Charles Arthur, technology editor
guardian.co.uk, Sunday 12 June 2011 17.02 BST
The IMF hackers may have gained access to a 'treasure trove' of economic data not available to the public. Photograph: Nick Rowe/Getty Images
The International Monetary Fund (IMF) is investigating a serious cyber-attack in which some of its systems were compromised and used to access internal data.
Security experts said the source seemed to be a "nation state" aiming to gain a "digital insider presence" on the network of the IMF, the inter-governmental group that oversees the global financial system and brings together 187 member countries.
Tom Kellermann, a cybersecurity expert who has worked for the IMF and was in charge of cyberintelligence in the World Bank's treasury team, said the intrusion could have yielded a treasure trove of non-public economic data used by the IMF to promote exchange rate stability, support balanced international trade, and provide resources to remedy members' balance-of-payments crises. "It was a targeted attack," said Kellermann, who serves on the International Cyber Security Protection Alliance.
The attack will increase concerns over low-level cyberwarfare waged by governments for economic and industrial espionage purposes, which have grown in recent weeks with announcements by the chancellor, George Osborne, of cyber-attacks on the Treasury and by defence secretary Liam Fox of a "sustained attack" on the Ministry of Defence.
Earlier this year it was revealed that computers at France's finance ministry had been hacked and were silently redirecting data to websites in China, apparently in an effort to steal documents relating to February's G20 summit.
The code used in the IMF incident was developed specifically for the attack on the institution, said Kellermann, now chief technology officer at cyberconsultancy AirPatrol.
The World Bank said it had cut its network connection with the IMF out of caution, even though the information shared over the link was "non-sensitive". The IMF insists that it remains "fully functional" while the FBI investigates the attack.
An internal memo issued on 8 June from the IMF's chief information officer, Jonathan Palmer, told staff that suspicious file transfers had been detected and that an investigation had shown a desktop computer "had been compromised and used to access some Fund systems". Significantly, he said that he had "no reason to believe that any personal information was sought for fraud purposes".
That points to a cyber-attack that sought to gain deeper access to the organisation's computers. The New York Times cited computer experts as saying that the IMF's systems had been under attack for several months.
Such attacks have grown in number and seriousness over the past two years. At the end of 2009, Google discovered that it had come under attack from hackers inside China, who sought high-level access to its systems and targeted dissidents' email accounts. Senior figures inside the search engine company are convinced the attack was orchestrated by the Chinese government.
A number of other financial and military organisations came under attack at around the same time, and last month Google said that it had again detected "phishing" attacks aimed at capturing login details for US government officials emanating from China. The Chinese government denied involvement – though it had not been directly accused.
"The attack was clearly designed to infiltrate the IMF with the intention of gaining sensitive 'insider privileged information'," cybersecurity specialist Mohan Koo, the managing director of Dtex Systems (UK) said, adding that the recent spate of attacks on large global organisations was worrying because they were targeted, well organised and well executed, not opportunistic.
"Perhaps most frightening of all is the fact that these type of attacks could quite easily be directed towards critical national infrastructure (CNI) organisations, for example energy and water, where the impact of such a breach would have severe, immediate and potentially life-threatening consequences for everyday citizens."
Rich Mills, a World Bank spokesman, said: "The World Bank Group, like any other large organisation, is increasingly aware of potential threats to the security of our information system and we are constantly working to improve our defences."
News of the hack came at a sensitive time for the world lender of last resort, as it seeks to replace its former managing director Dominique Strauss-Kahn, who quit last month after being charged with the attempted rape of a hotel maid.
The French finance minister, Christine Lagarde, remains the frontrunner to replace him. Stanley Fischer, the governor of the Bank of Israel and a former IMF deputy chief, has emerged as a late candidate, and Mexico's central bank chief, Agustin Carstens, is also a contender.
Jeff Moss, a self-described computer hacker and member of the department of homeland security advisory committee, said the IMF intrusion could inspire attacks on other large institutions. "If they can't catch them, I'm afraid it might embolden others to try," said Moss, who is chief security officer for ICANN, the internet registry system.
Security experts said it would be difficult for investigators to prove which nation was behind the attack. "Even developing nations are able to leverage the internet in order to change their standing and ability to influence," said Jeffrey Carr, author of the book Inside Cyber Warfare. "It's something they never could have done before without gold or without military might," Carr said.
The CIA director, Leon Panetta, told the US Congress on 9 June that the country faced the "real possibility" of a crippling internet-based attack on power systems, the electricity grid, security, financial and governmental systems.
Lockheed Martin, the Pentagon's top supplier by sales and the biggest information technology provider to the US government, disclosed two weeks ago that it had thwarted a "significant" cyber-attack. It said it had become a "frequent target of adversaries around the world".
Access to the website of Spain's national police force was blocked for over an hour late on Saturday in a reprisal attack by the Anonymous hackers group, El Mundo said on its website.
Source.
No comments:
Post a Comment