Articles by "CYBER WAR"
Tampilkan postingan dengan label CYBER WAR. Tampilkan semua postingan

di 0
CYBER WAR : A group of highly sophisticated state-sponsored hackers is spying on the Israeli military by hacking into the personal Android phones of individual soldiers to monitor their activities and steal data.
A newly released research by Lookout and Kaspersky suggests that more than 100 Israeli servicemen from the Israeli Defense Force (IDF) are believed to have been targeted with spyware.
Hackers Are Using Android Malware To Spy On Israeli Military Personnel


Dubbed ViperRAT, the malware has specifically been designed to hijack Israeli soldiers’ Android-based smartphones and remotely exfiltrate data of high value, including photos and audio recordings, directly from the compromised devices.

Modus Operandi Identified

According to the security firms, IDF personnel had been compromised by social engineering techniques — where the soldiers were lured via Facebook Messenger and other social networks into entering communications with hackers who posed as attractive women from various countries like Canada, Germany, and Switzerland.
The soldiers were then tricked into installing a trojanized version of two different, typically legitimate Android chat apps, SR Chat and YeeCall Pro, for easier communication.
The malware has also been distributed using a dropper hidden in other Android smartphone applications including a billiards game, an Israeli Love Songs player, and a Move To iOS app, which are common to Israeli citizens and available in the Google Play store.


The app then scanned soldiers' smartphones and downloaded another malicious application that masqueraded as an update for one of the already installed apps, such as WhatsApp, and tricked victims to allow various permissions in order to carry out surveillance.
This, in turn, allowed the attackers to execute on demand commands, enabling them to control phone's microphone and camera, eavesdrop on soldiers' conversations, and peer into live camera footage.
Besides this, the ViperRAT malware gathers a broad range of data from compromised devices including geolocation, call log, personal photos, SMS messages, cell phone tower information, network and device metadata, internet browsing, and app download history.

According to researchers, the hackers were able to successfully establish a widespread cyber espionage campaign by compromising dozens of mobile devices from Samsung, HTC, LG and Huawei belonging to over 100 Israeli soldiers.
Besides, almost 9,000 files stolen from compromised devices (roughly 97 percent) that were exfiltrated from compromised devices were identified by Lookout researchers as being highly encrypted images, which were taken using the device camera.
However, it's likely the IDF is not the only target.
The ViperRAT attack campaign started in July and continued to date, according to Kaspersky researchers.

Is Hamas Behind the Cyber-Spying Operation?

The IDF closely worked with Kaspersky Labs and Lookout to investigate this incident and theorized that Hamas was behind these attacks. However, Lookout researchers have come to doubt that theory.
According to Lookout researchers, "Based on tradecraft, the modular structure of code and use of cryptographic protocols [AES and RSA encryption] the actor appears to be quite sophisticated."
Researchers say Hamas is not known for sophisticated mobile capabilities, which makes it unlikely they are directly responsible for ViperRAT.

The IDF is currently working together with both Lookout and Kaspersky to identify infected targets and protect against further attacks, but there is one simple way to protect against ViperRAT: don't download apps from untrusted third-party sources.
Continue reading

di 0
CYBER WAR : Defeated presidential candidate also tells Australia’s Four Corners program that Wikileaks is now ‘a fully owned subsidiary of Russian intelligence’


Monday 16 October 2017 02.53 BST Last modified on Monday 16 October 2017 07.43 BST
Donald Trump’s Twitter account represents a “clear and present danger” to world security, Hillary Clinton has argued.

In an interview on Australian television aired on Monday night Clinton said the Trump’s presidency “certainly is” a risk not just to the US but also “the rest of the world, including Australia”.

Because, she said, of his “use of Twitter”, and his “conducting diplomacy or the lack thereof on Twitter”.

In a wide-ranging interview with ABC Four Corner’s Sarah Ferguson, Clinton said she believed Trump was the most dangerous president the US had ever had.

“I think he is, because he is impulsive, he lacks self-control, he is totally consumed by how he is viewed and what people think of him,” she said.

“So his behaviour traits and his lack of knowledge about how government works and his very, you know, limited curiosity about how to educate himself to actually make better decisions, are quite worrisome.”

