Hackers attacked parliament using WMF exploit

Hackers attacked parliament using WMF exploit

Summary: The UK Government was subjected to a concerted attack by Chinese hackers last year, according to the government’s email security provider

SHARE:
TOPICS: Security
3

The British Parliament was attacked late last year by hackers who tried to exploit the WMF flaw within Windows, security experts confirmed on Friday.

MessageLabs, the email filtering provider for the UK government, told ZDNet UK that targeted emails were sent to various individuals within government departments in an attempt to take control of their computers.

The attack occurred over the Christmas period and came from China, according to Mark Toshack, manager of antivirus operations at MessageLabs, who added that the emails were intercepted before they reached the government's systems.

"The attack definitely came from China — we know that because we log the IP addresses. The UK Government was targeted but none [of the emails] got through. No-one was affected — they were attacked but they [the government] didn't know about it until we told them," said Toshack.

The vulnerability with the way that WMF images are handled by Windows was discovered in November 2005. In a WMF attack, exploit code is hidden within a seemingly normal image that can be spread via emails or instant messages.

The first exploit code targeting the flaw was detected on 29 December, but Microsoft did not issue a patch until 5 January, after a security research released his own, unofficial patch.

The attack occurred on the morning of 2 January, before Microsoft's official patch was available. The hackers tried to send emails that used a social-engineering technique to lure users into opening an attachment containing the WMF/Setabortproc Trojan.

The Trojan, had it been downloaded, would have allowed the attackers to view files on the PC. The hackers may also have been able to install keylogging malware, said Toshack, enabling attackers to see classified government passwords.

The attack was individually tailored, and sent to 70 people in the government, according to MessageLabs. It played on people's natural curiosity by purporting to come from a government security organisation. The Trojan was hidden as an attachment called "map.wmf".

The body text of one of the emails read:

"Attached is the digital map for you. You should meet that man at those points separately. Delete the map thereafter. Good luck. Tommy"

The hackers could have been successful if the emails had reached their destinations, said Toshack. "It's like something you get from spooks — you can think 'I'm suddenly an MI5 agent.' You can see how it could work — it plays on people's romanticism about spies," Toshack suggested.

Speaking last November, Alan Paller, director of the SANS Institute, claimed that the Chinese government was employing malicious hackers.

"Of course it's the government. Governments will pay anything for control of other governments' computers. All governments will pay anything. It's so much better than tapping a phone," Paller told ZDNet UK.

Toshack could not confirm whether the Chinese government had been involved. "It is a Chinese hacker gang. I don't know if it is the Chinese government, and I don't know if it's the Chinese government paying a hacker gang," he said.

According to a Home Office source, the government is concerned about the threat posed by Trojan attacks. A Home Office spokesman would not confirm or deny an attack took place over Christmas.

"We do not comment on security matters, but have had discussions with many governments and computer emergency response teams from around the world on the matter of targeted Trojan attacks," a Home Office spokesperson told ZDNet UK.

The attempted attack on Parliament was first reported by The Guardian last week.

Topic: Security

Tom Espiner

About Tom Espiner

Tom is a technology reporter for ZDNet.com. He covers the security beat, writing about everything from hacking and cybercrime to threats and mitigation. He also focuses on open source and emerging technologies, all the while trying to cut through greenwash.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

3 comments
Log in or register to join the discussion
  • One minor problem with this article, that is exactly the same text as was quoted in various virus warnings regarding viruses being sent to the general public. A japanese site identified below lists it as being from f-secure and they posted this back on 3rd Jan.

    http://translate.google.com/translate?hl=en&sl=ja&u=http://itpro.nikkeibp.co.jp/article/NEWS/20060103/226844/&prev=/search%3Fq%3D%2522Delete%2Bthe%2Bmap%2Bthereafter.%2BGood%2Bluck.%2BTommy%2522%26hl%3Den%26lr%3D
    anonymous
  • What happened to the OSI initiative? If HMG made more use of safer, open software this sort of thing wouldn't happen.
    anonymous
  • Er... the title of this article is wrong. There is nothing in the story to indicate that parliament was attacked - only the government. Parliament and the government are in fact two different institutions!
    anonymous