Hackers quiet but may hit fed sites later

As the clock ticked past midnight on the U.S. East Coast, sentries on watchfor cyberattacks on federal systems were faced with the cheering prospectof nothing to do, but that reprieve may last only as long as the New Year'sparties.

For the rollover, federal security experts at the Year 2000 InformationCoordination Center in Washington, D.C., have not been working alone.Several industry groups also set up centers and e-mail lists to gather andfeed information to the ICC about potential attacks and World Wide Web sitedefacements.

But despite warnings this week from the FBI's National InfrastructureProtection Center about two specific denial of service attacks, most systemadministrators are so far experiencing little more than probes of theirnetworks. (See NIPC press release at www.fbi.gov/nipc/trinoo.htm)

"Maybe it has something to do with the fact that the government has shutdown all of their Web sites, or maybe people are out partying, but it hasbeen a very quiet night," said B.K. DeLong, a security consultant withAttrition.org.

Attrition posts defacements on its Web site (www.attrition.org) as they arediscovered, and works with many federal and commercial organizations toprotect their systems. Although there has been plenty of hacker activity inthe last 24 hours, with many of the messages indicating the hackers aretaking advantage of the Year 2000 distraction, Attrition has found nodefacements of federal Web sites.

The SANS Institute, a security education and research organization inBethesda, Md., has also had a quiet night for its analysts, according tothe regular e-mail updates sent out throughout the night.

But at least two hacker groups have contacted Attrition to say they willnot be staying idle in the new year, and DeLong attributes the lack ofactivity to hackers realizing that midnight was not a deadline for them.

"I expect once people start waking up or leaving parties we'll see someactivity," he said.

Several federal agencies announced this week that they would take their Websites and servers off-line for the weekend, including Defense Departmentand NASA organizations. But the current silence may also indicate thathackers are simply going to wait until the systems are put up again onMonday, Jan. 3, DeLong said.

"Maybe once the systems are back online and everyone is back at work we'llsee something more," he said. "I expect it will pick up as the week goesalong."