Asked whether Australians should be worried, Clinton said “I think the whole world should be concerned”.

During the interview Clinton has repeated her claim that the WikiLeaks founder, Julian Assange, colluded with the Russian government in the lead-up to the 2016 US election, describing him as a “nihilistic opportunist who does the bidding of a dictator”.

She alleged that Assange cooperated with the Russian president, Vladimir Putin, to disrupt the US election and damage her campaign for president.

“WikiLeaks is unfortunately now practically a fully owned subsidiary of Russian intelligence,” Clinton told the ABC’s Sarah Ferguson.

Describing Putin as a “dictator”, Clinton said the damaging email leaks that crippled her 2016 candidacy were part of a coordinated operation against her, directed by the Russian government.


Cyber cold war is just getting started, claims Hillary Clinton
 Read more
“Our intelligence community and other observers of Russia and Putin have said he held a grudge against me because as secretary of state, I stood up against some of his actions, his authoritarianism,” Clinton told the ABC.

“But it’s much bigger than that. He wants to destabilise democracy, he wants to undermine America, he wants to go after the Atlantic alliance, and we consider Australia an extension of that.”

WikiLeaks received thousands of hacked emails from accounts connected to the Democratic campaign allegedly stolen by Russian operatives. The emails were released during a four-month period in the lead-up to the US election.

Emails from the Clinton campaign chairman, John Podesta, were leaked on the same day – 7 October 2016 – the director of national intelligence and the secretary of homeland security released a statement concluding the Russian government had been attempting to interfere in the election.

It was also the day the Washington Post published the 2005 Access Hollywood recording of Donald Trump’s lewd comments about sexually harassing women.

Clinton told the ABC she believed the email leak was coordinated to disrupt the influence of the Access Hollywood tape.

“WikiLeaks, which in the world in which we find ourselves promised hidden information, promised some kind of secret that might be of influence, was a very clever, diabolical response to the Hollywood Access tape,” she said. “And I’ve no doubt in my mind that there was some communication if not coordination to drop those the first time in response to the Hollywood Access tape.”

Clinton is promoting her election memoir, What Happened, in which she details her thoughts on her unsuccessful campaign for president.

In September she told David Remnick from the New Yorker that she believed the Australian founder of WikiLeaks may be “on the payroll of the Kremlin”.


What Happened by Hillary Rodham Clinton – digested read
 Read more
“I think he is part nihilist, part anarchist, part exhibitionist, part opportunist, who is either actually on the payroll of the Kremlin or in some way supporting their propaganda objectives, because of his resentment toward the United States, toward Europe,” she said.

“He’s like a lot of the voices that we’re hearing now, which are expressing appreciation for the macho authoritarianism of a Putin. And they claim to be acting in furtherance of transparency, except they never go after the Kremlin or people on that side of the political ledger.”

Assange has denied the emails came from the Russian government or any other “state parties”.

In response to Clinton’s comments, Assange said on Twitter there was “something wrong with Hillary Clinton”.

“It is not just her constant lying,” he wrote. “It is not just that she throws off menacing glares and seethes thwarted entitlement.

“Something much darker rides along with it. A cold creepiness rarely seen.”
Continue reading

di 0
CYBER WAR : Denmark and Sweden are to boost defence cooperation to counter what they described as a growing threat from Russia, including from “dangerous” fake news campaigns and cyber-attacks, the two countries’ defence ministers have said.

Peter Hultqvist of Sweden and Claus Hjort Frederiksen of Denmark said in a statement before a meeting in Stockholm that Russian hybrid warfare – cyber-attacks, disinformation and fake news – could create uncertainty.

When nations “cannot clearly distinguish false news and disinformation from what is true, we become increasingly unsafe”, the ministers said, adding: “We have both been exposed to forms [of this] and want to better defend our societies in this area.”

This year Stockholm’s Institute of International Affairs accused Russia of using fake news, false documents and disinformation in a coordinated campaign to influence public opinion and decision-making in Sweden.

The study said Sweden had been the target of “a wide array of active measures” including misleading reports on Russian state-run news networks and websites, forged documents, fabricated news items and “troll armies”.



Moscow’s main aim was to “preserve the geo-strategic status quo” by minimising Nato’s role in the wider Baltic region and keeping Sweden out of the international military alliance, the study said.

