Oak Ridge still without Internet access due to malware attack
Connecting state and local government leaders
Malware delivered to the lab through a successful spear phishing attack keeps the facility's Internet access shut down as technicians work to identify, isolate and clean up the infection.
Internet access to the Energy Department’s Oak Ridge National Laboratory remains shut down for a second week as technicians work to identity, isolate and clean up malicious code delivered to the lab’s network through a successful spear phishing attack.
“We hope to get Internet back by the end of the week,” said Barbara H. Penland, the lab’s deputy director of communications.
Penland said the lab was the target of a phishing attack that began on April 7, and both e-mail and Internet access were shut down April 15 as a result of the infection. E-mail was restored on April 19 and the lab initially hoped to have Internet access back by the end of last week, but clean up work remains ongoing at the Tennessee lab.
Related stories:
Oak Ridge lab shuts down e-mail, Internet after cyberattack
Oak Ridge turbocharges intrusion detection systems
“We’re being cautious, since the whole purpose of the malware is to exfiltrate data,” Penland said. “We want to be completely sure before we get the Internet back up that it has been completely eradicated.”
The malicious code is being described as “very sophisticated,” but little more has been said about it so far. “Our technical people have learned quite a bit about it and how it works, but they are not sharing the details,” Penland said. “We hope to have more information by the end of the week.”
Oak Ridge is managed for the Energy Department by the University of Tennessee and Battelle LLC, and conducts basic and applied research in clean energy and other areas. It also is home to Jaguar, a recently upgraded Cray XT5-based supercomputer rated one of the fastest in the world.
More than 500 phishing e-mails were received at lab addresses earlier this month that appeared to have originated from the benefits department. When several people clicked on a malicious link for more information, a computer with access to the internal network allowed an infection.
The attack began one day after the Homeland Security Department’s US-CERT issued an advisory warning against targeted phishing attacks, and Penland confirmed that a number of other Energy labs and agencies had been targeted by similar attacks.
The lab’s public Web site at www.ornl.gov has remained online throughout the incident because that domain is not on the infected network. But, “not all of our sites are up,” Penland said.
“We are still able to function fairly well,” internally, she said, but workers who need access to the Internet have to work from outside the lab. Remote access to the Oak Ridge network also remains down, and outside workers and contractors still do not have access to the laboratory’s resources.
NEXT STORY: What can China teach the U.S. about IT security?