cybercrime – Page 32 – Product Management Confabulation

August 8, 2019

Apple expands its bug bounty, increases maximum payout to $1M

Apple is finally giving security researchers something they’ve wanted for years: a macOS bug bounty.

The technology giant said Thursday it will roll out the bug bounty program to include Macs and MacBooks, as well as Apple TV and Apple Watch, almost exactly three years after it debuted its bug bounty program for iOS.

The idea is simple: you find a vulnerability, you disclose it to Apple, they fix it — and in return you get a cash payout. These programs are wildly popular in the tech industry as it helps to fund security researchers in exchange for serious security flaws that could otherwise be used by malicious actors, and also helps fill the void of bug finders selling their vulnerabilities to exploit brokers, and on the black market, who might abuse the flaws to conduct surveillance.

But Apple had dragged its feet on rolling out a bug bounty to its range of computers. Some security researchers had flat-out refused to report security flaws to Apple in absence of a bug bounty.

At the Black Hat conference in Las Vegas, head of security engineering and architecture Ivan Krstić announced the program to run alongside its existing iOS bug bounty.

Patrick Wardle, a security expert and principle security researcher at Jamf, said the move was a “no brainer.”

Wardle has found several major security vulnerabilities and dropped zero-days — details of flaws published without allowing the companies a chance to fix — citing the lack of a macOS bug bounty. He has long criticized Apple for not having a bug bounty, accusing the company of leaving a void open for security researchers to sell their flaws to exploit brokers who often use the vulnerabilities for nefarious reasons.

“Granted, they hired many incredible talented researchers and security professionals — but still never really had a transparent mutually beneficial relationship with external independent researchers,” said Wardle.

“Sure this is a win for Apple, but ultimately this a huge win for Apple’s end users,” he added.

Apple said it will open its bug bounty program to all researchers and increase the size of the bounty from the current maximum of $200,000 per exploit to $1 million for a zero-click, full chain kernel code execution attack with persistence — in other words, if an attacker can gain complete control of a phone without any user interaction and simply by knowing a target’s phone number.

Apple also said that any researcher who finds a vulnerability in pre-release builds that’s reported before general release will qualify for up to 50% bonus on top of the category of vulnerability they discover.

The bug bounty programs will be available to all security researchers beginning later this year.

The company also confirmed a Forbes report, published earlier this week, saying it will give a number of “dev” iPhones to vetted and trusted security researchers and hackers under the new iOS Security Research Device Program. These devices are special devices that give the hackers greater access to the underlying software and operating system to help them find vulnerabilities typically locked away from other security researchers — such as secure shell.

Apple said that it hopes expanding its bug bounty program will encourage more researchers to privately disclose security flaws, which will help to increase the protection of its customers.

August 8, 2019

Flawed office printers are a silent but serious target for hackers

You probably don’t think too much about your humble office printer. But they’re a prime target for hackers, if any of the dozens of vulnerabilities found by security researchers are anything to go by.

The latest research by the NCC Group just revealed at the Def Con security conference shows just how easy of a target office printers can be.

Think about it: office printers at some of the largest organizations in finance, government and tech all print corporate secrets — and classified material — and often keep a recorded copy in their memory. Printers are also complicated devices — more so than most people realize — with multiple internet-connected components, networking protocols, printer languages and fonts, and connected apps and devices, all of which have vulnerabilities.

No wonder they’re a target; office printers are a treasure trove of sensitive data. And because they often come with a web-based interface or an internet connection, they have a huge attack surface, making them easy to hack.

In the course of three months’ work, researchers Daniel Romero and Mario Rivas found and reported 45 separate vulnerabilities from six of the largest printer makers — HP, Lexmark, Brother, Xerox, Ricoh, and Kyocera — which could have allowed attackers to, among other things, siphon off copies of print jobs to an attacker controlled server.

They also showed they could hijacked and enlist vulnerable printers into botnets — used to overload websites with junk internet traffic. Or, with little effort, they could brick the printers completely, potentially causing havoc for business operations.

“Suppose a criminal developed a work that sought to compromise and permanently corrupt every vulnerable printer; this would severely impact the world’s ability to print, and could be catastrophic for affected sectors that rely heavily on printed documents, such as healthcare, legal and financial services,” said Romero and Rivas.

