Category Archives: Department of Homeland Security

Chilling Details of the Sony Hack, Reported

Posted on by

These Are the Cyberweapons Used to Hack Sony

MotherBoard: In late November 2014, a mysterious group of hackers calling itself “God’sApstls” sent an ominous and jumbled email to a few high-level Sony Pictures executives.

“The compensation for it, monetary compensation we want,” the hackers wrote. “Pay the damage, or Sony Pictures will be bombarded as a whole.”

The executives at the Hollywood studio, which was about to release the controversial James Franco and Seth Rogen’s comedy The Interview, ignored the email. Just three days later, the hackers’ followed through with their threat and breached the studio’s systems, displaying a message on the computer screen of every employee: “Hacked by #GOP [Guardians of Peace].”

The hackers not only defaced employee’s computers, they then wiped their hard disks, crippling Sony Pictures for weeks, and costing the company $35 million in IT damages, according to its own estimate.

Now, more than a year later, several security researchers are still hunting down the hackers behind the attack, which the FBI officially identified as North Korean government-employed hackers. And despite the fact that the group is apparently still alive and well, a coalition of security researchers believes they can now disrupt them by exposing their extensive malware arsenal.

On Wednesday, a group of companies led by Novetta released a report detailing the Sony hackers’ long history of operations, as well as its large stock of malware. It’s perhaps the most detailed and extensive look at the group behind what might be the most infamous cyberattack ever.

Andre Ludwig, the senior technical director at Novetta Research and Interdiction Group, said that the investigation started from four hashes (values that uniquely identify a file) that the Department of Homeland security published after the attack. With those few identifying strings, and after months of sleuthing, the researchers found 2,000 malware samples, both from online malware portal VirusTotal, as well as from antivirus companies. Of those, they manually reviewed and catalogued 1,000, and were able to identify 45 unique malware strains, revealing that the Sony hackers had an arsenal more sophisticated and varied than previously thought.

The researchers hope that by shedding light on the hackers’ toolkit, the group, which the researchers called “Lazarus Group,” will be forced to adapt, spending resources and time, and perhaps even lose capabilities after antivirus companies and potential targets put up new defenses.

“There is no more shadows to hide in for these tools.”

“If all of a sudden you have antivirus signatures that detect and delete all the group’s arsenal, boom!” Jaime Blasco, the chief scientist at AlienVault Labs and one of the researchers who investigated the Sony hackers, told Motherboard. “They lose access to all the victims’ they got before.”

As Ludwig put it, “there is no more shadows to hide in for these tools.”

As it turns out, the hackers’ arsenal contains not only malware capable of wiping and destroying files on a hard disk like the Sony hack, but also Distributed Denial of Service (DDoS) tools, tools that allow for remotely eavesdropping on a victim’s computer, and more, according to the report. The researchers tracked some of this tools in cyberattacks and espionage operations that go as far as back as 2009, perhaps even 2007, showing the hackers that hit Sony have a long history.

While others suspected this before, Blasco said that nobody demonstrated it as conclusively until now.

Novetta researchers and their partners, which include AlienVault and Kaspersky Lab, don’t get into saying who the hackers really are, but they also don’t question the FBI’s controversial claim that North Korea was behind the attack.

The main reason, LaMontagne explained, is that the new data they found discredits the alternative theories that the hackers were actually a disgruntled former employee or just an independent hacktivist group.

A former Sony system administrator is unlikely to have built more than 45 malware tools in the span of more than seven years, LaMontagne told me. And the same time, he added, it’s also unlikely that a previously unheard of hacktivist group would pop up, claim responsibility for such a high-profile attack, and then disappear.

“They’re extremely motivated, regimented, organized, and they can definitely execute.”

“We have no reason to dispute what the US government and other governments have asserted as the threat being North Korean,” Peter LaMontagne, the CEO of Novetta, told me.

And as it turns out, those hackers have been around for longer than anyone thought—wielding sophisticated weapons. This, according to the researchers, shows the group was much more seasoned than anyone believed.

“Their motivation and operational execution, it’s impressive,” Ludwig said. “They’re extremely motivated, regimented, organized, and they can definitely execute.”

