Information Technology

Image: Asha Barbaschow/ZDNet
Australia scored number eight out of 30 major nations for “cyber intent” in the National Cyber Power Index 2020 (NCPI) published earlier this month, but only number 16 for “cyber capability”.
That capability gap pulls Australia down to number 10 after, in order, the US at number one, China, UK, Russia, Netherlands, France, Germany, Canada, and Japan.
Looking at individual data points, Australia is way down in an unsurprising 24th place when it comes to fixed broadband speed, behind Ukraine and only just ahead of Vietnam.
It’s down at 16th place for internet freedom, scoring 72 out of a possible 100 points. The five leading nations in this category were Sweden, Netherlands, New Zealand, Switzerland, and Estonia.
Australia is in the bottom half of the 30 ranked countries in things such as patent applications per capita; the number of global top 100 firms in all three tracked categories of tech, cyber, and surveillance; its military strategy and centralised cyber command; and its total number of cyber military personnel.
Australia is number five in e-commerce per capita, however. It’s also number five for mobile data speeds, after South Korea, China, Canada, and the Netherlands.
The NCPI was compiled by the Belfer Center for Science and International Affairs at the Harvard Kennedy School as part of its China Cyber Policy Initiative.
The methodology detailed in the report is complex, and it makes some assumptions which cause your correspondent to have some doubts about the index’s effectiveness.
The key issue is that the report is based entirely on publicly-available information, which means that secretive nations may be misrepresented. The researchers acknowledge this, however.
“We recognise that countries deliberately choosing to be opaque will be vastly under-ranked in the index. We suspect that Israel falls into this category,” they wrote.
“We also strongly believe that ‘Amassing Wealth or Extracting Cryptocurrency’ is a top objective of some countries and that they employ cyber means to achieve it. Unfortunately, we were not able to collect sufficient data … to measure each country against this objective.”
Cyber power isn’t just about destroying infrastructure
Unlike previous attempts to rank nation-state cyber power, the Belfer Center has attempted to include “all aspects under the control of a government where possible”.
“Within the NCPI we measure government strategies, capabilities for defense and offense, resource allocation, the private sector, workforce, and innovation,” they wrote.
“Our assessment is both a measurement of proven power and potential, where the final score assumes that the government of that country can wield these capabilities effectively.”
The NCPI identified seven national objectives that countries might pursue using cyber means.
They’re listed as: Surveilling and monitoring domestic groups; strengthening and enhancing national cyber defences; controlling and manipulating the information environment; foreign intelligence collection for national security; commercial gain or enhancing domestic industry growth; destroying or disabling an adversary’s infrastructure and capabilities; and defining international cyber norms and technical standards.
“In contrast to the broadly held view that cyber power means destroying or disabling an adversary’s infrastructure (commonly referred to as offensive cyber operations), offense is only one of these seven objectives countries pursue using cyber means,” they wrote.
The Belfer Center reviewed more than 1,000 existing sources of data and developed 27 unique indicators to measure a state’s cyber capabilities.
Beyond the top 10 scorers already listed, the nations studied were ranked from Israel at number 11, down through Spain, Sweden, Estonia, New Zealand, South Korea, Switzerland, Singapore, Malaysia, Vietnam, India, Turkey, Iran, Brazil, Ukraine, Saudi Arabia, Lithuania, Italy, and finally to Egypt at number 29.
North Korea was not given a ranking in the charts.
Morrison government is more rhetoric than action: Labor
The Labor Party has attempted to generate political capital with the NCPI, noting that while Australia is now in 10th place overall, it scored a far more impressive third place in a 2011 index produced by the Economist Intelligence Unit and Booz Allen Hamilton.
“This is yet another example of the Morrison government’s approach of rhetoric over action while failing to prioritise cyber at both an industry and government level,” wrote Tim Watts, the Shadow Assistant Communications Minister and Shadow Assistant Cyber Security Minister, last week.
“The biggest gap between intent and capability is in our offence, with Australia placing 10th in intent yet only 24th in capability — particularly lagging in the capability of our domestic industry to realise high-tech export opportunities.”
The government’s much-delayed 2020 Cyber Security Strategy lacks any objectives or initiatives to support the Australian cyber security industry, Watts said, noting that Australia ranked eighth in intent for the commercialisation of its cybersecurity capability, but only 12th when it came to capability.
While your correspondent has noted that the government strategy is certainly disappointing, vague, and unambitious, Labor’s comparison with the 2011 ranking is a furphy.
As the NCPI notes, that 2011 index “does not measure offensive capabilities, and focuses largely on economic and resource indicators — which although are important to understanding the potential for developing cyber power does not provide the fullest picture of cyber capabilities”.
Labor also chose not to compare the NCPI ranking with the International Telecommunications Union’s Global Cybersecurity Index [PDF] of 2018, where Australia came in at number 11.
As a nation with a higher cyber intent but lower cyber capability, Australia is “actively signalling to other states that they intend to develop their cyber capabilities”, said the NCPI.
However, such nations have either not yet disclosed their capabilities, through stated or demonstrated means, or currently don’t have the capabilities at hand to achieve their cyber goals.
The bad guys: China, Iran, North Korea
According to the NCPI, some 29 countries are seen to be pursuing legal wealth generation via cyber means, such as developing their cybersecurity industries.
“Only one country was observed pursuing it via illegal means — DPRK [North Korea],” the researchers said.
“Only one country was assessed to have not demonstrated its wealth generation intent at all — Egypt.”
China tops the NCPI’s list for the objective “growing national cyber and technology competence”.
“Along with DPRK and Iran, China is one of only three countries assessed to be pursuing this objective through both legal and illegal means,” they said.
“[China] has been both observed conducting industrial espionage and sought to incentivise and grow its domestic cyber expertise through research and development, and public-private partnerships.”
Related Coverage More

