Ukrainian Agents Quiz Site On Sircam Breach
Agents from the Ukraine's National Security Service have questioned employees of a Web site which received secret government documents via e-mail after government computers were infected by the Sircam virus, according to a spokesman for the Web site. Reports surfaced Thursday that secret documents from the administration of President Leonid Kuchma had been e-mailed to the Kiev-based news Web site, "ForUm Internet Newspaper" (http://www.for-ua.com ).
Oleh Khavruk, technical director at ForUm, in an interview with Newsbytes, was asked whether the incident may have been a prank. "It is not a joke, because National Security Service usually doesn't do any investigation on jokes," he said. "But in this case many people here in ForUm were questioned by Security Service officers as witnesses."
He said the secret documents arrived around 10 a.m. local time Wednesday to an e-mail address which is used "for contacts with all kinds of organizations and internet users."
According to a news report Thursday, ForUm posted on its Web site content from the e-mail, including a timetable for Kuchma's movements on the 10th anniversary of the Ukraine's independence later this month. Kuchma's exact movements are usually a tightly guarded secret.
Asked by Newsbytes what other secret documents ForUm received, he said: "It's hard to be more specific, because we received all kinds of documents. Among them were financial documents of private enterprises, interviews, political news from political parties, etc."
When asked if he could give more detail, Khavruk declined.
"There were some other messages, but we don't want to talk about it," he said. "We don't want to have any problems with the Security Service. We don't want to make any problems with anybody. They have a problem and we don't want to make it bigger." And he emphasized strongly. "We are not an opposition newspaper."
He also said a notice posted on the ForUm Web site says that Kuchma's Independence Day plans have been changed.
ForUm began receiving massive amounts of e-mail about a week ago, Khavruk said. Many of the messages contained attachments with "double extensions," such as "doc.bat" and "xls.pif."
"We were sure that all these messages were generated by the SirCam virus," he said. In one day we could receive about 30 MB of all kinds of information."
Experts say SirCam, which was first spotted in the wild July 17, has several characteristics that have enabled it to remain virulent. Unlike infamous mass mailer worms such as "Love Letter," "Melissa" or "Anna Kournikova," SirCam has its own mailing program, so it is not dependent on propagating through the infected computer's Microsoft Outlook.
When asked his opinion of the SirCam virus, Khavruk said: "I believe that this virus is quiet harmful, and especially for organizations which deal with secret information."
