N Korean Hackers’ Heist from Taiwan Bank

Posted on October 18, 2017October 18, 2017 by Denise Simon

Taiwan Bank Heist Linked to North Korean Hackers

A recent cyber-heist that targeted a bank in Taiwan has been linked by security researchers to an infamous threat group believed to be operating out of North Korea.

Hackers exploited the SWIFT global financial network to steal roughly $60 million from Taiwan’s Far Eastern International Bank. The money was transferred to several countries, but bank officials claimed they had managed to recover most of it. Two individuals were arrested earlier this month in Sri Lanka for their role in the operation.

Researchers at BAE Systems have identified some of the tools used in the attack and found connections to the North Korean threat actor known as Lazarus. This group is also believed to be behind the 2014 attack on Sony Pictures and campaigns targeting several banks, including Bangladesh’s central bank.

The attack on the Bangladesh bank, which resulted in the theft of $81 million, also involved the SWIFT system. Similar methods were also used to target several other banks, but SWIFT said some of the operations failed due to the new security measures implemented by the company.

While it’s still unclear how attackers gained access to the systems of Far Eastern International Bank, an analysis of various malware samples apparently involved in the attack suggests that the hackers may have used a piece of ransomware as a distraction.

The ransomware involved in the attack is known as Hermes. According to Bleeping Computer, the threat surfaced in February and its latest version has an encryption mechanism that makes it impossible to recover files without paying the ransom.

However, researchers at McAfee discovered that the Hermes variant used in the attack on the Taiwanese bank did not display a ransom note, which led them to believe it may have been only a distraction.

“Was the ransomware used to distract the real purpose of this attack? We strongly believe so,” McAfee researchers said. “Based on our sources, the ransomware attack started in the network when the unauthorized payments were being sent.”

BAE Systems has seen samples that drop a ransom note in each encrypted folder, but even they believe Hermes may have been used to distract the bank’s security team.

Another malware sample linked by BAE Systems to this attack is a loader named Bitsran, which spreads a malicious payload on the targeted network. This threat contained what appeared to be hardcoded credentials for Far Eastern International’s network, which suggests the threat group may have conducted previous reconnaissance.

Some pieces of malware discovered by BAE Systems are known to have been used by the Lazarus group, including in attacks aimed at financial organizations in Poland and Mexico. The malware includes commands and other messages written in Russia, which experts believe is likely a false flag designed to throw off investigators.

It’s worth noting that the Hermes ransomware samples checked the infected machine’s language settings and stopped running if Russian, Ukrainian or Belarusian was detected. This is common for malware created by Russian and Ukrainian hackers who often avoid targeting their own country’s citizens. However, this could also be a false flag.

Another piece of evidence linking the Taiwan bank attacks to Lazarus is the fact that money was transferred to accounts in Sri Lanka and Cambodia, similar to other operations attributed to the group.

Some experts believe that these bank heists and the WannaCry attack, which has also been linked by some to Lazarus, are campaigns launched by North Korea for financial gain. However, many of these operations don’t appear to have been very successful on this front.

“Despite their continued success in getting onto payment systems in banks, the Lazarus group still struggle getting the cash in the end, with payments being reversed soon after the attacks are uncovered,” BAE Systems researchers explained.

“The group may be trying new tricks to disrupt victims and delay their ability to respond – such as different message formats, and the deployment of ransomware across the victim’s network as a smokescreen for their other activity. It’s likely they’ll continue their heist attempts against banks in the coming months and we expect they will evolve their modus operandi to incorporate new ways of disrupting victims (and possibly the wider community) from responding,” they added.

photo

*** Related reading: The Lazarus (aka DarkSeoul group) is allegedly controlled by Bureau 121, a division of the Reconnaissance General Bureau, a North Korean intelligence agency. Bureau 121 is responsible for conducting military cyber campaigns.

*** By the way, some of the North Korean hackers not only operate in China but many of those hackers are from India….

6,000 is the number of hackers working for North Korea, traced by American and British security officials.

Once scoffed at, North Korea’s cyber technology has now developed to a brink where it can create a havoc in the world’s cybersecurity. From theft to political agenda, North Korea now launches attacks in the form of ransomware, digital bank heists, online video game cracks and Bitcoin exchanges.

