Malicious program embedded on home computers linked to Internet

WASHINGTON -- In a dark, musty office ominously called the ''Attack Lab,'' a cadre of former government sleuths worked through the night to discover a major new threat to Internet users.

Prompted by an attack on one of their own computers, Network Security Technologies investigators unraveled a possible future attack on major Web sites and some 2,000 compromised computers, mostly belonging to home users. The hackers had access to all the computers' secrets -- passwords, personal files and all -- and can at any point launch a crippling assault similar to February's attacks that included CNN's news site, the Yahoo! Internet directory and Amazon.com.

The hackers, who used the nicknames ''Serbian'' and ''Badman,'' tested their network of infected computers Wednesday night, said NETSEC, which alerted the Justice Department on Thursday.

The firm, which does work for the department, gave the government a list of the computers that have been infected with the malicious program, which cloaks itself as a movie file.

Even large computer companies were penetrated by the hackers.

The problem demonstrates the growing vulnerability that home computer users face as they purchase permanent, high-speed connections to the Internet. Without special software to protect them, Internet surfers using cable modem and digital subscriber lines are easy prey.

''Anybody who is directly connected to the Internet through cable modems or DSL is extremely susceptible to these backdoor programs. We have seen many, many attacks coming on to those people's machines,'' said Vincent Weafer, director of Symantec Corp.'s Anti-Virus Research Center in Cupertino, Calif.

The security firm watched the hackers add to their numbers daily.

''They're gathering up their armies, and as that number increases, so will their testosterone level,'' said Todd Waskelis, a vice president at NETSEC.

The Herndon, Va.-based company first learned of the hackers' plans when the vandals tried to penetrate one of NETSEC's computers, and protective software detected it.

NETSEC was founded by two alumni of the National Security Agency and the Defense Department.

Their office, located in suburban Washington, resembles an electronic fortress. Cameras line the hallways, and most of the company's employees aren't authorized to access secured rooms.

The ''Attack Lab,'' with its scattered computers, resembles an abandoned office in a university computer science department. Here, firm engineers track computer vandals worldwide.