Chilling Details of the Sony Hack, Reported

These Are the Cyberweapons Used to Hack Sony

MotherBoard: In late November 2014, a mysterious group of hackers calling itself “God’sApstls” sent an ominous and jumbled email to a few high-level Sony Pictures executives.

“The compensation for it, monetary compensation we want,” the hackers wrote. “Pay the damage, or Sony Pictures will be bombarded as a whole.”

The executives at the Hollywood studio, which was about to release the controversial James Franco and Seth Rogen’s comedy The Interview, ignored the email. Just three days later, the hackers’ followed through with their threat and breached the studio’s systems, displaying a message on the computer screen of every employee: “Hacked by #GOP [Guardians of Peace].”

The hackers not only defaced employee’s computers, they then wiped their hard disks, crippling Sony Pictures for weeks, and costing the company $35 million in IT damages, according to its own estimate.

Now, more than a year later, several security researchers are still hunting down the hackers behind the attack, which the FBI officially identified as North Korean government-employed hackers. And despite the fact that the group is apparently still alive and well, a coalition of security researchers believes they can now disrupt them by exposing their extensive malware arsenal.

On Wednesday, a group of companies led by Novetta released a report detailing the Sony hackers’ long history of operations, as well as its large stock of malware. It’s perhaps the most detailed and extensive look at the group behind what might be the most infamous cyberattack ever.

Andre Ludwig, the senior technical director at Novetta Research and Interdiction Group, said that the investigation started from four hashes (values that uniquely identify a file) that the Department of Homeland security published after the attack. With those few identifying strings, and after months of sleuthing, the researchers found 2,000 malware samples, both from online malware portal VirusTotal, as well as from antivirus companies. Of those, they manually reviewed and catalogued 1,000, and were able to identify 45 unique malware strains, revealing that the Sony hackers had an arsenal more sophisticated and varied than previously thought.

The researchers hope that by shedding light on the hackers’ toolkit, the group, which the researchers called “Lazarus Group,” will be forced to adapt, spending resources and time, and perhaps even lose capabilities after antivirus companies and potential targets put up new defenses.

“There is no more shadows to hide in for these tools.”

“If all of a sudden you have antivirus signatures that detect and delete all the group’s arsenal, boom!” Jaime Blasco, the chief scientist at AlienVault Labs and one of the researchers who investigated the Sony hackers, told Motherboard. “They lose access to all the victims’ they got before.”

As Ludwig put it, “there is no more shadows to hide in for these tools.”

As it turns out, the hackers’ arsenal contains not only malware capable of wiping and destroying files on a hard disk like the Sony hack, but also Distributed Denial of Service (DDoS) tools, tools that allow for remotely eavesdropping on a victim’s computer, and more, according to the report. The researchers tracked some of this tools in cyberattacks and espionage operations that go as far as back as 2009, perhaps even 2007, showing the hackers that hit Sony have a long history.

While others suspected this before, Blasco said that nobody demonstrated it as conclusively until now.

Novetta researchers and their partners, which include AlienVault and Kaspersky Lab, don’t get into saying who the hackers really are, but they also don’t question the FBI’s controversial claim that North Korea was behind the attack.

The main reason, LaMontagne explained, is that the new data they found discredits the alternative theories that the hackers were actually a disgruntled former employee or just an independent hacktivist group.

A former Sony system administrator is unlikely to have built more than 45 malware tools in the span of more than seven years, LaMontagne told me. And the same time, he added, it’s also unlikely that a previously unheard of hacktivist group would pop up, claim responsibility for such a high-profile attack, and then disappear.

“They’re extremely motivated, regimented, organized, and they can definitely execute.”

“We have no reason to dispute what the US government and other governments have asserted as the threat being North Korean,” Peter LaMontagne, the CEO of Novetta, told me.

And as it turns out, those hackers have been around for longer than anyone thought—wielding sophisticated weapons. This, according to the researchers, shows the group was much more seasoned than anyone believed.

“Their motivation and operational execution, it’s impressive,” Ludwig said. “They’re extremely motivated, regimented, organized, and they can definitely execute.”

