FCW
December
14, 2018
The Federal
Election Commission voted Thursday to allow members Congress to reallocate
leftover campaign funds to protect personal electronic devices and accounts of
members and staff. In an advisory opinion before the vote, FEC Commissioner
Caroline Hunter wrote that spending on cyber hygiene and protective services
would not constitute, "impermissible conversion of campaign funds to
personal use." Hunter's comments were addressed to Sen. Ron Wyden
(D-Ore.), who requested the opinion from FEC. The unanimous vote Thursday will
allow members of Congress and staff to use campaign funds to purchase a range
of hardware and software products to bolster their own security, including cell
phones and computers, home routers, personal software and applications,
firewalls, antivirus software, security keys, secure cloud services, password
management tools, consulting, incident response services and others.
The
Washington Post
December
12, 2018
A senior
FBI official on Wednesday said that Chinese economic espionage as well as
efforts to steal U.S. research and influence American discourse amount to “the
most severe counterintelligence threat” facing the United States today. E.W.
“Bill” Priestap, head of the bureau’s counterintelligence division, joined two
other senior security officials in outlining what they described as Beijing’s
long-term campaign to undermine the United States’ economic and technological
dominance and the government’s efforts to counter it. China’s Communist Party
“dominates every facet of Chinese life,” from religion to freedom of expression
and business, Priestap said at a Senate Judiciary Committee hearing. “It is
therefore alarming that the Chinese government’s economic aggression, including
its relentless theft of U.S. assets, is positioning China to supplant us as the
world’s superpower.” The hearing on “Non-Traditional Espionage Against the
United States” came as announcements of indictments of Chinese hackers and other
actions planned for this week have been put off for now, officials said,
declining to elaborate.
Quartz
The cyber
attack at Equifax that compromised data for nearly half of all Americans was
the result of rapid growth that boosted company’s share price but left the the
consumer credit bureau’s IT systems dangerously exposed to hackers. The massive
data breach, which took advantage of known security vulnerabilities, “was
entirely preventable,” according to a U.S. House of Representatives committee
report. Although Equifax is far from alone—the Marriott-owned Starwood hotel
chain and British Airways also reported huge hacker intrusions this year—the
credit bureau breach remains one of the biggest known data thefts. The steady
drumbeat of breaches signals consumers should be prepared for the worst and be
ready to respond. However the House report also shows there’s room for
companies to help prevent these incidents in the first place.
ADMINISTRATION
Nextgov
December
13, 2018
The State
Department is purchasing some very specific phone hacking tools that it plans
to turn over to the Ghanaian police force to assist the country’s
investigations into international crime. The department released a solicitation
Dec. 7 for phone hacking tools and hardware that are interoperable with tools
used by the department and other U.S. agencies. Once purchased, the department
will donate those tools through the U.S. Embassy in Accra to the Ghana Police
Service’s cyber investigative unit. “This will allow [the Bureau of
International Narcotics and Law Enforcement] to accomplish its foreign
assistance mission in Ghana to build the capacity of law enforcement to combat
transnational organized crime, such as cybercrime that directly affects Americans,”
according to the sole-source justification document. The State Department is
looking for a small business able to provide specific hacking tools.
The
Washington Post
December
11, 2018
The Trump
administration is preparing actions this week to call out Beijing for what it
says are China’s continued efforts to steal American trade secrets and advanced
technologies and to compromise sensitive government and corporate computers,
according to U.S. officials. Multiple government agencies are expected to
condemn China, citing a documented campaign of economic espionage and the
alleged violation of a landmark 2015 pact to refrain from hacking for
commercial gain. In perhaps the most significant move, the Justice Department
is expected to announce the indictments of hackers suspected of working for a
Chinese intelligence service and participating in a long-running espionage
campaign that targeted U.S. networks. Along with that, the administration is
planning to declassify intelligence relating to the breaches, which date to
2014, and to impose sanctions on some of those believed responsible, according
to people familiar with the plans. Other actions are expected, but officials
declined to discuss them.
FCW
The Office
of Management and Budget is making sure all agencies develop plans to protect
their most sensitive and valuable cybersecurity assets and designate an
agency-level office or team to secure them. A new memo from OMB builds on the
government's concerted, continued effort to shift its cybersecurity resources
to focus to the most sensitive and mission-critical systems that agencies need
to carry out their missions. It builds on recent Department of Homeland
Security guidance for agencies to update their lists of high-value assets, and
it comes as watchdogs continue to report on agencies that need stronger
protections around those assets. The new guidance from OMB covers all agencies
-- not just the Chief Financial Officers Act agencies covered in the 2016 memo
-- and expands the criteria for what constitutes a "high-value
asset." It replaces previous OMB directives.
Nextgov
December
11, 2018
At its
core, cybersecurity is a tight-lipped business. Organizations want to keep
their digital weaknesses under wraps and bad actors want their activities to
fly under the radar. But a lack of communication can also keep groups in the
dark about how well they’re protected online. Today it’s difficult to assess
how well different cyber tools defend against different types of attacks
because that information is largely unstandardized and rarely made public,
according to Erin Kenneally, who manages the cyber portfolio within the
Homeland Security Department’s research division. Companies each sell their
proprietary solutions “as the greatest thing since sliced cheese,” Kenneally
told Nextgov, and industry is left deciding what products to buy without much
hard data to rely on. As such, organizations have a tough time accurately
assessing their own cyber posture and predicting what the fallout would be from
an attack, she said. But through the Cyber Risk Economics program, or CYRIE,
the agency’s Science and Technology Directorate hopes to give groups more
transparency into the market for cyber solutions.
CyberScoop
December
10, 2018
A
presidential advisory council has warned the White House and Department of
Homeland Security in no uncertain terms that a catastrophic months-long power
outage represents a “profound threat [that] requires a new national focus.” The
president’s National Infrastructure Advisory Council, a group of executives
from the public and private sectors tasked with issuing advice on protecting
critical infrastructure, in a December report calls on the government to
enhance its efforts to prevent widespread electrical failures in the event of a
natural disaster. “Significant action is needed to prepare for a catastrophic
power outage that could last for weeks or months,” the report found, adding
that a cyberattack timed to coincide with a natural disaster could be especially
problematic. “Although emergency authorities are understood at a high-level,
how they are implemented in practice is unclear,” the report states. “There is
a better understanding for physical events that are more frequently practiced,
but it is less clear for cyber-physical events and larger-scale disasters.”
INDUSTRY
Huffpost
December
14, 2018
American
tech firm Cloudflare is providing cybersecurity services to at least seven
designated foreign terrorist organizations and militant groups, HuffPost has
learned. The San Francisco-based web giant is one of the world’s largest
content delivery networks and boasts of serving more traffic than Twitter,
Amazon, Apple, Instagram, Bing and Wikipedia combined. Founded in 2009, it
claims to power nearly 10 percent of Internet requests globally and has been
widely criticized for refusing to regulate access to its services. Among
Cloudflare’s millions of customers are several groups that are on the State
Department’s list of foreign terrorist organizations, including al-Shabab, the
Popular Front for the Liberation of Palestine, al-Quds Brigades, the Kurdistan
Workers’ Party (PKK), al-Aqsa Martyrs Brigade and Hamas — as well as the
Taliban, which, like the other groups, is sanctioned by the Treasury
Department’s Office of Foreign Assets Control (OFAC). These organizations own
and operate active websites that are protected by Cloudflare, according to four
national security and counterextremism experts who reviewed the sites at
HuffPost’s request.
CNBC
December
14, 2018
Private
equity firm Thoma Bravo is in early discussions to acquire security software
company McAfee from TPG and Intel for a significant premium over the company's
2016 $4.2 billion valuation, according to people familiar with the matter.
Talks may still fall apart and a deal announcement isn't expected soon, said
the people, who asked not to be named because the discussions are private.
McAfee, founded by John McAfee in 1987, historically developed cybersecurity
software for personal computers and servers, protecting users from malware and
other viruses. This type of computer security prevented attacks on personal
devices. More recently, it has expanded into mobile devices and cloud
computing, which is where hackers have migrated. The company was publicly
traded until 2010, when Intel bought it for $7.6 billion. The chipmaker hoped
to closely align its chips with McAfee's security technology. That vision
didn't pan out for Intel, which took a haircut of more than $3 billion when it
sold 51 percent of the business to TPG in a deal announced in 2016 at a
valuation of $4.2 billion.
CyberScoop
December
14, 2018
You don’t
have to be a hacker to hack. Much like legitimate businesses must pay for the
various inputs that make up their offerings, cybercriminals rely on products
and services — some legitimate and some purchased on the dark web — to conduct
their operations. A report published Friday by Deloitte, titled “Black Market
Ecosystem: Estimating the Cost of ‘Pwnership,'” paints a picture of an
underground economy of tools for cybercriminals and assesses how actors in this
space adapt and innovate much like legitimate businesses would invest in their
own services. “The underground economy is a diverse but interrelated ecosystem
where nearly all criminal enterprises incorporate a mixed assortment of tools
and services,” the report says. “This same concept is reflected in legitimate
markets where businesses and economies focus their effort on the production of
a limited scope of products or services to achieve productive efficiencies,
increase quality, and reduce costs.”
The
Washington Post
December
13, 2018
As the U.S.
military tries to ensure its military assets are as secure as possible against
cyberattack, the U.S. defense industry is gathering behind a new set of
standards to spot cybersecurity laggards within its own supply chain. The
Aerospace Industries Association (AIA), an Arlington-based trade association
that lobbies on behalf of defense contractors, on Tuesday released a set of
voluntary standards designed to help U.S. aerospace companies ensure the
weapons systems they make for the U.S. military are secure from hackers. AIA
president and chief executive Eric Fanning said in a statement that U.S.
defense companies should see cybersecurity as part of their competitive
advantage as they build complex systems for the military. “With aggressive
state and nonstate cyber actors targeting the United States, it is essential
that our industry work collectively to protect technology and information,”
Fanning wrote. “We are committed to bringing our industry together in
partnership with government to implement this and other meaningful measures
that keep us and our nation safer from cyber threats.” The release comes as the
U.S. military is considering how it can incorporate cybersecurity assessments
and requirements as it awards lucrative defense contracts, something that has
imposed new compliance hurdles for manufacturers. The lobbying group may be
trying to prove it can regulate itself without strict government intervention.
The
Boston Globe
December
13, 2018
Save the
Children Federation, one of the country’s best-known charities, said it was the
victim of a $1 million cyberscam last year. The Connecticut-based nonprofit
said hackers broke into a worker’s e-mail, posed as an employee, and created
false invoices and other documents, to fool the charity into sending nearly $1
million to a fraudulent entity in Japan. The con artists claimed the money was
needed to purchase solar panels for health centers in Pakistan, where Save the
Children has worked for more than 30 years. By the time the nonprofit realized
it had been defrauded, it was too late to stop the transfer. But Save the
Children Federation, the US affiliate of the international relief organization,
said it recouped all but $112,000 through insurance and tightened its security
after discovering the theft in May 2017, according to a recent filing with the
Internal Revenue Service.
CNBC
December
12, 2018
Freelance
elite hackers can make more than $500,000 a year searching for security flaws
and reporting those issues at big companies like Tesla and organizations like
the Department of Defense, according to new data released by ethical hacking
platform Bugcrowd. The company, founded in 2012, is one of a handful of
so-called “bug bounty” firms that provide a platform for hackers to safely
chase security flaws at companies that want to be tested. Hackers work on a
clearly defined contract for a specific company and get paid a bounty when they
are able to find a flaw in a company’s infrastructure. How much they’re paid
depends on how serious the problem is. Companies are increasingly looking for
alternatives for cybersecurity testing as millions of jobs in the field go
vacant, said Bugcrowd CEO Casey Ellis. By some estimates, as many as 3.5
million cyber jobs may be left open by 2021. Last year, the company saw its largest
payout for a single exploit — $113,000 for a bug found at a large tech hardware
company, Ellis said. Payouts rose 37 percent year over year in 2018, according
to the data.
ZDNet
December
12, 2018
Ships
suffer from the same types of cyber-security issues as other IT systems, a
recent document released by the international shipping industry reveals. The
document is the third edition of the "Guidelines on Cyber Security onboard
Ships," an industry-approved guide put together by a conglomerate of 21
international shipping associations and industry groups. While the document
contains what you'd expect to contain --rules and guidance for securing IT
systems onboard vessels-- it also comes with examples of what happens when
proper procedure isn't followed. These examples are past cyber-security
incidents that have happened on ships and ports, and which have not surfaced in
the public eye before until now.
CyberScoop
December
11, 2018
Executives
at Super Micro Computer (Supermicro) contended Tuesday that their company did
not fall victim to a major supply chain compromise described in a Bloomberg
Businessweek story in October. CEO Charles Liang and senior vice presidents
David Weigand and Raju Penumatcha wrote in a letter to customers that a
“thorough investigation” by a third-party firm concluded that malicious
hardware had not been planted on Supermicro devices. “Recent reports in the
media wrongly alleged that bad actors had inserted a malicious chip or other
hardware on our products during our manufacturing process,” the letter reads.
“After thorough examination and a range of functional tests, the investigations
firm found absolutely no evidence of malicious hardware on our motherboards.”
The Bloomberg story alleged Chinese operatives embedded rice grain-sized chips
on motherboards that Supermicro supplied to major technology companies like
Apple and Amazon Web Services. The report was immediately met with strong
denials from Supermicro and other organizations implicated. Public officials
like lawmakers, the FBI director, the director of national intelligence and
others also scrutinized the Bloomberg story.
INTERNATIONAL
The Wall
Street Journal
December 14,
2018
Chinese
hackers are breaching Navy contractors to steal everything from
ship-maintenance data to missile plans, officials and experts said, triggering
a top-to-bottom review of cyber vulnerabilities. A series of incidents in the
past 18 months has pointed out the service’s weaknesses, highlighting what some
officials have described as some of the most debilitating cyber campaigns linked
to Beijing. Cyberattacks affect all branches of the armed forces but
contractors for the Navy and the Air Force are viewed as choice targets for
hackers seeking advanced military technology, officials said. Navy contractors
have suffered especially troubling breaches over the past year, one U.S.
official said. The data allegedly stolen from Navy contractors and
subcontractors often is highly sensitive, classified information about advanced
military technology, according to U.S. officials and security researchers. The
victims have included large contractors as well as small ones, some of which
are seen as lacking the resources to invest in securing their networks.
Reuters
December 14,
2018
A group of
three Russian lawmakers close to the Kremlin has proposed a tightening of state
control over the local internet in response to what they view as
"aggressive" U.S. cyber security actions, a parliamentary document
showed on Friday. Russian authorities have in recent years attempted to curb
internet freedoms by blocking access to certain websites and messaging
services. If, as seems likely, the lawmakers' proposal is approved by the
parliament, this would among other things reduce the flows of Russian internet
traffic via foreign networks. "In an environment like this, defensive
measures are needed to ensure that the internet in Russia functions long-term
and in a stable way," the lawmakers' proposal said. Two of the lawmakers
belong to the ruling United Russia party, which supports President Vladimir
Putin and has a parliamentary majority. The third, Andrey Lugovoy, is a leading
suspect in the murder of former Russian spy and Kremlin critic Alexander
Litvinenko in London in 2006. The proposal said that more control was needed
over the internet because of the "aggressive character of the National
Cyber Strategy adopted by the United States".
AP
December
13, 2018
As U.S. President Donald Trump re-imposed harsh economic sanctions on
Iran last month, hackers scrambled to break into personal emails of American
officials tasked with enforcing them, The Associated Press has found — another
sign of how deeply cyberespionage is embedded into the fabric of U.S.-Iranian
relations. The AP drew on data gathered by the London-based cybersecurity group
Certfa to track how a hacking group often nicknamed Charming Kitten spent the
past month trying to break into the private emails of more than a dozen U.S.
Treasury officials. Also on the hackers’ hit list: high-profile defenders,
detractors and enforcers of the nuclear deal struck between Washington and
Tehran, as well as Arab atomic scientists, Iranian civil society figures and
D.C. think tank employees. “Presumably, some of this is about figuring out what
is going on with sanctions,” said Frederick Kagan, a scholar at the American
Enterprise Institute who has written about Iranian cyberespionage and was among
those targeted. Kagan said he was alarmed by the targeting of foreign nuclear
experts.
Ars Technica
December
13, 2018
A recent
phishing campaign targeting US government officials, activists, and journalists
is notable for using a technique that allowed the attackers to bypass
two-factor authentication protections offered by services such as Gmail and
Yahoo Mail, researchers said Thursday. The event underscores the risks of 2fa
that relies on one-tap logins or one-time passwords, particularly if the latter
are sent in SMS messages to phones. Attackers working on behalf of the Iranian
government collected detailed information on targets and used that knowledge to
write spear-phishing emails that were tailored to the targets’ level of
operational security, researchers with security firm Certfa Lab said in a blog
post. The emails contained a hidden image that alerted the attackers in real
time when targets viewed the messages. When targets entered passwords into a
fake Gmail or Yahoo security page, the attackers would almost simultaneously
enter the credentials into a real login page. In the event targets’ accounts
were protected by 2fa, the attackers redirected targets to a new page that
requested a one-time password.
CyberScoop
December
12, 2018
Hackers
behind a new campaign of cyberattacks that have targeted international critical
infrastructure facilities are using malicious code linked to North Korea,
according to research published Wednesday. Researchers from McAfee said
“Operation Sharpshooter” has numerous technical links to the Lazarus Group, the
group of suspected North Korean government hackers blamed for the 2014 breach
at Sony Pictures and other well-publicized attacks. Operation Sharpshooter used
a hacking tool called “Rising Sun” to target 87 organizations, mostly in the
U.S., between October and November of this year, McAfee said. The cybersecurity
vendor did not flatly tie this campaign to the North Korean government.
“Attributing an attack to any threat group is often riddled with challenges,
including potential ‘false flag’ operations by other threat actors,” the
research states. “Technical evidence alone is not sufficient to attribute this
activity with high confidence. However, based on our analysis, this operation
shares multiple striking similarities with other Lazarus Group attacks[.]”
Reuters
December
12, 2018
A hack on
Italian oil services firm Saipem that crippled more than 300 of the company’s
computers used a variant of the notorious Shamoon virus, Saipem said, a
development that links the case to a massive attack in 2012 on Saudi Aramco.
“The cyber attack hit servers based in the Middle East, India, Aberdeen and in
a limited way Italy through a variant of Shamoon malware,” the company said in
a statement on Wednesday. Work is under way “in a gradual and controlled
manner” to fully restore operations after the attack, it said. The Shamoon
virus was used in some of the most damaging cyber attacks in history, starting
in 2012 when it crippled tens of thousands of computers at Saudi Aramco and
RasGas Co Ltd in the Middle East - attacks that cybersecurity researchers said
were conducted on behalf of Iran. Saudi Aramco is Saipem’s biggest customer.
EURACTIV
December
11, 2018
Representatives
from the European Commission, Council and Parliament on Monday (10 December)
evening banded together to strengthen the bloc’s Cybersecurity efforts,
reaching agreement on the EU’s cybersecurity act. The measures approved will
see more resources and greater responsibility afforded to the EU’s
cybersecurity agency, ENISA, as well as establishing a certification framework
that will set cybersecurity standards for products during the design and
development stage. The Commission is set to draft the scope of products that
require obligatory certification, with a list to be finalized by 2023. “Trust
and security are fundamental for our Digital Single Market to work properly,”
Vice-President Andrus Ansip, in charge of the Digital Single Market, said in a
statement. “This evening’s (Monday’s) agreement on comprehensive certification
for cybersecurity products and a stronger EU Cybersecurity Agency is another
step on the path to its completion.”
The
Telegraph
December
11, 2018
A quarter
of NHS trusts in England and Wales have failed to give staff specialist cyber
security training, despite the devastating Wannacry cyber attack that crippled
hospital computers last year. On average, trusts have just one member of staff
with professional security credentials per 2,628 employees, according to
Freedom of Information requests by security company Redscan. Some large trusts,
with up to 16,000 total employees, do not have any formally qualified security
professionals, the research found. “Individual trusts are lacking in-house
cyber security talent and many are falling short of training targets,” said
Mark Nicholls, director of cyber security at Redscan. “The extent of the
discrepancies is alarming, as some NHS organisations are far better resourced,
funded and trained than others.”
Gov Info
Security
December
10, 2018
The U.K.'s
privacy watchdog says that six months after enforcement of the EU's General
Data Protection Regulation began, it's seen a dramatic increase in the number
of data breach reports. Under GDPR, organizations that suffer a breach
involving Europeans' personal information must file a report with the
appropriate regulator within 72 hours of learning of the breach if it included
"high-risk circumstances." In the U.K., breached organizations must
report the incident to the Information Commissioner's Office. Residents can
also file complaints with the ICO if they believe that their personal data has
been misused or not properly secured. Since GDPR enforcement began on May 25,
the number of complaints and breach reports has skyrocketed, U.K. Information
Commissioner Elizabeth Denham said last week in a speech delivered to the 50th
Asia Pacific Privacy Authorities Forum in Wellington, New Zealand.
The
Guardian
December 8,
2018
The UK’s
intelligence agencies are to significantly increase their use of large-scale
data hacking after claiming that more targeted operations are being rendered
obsolete by technology. The move, which has alarmed civil liberty groups, will
see an expansion in what is known as the “bulk equipment interference (EI)
regime” – the process by which GCHQ can target entire communication networks
overseas in a bid to identify individuals who pose a threat to national
security. A letter from the security minister, Ben Wallace, to the head of the
intelligence and security committee, Dominic Grieve, quietly filed in the House
of Commons library last week, states: “Following a review of current
operational and technical realities, GCHQ have … determined that it will be
necessary to conduct a higher proportion of ongoing overseas focused
operational activity using the bulk EI regime than was originally envisaged.”
TECHNOLOGY
CNBC
December
14, 2018
Credit
card-stealing software that has been infecting e-commerce sites since 2014
remains hard to stop, with a variety of hacking groups now using variations of
the code, according to security experts. The attacks have become so common and
consistent that information security professionals have given it a name:
Magecart. Magecart refers to cyberattacks in which hackers implant malicious
computer code into websites and third-party suppliers of digital systems to
steal credit card info as people enter it at a checkout page. While the digital
theft of credit car info, known as skimming, is not new, attacks on payment
pages and smaller companies represent a persistent threat that has proven so
successful that it has spawned its own small cottage industry. In 2018,
multiple large-scale online retailers revealed that their sites were infected
by Magecart hackers, including Ticketmaster, British Airways, electronics
retailer Newegg and Sotheby’s. Matthew Meltzer, a researcher at cybersecurity
firm Volexity, said that digital card skimming is attractive to hackers because
of the crime’s simplicity and high chance of reward.
CyberScoop
December
10, 2018
he Tor Project
has been waiting for an opportunity like this. The privacy-focused organization
for years has been developing technology to help web users browse the internet
without prying eyes of repressive governments or Silicon Valley giants.
Surveillance and the collection of personal data continues to be a fundamental
problem for internet users, as evidenced by the number of data breaches in
recent months involving information about hundreds of millions of people. Tor
now has a new leadership team which aims to use the growing awareness about the
proliferation of personal data as fuel for the privacy’s organization’s growth.
That team just needs to figure out how to pay for it. The research-based
nonprofit that’s responsible for the Tor browser — a free software tool that
obscures a user’s location, browsing activity and other identifying data — gets
funding from the U.S. government. First developed by the U.S. military to
shield intelligence sources and fight censorship, the browser has become the
gateway to the dark web, and its many marketplaces that provide access to all
kinds of contraband.
via Nick
Leiserson
