Highly-organised and sophisticated hackers are being blamed for “industrial-strength” attacks on vital computer networks aimed at stealing commercially and economically sensitive information.
Nearly 300 UK government departments and businesses, considered part of the country's critical national infrastructure, have been bombarded with a sophisticated electronic attack for several months, the National Infrastructure Security Co-ordination Centre has revealed.
The infrastructure includes communications, energy, finance, health, transport and government sectors.
Similar attacks have been reported in other countries, including the US.
“We have never seen anything like this in terms of the industrial scale of this series of attacks,” said Roger Cumming, director of NISCC, which protects critical infrastructure from electronic threats.
“This is not a few hackers sitting in their bedrooms trying to steal bank account details from individuals. This is aimed at organisations, targeted at gaining information and is extremely well organised and well structured.”
The NISCC will on Thursday issue a warning to business to be on alert for the hackers, the first time the secretive organisation has made such a high-profile announcement, highlighting the severity of its concerns.
Many of the attacks appear to be coming through internet addresses located in Asia, Mr Cumming said, although he declined to specify which countries. The NISCC and National Hi-Tech Crime Unit are working with the authorities in those countries to track and close down these addresses.
The attacks have come via unsolicited e-mails that contain a “Trojan”, or malicious computer code contained inside an apparently harmless file. When opened, the code secretly installs itself on to the user's computer, allowing a remote attacker to gain control of the system.
Mr Cumming said the attacks were unrelated to the industrial espionage network discovered last month in Israel, which was also using Trojan virus software.
The NISCC believes no significant information has been stolen from the critical national infrastructure organisations. However, there is concern the attacks may spread to the wider business community. In particular, banks, insurers and other financial institutions could be affected.
Mr Cumming is urging all businesses to monitor their IT systems and tighten security. The hackers have focused on individuals whose jobs involve dealing with sensitive information, and have tried to collect user names and passwords and upload data from the infected computers.
The NISCC warns that bogus e-mails are difficult to spot. The subject lines have been tailored to refer to news articles that would specifically interest the recipient and the e-mails have been “spoofed” to make it appear they come from trusted contacts.
Advice on detection and protection is available from the NISCC website, www.niscc.gov.uk