Now that their methods and tools are exposed, however, the researchers hope that they won’t be as effective.

The head-scratcher is sanctions are only for the missile test?

US to present UN sanctions resolution on North Korea

United Nations (United States) (AFP) – The United States will on Thursday present a draft UN resolution toughening sanctions on North Korea after reaching agreement with China on a joint response to Pyongyang’s fourth nuclear test and a rocket launch.

The UN Security Council will meet at 2:00 pm (1900 GMT) to discuss the draft text detailing a new package of measures to punish North Korea, but there will be no immediate vote.

US Ambassador Samantha Power “intends to submit for consideration by the Security Council a draft sanctions resolution in response to the DPRK’s recent nuclear test and subsequent proscribed ballistic missile launch,” US spokesman Kurtis Cooper said, using the abbreviation for North Korea’s formal name.

“We look forward to working with the Council on a strong and comprehensive response to the DPRK’s latest series of tests aimed at advancing their nuclear weapons program.”

UN diplomats said a vote was expected as early as Friday.

European Union: 10 Days to Collapse, $1.4 Trillion Euros

EU has 10 days to see progress on migrant crisis or Schengen unravels: EU commissioner

BRUSSELS (Reuters) – European Union has 10 more days to see significantly lower inflows of migrants and refugees from Turkey “or else there is risk the whole system will completely break down”, EU Migration Commissioner Dimitris Avramopoulos said on Thursday.

Avramopoulos was speaking after the bloc’s justice and home affairs ministers met in Brussels on Thursday in an effort to put a European solution to the crisis in place. A growing number of EU states are resorting to unilateral border tightening, unraveling the continent’s free-travel Schengen zone.

The study estimated that under a worst case scenario, in which the reintroduction of controls at EU borders pushed import prices up three percent, the costs to the bloc’s largest economy Germany could be as much as 235 billion euros between 2016 and 2025, and those to France up to 244 billion.

At a minimum, with import prices rising one percent, the study showed that a breakdown of Schengen would cost the EU roughly 470 billion euros over the next decade.

The cost would climb to 1.4 trillion euros, or roughly 10 percent of annual gross domestic product (GDP) in the 28-member EU bloc, under the more dire scenario.

“If border controls are reinstated within Europe, already weak growth will come under additional pressure,” said Aart De Geus, president of Bertelsmann.

Schengen was established over 30 years ago and now counts 26 members, 22 of which are EU members. But the system of passport-free travel has come under severe pressure over the past half year due to a flood of migrants entering Europe, mainly from the Middle East and Africa.

To stem the tide and to ensure they have an overview of who is entering their territory, many countries within Schengen have reintroduced border controls in recent months, leading to fears the whole system could collapse.

Underscoring the urgency of the issue, Germany’s Interior Minister Thomas de Maiziere told public broadcaster ARD on Sunday that EU member states, which have been squabbling for months over how to tackle the migrant crisis, must agree a common approach within two weeks if they wanted to avoid such a fate.

In addition to being a devastating symbolic setback for Europe, a collapse of Schengen would increase the amount of time it takes for goods to be transported across European borders, raising costs for companies and consumers.

The Bertelsmann study, conducted by Prognos AG, estimated that the minimum costs to Germany and France would be 77 billion euros and 80.5 billion euros, respectively, over the period to 2025.

A collapse of Schengen would also increase costs for countries outside the zone, with the combined burden on the United States and China over the next decade estimated at between 91 billion and 280 billion euros, according to the study.

More here.

*** EU’s migration system close to ‘complete breakdown’

EuroNews: The EU’s migration system is on the point of complete breakdown, according to a top European Commission official.

Dimitris Avramopoulos, the European Commissioner for migration, issued the stark warning after a meeting between EU interior ministers on Thursday.

“In the next ten days, we need tangible and clear results on the ground, otherwise there is a danger, there is a risk that the whole system will completely break down. There is no time for uncoordinated actions,” he told reporters in Brussels.

A number of EU countries have introduced border checks amid disagreements over how to best handle the huge influx of refugees and migrants into Europe.

