U.S. is on the Offensive, Espionage and Cyber

Posted on August 2, 2018August 2, 2018 by Denise Simon

In the last few weeks, there was the Aspen Security Forum, a 3 day event. Then there was a DNI report. Then came 2 separate nationwide conference calls hosted by CERT, the cyber division of DHS.

A remarkable White House press briefing included the heads of intelligence agencies explaining the condition of cyber/espionage and the countermeasures against Russia.

Then there is the military side, a division frankly not well known, the Defense Security Services.

See the whole 2 page release here.

And there is more:

FBI Releases Article on Securing the Internet of Things

The Federal Bureau of Investigation (FBI) has released an article on the risks associated with internet-connected devices, commonly referred to as the Internet of Things (IoT). FBI warns that cyber threat actors can use unsecured IoT devices as proxies to anonymously pursue malicious cyber activities.

As our reliance on IoT becomes an important part of everyday life, being aware of the associated risks is a key part of keeping your information and devices secure. NCCIC encourages users and administrators to review the FBI article for more information and refer to the NCCIC Tip Securing the Internet of Things.

*** IOT?

The internet of things, at its simplest level, is a network of smart devices – from refrigerators that warn you when you’re out of milk to industrial sensors – that are connected to the internet so they can share data, but IoT is far from a simple challenge for IT departments.

Related reading: Five IoT Predictions For 2019

For many companies, it represents a vast influx of new devices, many of which are difficult to secure and manage. It’s comparable to the advent of BYOD, except the new gizmos are potentially more difficult to secure, aren’t all running one of three or four basic operating systems, and there are already more of them.

A lot more, in fact – IDC research says that there are around 13 billion connected devices in use worldwide already, and that that number could expand to 30 billion within the next three years. (There were less than 4 billion smartphone subscriptions active around the world in Ericsson’s most recent Mobility Report.)

With a huge number of companies “doing IoT” – most big-name tech companies, including Google, Microsoft, Apple, Cisco, Intel, and IBM have various types of IoT play – all working to bring as many users as possible into their respective ecosystems, motivation to make sure IoT systems and devices from different companies all work with each other is sometimes lacking.

photo

The problem, of course, is that nobody’s willing to give up on the idea of their own ecosystem becoming a widely accepted standard – think of the benefits to the company whose system wins out! – and so the biggest players in the space focus on their own systems and development of more open technologies lags behind. More here.

Eligible Receiver 97, Red Team Being Applied Today for Cyber Hacks?

Posted on August 2, 2018August 2, 2018 by Denise Simon

An early classified Defense Department cybersecurity exercise named “Eligible Receiver 97” (ER97) featured a previously unpublicized series of mock terror attacks, hostage seizures, and special operations raids that went well beyond pure cyber activities in order to demonstrate the potential scope of threats to U.S. national security posed by attacks in the cyber domain, according to recently declassified documents and a National Security Agency (NSA) video posted today by the nongovernmental National Security Archive at The George Washington University.

“Joint Exercise Eligible Receiver 97”, run during the Clinton presidency, is frequently pointed to as a critical event in the United States’ appreciation of threats in cyber space. The exercise led directly to the formation of what would eventually become United States Cyber Command (USCYBERCOM) and informed key studies such as the formative Marsh Report on critical infrastructure protection. Despite the significance of ER97, however, very little is publicly known about the exercise itself.

ER97 involved an NSA Red Team playing the role of North Korean, Iranian and Cuban hostile forces whose putative aim was to attack critical infrastructure as well as military command-and-control capabilities to pressure the U.S. government into changing its policies toward those states. An interagency Blue Team was required to provide recommendations to personnel enacting defensive responses. Until now, only two phases out of three (infrastructure and command-and-control) had been publicly known. The video and documents posted today provide new details about the third phase involving kinetic attacks in the physical domain – i.e. more traditional terrorist assaults on civilian targets – which were built upon intelligence gathered through the Red Team’s successes. Read more here on the declassified files.

*** With all the cyber terror going on today in the United States, are we doing more ‘red team’ exercises? Perhaps some of those tactics are paying off many years later.

3 Carbanak (FIN7) Hackers Charged With Stealing 15 Million ...

Three Members of Notorious International Cybercrime Group “Fin7” in Custody for Role in Attacking Over 100 U.S. Companies

Victim Companies in 47 U.S. States; Used Front Company ‘Combi Security’ to Recruit Hackers to Criminal Enterprise

SEATTLE – Three high-ranking members of a sophisticated international cybercrime group operating out of Eastern Europe have been arrested and are currently in custody facing charges filed in U.S. District Court in Seattle, announced U.S. Attorney Annette L. Hayes, Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division and Special Agent in Charge Jay S. Tabb Jr. of the FBI’s Seattle Field Office.

According to three federal indictments unsealed today, Ukrainian nationals Dmytro Fedorov, 44, Fedir Hladyr, 33, and Andrii Kolpakov, 30, are members of a prolific hacking group widely known as FIN7 (also referred to as the Carbanak Group and the Navigator Group, among other names). Since at least 2015, FIN7 members engaged in a highly sophisticated malware campaign to attack more than 100 U.S. companies, predominantly in the restaurant, gaming, and hospitality industries. As set forth in the indictments, FIN7 hacked into thousands of computer systems and stole millions of customer credit and debit card numbers which were used or sold for profit.

In the United States alone, FIN7 successfully breached the computer networks of businesses in 47 states and the District of Columbia, stealing more than 15 million customer card records from over 6,500 individual point-of-sale terminals at more than 3,600 separate business locations. Additional intrusions occurred abroad, including in the United Kingdom, Australia, and France. Companies that have publicly disclosed hacks attributable to FIN7 include such familiar chains as Chipotle Mexican Grill, Chili’s, Arby’s, Red Robin and Jason’s Deli. Additionally here in Western Washington FIN7 targeted the Emerald Queen Casino (EQC) and other local businesses. The Emerald Queen Casino was able to stop the intrusion and no customer data was stolen.

“Protecting consumers and companies who use the internet to conduct business – both large chains and small ‘mom and pop’ stores — is a top priority for all of us in the Department of Justice,” said U.S. Attorney Annette L. Hayes. “Cyber criminals who believe that they can hide in faraway countries and operate from behind keyboards without getting caught are just plain wrong. We will continue our longstanding work with partners around the world to ensure cyber criminals are identified and held to account for the harm that they do – both to our pocketbooks and our ability to rely on the cyber networks we use.”

“The three Ukrainian nationals indicted today allegedly were part of a prolific hacking group that targeted American companies and citizens by stealing valuable consumer data, including personal credit card information, that they then sold on the Darknet,” said Assistant Attorney General Benczkowski. “Because hackers are committed to finding new ways to harm the American public and our economy, the Department of Justice remains steadfast in its commitment to working with our law enforcement partners to identify, interdict, and prosecute those responsible for these threats.”

“The naming of these FIN7 leaders marks a major step towards dismantling this sophisticated criminal enterprise,” said Special Agent in Charge Jay S. Tabb Jr., of the FBI’s Seattle Field Office. “As the lead federal agency for cyber-attack investigations, the FBI will continue to work with its law enforcement partners worldwide to pursue the members of this devious group, and hold them accountable for stealing from American businesses and individuals.”

Each of the three FIN7 conspirators is charged with 26 felony counts alleging conspiracy, wire fraud, computer hacking, access device fraud, and aggravated identity theft.

In January 2018, at the request of U.S. officials, foreign authorities separately arrested Ukrainian Fedir Hladyr and a second FIN7 member, Dmytro Fedorov. Hladyr was arrested in Dresden, Germany, and is currently detained in Seattle pending trial. Hladyr allegedly served as FIN7’s systems administrator who, among other things, maintained servers and communication channels used by the organization and held a managerial role by delegating tasks and by providing instruction to other members of the scheme. Hladyr’s trial is currently scheduled for October 22, 2018.

Fedorov, a high-level hacker and manager who allegedly supervised other hackers tasked with breaching the security of victims’ computer systems, was arrested in Bielsko-Biala, Poland. Fedorov remains detained in Poland pending his extradition to the United States.

In late June 2018, foreign authorities arrested a third FIN7 member, Ukrainian Andrii Kolpakov in Lepe, Spain. Kolpakov, also is alleged to be a supervisor of a group of hackers, remains detained in Spain pending the United States’ request for extradition.

According to the indictments, FIN7, through its dozens of members, launched numerous waves of malicious cyberattacks on numerous businesses operating in the United States and abroad. FIN7 carefully crafted email messages that would appear legitimate to a business’ employee, and accompanied emails with telephone calls intended to further legitimize the email. Once an attached file was opened and activated, FIN7 would use an adapted version of the notorious Carbanak malware in addition to an arsenal of other tools to ultimately access and steal payment card data for the business’ customers. Since 2015, many of the stolen payment card numbers have been offered for sale through online underground marketplaces. (Supplemental document “How FIN7 Attacked and Stole Data” explains the scheme in greater detail.)

