17 September 2001

Text: U.S. Internet Watchdogs Warn of Increased Hacking Activity

Attempts to disrupt Internet communications are likely to increase in the aftermath of September 11 terrorist attacks on the United States, according to a warning issued September 17 by the National Infrastructure Protection Center (NIPC).

NIPC has already received reports of hacking activity that appears to arise from two different motives, the agency says. Some cyber attacks seem to come from vigilantes targeting the sites of groups they believe are responsible for the real world attacks in New York City, Washington, D.C. and Pennsylvania. The second category is ascribed to the perpetrators of previously seen viruses who may attempt to launch those viruses again.

Hacking is illegal, the NIPC warning says.

NIPC serves as the U.S. government's focal point for threat assessment, warning, investigation and response for threats or attacks against our critical infrastructures.

(begin text)

NATIONAL INFRASTRUCTURE PROTECTION CENTER<p>

"Increased Cyber Awareness"

September 14, 2001

The National Infrastructure Protection Center (NIPC) expects to see an upswing in incidents as a result of the tragic events of September 11, 2001. Increased hacking attacks are likely to have two motivations:

--Political hacktivism by self-described "patriot" hackers targeted at those perceived to be responsible for the terrorist attacks. NIPC has already received reports of individuals encouraging vigilante hacking activity.

--Virus propagation in which old viruses are renamed to appear related to recent events. One such incident has already been reported in which a new version of the life_stages.txt.shs virus was renamed wtc.txt.vbs to appear to be related to the World Trade Center.

The NIPC reiterates that the above conduct is illegal and punishable as a felony, with penalties extending to five years in prison. Those individuals who believe they are doing a service to this nation by engaging in acts of vigilantism should know that they are actually doing a disservice to the country.

To limit the potential damage from any cyber attacks, system administrators are encouraged to follow best practices to ensure the security of their networks. Some of the most basic measures are outlined below:

--Increase user awareness
--Update anti-virus software
--Stop hostile attachments at the e-mail server
--Utilize ingress & egress filtering
--Establish policy and procedures for responding and recovery

For a more comprehensive security checklist please refer to the following sites:

www.cert.org/security-improvement

www.sans.org/topten.htm

Recipients of this Advisory are encouraged to report computer intrusions to their local FBI office (http://www.fbi.gov/contact/fo/fo.htm) or the NIPC, and to other appropriate authorities. Incidents may be reported online at http://www.nipc.gov/incident/cirr.htm The NIPC Watch and Warning Unit can be reached at (202) 323-3204/3205/3206 or [email protected]