Not only that, printers can also be used as a way to gain a “method of persistence on a network,” the researchers said, allowing them to gain deeper access into a corporate network from an easy point of entry.

Because in most cases printers aren’t protected by anti-malware services like desktops and laptops, a malicious attacker could gain a permanent backdoor on the devices, giving them long-term access to a target corporate network.

When the researchers reported the bugs, they received mixed responses from the companies. Although every printer maker has since fixed the bugs they found, the researchers said some printer makers didn’t have a way to disclose the vulnerabilities they found, leaving them stranded and unable to make contact with some companies for more than two months.

Lexmark, which fixed nine vulnerabilities and issued its own security advisories, received a special mention for its “mature” vulnerability disclosure effort.

HP also issued a security advisory noting the five bugs it received and later fixed.

But the researchers said there are “probably more” bugs ready to be found. “We stopped searching after a few vulnerabilities,” they said. What makes matters worse is that most printer makers share code from one device to another, likely vastly expanding the number of devices affected by a single vulnerability.

Maybe next time, think before you print.

August 6, 2019

Cybereason raises $200 million for its enterprise security platform

Cybereason, which uses machine learning to increase the number of endpoints a single analyst can manage across a network of distributed resources, has raised $200 million in new financing from SoftBank Group and its affiliates.

It’s a sign of the belief that SoftBank has in the technology, since the Japanese investment firm is basically doubling down on commitments it made to the Boston-based company four years ago.

Israeli Cybersecurity Firm Cybereason Raises $59M Series C Led By SoftBank

The company first came to our attention five years ago when it raised a $25 million financing from investors including CRV, Spark Capital and Lockheed Martin.

Cybereason’s technology processes and analyzes data in real-time across an organization’s daily operations and relationships. It looks for anomalies in behavior across nodes on networks and uses those anomalies to flag suspicious activity.

The company also provides reporting tools to inform customers of the root cause, the timeline, the person involved in the breach or breaches, what tools they use and what information was being disseminated within and outside of the organization.

For founder Lior Div, Cybereason’s work is the continuation of the six years of training and service he spent working with the Israeli army’s 8200 Unit, the military incubator for half of the security startups pitching their wares today. After his time in the military, Div worked for the Israei government as a private contractor reverse engineering hacking operations.

Over the last two years, Cybereason has expanded the scope of its service to a network that spans 6 million endpoints tracked by 500 employees with offices in Boston, Tel Aviv, Tokyo and London.

“Cybereason’s big data analytics approach to mitigating cyber risk has fueled explosive expansion at the leading edge of the EDR domain, disrupting the EPP market. We are leading the wave, becoming the world’s most reliable and effective endpoint prevention and detection solution because of our technology, our people and our partners,” said Div, in a statement. “We help all security teams prevent more attacks, sooner, in ways that enable understanding and taking decisive action faster.”

The company said it will use the new funding to accelerate its sales and marketing efforts across all geographies and push further ahead with research and development to make more of its security operations autonomous.

“Today, there is a shortage of more than three million level 1-3 analysts,” said Yonatan Striem-Amit, chief technology officer and Co-founder, Cybereason, in a statement. “The new autonomous SOC enables SOC teams of the future to harness technology where manual work is being relied on today and it will elevate L1 analysts to spend time on higher value tasks and accelerate the advanced analysis L3 analysts do.”

Most recently the company was behind the discovery of Operation SoftCell , the largest nation-state cyber espionage attack on telecommunications companies.

Hackers are stealing years of call records from hacked cell networks

That attack, which was either conducted by Chinese-backed actors or made to look like it was conducted by Chinese-backed actors, according to Cybereason targeted a select group of users in an effort to acquire cell phone records.

As we wrote at the time:

… hackers have systematically broken in to more than 10 cell networks around the world to date over the past seven years to obtain massive amounts of call records — including times and dates of calls, and their cell-based locations — on at least 20 individuals.

Researchers at Boston-based Cybereason, who discovered the operationand shared their findings with TechCrunch, said the hackers could track the physical location of any customer of the hacked telcos — including spies and politicians — using the call records.

Lior Div, Cybereason’s co-founder and chief executive, told TechCrunch it’s “massive-scale” espionage.