FIN7 used a front company, Combi Security, purportedly headquartered in Russia and Israel, to provide a guise of legitimacy and to recruit hackers to join the criminal enterprise. Combi Security’s website indicated that it provided a number of security services such as penetration testing. Ironically, the sham company’s website listed multiple U.S. victims among its purported clients.

The charges in the indictments are merely allegations, and the defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

The indictments are the result of an investigation conducted by the Seattle Cyber Task Force of the FBI and the U.S. Attorney’s Office for the Western District of Washington, with the assistance of the Justice Department’s Computer Crime and Intellectual Property Section and Office of International Affairs, the National Cyber-Forensics and Training Alliance, numerous computer security firms and financial institutions, FBI offices across the nation and globe, as well as numerous international agencies. Arrests overseas were executed in Poland by the “Shadow Hunters” from CBŚP (Polish Central Bureau of Investigation); in Germany by LKA Sachsen – Dezernat 33, (German State Criminal Police Office) and the Polizeidirektion Dresden (Dresden Police); and in Spain by the Grupo de Seguridad Logica within the Unidad de Investigación Technologica of the Cuerpo Nacional de Policía (Spanish National Police).

This case is being prosecuted by Assistant U.S. Attorneys Francis Franze-Nakamura and Steven Masada of the Western District of Washington, and Trial Attorney Anthony Teelucksingh of the Justice Department’s Computer Crime and Intellectual Property Section.

how_fin7_attacked_and_stole_data.pdf

Russia Hacks Lab Testing Poison from Britain Cases

Posted on July 31, 2018July 31, 2018 by Denise Simon

Kremlin Hackers Take Aim at the Swiss Lab That’s Working the Skirpal Poisoning Case

The group that attacked Ukraine’s power grid is phishing a chemical-weapons lab critical to the Skripal case.

A state-backed Russian hacking group has is targeting a Swiss laboratory that’s helping investigators solve the March poisoning of Sergei Skripal and his daughter in London.

Called Sandworm, the group has been trying to phish employees of Switzerland’s Spiez Laboratory, a chemical-and biological-weapons facility that is doing forensics work on the Novichok poisoning of the former Russian colonel and double agent, according to Swiss news outlet Sonntags Blick, which reported the attacks on Sunday.

Russia has denied any involvement in Skripal’s poisoning.

Sandworm isn’t as well known as the Russian intelligence (FSB) and military (GRU) entities that stole emails from the Democratic National Committee in 2016, but it has run similar operations. In 2013, the group sent malicious emails to NATO officials and to a Polish energy concern. In 2014, they went after various Eastern European officials working in governments that are critical of Russia, using a version of the BlackEnergy botnet tool originally developed by Russian programmer Oleksiuk Dmytro.

“They’re not going after credentials. They want knowledge that only a few people can use. That’s security-related information and diplomatic information and intelligence on NATO and Ukraine and Poland,” FireEye’s John Hultquist toldWIRED in 2014.

In 2015, Sandworm made history with the first successful attack on a power grid, using a version of BlackEnergy to hit the Ukrainian energy sector. The group struck again in December 2016, disrupting power to as many as 200,000 Ukrainians in the dead of winter.

Sandworm’s recent attack on Spiez was subtler, a return to the highly directed phishing attacks they ran in 2013 and 2014. Impersonating members of the lab’s management, they sent an email inviting researchers to a chemical weapons conference — and encouraging them to click on a malware-laden Word attachment.

Kurt Münger of the Swiss Federal Office for Civil Protection told Blick that authorities had not seen any data theft resulting from the attempt.

*** Meanwhile:

Increasingly alarmed at foreign hacking, DOD and intelligence officials are racing to educate the military and defense contractors.

The Pentagon is warning the military and its contractors not to use software it deems to have Russian and Chinese connections, according to the U.S. Defense Department’s acquisition chief.

Officials have begun circulating a “Do Not Buy” list of software that does not meet “national security standards,” Ellen Lord, defense undersecretary for acquisition and sustainment, said Friday.

“We had specific issues … that caused us to focus on this,” Lord told reporters at the Pentagon.

“What we are doing is making sure that we do not buy software that’s Russian or Chinese provenance,” she said. “Quite often that’s difficult to tell at at first glance because of holding companies.”

The Pentagon started compiling the list about six months ago. Suspicious companies are put on a list that is circulated to the military’s software buyers. Now the Pentagon is working with the three major defense industry trade associations — the Aerospace industries Association, National Defense Industrial Association and Professional Services Council — to alert contractors small and large.

Facebook Announces Foreign Intrusion Again, 290,000 Accounts

Posted on July 31, 2018July 31, 2018 by Denise Simon

The details: “About two weeks ago we identified the first of eight Pages and 17 profiles on Facebook, as well as seven Instagram accounts, that violate our ban on coordinated inauthentic behavior,” said Nathaniel Gleicher, the company’s head of cybersecurity policy, in blog post. Those pages and accounts have been removed.

“In total, more than 290,000 accounts followed at least one of these Pages, the earliest of which was created in March 2017,” Gleicher said. “The latest was created in May 2018.”

The New York Times was the first to report that the company had identified the operation.

What they’re saying: Gleicher said Facebook has not attributed the campaign to a specific actor like Russia’s Internet Research Agency, which was behind the 2016 campaign.

There are some similarities to what they say before and after the 2016 elections, and Facebook found evidence of some connections between recent accounts and IRA accounts that were disabled last year.

But there are also differences: “For example, while IP addresses are easy to spoof, the IRA accounts we disabled last year sometimes used Russian IP addresses. We haven’t seen those here,” Gleicher said.

Facebook COO Sheryl Sandberg told reporters that the company is still investigating: “This is an early stage for us to be sharing this information because we don’t have perfect information.”

The content included several related to divisive political issues.

One post released by Facebook was posted by a page called “Resisters” and featured an image of President Trump with the text: “If Trump wants to beat Barack Obama’s Twitter record for most liked tweet he only needs to tweet 2 words ‘I resign.'”

The same page also created an event for a counter-protest to the upcoming ““Unite the Right” rally in Washington. “Inauthentic admins of the ‘Resisters’ Page connected with admins from five legitimate Pages to co-host the event,” said Gleicher.

Though the company released some sample posts from the pages, Facebook officials said on a call with reporters that it would not get into the broad details of the content — beyond what it had released publicly — but were working with researchers to evaluate it.

*** Early patterns, language and tactics are once again pointing to Russia, however that is not confirmed.

CNet: Facebook has discovered a new campaign of “inauthentic behavior” that’s used dozens of Facebook pages and accounts, and $11,000 worth of ads, to promote political causes prior to the US midterm elections, the social network said Tuesday.

The world’s largest social network is already in the hot seat with lawmakers over its role in the 2016 US presidential election. Russian trolls affiliated with the Kremlin-linked Internet Research Agency used a combination of paid ads and organic posts to spread misinformation and sow discord among voters ahead of the election.

In the wake of the scandal, Facebook made several changes to its advertising operations. They include a stricter verification process for political ads, and labeling ads with who paid for them. On Tuesday, Facebook’s head of cybersecurity policy, Nathaniel Gleicher, wrote in a company blog post that his team couldn’t say for sure who was behind the new campaign.

“Some of the activity is consistent with what we saw from the IRA before and after the 2016 elections,” Gleicher said. “And we’ve found evidence of some connections between these accounts and IRA accounts we disabled last year.” But there are differences as well, Gleicher said.

The people behind the new fake accounts are taking more steps to cover their tracks, and Facebook hasn’t found any activity coming from Russian IP addresses. What’s more, the ads were purchased in US and Canadian dollars.

Gleicher said there was a connection between the fake accounts and pages and planned protests in Washington next week.

Sen. Mark Warner, a Virginia Democrat who’s helped lead the Senate Intelligence Committee’s investigation into Russian efforts to influence the 2016 presidential election, said the news shows that social media remains a propaganda target for the Russians.

photo

“Today’s disclosure is further evidence that the Kremlin continues to exploit platforms like Facebook to sow division and spread disinformation,” Warner said, “and I am glad that Facebook is taking some steps to pinpoint and address this activity. I also expect Facebook, along with other platform companies, will continue to identify Russian troll activity and to work with Congress on updating our laws to better protect our democracy in the future.”

Facebook said it’s working with law enforcement to investigate the campaign.

Asia Pivot/Latin America Failure, China Owns L.A.

Posted on July 29, 2018July 29, 2018 by Denise Simon

Remember when just a few weeks ago when President Trump announced a new ‘space command‘?

The House Armed Services Committee has a fiscal item in the 2018 NDAA for something called ‘Management and Organization of Space Programs’. The Air Force is not too happy. Redundancy maybe or no?

US Air Force Sees Multidomain Command and Control As Critical photo

Air Force Space Command, activated Sept. 1, 1982, is a major command with headquarters at Peterson Air Force Base, Colorado. AFSPC provides military focused space capabilities with a global perspective to the joint warfighting team.

Mission

AFSPC’s mission is to provide resilient, defendable and affordable space capabilities for the Air Force, Joint Force and the Nation.