In the first week of October, India’s Ministry of External Affairs issued a strongly-worded statement condemning North Korea for conducting a powerful nuclear test. Few weeks down the line, a stunning report from the New York Times claims that India serves as a base for North Korea’s cyber warfare.

Citing a report by the Recorded Future, the American publication said nearly a fifth of the Pyongang’s attacks originate from India.

The report claims that most of North Korean cyber operations are carried out from foreign countries like India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, and Indonesia. While in some cases, the North Korean hackers route their attacks through their computers from abroad, in cases like that in India, hackers are physically stationed to carry out attacks.

The cyber mission as envisaged by Kim Jong-il in the 1990s was expanded by his dictator son Kim Jong-Un after he took power in 2011.

On of the most successful cyber attacks carried out by North Korea dates back to 2014 on Sony pictures to prevent them from releasing a comedy film that was based on the assassination of Kim Jong Un.

Last May, a widespread global ransomware attack caused panic and briefly stalled the Britain’s National Health Services.

The digital bank heists in Philippines in 2015 and in Vietnam in the same year also earned them some hard cash from cyber attacks.

The report by Recorded Future also indicates that India, despite serving as a base for North Korea’s cyberwar, also remains at a potential threat from similar attacks. While the world lives under the fear of North Korea emerging as a nuclear superpower, the country is silently building a strong brigade of hackers.

Scope of Russian Troll Operation Explained

Posted on October 17, 2017October 17, 2017 by Denise Simon

Information warfare = Troll warfare

Russian journalists publish massive investigation into St. Petersburg troll factory’s U.S. operations

A day after Dozhd television published an interview with a former member of Russia’s infamous Internet Research Agency, the magazine RBC released a new detailed report on the same organization’s efforts to meddle in U.S. domestic politics. Meduza summarizes RBC’s new report here.

photo

The Internet Research Agency, Russia’s infamous “troll farm,” reportedly devoted up to a third of its entire staff to meddling in U.S. politics during the 2016 presidential election. At the peak of the campaign, as many as 90 people were working for the IRA’s U.S. desk, sources told RBC, revealing that the entire agency employs upwards of 250 people. Salaries for staff working in the U.S. department apparently range from 80,000 to 120,000 rubles ($1,400 to $2,100) per month.

The head of the IRA’s U.S. desk is apparently a man originally from Azerbaijan named Dzheikhun Aslanov (though he denies any involvement with the troll factory).

In August and September this year, Facebook, Instagram, and Twitter suspended 118 communities and accounts run by the St. Petersburg “troll factory,” disabling a network capable of reaching 6 million subscribers. In 2016, at the height of the U.S. presidential campaign, this network reportedly produced content that reached 30 million people each week.

A source also told RBC that the Internet Research Agency spent almost $80,000 over two years, hiring roughly 100 local American activists to stage about 40 rallies in different cities across the United States. The activists were hired over the Internet, communicating in English, without their knowledge that they were accepting money or organizing support from a Russian organization. According to RBC, internal records from the IRA verify its role in these activities.

The main activity in the troll factory’s U.S. desk was to incite racial animosity (playing both sides of the issue), and promoting the secession of Texas, objections to illegal immigration, and gun rights.

RBC estimates that the Internet Research Agency’s total salary expenses approach $1 million per year, with another $200,000 allocated to buying ads on social media and hiring local activists in the U.S.

According to RBC, the IRA still has a U.S. desk, though its staff has apparently dropped to 50 employees.

Note: Formally, the Internet Research Agency ceased to exist roughly two years ago, rebranding itself under different names, but sources say the organization continues to operate as before.

***

One part of the factory had a particularly intriguing name and mission: a “Department of Provocations” dedicated to sowing fake news and social divisions in the West, according to internal company documents obtained by CNN.

Prigozhin is one of the Kremlin’s inner circle. His company is believed to be a main backer of the St. Petersburg-based “Internet Research Agency” (IRA), a secretive technology firm, according to US officials and the documents reviewed by CNN. Prigozhin was sanctioned by the US Treasury Department in December of 2016 for providing financial support for Russia’s military occupation of Ukraine. Two of his companies, including his catering business, were also sanctioned by Treasury this year.

CNN has examined scores of documents leaked from Prigozhin’s companies that show further evidence of his links to the troll factory.

One contract provided IRA with ways to monitor social media and a “system of automized promotion in search engines.”

Prigozhin has a colorful past. He spent nine years in prison in the 1980s for fraud and robbery, according to Russian media reports. After his release, he went into the catering business — renovating a boat and opening New Island, one of a half-dozen upscale restaurants he owns in St. Petersburg. Putin turned to him to cater his birthday parties as well as dinners with visiting leaders, including President Bush and Jacques Chirac of France. A headline in The Moscow Times referred to Prigozhin as Putin’s “Personal Chef.”

Prigozhin subsequently won lucrative catering contracts for schools and Russia’s armed forces. He escorted Putin around his new food-processing factory in 2010. By then he was very much a Kremlin insider with a growing commercial empire. More here.

***

Trolling NATO? Yuppers

Seventy percent of Russian-language tweets targeting NATO military activities in Eastern Europe are generated by automated Russian trolls, according to a survey done by the military alliance.

“Two in three Twitter users who write in Russian about the NATO presence in Eastern Europe are robotic or ‘bot’ accounts,” the NATO Strategic Communications Centre of Excellence stated in a report made public this week.

The Russian bots sent 84 percent of all Russian language messages. English language tweets against the alliance also were found to be automated, with some 46 percent generated by automated Twitter accounts.

The report criticized the global social media platform for not doing enough to counter Russian bot activities on Twitter. “Our impression is that Twitter in Russian is policed less effectively than it is in English,” the report said.

A Twitter spokesman could not be reached for comment. Colin Crowell, Twitter’s vice president for public policy, stated in a recent post on the company website that “we strictly prohibit the use of bots and other networks of manipulation to undermine the core functionality of our service.” Read more here.

Should Voting Machines be Part of Critical Infrastructure?

Posted on October 16, 2017October 16, 2017 by Denise Simon

At present, there are sixteen critical infrastructure sectors, including twenty subsectors that are eligible to receive prioritized cybersecurity assistance from the Department of Homeland Security. The existing critical infrastructure sectors are:

Chemical
Commercial Facilities
Communications
Critical Manufacturing
Dams
Defense Industrial Base
Emergency Services
Energy
Financial Services
Food and Agriculture
Government Facilities
Healthcare and Public Health
Information Technology
Nuclear Reactors, Material, and Waste
Transportation Systems
Water and Wastewater Systems

***

WE: op election officials from around the country met this weekend to create the formal organization to hash out what powers and lines of communications the Department of Homeland Security should have after the department designated voting systems in the states and territories as “critical infrastructure” earlier this year.

By voting to adopt a charter for a “Government Coordinating Council,” the secretaries of state now have a group that has an official channel and a single “voice” to communicate with DHS.

The move marks the first major step in the coming together between the nonpartisan National Association of Secretaries of State, or NASS, and DHS, amidst a contentious and sometimes mistrusting year.

“The other importance of the coordinating council actually being formed, is that there is so much activity on the federal level regarding legislation, I think this will give us, hopefully, a venue to help us inform members of the U.S. Senate and House of Representatives that states are taking an active role and we are doing a lot to prepare ourselves for the 2018 elections and beyond,” said NASS President and Indiana Secretary of State Connie Lawson.

Lawson and six other secretaries of state were in Atlanta this weekend for the first real efforts at coordinating between the states and DHS.

Although DHS has insisted from the start their “critical infrastructure” designation doesn’t give them any actual powers or authority over state and local voting systems, local officials have been wary. They say they can’t be sure DHS wasn’t encroaching on authority reserved explicitly to the states until DHS had clearly delineated their mission and what they hoped to accomplish with the critical infrastructure tag.

NASS and even U.S. senators and representatives expressed serious concern that although DHS knew for months about attempted “hacks” around the time of the 2016 elections, the affected states weren’t notified by DHS until this past September.

