• E-mail
• Print
• Comment
• Font Size
• Digg
• del.icio.us
• Discuss article

U.S. Warns Banks of Virus-Like Infection

Posted on: Tuesday, 10 June 2003, 06:00 CDT

By TED BRIDIS

WASHINGTON (AP) -- The government is warning financial institutions about a virus-like infection that has targeted computers at roughly 1,200 banks worldwide, trying to steal corporate passwords.

The FBI is investigating what private security experts believe to be the first Internet attack aimed primarily at a single economic sector.

Virus experts studying the blueprints for the latest threat to Internet users were astonished to find inside the software code a list of roughly 1,200 Web addresses for many of the world's largest financial institutions, including J.P. Morgan Chase & Co., American Express Co. (AXP), Wachovia Corp., Bank of America Corp. and Citibank N.A.

The destructive infection, known as "BugBear.B," has spread to tens of thousands of consumer computers across the Internet since last week, but investigators and industry experts said they were unaware if any financial institutions had been significantly affected.

Industry executives told Treasury Department officials and other banking regulators during a meeting Monday in Washington that while they were concerned that the infection targeted them, they were unaffected because of tight corporate security.

The infection "was hammering the outside servers but it was being rejected," said Suzanne Gorman, head of the Financial Services Information Sharing and Analysis Center, a bank cybersecurity organization that works with the government. "People weren't reporting that it got through to their personal organizations."

The analysis center distributed information from the Homeland Security Department to the nation's banks using its highest-priority alert on Thursday, Gorman said. The discovery of the banking Web addresses inside the software code "raised a lot of eyebrows," she said.

FBI spokesman Bill Murray confirmed the agency was trying to trace the author of the attacking software.

Experts said the BugBear software was programmed to determine whether a victim used an e-mail address that belonged to any of the 1,300 financial institutions listed in its blueprints.

If a match was made, it tried to steal passwords and other information that would make it easier for hackers to break into a bank's networks.

The software transmitted stolen passwords to 10 e-mail addresses, which also were included in the blueprints. But experts said that on the Internet, where anyone can easily open a free e-mail account using a false name, knowing those addresses might not lead detectives to the culprit.

"Depending on how those e-mail boxes are used, it could make investigating this a little easier," Murray said. "But it's not that easy. Those addresses may be blind boxes."

-----

On the Net:

Financial Services Information Sharing and Analysis Center

Federal Bureau of Investigation

Network Associates Inc. (NET) BugBear.B info

More science, space, and technology from RedNova

Copyright © 2003 The Associated Press. All rights reserved. The information contained in the AP News report may not be published, broadcast, rewritten or redistributed without the prior written authority of The Associated Press.

More News in this Category