Call detail records — or CDRs — are the crown jewels of any intelligence agency’s collection efforts. These call records are highly detailed metadata logs generated by a phone provider to connect calls and messages from one person to another. Although they don’t include the recordings of calls or the contents of messages, they can offer detailed insight into a person’s life. The National Security Agency has for years controversially collected the call records of Americans from cell providers like AT&T and Verizon (which owns TechCrunch), despite the questionable legality.

It’s not the first time that Cybereason has uncovered major security threats.

Back when it had just raised capital from CRV and Spark, Cybereason’s chief executive was touting its work with a defense contractor who’d been hacked. Again, the suspected culprit was the Chinese government.

As we reported, during one of the early product demos for a private defense contractor, Cybereason identified a full-blown attack by the Chinese — ten thousand usernames and passwords were leaked, and the attackers had access to nearly half of the organization on a daily basis.

The security breach was too sensitive to be shared with the press, but Div says that the FBI was involved and that the company had no indication that they were being hacked until Cybereason detected it.

July 27, 2019

Bellingcat journalists targeted by failed phishing attempt

Investigative news site Bellingcat has confirmed several of its staff were targeted by an attempted phishing attack on their Protonmail accounts, which the journalists and the email provider say failed.

“Yet again, Bellingcat finds itself targeted by cyber attacks, almost certainly linked to our work on Russia,” wrote Eliot Higgins, founder of the investigative news site in a tweet. “I guess one way to measure our impact is how frequently agents of the Russian Federation try to attack it, be it their hackers, trolls, or media.”

News emerged that a small number of Protonmail email accounts were targeted during the week — several of which belonged to Bellingcat’s researchers who work on projects relating to activities by the Russian government. A phishing email purportedly from Protonmail itself asked users to change their email account passwords or generate new encryption keys on a similarly named domain set up by the attackers. Records show the fake site was registered anonymously, according to an analysis by security researchers.

In a statement, Protonmail said the phishing attacks “did not succeed” and denied that its systems or user accounts had been hacked or compromised.

“The most practical way to obtain email data from a ProtonMail user’s inbox is by compromising the user, as opposed to trying to compromise the service itself,” said Protonmail’s chief executive Andy Yen. “For this reason, the attackers opted for a phishing campaign that targeted the journalists directly.”

Yen said the attackers tried to exploited an unpatched flaw in third-party software used by Protonmail, which has yet to be fixed or disclosed by the software maker.

“This vulnerability, however, is not widely known and indicates a higher level of sophistication on the part of the attackers,” said Yen.

It’s not known conclusively who was behind the attack. However, both Bellingcat and Protonmail said they believe certain tactics and indicators of the attack — and the fact that the targets were Bellingcat’s researchers working on the ongoing investigation into the downing of flight MH17 by Russian forces and the release of nerve agent in the U.K. — may point to hackers associated with the Russian government.

Higgins said in a tweet that this week’s attempted attack likely targeted a number of people “in the tens” unlike earlier attacks attributed to the Russian government-backed hacker group, known as APT 28 or Fancy Bear.

Bellingcat in the past year has gained critical acclaim for its investigations into the Russian government, uncovering the names of the alleged Russian operatives behind the suspected missile attack that blew up Malaysian airliner MH17 in 2014. The research team also discovered the names of the Russian operatives who were since accused of poisoning former Russian intelligence agent Sergei Skripal and his daughter Yulia in a nerve agent attack in Salisbury, U.K. in 2018.

The researchers use open-source intelligence and information gathering where police, law enforcement and intelligence agencies often fail.

It’s not the first time that hackers have targeted Bellingcat. Its researchers were targeted several times in 2016 and 2017 following the breach on the Democratic National Committee which saw thousands of internal emails stolen and published online.

A phone call to the Russian consulate in New York requesting comment was not returned.

Microsoft has warned 10,000 victims of state-sponsored hacking

July 26, 2019

Marcus Hutchins, malware researcher and ‘WannaCry hero’, sentenced to supervised release

MILWAUKEE, WI. — Marcus Hutchins, the malware researcher who became known as an “accidental hero” for stopping the WannaCry ransomware attack in 2017, has been sentenced to supervised release for one year on charges of making and selling the Kronos banking malware.