Now that their methods and tools are exposed, however, the researchers hope that they won’t be as effective.

The head-scratcher is sanctions are only for the missile test?

US to present UN sanctions resolution on North Korea

United Nations (United States) (AFP) – The United States will on Thursday present a draft UN resolution toughening sanctions on North Korea after reaching agreement with China on a joint response to Pyongyang’s fourth nuclear test and a rocket launch.

The UN Security Council will meet at 2:00 pm (1900 GMT) to discuss the draft text detailing a new package of measures to punish North Korea, but there will be no immediate vote.

US Ambassador Samantha Power “intends to submit for consideration by the Security Council a draft sanctions resolution in response to the DPRK’s recent nuclear test and subsequent proscribed ballistic missile launch,” US spokesman Kurtis Cooper said, using the abbreviation for North Korea’s formal name.

“We look forward to working with the Council on a strong and comprehensive response to the DPRK’s latest series of tests aimed at advancing their nuclear weapons program.”

UN diplomats said a vote was expected as early as Friday.

European Union: 10 Days to Collapse, $1.4 Trillion Euros

Posted on by

EU has 10 days to see progress on migrant crisis or Schengen unravels: EU commissioner

BRUSSELS (Reuters) – European Union has 10 more days to see significantly lower inflows of migrants and refugees from Turkey “or else there is risk the whole system will completely break down”, EU Migration Commissioner Dimitris Avramopoulos said on Thursday.

Avramopoulos was speaking after the bloc’s justice and home affairs ministers met in Brussels on Thursday in an effort to put a European solution to the crisis in place. A growing number of EU states are resorting to unilateral border tightening, unraveling the continent’s free-travel Schengen zone.

The study estimated that under a worst case scenario, in which the reintroduction of controls at EU borders pushed import prices up three percent, the costs to the bloc’s largest economy Germany could be as much as 235 billion euros between 2016 and 2025, and those to France up to 244 billion.

At a minimum, with import prices rising one percent, the study showed that a breakdown of Schengen would cost the EU roughly 470 billion euros over the next decade.

The cost would climb to 1.4 trillion euros, or roughly 10 percent of annual gross domestic product (GDP) in the 28-member EU bloc, under the more dire scenario.

“If border controls are reinstated within Europe, already weak growth will come under additional pressure,” said Aart De Geus, president of Bertelsmann.

Schengen was established over 30 years ago and now counts 26 members, 22 of which are EU members. But the system of passport-free travel has come under severe pressure over the past half year due to a flood of migrants entering Europe, mainly from the Middle East and Africa.

To stem the tide and to ensure they have an overview of who is entering their territory, many countries within Schengen have reintroduced border controls in recent months, leading to fears the whole system could collapse.

Underscoring the urgency of the issue, Germany’s Interior Minister Thomas de Maiziere told public broadcaster ARD on Sunday that EU member states, which have been squabbling for months over how to tackle the migrant crisis, must agree a common approach within two weeks if they wanted to avoid such a fate.

In addition to being a devastating symbolic setback for Europe, a collapse of Schengen would increase the amount of time it takes for goods to be transported across European borders, raising costs for companies and consumers.

The Bertelsmann study, conducted by Prognos AG, estimated that the minimum costs to Germany and France would be 77 billion euros and 80.5 billion euros, respectively, over the period to 2025.

A collapse of Schengen would also increase costs for countries outside the zone, with the combined burden on the United States and China over the next decade estimated at between 91 billion and 280 billion euros, according to the study.

More here.

*** EU’s migration system close to ‘complete breakdown’

EuroNews: The EU’s migration system is on the point of complete breakdown, according to a top European Commission official.

Dimitris Avramopoulos, the European Commissioner for migration, issued the stark warning after a meeting between EU interior ministers on Thursday.

inRead invented by Teads

“In the next ten days, we need tangible and clear results on the ground, otherwise there is a danger, there is a risk that the whole system will completely break down. There is no time for uncoordinated actions,” he told reporters in Brussels.

A number of EU countries have introduced border checks amid disagreements over how to best handle the huge influx of refugees and migrants into Europe.

Austria irked some EU officials by calling a mini summit with Western Balkan nations – without inviting Greece or Germany

The Austrian government has also set a daily cap on how migrants per day are allowed to enter the country, ignoring a warning from European Commission lawyers

“We have to recover our ability to act – and that will only be possible when the European external border is protected,” said Johanna Mikl-Leitner, the Austrian interior minister.

“If Greece stresses over and over again that it is not possible to protect the Greek border…we have to ask the question if it’s possible that the external border of the Schengen area stays in Greece.”

The Schengen area is a passport-free travel zone including 26 countries, of which 22 are EU member states.

But the migration crisis, which saw more than a million people reach Europe last year, has left some observers to question whether the whole system may be at risk.

The influx of migrants has exposed divisions between EU governments, which are trading accusations of blame and resulting beggar-thy-neighbour policies to tighten border controls.

Belgium became the seventh Schengen member on Wednesday to introduce border checks as it became clear that a court in Lille would order the partial demolition of the infamous Calais ‘Jungle’ refugee camp.

 

Terror Incubation in Europe and U.S.

Posted on by

Israel says Iran building terror network in Europe, US

AP ~ NICOSIA, Cyprus (AP) — Israel’s defense minister on Wednesday accused Iran of building an international terror network that includes “sleeper cells” that are stockpiling arms, intelligence and operatives in order to strike on command in places including Europe and the U.S.

Moshe Yaalon said Iran aims to destabilize the Middle East and other parts of the world and is training, funding and arming “emissaries” to spread a revolution. He said Tehran is the anchor of a “dangerous axis” that includes Baghdad, Damascus, Beirut, Sanaa and other cities in the region.

“The Iranian regime through the Iranian Revolutionary Guard corps is building a complex terror infrastructure including sleeping cells that are stockpiling arms, intelligence and operatives and are ready to act on order including in Europe and America,” Yaalon said after talks with his Cypriot counterpart.

Israel considers Iran the biggest threat to the region, citing its support for anti-Israel militant groups like Hezbollah and Hamas, and has been an outspoken critic of the international nuclear deal with Iran.

The Israeli defense minister offered no direct evidence of such sleeper cells existing in the U.S. or Europe, but referred indirectly to the case of a Hezbollah member who was jailed in Cyprus last June following the seizure of nine tons of a chemical compound that can be converted into an explosive.

A Cypriot court sentenced Lebanese Canadian Hussein Bassam Abdallah to six years in prison after prosecutors said he admitted that Hezbollah aimed to mount terrorist attacks against Israeli interests in Cyprus using the ammonium nitrate that he had been ordered to guard at the Larnaca home of another official of the Iranian-backed group.

Yaalon said Cypriot authorities had “defeated attempts by Hezbollah and Iran to establish a terror infrastructure” on the island that aimed to expand “throughout Europe.”

Yaalon said that apart from the refugee crisis, the war in Syria has resulted in “widespread infiltration by murderous, merciless terror organizations” that belong to global jihad and are partly funded by Iran.

He said that requires western nations to counter attempts to carry out “massive terror attacks.”

Yaalon’s trip to Cyprus was the first official visit by an Israeli defense minister to the east Mediterranean island.

***

Up To 5,000 Islamic State Trained Jihadists Could Be At Large In Europe — Says U.K. Head Of Europol –‘ Islamic State, And/Or, Other Religious Terror Groups,’ Actively Planning Mass Casualty Attack/s Somewhere In Europe 

FC: Robin Wainwright, the British head of Europol, Europe’s International Crime Agency, in an interview with Germany’s Neue Osnabrucker Zeitung newspaper warned that “up to 5,000 jihadists could be at large in Europe, after training with the Islamic State in Iraq and Syria.”  

Justin Huggler, reporting in the February 19, 2016 edition of London’s The Telegraph, writing from Berlin, writes that “Europol estimates the number of EU citizens who have slipped back [into Europe] after training in the Middle East, is between 3,000 – 5,000..  “Europe is currently facing the highest terror threat in more than ten years,” according to Mr. Wainwright.  “We can expect the Islamic State, or other religious terror groups to stage an attack somewhere in Europe — with the aim of achieving mass casualties among the civilian population.”