Hultqvist and Frederiksen said the two countries would also increase more traditional forms of military cooperation, citing the increased presence of Russian naval vessels in the Baltic and airspace violations by Russian military aircraft.

“We already have good cooperation with Sweden and the other Nordic countries, but believe we can expand this more,” Frederiksen said. “We need to stand together when we have an unreasonable Russia moving into the Crimea and building up in our immediate neighbourhood.”

Joint exercises and more cross-border exchanges of military and intelligence expertise would follow, he added.

In January, after accusations that Russian hackers had interfered with the US presidential election, Sweden’s prime minister, Stefan Löfven, told a national defence conference that he could not rule out Russia trying to influence the next Swedish elections, due in 2018.
Continue reading

di 0
CYBER WAR : Thirteen years of negotiations at the United Nations aimed at restricting cyberwarfare collapsed in June, it has emerged, due to an acrimonious dispute that pitted Russia, China and Cuba against western countries.

The split among legal and military experts at the UN, along old cold war lines, has reinforced distrust at a time of mounting diplomatic tension over cyber-attacks, such as the 2016 hacking of the US Democratic National Committee’s (DNC) computers. That break-in was allegedly coordinated by Russian intelligence and intended to assist Donald Trump’s presidential campaign.

Negotiations aimed at forging an international legal framework governing cybersecurity began in 2004. Experts from 25 countries, including the UK and all the other members of the UN security council, participated in the discussions.


Cyberwar: hacking attacks between nations are difficult to prove
 Read more
But in June, diplomats at the UN abandoned any hope of making further progress, amid a row centred on the right to self-defence in the face of cyber-attacks.

At previous sessions, officials accepted that the principles of international law should apply to cyberspace, including the UN charter itself. Article 51 of the charter states that nothing shall “impair the right of individual or collective self-defence” in the face of an armed attack.

The Cuban representative, Miguel Rodríguez, told the final meeting of negotiators that recognising self-defence rights in cyberspace would lead to militarisation of cyberspace and “legitimise … unilateral punitive force actions, including the application of sanctions and even military action by states claiming to be victims” of hacking attacks.

Without naming Russia or China, Michele Markoff, who led the US delegation to the UN’s Group of Governmental Experts (GGE), released a statement in the aftermath of the collapse of negotiations attacking “those who are unwilling to affirm the applicability of these international legal rules and principles”.

Such countries “believe their states are free to act in or through cyberspace to achieve their political ends with no limits or constraints on their actions”, Markoff said. “That is a dangerous and unsupportable view.”

 US homeland security secretary John Kelly and President Donald Trump meet government cyber security experts in January.
Facebook Twitter Pinterest
 The US homeland security secretary, John Kelly, and the president, Donald Trump, meet government cyber security experts in January. Photograph: Chip Somodevilla/Getty Images
Speaking at a cybersecurity conference in Israel after the breakdown of the UN process, a senior Russian official, Oleg Khramov, blamed western countries for the impasse. “Talks about the need to adopt rules of behaviour in the information space remained mere talk. We all were thrown years back,” he said.

Perhaps Russia, China and Cuba want to avoid the perception that ‘the west’ gets to dictate the rules of the game
Mike Schmitt, professor of international law
Mike Schmitt, professor of international law at Exeter University and a former US air force lawyer, has been monitoring the UN GGE discussions. He said he feared a calculated decision has been made by Moscow and Beijing that the west has more to lose if there is no guaranteed right to retaliate against cyber-attacks.

“Perhaps [Russia, China and Cuba] … want to avoid the perception that ‘the west’ gets to dictate the rules of the game for cyberspace,” he wrote on the Just Security blog.

“Or perhaps the answer is legal-operational in the sense that they want to deprive the west of a legal justification for responding to hostile cyber operations that they themselves launch.”



Part of the dispute was over the difficulty of establishing who is responsible for a foreign cyber-attack. Proving whether hackers had state backing is extremely difficult, particularly for countries that do not possess adequate technological resources.

The legal row over cyberwarfare echoes international concerns over the deployment of drones. Both technologies permit the application of force by remote control, effectively lowering the threshold for future conflicts.

