Arms Race, Cyber Defenses Fail

By: Damian Paletta, Danny Yadron and Jennifer Valentino-DeVries
Countries toiled for years and spent billions of dollars to build elaborate facilities that would allow them to join the exclusive club of nations that possessed nuclear weapons.
Getting into the cyberweapon club is easier, cheaper and available to almost anyone with cash and a computer.
A series of successful computer attacks carried out by the U.S. and others has kicked off a frantic and destabilizing digital arms race, with dozens of countries amassing stockpiles of malicious code. The programs range from the most elementary, such as typo-ridden emails asking for a password, to software that takes orders from a rotating list of Twitter handles.
The proliferation of these weapons has spread so widely that the U.S. and China-longtime cyber adversaries-brokered a limited agreement last month not to conduct certain types of cyberattacks against each other, such as intrusions that steal corporate information and then pass it along to domestic companies. Cyberattacks that steal government secrets, however, remain fair game.
This comes after other countries have begun to amass cyberweaponry on an unprecedented scale. Pakistan and India, two nuclear-armed rivals, regularly hack each other’s companies and governments, security researchers said. Estonia and Belarus are racing to build defensive shields to counter Russia. Denmark and the Netherlands have begun programs to develop offensive computer weapons, as have Argentina and France.
In total, at least 29 countries have formal military or intelligence units dedicated to offensive hacking efforts, according to a Wall Street Journal compilation of government records and interviews with U.S. and foreign officials. Some 50 countries have bought off-the-shelf hacking software that can be used for domestic and international surveillance. The U.S. has among the most-advanced operations.
In the nuclear arms race, “the acronym was MAD-mutually assured destruction-which kept everything nice and tidy,” said Matthijs Veenendaal, a researcher at the NATO Cooperative Cyber Defence Centre of Excellence, a research group in Estonia. “Here you have the same acronym, but it’s ‘mutually assured doubt,’ because you can never be sure what the attack will be.”
Governments have used computer attacks to mine and steal information, erase computers, disable bank networks and-in one extreme case-destroy nuclear centrifuges.
Nation states have also looked into using cyberweapons to knock out electrical grids, disable domestic airline networks, jam Internet connectivity, erase money from bank accounts and confuse radar systems, experts believe.
Large conventional militaries and nuclear forces are ill-suited to this new kind of warfare, which evens the playing field between big and small countries. Cyberattacks are hard to stop and sometimes impossible to trace. The West, as a result, has been forced to start reconfiguring its militaries to better meet the threat.
Access to cyberweapons, according to U.S. and foreign officials and security researchers, is far more widespread than access to nuclear weapons was at the height of the nuclear arms race, a result of inexpensive technology and the power of distributed computing.
More than two dozen countries have accumulated advanced cyberweapons in the past decade. Some Defense Department officials compare the current moment to the lull between the World Wars when militaries realized the potential of armed planes.
“It’s not like developing an air force,” in terms of cost and expertise, said Michael Schmitt, a professor at the U.S. Naval War College and part of an international group studying how international law relates to cyberwarfare. “You don’t need to have your own cyberforce to have a very robust and very scary offensive capability.”
For example, hackers aligned with the Syrian government have spied into the computers of rebel militias, stolen tactical information and then used the stolen intelligence in the ongoing and bloody battle, according to several researchers, including FireEye Inc.
Most cyberattacks linked to the U.S. and foreign governments in recent years involve cyberspying-breaking into a computer network and stealing data. More-aggressive covert weapons go further, either erasing computer records or destroying physical property.
“With some countries, we’re comfortable with knowing what their capabilities are, but with other countries we’re still lost,” said Andre McGregor, a former cyber special agent at the Federal Bureau of Investigation and now the director of security at Tanium Inc., a Silicon Valley cybersecurity startup. “We don’t have the visibility into their toolset.”