Vision

Innovate, Accelerate, Domininate

Priorities

1. Build Combat Readiness

2. Innovate and Accelerate to Win

3. Develop Joint Warfighters

4. Organize for Sustained Success

People

More than 30,000 space professionals worldwide.

Organization

Fourteenth Air Force is located at Vandenberg AFB, California, and provides space capabilities for the joint fight through the operational missions of spacelift; position, navigation and timing; satellite communications; missile warning and space control.

The Space and Missile Systems Center at Los Angeles AFB, California, designs and acquires all Air Force and most Department of Defense space systems. It oversees launches, completes on-orbit checkouts and then turns systems over to user agencies. It supports the Program Executive Office for Space on the Global Positioning, Defense Satellite Communications and MILSTAR systems. SMC also supports the Evolved Expendable Launch Vehicle, Defense Meteorological Satellite and Defense Support programs and the Space-Based Infrared System.

AFSPC major installations include: Schriever, Peterson and Buckley Air Force bases in Colorado; Los Angeles and Vandenberg Air Force bases in California; and Patrick AFB in Florida. Major AFSPC units also reside on bases managed by other commands in New Mexico, Virginia and Georgia. AFSPC manages many smaller installations and geographically separated units in North Dakota, Alaska, Hawaii and across the globe.

Space Capabilities

Spacelift operations at the East and West Coast launch bases provide services, facilities and range safety control for the conduct of DOD, NASA and commercial launches. Through the command and control of all DOD satellites, satellite operators provide force-multiplying effects — continuous global coverage, low vulnerability and autonomous operations. Satellites provide essential in-theater secure communications, weather and navigational data for ground, air and fleet operations and threat warning.

Ground-based radar, Space-Based Infrared System and Defense Support Program satellites monitor ballistic missile launches around the world to guard against a surprise missile attack on North America. Space surveillance radars provide vital information on the location of satellites and space debris for the nation and the world. Maintaining space superiority is an emerging capability required to protect U.S. space assets.

Remember when VP Pence visited several countries in Latin America a few months ago?

Lots of back story items going on here. China landed in Latin America, the world knew it and did nothing. Obama? Yep…nothing and Trump is working to catch up and applying some counter-measures? This trade war thing is beginning to make some sense with China….

No Need for New ‘Imperial Powers’

Latin America experts in the Obama White House watched China’s rise in the region warily. But the administration raised little fuss publicly, sharing its concerns with leaders mostly in private.

Besides, former officials say, Washington did not have much of a counteroffer.

“I wished the whole time I was working in Latin America that any administration had as well thought-out, resourced and planned a policy as the pivot to Asia for Latin America,” said John Feeley, who recently resigned as the American ambassador to Panama after a nearly three-decade career. “Since the end of the 1980s, there really has never been a comprehensive hemispheric long-term strategy.”

While President Barack Obama was widely hailed in the region for restoring diplomatic relations with Cuba in late 2014, Washington’s agenda never ceased being dominated by two issues that have long generated resentment in Latin America: the war on drugs and illegal immigration.

***

Meanwhile, Patagonia has a Chinese military base, for 50 years, for free.

The 450-ton device, with its hulking dish embracing the open skies, is the centerpiece of a $50 million satellite and space mission control station built by the Chinese military.

The isolated base is one of the most striking symbols of Beijing’s long push to transform Latin America and shape its future for generations to come — often in ways that directly undermine the United States’ political, economic and strategic power in the region.

The antenna is the centerpiece of a $50 million station built by the Chinese military.CreditMauricio Lima for The New York Times

The station began operating in March, playing a pivotal role in China’s audacious expedition to the far side of the moon — an endeavor that Argentine officials say they are elated to support.

But the way the base was negotiated — in secret, at a time when Argentina desperately needed investment — and concerns that it could enhance China’s intelligence gathering capabilities in the hemisphere have set off a debate in Argentina about the risks and benefits of being pulled into China’s orbit.

“Beijing has transformed the dynamics of the region, from the agendas of its leaders and businessmen to the structure of its economies, the content of its politics and even its security dynamics,” said R. Evan Ellis, a professor of Latin American studies at the United States Army War College.

Just weeks after the space station began operating in Patagonia, the United States made an announcement that raised eyebrows here in Argentina.

The Pentagon is funding a $1.3 million emergency response center in Neuquén — the same province where the Chinese base is, and the first such American project in all of Argentina. Local officials and residents wondered whether the move was a tit-for-tat response to China’s new presence in this remote part of the country. Read the full article here from the NYT’s, great work.