The Edmond Sun

Nation & World

January 17, 2013

Russia’s Kaspersky Lab reports major malware discovery

MOSCOW — In what is being called a new hunt for Red October, a Russian cyber-security company says it has discovered a major international malware system that has attacked and compromised the computers of government agencies, diplomatic consulates, research centers and defense installations, among other sensitive institutions.

The malware has siphoned off terabytes’ worth of information, much of it classified, researchers with Moscow-based Kaspersky Lab said in a report this week. The origin of the program and the motives of the attackers remain elusive, but there are hints that the programmers are Russian, the report says.

“Last October we first received from our clients samples of something we soon gathered was not just a malware program but a multi-component attack platform, initially targeting embassies around the world,” Vitaly Kamlyuk, a senior anti-virus expert at Kaspersky, said in an interview Wednesday. “We called the virus ‘Red October’ because we detected it in October and because it required a level of red-alert attention to tackle.”

Similar to the Flame virus, a now-defunct spyware program Kaspersky thwarted last year, the new virus usually infiltrates computers through an email attachment camouflaged to mimic ordinary business correspondence, the expert said.

“One embassy was looking to buy a car and received the virus in a car sale proposal they soon found in their inbox,” Kamlyuk said.

Kaspersky, a leading developer of commercial anti-virus software, said it found victims of the malware with IP addresses in 39 countries, led by Switzerland, Kazakhstan and Greece. The most common targets included embassies, government agencies and research institutes, as well as aerospace and energy companies.

Kaspersky said the malware was probably being operated by a government or criminal organization large enough to employ at least two dozen highly trained programmers.

Independent experts in the United States offered differing views on who might be responsible.

“The two primary suspects for this operation would have been either Russia or China, just based on some of the data,” said John Bumgarner, research director for the U.S. Cyber Consequences Unit, a nongovernmental think tank.

But researcher Jeffrey Carr, author of “Inside Cyber Warfare,” theorized that the malware was the work of the foreign intelligence service of a NATO or European Union country, and that the intent was to spy on Russian embassies.

“It’s a pretty good guess” that Russia’s spy service, the FSB, approached Kaspersky and asked the firm to investigate, Carr said. “One of the indications was that they were specifically looking for Russian documents.”

Kaspersky researchers said the spyware, when first installed, might be only several hundred kilobytes in size, minuscule by modern computer standards. But as it gets established and communicates with its controllers, it may grow to several megabytes.

The virus records the names of the users, their IP addresses, information stored on their processors and local disks, the history of browsers, logins and passwords, and the records of devices plugged into USB ports, including smartphones, according to the report.

Like the Flame program, the new virus can record screen shots, as well as keystrokes.

Evidence of the Red October virus dates to May 2007, Kamlyuk said. The program was embedded in Microsoft Excel and Word documents that had been used by Chinese hackers against Asian companies and Tibetan political activists, Kamlyuk said.

"But soon enough,” he said, “we realized that, despite its obvious Chinese roots and the fact that no agencies in China were in fact targets of the new malicious program, the Chinese hackers had nothing to do with Red October.”

The language used in the malware was primarily English, but not that of a native English speaker. It included Cyrillic symbols and transliterations of terms from Russian computer jargon, the researchers said.

For instance, Kamlyuk said, the malware sometimes uses the Russian word “zakladka” for “bookmark” or “marker” and “proga” for “programs.”

“Many domain names of the malware were registered under fake Russian names and addresses too,” he said.

“Now we have come to the realization that we are dealing with something programmed by Russian-speaking experts, based on Chinese hackers’ exploit documents and mostly aimed at embassies of and other targets in Russia and its former Soviet satellites,” Kamlyuk said.

Sergei Karaganov, honorary chairman of the Council on Foreign and Defense Policy, a Moscow-based think tank, said in an interview that such cyber-espionage is increasingly common and that Russia and other countries have attempted to create international protocols to combat it.

“But every time, their attempts have been thwarted by the stiff resistance on the part of the United States, which probably counts too much on its supremacy in this sphere,” he said. “On the other hand, I wouldn’t rule out the possibility of this being an ingenious trick on the part of Kaspersky Lab to boost their trade.”

1
Text Only
Nation & World
  • weather 1.jpg July could be coolest in weather record books

    With chances for soaking rains and unseasonably cool temperatures becoming frequent, a weather expert is increasingly convinced Oklahoma will end up with a historic July.
    At mid-afternoon Tuesday, the National Weather Service forecast for Edmond called for the high Wednesday to be near 73 with a 90 percent chance of heavy rain, followed by the high Thursday near 78 with a 30 percent chance of showers.
    Highs are expected to remain in the 80s into Monday.

