BugBear Virus Targets Banks
The government is warning financial institutions about a virus-like infection that has targeted computers at roughly 1,200 banks worldwide, trying to steal corporate passwords.
The FBI is investigating what private security experts believe to be the first Internet attack aimed primarily at a single economic sector.
Virus experts studying the blueprints for the latest threat to Internet users were astonished to find inside the software code a list of roughly 1,200 Web addresses for many of the world's largest financial institutions, including J.P. Morgan Chase & Co., American Express Co., Wachovia Corp., Bank of America Corp. and Citibank N.A.
The destructive infection, known as "BugBear.B," has spread to tens of thousands of consumer computers across the Internet since last week, but investigators and industry experts said they were unaware if any financial institutions had been significantly affected.
Industry executives told Treasury Department officials and other banking regulators during a meeting Monday in Washington that while they were concerned that the infection targeted them, they were unaffected because of tight corporate security.
The infection "was hammering the outside servers but it was being rejected," said Suzanne Gorman, head of the Financial Services Information Sharing and Analysis Center, a bank cybersecurity organization that works with the government. "People weren't reporting that it got through to their personal organizations."
The analysis center distributed information from the Homeland Security Department to the nation's banks using its highest-priority alert on Thursday, Gorman said. The discovery of the banking Web addresses inside the software code "raised a lot of eyebrows," she said.
FBI spokesman Bill Murray confirmed the agency is trying to trace the author of the attacking software.
Experts said the BugBear software was programmed to determine whether a victim used an e-mail address that belonged to any of the 1,300 financial institutions listed in its blueprints.
If a match was made, it tried to steal passwords and other information that would make it easier for hackers to break into a bank's networks.
The software transmitted stolen passwords to 10 e-mail addresses, which also were included in the blueprints. But experts said that on the Internet, where anyone can easily open a free e-mail account using a false name, knowing those addresses might not lead detectives to the culprit.
"Depending on how those e-mail boxes are used, it could make investigating this a little easier," Murray said. "But it's not that easy. Those addresses may be blind boxes."
By Ted Bridis