Austria irked some EU officials by calling a mini summit with Western Balkan nations – without inviting Greece or Germany

The Austrian government has also set a daily cap on how migrants per day are allowed to enter the country, ignoring a warning from European Commission lawyers

“We have to recover our ability to act – and that will only be possible when the European external border is protected,” said Johanna Mikl-Leitner, the Austrian interior minister.

“If Greece stresses over and over again that it is not possible to protect the Greek border…we have to ask the question if it’s possible that the external border of the Schengen area stays in Greece.”

The Schengen area is a passport-free travel zone including 26 countries, of which 22 are EU member states.

But the migration crisis, which saw more than a million people reach Europe last year, has left some observers to question whether the whole system may be at risk.

The influx of migrants has exposed divisions between EU governments, which are trading accusations of blame and resulting beggar-thy-neighbour policies to tighten border controls.

Belgium became the seventh Schengen member on Wednesday to introduce border checks as it became clear that a court in Lille would order the partial demolition of the infamous Calais ‘Jungle’ refugee camp.

 

U.S. Poised to Take on China Aggressions

The Pentagon Readies Backup Island in Case of Chinese Missile Onslaught

Threat prompts the U.S. military to prepare a fallback option

WiB: The United States can no longer count on its Pacific air bases to be safe from missile attack during a war with China. On the contrary, a 2015 paper from the influential RAND Corporation noted that in the worst case scenario, “larger and accurate attacks sustained over time against a less hardened posture could be devastating, causing large losses of aircraft and prolonged airfield closures.”

Kadena Air Base in Okinawa, due to its relative proximity, would be hardest hit. To up the stakes, China in September 2015 publicly revealed its DF-26 ballistic missile, which can strike Andersen Air Force Base in Guam — nearly 3,000 miles away — from the Chinese mainland. Andersen and Kadena are among the U.S. military’s largest and most important overseas bases.

Enter Tinian. The lush, small island near Guam is emerging as one of the Air Force’s backup landing bases. On Feb. 10, the flying branch announced that it selected Tinian as a divert airfield “in the event access to Andersen Air Force Base, Guam, or other western Pacific locations is limited or denied.”

In the Pentagon’s 2017 budget request, it asked for $9 million to buy 17.5 acres of land “in support of divert activities and exercise intiatives,” the Saipan Tribune reported. In peacetime, the expanded Tinian airfield will host “up to 12 tanker aircraft and associated support personnel for divert operations,” according to the Air Force.

7637127318_661f4e4d60_kAbove — Tinian’s West Field in 1945. At top — Tinian seen from the cockpit of a C-130H. U.S. Air Force photo

Tinian is now a sleepy place.

During World War II, the 4th and 2nd Marine Divisions captured the island, which later based the B-29 Superfortresses Enola Gay and Bockscar which took off from Tinian’s North Field and dropped the atomic bombs on Hiroshima and Nagasaki. An arsenal during the war, most of its airstrips are now abandoned and unused. The island’s other former air base, West Field, is a small, neglected international airport.

The Air Force first wanted Saipan for its airfield. Very close to Tinian, Saipan has 15 times the population, a larger airport and a harbor. But this proposal met opposition from local activists due to the effect on “coral, potable water, local transportation and socioeconomic factors on surrounding communities,” Stars and Stripes reported.

The opposition even included the pro-business Saipan Chamber of Commerce, which worried that Tinian’s rusty airport would miss out on the flood of Pentagon spending. Saipan’s airport is also overcrowded — with locals not happy about the prospect of hundreds of airmen flying in for military exercises lasting up to eight weeks ever year.

In a way, its a return to the past. The United States dispersed air bases to varying degrees — and in different parts of the world — during the Cold War, but as the threat of a Soviet missile attack evaporated and post-Persian Gulf War budget cuts hit hard in the 1990s, the trend shifted toward larger mega-bases that operate on economies of scale.

But dispersed bases are more survivable, RAND’s Alan Vick noted in his 2015 paper:

Dispersing aircraft across many bases creates redundancy in operating surfaces and facilities. This enhances basic safety of flight by providing bases for weather or inflight-emergency diverts. It also increases the number of airfields that adversary forces must monitor and can greatly complicate their targeting problem (in part by raising the prospect that friendly forces might move among several bases).

