Information Technology

Unless you’ve been living under a rock, you know that our digital infrastructure is under attack. ZDNet’s excellent security coverage has daily updates, usually with names I’ve never heard of before. As the ZDNet security tagline says, “Let’s face it. Software has holes. And hackers love to exploit them. New vulnerabilities appear almost daily.” 

ZDNet Recommends

Sadly, that’s not hyperbole. “SolarWinds attack is not an outlier, but a moment of reckoning for security industry, says Microsoft exec” is a recent headline. 
Vasu Jakkal, Microsoft’s corporate vice president of security, compliance and identity, said,

“These attacks are going to continue to get more sophisticated. So we should expect that. This is not the first and not the last. This is not an outlier. This is going to be the norm. This is why what we do is more important than ever. I believe that SolarWinds is a moment of reckoning in the industry. This is not going to change and we have to do better as a defender community and we have to be unified in our responses.”

But Ms. Jakkal is wrong. Private enterprise can’t handle serious, nation state digital aggression. Nations have the resources and patience to pursue long term strategies. Even the largest corporations lack the heft of a nation.
Microsoft estimates that at least 1,000 engineers were needed to develop the SolarWinds hack. What company, what consortium of companies, could devote similar resources? 
We don’t send defense contractors to fight wars. We send armed forces, backed by intelligence agencies and diplomacy – as well as the weapons defense contractors develop – to defeat the enemy.  
Digital aggression is aggression
Scale changes everything is a Silicon Valley truism. Back when the Internet’s predecessor, ARPAnet, was five nodes, there was no money in digital crime.

Now the Internet is five billion nodes. Deep into the transition to a digital civilization, crime is following the money. The thieves, gangs, and nation-state bad actors are stealing everything that isn’t locked down. Money, industrial secrets, intelligence assets, and personal data.
There’s no end in sight since “software engineering” is an oxymoron. As Randall Munroe had a software writer say on xkcd.com: “. . . our entire field is bad at what we do, and if you rely on us, everyone will die.” We don’t know how to build a digital dike that doesn’t leak. We can only plug holes after the bad guys find them.
Strategically, deterrence seems to be the only option for persuading nation states to back off. And only a strong nation can persuade another nation to chill, as the Cold War showed. 

Likewise, today’s Internet needs a police force as well. The Internet is borderless, so a global force is needed to bring the criminals to heel.
Despite massive private investment in digital security, the stakes keep rising and the hacks are getting worse. Private enterprise isn’t working. Private efforts to coordinate across organizations to record and analyze attacks are not enough.
Can the US government take this on?
Don’t reflexively dismiss the idea that government could handle this. Consider the US armed forces, the world’s most powerful fighting force. Handsomely funded, well-trained, and constantly analyzing the threats America faces. That’s a blueprint for US Digital Defense Force.
Perhaps you recoil at the thought of higher taxes to pay for the DDF. But the choice isn’t between no taxes and higher taxes. Criminals and nation-states – in Russia, they may be one and the same – are already collecting massive taxes to fund their aggression. The choice is essentially between paying for digital order and security, or paying the criminals.

The take
America’s adversaries are actively probing our infrastructure for vulnerabilities. America’s superiority in conventional forces – for now anyway – makes a big shooting war unlikely. But crippling America’s government, power, water, energy, and medical systems all at once would help even the odds if someone wanted to take us down.
The current model of digital security isn’t working, nor is there a plan to fix it. Sorry Microsoft, you – and the rest of the private firms – don’t have the chops to take on Russia, Iran, and North Korea. 
We’ve been here before. London in the early 1800s was a city of 1.3 million people with no central police force. In 1829 Parliament established the Metropolitan Police to bring order and security. Private firms and wealthy individuals had guards, but that was not enough.
Like 1820s London, we need to be a well-funded and trained force to stop digital muggers, gangs, and conspiracies, whether private or nation sponsored. And our government to make it clear that countries that mess with our digital infrastructure will face painful consequences.
Comments welcome. If you don’t like the government idea, what would you do instead? More

The White House team leading the investigation into the SolarWinds hack is worried that the breach of 100 US companies has the potential to make the initial compromise a headache in future.
Anne Neuberger, deputy national security advisor for Cyber and Emerging Technology at the White House, said in a press briefing that nine government agencies were breached while many of the 100 private sector US organizations that were breached were technology companies. 