When the local election officials were finally notified, it immediately generated headlines around the country that “21 states” were the victims of some kind of hacking attempts on their voting systems, or on computer systems that may have been linked to the same offices as the voting systems.

However, in the intervening weeks, at least four states have come forward – California, Texas, Wisconsin, and Arizona – and disputed to some degree the DHS finding that they were the victims of a hack attempt.

Elected officials on Capitol Hill were upset as well when the “21 states” news broke.

“It’s unacceptable that it took almost a year after the election to notify states that their elections systems were targeted, but I’m relieved that DHS has acted upon our numerous requests and is finally informing the top elections officials in all 21 affected states that Russian hackers tried to breach their systems in the run up to the 2016 election,” said Sen. Mark Warner, D-Va., who serves on the Senate Intelligence Committee, which has taken an active role in trying to look at election vulnerabilities from 2016 in order to create more voting security in the future.

Lawson said NASS officials were still concerned about the lack of communication, but were also not trying to harp on the topic at this weekend’s meeting in Atlanta.

“I can’t say we’ve set it [communications issues] aside, but I can say we are just trying to make sure that things like this don’t happen again, that we all use the same terminology, that there’s a chain of communication that needs to take place,” Lawson told the WashingtonExaminer.

“We’re cautiously optimistic that things are going to get better,” she said.

Besides discussing the communications issues and communications chains in the event of problems in the future, Lawson said the coordinating council also discussed goals and deliverables.

“Those are just big, high-level pictures,” Lawson said.

“And then, who’s going to do the work, and how are we going to make sure that DHS has the support they need to stand up this coordinating council.”

“It was a logistical issue just being able to get everybody here because there wasn’t an official council at the time,” Lawson added later.

Secretary of Homeland Security Jeh Johnson originally made the critical infrastructure designation in the last days of the Obama administration. However, not long after, then-DHS Secretary John Kelly said the Trump administration had no plans to rescind the designation.

Apart from DHS, representatives from Election Assistance Commission were in attendance as well.

“State and local officials have already taken a number of steps to improve the security of the nation’s elections, and under the Government Coordinating Council we will be able to further leverage resources and our collective expertise,” said Bob Kolasky, the acting deputy under secretary of the DHS National Protections and Programs Directorate in a statement.

“The security of the nation’s elections are critical to our democracy, and DHS stands ready to support this important mission through exercises, information sharing, and technical cyber analysis and expertise.”

Facebook Scrubbed Data, Possible Obstruction of Investigation

Posted on October 12, 2017October 12, 2017 by Denise Simon

Blame ‘crowdtangle’ among others. As noted on their site: ‘the easiest way to keep track of what’s happening of social media. Other sites such as meltwater broadcasts that they are ‘influencers’ and then leaderboards are created such that real or hoax operations become a trending topic.

Lots of fake news gets blamed on bloggers posing as official media outlets while quoting unnamed sources and rightly so. Some of those blogs are concoctions of Moscow while others websites repeated fake stories stoking issues and divisions within the United States from Russia media outlets such as Sputnik News and RT.

Facebook is the location of choice for millions to park links and fake items resulting in Facebook often being referred to as Fakebook.

Moscow, along with out social media tech software in the United States created algorithms that counted ‘likes and ‘shares’ which then manifested unreliable stories and questionable sources. These analytic tools have become the norm across the world and consequentially having credibility and reliance on issues or stories has fallen.

It all boils down to communication, collaboration, branding, feedback and scoring results. You are the sheep, money is made from your activity on social media with every keystroke and you don’t get paid a dime….secret financial extortion, meaning without your knowledge unless you read ALL the mice type. Facebook is a master and frankly a player where you are being punked.

This is yet another form of cyber-warfare….

Facebook scrubbed potentially damning Russia data before researchers could analyze it further

Facebook scrubbed thousands of posts shared during the 2016 campaign by accounts linked to Russia.

The removals came as a Columbia University researcher was examining their reach.

Facebook says the posts were removed to fix a glitch.

BI: Facebook removed thousands of posts shared during the 2016 election by accounts linked to Russia after a Columbia University social media researcher, Jonathan Albright, used the company’s data analytics tool to examine the reach of the Russian accounts.