The Core of the Hillary Server Controversy, Revealed

Posted on by

Once a year, those who handle classified information must attend a refresher class on dealing with classified material and the consequences of violating the rules governing classified material. My guess is Hillary and her circle of aides and protectors waived themselves from attending. Obama approved?

I guess there is a good reason it is called ‘Foggy Bottom’.

Spy agencies say Clinton emails closely matched top secret documents: sources

WASHINGTON (Reuters) – U.S. spy agencies have told Congress that Hillary Clinton’s home computer server contained some emails that should have been treated as “top secret” because their wording matched sections of some of the government’s most highly classified documents, four sources familiar with the agency reports said.

    The two reports are the first formal declarations by U.S. spy agencies detailing how they believe Clinton violated government rules when highly classified information in at least 22 email messages passed through her unsecured home server.

    The State Department has already acknowledged that the emails contained top secret intelligence, though it says they were not marked that way. It has not previously been clear if the emails contained full classified documents or only some information from them.

    The agencies did not find any top secret documents that passed through Clinton’s server in their full version, the sources from Congress and the government’s executive branch said.

    However, the agency reports found some emails included passages that closely tracked or mirrored communications marked “top secret,” according to the sources, who all requested anonymity. In some cases, additional classification markings meant access was supposed to be limited to small groups of specially cleared officials.

Under the law and government rules, U.S. officials and contractors may not transmit any classified information – not only documents – outside secure, government-controlled channels. Such information should not be sent even through the government’s .gov email network.

The front-runner for the Democratic nomination for president and former secretary of state has insisted she broke no rules. Clinton’s lawyer, David Kendall, did not respond to a request for comment. Clinton campaign spokespeople did not respond to multiple requests for comment.

Two sources said some of the top secret material was related to the CIA’s campaign of drone strikes against Islamist militants in the Middle East and South Asia.

That campaign has been widely reported by Reuters and other media outlets, but it officially is classified as a “Top Secret/Special Access Program” (SAP), meaning only a limited number of people whose names are on a special list are allowed to learn details about it.

One source said the reports identified some information in messages on Clinton’s server that came from human sources, such as confidential CIA informants, and some from technical systems, such as spy satellites or electronic eavesdropping.

The Clinton campaign criticized the State Department’s decision last month to withhold the 22 emails containing top secret information from the public, blaming it on “bureaucratic infighting” and “over-classification run amok.”

“As we have previously made clear, we are not going to speak to the content of the emails,” a State Department official said on Wednesday when asked about the intelligence agency reports.

Clinton’s use of a private server in her New York home for her government work is being investigated by the Federal Bureau of Investigation, the State Department’s and spy community’s internal watchdogs and several Republican-controlled congressional committees.

Two of the sources told Reuters that one of the reports on the emails came from the CIA. Three sources said the other report came from the National Geospatial Intelligence Agency (NGA), which analyzes U.S. spy satellite intelligence.

A spokesman for NGA did not immediately respond to requests for comment. CIA spokespeople declined to comment.

The two spy agencies’ reports were sent to Congress in the past few weeks by the intelligence community inspector general, an official government watchdog for multiple spy agencies.

The inspector general’s office has confirmed that it requested the reports from two intelligence agencies, but didn’t identify them.

    It was unclear what the congressional committees that received the classified reports, the House and Senate intelligence and foreign relations panels, will do with them. The contents cannot be discussed publicly. The committees requested intelligence reports in connection with their efforts to ensure that government secrets are appropriately protected.

Sidebar:

Everyone who handles Classified Material signs the SF-312 that outlines handling according to EO 13526 that requires an annual refresher course for originators of Classified Materials. Section 1 outlines handling. Section 4 is agreement to punishment if violation is discovered. Text of SF-312 below:

1. Intending to be legally bound, I hereby accept the obligations contained in this Agreement in consideration of my being granted access to classified information. As used in this Agreement, classified information is marked or unmarked classified information, including oral communications, that is classified under the standards of Executive Order 13526, or under any other Executive order or statute that prohibits the unauthorized disclosure of information in the interest of national security; and unclassified information that meets the standards for classification and is in the process of a classification determination as provided in sections 1.1, 1.2, 1.3 and 1.4(e) of Executive Order 13526, or under any other Executive order or statute that requires protection for such information in the interest of national security. I understand and accept that by being granted access to classified information, special confidence and trust shall be placed in me by the United States Government.

