Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Home Network Security Viruses & Malware Hackers Security Solutions More Topics...
Viruses & Malware
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Labor Department Web Site Hacked, Malware Uploaded
Labor Department Web Site Hacked, Malware Uploaded

By Jennifer LeClaire
May 1, 2013 2:04PM

Bookmark and Share
"It's difficult to discern the intent of a criminal targeting visitors to such a specific Web site, but clearly this was planned well in advance, and was not intended to reach a wide audience of potential victims," said security researcher Andrew Brandt. A relatively obscure portion of the U.S. Department of Labor Web site was hacked, and malware placed there.
 


The U.S. Department of Labor's Web site was hacked on Tuesday. Malicious code was placed on the site in the process.

According to security information and event management firm AlienVault, the government site has been serving out malicious code since Wednesday. That code then works to install malware on victim computers. The Labor Department could not be reached immediately but news reports indicate the hack has been resolved.

Some security firms are pointing the finger at DeepPanda, a Thai non-governmental organization with a human rights mandate. DeepPanda has been connected with a number of advanced persistent threat attacks.

Behind the Hack Attack

Andrew Brandt, director of Threat Research at Solera Networks, said although he was not sure what time the Labor Department site was modified, he he was made aware Tuesday that code that was suspicious in appearance had been uploaded to the department's "Site Exposure Matrices" (SEM) Web site.

"The page is offline at the moment, and I had never heard of the SEM before, but the SEM page described it as 'a repository of information gathered from a variety of sources regarding toxic substances present at Department of Energy (DOE) and Radiation Exposure Compensation Act (RECA) facilities," Brandt told us.

"The code that was added to the foot of the page caused a site visitor to load a script hosted on a server elsewhere. The page loaded the script from a page at the domain dol.ns01.us -- but the ns01.us domain is actually owned by a dynamic DNS service called ChangeIP.com. The domain name pointed to a server hosted in Los Angeles, as of last night."

What Was the Motive?

Among the malicious code pushed down to victims' computers was a binary data file with a .png extension. Brandt didn't manage to obtain this file through visiting the site. Instead, another researcher provided the file. That researcher claimed this binary file was the initial malware payload of the attack.

According to Brandt, upon execution, the malware tried to contact another ChangeIP.com dynamic DNS hostname -- microsoftUpdate.ns1.name. As of this morning, he explained, that hostname had been blackholed and the malware has been unable to "phone home" since.

"It's difficult to discern the intent of a criminal targeting visitors to such a specific Web site, but clearly this was planned well in advance, and was not intended to reach a wide audience of potential victims," Brandt said. "The reality is that the public, and possibly even the webmasters at the Labor Department, may never know who carried out the attack or why, or just how successful it was."
 

Tell Us What You Think
Comment:

Name:

Terrie Barrie, Alliance:

Posted: 2013-05-01 @ 2:33pm PT
As an advocate for the sick nuclear weapons workers, this attack is beyond concerning. Advocates, claimants and DOL personnel frequently use the database to locate information to assist in proving an illness was the result of toxic exposures at a DOE plant. How many personal computers have been infected? Since DOL claims examiners use this database, have personal identifying information such as Social Security numbers been compromised?



Your Next Generation Data Center Is Here! Vblock™ Systems: the world's most advanced converged infrastructure are built on the Cisco Unified Computing System with Intel® Xeon® processors. Vblock™ Systems deliver extraordinary time to market, ROI and TCO, and flexibility to meet your continually changing demands with 5X faster deployment, 96% less downtime, and 1/2 the cost. Click here to learn more.


 Viruses & Malware
1.   Lessons from Verizon's Threat Report
2.   Malware Targets Facebook Users
3.   OpenSSL Calls for More Support
4.   How, Why Heartbleed Got Its Name
5.   Android Apps Mine Virtual Currency


advertisement
Lessons from Verizon's Threat Report
Enterprises can learn a thing or two.
Average Rating:
Malware Targets Facebook Users
iBanking app spys on communications.
Average Rating:
Android Apps Mine Virtual Currency
Malware drains mobile phone battery.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
What Verizon's Data Breach Report Can Teach Enterprises
It’s probably not a jaw-dropper, but cyberespionage is officially on the rise. And the use of stolen or misused credentials is still the leading way the bad guys gain access to corporate information.
 
Top Cyberthreats Exposed by Verizon Report
Beyond Heartbleed, there are cyberthreats vying to take down enterprise networks, corrupt smartphones, and wreak havoc on businesses. Verizon is exposing these threats in a new report.
 
Where Do Web Sites Stand, Post-Heartbleed?
A security firm says the vast majority of Web sites have patched themselves to protect against the Heartbleed bug, but now there are questions raised on the reliability of open-source programs.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Hackers | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.