The Military Balance, a widely read annual assessment of global military powers published by the International Institute for Strategic Studies in London, tallies tanks, battalions and aircraft carriers. When it comes to national cyberforces it says “capabilities are not assessed quantitatively.”
In the U.S., the National Security Agency, Central Intelligence Agency, FBI and others all play roles in combing through intelligence.
U.S. officials say their biggest concerns are the cyberweapons held by the Chinese, Russians, Iranians and North Koreans, countries that have deployed advanced attacks that either dug inside U.S. government networks or targeted top U.S. companies. Even Israel, a U.S. ally, was linked to hacking tools found on the computers of European hotels used for America’s diplomatic talks with Iran, according to the analysis of the spyware by a top cybersecurity firm. Israeli officials have denied spying on the U.S.
Cyberarmies tend to be integrated with a country’s military, its intelligence services, or both, as is the case in China and the U.S.
In China, hackers are famous for the relatively low-tech tactic of “phishing”-sending a flood of disguised emails to trick corporate employees and government bureaucrats to letting them into their networks.
The U.S. suspects that is how they penetrated the Office of Personnel Management, using a phishing email to breach an OPM contractor and then crack the agency’s network. The records of more than 21 million people were exposed in the 2014 and 2015 data breach, disclosed this summer. China has said it wasn’t involved.
China’s army has divisions devoted to cyberattacks, and recent evidence shows links between the country’s military and hackers who appear to be pressing the country’s interests abroad.
“They used to be snap and grab-get in and dump everything they can,” said Tommy Stiansen, co-founder and chief technology officer at Norse Corp., a California cybersecurity firm that tracks nation-state activity. “Now they trickle out the information, stay hidden in the system. We’ve even seen Chinese actors patch and repair networks once they’ve broken in.”
China opposes the militarization of cyberspace or a cyberarms race, said Zhu Haiquan, a spokesman for the Chinese Embassy in Washington, adding China “firmly opposes and combats all forms of cyberattacks in accordance with law.”
Choosy in targets
Russian hackers have targeted diplomatic and political data, burrowing inside unclassified networks at the Pentagon, State Department and White House, also using emails laced with malware, according to security researchers and U.S. officials.
They have stolen President Barack Obama‘s daily schedule and diplomatic correspondence sent across the State Department’s unclassified network, according to people briefed on the investigation. A Russian government spokesman in April denied Russia’s involvement.
“Russia has never waged cyberwarfare against anyone,” Andrey Akulchev, a spokesman for the Russian Embassy in Washington, said in a written statement Friday. “Russia believes that the cybersphere should be used exclusively for peaceful purposes.”
Russia’s top hackers tend to be choosier in their targets, tailoring email attacks to those they believe might unwittingly open links or attachments.
“They are sitting there trying to think through ‘how do I really want to compromise this target?’ ” said Laura Galante, director of threat intelligence at FireEye, a Silicon Valley cybersecurity company that works closely with Washington. “The Chinese just want a foothold into the target. Russian theft is very personal.”
U.S. spies and security researchers say Russia is particularly skilled at developing hacking tools. Some malicious software linked to Russia by security researchers has a feature meant to help it target computers on classified government networks usually not connected to the Internet.
The virus does this by jumping onto USB thumb drives connected to targeted computers, in the hopes that the user-such as U.S. military personnel-will then plug that USB drive into a computer on the classified network.
Russian hackers also make efforts to hide stolen data in normal network traffic. In one example, a piece of malware hides its communications in consumer Web services to fool cybersecurity defenses. The code downloads its instructions from a set of Twitter accounts. It then exports data to commercial storage services. This tactic is effective because corporate cybersecurity systems often don’t block traffic to and from these sites.
Government investigators believe Iranian hackers implanted the Shamoon virus on computers at Saudi Arabia’s Saudi Aramco, the world’s largest energy firm, in 2012. The Aramco attack erased 75% of the company’s computers and replaced screen images with burning American flags. The attack didn’t affect oil production, but it rattled the company, and security officials, as it revealed the extent of Iran’s cybercapabilities. A spokesman for Aramco didn’t respond to a request for comment.
The move was at least partly in retaliation for the alleged U.S.-Israeli attack on Iran discovered in 2010 that deployed the Stuxnet computer worm to destroy Iranian nuclear centrifuges-considered to be the most successful and advanced cyberattack ever. The U.S. and Israel haven’t confirmed or denied involvement with Stuxnet.
Director of National Intelligence James R. Clapper has said that Iran used malware to destroy computers last year at Las Vegas Sands Corp., a casino company run by Sheldon Adelson, a major critic of the Iranian government. A Sands spokesman declined to comment.
Adm. Michael Rogers, center, director of the National Security Agency and commander of the U.S. Cyber Command, confers with Deputy Defense Secretary Robert Work ahead of testifying before the Senate Armed Services Committee in September. Photo: Win McNamee/Getty Images
Defense officials have also said Iranian hackers have temporarily overwhelmed the websites of numerous U.S. banks, in an annoying but relatively pedestrian technique known as a “denial of service” attack. The attack was allegedly in response to a YouTube video depicting the Prophet Muhammad. Some U.S. officials suspected it was retaliation for sanctions and the Stuxnet attack.
In 2012, Iran’s Supreme Leader Ayatollah Ali Khamenei publicly announced the creation of the Supreme Council of Cyberspace charged to oversee the defense of Iran’s computer networks and develop “new ways of infiltrating or attacking the computer networks of its enemies.”
National Security Agency Director Adm. Michael Rogers said Iranian cyberattacks have slowed since nuclear talks intensified last year, but that Tehran appears “fully committed” to using cyberattacks as part of its national strategy.
A spokesman for the Iranian government didn’t respond to request for comment.
Sony hack
U.S. officials accused North Korea of destroying computer files and records at Sony Corp.’s Hollywood film unit in 2014, allegedly in retaliation for “The Interview,” a satirical movie about assassins of North Korean leader Kim Jong Un. The breach was considered one of the most successful nation-state attacks. North Korea successfully implanted malware on Sony computers, which allowed them to both steal and destroy company records, the FBI alleged.
South Korea has also accused North Korea of trying to hack a nuclear reactor, television networks and at least one bank.
“Cybercapability, especially offensive cybercapability, is a relatively inexpensive method that a country can exploit to ‘hit above its weight class,’ which North Korea is fully aware of and is attempting to leverage,” said Steve Sin, a former U.S. Army counterintelligence officer who now researches unconventional weapons and technology.
Defense contractor Northrop Grumman Corp., meanwhile, has advertised for a “cyber operations planner” to “facilitate” offensive computer attacks with the South Korean and U.S. governments, according to a job posting it listed online.
A Northrop spokesman said the customer determines the scope of work performed.
A spokesman for North Korea couldn’t be reached for comment. The country hasn’t commented publicly on cyberprograms.
Many cybersecurity experts, however, consider the U.S. government to have the most advanced operations. When Kaspersky Lab ZAO, a Russian cybersecurity company, this year released a report on a group it called the Equation Group-which U.S. officials confirmed was a thinly veiled reference to the NSA-it referred to the operatives as the “crown creator of cyberespionage.”
Former National Security Agency contractor Edward Snowden leaked documents that showed the NSA had implanted malware on tens of thousands of foreign computers. That allowed the U.S. government secret access to data and, potentially, the industrial control systems behind power plants and pipelines. The Pentagon’s U.S. Cyber Command didn’t respond to a request for comment.
In some instances, Kaspersky found, the NSA was able to burrow so deeply into computers that it infected the code that controls how a hard drive spins. So-called firmware isn’t scanned by computer defenses.
“We, too, practice cyberespionage, and, in a public forum, I’m not going to say how successful we are, but we’re not bad,” Mr. Clapper, the Director of National Intelligence, told a Senate panel in September.
U.S. Cyber Command now has nine “National Mission Teams” with plans to build four more. These each comprise 60 military personnel that will “conduct full-spectrum cyberspace operations to provide cyber options to senior policy makers in response to attacks against our nation,” a Pentagon spokesperson said.
The Navy, Army, and Air Force will each build four teams, with the Marines building a single unit. Each will have a “separate mission with a specific focus area,” though these have so far remained secret.
Air Force Chief of Staff Gen. Mark A. Welsh III told a group of reporters in April that he wanted to see the military develop “blunt force trauma” powers with their cyberweapons. He gave examples of computer codes that could “make an enemy air defense system go completely blank” or have an enemy’s “radar show a thousand false targets that all look real.” He didn’t say the military had finished designing such powers.
Defense Secretary Ash Carter has made the development of new cyberweapons a priority, although the policy seems in flux after questions were raised by the Pentagon’s inspector general.
This activity has prompted other countries to join the digital buildup.
In 2014, the Netherlands announced it would begin training its own Internet troops through a domestic cybersecurity company, called Fox-IT. The head of the Dutch armed forces, Major Gen. Tom Middendorp, said in a symposium the group should be prepared to carry out attacks, not just block them, according to a Dutch media report. The Netherlands’ military strategy, laid out in various documents, refers to hacking as a “force multiplier.” A Dutch military spokesman confirmed the efforts but declined to make Gen. Middendorp available for an interview.
In 2013, Denmark’s Defense Ministry began allocating about $10 million a year for “computer network operations,” which include “defensive and offensive military operations,” according to government budget documents. That amount is just 0.24% of the Danish defense budget, reflecting the tiny barrier of entry.
Countries unable to develop their own weapons can buy off-the-shelf systems from private parties. Earlier this year, an attack and document leak on the Italian firm Hacking Team revealed the company had sold its surveillance tools to dozens of countries, including Sudan, Egypt, Ethiopia and Azerbaijan.
Hacking Team touted its product as “the hacking suite for governmental interception,” and computer security researchers who studied its program said it took advantage of holes in popular software to get onto opponents’ computers and mobile devices. The FBI is among the groups listed as clients of Hacking Team. An FBI spokesman said it didn’t comment on specific tools or techniques.
Most of these countries use surveillance software on domestic enemies or insurgent groups, according to officials with numerous countries and researchers.
States aren’t the only players. About 30 Arabic-fluent hackers in the Palestinian territories, Egypt and Turkey are building their own tools to hit targets in Egypt, Israel and the U.S., according to researchers at Kaspersky Lab.
And in August, the U.S. used a drone to kill Islamic State hacker Junaid Hussain in Raqqa, Syria, showing the extent to which digital warfare has upset the balance of power on the modern battlefield.
The British citizen had used inexpensive tools to hack more than 1,000 U.S. military personnel and published personal and financial details online for others to exploit. He helped sharpen the terror group’s defense against Western surveillance and built hacking tools to penetrate computer systems, according to people familiar with the matter.
National-security and cyberweapon experts are watching the growing digital arms stockpile nervously, worried that one-off attacks could eventually turn messier, particularly given how little is known about what each country is capable of doing.
“What we can do, we can expect done back to us,” said Howard Schmidt, who was the White House’s cybersecurity coordinator until 2012. The U.S. is thinking, “Yeah, I don’t want to pull that trigger because it’s going to be more than a single shot that goes off.”

How we get to World War III

(Videos courtesy of Popular Mechanics)

by Danielle Pletka, AEI: NATO’s SecGen Jens Stoltenberg today warned the Russians about their violation of Turkish airspace in ongoing Russian air operations over Syria. It was only the latest warning from NATO about Russian violations of various NATO nations’ airspace and assorted other antics. But today’s incursion — which prompted a nasty threat from Turkey about what would happen if the Russians make the same mistake again — only underscores what a dangerous place the world has become since Barack Obama became president.

History teaches us that large wars begin for many complex reasons, and that notwithstanding our obsession with poor old Archduke Ferdinand, it was probably not simply his shooting that spawned World War I. But… there are now so many global flashpoints that we cannot rule out the notion that a conflict between major powers could break out simply based on circumstance. Consider:

  • NATO aircraft scrambled more than 500 times in 2014, with only a few exceptions, in reaction to Russian incursions into NATO member airspace. Russians planes reportedly often switch off transponders and fail to file flight plans, which has resulted in several near misses, including with a passenger plane. (Not to speak of the Russian shoot down of the Malaysia Airlines passenger jet.)

  • In 2014, Japan scrambled aircraft almost 1000 times, with all but a few of these incidents attributed to either Russian or Chinese warplanes.
  • Russian bombers entered US airspace 10 times in 2014, double the previous average.
  • On July 4th, as Americans celebrated Independence Day, the US Air Force scrambled fighter jets to intercept two pairs of Russian bombers skirting US airspace off the coast of California and Alaska.
  • The United States is preparing, reportedly, a show of force with “freedom of navigation operations” in the South China Sea, a reaction to increasingly aggressive land reclamation/military construction in disputed territory.

  • On the eve of Chinese leader Xi Jinping’s recent visit to Washington, two Chinese fighters intercepted a US Air Force surveillance plane over the Yellow Sea.
  • The US is planning on stepping up air operations over Syria at the same time that Russia advances its own war on Assad’s opponents. Washington and Moscow aim to “deconflict” (whatever that means).
  • Russia is consistently violating its obligations under the Minsk Accords and continues to make claims on Ukrainian territory. Facing few consequences for his actions in Ukraine, there are fears that Putin may choose to move on NATO members Lithuania, Latvia or Estonia.

The world has always been a dangerous place, and the proliferation of nuclear weapons has only made it more so. But not since the Cold War have there been so many potential triggers for major power conflicts. Will we get into a shooting war? Perhaps not, and almost not certainly with the current Commander in Chief. But each time there is a near miss without consequence, as most are, bad actors are encouraged to believe there will never be any consequence. Still, notwithstanding Barack Obama, the United States does have red lines, treaty obligations (to the Philippines, to Japan, to NATO allies) that could force us into conflict where none was planned.

A Quick Preview of the Start of World War III

What Russia’s newest ICBM looks like when it takes off.

Popular Mechanics: The RS-24 was developed in secret by Russia, but public tests of the fifth-generation ICBM began in 2007 in response to a possible missile shield being built in Europe, and the Yars became operational in 2010. The RS-24 has been “MIRVed,” meaning it has multiple independently targetable reentry vehicles—in other words, each missile has multiple warheads that can hit multiple targets. Each of the RS-24’s four nuclear warheads has a yield of about 150 to 250 kilotons (the bombs dropped on Hiroshima and Nagasaki had yields of 15 and 21 kilotons, respectively).

The RS-24 is powered by solid-state fuel, meaning that it can be ready to be launched within minutes, and is built to accelerate extremely quickly, giving opposition forces little time to react to a launch. It also can deploy a series of anti-missile-defense measures to evade attempts to shoot it down. The Russian government reports it to have an effective range of 6,800 miles, traveling at top speeds of 15,220 miles per hour, or just a shade under Mach 20. It can be launched from a silo, as seen above, or from a mobile launch vehicle, meaning the Russian government can essentially tuck one of these away anywhere in the vast wilderness that makes up so much of its territory.

What makes the Yars perhaps even more unsettling is that it’s an upgrade to the Topol-M ICBM, a weapon that Tyler Rogorsky over at Foxtrot Alpha called “scary as hell.” The Topol-M was the first ICBM to be developed by Russia after the fall of the Soviet Union, and is now being phased out in favor of the RS-24.

The Yars and Topol-M, along with America’s own state-of-the-art ICBMs, the LGM-30G Minuteman-III and UGM-133 Trident II, are stark reminders that mutually assured destruction continues to define nuclear warfare, despite various nuclear arms treaties. It’s easier to add more warheads to an ICBM than to build a missile defense system that can effectively shoot down those additional warheads, meaning there isn’t much either side can hope to do once a nuclear power decides to launch—except fling off their own set of ICBMs and irradiate the other side of the globe as well.

Obama did not Invite FBI Director to Seminar

Place this story and decision into the WTH file.

F.B.I. Chief Not Invited to Meeting on Countering Violent Extremism

NYT > WASHINGTON — The White House did not invite the most senior American official charged with preventing terrorist attacks — the F.B.I. director, James B. Comey — to the three-day conference this week on countering violent extremism in the United States and abroad because the administration did not want the event too focused on law enforcement issues, according to senior American officials.
But Mr. Comey’s Russian counterpart — Aleksandr V. Bortnikov, the director of the Russian Federal Security Service, the post-Soviet K.G.B. — was at the meeting, even though international human rights groups have repeatedly accused the Russian security service of unjustly detaining and spying on Russians and others.

The service also declined to provide American counterterrorism and intelligence officials with information before the 2013 Boston Marathon bombings that would probably have led to more scrutiny of one of the suspects.

Several other foreign law enforcement officials attended the conference, which was held in Washington. The meeting has been criticized as ineffectual and irrelevant, and not focused on immediate and tangible solutions to stop terrorists. And some Republicans said that President Obama’s speech to the assembled leaders on Wednesday did not lay out a strategy for defeating groups like the Islamic State.
The omission of Mr. Comey adds further uncertainty over who in the government is in charge of the anti-extremist effort. Just a few months ago, the F.B.I. put out a lengthy bulletin on its website about how it was leading “a new approach to countering violent extremism.” Many of the strategies listed by the F.B.I. appear similar to ones mentioned at the meeting.

An Obama administration official defended the decision not to invite Mr. Comey, saying that “while the F.B.I. works tirelessly to keep the country safe, this conference was not centered on federal law enforcement.”
The official said that the administration’s efforts to counter violent extremists “are premised on the notion that local officials and communities can be an effective bulwark against violent extremism, and most of the participants — spanning community leaders, local, law enforcement, private sector innovators, and others — reflected this bottom-up approach.” A spokesman for the F.B.I. declined to comment.
Mr. Comey’s boss, Attorney General Eric H. Holder Jr., attended the conference, and several F.B.I. officials participated in its panels, the official said.
The administration did not specifically invite Mr. Bortnikov, the official said. Instead, it had sent a general invitation to the Russian government, which chose Mr. Bortnikov, along with others, to come to Washington.
The administration did not try to prevent Mr. Bortnikov, who rarely visits the United States, from attending, said the official, who did not want to be identified discussing internal White House deliberations. Mr. Bortnikov is on the European Union sanctions list in response to the crisis in Ukraine, but he is not subject to American sanctions.
The programs intended to prevent Americans from becoming extremists are led by the Department of Justice and the Department of Homeland Security.
The Obama administration said in a news release on Wednesday that the effort to counter violent extremism “encompasses the preventive aspects of counterterrorism as well as interventions to undermine the attraction of extremist movements and ideologies that seek to promote violence.”
Stopping terrorist attacks has been the F.B.I.’s highest priority since the Sept. 11, 2001, attacks. The bureau oversees joint terrorism task forces in every major American city that bring together federal, state and local authorities to investigate terrorism.


This is not the first little confab concocted by Barack Obama. Back in February of 2015, Obama had the same session calling on 60 nations. Progress? Not so much.

WASHINGTON — President Obama called on Americans and more than 60 nations on Wednesday to join the fight against violent extremism, saying they had to counter the ideology of the Islamic State and other groups making increasingly sophisticated appeals to young people around the world.
On the second day of a three-day meeting that comes after a wave of terrorist attacks in Paris, Sydney, Copenhagen and Ottawa, Mr. Obama said undercutting the Sunni militant group’s message and blunting its dark appeal was a “generational challenge” that would require cooperation from mainstream Muslims as well as governments, communities, religious leaders and educators. “We have to confront squarely and honestly the twisted ideologies that these terrorist groups use to incite people to violence,” Mr. Obama told an auditorium full of community activists, religious leaders and law enforcement officials — some of them skeptical about his message — gathered at the Eisenhower Executive Office Building next door to the White House. “We need to find new ways to amplify the voices of peace and tolerance and inclusion, and we especially need to do it online.”

Obama vs. China President Xi, Hacking

A new unit of the People’s Liberation Army was identified last week by cyber security researchers as Unit 78020 based in Kunming, in Yunnan Province.
The unit’s operations have been tracked for five years and have included targeted attacks on states in the region that are challenging Beijing’s strategic program of seeking to control the sea through building up small islands and reefs and then deploying military forces on them.
“Unit 78020 conducts cyber espionage against Southeast Asian military, diplomatic, and economic targets,” according to a security report on the unit that included a satellite photo of the unit’s Kunming compound.
“The targets include government entities in Cambodia, Indonesia, Laos, Malaysia, Myanmar, Nepal, the Philippines, Singapore, Thailand, and Vietnam as well as international bodies such as United Nations Development Program (UNDP) and the Association of Southeast Asian Nations (ASEAN).” More details here.

Chinese president Xi Jinping is supposed to have dinner this evening with U.S. president Barack Obama. Wonder if the name Ge Xing will come up?Ge Xing is the subject of a joint report published this morning by ThreatConnect and Defense Group Inc., computer and national security service providers respectively. Ge is alleged to be a member of the People’s Liberation Army unit 78020, a state-sponsored hacking team whose mission is to collect intelligence from political and military sources to advance China’s interests in the South China Sea, a key strategic and economic region in Asia with plenty of ties to the U.S.

The report connects PLA 78020 to the Naikon advanced persistent threat group, a state-sponsored outfit that has followed the APT playbook to the letter to infiltrate and steal sensitive data and intellectual property from military, diplomatic and enterprise targets in a number of Asian countries, as well as the United Nations Development Programme and the Association of Southeast Asian Nations (ASEAN).

Control over the South China Sea is a focal point for China; through this region flows trillions of dollars of commerce and China has not been shy about claiming its share of the territory. The report states that China uses its offensive hacking capabilities to gather intelligence on adversaries’ military and diplomatic intentions in the regions, and has leveraged the information to strengthen its position.“The South China Sea is seen as a key geopolitical area for China,” said Dan Alderman, deputy director of DGI. “With Naikon, we see their activity as a big element of a larger emphasis on the region and the Technical Reconnaissance Bureau fitting into a multisector effort to influence that region.”The report is just the latest chess piece hovering over Jinping’s U.S. visit this week, which began in earnest yesterday with a visit to Seattle and meetings with giant technology firms such as Microsoft, Apple and Google, among others.

Those companies want to tap into the growing Chinese technology market and the government there is using its leverage to get them to support stringent Internet controls imposed by the Chinese government. A letter sent to American technology companies this summer, a New York Times report last week, said that China would ask American firms to store Chinese user data in China. China also reportedly asked U.S.-built software and devices sold in China to be “secure and controllable,” which likely means the Chinese would want backdoor access to these products, or access to private encryption keys.Jinping, meanwhile, tried to distance himself from the fray when he said in a Wall Street Journal interview: “Cyber theft of commercial secrets and hacking attacks against government networks are both illegal; such acts are criminal offences and should be punished according to law and relevant international conventions.”Journal reporter Josh Chin connected with Ge Xing over the phone and Ge confirmed a number of the dots connected in the report before hanging up on the reporter and threatening to report him to the police.

While that never happened, the infrastructure connected to Ge and this slice of the Naikon APT group, was quickly shut down and taken offline. In May, researchers at Kaspersky Lab published a report on Naikon and documented five years of activity attributed to the APT group. It describes a high volume of geo-politically motivated attacks with a high rate of success infiltrating influential organizations in the region. The group uses advanced hacking tools, most of which were developed externally and include a full-featured backdoor and exploit builder.Like most APT groups, they craft tailored spear phishing messages to infiltrate organizations, in this case a Word or Office document carrying an exploit for CVE-2012-0158, a favorite target for APT groups. The vulnerability is a buffer overflow in the ActiveX controls of a Windows library, MSCOMCTL.OCX. The exploit installs a remote administration tool, or RAT, on the compromised machine that opens a backdoor through which stolen data is moved out and additional malware and instructions can be moved in.Chin’s article describes a similar attack initiated by Ge, who is portrayed not only as a soldier, but as an academic.

The researchers determined through a variety of avenues that Ge is an active member of the military, having published research as a member of the military, in addition to numerous postings to social media as an officer and via his access to secure locations believed to be headquarters to the PLA unit’s technical reconnaissance bureau.“Doing this kind of biopsy, if you will, of this threat through direct analysis of the technical and non-technical evidence allows us to paint a picture of the rest of this group’s activity,” said Rich Barger, CIO and cofounder of ThreatConnect. “We’ve had hundreds of hashes, hundreds of domains, and thousands of IPs [related to PLA unit 78020].

Only looking at this from a technical lens only gives you so much. When you bring in a regional, cultural and even language aspect to it, you can derive more context that gets folded over and over into the technical findings and continues to refine additional meaning that we can apply to the broader group itself.”The report also highlights a number of operational security mistakes Ge made to inadvertently give himself away, such as using the same handle within the group’s infrastructure, even embedding certain names in families of malware attributed to them. All of this combined with similar mistakes made across the command and control infrastructure and evidence pulled from posts on social media proved to be enough to tie Ge to the Naikon group and elite PLA unit that is making gains in the region.“If you look at where China is and how assertive they are in region, it might be a reflection of some of the gains and wins this group has made,” Barger said. “You don’t influence what they’re influencing in the region if you don’t have the intel support capabilities fueling that operational machine.”


Hotel Chains Credit Cards Hacked

Not the first case for hotel chains not protecting guest records.

FromHotelManagement: A U.S. appeals court said the Federal Trade Commission has authority to regulate corporate cyber security, and may pursue a lawsuit accusing hotel operator Wyndham Worldwide Corp of failing to properly safeguard consumers’ information.

The 3-0 decision by the 3rd U.S. Circuit Court of Appeals in Philadelphia on Monday upheld an April 2014 lower court ruling allowing the case to go forward. The FTC wants to hold Wyndham accountable for three breaches in 2008 and 2009 in which hackers broke into its computer system and stole credit card and other details from more than 619,000 consumers, leading to over $10.6 million in fraudulent charges.

The FTC originally sued Wyndham in 2012 over the lack of security that led to its massive hack. But before the case proceeded, Wyndham appealed to a higher court to dismiss it, arguing that the FTC didn’t have the authority to punish the hotel chain for its breach. The third circuit court’s new decision spells out that Wyndham’s breach is exactly the sort of “unfair or deceptive business practice” the FTC is empowered to stop, reports Wired.

BusinessInsider: In August, Visa alerted numerous financial institutions of a breach. Five different banks determined the commonality between the cards included in that alert was that they were used at Hilton properties — including Embassy Suites, Doubletree, Hampton Inn and Suites, and the upscale Waldorf Astoria Hotels & Resorts, Krebs reports.

Hilton Hotels investigates customer credit card security hack

FNC: Hilton Hotels announced that it is looking into a possible security breach that occurred at gift shops, restaurants, bars, and other stores located on Hilton owned properties across the U.S.

According to cyber-security expert Brian Krebs, Visa sent confidential alerts to several financial institutions warning of a security breach at various retail locations earlier this year from April 21 to July 27. While the alerts named individual card numbers that had allegedly been compromised, per Visa’s policy, the notifications did not name the breached retail location. But sources at five different banks have now determined that the hacks all had one thing in common–they occurred at Hilton property point-of-sale registers.

Currently, the breach does not appear to have comprised the guest reservation systems at the associated properties. The company released the following statement regarding the incident:

“Hilton Worldwide is strongly committed to protecting our customers’ credit card information. We have many systems in place and work with some of the top experts in the field to address data security.  Unfortunately the possibility of fraudulent credit card activity is all too common for every company in today’s marketplace.  We take any potential issue very seriously, and we are looking into this matter.”

The breach includes other Hilton brand name properties including Embassy Suites, Doubletree, Hampton Inn and Suites, and Waldorf Astoria Hotels & Resorts. The hotel group is advising customers who may have made purchases at Hilton properties during the time indicated to carefully scan bank records for any unusual activity and contact their bank immediately.

According to USA Today, evidence from the investigation indicates that the hack may have affected credit card transactions as far back as Nov. 2014 and security breaches could possibly be ongoing.