Presiding Judge J. P. Stadmueller described Hutchins, 25, as a “talented” but “youthful offender” in remarks in court Friday.

The judge said Hutchins’ time had been served and will face no time in jail.

“It’s going to take the people like [Hutchins] with your skills to come up with solutions because that’s the only way we’re going to eliminate this entire subject of the woefully inadequate security protocols,” said Stadmueller.

The judge said he look into account Hutchins’ age at the time of the offenses, and gave him credit for “turning a corner” in his life before charges were brought.

Stadmueller said his sentence is likely, however, to bar him from re-entering the United States.

In a statement, Hutchins said he made some “bad decisions” as a teenager. “I deeply regret my conduct and the harm that was caused,” he said.

“I have no desire to go back to that life,” he said, and apologized to the victims of the malware he created.

Hutchins, a British citizen who goes by the online handle @MalwareTech, was arrested in Las Vegas by federal marshals in August 2017 while boarding a flight back to the U.K. following the Def Con security security conference. The government alleged in an indictment that he developed Kronos, a malware that steals banking credentials from the browsers of infected computers. The indictment also accused him of developing another malware known as the UPAS Kit. Hutchins was bailed on a $30,000 bond.

Since his indictment, he had been living in Los Angeles.

Hutchins initially denied creating the malware. But after prosecutors filed a superseding indictment, he later pleaded guilty to the two primary counts of creating and selling the malware. Eight remaining charges were dropped following his change in plea.

Prosecutors said Hutchins faced up to 10 years in prison and a maximum $500,000 fine.

In a statement following his guilty plea, he said he regretted his actions and accepted “full responsibility for my mistakes.”

Prosecutors said although Hutchins and an accomplice had generated only a few thousand dollars from selling the malware, Kronos allowed others to financially benefit from using the malware.

Hutchins’ indictment came four months after he was hailed as a hero for registering a domain name that stopped the spread of the WannCry cyberattack, which knocked tens of thousands of computers offline with ransomware in a few hours.

The ransomware attack, later blamed on North Korean hackers, spread across Ukraine, Europe and the U.K., encrypting systems and knocking businesses and government departments offline. The U.K.’s National Health Service NHS was one of the biggest organizations hit, forcing doctors to turn patients away and emergency rooms to close. Hutchins, who at the time of the attack worked for Los Angeles-based Kryptos Logic from his home in the south of England, registered the domain in an effort to understand why the ransomware was spreading. It later transpired the domain acts as a “kill switch” and stopped it dead in its tracks.

In the week after, the kill switch became the target of powerful botnets hoping to knock the domain offline and spark another outbreak.

Hutchins told TechCrunch last month that the WannaCry attack was one of the most stressful and exhausting moments in his life.

Since the attack, however, Hutchins received additional acclaim for his malware research on new infections and botnet activities. He has been praised for live-streaming his work so others can learn how to reverse engineer malware. Many in the security community — and further afield — have called on the court to grant Hutchins clemency for his recent concerted efforts to protect users from security threats.

Prosecutors acknowledged Hutchins’ reformed character in a sentencing memo filed this week, saying Hutchins has “since made a good decision to turn his talents toward more positive ends.”

When reached, a Justice Department spokesperson deferred comment to the U.S. Attorney’s Office for the Eastern District of Wisconsin, which did not immediately comment.

The sinkhole that saved the internet

July 23, 2019

As tech giants face Congressional investigation, states must step up regulatory oversight too

Tiffany Olson Kleemann Contributor

Tiffany Olson Kleemann is the chief executive officer of Distil Networks. She formerly served in executive roles at Symantec and FireEye and was deputy chief of staff for cybersecurity operations under President George W. Bush.

Congress has begun investigations into the power wielded by tech giants Amazon, Apple, Facebook, and Google – from their effect on the news media, to their impact on retail markets, to their handling of data. Unusual for these divided times, the concerns are bipartisan, with members of both parties suggesting that new legislation and regulation may be needed.

A number of big challenges are hurting consumers, including “serious breaches of privacy” and “loss of control of data,” Rep. David Cicilline, D-R.I., chairman of the House Antitrust Subcommittee, told CNBC.