More on privacy

“Many of the private sector compromises are technology companies including networks of companies whose products could be used to launch additional intrusions,” said Neuberger, a former director of cybersecurity at the National Security Agency.
SEE: Network security policy (TechRepublic Premium)
Attackers that the US says are of “likely Russian origin” had compromised the software build system of US software vendor SolarWinds and planted the Sunburst backdoor in its widely used Orion product for monitoring enterprise networks.   
That 100 private sector firms were breached in the attack paints a different picture to what was known in December, when Microsoft and FireEye, that were both breached, disclosed the attack. 
At that stage there were eight federal agencies confirmed to have been breached, including the US Treasury Department, the Department of Homeland Security, the US Department of State, the US Department of Energy, and the National Nuclear Security Administration.   

However, back then Microsoft and FireEye were the two most significant private sector companies known to have been compromised by the tainted Orion update (the Orion updates weren’t the only way that companies were infiltrated during the campaign, which also involved the hackers gaining access to cloud applications).
“When there is a compromise of this scope and scale both across government and across the US technology sector to lead to follow-on intrusions, it is more than a single incident of espionage. It’s fundamentally of concern for the ability of this to become disruptive,” Neuberger explained during questioning. 

ZDNet Recommends

She stressed that the attackers were “advanced” because the “level of knowledge they showed about the technology and the way they compromised it truly was sophisticated.”
“As a country we chose to have both privacy and security, so the intelligence community largely has no visibility into private sector networks. The hackers launched the hack from inside the United States, which further made it difficult for the US government to observe their activities,” she said.
Microsoft president Brad Smith told 60 Minutes last week that it was “probably fair to say that this is the largest and most sophisticated attack the world has ever seen.”
SEE: How do we stop cyber weapons from getting out of control?
Smith previously said the attackers “used a technique that has put at risk the technology supply chain for the broader economy.”
“We believe it took [the attackers] months to plan and execute this compromise. It’ll take us some time to uncover this, layer by layer,” said Neuberger.
Neuberger said she expected the investigation, as well as identification and remediation of affected networks, would take months but not years to complete. 
[embedded content] More

Due to the recent rise in cryptocurrency trading prices, most online systems these days are often under the assault of crypto-mining botnets seeking to gain a foothold on unsecured systems and make a profit for their criminal overlords.

The latest of these threats is a botnet named WatchDog. Discovered by Unit42, a security division at Palo Alto Networks, this crypto-mining botnet has been active since January 2019.
Written in the Go programming language, researchers say they’ve seen WatchDog infect both Windows and Linux systems.
The point of entry for their attacks has been outdated enterprise apps. According to an analysis of the WatchDog botnet operations published on Wednesday, Unit 42 said the botnet operators used 33 different exploits to target 32 vulnerabilities in software such as:
Drupal
Elasticsearch
Apache Hadoop
Redis
Spring Data Commons
SQL Server
ThinkPHP
Oracle WebLogic
CCTV (currently unknown if the target is a CCTV appliance or if there is another moniker “cctv” could stand for).
Based on details the Unit42 team was able to learn by analyzing the WatchDog malware binaries, researchers estimated the size of the botnet to be around 500 to 1,000 infected systems.
Profits were estimated at 209 Monero coins, currently valued at around $32,000, but the real figure is believed to be much higher since researchers only managed to analyze a few binaries, and the WatchDog gang is thought to have used many more Monero addresses to collect their illegal crypto-mining funds.
No credentials theft observed
The good news for server owners is that WatchDog is not yet on par with recent crypto-mining botnets like TeamTNT and Rocke, which in recent months have added capabilities that allow them to extract credentials for AWS and Docker systems from infected servers.

However, the Unit42 team warns that such an update is only a few keystrokes away for the WatchDog attackers.
On infected servers, WatchDog usually runs with admin privileges and could perform a credentials scan & dump without any difficulty, if its creators ever wished to.
To protect their systems against this new threat, the advice for network defenders is the same that security experts have been giving out for the past decade — keep systems and their apps up to date to prevent attacks using exploits for old vulnerabilities. More

A variant of the Masslogger Trojan is being used in attacks designed to steal Microsoft Outlook, Google Chrome, and messenger service account credentials. 

