APCERT Shuts Down Malware Embedded Sites During Drill Exercise

The Asia Pacific Computer Emergency Response Team (APCERT) today (19 December 2006) completed its annual drill to test the timeliness and response capability of leading Computer Security Incident Response Teams (CSIRT) from Asia Pacific economies.

The drill focused on handling compromised websites hosting malicious code designed for use in distributed denial of service (DDoS) attacks.

The objective of the drill was for participating teams to exercise incident response handling arrangements locally and internationally to mitigate the impact of ongoing Internet-based attacks.

In this year's scenario, a number of global websites have been compromised and used as a vehicle to spread malicious software which ultimately allowing for infected computers to join a massive DDoS attack on e-commerce websites.

Fifteen teams from 13 economies (Australia, Brunei, the mainland China, Hong Kong, India, Japan, Korea, New Zealand, Malaysia, Singapore, Thailand, Chinese Taipei, and Vietnam) shared information about incidents that have been detected and took action to shut down or block systems hosting malware or launching DDoS attacks.

This year's drill included extended participation from some APEC economies. Some participating national CERTs have organized local aspects to the drill with key stakeholders, such as major Internet service providers (ISPs) and law enforcement agencies.

"This is the third drill organized by APCERT members," said Mr Graham Ingram, Chair of APCERT. "The drill is important for us to have a chance to share the common experience on cross-border incident handling and helps us refine and test the points of contacts and procedures we have established to share and respond to active Internet attacks in progress. The reality is that APCERT members are already very active in helping each other respond to Internet attacks within our respective economies, hence drills like this help us review and improve our procedures and ensure that we are prepared to help each other as best we can."

The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) also participated in the drill and has successfully shut down the websites in problem. Mr Roy Ko, Centre Manager of HKCERT, said, "We have discussed with major ISPs and other related parties, and agreed that a coordinated process to quickly respond to Internet attacks will be beneficial to all parties. Based on the success of today's drill, HKCERT will organize a drill early next year with local parties, including ISPs and law enforcement bodies."

APCERT was established by leading and national CSIRTs in the Asia Pacific region to improve cooperation, response and information sharing among CSIRTs in the region. It consists of 19 CSIRTs from 14 economies.

A founding member of APCERT, HKCERT was established by the Hong Kong Productivity Council (HKPC) in 2001 with funding support from the HKSAR Government to help local enterprises and Internet users address information security issues.



For media enquiries, please contact:
Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT)
Tel : (852) 8105 6060
Fax : (852) 8105 9760
E-mail : hkcert@hkcert.org
Web Page: http://www.hkcert.org/

19 December 2006