This discussion of what Cicilline has called a “monopoly moment” is healthy and overdue. However, while Congress examines whether we should trust the tech titans with so much of our data and other assets, it would be great to see more urgency on another question: Can we trust the government itself with our data?

Federal and state government databases hold a treasure trove of sensitive, personal information that is used to collect taxes, administer benefits, register vehicles, or run elections. Not to mention the 434.2 million phone records on Americans that the National Security Agency collected last year, according to a government report.

Hackers, naturally, know that government sites are a rich target, and some of the largest cybersecurity breaches of recent years have taken place in the public sector.

WASHINGTON, DC – MARCH 24: A Department of Justice employee put up a poster of the seven indicted hackers prior to a news conference for announcing a law enforcement action March 24, 2016 in Washington, DC. A grand jury in the Southern District of New York has indicted seven Iranian who were employed by two Iran-based computer companies that performed work on behalf of the Iranian Government, on computer hacking charges related to their involvement in an extensive campaign of over 176 days of distributed denial of service (DDoS) attacks. (Photo by Alex Wong/Getty Images)

In two separate incidents in June 2015, the U.S. Office of Personnel Management discovered that attackers had stolen the Social Security numbers and other confidential information of 25.7 million current and former federal employees and contractors. The hackers’ haul even included 5.6 million fingerprints of job applicants who has undergone background investigations.

In 2016, the IRS said that 700,000 Social Security numbers were taken in a hack the year before.

In 2018, a “SamSam” ransomware attack shut down the city of Atlanta’s online systems, forcing the cancellation of court proceedings and preventing the collection of water bills and traffic fines. Last month, a ransomware assault has affected services in Baltimore and cost the city at least $18.2 million in lost or delayed revenue and direct restoration costs.

And then there are the foreign attempts to interfere with elections. U.S. officials have testified that Russian hackers targeted voting systems in 21 states in 2016, though no actual votes are believed to have been affected.

Since free and fair elections are a core tenet of our democracy, voter registration pages and election systems are the most sensitive areas of state and municipal web infrastructure. Election databases also contain personally identifiable information such as names, ages, and addresses. As my company’s experience with various state governments show, these systems are constantly under attack.

In fact, we’ve seen up to two-thirds of state election agencies’ website traffic consist of malicious bots searching for data to steal or scrape. Even more disturbingly, we have also seen spikes in automated traffic attacking the websites as registration deadlines approach. These spikes slow down the performance of back-end databases, compromising the agencies’ overall ability to effectively conduct elections.

This evidence shows that the existential threat to government data is every bit as important as the security and privacy concerns driving the congressional investigation of Amazon, Apple, Facebook, and Google. But is enough being done?

Voting booths in polling place. Image courtesy Getty Images

More than three years after the devastating attack on the U.S. Office of Personnel Management, a report by the General Accounting Office in November found that the agency had not implemented 29 of the 80 recommendations the government’s in-house auditor had made to shore up its cyber defenses.

In Atlanta, an audit determined that leading up to the ransomware attack, the city had ignored repeated warnings about flaws in its security posture, including a failure to address 1,500 to 2,000 severe vulnerabilities that the city’s Information Management and the Office of Information Security had identified.

Where control of data is concerned, it’s vital that the federal and state governments look themselves in the mirror just as hard as Congress is now assessing the tech giants. A few specific recommendations:

Government agencies at all levels should conduct an exhaustive review of their cyber security capabilities and hold leaders personally responsible for ensuring they are up to snuff for constantly evolving threats.

Beyond investigating the practices of a few companies, Congress also should focus energy on a long-overdue update of the Computer Fraud and Abuse Act, a 33-year-old law that makes it unlawful to break into a computer to access or alter information and, astoundingly, still serves as a legal guidepost in today’s new landscape of bots, malware, ransomware and other malicious attacks.

The Trump administration should make sure to follow through with its May 2 executive order on cyber defense that promised to “grow the cybersecurity capability of the United States Government, increase integration of the federal cybersecurity workforce, and strengthen the skills of federal information technology and cybersecurity practitioners.” It also called for a “cybersecurity rotational assignment program” within the federal government that “will serve as a mechanism for knowledge transfer and a development program for cybersecurity practitioners.”

