FBI looks at Chinese role in Darfur site hack
Aid organization's Web and e-mail servers under attack
IDG News Service - The U.S. Federal Bureau of Investigation is looking into a possible China connection in the hack of a nonprofit group created to draw attention to the ongoing genocide in western Sudan's Darfur region.
The Save Darfur Coalition called in the FBI earlier this week after discovering that someone had gained unauthorized access to its e-mail and Web server, according to Allyn Brooks-LaSure, a spokesman with the group.
Brooks-LaSure doesn't know who is behind the attacks, but he said the Internet Protocol addresses of the computers that had hacked his organization were from China. "Someone in Beijing is trying to send us a message," he said.
The hackers seemed to be primarily interested in gathering data on his group, Brooks-LaSure said. Save Darfur has been trying to get China to pressure Sudan's government into stopping the mass killings in Darfur's ongoing civil war. China is one of Sudan's largest trading partners.
Computers in China have been the source of many attacks in recent years, although security experts say that sometimes China-based machines are simply used as jumping-off points for attackers who actually reside in other countries such as the U.S. or Russia.
Groups that work with Save Darfur may have also been hit, Brooks-LaSure said. Some partner organizations have been the subject of very targeted e-mail attacks over the past few weeks that have tried to trick workers into opening malicious documents or visiting malicious Web sites. These are both common ways of installing unauthorized software on a victim's computer.
This type of targeted e-mail attack was recently employed by attackers looking to infect people on a pro-Tibet mailing list. Victims who opened what appeared to be a statement of solidarity for the people of Tibet were secretly hit with attack code that exploited a flaw in Adobe's Acrobat software, said security researchers at F-Secure in a blog posting.
"It looked like it was coming from the Unrepresented Nations and Peoples Organization (UNPO). However, the e-mail headers were forged and the mail was coming from somewhere else altogether," wrote F-Secure.
Many pro-Tibet organizations have been targeted with these types of attacks in recent months, the company added. "This is not an isolated incident. Far from it," the company said. "These e-mails have been sent to mailing lists, private forums and directly to persons working inside pro-Tibet groups. Some individuals have received targeted attacks like this several times a month."
A similar type of attack was used last month to infect computers at a committee working on security at the upcoming 2008 Olympic Games in Beijing, according to security vendor MessageLabs.
Members of that committee were infected by a malicious Microsoft Word document that they then forwarded to other organizations, according to MessageLabs researcher Maksym Schipka. In that case, "the bad guys did not have to hack into the good guy's mail server, all they had to do was persuade them that the document was something interesting so that the good guys themselves would forward it on," he said.
It is not clear that there is any connection between the attack reported by MessageLabs and that reported by Save Darfur.
When contacted Friday regarding the Save Darfur incident, FBI Spokeswoman Debbie Weierman confirmed that the law enforcement agency was "looking into the matter."
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts