Sleepless in Midland

Marriott breached -- AGAIN!

It was in late 2018 that Marriott suffered a major breach: Revealed: Marriott's 500 Million Hack Came After A String Of Security Breaches:

On Friday, hospitality giant Marriott revealed a massive hack led to the theft of personal data of a whopping 500 million customers of its Starwood hotels.

To some onlookers the breach, one of the biggest on record, was astonishing. To those who’ve been tracking Marriott and Starwood digital security, it wasn’t a huge surprise. Prior to the four-year-old breach being discovered, Marriott suffered at least one previously unreported hack, including an infection that hit the company’s own cyber-incident response team, Forbes has learned. And there’s evidence Russian cybercriminals have breached Starwood Web servers.

Now we are hearing about another breach: Marriott International Notifies Guests of Property System Incident:

At the end of February 2020, the company identified that an unexpected amount of guest information may have been accessed using the login credentials of two employees at a franchise property. The company believes that this activity started in mid-January 2020. ...

At this point, the company believes that the following information may have been involved for up to approximately 5.2 million guests, although not all of this information was present for every guest involved:
-contact details (e.g., name, mailing address, email address, and phone number)
-loyalty account information (e.g., account number and points balance, but not passwords)
-partnerships and affiliations (e.g., linked airline loyalty programs and numbers)
-preferences (e.g., stay/room preferences and language preference)

One doesn't have to be paranoid to suspect that anything that gets put on the internet is hackable.

------
3:27 PM 3/31/2020

Cybercriminals try to extort money by threatening to infect family with Coronavirus

Paul Ducklin at Naked Security reported that their security team received a phishing attempt which threatened to infect the target's family with Coronavirus.

Apparently, as proof of the culprit's supposed knowledge of those dirty little secrets they divulge a password they copied from some public exposure of purloined passwords.

Anyway, it's a scam. But one has to wonder whether anyone in the target audience actually paid the ransom.

------
12:57 PM 3/21/2020

Free WiFi sources collect info, store it in cloud, sometimes carelessly

If you're one of those people suspicious of free WiFi services, here's an example of why you are right to be suspicious.

There's a slogan in use these days: If it's free, you are the product.

This article by the excellent Paul Ducklin titled, Why ‘free’ Wi-Fi isn’t really free tells an interesting tale. He refers us to an article with more detail: Free Wifi User Data Exposed in Multiple UK Train Stations. Here's a self explanatory excerpt:

On February 14th I discovered a non-password protected database that contained a massive amount of records totaling 146 million. Upon further review I was able to see connections to what appeared to be free wifi details in major UK train stations. I could see a large amount of records that contained email addresses, age ranges, what was the reason for their travel, device data, and other internal logs. There were references to a company called C3UK inside the database and multiple domains that contained some form of the name C3.

He notified the owner of the cloud service as well as the WiFi provider, and the sloppiness was corrected in short order. But the experience highlights the fact that those services will not always operate in a manner that "the product" -- you and me -- would appreciate.

------
2:07 PM 3/4/2020

What's your Chinese social credit score?

Attorney General William Barr held a press conference the other day in which he announced indictments against four Chinese military hackers. Unless those malefactors decide to travel to the U.S. they will likely never have to face justice. They are more likely to be awarded honors by the Chinese government. Mr. Barr's prepared remarks can be seen here. And this excerpt tells us just how many American's personal information was purloined from Equifax:

This was one of the largest data breaches in history.  It came to light in the summer of 2017, when Equifax announced the theft.  The scale of the theft was staggering.  As alleged in the indictment, the hackers obtained the names, birth dates, and social security numbers of nearly 150 million Americans, and the driver’s license numbers of at least 10 million Americans.

Let's not forget that Chinese hackers stole OPM information about government employees a few years ago.

The objective could have been to aid thefts from the hacking victims. But it's just a likely, and maybe more likely, the goal was to compile dossiers on each and every American for future use in persuasion or coercion.

A news item supporting this theory is the scoring of American governors revealed in BUSTED: Mike Pompeo Says He Has List of American Governors Named as 'Friendly' by Communist China.

Meanwhile, major print periodicals routinely contain inserts paid for by the Chinese which purport to tell us all how great China is.

As if we needed a reminder, we would all do well to remember that China is not a friend.

------
3:08 PM 2/11/2020

Should we be worried about 2020 election interference?

Andy Kroll tells us in Rolling Stone that Hackers Are Coming for the 2020 Election — And We’re Not Ready.

Mr. Kroll cites a major cyber hack in 2016 conducted by Russian operative brought the internet to a halt. Then he goes on to a Russian group with a modest expenditure of "$15 million to $20 million and wreaked havoc on the psyche of the American voter creating the impression that behind every Twitter avatar or Facebook profile was a Russian troll."

Actually, that havoc on the psyche of the American voter was more likely the result a ploy by Hillary Clinton to deflect blame for her election loss and the Comey gang's efforts to criminalize Trump.

But never mind. The Russian are still busy bears. And regardless of any bias in Mr. Kroll's analysis, he makes a good case for caution going forward.

Most of us knew that already, though. For example, Wahingtontimes.com tells us 4 in 10 voters say U.S. ill-prepared to secure 2020 elections. Unfortunately, there's little any one individual can do, especially when many local election agencies are not that well equipped to deal with normal election safeguards. E.g., Hundreds of non-citizens registered to vote in Illinois due to technical glitch. Will they vote responsibly? We can hope.

------
10:14 AM 1/22/2020

Learning to avoid phishing attacks

Politico informs us that Moody’s credit rating agency is warning against Iranian hackers. And while they don't mention the method, we should be aware that phishing is the most common way a hacker breaches the target's system.

Most of us are already on alert for phishing emails, and on this subject, Paul Ducklin provides some helpful info in 5 tips to avoid spear-phishing attacks. Here are his bullet points:

1. Don’t be swayed just because a correspondent seems to know a lot about you.

2. Don’t rush to send out data just because the other person tells you it’s urgent.

3. Don’t rely on details provided by the sender when you check up on them.

4. Don’t follow instructions on how to view an email that appear inside the email itself.

5. Don’t be afraid to get a second opinion.

Go to the article for more details on these five points and to also see tips for the IT department.

------
3:37 PM 1/17/2020

Busy bears -- Russians are hacking Burisma

News sources are making this into a political event, and they could be right. But the bottom line is that Russian actors have been actively trying to hack into places where they don't belong.

Thepatrioteagle.com describes how it was done in Russians Hacked Ukrainian Gas Company at Center of Impeachment:

The Russian tactics are strikingly similar to what American intelligence agencies say was Russia’s hacking of emails from Hillary Clinton’s campaign chairman and the Democratic National Committee during the 2016 presidential campaign. In that case, once they had the emails, the Russians used trolls to spread and spin the material, and built an echo chamber to widen its effect.

Then, as now, the Russian hackers from a military intelligence unit known formerly as the G.R.U., and to private researchers by the alias “Fancy Bear,” used so-called phishing emails that appear designed to steal usernames and passwords, according to Area1, the Silicon Valley security firm that detected the hacking. In this instance, the hackers set up fake websites that mimicked sign-in pages of Burisma subsidiaries, and have been blasting Burisma employees with emails meant to look like they are coming from inside the company.

The hackers fooled some of them into handing over their login credentials, and managed to get inside one of Burisma’s servers, Area1 said.

So why would Russia want to hack Burisma? For information harmful to Joe Biden? If so, it's doubtful they wanted to help Trump. As one of the Democrat star impeachment witnesses said, Russians wasn't really trying to get Trump elected. They wanted to sow discord among our citizens and generate disgust with our governmental system. Whatever role Russia played, they got what they sought.

Any information they obtained that could hurt Biden would more likely be used against him should he become president.

Meanwhile, this sort of thing happens so frequently it seems negligent for any company not to have built in protection from phishing emails.

-----------

Topic originally found at POLITICO Playbook: The Democratic primary just got real.

------
1:45 PM 1/14/2020

Texas state and local officials on alert for Iranian cyber attacks

Iranians are trying. And hopefully state, county, and municipal agencies are on full alert.

Texas Governor Abbott has noticed:

None of the attempted attacks — which probed for weaknesses that would let hackers gather data, deny access to a website or post messages on a site — tracked by state officials were successful, said Abbott and Amanda Crawford, head of the Texas Department of Information Resources.

However, the Texas Department of Agriculture website was briefly defaced Tuesday with a photo of Qassem Soleimani, the Iranian general who was killed Friday in a U.S. drone strike, by a self-described “Iranian Hacker.” Similar attacks were reported in other states.

Hardly a week goes by in which we don't hear about some entity -- a company, government agency, municipality, hospital, etc. -- getting hacked or subjected to malware, ransomware, or something else. We all need to keep out software up to date and protected. Oh, and we should keep our fingers crossed just in case that particular gesture actually works.

Links:
Texas facing 10,000 potential cybersecurity attacks from Iran per minute, Abbott says;
Governor Greg Abbott Reports Rise In Attempted Cyber Attacks On Texas;
Abbott: Cyberattacks increase from inside Iran;
Morning Greatness: Iran Launches Hype Missile Attack on U.S. Military Bases in Iraq.

P.S. It would be nice if the U.S. could put some malware of its own in the Iranian government computers.

------
11:35 AM 1/8/2020

Enemies will use intel about us on us

It's heartening to learn that writers with some influence are concerned with the theory that China is compiling information on Americans. Samantha Ravich is one such writer. She has an impressive resume and recently wrote Artificial Intelligence and the Adversary. Here's an excerpt:

... Beijing already hoards vast quantities of data about its own 1.4 billion people, none of whom have privacy rights under the Communist regime.

Nevertheless, Beijing isn’t satisfied. It has turned its sights on the U.S. and has already exfiltrated some of the most sensitive information on the American people and military. These include repeated breaches since 2013 of medical systems and databases, and the decadelong targeting of the U.S. Navy’s ship-maintenance records and the names and personal details of 100,000 of its personnel.

In time, through artificial intelligence, China will be able to use Americans’ data against us. Personalized medical records could become personalized bioweapons, for instance.

This next passage is both terrifying and mystifying:

Personalized medical records could become personalized bioweapons, for instance. In 2017 Zhang Shibo, a retired Chinese general, wrote that biotech could provide China an offensive capability through the creation of “specific ethnic genetic attacks.” As for the stolen Navy data, understanding how the U.S. maintains its fleets will help China point out vulnerabilities in U.S. weapons systems and ship design to be exploited during a confrontation.

“Specific ethnic genetic attacks.” Understanding what each of those words means doesn't help to understand the phrase. Perhaps it means an involuntary assault on a person's DNA based on race. In any event, it's certainly sounds scary.

And it drives home the point that while China might be a trading partner, it is certainly not a friend.

------
2:51 PM 12/9/2019

Ransomware attacks on nursing homes? That's ruthless

The attack occurred on November 17 and involve the Ryuk ransomware strain. Attackers are getting ruthless, as it shut down Milwaukee, Wisc. based Virtual Care Provider Inc. which provides internet and data storage for nursing homes. Krebsonsecurity.com has the story in 110 Nursing Homes Cut Off from Health Records in Ransomware Attack. Here's the scary part:

Christianson said her firm cannot afford to pay the ransom amount being demanded — roughly $14 million worth of Bitcoin — and said some clients will soon be in danger of having to shut their doors if VCPI can’t recover from the attack.

“We’ve got some facilities where the nurses can’t get the drugs updated and the order put in so the drugs can arrive on time,” she said. “In another case, we have this one small assisted living place that is just a single unit that connects to billing. And if they don’t get their billing into Medicaid by December 5, they close their doors. Seniors that don’t have family to go to are then done. We have a lot of [clients] right now who are like, ‘Just give me my data,’ but we can’t.”

Brutal. The culprits could have blood on their hands.

Via: Sophos' Naked Security website which offers tips on how to prevent ransomware attacks.  However, even with all the publicity these attacks get, they are still happening.

------
3:45 PM 12/4/2019

In a war our enemies will be using that personal information they got about us on the internet

In an article titled The Future Of Information Warfare Is Here — And The Russians Are Already Doing It Tom Ricks tells us of a sneaky way the Russians tricked Ukrainian soldiers, quoting Army Col. Liam Collins:

“The Russians are adept at identifying Ukrainian positions by their electrometric signatures,” writes Collins. One would expect that, but the thing that impressed me what came next.

“In one tactic, soldiers receive texts telling them they are ‘surrounded and abandoned.’ Minutes later, their families receive a text stating, ‘Your son is killed in action,’ which often prompts a call or text to the soldiers. Minutes later, soldiers receive another message telling them to ‘retreat and live,’ followed by an artillery strike to the location where a large group of cellphones was detected.”

Surely this particular tactic won't work again. But it's a constant battle to stay ahead in any arena that relies on technology.

From time to time we hear of some big hack resulting in the loss of gigabytes of personal information about citizens. When we factor in the possibility that an enemy may have a dossier on each soldier it's even more important to guard against what that information can do to hurt them.

------
3:07 PM 12/1/2019

Does anyone trust Facebook's face recognition app?

For someone having trouble remembering a person's name this Facebook app might be a real benefit. But does anyone still trust Facebook?

Kate O'Flaherty tells us this in Forbes -- Facebook Tested A Terrifying Facial Recognition App On Employees And Their Friends. Excerpt:

Facebook is under fire again, and this time over a terrifying facial recognition app that was tested on its employees. According to Business Insider, the tool used real-time facial recognition to identify a person by simply pointing a smartphone’s camera at them.

Business Insider said the app was developed between 2015 and 2016 but has since been discontinued. Citing anonymous sources, it reported that one version of the tool could even bring up someone’s Facebook profile using facial recognition capabilities. It was allegedly tested on Facebook’s employees and their friends who had enabled facial recognition on their profiles. 

Facebook has confirmed that it did develop the app, but denied that it could identify users of the social network. CNET published a statement, which read: "As a way to learn about new technologies, our teams regularly build apps to use internally.

The program could have some benefit to individual users. But social media companies are less caring about their users than their customers -- companies and governments wanting to compile dossiers on each us. China and it's social credit scorecard comes to mind.

Americans who grew up during the cyber revolution are much more at ease sharing personal information then those who grew up without it. And some people are more tolerant of snoops than others.

It's still an open question why China purloined U.S. government employee files a few years back. But it's not out of the question that they could be compiling dossiers on each and every one of us.

In any event, it's disturbing to read how cavalier many tech companies are about developing snooping software which will undoubtedly end up in the hands of foreign government agencies.

------
3:22 PM 11/26/2019

Hackers are trying to get malware into utility companies' computers

Hopefully, they are trying to prevent this. But nonetheless, it's worrisome to think they aren't doing enough. And the means of attack is predominately through phishing. We've heard of several municipalities that were victimized by this type malware. Are utility employees keen enough to avoid becoming a patsy for hackers?

The bad news is in the Wall Street Journal. Utilities Targeted in Cyberattacks Identified. Here's a rather long excerpt:

More than a dozen U.S. utilities that were targets in a recent wave of cyberattacks have been identified by The Wall Street Journal. Some of the utilities, most of which are relatively small, are located near dams, locks and other critical infrastructure.

These electricity providers were singled out in a hacking campaign that was brought to light in August by researchers at a Silicon Valley cybersecurity company. But little was known about the attacks until now.

The Federal Bureau of Investigation is probing the attacks and has contacted some, but not all, of the utilities, according to some of the utilities. It is possible that the hacking campaign is ongoing, according to security researchers.

Utilities said the FBI provided information that helped them scan their computer networks to see if firewalls—their first-line defenses—had been probed and whether malware-laced emails had been sent to their employees. The FBI declined to comment.

The targeted utilities, which operate in 18 states from Maine to Washington, include Cloverland Electric Cooperative in Michigan, which sits next to the Sault Ste. Marie Locks, a critical juncture for the transport of iron ore to U.S. steel mills; Klickitat Public Utility District in Washington state, which is near major federal dams and transmission lines that funnel hydroelectricity to California; and Basin Electric Power Cooperative in North Dakota, one of the few utilities that is capable of delivering electricity to both the nation’s eastern and western grids.

The hackers attempted to get malware installed on utility computers through “phishing” emails that trick recipients into opening them. The embedded malware, which in this case has been dubbed “Lookback,” could give attackers the ability to take control of victims’ computers and steal information.

Here's the list of utilities affected:

Wisconsin Rapids Water Works and Lighting—Contacted by FBI
ALP Utilities, Minn.—Contacted by FBI
Cowlitz County Public Utility District, Wash.—Contacted by FBI
Flathead Electric Cooperative, Mont.—Didn’t provide details
Basin Electric Power, N.D.—Didn’t provide details
Klickitat Public Utility District, Wash.—No FBI contact
Cloverland Electric Cooperative, Mich.—Contacted by FBI
Brownsville Public Utilities Board, Texas—Contacted by the FBI
Utilities Commission of New Smyrna Beach, Fla.—Contacted by the FBI
Rochester Public Utilities, Minn.—No FBI contact
Tucson Electric Power, Ariz.—Declined to comment
Emera Maine—Declined to comment
Tri-County Electric Cooperative, S.C.—Couldn’t be reached for comment

Should we all be preppers so we could endure a long blackout?

------
3:15 PM 11/25/2019

Sim swap -- a sinister hacking technique now being litigated in Terpin vs. AT&T

The plaintiff, Michael Terpin, sued AT&T last year alleging that hackers were able to change the password to his cell phone remotely either with the assistance of AT&T employees or through the company's negligence, and as a result, he lost millions of dollars worth of cryptocurrency.

The judge dismissed most of the claims in a recent ruling but left the door open for amending the petition to include more information that might allow the claims to be reinstated.

But what the heck is a sim swap? The FTC has a short tutorial at SIM Swap Scams: How to Protect Yourself:

So how do scammers pull off a SIM card swap like this? They may call your cell phone service provider and say your phone was lost or damaged. Then they ask the provider to activate a new SIM card connected to your phone number on a new phone — a phone they own. If your provider believes the bogus story and activates the new SIM card, the scammer — not you — will get all your text messages, calls, and data on the new phone.

The scammer — who now has control of your number — could open new cellular accounts in your name or buy new phones using your information.

Or they could log in to your accounts that use text messages as a form of multi-factor authentication. How? Because they’ll get a text message with the verification code they need to log in.

They suggest ways to avoid being a victim:

Don’t reply to calls, emails, or text messages that request personal information.

Limit the personal information you share online.

Set up a PIN or password on your cellular account.

Consider using stronger authentication on accounts with sensitive personal or financial information.

It's a jungle out there.

------
4:13 PM 11/16/2019

Robocalls are bad enough, now it's robotexts

My land line went several days last week without a robocall, so maybe the government crackdown helped. Then again, the election is over, and that may have reduced the number.

And now there are robotexts to contend with. But here's some good news:

Spam texts make up less than 3 percent of the total number of SMS messages sent, according to CTIA, a wireless communications industry group. But with nearly 1 trillion texts sent by Americans in 2017, that means the number of unwanted robotexts is still substantial. ...

The FCC recently voted on new rules that ban fraudulent text messages by closing a loophole in the Truth in Caller ID Act, which banned “spoofing” phone numbers. It is illegal to send unsolicited commercial text messages. The FCC said it was cracking down on illegal robocalls and texts by fining the responsible people and giving the cellphone carriers more power to block them.

But it can be difficult to stop unwanted messages. Just like with robocalls, there are wanted robotexts from legitimate businesses. And people sending the spam may not be in the U.S.

In the meantime, there are ways to minimize the robotext annoyance.

Short solution: Don't reply or click on any links in an unwanted text, and block phone numbers that send them.

Then there's Simjacker, a “'spyware-like code' that co-opts the target device’s SIM card.” Although they haven't hit the U.S. yet, that doesn't mean they won't.

------
3:24 PM 11/11/2019

thanks for saving my air conditioner -- GAO asks DOE and FERC to do more to guard against cyber assaults

Way back in the good old pre-internet days it was easy to guard the electric grid with a tall fence around the plants. But the internet provides a much easier way to get in and do damage. Who would want to do that? For starters, there are nation states, criminals, and terrorists.

The smart people think the nation states wouldn't do anything right away, but that wouldn't stop the smart people on the other side from planting a bug that they could activate when the time is right.

The Government Accountability Office just released a report titled Critical Infrastructure Protection: Actions Needed to Address Significant Cybersecurity Risks Facing the Electric Grid. A link to the full report in PDF can be found at that site.

The GAO has recommended that DOE and FERC up their cyber security games. Hopefully, they'll find and plug any gaps in their present security plans.

Meanwhile, thehill.com writes about this at Watchdog: Energy Department not doing enough to protect grid against cyber attacks capsuling some key concerns:

GAO wrote in the report, originally finalized in August, that “the nation’s electric grid is becoming more vulnerable to cyberattacks — particularly those involving industrial control systems that support grid operations. Recent federal assessments indicate that cyberattacks could cause widespread power outages in the United States, but the scale of such outages is uncertain.”

GAO emphasized that DOE “plays a key role in helping address cybersecurity risks in each component of the electric grid’s infrastructure. However, DOE has not developed plans for electric grid cybersecurity that address the key characteristics needed for a national strategy.”

The report also found that while the Federal Energy Regulatory Commission (FERC), which regulates the flow of electricity between states, has approved mandatory grid cybersecurity standards, these do not fully encompass current federal guidance on grid cybersecurity.

It shouldn't be too much to ask those responsible for protecting the people they are supposed to protect to actually try to protect them. I need my air conditioner.

------
10:57 AM 10/2/2019

FERC is inviting comments on whether to publicize names of utilities that violated rules to protect power grid against cyber attacks

Should we know which utilities haven't complied with Federal Energy Regulatory Commission rules regarding protecting grids against cyber and other attacks?

Turns out the agency has received a number of FOIA requests for the names, so it's inviting public comments. If exposing the foot draggers in public will spur them to take the necessary actions to protect their power customers from the nightmare of a blackout resulting from sabotage, then do it.

Some helpful links:

Comments Sought on FERC/NERC Staff White Paper on CIP Standards Notices of Penalties
Regulator Weighs Disclosing Names of Utilities That Violate Grid Security Rules
NERC Coverup Investigation Report

------
1:59 PM 9/8/2019

Finally, some potentially good news about EMP protection

The prospect of an electromagnetic pulse attack has kept anyone who read William R. Forstchen's book, "One Second After" nervous for almost a decade. And those of us who hoped the people in charge would ramp up protection were left in the dark, so to speak.

But president Trump was prescient enough to issue an executive order that might stimulate those people who could actually make a difference. See Trump orders historic plan to thwart EMP, warns attack would be ‘debilitating’ from earlier this year.

The Electric Power Research Institute issued a report in April that suggested an EMP attack might result in as much damage as had been predicted.

But some steps could be taken to minimize the problems. The article Scientists Are Zapping Fake Electrical Grids to Help Us Survive an EMP Attack tells us some of the ways they might do it. Here's an excerpt:

The results showed that although some parts of power lines and transformer equipment were damaged by the pulses, they weren’t as drastically affected as some predictions presumed. And with the control houses, some structures held up better than others — namely the ones made with mostly metal, not concrete. The conductive qualities of metal make the control house act like a Faraday Cage, absorbing and dissipating the incoming energy so none reaches the electronics inside. While the modern-day metal control house designs weren’t totally EMP-proof, they did have better shielding qualities than their concrete counterparts.