An important discussion is happening on Capitol Hill about the influence of Amazon, Apple, Facebook, and Google in our lives and society. It would be hypocritical, however, to lose sight of how much of our data sits in government computer systems and that it also faces serious threat.

July 22, 2019

Cyber threats from the U.S. and Russia are now focusing on civilian infrastructure

Joe Cheravitch Contributor

Joe Cheravitch is a defense analyst with the Rand Corporation.

Cyber-confrontation between the U.S. and Russia is increasingly turning to critical civilian infrastructure, particularly power grids, judging from recent press reports. The typically furtive conflict went public last month, when The New York Times reported U.S. Cyber Command’s shift to a more offensive and aggressive approach in targeting Russia’s electric power grid.

The report drew skepticism from some experts and a denial from the administration, but the revelation led Moscow to warn that such activity presented a “direct challenge” that demanded a response. WIRED magazine the same day published an article detailing growing cyber-reconnaissance on U.S. grids by sophisticated malware emanating from a Russian research institution, the same malware that abruptly halted operations at a Saudi Arabian oil refinery in 2017 during what WIRED called “one of the most reckless cyberattacks in history.”

Although both sides have been targeting each other’s infrastructure since at least 2012, according to the Times article, the aggression and scope of these operations now seems unprecedented.

Washington and Moscow share several similarities related to cyber-deterrence. Both, for instance, view the other as a highly capable adversary. U.S. officials fret about Moscow’s ability to wield its authoritarian power to corral Russian academia, the private sector, and criminal networks to boost its cyber-capacity while insulating state-backed hackers from direct attribution.

Moscow sees an unwavering cyber-omnipotence in the U.S., capable of crafting uniquely sophisticated malware like the ‘Stuxnet’ virus, all while using digital operations to orchestrate regional upheaval, such as the Arab Spring in 2011. At least some officials on both sides, apparently, view civilian infrastructure as an appropriate and perhaps necessary lever to deter the other.

Image courtesy of TechCrunch/Bryce Durbin

Whatever their similarities in cyber-targeting, Moscow and Washington faced different paths in developing capabilities and policies for cyberwarfare, due in large part to the two sides’ vastly different interpretations of global events and the amount of resources at their disposal.

A gulf in both the will to use cyber-operations and the capacity to launch them separated the two for almost 20 years. While the U.S. military built up the latter, the issue of when and where the U.S. should use cyber-operations failed to keep pace with new capabilities. Inversely, Russia’s capacity, particularly within its military, was outpaced by its will to use cyber-operations against perceived adversaries.

Nonetheless, events since 2016 reflect a convergence of the two factors. While the U.S. has displayed a growing willingness to launch operations against Russia, Moscow has somewhat bolstered its military cyber-capacity by expanding recruiting initiatives and malware development.

The danger in both sides’ cyber-deterrence, however, lies not so much in their converging will and capacity as much as it is rooted in mutual misunderstanding. The Kremlin’s cyber-authorities, for instance, hold an almost immutable view that the U.S. seeks to undermine Russia’s global position at every turn along the digital front, pointing to U.S. cyber-operations behind global incidents that are unfavorable to Moscow’s foreign policy goals. A declared expansion in targeting Russian power grids could ensure that future disruptions, which can occur spontaneously, are seen by Moscow as an unmistakable act of U.S. cyber-aggression.

In Washington, it seems too little effort is dedicated to understanding the complexity of Russia’s view of cyber-warfare and deterrence. The notion that Russia’s 2016 effort to affect the U.S. presidential election was a “Cyber” or “Political” Pearl Harbor is an appropriate comparison only in the sense that U.S. officials were blindsided by Moscow’s distinct approach to cyberwarfare: an almost seamless blend of psychological and technical operations that differs from most Western concepts.

Russian military operators conducted what should be considered a more aggressive cyber-campaign a year before their presidential election-meddling, when they posed as ‘CyberCaliphate,’ an online branch of ISIS, and attacked U.S. media outlets and threatened the safety of U.S. military spouses.

For their part, the Russians made a different historical comparison to their 2016 activity. Andrey Krutskikh, the Kremlin’s bombastic point-man on cyber-diplomacy issues, likened Russia’s development of cyber-capabilities that year to the Soviet Union’s first successful atomic bomb test in 1949.