Albright, who discovered the content had reached a far broader audience than Facebook initially acknowledged, told The Washington Post on Wednesday that the data had allowed him “to at least reconstruct some of the pieces of the puzzle” of Russia’s election interference.

“Not everything, but it allowed us to make sense of some of this thing,” he said.

Facebook confirmed that the posts had been removed, but said it was because the company had fixed a glitch in the analytics tool — called CrowdTangle — that Albright had used.

“We identified and fixed a bug in CrowdTangle that allowed users to see cached information from inactive Facebook Pages,” said Andy Stone, a Facebook spokesman.

Facebook’s decision to remove the posts from public view raised questions about whether the company could be held liable for suppressing potential evidence, given its role in the wide-ranging investigation of Russia’s election interference.

Albright told Business Insider that “because this is clearly a legal and imminent justice-related matter, I can’t provide much critical insight at this stage.

“I feel like my 10 rounds with the $500 billion dollar tech juggernaut are over,” he said.

Legal experts and scholars on the subject say scrubbing the data Albright used for his research is Facebook’s prerogative as long as it isn’t knowingly removing content sought under a court order or by government request.

“If Facebook has no reason to think that it should retain the data (subpoena, court order), then it can make choices about what appears on its platform,” said Danielle Citron, a professor of law at the University of Maryland, where she teaches and writes about information privacy.

Citron said Facebook and other private tech companies have in the past argued, successfully, that they have free speech interests and enjoy immunity from liability for the content posted by their users — immunity that extends to their ability to remove it if it violates their terms of service.

Albert Gidari, the director of privacy at the Stanford Center for Internet and Society, said it’s likely that Facebook has kept copies of “anything at issue as part of its preservation obligation” in light of special counsel Robert Mueller’s search warrant and the House and Senate Intelligence Committee subpoenas.

Gidari said that because there hasn’t been any allegation against Facebook itself, the company has no obligation, absent a court order, to maintain information “that later may be evidence.”

But the question becomes more complicated when considering the ethical obligations of a company whose tools were exploited by a foreign adversary to try to influence a US election.

Gidari, for his part, said he doesn’t think “any platform has an independent or ethical obligation to run a research playground for third-party data analysts.”

But Tom Rubin, a lecturer at Stanford Law School, said that Facebook’s “credibility as a global social platform and its responsibility as an internet giant require it to fully embrace an independent, urgent and public review of the facts.”

“Facebook’s Russia predicament is of its own doing — it controls the platform, runs the ads, and profits mightily,” said Rubin, who previously served as the assistant US Attorney in New York heading investigations and prosecutions of computer crimes.

“The investigation here is as serious as it gets: illegal and hostile foreign influence on the US presidential election,” Rubin said. “The issue confronting Facebook is the extent to which it should commit to complete transparency, and the answer to that is straightforward.”

Citron agreed.

“For transparency’s sake and for our broader interest in our democracy, people should know the extent to which they have been played by the Russians and how a hostile state actor has interfered with, manipulated, and generally hacked our political process,” she said.

That is what Albright said was his mission when he downloaded the last 500 posts shared by six accounts that Facebook has confirmed were operating out of Russia. Those accounts — Blacktivists, Being Patriotic, Secured Borders, Heart of Texas, LGBT United, and Muslims of America — were among the 470 pages Facebook shut down in September as part of its purge of “inauthentic accounts” linked to Russia’s Internet Research Agency.

The data Albright obtained using CrowdTangle showed that the Russians’ reach far exceeded the number of Facebook users they were able to access with advertisements alone — content including memes, links, and other miscellaneous postings was shared over 340 million times between the six accounts.

The other 464 accounts closed by Facebook have not yet been made public. If they are, an analysis of their combined posts would likely reveal that their content was shared an estimated billions of times during the election.

WC-135 Dispatched to Investigate Europe for Radiation

Posted on October 11, 2017October 11, 2017 by Denise Simon

Gotta look deep for information and there are two theories, one is Russia as the other is the medical industry. Humm….it goes something like this…. By the way, the dates could easily lineup.

Primer:

The Washington Free Beacon quotes Pentagon officials saying the unmanned underwater vehicle, code named Kanyon by the Pentagon, was test-launched from the Sarov-class submarine on November 27th.