The concept of a Faraday Cage has been with us for a long time. And if protecting the control houses actually works, then more power to them. But, it's probably too soon to stop worrying, especially with since cyber attacks would be so much simpler for an adversary to pull off.

P.S. That EPRI report is not without serious criticism. See EPRI EMP Report: Selling Snake Oil to America.

------
4:33 PM 9/6/2019

Will China apply its social credit system to the Americans in their database

It's a well known secret that China is snooping on us. Just the other day we learned that Chinese hackers had pilfered metadata from cell phone networks in Europe, Africa, the Middle East and Asia. Were they not hacking networks serving the U.S., or had those breaches just not yet been discovered or made public?

We go back a few years ago and recall the huge breach of the U.S. OPM data on thousands of current and retired federal workers. What became of that stolen private data?

At some point we need to reconcile the fact that the government of China has access to information on millions of U.S. citizens with China's new social credit system they are setting up for their own citizens. If they haven't done so already, they will surely be tempted to apply such a system to American citizens so they will know who is their friend, who is their foe, and who is persuadable.

------
2:47 PM 7/6/2019

Chinese hackers suspected of pilfering metadata from 10 cellular networks

It's as if anything using the internet can be tapped into. And any information flowing on the net can be stolen.

And now we are learning that information has been extracted from a hack on ten cell phone carriers. No disclosures yet on just which of the carriers have been affected, but there really aren't enough of them for the typical cell phone user in the affected countries to count on escaping this hack.

An article in Forbes says this. China's Hackers Accused Of 'Mass-Scale Espionage' Attack On Global Cellular Networks:

"The advanced, persistent attack targeting telecommunications providers," the company said, "has been active since at least 2017... The threat actor was attempting to steal all data stored in the active directory, compromising every single username and password in the organization, along with other personally identifiable information, billing data, call detail records, credentials, email servers, geo-location of users, and more."

And note this:

The affected carriers. were in Europe, Africa, the Middle East and Asia. None were thought to be in the United States.

So for what it's worth, the U.S. has somehow escaped this one, for now.

More. Wired.com says this about it. A Likely Chinese Hacker Crew Targeted 10 Phone Carriers to Steal Metadata:

Cybereason says that the company found no evidence that the hackers stole the actual content of communications from victims, but the firm's principal security researcher, Amit Serper, argues that the metadata alone—device and SIM identifiers, call records, and which cell tower a phone connected to at any given time—can provide a frighteningly high-resolution picture of a target's life. "That metadata is sometimes more important than the contents of what you're saying," says Serper, who previously worked in Israeli intelligence. "It allows an intelligence service to build a whole picture of you: who you’re talking to, who are your peers and coworkers, when do you wake up and go to bed, where you work, what your route to work looks like. These are valuable pieces of information."

It wasn't so awfully long ago* that Americans were outraged at the NSA for collecting our metadata. But it seems as though the information is out there for the taking by anyone with the skill set.

*Oops. They did it again. NSA Improperly Collected U.S. Phone Records a Second Time.

------
1:09 PM 6/26/2019

War between U.S. and Iran has moved to the cyber front

President Trump opted out of a missile strike on an Iranian facility, but the front line in this skirmish has shifted to the Cyber arena.

AP sources: US struck Iranian military computers this week:

The cyberattacks — a contingency plan developed over weeks amid escalating tensions — disabled Iranian computer systems that controlled its rocket and missile launchers, the officials said. Two of the officials said the attacks, which specifically targeted Iran’s Islamic Revolutionary Guard Corps computer system, were provided as options after Iranian forces blew up two oil tankers earlier this month.

But there's this:

There was no immediate reaction Sunday morning in Iran to the U.S. claims. Iran has hardened and disconnected much of its infrastructure from the internet after the Stuxnet computer virus, widely believed to be a joint U.S.-Israeli creation, disrupted thousands of Iranian centrifuges in the late 2000s.

Let's hope our own systems have been hardened and disconnected from the internet, too. Because: Iranian Hackers Launch a New US-Targeted Campaign as Tensions Mount:

Analysts at two security firms, Crowdstrike and Dragos, tell WIRED that they've seen a new campaign of targeted phishing emails sent to a variety of US targets last week from a hacker group known by the names APT33, Magnallium, or Refined Kitten and widely believed to be working in the service of the Iranian government. Dragos named the Department of Energy and US national labs as some of the half-dozen targeted organizations. A third security firm, FireEye, independently confirmed that it's seen a broad Iranian phishing campaign targeting both government agencies and private sector companies in the US and Europe, without naming APT33 specifically. None of the companies had any knowledge of successful intrusions.

Finally, the Dunce of the Month award -- cyber category -- has to go to that municipal employee who downloaded ransomware at a municipal office that will ultimately cost the taxpayers of Riviera Beach, Florida, $600,000.

------
11:55 AM 6/23/2019

Another data hack of gov agency

This time it was the U.S. Customs and Border Protection which reported to Techcrunch.com about a recent breach. See CBP says traveler photos and license plate images stolen in data breach:

“CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network,” said an agency statement. ...

A spokesperson for the agency later said the security incident affected “fewer than 100,000 people” through a “few specific lanes at a single land border” over a period of a month and a half.

So it was only 100,000, huh? That seems small when compared with the OPM hack of a few years ago wherein records of as many as four million people were taken.

So what happens to all that data? It's tempting to envision some super villain compiling dossiers on every American for some evil scheme that would result in a compromised government. Or maybe it's not a super villain but a rival nation with the goal of ultimately defeating the wicked West.

Anyway, it seems that nothing in a computer is secret anymore.

------
4:27 PM 6/21/2019

Cyber threat watchdog finds js-sniffer hack which sniffed out thousands of customer info from online rertailers

The news release can be found at Group-IB: payment data of thousands of customers of UK and US online stores could have been compromised. Here's an excerpt:

Group-IB’s Threat Intelligence team first discovered GMO on the FILA UK website. The malicious code was detected in early March 2019. In the course of further research it was revealed that GMO JS Sniffer has presumably been collecting customer payment data since November 2018. According to Alexa.com, the number of fila.co[.]uk unique monthly visitors is estimated at around 140k per month.

Just the other day we were advised of this: Report: Navy is under ‘cyber siege,’ national secrets leaking from the hull.

Can a reasonable person assume that anything can be hacked?

------

3:10 PM 3/15/2019

EDGAR hacked -- nothing online is safe

Is anything online safe anymore? It seems not.

Even the SEC's EDGAR go hacked, and two Ukrainian miscreants made millions from trades made with purloined information. The PDF Indictment alleges that the two used directory traversal attacks and phishing attacks to obtain access to "test filings" prior to the actual release of company financial information to the public. By getting this head start they would anticipate how the market would move the stock price once the information was made public then make trades relying on the advance information. Source: Two charged with hacking company filings out of SEC’s EDGAR system.

This passage from the Indictment describes the phishing expedition:

7. It was further part of the conspiracy that the defendants and others employed phishing attacks to send malicious emails to SEC employees that were made to falsely appear as though they originated from actual SEC employees. As a result of the co-conspirators' phishing attacks, which misrepresented their identities, the co-conspirators successfully infected a number of SEC computers with malware. Once these computers were infected, the co-conspirators used them to probe the SEC's network and to steal information to use in their ongoing efforts to gain unauthorized access to Test Filings.

The two Ukrainians are currently on the lam.

But the lesson here is that practically anything online can get hacked.

------

1:54 PM 1/18/2019

Phishing attempts should be easy to dodge yet they are the most common means of attack

Lisa Vaas at NakedSecurity: Phishing is still the most commonly used attack on organizations, survey says. According to Ms. Vaas, survey respondents reported this:

These are the most common outsider attack vectors that lead to cybersecurity breaches:

1. Phishing – 53%
2. Malware – 50%
3. Spyware – 45%

The total exceeds 100, so there has to be some overlap. In any event, it would seem to be easy to avoid phishing attacks. Nonetheless, plenty of people must fall for them. So the phishers must be pretty good at deceiving their victims.

------

4:29 PM 10/24/2018

Scary forecasts of cyberattacks

Dave Lawler and Jonathan Swan of Axios.com provide a concise roundup of chilling cyberattack forecasts in Special report: America’s greatest threat is a hurricane-force cyberattack. Bullet points:

Gen. David Petraeus, former CIA director: “What worries me most is a cyber equivalent of a weapon of mass destruction falling into the hands of extremists who would, needless to say, be very difficult to deter, given their willingness to blow themselves up on the battlefield to take us with them.”

Former CIA Director Leon Panetta says the biggest threat is "a cyberattack that could paralyze the nation," while former Homeland Security Secretary Michael Chertoff says "cyberattacks on critical infrastructure from state or state-sponsored actors are the biggest threat right now.”

“The steady drumbeat of breaches in the headlines — each more fantastic than the next — may have numbed people, but everyone should care about the cyber threat," explains Lisa Monaco, homeland security adviser to Barack Obama. "First, we are all vulnerable. Second, it won’t take a cyber 9/11 to make this very real.”

“There will be tremendous media coverage and assigning of blame after there is a catastrophic attack on U.S. critical infrastructure that results in the loss of American lives,” says Frances Townsend, homeland security adviser to George W. Bush, “but we need to spend more time now covering what is at stake and the magnitude of the growing risk.”

"Companies in the energy, financial, and other key economic sectors need to develop the capacity to share threat information in real time, and give the government the visibility and information to take action when necessary to defend us," says Matt Olsen, former director of the National Counterterrorism Center.