A silhouette of a hacker with a black hat in a suit enters a hallway with walls textured with blue internet of things icons 3D illustration cybersecurity concept

Image courtesy of Getty Images/BeeBright

Western analysts, fixated on untangling the now-defunct concept of the ‘Gerasimov Doctrine,’ devoted far less attention to the Russian military’s actual cyber-experts, who starting in 2008 wrote a series of articles about the consequences of Washington’s perceived militarization of cyberspace, including a mid-2016 finale that discussed Russia’s need to pursue cyber-peace with the U.S. by demonstrating an equal ‘information potential’.

Despite Cyber Command’s new authorities, Moscow’s hackers are comparatively unfettered by legal or normative boundaries and have a far wider menu of means and methods in competing with the U.S. short of all-out war. Russian military hackers, for example, have gone after everything from the Orthodox Church to U.S. think tanks, and they launched what the Trump administration called the most costly cyber-attack in history.

In the awkward space between war and peace, Russian cyber-operations certainly benefit from the highly permissive, extralegal mandate granted by an authoritarian state, one that Washington would likely be loath (with good reason) to replicate out of frustration.

By no means should the Kremlin’s activity go unanswered. But a leap from disabling internet access for Russia’s ‘Troll Farm’ to threatening to blackout swaths of Russia could jeopardize the few fragile norms existing in this bilateral cyber-competition, perhaps leading to expanded targeting of nuclear facilities.

The U.S. is arriving late to a showdown that many officials in Russian defense circles saw coming a long time ago, when U.S. policymakers were understandably preoccupied with the exigencies of counterterrorism and counterinsurgency.

Washington could follow Moscow’s lead in realizing that this is a long-term struggle that requires innovative and thoughtful solutions as opposed to reflexive ones. Increasing the diplomatic costs of Russian cyber-aggression, shoring-up cyber-defenses, or even fostering military-to-military or working-level diplomatic channels to discuss cyber redlines, however discretely and unofficially, could present better choices than apparently gambling with the safety of civilians that both sides’ forces are sworn to protect.

July 17, 2019

Microsoft has warned 10,000 victims of state-sponsored hacking

Microsoft said it has notified close to 10,000 people in the past year that they have been targeted by state-sponsored hackers.

The tech giant said Wednesday that the victims were either targeted or compromised by hackers working for a foreign government. In almost all cases, Microsoft said, enterprise customers were the primary targets — such as businesses and corporations. About one in 10 victims are consumer personal accounts, the company said.

Microsoft said its new data, revealed at the Aspen Security Forum in Colorado, demonstrates the “significant extent to which nation-states continue to rely on cyberattacks as a tool to gain intelligence, influence geopolitics, or achieve other objectives.”

On top of that the company also said it has made 781 notifications of state-sponsored attacks on organizations using its AccountGuard technology, designed for political campaigns, parties and government institutions.

Almost all of the attacks targeted U.S.-based organizations, the company said, but a spokesperson would not disclose the percentage of successful attacks.

Most of the attacks were traced back to activity by hacking groups believed to be associated with Russia, North Korea and Iran.

One such group, the so-called APT 33 group operating out of Iran — which Microsoft calls Holmium — has been in Microsoft’s cross-hairs before. In March the company said the Tehran-backed hackers stole corporate secrets and destroyed data in a two-year-long hacking campaign. Weeks later the company sued to obtain a restraining order for another Iranian hacker group, APT 35, or Phosphorus. A year earlier it took similar legal action against Russian hackers, known as APT 28, or Fancy Bear, which was blamed for disrupting the 2016 presidential election.

“Cyberattacks continue to be a significant tool and weapon wielded in cyberspace. In some instances, those attacks appear to be related to ongoing efforts to attack the democratic process,” said Microsoft’s customer security chief Tom Burt in a blog post.

Microsoft said it expects to see the “use of cyberattacks to specifically target democratic processes” ahead of the upcoming 2020 presidential election.

Microsoft sues to take control of domains involved in Iran hacking campaign

July 12, 2019

TrickBot malware learns how to spam, ensnares 250M email addresses

Old bot, new tricks.

