Previous Story: Berners-Lee seeks killer app for Semantic Web
Next Story: Online social network scores hit in South Korea

Popular Japanese Web site hard hit by major hack
By Paul Kallender

Japan's largest price comparison Web portal is scrambling with the fallout of a decision to keep its Web site operating for three days with the knowledge that it had been hacked and could be feeding Trojan horse programs to visitors.

Tokyo-based Kakaku.com Inc., which attracted 6.4 million visitors in April, said Trojan horse programs were installed on the company's servers during an unauthorized intrusion on May 11. The company detected the intrusion soon after it occurred. Instead of closing the site, Kakaku.com decided to keep it open until May 14 in an attempt to trace the hack, company president Yoshiteru Akita said at a news conference in Tokyo on Wednesday.

The Trojan programs have been identified as "trojandownloader.small.AAO" and "PSW.Delf.FZ," and can affect PCs running Windows 95, 98, ME, XP, 2000 and NT operating systems, Kakaku.com said.

Delf is a Trojan program that installs a keystroke logger and remote control software, according to John Pescatore, research director for Internet security at Gartner Inc. The programs record all keystrokes made on an infected PC. If a PC gets hit and the user logs into a server, the attacker can get the user's password for the server and access the user's account.

Akita and other company executives bowed at the news conference and apologized several times but defended the decision to keep the site open.

"We are extremely sorry to all of our customers and shareholders," Akita said.

Keeping the site operating was exactly the wrong thing to do, at least against a Delf-type Trojan program, Pescatore said.

"If Delf gets installed on a server, much more damage can be caused. When any such Trojan is found, it is important to immediately block all connections to the outside world to prevent the attacker from using the remote control features," he said.

"Any site that was left running for several days after discovering a Trojan such as Delf would be allowing the attacker to use his remote control ability to remove all evidence of his action from audit trails, as well as possibly crash servers in an attempt to cover his tracks," Pescatore said.

Delf-type Trojan programs emerged in 2003 and can be blocked, detected and removed with commonly available antivirus and antispyware packages, according to Pescatore.

Kakaku.com was using a variety of antivirus and antispyware systems from major vendors, said Kaori Kawai, a spokeswoman for the company. But she wouldn't name the software or detail the company's update procedures.

Since closing the Web site, the company has posted a page that lists the Trojan horse programs and links to programs that will help disinfect PCs.

The company said the site wouldn't be back in operation until May 23 at the earliest.

While the company scrambles to cope with the hack, it now faces potentially big losses as a result of the closure, it said.

"We are a growing company with a growing number of customers and the impact is, frankly, enormous," Akita said.

During the first three months of 2005, the company had revenue of ¥2.14 billion (US$20 million), up 70 percent from the prior year, and profits of ¥478 million, 74 percent higher than those of the previous year, the company said.

The company is revising its financial forecast and will release the estimate within a month, according to Minoru Tanaka, Kakaku.com's chief financial officer. He declined comment on the scale of the revision.

"All we can say is that we are very sorry and that we are doing our upmost to make our security as strong as possible," Kawai said.

Posted May 20, 2005 05:11 PM |