Foreign Cyber News

McAfee JP sharing relevant cyber security news from across the globe

[foreigncybernews]

From the article:

In the UK, the government has announced that organizations working in critical services like energy, transport, water and health can be fined up to £17 million ($24 million) as a “last resort” if they fail to demonstrate that their cyber security systems are equipped adequately against attacks.

Major requirements for organizations will include having the right people and organization in place to handle a cyber attack; having the right software in to protect against attacks; having the right capabilities in place to detect if an attack has taken place anyway; and having the right systems in place to minimize the impact of an attack if a system is breached (despite the other three being in place).

More detailed guidance includes how to secure other aspects of your network, such as your supply chain and how your data in the cloud.

UK is well ahead of most of the global cyber powers on oversight of critical infrastructure cyber security implementation. This is a good set of lessons learned for Japan to consider investigating to determine viability in the country.

[foreigncybernews]

Dutch team infiltrated Russian hacker group, witnessing U.S. election meddling, DNC attack

Two Dutch intelligence services uncovered substantial evidence detailing how a Russian-backed hacking group infiltrated the Barack Obama White House, the U.S. Department of State, and the Democratic National Committee, according to a ground breaking report from broadcaster NOS and newspaper Volkskrant.

From the article:

Two Dutch intelligence services uncovered substantial evidence detailing how a Russian-backed hacking group infiltrated the Barack Obama White House, the U.S. Department of State, and the Democratic National Committee. The evidence was uncovered by a Dutch cyber defense team which gained access to the "Cozy Bear" hacker group's systems, including a hallway security camera that allowed the Dutch team to maintain visual surveillance of the hackers. Information collected by the Dutch Joint Sigint Cyber Unit (JSCU) was turned over to the NSA, CIA, and FBI, and helped form the basis for the U.S. special counsel investigation examining claims of Russian meddling during the 2016 presidential election campaign. The JSCU, comprised of members from the AIVD and MIVD intelligence agencies, kept watch over Cozy Bear from anywhere between 12 to 30 months.

The Dutch owned the owners - they had not only been able to acquire access to Russian backed Cozy Bear networks, but even physical security camera’s in the building where the team performed their operations. This is tremendous news, and a highly interesting revelations that absolutely nobody would have expected.

[foreigncybernews]

Dutch banks, tax office hit by DDoS attacks amid reports of intel spying on Russia-linked Cozy Bear

At least three banks and the Dutch tax authority suffered DDoS attacks over the weekend.

From the article:

Several top banks and the national tax authority in the Netherlands were briefly crippled by a series of powerful DDoS attacks targeting their networks. ABN Amro, ING and Rabobank confirmed in separate statements that they were attacked with their online and mobile banking services temporarily knocked offline. The wave of cyber attacks come just days after local media reported that Dutch intelligence agency AIVD spied on Russia-linked hacker group Cozy Bear, also known as APT29, as early as 2014.

This should not come as a surprise considering the bombshell intelligence revelations to come out of the Netherlands.

[foreigncybernews]

Intel reportedly notified Chinese companies of chip security flaw before the U.S. government

Intel is not having that great of year thus far in the face of a slew of information about security flaws in it hardware coming out — and you can add..

From the article:

Intel notified some of its customers of the security flaws in its processors, dubbed Spectre and Meltdown, but left out the U.S. government as part of that. Some of the companies Intel notified included Chinese technology companies, though the report suggests there is no evidence that any information was misused. An Intel spokesperson said the company wasn’t able to tell everyone it planned because the news was made public earlier than expected.

So the real questions are: did China inform Russia of these vulnerabilities, and has Russia created tools to leverage these exploits? Why would Intel hide this information from the United States government? 

This goes back to something I am adamantly against: withholding news of vulnerabilities of this nature so the intelligence communities can stockpile and leverage internally developed exploit kits to their so-called advantage,

[foreigncybernews]

NonPetya ransomware forced Maersk to reinstall 4000 servers, 45000 PCs

The shipping giant has suffered millions of dollars in damage due to the ransomware attack.