4. I have been advised that any breach of this Agreement may result in the termination of any security clearances I hold; removal from any position of special confidence and trust requiring such clearances; or termination of my employment or other relationships with the Departments or Agencies that granted my security clearance or clearances. In addition, I have been advised that any unauthorized disclosure of classified information by me may constitute a violation, or violations, of United States criminal laws, including the provisions of sections 641, 793, 794, 798, *952 and 1924, title 18, United States Code; *the provisions of section 783(b}, title 50, United States Code; and the provisions of the Intelligence Identities Protection Act of 1982. I recognize that nothing in this Agreement constitutes a waiver by the United States of the right to prosecute me for any statutory violation.

The IAEA’s Big Challenge of Iran’s Nuclear Program

Posted on by

  $150 billion or $50 billion, should take care of the financial shortfall. What say you?

The full GAO report here.

Will IAEA be able to verify Iran’s nuclear program

alMonitor: The UN nuclear agency will face “challenges” verifying Iran’s compliance with last year’s nuclear agreement, the US government watchdog said Feb. 23 in a new report that was immediately used as ammunition by critics of the deal.

The International Atomic Energy Agency (IAEA) faces a budget and staffing shortfall that will require an extra $10 million per year for the next 15 years to monitor the deal, according to the Government Accountability Office (GAO). The report goes on to detail the agency’s dependence on Iranian cooperation to access nuclear sites and the intrinsic difficulty in detecting undeclared activities such as weapons development and centrifuge manufacturing that do not leave a nuclear trace.

Sen. Robert Menendez, D-N.J., said the report raises concerns about “the entity that we are putting all our marbles in.” He commissioned the report with Sen. Mark Kirk, R-Ill., a fellow critic of the deal who also voted against it last year.

“Some of the preliminary findings cause concern for me about what the IAEA is capable of,” Menendez told Secretary of State John Kerry at a hearing on the department’s FY 2017 budget request. “The GAO [report] point[s] directly to future problems with monitoring, verifying and meeting requirements of the [Iran deal].”

Kirk used the report to call on Congress to prepare sanctions that can be imposed if Iran starts to cheat on its nuclear obligations. He and Menendez are pushing for the reauthorization of the Iran Sanctions Act, a decade-old law that expires at the end of the year.

“My biggest takeaway is lawmakers must come together in a bipartisan manner now to create an insurance policy for imposing crippling pressure if and when Iran once again cheats on nuclear inspections as it has so many times in the past,” Kirk said in a statement. “International inspectors, according to the GAO’s interim report, still face an ‘inherent challenge’ in detecting undeclared nuclear activities, including weapons development activities and centrifuge manufacturing. The report also cites concerns the IAEA’s decision to end investigations into Iran’s past nuclear weapons activities ‘could reduce the indicators at the IAEA’s disposal to detect undeclared activity.’ Indeed, GAO also warns the nuclear deal’s mechanism for IAEA inspectors to gain access to Iranian sites suspected of having undeclared nuclear activities remains ‘untested’ and cautions ‘it is too soon to tell whether it will improve access.’”

Among the concerns raised by the GAO report is the sheer amount of manpower the Iran deal will consume. The agency is expected to have to transfer 18 “experienced inspectors” and “nearly twice that number of other staff” to its Iran Task Force, the GAO concludes, raising concerns about proliferation in other countries.

The State Department is proposing a $191 million US contribution to the agency in its FY 2017 budget request, a $5 million increase over the current year, to help the agency meet its new obligations.

*** 

In part by Rubin at WaPo:

Last week the administration warned that a sale of Russian advanced jets to Iran would violate the United Nations ban on such equipment. Sanctions guru Mark Dubowitz tells me, “Congress should draw up a list of Russian and Iranian entities to be sanctioned, give the administration 30 days to impose sanctions on these entities, and, if there’s no action, move ahead with statutory designations of these entities.”

That thinking needs to be applied across the board, taking into account all aspects of Iran’s behavior. Iran acts with impunity because it is convinced (rightly) the administration will do nothing. If the White House won’t, then Congress must act. Full article here.