On Wednesday, cybersecurity researchers from Cisco Talos said the campaign is currently focused on victims in Turkey, Latvia, and Italy, expanding activities documented in late 2020 which targeted users in Spain, Bulgaria, Lithuania, Hungary, Estonia, and Romania. 
It appears that targets are changing on close to a monthly basis.
Masslogger was first spotted in the wild in April 2020 under licensing agreements agreed in underground forums. However, the new variant is considered “notable” by Talos due to the use of a compiled HTML file format to trigger an infection chain. 
Threat actors begin their attacks in a typical way, which is through phishing emails. In this attack wave, phishing messages masquerade as business-related queries and contain .RAR attachments. 
If a victim opens the attachment, they are split into multi-volume archives with the “r00” extension, a feature the researchers believe could be an effort to “bypass any programs that would block [an] email attachment based on its file extension.”
A compiled HTML file, .CHM — the default format for legitimate Windows Help files — is then extracted which contains a further HTML file with embedded JavaScript code. At each stage, code is obfuscated, and eventually leads to a PowerShell script being deployed that contains the Masslogger loader. 

The Masslogger Trojan variant, designed for Windows machines and written in .NET, will then begin the exfiltration of user credentials and is not picky in its targets — both home users and businesses are at risk, although it appears the operators are focusing on the latter. 
After being stored in memory as a buffer, compressed with gzip, the malware begins harvesting credentials. Microsoft Outlook, Google Chrome, Firefox, Edge, NordVPN, FileZilla, and Thunderbird are among the applications targeted by the Trojan. 
Stolen information can be sent through SMTP, FTP, or HTTP channels. Information uploaded to an exfiltration server includes the victim’s PC username, country ID, machine ID, and a timestamp, as well as records relating to configuration options and running processes. 
“The observed campaign is almost entirely executed and present only in memory, which emphasizes the importance of conducting regular and background memory scans,” Talos says. “The only component present on disk is the attachment and the compiled HTML help file.”
The researchers note that Masslogger is also able to act as a keylogger, but in this variant, it appears that the keylogging functionality has been disabled. 
Cisco Talos believes that based on Indicators of Compromise (IoCs), the cyberattackers can also be linked to the past usage of AgentTesla, Formbook and AsyncRAT Trojans. 
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Two Labor shadow ministry members have called for a national ransomware strategy, one they say is aimed at reducing the number of such attacks on Australian targets.
In a report [PDF] prepared by Shadow Minister for Home Affairs Kristina Keneally and Shadow Assistant Minister for Communications Tim Watts, Labor declared that due to ransomware being the biggest threat facing Australia, it’s time for a strategy to thwart it.
“Australia needs a comprehensive National Ransomware Strategy designed to reduce the attractiveness of Australian targets in the eyes of cyber criminals,” the report said. 
“None of these interventions are silver bullets. But the threat of ransomware isn’t going anywhere soon, and the government cannot leave it to Australian organisations to confront this challenge alone.”
The report pointed to the Australian government’s underwhelming cybersecurity strategy that was published in August.
“[It] rightly identifies that individual organisations have the primary responsibility for securing their own networks against any cyber threat, including ransomware. However, this is far from the end of the story,” the report said.
It also said the government has a range of policy tools that only it can deploy in an effort to reduce the overall volume of ransomware attacks, such as regulation making, law enforcement, diplomacy, international agreement making, offensive cyber operations, as well as the imposition of sanctions.

“While individual organisations will always be primarily responsible for securing their own networks, governments can intervene strategically to shape the overall threat environment in ways that make Australian targets less attractive,” it continued.
One suggestion the report has made is for the Australian government to pursue an approach that seeks to alter the return on investment of ransomware groups that target Australian organisations.
“To do this, it should pursue a range of initiatives designed to increase the costs of mounting campaigns against Australian organisations and to reduce the returns that are realised from such campaigns,” it said.
“The Australian government has tools that it can use to impose costs on ransomware crews that target Australians, including law enforcement action, targeted international sanctions, and offensive cyber operations.”
Additionally, the report said that while Australian law enforcement agencies have been part of some significant international cybercrime cooperation success stories, Australian law enforcement agencies need to be more aggressively and visibly involved in international operations against ransomware operators and pursuing those who target Australia.
It said that in the event where there is no prospect for law enforcement action against ransomware crews, Australia should seek to impose costs on ransomware crews that target Australian organisations by seeking to disrupt their activities through offensive cyber operations.
Labor also believes there is more that Australia could be doing to develop cybercrime prevention programs, such as using existing aid programs to develop diversion programs and developing skilled migration pathways for “young, technically savvy people” in the greater Indo-Pacific region.
Another way the shadow ministers believe the government could seek to reduce the returns of ransomware attacks on Australian organisations is by targeting cryptocurrency exchanges that enable ransomware payments.
“Cryptocurrencies have been a crucial enabling technology for the growth of ransomware by providing a system for the payment of ransoms that is anonymous and outside existing global payments architecture,” they wrote. “The absence of a central organisation controlling cryptocurrencies has made the enforcement of existing ‘know your customer’ anti-money laundering laws far more challenging in this context.”
The report concludes by stating that perhaps the simplest way to reduce the returns of ransomware attacks on Australian organisations is to lift the overall level of resilience of the IT networks of Australian organisations.
Elsewhere, head of information warfare at the Australian Department of Defence Major General Susan Coyle used her appearance at IBM Think Australia and New Zealand on Thursday to say it’s important to patch systems and change passwords frequently.
“First and foremost, we’ve got to accept that there is a risk, thinking that there isn’t a risk makes us more complacent,” she said.
HERE’S MORE More