From the article:

Maersk has revealed that a devastating ransomware attack which struck businesses across Europe in 2017 required close to a "complete infrastructure" overhaul and the reinstallation of thousands of machines. The Danish transport and logistics conglomerate fell prey to a campaign which used a modified version of the Petya ransomware, NonPetya, bringing down IT systems and operational controls across the board. In total, Maersk reinstalled 4,000 servers, 45,000 PCs, and 2,500 applications in what the chairman called a "heroic effort" over ten days, one in which the executive said may have usually taken up to six months to implement.

What a complete and utter disaster for Maersk. What is most interesting to me, and what I would really like to know, is how this was even able to cause such devastation to corporate IT assets.

[foreigncybernews]

Triton malware: Next-gen cyberweapon that can shut down power plants accidentally leaked online

Triton malware, considered to be an advanced variant of Stuxnet, was used to shut down a Middle East oil and gas facility.

From the article:

A powerful malware, dubbed Triton or Trisis, which allows hackers to gain remote access to energy facilities' safety systems, has reportedly been accidentally leaked online for anyone to download. The malware is considered by some experts to be a next-generation cyber weapon and has already been used in December 2017 to shut down an oil and gas facility in the Middle East. According to research from multiple cybersecurity firms including FireEye, Dragos, Symantec and Trend Micro, the malware is likely created by a nation-state and targets safety systems of industrial control systems (ICS). Triton specifically targets the safety instrument system (SIS) produced by Schneider Electric's Triconex.

Successful attacks against critical infrastructure operators may very well prove devastating in the event of an actual global military conflict.

[foreigncybernews]

Russia, China's Cyber-Capabilities Are Catastrophic

Both have the capability to launch kinetic and cyber-attacks that cause complete paralysis and/or destruction of critical systems and infrastructure.

From the article:

Russia’s state-sponsored hacking arms (such as Fancy Bear) remain highly active, capable and influential, with retaliatory and cyber-influence activity expecting to ramp up as it is increasingly isolated from the West following election interference and information operations against Western democracies.

Chinese actors were linked to some notable attacks, however, and Beijing forged ahead with the implementation of the National Cybersecurity Law and subsequent regulatory changes with respect to the internet, and continued its crackdown on cybercrime and illicit content online. Chinese policymakers and military planners have long recognized the utility of cyber-espionage and cyber-weapons as a means of fueling economic growth and diminishing the US’ advantage in the event of a conventional military conflict.

Both China and Russia are two of the most sophisticated countries with cyber operations capabilities. However, the two countries leverage cyber for diametrically opposed reasons. Russia is interested in destabilizing the globe, while China, primarily, utilizes cyber as a means of either propping up its own economic goals or for espionage.

[foreigncybernews]

Nations Seek the Elusive Cure for Cyberattacks

Securing the world from these types of attacks will be on the agenda when many of the world’s top leaders gather at the World Economic Forum in Davos this week.

From the article:

Securing the world against cyberattacks — from nations, criminal groups, vandals and teenagers — will be on the agenda when many of the world’s top leaders gather at the World Economic Forum in Davos, Switzerland. As usual, there is a flurry of reports, and entrepreneurs will declare they have technological solutions at hand. But the fact remains that the major powers of the world have been unable to come up with a viable means of deterring the most damaging attacks. It still takes too long to formally identify the culprits, and the responses are insufficient. Efforts to establish “norms of behavior” got a promising start, but are now falling apart. No one can even agree on when an act of aggression in cyberspace amounts to an act of war. The Pentagon, in its first nuclear strategy review since President Trump took office, is even proposing to use the threat of unleashing nuclear weapons against a country or group delivering a devastating cyber attack against critical infrastructure of the United States or its allies. But that doesn’t help with the problem of everyday attacks.

