Wave Systems Corp. (fka WAVXQ)

[dude_danny]

Hack infiltrates government, corporate systems
US Department of Transportation, HP and others targeted...


http://software.silicon.com/security/0,39024655,39167873,00.htm
Published: Wednesday 18 July 2007

Hackers stole information from the US Department of Transportation and several US corporations by seducing employees with fake job listings on ads and email, a computer security firm said on Monday.

The list of victims included several companies known for providing security services to government agencies.

They include consulting firm Booz Allen, HP, satellite network provider Hughes Network Systems, a unit of Hughes Communications, and computer services company Unisys, said Mel Morris, CEO of British internet security provider Prevx.

HP declined comment, while officials with other companies couldn't be reached for comment. A Department of Transportation spokeswoman said the agency couldn't find any indication of a security breach.

Malicious programs were able to pass sophisticated security systems undetected because that software hadn't been instructed that they were dangerous. Hackers targeted only a limited group of personal computers, which kept traffic down and allowed them to stay under the radar of security experts, Morris said.

It was not clear whether the hackers used information stolen from the personal computers, Morris said.

Internet security firms began to release patches to fight the malicious software on Monday night.

A piece of software, NTOS.exe, was used to probe the PCs for confidential data, then send it to a website hosted on Yahoo! That site's owner was probably unaware that it was being used by hackers, Morris said.

The website hosted data that had been stolen from more than 1,000 PCs and encrypted before it was posted on the site, according to Morris.

He said that he believes the hackers have set up several sister websites that are collecting similar data from other squadrons of malicious software.

Officials with Yahoo! weren't available for comment.

Morris said that he had downloaded the data from the website and decrypted it at the request of investigators from the FBI's Law Enforcement Online, or LEO, program, who were looking into the matter.