The Australian Department of Defence has released a new report on its findings for how to reduce the ethical risk of artificial intelligence projects, noting that cyber mitigation will be key to maintaining the trust and integrity of autonomous systems.
The report was drafted following concerns from Defence that failure to adopt emerging technologies in a timely manner could result in military disadvantage, while premature adoption without sufficient research and analysis could result in inadvertent harms.
“Significant work is required to ensure that introducing the technology does not result in adverse outcomes,” Defence said in the report [PDF].
The report is the culmination of a workshop held two years ago, which saw organisations, including Defence, other Australian government agencies, the Trusted Autonomous Systems Defence Cooperative Research Centre, universities, and companies from the defence industry come together to explore how to best develop ethical AI in a defence context.
In the report, participants have jointly created five key considerations — trust, responsibility, governance, law, traceability — that they believe are essential during the development of any ethical AI project.
When explaining these five considerations, workshop participants said all AI defence projects needed to have the ability to defend themselves from cyber attacks due to the growth of cyber capabilities globally.
“Systems must be resilient or able to defend themselves from attack, including protecting their communications feeds,” the report said.

“The ability to take control of systems has been demonstrated in commercial vehicles, including ones that still require drivers but have an ‘internet of things’ connection. In a worst-case scenario, systems could be re-tasked to operate on behalf of opposing forces.”
Workshop participants added there is a risk that a lack of investment in sovereign AI could impact Australia’s ability to achieve sovereign decision superiority.
As such, the participants recommended increasing early AI education to military personnel to improve the ability for defence to act responsibly when working with AI.
“Without early AI education to military personnel, they will likely fail to manage, lead, or interface with AI that they cannot understand and therefore, cannot trust,” the report said. “Proactive ethical and legal frameworks may help to ensure fair accountability for humans within AI systems, ensuring operators or individuals are not disproportionately penalised for system-wide and tiered decision-making.”
The report also endorsed investment into cybersecurity, intelligence, border security and ID management, investigative support and forensic science, and for AI systems to only be deployed after demonstrating effectiveness through experimentation, simulation, or limited live trials.
In addition, the report recommended for defence AI projects to prioritise integration with already-existing systems. It provided the example of automotive vehicle automation as it provides collision notifications, blind-spot monitoring, among other things that support human driver cognitive functions.
The workshop members also created three tools that were designed to support AI project managers with managing ethical risks.
The first two tools are an ethical AI defence checklist and ethical AI risk matrix, which can be found on the Department of Defence’s website.
Meanwhile, the third tool is an ethical risk assessment for AI programs that require a more comprehensive legal and ethical program plan. Labelled as the Legal and Ethical Assurance Program Plan (LEAPP), the assessment requires AI project managers to describe how they will meet the Commonwealth’s legal and ethical assurance requirements.
The LEAPP requires AI project managers to create a document with information, such as legal and ethical planning, progress and risk assessment, and input into Defence’s internal planning, including weapons reviews. Once written, this assessment would then be sent for review and comment by Defence and industry stakeholders before it is considered for Defence contracts. 
As the findings and tools from the report are only recommendations, the report did not specify what AI defence projects fit within the scope of the LEAPP assessment.  
Related Coverage More

