FBI email network down for days after virus attack

happygeek 0 423 Views

The FBI has confirmed reports that it was forced to shut down it's external unclassified email network "as a precautionary measure" following the discovery of a virus infection. I am led to understand that the particular virus concerned has been identified by the FBI but this information has yet to find it's way in to the public domain.

What most certainly has, however, is the admission by the FBI itself that it was some 48 hours after identifying the issue and mitigating the risks before email traffic was 'largely restored' to the network which is used primarily for routine communications and messages. The FBI told us that it is "important to note that the FBI's internal, classified network is where communications and e-mail about sensitive and investigative matters take place and was never affected."

Yet full functionality has yet to be restored to that unclassified network, in what must go down as a huge embarrassment for the Feds. An official FBI statement states that "Out of an abundance of caution, the FBI has temporarily self-imposed a limit on sending and receiving attachments on our external, unclassified network to give our technicians time to scan all the attachments that came into the e-mail system to make sure we have identified and mitigated all threats to the network."

We wonder, could it have been conficker? After all, it pretty much managed to sink the Royal Navy fleet comms system a few months back.

Dani AI

Generated

A short, practical incident‑response primer for an organization that must take email offline to contain malware. Thread replies range from useful speculation () to distractions (). The goal here is a concise, repeatable checklist that keeps mail service recovery controlled and forensically sound.

Immediate priorities (minutes–hours)

  • Contain: put the mail gateway into a hold/quarantine state or set MX to a holding system so inbound mail is not delivered into user mailboxes. Isolate any mail servers that show signs of compromise; do not rejoin them to production networks until imaged and inspected.
  • Preserve evidence: collect mail server logs, gateway AV/ATP logs, message queues, and memory/disk images. Do not delete logs or clear queues before taking copies.
  • Scope and triage: use message tracking and queue inspection to find high‑volume senders, repeating attachment patterns, or spikes in delivery errors. Extract suspicious attachments to an isolated lab and compute hashes for reference and cross‑checking against threat intelligence.

Helpful commands and workflow examples (Unix/Postfix + generic scanning)

# inspect mail queue
postqueue -p

# inspect a queued message
postcat -q <QUEUEID>

# delete a bad queued message
postsuper -d <QUEUEID>

# extract and scan attachments (isolate first)
ripmime -i message.eml -d ./attachments
clamscan -r ./attachments
sha256sum ./attachments/* > hashes.txt

Medium‑term remediation and cautions

  • Fix root causes: patch endpoints and servers, remove persistence, rotate credentials, and verify no lateral movement (check AD, scheduled tasks, new services).
  • Hardening: enforce gateway scanning, deploy/verify SPF, DKIM, DMARC, and improve EDR/visibility and segmentation so email problems cannot rapidly affect critical systems.
  • Process: restore functionality in stages (test mail flow, then enable attachments for a pilot group), document every step, and involve legal/IR/law‑enforcement as required. Focus on evidence and repeatable controls; conjecture and politics slow response.
Member Avatar for windowsrefund
windowsrefund 0 Newbie Poster

Obviously, this is part of the hype behind Obama's attempt to shutdown the Internet. We'll continue to see stories like the "Craigslist Killer" and read bills like H.R. 1966 (CyberBullying Act). There is a bigger picture here folks. The Internet is the last forum for free speech and the global elite are very angry to see the exposure of critical issues like Bilderberg, Obama's attempts to destroy our 2nd amendment (H.R. 2401) and Ron Paul's attempts to audit the Federal Reserve. They want to destroy this media so we have no alternative to Fox News and the other corporate controlled information channels.

Wake up and realize that there are forces at work that are aggressively attacking your first amendment.

Member Avatar for happygeek
happygeek 2,411 Most Valuable Poster

Do you wear a tinfoil hat by any chance?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview