Category Archives: Cyber War

China Used ‘Mass Surveillance’ on Thousands of Americans’ Phones

Posted on by

Is the Caribbean Smartphone Market Closer to Asia than America? - Droid Island

Newsweek reports: A mobile security expert has accused China of exploiting cellphone networks in the Caribbean to conduct “mass surveillance” on Americans.

China Regional Snapshot: The Caribbean - Committee on Foreign Affairs

Gary Miller, a former vice president of network security at California-based analytics company Mobileum, told The Guardian he had amassed evidence of espionage conducted via “decades-old vulnerabilities” in the global telecommunications system.

While not explicitly mentioned in the report, the claims appear to be centered around Signaling System 7 (SS7), a communications protocol that routes calls and data around the world and has long been known to have inherent security weaknesses.

According to Miller, his analysis of “signals data” from the Caribbean has shown China was using a state-controlled mobile operator to “target, track, and intercept phone communications of U.S. phone subscribers,” The Guardian reported.

Miller claimed China appeared to exploit Caribbean operators to conduct surveillance on Americans as they were traveling, alleging that attacks on cell phones between 2018 to 2020 likely affected “tens of thousands” of U.S. mobile users in the region.

“Once you get into the tens of thousands, the attacks qualify as mass surveillance,” the mobile researcher said, noting the tactic is “primarily for intelligence collection and not necessarily targeting high-profile targets.” Miller continued: “It might be that there are locations of interest, and these occur primarily while people are abroad.”

A previous analysis paper covering 2018-2019, also titled Far From Home, contained a series of similar espionage claims about SS7, alleging that “mass surveillance attacks” in 2018 were most prevalent by China and Caribbean mobile networks. More here.

But hold on…. it does not stop there….we also have the Channel Islands…

Pin on Guernsey Island

Remarkable investigative details here.

The Bureau: Private intelligence companies are using phone networks based in the Channel Islands to enable surveillance operations to be carried out against people around the world, including British and US citizens, the Bureau of Investigative Journalism can reveal following a joint reporting project with the Guardian.

Leaked data, documents and interviews with industry insiders who have access to sensitive information suggest that systemic weaknesses in the global telecoms infrastructure, and a particular vulnerability in Jersey and Guernsey, are being exploited by corporate spy businesses.

These businesses take advantage of some of the ways mobile phone networks across the world interact in order to access private information on targets, such as location information or, in more sophisticated applications, the content of calls and messages or other highly sensitive data.

The spy companies see phone operators in the Channel Islands as an especially soft route into the UK, according to industry experts, who say the attacks emanating from the islands appear to be targeted at individuals rather than cases of “mass” surveillance. The Bureau understands that the targets of this surveillance have been spread across the globe, and included US citizens as well as people in Europe and Africa.

Ron Wyden, the Oregon senator and privacy advocate, described the use of foreign telecom assets to spy on people in the US as a national security threat.

“Access into US telephone networks is a privilege,” he said in response to the Bureau’s findings. “Foreign telecom regulators need to police their domestic industry – if they don’t, they risk their country being cut off from US roaming agreements.”

Markéta Gregorová, the European Parliament’s chief negotiator on trade legislation for surveillance technology, called for “immediate regulatory, financial and diplomatic costs on companies and rogue jurisdictions” that enabled these practices.

“Any commercial or governmental entity, foreign or domestic which enables the facilitation of warrantless cyber-attacks on European citizens deserves the full force of our justice system,” she told the Bureau.

Stop Using Zoom, Second Warning

Posted on by

The first warning came last March.

March: As remote work surges amid the coronavirus pandemic, the FBI issued a public bulletin Monday warning Zoom and other video teleconferencing services may not be as private, or as secure, as users may assume.

Use of Zoom and similar services has exploded in recent weeks as companies, schools, governments, and individuals increasingly turn to its teleconferencing as ways to keep businesses and classrooms afloat while sheltering in pace or working from home. However the shift also represents an opportunity for attackers, as white supremacists, hackers and other trolls barge into digital meetings, a phenomenon known as “Zoombombing.”

In Massachusetts, there have been several incidents, including an unintended participant joining a high school’s virtual classroom only to yell profanities and reveal personal information about the teacher, according to the FBI. Another unwelcome participant with swastika tattoos joined a separate Massachusetts school’s Zoom meeting, the FBI reports.

“The FBI has received multiple reports of conferences being disrupted by pornographic and/or hate images and threatening language,” the FBI cautioned. “As individuals continue the transition to online lessons and meetings, the FBI recommends exercising due diligence and caution in your cybersecurity efforts.”

It’s not just private businesses and children whose meetings could be Zoombombed. Privacy and security issues in conferencing software may also pose risks to national security, as world leaders convene Zoom meetings. In some cases, world leaders such as U.K. Prime Minister Boris Johnson have shared screenshots of their teleconferencing publicly only to reveal Zoom meeting IDs, raising concerns that sensitive information could be compromised. More here.

Stupidly, government officials at all levels are using Zoom including the Biden presidential team. How dangerous is that? Those officials are not reading the warnings or the news? Yeesh

 

Zoom Biden Rally

For more proof, again this month…

Justice Department/December 2020: China-Based Executive at U.S. Telecommunications Company Charged with Disrupting Video Meetings

It is not only the U.S. that is sounding the warnings. The Telegraph reports warnings that “opportunistic criminals” (a formulation that’s practically redundant), can be expected to use bogus invitations to sessions in their social engineering efforts.

Connecticut Teen Arrested for Allegedly 'Zoom Bombing ... source

A security executive with the video-tech giant Zoom worked with the Chinese government to terminate Americans’ accounts and disrupt video calls about the 1989 massacre of pro-democracy activists in Tiananmen Square, Justice Department prosecutors said Friday.

The case is a stunning blow for Zoom, one of the most popular new titans of American tech, which during the pandemic became one of the main ways people work, socialize and share ideas around the world. The California-based company is now worth more than $100 billion.

But the executive’s work with the Chinese government, as alleged by FBI agents in a criminal complaint unsealed Friday in a Brooklyn federal court, highlights the often-hidden threats of censorship on a forum promoted as a platform for free speech. It also raises questions about how Zoom is protecting users’ data from governments that seek to surveil and suppress people inside their borders and abroad.

Prosecutors said the China-based executive, Xinjiang Jin, worked as Zoom’s primary liaison with Chinese law enforcement and intelligence services, sharing user information and terminating video calls at the Chinese government’s request.

Jin monitored Zoom’s video system for discussions of political and religious topics deemed unacceptable by China’s ruling Communist Party, the complaint states, and he gave government officials the names, email addresses and other sensitive information of users, even those outside China.

Jin worked also to end at least four video meetings in May and June, including video memorial calls with U.S.-based dissidents who’d survived the crackdown by Chinese military forces that killed thousands of students and protesters. The Chinese government works to censor any acknowledgment of the massacre, including on social media outside China.

A Zoom spokesperson said in a statement Friday that the company has cooperated with the case and launched its own internal investigation. Jin, the company said, shared “a limited amount of individual user data with Chinese authorities,” as well as data on no more than 10 users based outside China. Jin was fired for violating company policies, the statement said, and other employees have been placed on administrative leave until the investigation is complete.

In an updated statement on Zoom’s website, the company said it “fell short” by terminating the meetings instead of only blocking access to participants in China, to abide by Chinese law. The company said it has reinstated the victims’ accounts and will no longer allow requests from the Chinese government to affect users outside mainland China.

“As the DOJ makes clear, every American company, including Zoom and our industry peers, faces challenges when doing business in China,” the company said in its statement. “We will continue to act aggressively to anticipate and combat ever-evolving data security challenges.”

Jin could not be reached for comment. Though Jin lives in China and is not in U.S. custody, officials said he could be transferred to the United States to face prosecution if he travels to a country that has an extradition treaty with the U.S.

A spokesperson for the Chinese embassy in Washington did not respond to requests for comment.

Human-rights activists this summer said their Zoom accounts had been abruptly terminated shortly before or after they’d hosted video calls commemorating the 31st anniversary of the Tiananmen Square protests, a bloody crackdown captured in the iconic photo of a man standing in front of a Chinese tank.

Zoom said in a statement then that the company “must comply with laws in the countries where we operate.” While the company said it regretted “that a few recent meetings with participants both inside and outside of China were negatively impacted,” the statement said it was not in the company’s power “to change the laws of governments opposed to free speech.”

Zhou Fengsuo, a student leader during the Tiananmen Square protests who had his paid Zoom account terminated this summer, told The Washington Post on Friday that he had worked with the FBI on the case and saw the charges as “tremendous news.”

“It’s so eye-opening to me how this U.S. company, having this connection, would report directly to” the Chinese Communist Party and “disrupt our meetings regularly on behalf of the CCP,” he said. “This executive was working for the government and police as an agent of persecution, and Zoom was paying this guy for doing that job.”

Prosecutors charged Jin, also known as Julien Jin, with conspiracy to commit interstate harassment and to transfer a means of identification. Jin, 39, had worked at the company since 2016, most recently as a “Security Technical Leader,” the complaint said.

Quoting from electronic messages between Jin and other Zoom employees, FBI agents outlined a months-long, high-pressure campaign by China’s “Internet Police” to view users’ video calls and suppress unwanted speech. In one April message, Jin said he had been summoned to a meeting with Chinese government officials who demanded that Zoom develop the capability to terminate any “illegal meeting” within one minute. In others, Jin sent meeting passwords and other sensitive internal data directly to Chinese law enforcement.

In the complaint, FBI agents said that Zoom employees in the U.S. had agreed to a Chinese government “rectification” plan that entailed migrating data on roughly 1 million users from the U.S. to China, thereby subjecting it to Chinese law. Zoom also agreed, the complaint states, to provide “special access” to Chinese law enforcement and national-security authorities. In one message cited in the complaint, Jin wrote that the authorities had wanted him to share detailed lists of the company’s “daily monitoring” of “Hong Kong demonstrations, illegal religions” and other subjects.

To terminate the Tiananmen Square calls, the complaint alleges, Jin’s co-conspirators fabricated evidence that they were intended to discuss child abuse, racism, terrorism and violence. Jin’s co-conspirators also entered some calls with fake accounts that used pornographic or terrorist-related profile images, and Jin pointed to those images as evidence to terminate the meetings and suspend the hosts’ accounts.

John Demers, the assistant attorney general for national security, said the firm had, like many others that do business in China, put itself in a difficult position by operating in an authoritarian country whose laws and practices often “run antithetical to our values.”

“The company was focused on complying with Chinese law and the expectations of Chinese law enforcement,” Demers said. “But what happened over time is those expectations increased. So it goes from, ‘Well, respond to our lawful requests,’ to ‘You must take action within a minute to shut down any action on your platforms’ – not just in China, but outside – that hits upon topics of sensitivity to the Chinese government.”

That pressure, he noted, spans many industries: He cited the controversy last year involving the National Basketball Association, in which the general manager of the Houston Rockets tweeted in support of Hong Kong protesters, leading to a backlash in China.

“The case is an illustration of the choices that companies are forced to make when they do business in China . . . [and] how the Chinese government will take advantage of the leverage they have over you to push their agenda,” he said. “You’ve got a consistent pattern of the Chinese government using economic leverage – the opportunity to access markets, foreign investments – in order to further political goals.”

John Scott-Railton, a researcher at the Citizen Lab in Toronto, said the filing showed how authoritarian governments have increasingly looked at major tech companies as top-priority intelligence targets ripe for infiltration and recruitment.

He pointed to another case last year against two former Twitter employees charged with spying on behalf of Saudi Arabia, including by sending the personal information of thousands of people, including Saudi critics and prominent dissidents.

The charges were announced on the same day that the Trump administration added four Chinese companies to the Commerce Department entity list for enabling human rights abuses within China by providing DNA-testing materials or high-technology surveillance equipment to the Chinese government. They were among 59 Chinese companies Commerce add to its export control entity list, including companies that have been accused of stealing trade secrets and using U.S. exports to support the Chinese military.

Zoom has faced questions before about how it guards against the potential misuse of video data by the Chinese government, which censors major news and social media websites beneath what’s known as a “Great Firewall.”

This spring, Scott-Railton and another researcher found the company had routed American users’ data through Chinese servers, potentially opening it to Chinese-government data requests. The company later said it had “mistakenly” sent American video calls to Chinese data centers amid a flood of calls.

Zoom employs more than 2,500 people around the world, including, as of last year, more than 500 in China who develop the software installed in computers around the world.

The company’s billionaire chief executive, Eric Yuan, was born in China but moved to Silicon Valley in the late ’90s, where he worked for the video start-up WebEx before founding Zoom in 2011.

The Federal Trade Commission last month reached a settlement with Zoom, in which the company resolved allegations that it had misled users about their data privacy and encryption measures by agreeing to new security rules.

Questions over business dealings in China have become more commonplace as a new wave of Chinese tech start-ups has gained international popularity and acclaim. TikTok, the wildly popular short-video app owned by the Beijing-based tech company ByteDance, drew suspicions of censorship from users last year because searches on the site related to topics suppressed by the Chinese government, such as the Tiananmen Square massacre or the Hong Kong pro-democracy protests, showed few or no videos.

Internal guidelines for the site also mimicked Chinese-government censorship policies, and former employees for the company told The Post last year that key content-moderation decisions for international users were made in China. TikTok has said it has worked in recent months to distance its U.S. operations from the company’s Chinese headquarters.

Wang Dan, a Chinese dissident whose Zoom call on Tiananmen Square was also disrupted this spring, said the case showed how China could threaten free expression for people in the West.

“Interfering with the freedom of speech of those who have settled and lived in the United States in exile is . . . a serious attack to American sovereignty,” he told The Post on Friday. “The American people should also pay more attention to the [Chinese Communist Party’s] threat of American democracy.”

 

Increased Alarm over Intrusion into U.S. and Sandia/Los Alamos

Posted on by

WASHINGTON (AP) — Federal authorities expressed increased alarm Thursday about an intrusion into U.S. and other computer systems around the globe that officials suspect was carried out by Russian hackers. The nation’s cybersecurity agency warned of a “grave” risk to government and private networks.

The Cybersecurity and Infrastructure Security Agency said in its most detailed comments yet that the intrusion had compromised federal agencies as well as “critical infrastructure” in a sophisticated attack that was hard to detect and will be difficult to undo.

CISA did not say which agencies or infrastructure had been breached or what information taken in an attack that it previously said appeared to have begun in March.

“This threat actor has demonstrated sophistication and complex tradecraft in these intrusions,” the agency said in its unusual alert. “CISA expects that removing the threat actor from compromised environments will be highly complex and challenging.”

President Donald Trump, whose administration has been criticized for eliminating a White House cybersecurity adviser and downplaying Russian interference in the 2016 presidential election, has made no public statements about the breach.

President-elect Joe Biden said he would make cybersecurity a top priority of his administration, but that stronger defenses are not enough.

“We need to disrupt and deter our adversaries from undertaking significant cyberattacks in the first place,” he said. “We will do that by, among other things, imposing substantial costs on those responsible for such malicious attacks, including in coordination with our allies and partners.”

The cybersecurity agency previously said the perpetrators had used network management software from Texas-based SolarWinds t o infiltrate computer networks. Its new alert said the attackers may have used other methods, as well.

Over the weekend, amid reports that the Treasury and Commerce departments were breached, CISA directed all civilian agencies of the federal government to remove SolarWinds from their servers. The cybersecurity agencies of Britain and Ireland issued similar alerts.

A U.S. official previously told The Associated Press that Russia-based hackers were suspected, but neither CISA nor the FBI has publicly said who is believed be responsible. Asked whether Russia was behind the attack, the official said: “We believe so. We haven’t said that publicly yet because it isn’t 100% confirmed.”

Another U.S. official, speaking Thursday on condition of anonymity to discuss a matter that is under investigation, said the hack was severe and extremely damaging although the administration was not yet ready to publicly blame anyone for it.

“This is looking like it’s the worst hacking case in the history of America,” the official said. “They got into everything.”

The official said the administration is working on the assumption that most, if not all, government agencies were compromised but the extent of the damage was not yet known.

This hack had nothing to do with President Trump firing Director Krebs at CISA even though Associated Press keeps suggesting. But things just took a turn for the bad bad side –>

Sandia National Laboratories - From the Manhattan Project to a National Lab Sandia

Texas A&M System part of team awarded lucrative Los Alamos National Lab contract | The Texas Tribune Los Alamos

The Energy Department and National Nuclear Security Administration, which maintains the U.S. nuclear weapons stockpile, have evidence that hackers accessed their networks as part of an extensive espionage operation that has affected at least half a dozen federal agencies, officials directly familiar with the matter said.

On Thursday, DOE and NNSA officials began coordinating notifications about the breach to their congressional oversight bodies after being briefed by Rocky Campione, the chief information officer at DOE.

They found suspicious activity in networks belonging to the Federal Energy Regulatory Commission (FERC), Sandia and Los Alamos national laboratories in New Mexico and Washington, the Office of Secure Transportation and the Richland Field Office of the DOE. The hackers have been able to do more damage at FERC than the other agencies, the officials said, but did not elaborate.

Federal investigators have been combing through networks in recent days to determine what hackers had been able to access and/or steal, and officials at DOE still don’t know whether the attackers were able to access anything, the people said, noting that the investigation is ongoing and they may not know the full extent of the damage “for weeks.”

Spokespeople for DOE did not immediately respond to requests for comment.

The attack on DOE is the clearest sign yet that the hackers were able to access the networks belonging to a core part of the U.S. national security enterprise. The hackers are believed to have gained access to the federal agencies’ networks by compromising the software company SolarWinds, which sells IT management products to hundreds of government and private-sector clients.

DOE officials were planning on Thursday to notify the House and Senate Energy committees, House and Senate Energy and Water Development subcommittees, House and Senate Armed Services committees, and the New Mexico and Washington State delegations of the breach, the officials said.

The FBI, Cybersecurity and Infrastructure Security Agency, and Office of the Director of National Intelligence acknowledged the “ongoing” cybersecurity campaign in a joint statement released on Wednesday, saying that they had only become aware of the incident in recent days.

“This is a developing situation, and while we continue to work to understand the full extent of this campaign, we know this compromise has affected networks within the federal government,” the statement read.

NNSA is responsible for managing the nation’s nuclear weapons, and while it gets the least attention, it takes up the vast majority of DOE’s budget. Similarly, the Sandia and Los Alamos National Labs conduct atomic research related to both civil nuclear power and nuclear weapons. The Office of Secure Transportation is tasked with moving enriched uranium and other materials critical for maintaining the nuclear stockpile.

Hackers may have been casting too wide a net when they targeted DOE’s Richland Field Office, whose primary responsibility is overseeing the cleanup of the Hanford nuclear waste site in Washington state. During World War II and the Cold War, the U.S. produced two- thirds of its plutonium there, but the site hasn’t been active since 1971.

The attack on the Federal Energy Regulatory Commission may have been an effort to disrupt the nation’s bulk electric grid. FERC doesn’t directly manage any power flows, but it does store sensitive data on the grid that could be used to identify the most disruptive locations for future attacks.

US Companies Riddled with Members of Chinese Communist Party

Posted on by

Latest CHINESE COMMUNIST PARTY | The Straits Times

Primer:

In his speech just a few days ago at Georgia Tech University: Pompeo called China’s Communist Party “the central threat of our time” and highlighted efforts by Chinese security services to pressure and recruit Chinese academics and students as spies.

“Americans must know how the Chinese Communist Party is poisoning the well of our higher education institutions for its own ends and how those actions degrade our freedoms and American national security,” Pompeo said.

“If we don’t educate ourselves, if we’re not honest about what’s taking place, we’ll get schooled by Beijing.”

NYP: As we try to come to terms with the extent of Chinese influence over the Biden family, a leaked database of registered members of the Chinese Communist Party has exposed a mass infiltration of American companies — with serious national security implications.

Boeing, Qualcomm and Pfizer are just three US companies that have employed dozens of CCP members in their Chinese facilities, the database reveals.

As well, three female employees of the US consulate in Shanghai have been identified in the list of 1.95 million party members that was leaked to an international group of legislators, the Inter-Parliamentary Alliance on China, which includes Sens. Marco Rubio (R-Fla.) and Bob Menendez (D-NJ).

All CCP members swear an oath to “fight for communism throughout my life, be ready at all times to sacrifice my all for the party and the people, and never betray the party [and] guard party secrets, be loyal to the party.”

Sen. Josh Hawley (R-Mo.), a member of the Homeland Security Committee, said yesterday: “CCP agents have no place in US government facilities, and this report should serve as a much-needed wake-up call to Washington, DC, and corporate executives, who continue to welcome the Chinese government with open arms.

“[It] is just more evidence of the extent to which the CCP has successfully infiltrated American companies and government.”

While none of the people listed in the database have been identified as spies, mounting concerns in the State Department about the CCP have resulted in tightened visa rules for its members earlier this month. CCP members and their immediate families now are limited to one-month, single-entry US permits.

The database was verified by international cybersecurity firm Internet 2.0, which found it was originally leaked on encrypted messaging app Telegram in 2016. It was passed on to IPAC six weeks ago by a third party.

“We have high confidence this list is authentic,” Internet 2.0 co-founder David Robinson, a former Australian army intelligence officer, told me Sunday.

“Someone — an insider, a dissident — managed to get physical access to the server [in Shanghai] from outside the building. They didn’t have to hack it over the internet.”

Each data entry contains the CCP member’s name, ethnicity, place of birth, education level, identification number and, in some cases, a phone number and address.

Robinson has verified the identity of three women who work at the US consulate in Shanghai.

The three, all listed as ethnic Han college graduates, are registered in a 31-strong Communist Party branch listed as Shanghai Foreign Institutional Service Co., which is a state-owned employment agency, which provides local staff for foreign consulates, schools and news media.

A department spokesperson yesterday had no comment about “an allegedly leaked database of Communist Party members” and said “the department does not discuss security protocols or personnel matters.”

However, she said: “Influence and interference operations are fundamental to how the Chinese Communist Party engages with the world.

“China’s role in the world today cannot be understood without reference to the wide array of malign activities that the [CCP] undertakes to influence our societies in ways that are covert, coercive and corrupting.”

The CCP database is split into 79,000 branches.

For example, Boeing has 17 branches, totaling 252 CCP members. Sixteen members are part of Boeing’s Hongqiao Maintenance Base Boeing Line Maintenance Division . . . First Workshop Party Branch; 22 are in the Second Workshop Party Branch; 13 are in the Third Workshop Party Branch, 14 in the Fourth Workshop Party Branch.

There are four subdivisions of the Pudong Maintenance Base Boeing Line Maintenance Branch, totaling 49 members.

Two branches of the Pudong Maintenance Base Boeing Line Maintenance Branch Cargo Aircraft Line Maintenance total 33 members.

Also listed are 27 members of the Party Branch of Boeing Fourth Branch of the Flight Department of Eastern Airlines Yunnan Co. and 23 members of the China Eastern Airlines Beijing Maintenance Department Party Committee Boeing Maintenance Workshop Party Branch.

Boeing spokesman Bradley Akubuiro said last night the company was satisfied with its security.

“As a global company, we enforce strict security protocols and maintain secure firewalls to protect both our customer and company proprietary data in all countries we operate in.”

According to the database, 96 members in the Qualcomm Wireless Communication Technology (China) Co. Ltd. Party Branch, and 133 additional members spread over six party branches of Qualcomm Enterprise Management (Shanghai) work for semiconductor manufacturer and 5G wireless technology company Qualcomm, a US-based multinational.

Qualcomm was awarded a contract by the Defense Department in 2018 to develop multifactor authentication security systems for US military computers.

Another US company crucial to national security is pharmaceutical giant Pfizer, which began rolling out COVID-19 vaccines Sunday.

The database lists 69 CCP members in four Pfizer branches in Shanghai.

Neither Qualcomm nor Pfizer responded to inquiries yesterday.

New York University also appears with 71 members attached to a branch named East China Normal University Shanghai New York University Faculty and Labor Party Branch.

The database leak comes just days after a number of disturbing revelations involving CCP infiltration of American institutions:

Director of National Intelligence John Ratcliffe warned that China has targeted members of Congress and poses “the greatest threat to democracy and freedom” since World War II.
Secretary of State Mike Pompeo warned of China’s infiltration of US universities, which are “hooked on Communist cash” and stifle criticism of Beijing.
Media reports identified Rep. Eric Swalwell (D-Calif.), a member of House Intelligence Committee, as one of several San Francisco politicians courted by Chinese spy Christine Fang.

It was confirmed last week that Joe Biden’s son Hunter is under federal investigation over tax fraud and potential money-laundering over his foreign business dealings, including in China.

“Communist China has been allowed to infiltrate our universities and corporations with people loyal to only the Communist Party,” former Acting Director of National Intelligence Ric Grenell said Sunday.

“Our beloved Chinese American community has been warning us about these tactics for many years, and the political class has ignored those warnings.”

*** Communist party is 'leader of all religions' in China - world news - Hindustan Times

Sensitive data of around two million members of the Communist Party of China (CPC) have been leaked, highlighting their positions in major organizations, including government agencies, throughout the world.

According to reports from The Australian newspaper, featured in the Economic Times, the information includes official records such as party position, birthdate, national ID number and ethnicity. It revealed that members of China’s ruling party hold prominent positions in some of the world’s biggest companies, including in pharmaceutical giants involved in the development of COVID-19 vaccines like Pfizer and financial institutions such as HSBC.

The investigation by The Australian centred around the data leak, which was extracted from a Shanghai server in 2016 by Chinese dissidents.

It noted that CPC members are employed as senior political and government affairs specialists in at least 10 consulates, including the US, UK and Australia, in the eastern Chinese metropolis Shanghai. The paper added that many other members hold positions inside universities and government agencies.

The report emphasized there is no evidence that spying for the Chinese government or other forms of cyber-espionage have taken place.

In her report, The Australian journalist and Sky News host Sharri Markson commented: “What’s amazing about this database is not just that it exposes people who are members of the Communist Party, and who are now living and working all over the world, from Australia to the US to the UK, but it’s amazing because it lifts the lid on how the party operates under President and Chairman Xi Jinping.

“It is also going to embarrass some global companies who appear to have no plan in place to protect their intellectual property from theft, from economic espionage.”

In September, the Cybersecurity and Infrastructure Security Agency (CISA) and the US Department of Justice issued a joint advisory warning US government agencies and private sector companies to be on high alert for cyber-attacks by threat actors affiliated with the Chinese Ministry of State Security (MSS).

Details: Cozy Bear, Solarwinds, FireEye and the Hack of the US Govt

Posted on by

Cozy Bear (also called APT29, a known unit of Russia’s SVR foreign intelligence service) appears to have been behind the attack, the Wall Street Journal reports. Moscow denies any involvement in the incident. Reuters adds that the Kremlin thinks the Americans should have been more mutual, more cooperative.

FireEye calls the backdoor “Sunburst.” Microsoft’s Security Response Center has a detailed account of how the malware functions. Both FireEye and Microsoft have upgraded their security products to include measures for detecting and protecting against the attack. SolarWinds urges its customers to “upgrade to Orion Platform version 2020.2.1 HF 1 as soon as possible.”

Global cybersecurity firm FireEye hacked by foreign ... source

When FireEye Inc. discovered that it was hacked this month, the cybersecurity firm’s investigators immediately set about trying to figure out how attackers got past its defenses.

It wasn’t just FireEye that got attacked, they quickly found out. Investigators discovered a vunerability in a product made by one of its software providers, Texas-based SolarWinds Corp.

“We looked through 50,000 lines of source code, which we were able to determine there was a backdoor within SolarWinds,” said Charles Carmakal, senior vice president and chief technical officer at Mandiant, FireEye’s incident response arm.

After discovering the backdoor, FireEye contacted SolarWinds and law enforcement, Carmakal said.

In part: Washington — U.S. government agencies were ordered to scour their networks for malware and disconnect potentially compromised servers after authorities learned that the Treasury and Commerce departments had been hacked in a months-long global cyberespionage campaign. The campaign was discovered when a prominent cybersecurity firm learned it had been breached.

In a rare emergency directive issued late Sunday, the Department of Homeland Security’s cybersecurity arm warned of an “unacceptable risk” to the executive branch from a feared large-scale penetration of U.S. government agencies that could date back to mid-year or earlier.

“This can turn into one of the most impactful espionage campaigns on record,” said cybersecurity expert Dmitri Alperovitch.

The apparent conduit for the Treasury and Commerce Department hacks – and the FireEye compromise – is a hugely popular piece of server software called SolarWinds. It’s used by hundreds of thousands of organizations globally, including most Fortune 500 companies and multiple U.S. federal agencies that will now be scrambling to patch up their networks, said Alperovitch, the former chief technical officer of the cybersecurity firm CrowdStrike.

On its website, SolarWinds says it has 300,000 customers worldwide, including all five branches of the U.S. military, the Pentagon, the State Department, NASA, the National Security Agency, the Department of Justice and the White House. It says the 10 leading U.S. telecommunications companies and top five U.S. accounting firms are also among customers.

The DHS directive – only the fifth since such directives were created in 2015 – said U.S. agencies should immediately disconnect or power down any machines running the impacted SolarWinds software.

“We believe that this vulnerability is the result of a highly-sophisticated, targeted and manual supply chain attack by a nation state,” said SolarWinds CEO Kevin Thompson said in a statement. He said it was working with the FBI, FireEye and intelligence community. More here.

***  SolarWinds of Austin posts sharp rise in revenue - Austin ... source

Many more details on consequence –>

It turns out that the attackers also compromised the Department of Homeland Security. SolarWinds revealed to the Securities and Exchange Commission that the breach may affect 18,000 customers.

It appears that, in March 2020, someone managed to modify the SolarWinds Orion software during the build process—that is, the process that translates the human-readable code and merges it into a form that a computer can execute. This timing is based on both the Microsoft and FireEye analyses, as well as the reported versions affected by SolarWinds.

This modification included a sophisticated and stealthy Trojan program, designed to remotely control any computer that installed SolarWinds Orion. When customers installed the latest update, the Trojan program would start running on the victims’ computers. This is considered a software “supply chain attack”: The intended victims received a polluted copy of the Orion software directly or indirectly from SolarWinds.

What Now?

Christmas is now officially cancelled for three groups. The first is for the IT staff working for the perhaps 18,000 SolarWinds customers affected by the breach, who are going to have to spend the next weeks rebuilding their networks and going over everything with a fine-toothed comb looking for various backdoors. This is going to be a lot of work to sort out. The only good thing is that most of the customers don’t have secondary backdoors to worry about, because the biggest problem faced by the attacker was simply the target-rich environment. Each effort at exploitation increases the risk of discovery, and in the end, there are only so many people who can conduct these attacks.

The second group is the U.S. intelligence community. This attack started in March with the first exploitation starting in April. Either they didn’t know about it—a failure in the “defend forward” philosophy—or they did know about it, in which case they also failed to defend forward. There are going to be tough questions that the intelligence community will need to answer internally.

The final group is the Russian government. This was an amazingly valuable intelligence feed, capturing U.S. government communication leading up to the transition as well as critical insights into U.S. financial controls. Now the feed has gone dark and Russia has lost a hugely powerful asset. But then again, these are a bunch of Russian spies, so in the immortal words of every sysadmin: “fsck those guys”.

More here.