Geopolitical cyber attacks are the new cold war.

[foreigncybernews]

From the article:

The fingerprint-analysis software used by the FBI and more than 18,000 other US law enforcement agencies contains code created by a Russian firm with close ties to the Kremlin, according to documents and two whistleblowers. The allegations raise concerns that Russian hackers could gain backdoor access to sensitive biometric information on millions of Americans, or even compromise wider national security and law enforcement computer systems. The Russian code was inserted into the fingerprint-analysis software by a French company, said the two whistleblowers, who are former employees of that company. The firm — then a subsidiary of the massive Paris-based conglomerate Safran — deliberately concealed from the FBI the fact that it had purchased the Russian code in a secret deal, they said.

[foreigncybernews]

From the article:

Researchers tracked 34 of the Iranian group's attacks on institutions in seven Middle Eastern countries between 2015 and mid-2017, but says APT 34 has been operational since at least 2014. The group appears to target financial, energy, telecommunications, and chemical companies, and analysts have moderate confidence the hackers are Iranians. They log into VPNs from Iranian IP addresses, adhere to normal Iranian business hours, their work has occasionally leaked Iranian addresses and phone numbers, and their efforts align with Iranian interests. Namely, targeting the country's adversaries.

[foreigncybernews]

From the article:

A Russian hacker believed to be a member of a hacking collective called Lurk said in court he was ordered by Russia's FSB security services to hack the Democratic National Committee. The hacker, Konstantin Kozlovsky, told a Moscow court in August of 2017 that his nine-member hacking group — which has been accused of stealing over $17 million from Russia's largest financial institutions since 2013 — has been cooperating with the FSB for several years. Part of that cooperation included hacking the DNC. Kozlovsky said during a hearing on August 15 that he "performed various tasks under the supervision of FSB officers," including a DNC hack and cyber attacks on "very serious military enterprises of the United States & other organizations."

[foreigncybernews]

From the article:

The most dramatic cybersecurity story of 2016 came to a quiet conclusion in December 2017 in an Alaska courtroom, as three young American computer savants pleaded guilty to masterminding an unprecedented botnet - powered by unsecured internet-of-things devices like security cameras and wireless routers - that unleashed sweeping attacks on key internet services around the globe. What drove them wasn’t anarchist politics or shadowy ties to a nation-state. It was Minecraft. It was a hard story to miss last year: In France last September, the telecom provider OVH was hit by a distributed denial-of-service (DDoS) attack a hundred times larger than most of its kind. Then, on a Friday afternoon in October 2016, the internet slowed or stopped for nearly the entire eastern United States, as the tech company Dyn, a key part of the internet’s backbone, came under a crippling assault, and much much more.

[foreigncybernews]

From the article:

South Korea’s spy agency said North Korean hackers were behind attacks on cryptocurrency exchanges this year in which some $7 million worth of cryptocurrencies were stolen. The cyber attacks attributed to North Korean hackers also included the leaking of personal information from 36,000 accounts from the world’s busiest cryptocurrency exchange Bitthumb in June, according to South Korea’s National Intelligence Service (NIS).

[foreigncybernews]

From the article:

Attackers infected a Windows machine, then deployed EternalBlue and EternalSynergy, two NSA exploits leaked by the Shadow Brokers earlier this year, which allows them to move laterally in the victim's local network and infect even more systems. At a later point, they would use PowerShell to download and install the final-stage malware, which, for this campaign, was a Monero miner. On Linux, attackers use Python scripts taken from the EmpireProject post-exploitation framework, and also install the same Monero miner.

[foreigncybernews]

From the article:

Auto giant Nissan confirmed that its Canadian branch has been hit by hackers. Nissan says that the hack may have impacted all of its current and past customers – approximately 1.13 million people. It is feared that hackers may have likely stolen millions of customers' private and sensitive information including names, addresses, vehicle identification number (VIN), vehicle make and model, credit score, loan amount and monthly payments.