Frances Townsend's remark about media coverage of a catastrophic attack implies she thinks the media outlets will be spared. Interesting. Our enemies have known at least since the 1960s that the best way to defeat the U.S. is through media influence and manipulation. So she might be onto something.

In any event, it would serve the public well if those companies that rely on internet connects, and those that don't, toughen up their protections. And it goes without saying that the power grid operators should have done this already.

------

10:41 AM 8/7/2018

How long before self driving car gets hacked?

As we hear more and more about self driving vehicles it's tempting to get complacent and dream of the possibilities.

But it doesn't take a pessimist to imagine one negative aspect -- the possibility of remote hacking. We've already heard of vehicles being hijacked by laptop, i.e., locks and brakes disengaged without the owners' approval.

Making some computer device unhackable is probably impossible. The process can be slowed, but the risk can't be eliminated.

According to Reuters, a meeting was held in March in which Transportation Department officials met with interested individuals to compile information about self-driving vehicles in which law enforcement representatives wanted the ability to take over such a vehicle. That would be a lot safer than what they can do now to a moving vehicle.

But if law enforcement could take over an autonomous vehicle, it follows that hackers could eventually do it, too.

------

1:26 PM 7/27/2018

Foldering -- spy tactic now widely known

The spy trick of creating an email account, writing text in an email, then saving it to the draft folder to be opened by another spy has been around a while. But now it has a name. "Foldering." Here's the Wall Street Journal with ‘Foldering’: In the Manafort Case, an Old Spy Trick Enters the Digital Age. Excerpt:

While digital dead-dropping has been reported to be a favored tactic in terrorist cells (as depicted on screen in the 2008 spy thriller “Traitor”), the most famous example prior to Mr. Manafort came to light in 2012, when F.B.I. agents uncovered secret messages shared between David Petraeus, then the Director of the Central Intelligence Agency, and his biographer Paula Broadwell. As The Wall Street Journal reported at the time, Mr. Petraeus and Ms. Broadwell were discovered to be using “the draft-email trick.”

The introduction of a single word, “foldering,” to label this practice is handy shorthand. Whether the technique will offer refuge from the digital police is another question.

Alternate link.

I would have called it a "Draft Dodge." That could cause some confusion, but isn't that one of a spy's objectives?

------

3:21 PM 6/26/2018

Some websites record your key strokes -- including passwords -- during your entire web session

If you supply personal information on a website, you should expect that the owners of the website would get that information. But according to recent reports, some websites can record your key strokes during your entire browsing session. Here's one report about the issue: No, you’re not being paranoid. Sites really are watching your every move:

Session replay scripts are provided by third-party analytics services that are designed to help site operators better understand how visitors interact with their Web properties and identify specific pages that are confusing or broken. As their name implies, the scripts allow the operators to re-enact individual browsing sessions. Each click, input, and scroll can be recorded and later played back.

A study published last week reported that 482 of the 50,000 most trafficked websites employ such scripts, usually with no clear disclosure. It's not always easy to detect sites that employ such scripts. The actual number is almost certainly much higher, particularly among sites outside the top 50,000 that were studied.

"Collection of page content by third-party replay scripts may cause sensitive information, such as medical conditions, credit card details, and other personal information displayed on a page, to leak to the third-party as part of the recording," Steven Englehardt, a PhD candidate at Princeton University, wrote. "This may expose users to identity theft, online scams, and other unwanted behavior. The same is true for the collection of user inputs during checkout and registration processes."

Here's another one: No boundaries: Exfiltration of personal data by session-replay scripts.

There doesn't appear to be a way the site visitor can prevent it from happening. But as precaution a site visitor could open the browser only for that page in which he/she expects to supply a password or other personal info, then close it once the business is concluded.

------

2:06 PM 12/13/2017

Would you let a delivery person enter you're house when you're not home?

This product is a little too far ahead of its time. Amazon Key is a new service that lets couriers unlock your front door. Excerpt:

When a courier arrives with a package for in-home delivery, they scan the barcode, sending a request to Amazon’s cloud. If everything checks out, the cloud grants permission by sending a message back to the camera, which starts recording. The courier then gets a prompt on their app, swipes the screen, and voilà, your door unlocks. They drop off the package, relock the door with another swipe, and are on their way. The customer will get a notification that their delivery has arrived, along with a short video showing the drop-off to confirm everything was done properly.

Oh boy. Never mind that the home owners will be allowing a strangers access to the house, they've also got a door lock connected to the internet which is an issue just as big. Hardly a week goes by during which we don't hear about some major hack of a database. Just the other day Sophos disclosed an exploitable weakness in Microsoft Office. See Microsoft Office DDE zero-day: are you protected?.

Never forget that deception is always one step ahead of detection and that all devices connected to the internet are vulnerable.

------

3:32 PM 10/25/2017