What Pentagon names Kanyon is what in Russia is known as the «Ocean Multipurpose System Status-6» – a top secret weapon system the world has never seen anything like before. A year ago, Russian state-TV Channel One showed a glimpse of a graphic slide of the Status-6, later on said to be an unauthorized leak of a secret weapon development plan.

The drawings on the slide could very well be a purpose leak aimed at telling the world what weapon-systems are under development. The TV news covered the meeting in Sochi where President Putin was told by high-ranking officers in the Strategic forces how Russia’s nuclear deterrence strategy is developing. Moscow are looking for ways to overcome the United States’ Anti-Ballistic Missile Defence system, and one answer is to go deep with the nukes. Highly suggested reading more here.

Mysterious Radiation Spike Across Europe

Nuclear scientists are struggling to determine the source of small amounts of nuclear radiation that bloomed over Europe throughout January.

France’s IRSN institute, the public body for radiological and nuclear risks, announced in a statement on February 13 that Iodine-131, a radionuclide of human origin, was detected in trace amounts at ground-level atmosphere in continental Europe. First detected in the second week of January over northern Norway, Iodine-131 presence was then detected over Finland, Poland, Germany, Czech Republic, France, and Spain. However, the levels have since returned to normal and scientists have yet to determine the source of the radiation.

Norway’s Radiation protection Authority (NRPA), which first detected the Iodine-131 over its northern Russian border, told Motherboard over the phone today that the levels present essentially no risk to human health. “I can assure you that the levels are low,” said a press a spokesperson.

But with a half-life of just eight days, the detection of Iodine-131 is proof of a recent release, said IRSN in its statement to the media.

Rumors are circulating, of course, that Russia has secretly tested a low-yield nuclear weapon in the Arctic, possibly in the Novaya Zemlya region—historically used for Russia’s nuclear tests. Iodine-131, discovered by two University of California researchers in 1938, is a radioisotope synonymous with the atomic bomb tests carried out by the US and Russia throughout the 1950s, and has recently presented threats from leaking during the Chernobyl nuclear power plant disaster and the 2011 Fukushima nuclear accident.

But Iodine-131 is also found in the medical industry, commonly used for treating thyroid-related illnesses and cancers. Astrid Liland, head of the section for emergency preparedness at the NRPA, told Motherboard in an email today, “Since only Iodine-131 was measured, and no other radioactive substances, we think it originates from a pharmaceutical company producing radioactive drugs.
Iodine-131 is used for treatment of cancer.”

Particulate Iodine-131 (value +/- uncertainty) in the atmosphere(µBq/m3). Image: IRSN

Britain’s Society for Radiological Protection (SRP) also told Motherboard that the exclusive presence of Iodine-131 suggests the source is not a nuclear incident, but rather a medical facility such as a hospital or a supplier of radio-pharmaceuticals. “The release was probably of recent origin. Further than this it is impossible to speculate,” the SRP’s Brian Gornall told Motherboard in an email.

Still, where exactly that pharma company could be located is unknown. “Due to rapidly changing winds, it is not possible to track exactly where it came from. It points to a release source somewhere in Eastern Europe,” Liland told Motherboard.

The Iodine cloud prompted the United States Air Force to send over a specialized particle-sniffing aircraft to investigate. As per reports on The Aviationist, a US Air Force WC-135 deployed to Royal Air Force base Mildenhall in the UK on February 17, equipped to test the atmosphere over Europe for radiation. The aircraft’s last intercontinental expedition was to analyse the atmosphere over the Korean Peninsula following an alleged North Korean nuclear test.

The deployment spurred on rumors of a nuclear test from Russia, but a spokesperson for the the Comprehensive Nuclear-Test-Ban Treaty Organization (CTBTO), an international body that monitors nuclear weapon tests, told Motherboard in an email today, “Although some readings of I-131 above minimal detection level have been observed since beginning of year in Europe nothing extraordinary has been measured.”

The IRSN said in its statement that the data has now been shared between the members of the informal European network called Ring of Five, a group of organizations that research radiation levels in the atmosphere.