Schmitt, who is also the editor of the Tallinn Manual on International Law Applicable to Cyber Warfare, said: “From the western perspective, Russia and China are the two countries they are most concerned about. I’m comfortable with the US intelligence conclusion that the Russians [were responsible for hacking into the DNC].

“There are a number of states that like legal ambiguity because it gives them flexibility. [They] can operate without risking any collective [punishment] for being a lawbreaker … It may not be in their national interest to clarify the law. There are no more sessions planned for the GGE but there are discussions about what to do next.”

The UK foreign office said: “Existing international law applies in cyberspace as it does in other domains. The UN GGE’s inability to agree a consensus in June does not undo previous work. The government is committed to maintaining a free, open, peaceful and secure cyberspace.”
Continue reading

di 0
CYBER WAR : The UK energy sector is likely to have been targeted and probably compromised by nation-state hackers, according to a memo from Britain’s National Cybersecurity Centre.

The NCSC, a subsidiary of GCHQ, warned that it had spotted connections “from multiple UK IP addresses to infrastructure associated with advanced state-sponsored hostile threat actors, who are known to target the energy and manufacturing sectors,” according to Motherboard, which obtained a copy of the document.

This information implies that direct connections are being made between computers in the UK’s energy sector and the attacker’s command-and-control apparatus. Both the Windows data-transfer protocol SMB, and the web backbone HTTP, were used to in the connections, according to Motherboard.


Guardian Today: the headlines, the analysis, the debate - sent direct to you
 Read more
“NCSC believes that due to the use of wide-spread targeting by the attacker, a number of industrial control system engineering and services organisations are likely to have been compromised,” the memo says.

The NCSC has neither confirmed nor denied the memo is genuine. It told the BBC in a statement: “We are aware of reports of malicious cyber-activity targeting the energy sector around the globe … We are liaising with our counterparts to better understand the threat and continue to manage any risks to the UK.”

It makes the UK the third country in the last week to note state-sponsored intrusion of its power grid. Earlier this week, the Times reported on fears that Ireland’s Electricity Supply Board was targeted by a group with ties to the Kremlin, while 18 US-based energy companies were sent phishing emails attempting to steal credentials, according to Cyberscoop.


All the reports appear to be linked, suggesting a widespread campaign to probe energy suppliers for weaknesses, and to steal credentials which may prove useful in future attacks. It is a matter of debate whether such a campaign can itself be called an attack, since no damage has apparently been done, but it will focus attention on the risk to critical infrastructure from cyber-attacks.

In late June, the former chief of the National Grid, Steve Holliday, told the Guardian: “The UK stands out uniquely on cyber threats. Nowhere else is as worried as the UK about cyber threats: we are just off the scale on our energy system concerns on cyber.”

As far back as 2013, security researchers were identifying significant vulnerabilities in power grids that allowed a remote hacker to seize or take control of plant control systems, while Ukraine became one of the first countries to see the physical results of such attacks in 2016, when a blackout across western Ukraine was caused by a malware called “BlackEnergy”.
Continue reading

di 0


CYBER WAR : The UK’s Trident submarine fleet is vulnerable to a “catastrophic” cyber-attack that could render Britain’s nuclear weapons useless, according to a report by a London-based thinktank.

The 38-page report, Hacking UK Trident: A Growing Threat, warns that a successful cyber-attack could “neutralise operations, lead to loss of life, defeat or perhaps even the catastrophic exchange of nuclear warheads (directly or indirectly)”.

The Ministry of Defence has repeatedly said the operating systems of Britain’s nuclear submarines cannot be penetrated while at sea because they are not connected to the internet at that point.


Guardian Today: the headlines, the analysis, the debate - sent direct to you
 Read more
But the report’s authors, the British American Security Information Council (Basic), expressed scepticism.

“Submarines on patrol are clearly air-gapped, not being connected to the internet or other networks, except when receiving (very simple) data from outside. As a consequence, it has sometimes been claimed by officials that Trident is safe from hacking. But this is patently false and complacent,” they say in the report.

Even if it were true that a submarine at sea could not be attacked digitally, the report points out that the vessels are only at sea part of the time and are vulnerable to the introduction of malware at other points, such as during maintenance while docked at the Faslane naval base in Scotland.

The report says: “Trident’s sensitive cyber systems are not connected to the internet or any other civilian network. Nevertheless, the vessel, missiles, warheads and all the various support systems rely on networked computers, devices and software, and each of these have to be designed and programmed. All of them incorporate unique data and must be regularly upgraded, reconfigured and patched.”

Advertisement

The UK has four nuclear missile-carrying submarines, which are in the process of being replaced. Their replacements are scheduled to go into service in the early 2030s.

The report comes after the cyber-attack last month that disrupted the NHS, which uses the same Windows software as the Trident submarines. There was speculation too that the US used cyberwarfare to destroy a North Korean missile test. A Trident test-firing of a missile last year off the coast of Florida also went awry, with no official explanation given.

The report was co-written by Stanislav Abaimov, a researcher in cybersecurity and electronic engineering at the University of Rome and a graduate of the Moscow State Institute of Electronics and Mathematics, and Paul Ingram, Basic’s executive director.

In reaction to the report, Des Browne, who as UK defence secretary in 2007 was responsible for steering the original decision to renew Trident through parliament, said: “The WannaCry worm attack earlier this month affecting 300,000 computers worldwide, including vital NHS services, was just a taste of what is possible when cyber-weapons are stolen.

“To imagine that critical digital systems at the heart of nuclear weapon systems are somehow immune or can be confidently protected by dedicated teams of network managers is to be irresponsibly complacent.”



Abaimov said: “There are numerous cyber vulnerabilities in the Trident system at each stage of operation, from design to decommissioning. An effective approach to reducing the risk would involve a massive and inevitably expensive operation to strengthen the resilience of subcontractors, maintenance systems, components design and even software updates. If the UK is to continue deploying nuclear weapon systems this is an essential and urgent task in the era of cyberwarfare.”

The report’s authors estimate that the capital costs for the UK government to improve cybersecurity for the Trident programme would run to several billions of pounds over the next 15 years.
Continue reading

di 0
CYBER WAR : To appreciate the perversity of our reliance on US technology giants, you just need to grapple with the fact that one of the likely winners in the global “cyber-outage” – caused by the series of crippling cyber-attacks that hit public and private institutions worldwide a week ago – might be the very company whose software was compromised – Microsoft.

The WannaCry ransomware used in the attack wreaked havoc on organisations including FedEx and Telefónica, as well as the NHS, where operations were cancelled, x-rays, test results and patient records became unavailable and phones did not work. In the end the global spread of the attack was halted by an “accidental hero”, a 22-year-old IT security blogger from Ilfracombe, Devon. Marcus Hutchins found and inadvertently activated a “kill switch” in the malware by registering a specific domain name hidden within the program.

But even before the recent WannaCry ransomware attacks, Microsoft – always seeking to deflate any responsibility for the flaws in its products – had been advocating the establishment of the digital equivalent of Geneva conventions that would protect civilians from cyber-attacks launched by nation states. At the same time, such agreements would allocate responsibility to big tech companies that would help to ensure safety online.

Brad Smith, Microsoft’s president, who has been spearheading the company’s efforts over this, has even compared the tech sector to the Red Cross. “Just as the fourth Geneva convention recognised that the protection of civilians required the active involvement of the Red Cross, protection against nation-state cyber-attacks requires the active assistance of technology companies,” he wrote on the company’s blog in February.

In the wake of the WannaCry outage, Microsoft stepped up its rhetoric, with Smith and many others demanding immediate action by governments.

Yet something in this effort seems disingenuous as Microsoft is essentially asking to be given more duties and responsibilities by means of international legislation. And what company would voluntarily desire more such regulations imposed on its global operations?

However, the reasons for such humanitarian enthusiasm – which has become the trademark of the tech industry – are entirely selfish. First, it is an elaborate publicity exercise aimed at presenting cyber-attacks as natural and inevitable, or at least as something that only nation states are responsible for; tech companies, by this logic, are just the victims of sophisticated hacking attacks by the geniuses at intelligence agencies.