 

At the least, dispersal (because it increases the ratio of runways to aircraft) forces an attacker to devote considerably more resources to runway attacks than would be the case for a concentrated force. It also greatly increases construction and operating costs to spread aircraft across many major bases. To mitigate these costs, dispersal bases tend to have more-modest facilities and, at times, might be nothing more than airstrips.

Terror Incubation in Europe and U.S.

Israel says Iran building terror network in Europe, US

AP ~ NICOSIA, Cyprus (AP) — Israel’s defense minister on Wednesday accused Iran of building an international terror network that includes “sleeper cells” that are stockpiling arms, intelligence and operatives in order to strike on command in places including Europe and the U.S.

Moshe Yaalon said Iran aims to destabilize the Middle East and other parts of the world and is training, funding and arming “emissaries” to spread a revolution. He said Tehran is the anchor of a “dangerous axis” that includes Baghdad, Damascus, Beirut, Sanaa and other cities in the region.

“The Iranian regime through the Iranian Revolutionary Guard corps is building a complex terror infrastructure including sleeping cells that are stockpiling arms, intelligence and operatives and are ready to act on order including in Europe and America,” Yaalon said after talks with his Cypriot counterpart.

Israel considers Iran the biggest threat to the region, citing its support for anti-Israel militant groups like Hezbollah and Hamas, and has been an outspoken critic of the international nuclear deal with Iran.

The Israeli defense minister offered no direct evidence of such sleeper cells existing in the U.S. or Europe, but referred indirectly to the case of a Hezbollah member who was jailed in Cyprus last June following the seizure of nine tons of a chemical compound that can be converted into an explosive.

A Cypriot court sentenced Lebanese Canadian Hussein Bassam Abdallah to six years in prison after prosecutors said he admitted that Hezbollah aimed to mount terrorist attacks against Israeli interests in Cyprus using the ammonium nitrate that he had been ordered to guard at the Larnaca home of another official of the Iranian-backed group.

Yaalon said Cypriot authorities had “defeated attempts by Hezbollah and Iran to establish a terror infrastructure” on the island that aimed to expand “throughout Europe.”

Yaalon said that apart from the refugee crisis, the war in Syria has resulted in “widespread infiltration by murderous, merciless terror organizations” that belong to global jihad and are partly funded by Iran.

He said that requires western nations to counter attempts to carry out “massive terror attacks.”

Yaalon’s trip to Cyprus was the first official visit by an Israeli defense minister to the east Mediterranean island.

***

Up To 5,000 Islamic State Trained Jihadists Could Be At Large In Europe — Says U.K. Head Of Europol –‘ Islamic State, And/Or, Other Religious Terror Groups,’ Actively Planning Mass Casualty Attack/s Somewhere In Europe 

FC: Robin Wainwright, the British head of Europol, Europe’s International Crime Agency, in an interview with Germany’s Neue Osnabrucker Zeitung newspaper warned that “up to 5,000 jihadists could be at large in Europe, after training with the Islamic State in Iraq and Syria.”  

Justin Huggler, reporting in the February 19, 2016 edition of London’s The Telegraph, writing from Berlin, writes that “Europol estimates the number of EU citizens who have slipped back [into Europe] after training in the Middle East, is between 3,000 – 5,000..  “Europe is currently facing the highest terror threat in more than ten years,” according to Mr. Wainwright.  “We can expect the Islamic State, or other religious terror groups to stage an attack somewhere in Europe — with the aim of achieving mass casualties among the civilian population.”

Russia Win in Syria, now What for Saudi Coalition

Senate foreign policy chairman: Russia the winner in Syria’s civil war

TheHill: The outcome of Syria’s long-running civil war is effectively settled, according to the head of the Senate Foreign Relations Committee.

And Russia won.

“Let’s face it: This is close to over now,” Sen. Bob Corker told reporters at a breakfast sponsored by The Christian Science Monitor on Wednesday.

“It is very difficult at present, with Russia having stepped into the vacuum … now it’s a direct conflict with Russia,“ Corker added, “which is why there’s unlikely to be a Plan B.”

