Global News

Security experts said the sophisticated attack had succeeded on a larger scale than many other similar attacks.

Once installed on a Windows machine the malicious code steals passwords, browser data as well as login names for bank accounts and online games.

The attack is proving hard to defend against for both sites being hit and PC users who are caught out.

Big hitter

Security researchers at ScanSafe, Finjan and Secure Works separately discovered the nest of poisoned websites. Estimates of how many sites have been enrolled into the attack vary. ScanSafe said it knew of about 230 but Secure Works and Finjan believe the total could be as high as 10,000.

Yuval Ben-Itzhak, chief technology officer of Finjan, said it had been following the attack since early December when it noticed an increase in the number of attacks using poisoned websites.

"It's safe to say that there are thousands of these out there," he said. He added that it was hard to get an accurate picture of just how many had been hit because security firms had limited resources to scan all potential targets.

Writing on the ScanSafe blog Mary Landesman said many of the poisoned sites were small "mom and pop" web shops rather than large web retailers. Despite this, she wrote, many had large numbers of visitors because they did well in web searches for particular products and services.

Sites enrolled by the ongoing attack include trade papers, travel firms, ad brokers, estate agents, butchers, hotel booking sites and car spare specialists.

Although all the websites that have become poisoned hosts use the same server and remote administration software, researchers have struggled to spot all the ways they are being compromised.

"We know some of the methods," said Mr Ben-Itzhak, "they are trying to exploit known vulnerabilities in open source content management software that the sites are using."

Spotting the attack code on a site was very difficult, he said, because every time a new user visited the code got a new, random five character name. If a visitor returned the malicious code identified them and did not launch a second attack.

In the last month, the malicious program has racked up about 5,000 victims - most of whom are in Europe. Many are falling victim via booby-trapped websites that use vulnerabilities in Microsoft's browser to install the attack code. Experts say the virus is dangerous because it buries itself deep inside Windows to avoid detection.

Old tricks

The malicious program is a type of virus known as a rootkit and it tries to overwrite part of a computer's hard drive called the Master Boot Record (MBR). This is where a computer looks when it is switched on for information about the operating system it will be running.

"If you can control the MBR, you can control the operating system and therefore the computer it resides on," wrote Elia Florio on security company Symantec's blog. Mr Florio pointed out that many viruses dating from the days before Windows used the Master Boot Record to get a grip on a computer.

Once installed the virus, dubbed Mebroot by Symantec, usually downloads other malicious programs, such as keyloggers, to do the work of stealing confidential information. Most of these associated programs lie in wait on a machine until its owner logs in to the online banking systems of one of more than 900 financial institutions. The Russian virus-writing group behind Mebroot is thought to have created the torpig family of viruses that are known to have been installed on more than 200,000 systems. This group specialises in stealing bank login information.

Security firm iDefense said Mebroot was discovered in October but started to be used in a series of attacks in early December. Between 12 December and 7 January, iDefense detected more than 5,000 machines that had been infected with the program. Analysis of Mebroot has shown that it uses its hidden position on the MBR as a beachhead so it can re-install these associated programs if they are deleted by anti-virus software. Although the password-stealing programs that Mebroot installs can be found by security software, few commercial anti-virus packages currently detect its presence. Mebroot cannot be removed while a computer is running.

Independent security firm GMER has produced a utility that will scan and remove the stealthy program. Computers running Windows XP, Windows Vista, Windows Server 2003 and Windows 2000 that are not fully patched are all vulnerable to the virus.

NASA develops PPA system to up the safety and accuracy of civil and research aircraft

The PPA system will help keep the C-20A Gulfstream III flying level so the UAVSAR radar pod can scan geoseismic hot spots. (Source: US Army)

The Wide Area Augmentation System (WAAS) is just now finally entering into civil aviation navigation in the United States. WAAS provides a GPS based means for aircraft to maintain a flight path by issuing level correction vectors. The end result is that the plane flies on a prescribed level path -- either from a previous flight or a computer generated path -- and follows the path to an accuracy of 30 feet.

Not one to rest on their laurels, NASA is keeping the ball rolling developing an even better system, dubbed the Platform Precision Autopilot (PPA). One significant advantage of PPA over WAAS is that due to its usage of GPS satellites and traditional techniques WAAS can only operate with 75 degrees of latitude in the northern and southern hemispheres. For PPA, which NASA plans to use in research planes which travel over Greenland and the Arctic, NASA also uses GPS but it boosts the range by relaying real-time GPS correction-vectors along Iridium’s satellite phone network to allow for navigation anywhere on the global.

NASA makes significant gains in accuracy between PPA and WAAS. WAAS's accuracy of 30 feet has been beefed up to 15 feet with PPA, a two-fold improvement. NASA hopes to become even more accurate, and is shooting for an accuracy of a few millimeters.

The final step after grabbing the more accurate GPS data is to combine it with 40 Hz input data from the aircraft's laser gyro-driven Inertial Navigation Unit (INU). Combining these signals the aircraft's onboard computer outputs positional and guidance information. This is used to autopilot the plane, but the output is displayed in traditional instrument landing system (ILS) form. Pilots will be able to read and understand it, and take corrective actions if necessary in case of system malfunction or failure. By implementing ILS, the system can become FAA-certified, paving the way for its eventual adoption on commercial aircraft.

The system was developed at NASA's Dryden Flight Research Center in Edwards, CA, which worked in conjunction with NASA's Jet Propulsion Laboratory (JPL) in Pasadena, CA. The system is designed to be utilized for NASA's Unmanned Aerial Vehicle Synthetic Aperture Radar (UAVSAR), a radar system designed at NASA's JPL under the guidance of NASA engineer Scott Hensley. The UAVSAR is a radar system which broadcasts microwaves in the 1.2 GHz range from an L-Band aperture.

NASA intends to use the UAVSAR for precision mapping of terrain, particularly with unmanned vehicles to map and monitor sites of extreme geologic activity. The UAVSAR is very flexible and can electronically adjusts its signal, allowing it to be mounted on a wide variety of vehicles, but it requires a system like PPA to maintain a steady enough altitude for it to get good images.

The UAVSAR will be mounted aboard NASA's C-20A Gulfstream III, which will be used as a test of PPA's accuracy and whether it operates sufficiently for the UAVSAR system's readings. NASA plans to log 140 hours of test flights before August 2008. Since the Gulfstream III operates outside civilian air space it will not need a permit to use the UAV which takes 90-days due to a somewhat archaic processing system. The test platform will allow NASA to instantly map hot zones of geologic activity. Satellite SAR systems currently exist, but they only flyby a location with 24 to 45 days, so being in the right place at the right time for short-term events is unlikely.

NASA continues to lead the way in international aviation and its PPA and UAVSAR systems are no exception. The PPA is especially promising to not only allow cutting edge research flights, but also promises to evolve and America's next generation of civilian aircraft safer.