Pentagon Hit by Fake E-mails on 'North Korean Missile'

(March 8) -- The Pentagon warned its employees over the weekend of a new threat to its cyber security: e-mails that look like they were sent by the U.S. government but weren't.

Calling it an attempt at "cyber exploitation," officials urged Defense Department employees against clicking on links in e-mails from the Office of the Director of National Intelligence with the subject line "DPRK has carried out nuclear missile attack on Japan." Employees who had been duped by the message were told to cease using their computers and contact the help desk.

"The attacks utilize e-mail messages attempting to fool DoD users into clicking on embedded links and opening e-mail attachments," reads a cautionary e-mail sent out by a Pentagon IT official to employees of the Office of the Secretary of Defense. "E-mail has historically been a very successful attack mechanism. Studies indicate that a success rate of user compromise is about 70 percent during the initial attack phase."

The warning e-mail to employees doesn't say who might be behind this latest attack, or whether any damage was done. But the Pentagon has been on the receiving end of a number of high-profile hacking attempts, some with links to foreign governments. Among other incidents, hackers last year accessed information on the Pentagon's new stealth fighter.

In the meantime, concerns about cyberattacks and cyberwar are growing. Dennis Blair, the director of national intelligence, warned last month that "terrorist groups and their sympathizers have expressed interest in using cyber means to target the United States and its citizens."

This latest attack demonstrates at least casual familiarity with Defense Department e-mails. The fake e-mail was marked "U/FOUO," a common designation used in Pentagon communications for "unclassified/for official use only."

Lt. Col. Eric Butterbaugh, a Defense Department spokesman, said the Pentagon generally does not comment on specific threats. Defense Department employees, he added, are provided training about an array of potential attacks, including malicious e-mails.

"But clearly," he said, "the threat is real."