Image: ZDNet
Microsoft has begun deploying this week KB4577586, a Windows update that permanently removes the Adobe Flash Player software from Windows devices.
The update was formally announced last year at the end of October when Microsoft and other browser makers were preparing for the impending Flash end-of-life, scheduled for the end of 2020.
According to a support document published at the time, the update was initially supposed to be optional.
System administrators who wanted to remove Flash before the EOL date could access the Microsoft Update Catalog, download the KB4577586 packages, and remove Flash to avoid any security-related issues.
But this week, multiple Windows 10 users reported that Microsoft is now forcibly installing KB4577586 on their devices and removing Flash support from the OS.
While users might think this would cause issues for some enterprises, it actually does not. Last year, Adobe introduced a time bomb in the Flash Player code that prevents the Flash Player app from playing content after January 12.
Even if Flash Player is installed on a Windows device, the OS wouldn’t be able to play any content due to this time bomb — a well-known issue that has created problems in countries such as China and South Africa last month.

It appears that Microsoft has also learned of this time bomb and has decided to push KB4577586 to Windows 10 systems this week to remove any Flash code since the app doesn’t work anyway. More

Image: zhushenje
The US Department of Justice has unsealed today new charges against the Lazarus Group, a codename given to North Korea’s state-sponsored military hacking groups.
The new indictment expands charges initially brought against Park Jin Hyok, a North Korean military hacker the US charged in September 2018 for his involvement in the Sony hacks, WannaCry ransomware attacks, and bank cyber-heists.
The new indictment unsealed today charges two additional North Korean hackers, namely Jon Chang Hyok (전창혁), 31, and Kim Il (김일), 27, and expands the charges brought against Park in 2018.

US officials say the three hackers are part of units of the Reconnaissance General Bureau (RGB), a North Korean military intelligence agency, part of which they participated in a worldwide hacking campaign that dates back to 2014 and includes the likes of:
The hack of Sony Pictures Entertainment in 2014, in retaliation for the studio releasing The Interview movie.
Cyber-heists at banks in Vietnam, Bangladesh, Taiwan, Mexico, Malta, and across Africa. The group targeted the bank’s SWIFT money transfer system in attempts to steal more than $1.2 billion in funds.
ATM cash-out attacks using the FASTCash malware. One successful such attack took place in October 2018 when the group stole $6.1 million from Pakistan’s BankIslami.
The WannaCry ransomware outbreak of May 2017.
Creating and spreading malware-laced cryptocurrency apps that stole users’ funds. Examples include Celas Trade Pro, WorldBit-Bot, iCryptoFx, Union Crypto Trader, Kupay Wallet, CoinGo Trade, Dorusio, CryptoNeuro Trader, and Ants2Whale.
Hacks of cryptocurrency exchange portals. The DOJ said the RGB targeted hundreds of such entities and stole tens of millions of US dollars.
Spear-phishing campaigns targeting US defense contractors, energy companies, aerospace companies, technology companies, the United States Department of State, and the United States Department of Defense.
Creating a fake cryptocurrency company and releasing the Marine Chain Token. The US DOJ said the scheme would have allowed users to purchase ownership of marine vessels via a cryptocurrency token, allowing the North Korean state to gain access to investor funds and bypass US sanctions.
US officials said that while campaigns were geared towards intelligence collection, most were criminal endeavors to gather funds for the hermit kingdom’s regime.
Assistant Attorney General John Demers described the three hackers and the Lazarus Group as “the world’s leading bank robbers” and “a criminal syndicate with a flag.”
One more money mules charged
But today, the DOJ also said it charged a Canadian national named Ghaleb Alaumary for helping the Lazarus Group launder some of their stolen funds.

“Alaumary was a prolific money launderer for hackers engaged in ATM cash-out schemes, cyber-enabled bank heists, business email compromise (BEC) schemes, and other online fraud schemes,” DOJ officials said.
He allegedly organized crews of money launderers in the US and Canada to receive stolen funds and then relay the funds to other accounts under the hackers’ control.
This included laundering funds stolen from the BankIslami ATM cash-out attack, another ATM cash-out from an Indian bank that took place in 2018, and funds stolen from a Maltese bank in 2019.
Alaumary is now the third Nortk Korean money muled charged in the US after the DOJ charged two Chinese nationals in March 2020.
A copy of today’s indictment is available here, in PDF format.
Besides the DOJ charges, the US Cybersecurity and Infrastructure Security Agency has also released a report today on the AppleJeus malware, which the Lazarus Group has often used during attacks on cryptocurrency exchange portals. More