Analysis Who is to blame for exposing the NHS to cyber-attacks?
Could the government or intelligence agencies have done more to protect the health service from cybercriminals?
 Read more
This reasoning has little basis in reality: tech giants such as Microsoft enjoy so much market power – not least due to their extensive intellectual property holdings – that they hardly operate in a competitive market environment. This quickly eliminates any incentives to actually make their software as secure as possible, issue regular updates, retire outdated and compromised products early and so on. These firms are fat and lazy, and justify their rentier-like status with highfalutin talk of “disruption” and “innovation”, not to mention that the proprietary nature of their software makes it impossible to examine it for any possible flaws and backdoors.

Second, there is no sign that the US – which has the most sophisticated and extensive government-run hacking apparatus in the world – would sign up to these digital Geneva conventions. This, after all, is the same country that has been refusing to ratify several core protocols of the original Geneva conventions. But even if the Trump administration does miraculously decide to adhere to its digital equivalent – and it would be a miracle because all the evidence suggests Trump hates multilaterial treaties – there are few grounds to believe that the National Security Agency or the CIA would not simply ignore them.


Third, you cannot understand Microsoft’s desire for regulation without understanding what exactly it would entail. Essentially, the complexity of modern cyber-attacks has become so enormous that the only actors capable of shielding us from them are the likes of Google, Facebook and Microsoft. Even many seasoned security professionals now concede that for most cyber-attacks we might be safer using commercial services from big tech giants rather than, say, running our own email servers – a lesson learned by Hillary Clinton.

When artificial intelligence and machine learning become key ingredients in determining what is spam or a malicious attack, it is obvious that whoever controls those resources will also be the key service provider. In this field, there is little or no competition to the big US tech firms. A few Chinese companies are trying to catch up, but not very successfully because this battle also involves a global hunt for the talent and data needed to train the machine-learning systems. How did US tech firms develop this superb capability in artificial intelligence? Some of it has to do with the legacy of the cold war and the massive government funding that it spawned. But some of it comes from the particular nature of the business models, which are greatly facilitated by America’s insistence on the liberalisation of the global trade in services and the removal of any barriers to the free flow of data.


NHS cyber-attack causing disruption one week after breach
 Read more
These business models are quite brutal in their simplicity: firms such as Google and Facebook use advertising to pay for the provision of relatively trivial services, like search or email, in order then to extract and deploy the user data to develop non-trivial products and services, such as self-driving cars or advanced health analytics capable of diagnosing diseases early on.

In essence, the concentration of the most valuable resource of the new century – artificial intelligence – in Silicon Valley makes US tech firms impossible to disrupt, allowing them to create new opportunities for rent-extraction. In the case of cybersecurity and the “digital Geneva conventions”, Microsoft’s game plan is clear: once nation states formally recognise the company as the digital equivalent of the Red Cross, it should also lead to lucrative private contracts to offer cybersecurity protection – all of that, obviously, at a hefty fee. Thus, in addition to regularly extracting rent from the users of its software, Microsoft can now also extract additional rent from those very users for protecting the very software that they are renting in the first place – no one really buys or owns anything in the digital world, it all belongs to platform operators.

Advertisement

The conflict of interest here would be mind-boggling: the more insecure Microsoft’s software, the greater the demand for its cybersecurity services to protect it. Worse, governments – instead of doing something to curb such conflicts of interest – are only aggravating them. They allow tech companies to use their intelligence services as scapegoats while also creating a secondary market in cyberweapons that can then be used by petty criminals to instil terror and dread in the population. No wonder there are people demanding that some version of the digital Geneva conventions pass: the horrors, imposed by the tag team of government and industry, are just too painful to endure.

Cybersecurity that has been turned into a service is a perfect example of how the surveillance imperatives of modern governments – with the US leading the way – create almost infinite opportunities for monopolistic rent extraction by tech firms. In essence, every time you read that something is offered as a service – as in “cloud as a service” or “mobility as a service” – it is almost always a bland euphemism for legalised rent extraction that has a large tech company as the middle man.

Thanks to digitisation and automation, it is obvious that the future providers of most services are those that happen to own the data – and the advanced artificial intelligence powered by it. They might preach the values of brotherly love, decentralisation and hippiedom but the new giants of Silicon Valley are just the latest generation of rentiers who are far more likely to become a drag on the rest of the economy than to produce the infinite digital abundance that they promise.
Continue reading
Langganan: Postingan (Atom)