American inaction, Corker maintained —particularly following President Obama’s failure to act on the “red line” he imposed in 2013 with regard to the use of chemical weapons —has effectively empowered Russia’s support of embattled leader Bashar Assad.

“Let’s face it: We are empowering Assad,” Corker maintained on Wednesday.

“When we did not hit Assad in September of 2013 and said to the world —said to the world —that we could not be counted on. … Who propped up Assad more than anyone? We did!” Corker exclaimed. “We began by propping up Assad and making these hollow comments about ‘He had to go.’”

Corker’s comments on Wednesday came on the heels of this week’s announcement that the U.S. and Russia had reached a “cessation of hostilities”scheduled to go into effect on Saturday.

The arrangement, which many viewed skeptically, will allow for continued airstrikes against the Islamic State in Iraq and Syria (ISIS) and other designated terror groups. However, it calls for both sides to stop seeking new territory and allow for humanitarian aide to pass through.

Washington and Moscow have been at odds in the Syrian chaos. While both countries have claimed to be trying to root out terrorists, Russian forces have frequently targeted U.S.-backed rebels trying to unseat Assad from power.

According to Corker, Russia won’t change its calculus until challenges against Assad have been wiped out.

Pentagon, CIA Chiefs Don’t Think Russia Will Abide by Syria Cease-Fire

Emerging alliance of Russia hawks in cabinet exposes disagreement in the administration

WSJ:

WASHINGTON—President Barack Obama’s top military and intelligence advisers, convinced Russia won’t abide by a cease-fire in Syria, are pushing for ways to increase pressure on Moscow, including expanding covert military assistance for some rebels now taking a pounding from Russian airstrikes.

Defense Secretary Ash Carter; Marine Gen. Joseph Dunford, the chairman of the Joint Chiefs of Staff; and Central Intelligence Agency Director John Brennan have voiced increasingly tough views in White House meetings, calling for new measures to “inflict real pain on the Russians,” a senior administration official said.

The emerging alliance of Russia hawks exposes discord among defense and diplomatic officials and could put pressure on Mr. Obama to take stronger action against Moscow. But doing so risks pulling the U.S. deeper into a proxy fight in Syria, with Moscow showing little sign of lessening its support for President Bashar al-Assad.

The Syrian government said Tuesday it accepted the proposed cease-fire, announced a day earlier by the U.S. and Russia. But it said military operations would continue not only against Islamic State and the al Qaeda-linked Nusra Front—both designated by the United Nations as terrorist organizations—but against “other terrorist groups connected to them” as well.

Russia and the Assad regime have branded all rebel groups as terrorists—further clouding prospects for any truce.

The opposition’s delegation to U.N.-mediated peace talks in Geneva said late Monday it supported the U.S.-Russia deal, with several conditions related to humanitarian issues.

Russia’s bombing campaign in Syria, launched last fall, has infuriated the CIA in particular because the strikes have aggressively targeted relatively moderate rebels it has backed with military supplies, including antitank missiles, U.S. officials say.

Officials say it was unclear whether stepped-up support would make much difference at this stage, given how much ground the CIA-backed rebels have lost in the recent pro-regime offensive.

Mr. Obama has been reluctant to allow either the U.S. or its regional partners to supply the rebels with advanced ground-to-air antiaircraft weapons to fend off airstrikes. While introducing that sort of system could be a game-changer, any decision to help the rebels directly go after Russian soldiers or destroy Russian airplanes could mark a dramatic escalation.

At the heart of the debate is how much confidence to place in diplomacy at this point in the Syria drama.

On Capitol Hill on Tuesday, Secretary of State John Kerry said there have been discussions within the administration over what strategy to pursue “in the event we don’t succeed” in negotiations. He noted the president has the ability to take additional actions against Moscow.

But Mr. Kerry also said that “this is a moment to try to see whether or not we can make this work, not to find ways to preordain its failure and start talking about all the downsides of what we might do afterward.”

Officials said neither Mr. Carter nor Gen. Dunford had formally submitted recommendations to Mr. Obama.