TrickBot, a financially motivated malware in wide circulation, has been observed infecting victims’ computers to steal email passwords and address books to spread malicious emails from their compromised email accounts.

The TrickBot malware was first spotted in 2016 but has since developed new capabilities and techniques to spread and invade computers in an effort to grab passwords and credentials — eventually with an eye on stealing money. It’s highly adaptable and modular, allowing its creators to add in new components. In the past few months it’s adapted for tax season to try to steal tax documents for making fraudulent returns. More recently the malware gained cookie stealing capabilities, allowing attackers to log in as their victims without needing their passwords.

With these new spamming capabilities, the malware — which researchers are calling “TrickBooster” — sends malicious from a victim’s account then removes the sent messages from both the outbox and the sent items folders to avoid detection.

Researchers at cybersecurity firm Deep Instinct, who found the servers running the malware spamming campaign, say they have evidence that the malware has collected more than 250 million email addresses to date. Aside from the massive amounts of Gmail, Yahoo, and Hotmail accounts, the researchers say several U.S. government departments and other foreign governments — like the U.K. and Canada — had emails and credentials collected by the malware.

“Based on the organizations affected it makes a lot of sense to get as widely spread as possible and harvest as many emails as possible,” Guy Caspi, chief executive of Deep Instinct, told TechCrunch. “If I were to land on an end point in the U.S. State department, I would try to spread as much as I can and collect any address or credential possible.”

If a victim’s computer is already infected with TrickBot, it can download the certificate-signed TrickBooster component, which sends lists of the victim’s email addresses and address books back to the main server, then begins its spamming operating from the victim’s computer.

The malware uses a forged certificates to sign the component to help evade detection, said Caspi. Many of the certificates were issued in the name of legitimate businesses with no need to sign code, like heating or plumbing firms, he said.

The researchers first spotted TrickBooster on June 25 and was reported to the issuing certificate authorities a week later which revoked the certificates, making it more difficult for the malware to operate.

After identifying the command and control servers, the researchers obtained and downloaded the 250 million cache of emails. Caspi said the server was unprotected but “hard to access and communicate with” due to connectivity issues.

The researchers described TrickBooster as a “powerful addition to TrickBot’s vast arsenal of tools,” given its ability to move stealthily and evade detection by most antimalware vendors, they said.

TrickBot malware attacks are ramping up ahead of Tax Day

July 10, 2019

What CISOs need to learn from WannaCry

In 2017 — for the first time in over a decade — a computer worm ran rampage across the internet, threatening to disrupt businesses, industries, governments and national infrastructure across several continents.

The WannaCry ransomware attack became the biggest threat to the internet since the Mydoom worm in 2004. On May 12, 2017, the worm infected millions of computers, encrypting their files and holding them hostage to a bitcoin payment.

Train stations, government departments, and Fortune 500 companies were hit by the surprise attack. The U.K.’s National Health Service (NHS) was one of the biggest organizations hit, forcing doctors to turn patients away and emergency rooms to close.

Earlier this week we reported a deep-dive story into the 2017 cyberattack that’s never been told before.

British security researchers — Marcus Hutchins and Jamie Hankins — registered a domain name found in WannaCry’s code in order to track the infection. It took them three hours to realize they had inadvertently stopped the attack dead in its tracks. That domain became the now-infamous “kill switch” that instantly stopped the spread of the ransomware.

As long as the kill switch remains online, no computer infected with WannaCry would have its files encrypted.

But the attack was far from over.

In the days following, the researchers were attacked from an angry botnet operator pummeling the domain with junk traffic to try to knock it offline and two of their servers were seized by police in France thinking they were contributing to the spread of the ransomware.

Worse, their exhaustion and lack of sleep threatened to derail the operation. The kill switch was later moved to Cloudflare, which has the technical and infrastructure support to keep it alive.

Hankins described it as the “most stressful thing” he’s ever experienced. “The last thing you need is the idea of the entire NHS on fire,” he told TechCrunch.

Although the kill switch is in good hands, the internet is just one domain failure away from another massive WannaCry outbreak. Just last month two Cloudflare failures threatened to bring the kill switch domain offline. Thankfully, it stayed up without a hitch.

CISOs and CSOs take note: here’s what you need to know.