Fujitsu is reportedly working on a cyber-weapon for the Japanese government designed to track and disable the sources of cyber-attacks, according to a Japanese newspaper.
Japan’s Defense Ministry has commissioned Fujitsu to develop a virus capable of tracking, identifying and disabling the systems being used by cyber-attackers, the Yomiuri Shimbun reported Jan. 3. The Defense Ministry’s Technical Research and Development Institute awarded the three-year project, which reportedly has a $2.3 million price tag, to Fujitsu in 2008.
The project includes both the virus and a system to monitor and analyze cyber-attacks, according to Yomiuri. The virus has already been tested in a “closed network environment” to test the capabilities without it accidentally being released into the wild, anonymous sources told the newspaper.
Yomiuri said Fujitsu declined comment, citing client confidentiality. The company did not respond to requests for comment from eWEEK.
The malware under development is designed to trace connections to identify where the cyber-attack is originating from, as well as all the “springboard” computers being used to launch the attack, Yomiuri said. It reportedly has the ability to collect relevant information from the attacking system and disable the malicious program, halting the attack in progress. It appears to be the most effective in tracking back the sources of distributed denial of service (DDoS) attacks as well as some types of attacks aimed at stealing information from compromised systems.
The idea of tracking down the source of attacks and taking active steps to halt an attack is an increasingly popular concept as organizations shift away from passive defenses. For example, Israel-based Radware offers “counter-attack” capabilities in its Attack Mitigation System to help organizations fight off distributed denial of service attacks.
Many anti-DDoS systems focus on just increasing the organization’s ability to “absorb” the attacks and try to outlast the attackers, Carl Herberger, vice-president of security solutions at Radware, told eWEEK in an earlier interview. Radware, in contrast, relies on various tools that make it harder for the attacker to sustain the campaign and cause them to abandon the fight, he said.
Counterattacks are ways to neutralize the attacking tool in a passive, non-intrusive way. Techniques include applying sophisticated filters that slow down the malicious traffic hitting the organization’s servers or just adding some lag time when attacking systems try to establish a connection, according to Radware. These steps would result in the attack taking longer to complete, or even cause the attacking program to time out or crash, thus “exhausting” the attacker into quitting the campaign, Herberger said.
By that measure, Fujitsu’s attempt to automate the process by disabling the malicious program on the attacking system itself appears to be unique.
Under Japanese law, the military is restricted from launching cyber-attacks, and this new cyber-weapon is also limited by a law that bans anyone from developing computer viruses. The Defense and Foreign Ministries are reportedly discussing possible legal changes, according to Yomiuri.
“When you’re trying to gather digital forensic evidence as to what has broken into your network, and what data it may have stolen, it’s probably not wise to let loose a program that starts to trample over your hard drives, making changes,” Graham Cluley, a senior technology consultant at Sophos, wrote on the Naked Security blog. Cluley questioned the ramifications of another application, even if it is a “good virus,” running on another person’s computer.
However, a Defense Ministry official downplayed the tool’s offensive capabilities, telling Yomiuri that the technology was developed for defensive use, such as identifying which terminal within the Japanese Self-Defense Forces was initially targeted.
The Japanese government was hit by several attacks in 2011. Mitsubishi Heavy Industries, the country’s largest defense contractor, was infected by an information-stealing Trojan attack in September that successfully stole sensitive information. Several computers belonging to several members of Japan’s parliament were also compromised by a malicious email over the summer.