Pentagon press secretary Peter Cook declined to comment, as did a spokesman for the CIA director. Navy Capt. Greg Hicks, a spokesman for Gen. Dunford, said the general’s recommendations were private.

A senior administration official said of the White House’s review: “We’ll judge Russia by its actions, not its words.”

The official added: “To be clear: Our actions are not aimed at Russia. Our focus, however, does not change the fact that Russia, by increasingly involving itself in a vicious conflict on the side of a brutal dictator, will become enmeshed in a quagmire. Should it not change course, Russia’s fate will be self-inflicted.”

Aside from expanding the CIA program, other options under discussion include providing intelligence support to moderate rebels to help them better defend themselves against Russian air attacks and to possibly conduct more effective offensive operations, officials said.

Another option with wide support among Mr. Obama’s advisers would impose new economic sanctions against Russia. But senior administration officials said they doubt European powers would go along, given the importance they place on trade with Russia.

The drawn-out negotiations with Moscow this month over a cease-fire agreement in Syria exposed the growing rift within the administration.

Mr. Carter had publicly voiced support for the negotiations led by Mr. Kerry. But while the talks were under way last week, Messrs. Carter and Brennan, and Gen. Dunford, privately warned the White House they risked undermining Washington’s standing with regional partners in the two U.S.-led coalitions—one in support of anti-Assad rebels, the other fighting Islamic State, the senior officials said.

At one point last week, the Pentagon came close to withdrawing its representatives from the cease-fire talks after the Russians claimed military cooperation between the U.S. and Russia was part of the closed-door discussions, according to senior administration officials.

Mr. Carter was upset about the Russian claims because he had explicitly ruled out such discussions, the officials said.

The Pentagon believes Russia was trying to try to drive a wedge between the U.S. and its coalition partners and to make it look like Washington would support Moscow’s military campaign in Syria and accept Mr. Assad.

While Russia was engaged in the cease-fire talks, U.S. officials say its war planes stepped up their attacks on positions held by moderate rebels. Russia maintains its airstrikes are targeting terrorist groups.

Mr. Kerry believes Monday’s agreement has “a viable chance of succeeding,” according to a senior administration official close to the secretary.

In contrast, Mr. Carter told senior officials Monday that it won’t hold. “He thinks it’s a ruse,” a senior administration official said.

Messrs. Carter and Brennan and Gen. Dunford raised many of their concerns in meetings last week involving Mr. Kerry, White House National Security Adviser Susan Rice and White House Chief of Staff Denis McDonough, according to senior administration officials.

The senior administration official close to Mr. Kerry said the secretary recognized the challenge of ensuring Russian compliance. The official added that the agreement was partially intended to test whether Moscow can be trusted. If Russia doesn’t abide by the deal, then “Plan-B thinking needs to occur,” the official said.

Mr. Kerry has supported the CIA program in Syria in the past and has advocated for greater military involvement, such as the creation of a safe zone to protect the moderate opposition. But the Pentagon has been resistant to such ideas, warning they could lead to a conflict with Russia, administration officials have said.

Senior administration officials involved in the discussions said it is unclear whether Mr. Obama would support expanding the CIA program.

Ms. Rice, Mr. McDonough and other senior national security officials at the White House have voiced skepticism in the past about the CIA effort.

White House critics of the program warned that open-ended support for the rebels could pull the U.S. deeper into the conflict over time, with little chance of success as long as Moscow remains willing to increase its support to Mr. Assad, according to former administration officials.

Current and former officials said Mr. Obama was persuaded in 2013 to green-light the covert program in Syria in part because doing so gave the CIA influence over the actions of regional partners, including Saudi and Turkish intelligence, preventing them, for example, from introducing advanced antiaircraft weapons known as Manpads on the battlefield. Washington warned the weapons could fall into terrorist hands and be turned against commercial aircraft.

If the U.S. doesn’t take action to prevent moderate rebel forces from being wiped out by the Russian-backed offensive, then the Saudis or some other group could decide to break ranks with Washington and send large numbers of Manpads into northern Syria to shoot down Russian bombers, U.S. intelligence agencies have warned policy makers, increasing the chances of a wider conflict.