    July 29, 2014 3 Photos

  • jc_ITS map.jpg More cameras monitoring Edmond motorists

    The Edmond City Council this week approved a services agreement with Electronic Technology, Inc. For the  installation of Intelligent Transportation Systems’ video wall system at a cost of $314,620. The vote was 3-0.
    ITS is a fiber optic, wireless or hybrid communication system of monitoring road events and equipment in the field, data archiving and predicting traffic volume, said Kent Kacir, an engineer with Kimley-Horn and Associates Inc.

    July 29, 2014 1 Photo

  • jc_Earp Marlin 2 - photo credit Noel Winters.jpg Shootout of a sale

    An original article of the Wild West will be made available at auction Thursday. The rifle of legendary lawman Wyatt Earp will be part of the J. Levine Auction & Appraisal’s Summer Quarterly Auction in Scottsdale, Ariz.
    Earp was an Arizona deputy sheriff and deputy town marshal in Tombstone, Ariz. He is legendary for playing a key role in the gunfight at the O.K. Corral. He died in 1929 at age 80.
    Wyatt Earp collector Barry Tapp of Edmond will be selling his 1895 Wyatt Earp Marlin rifle at the auction. The rifle has an estimated value between $50,000 and $75,000. It includes authentication documentation from Tombstone Heritage Museum, according to the auction house

    July 28, 2014 2 Photos

  • sales tax holiday.jpg Oklahoma sales tax takes a holiday

    Beginning at 12:01 a.m. on Friday, Aug. 1 and ending at midnight Aug. 3, Oklahomans will be able to participate in a sales tax holiday giving shoppers the opportunity to purchase certain clothing and shoes free of sales tax.
    Yes, retailers may not charge tax, including state and local sales taxes on items that are tax-exempt during the sales tax holiday weekend. The sales of clothing and shoes priced at less than $100 are exempted from sales taxes.

    July 28, 2014 1 Photo

  • Blackmon.jpg Local cops arrest NFL player on marijuana complaint

    The Edmond Police Department has released the incident report related to the arrest of ex-Oklahoma State star and current NFL player Justin Blackmon.
    Blackmon, 24, a product of Plainview High School in Ardmore, is a 6-1, 210-pound wide receiver in his second year with the Jacksonville Jaguars. At Oklahoma State University, he was a two-time Biletnikoff Award winner as the country’s best collegiate wide receiver.

    July 24, 2014 1 Photo

  • A Q&A on ‘Obamacare’ Court Rulings

    On Tuesday, two federal appeals courts issued conflicting rulings on the legality of tax subsidies being provided to people who bought “Obamacare” health insurance policies in Oklahoma and 35 other states.
    Here’s a look at the rulings’ potential impact in Oklahoma.

    Q: I’m confused. What did the courts rule today?
    A: A three-judge panel of the U.S. Court of Appeals circuit in Washington, D.C., decided that the government can’t provide tax subsidies for Affordable Care Act plans purchased in 36 states where the federal government is operating the health insurance exchange. Oklahoma is one of the 36 states. A few hours later, the U.S. Court of Appeals circuit in Richmond, Va., issued a conflicting ruling that upheld the legality of the health-care law’s tax subsidies.

    July 22, 2014

  • June healthy month for Oklahoma jobs

    Nearly 10,000 new jobs in Oklahoma were created in June, according to the U.S. Labor Department.
    Gov. Mary Fallin said Tuesday the state experienced one of the largest increases in employment in the nation in June. More than 9,600 additional people joined the state’s workforce in June.
    The unemployment rate in June dropped to 4.5 percent, its lowest ratio in six years. June’s rate was down a percentage point from 4.6 percent in May and April, according to the Oklahoma Employment Security Commission.

    July 22, 2014

  • Former OSU line coach having impact on Texas staff

    It was quite possibly the biggest coaching coup of the offseason and Oklahoma State was at the wrong end of it — former Cowboy offensive line coach Joe Wickline joining the staff for Charlie Strong’s Texas Longhorns.
    “It’s always good when you go hire staff and you look at just getting the right people within your program. And, a lot of times, guys know a lot of Xs and Os, but it’s all just about developing a player,” said Strong, Tuesday during the Big 12 Conference Football Media Days. “Joe and I, we’ve coached together at two different places. But just with him being within his conference and knowing the conference, he’s been a great asset.”

    July 22, 2014

  • UCO campus 3.jpg University of Central Oklahoma recognized as having friendly work environment

    The Chronicle of Higher Education named the University of Central Oklahoma as one of the “2014 Great Colleges to Work For.” Central is the only higher education institution in the state recognized on the list and one of only a handful of institutions in the nation given the distinction of being named to the Honor Roll for being cited most often among all the recognition categories.          
    Central joins Duke, Baylor and Notre Dame on the list of the 10 universities named to the large institution honor roll.

    July 21, 2014 1 Photo

  • Sparring justices find little disagreement at the opera

    Justice Ruth Bader Ginsburg revealed a different view of U.S. Supreme Court on Saturday when she described about her passion for opera, one she shares with Justice Antonin Scalia.

    July 21, 2014