestic and foreign networks as a means of
providing advanced warning of pending attacks and tracing their origin. 
Army Maj.  Gen.  James Bryan, who directs the DoD's Joint Task
Force-Computer Network Operations (JTF-CNO), told Jane's Defense Weekly:
"People are free to browse all over the global Internet and that is what
we are really talking about - a form of reconnaissance that is much like
browsing." At the same time, he said these deliberations are in a very
preliminary stage and the DoD is "a long way" from performing these
activities.  US law currently precludes the DoD from conducting computer
network defense (CND) activities outside its own network infrastructure. 
(Source: Jane's Defense Weekly, 26 September)

International - Asia's largest Internet show kicks off in the Indian
capital on 26 September, with plans to showcase a range of technologies
on using the Web more efficiently after the dotcom meltdown.  Some 70
firms participating in the three-day India Internet World will offer
their expertise on leveraging the web for Internet based finance and
customer management, digital commerce, web procurement and virtual
infrastructure.  “The focus of the show is based on the assumption that
the Internet is a reality now and only a web presence is not enough,”
Pradeep Kar, chairman of Microland, one of the organizers of the show. 
E-commerce in India is projected to grow 10 times to $40.7 billion over
the next five years, according to a joint study undertaken by the
country's main software industry body and a Boston Consulting Group. 
(Source: Reuters, 25 September)

U.S.  SECTOR INFORMATION:

Electrical Power - Authorities and the Moffat County hospital went on
alert over the weekend following a call that two men of Middle Eastern
descent suspiciously delivered a substance to an area power plant.  An
investigation by the FBI and a hazardous materials team found the
substance to be Ecodex, a water treatment agent used at the power plant,
Moffat County Sheriff Buddy Grinstead said.  No arrests were made.  He
said a worker at the Tri-State Generation and Transmission Power Plant
notified authorities on 23 September.  The worker said the driver of the
delivery truck took longer than usual to back up and drop off the
materials.  He also said some of the shrink wrap had been removed or
opened.  Grinstead said increased awareness and fears following the
terrorist attacks in New York and Washington probably led the worker to
telephone police.(Source: Associated Press, 24 September)

Water Supply - US drinking water suppliers have been advised, at the
direction of the FBI, to be on alert and exercise caution to guard
against possible attempts at sabotage in the wake of the recent terror
attacks.  "We have advised all utilities to be on alert and cautious,"
Tom Curtis, the deputy executive director of the American Water Works
Association (AWWA).  "We are not responding to a specific threat
advisory from the FBI concerning water utilities, but we have advised
water utilities to be on a heightened state of alert." (Source: UPI, 24
September)

Transportation - The FAA said that hundreds of thousands of airport
workers need to have their credentials verified to ensure they are valid
in an attempt to reassure airline passengers and flight crews that
security gaps at the nation's airports are being addressed.  The
unprecedented order, which covers the spectrum of workers authorized to
enter secure areas of airports, gives airport authorities until 3
October to re-validate employee identification in an attempt to track
down any that may have been falsified or stolen.  "The general belief is
that at many airports, there are a lot of badges that have not been
returned and might be held by people who no longer work at the airport,"
said James Coyne, president of the National Air Transportation
Association, which represents contractors providing services at
airports.  (Source: Chicago Tribune, 25 September)

Telecommunications - The number of cell phones worldwide could eclipse
the number of traditional land lines by 2006, according to a report
issued on 20 September by a California research company.  With Asia and
Europe leading the way as heavy adopters of wireless technology, by 2006
there will be 1.6 billion cellular phone subscribers and just 963
million fixed-line subscribers, according to a report published by The
Carmel Group.  This shift toward a highly mobile world could increase
the productivity of workers around the globe, as users will have almost
immediate access to many forms of information no matter where they go. 
(Source: InfoWorld, 24 September)

Emergency Services - NTR
Banking and Finance - NTR
Gas and Oil Storage Distribution - NTR
Government Services - NTR

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Pinpoint the right security solution for your company- Learn how to add 128- bit encryption and to authenticate your web site with VeriSign's FREE guide!
http://us.click.yahoo.com/JNm9_D/33_CAA/yigFAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Next message: Fred Cohen: "[iwar] [fc:Bill.would.boost.info.sharing.-.between.government.and.industry]"
Previous message: Fred Cohen: "[iwar] [fc:Shiite.propaganda]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
This archive was generated by hypermail 2.1.2 : 2001-09-29 21:08:49 PDT