A United States district court judge has issued a nationwide injunction against President Donald Trump’s executive order, thereby preventing the country’s WeChat ban from coming into effect. 
The ruling was in relation to a lawsuit filed by WeChat users that argued the ban undermines the free speech rights of US citizens.
The case’s presiding judge, Laurel Beeler, granted the injunction to halt the WeChat ban as the plaintiffs showed serious questions about whether the ban impinged on the US first amendment. She also acknowledged the ban would provide hardship for the plaintiffs as it would shut down the primary means of communication for the Chinese community.
Beeler added that she was not convinced the ban would address the national security concerns posed by Trump due to there being “scant little evidence”.
“Certainly the government’s overarching national security interest is significant. But on this record — while the government has established that China’s activities raise significant national security concerns — it has put in scant little evidence that its effective ban of WeChat for all US users addresses those concerns,” Beeler said in her judgment. 
“As the plaintiffs point out, there are obvious alternatives to a complete ban, such as barring WeChat from government devices, as Australia has done, or taking other steps to address data security.”
The ban, which would have come into effect on Sunday, was announced by the US Commerce Department late last week. It was the official instrument for enforcing the two executive orders signed by President Donald Trump in early August, which had addressed what he labelled as the national security threat posed by the pair of Chinese apps. 
The ban had sought to block TikTok and WeChat as well as remove them from the Apple and Google app stores. Additionally, updates to the existing apps would have also been banned. 
The ban would not have prevented existing users from using the apps, however, so long as the apps were already installed prior to the app store removals.
Meanwhile, the Commerce Department said the ban on TikTok would be pushed back to November 12 unless national security concerns posed by the app are resolved. The decision to push back TikTok’s ban follows Oracle and Walmart announcing they would acquire 20% of a newly formed TikTok Global and issue an IPO within 12 months, effectively saving TikTok’s US footprint.
Related Coverage More

The cruel march of ransomware has apparently reached a grim new milestone. In Germany, authorities are investigating the death of a patient during a ransomware attack on a hospital; according to reports, the woman, who needed urgent medical care, died after being re-routed to a hospital further away, as a nearer hospital was in the midst of dealing with a ransomware attack.
Elsewhere ransomware continues to create painful, if less tragic, disruptions. The UK’s cybersecurity agency has just warned that ransomware groups are launching ‘reprehensible’ attacks against universities as the new academic year starts. On a daily basis, companies large and small are finding their business disrupted when they can least afford to have computer systems failing.

More on privacy

And yet, there seems to be a sense in some quarters that ransomware is simply an inevitable consequence of our digital age. That it is something that we just have to learn to accept.
SEE: Security Awareness and Training policy (TechRepublic Premium)
In reality, ransomware exists because of a series of failures. While apparently unrelated, they combine to create the conditions under which ransomware can flourish and become one of the biggest menaces on the internet today. If we want to stop the next decade becoming the decade of ransomware, we need to make some significant changes.
Policing versus politics – Many of these gangs operate from countries where their behaviour is either not considered criminal, or over-looked by authorities (so long as they don’t attack local companies), or even actively welcomed as a source of new funds. That means treating ransomware as a simple law-enforcement issue is never likely to fix the problem: these states will never hand over these gangs to outside justice. This makes ransomware a political issue as much as a problem for police. Politicians should make clear to these governments that by allowing these gangs to flourish on their soil, they are part of the problem.
Increase the pressure – Intelligence agencies also need to make tackling ransomware a priority. While, understandably, they have focused on state-backed espionage and cyberwarfare, ransomware is now becoming such a problem that greater emphasis needs to be placed on identifying, tracking and disrupting these groups. Some efforts, like the NoMoreRansom project, which offers decryption keys, are a good start, but more effort is needed.
Make paying the ransom an absolute last resort – One of the fundamental issues that allows ransomware to flourish is that it remains lucrative for the gangs because victims will pay up. It’s entirely understandable that victims do pay up especially when the alternative is going out of business, or paying much more to restore data and computer systems. 
But there are two problems with paying up. Firstly, it normalises ransomware attacks, and turns them into another business expense. You can even buy insurance that will cover them. Turning these attacks into just another business cost means that they are taken less seriously. There is sense that if data is encrypted – but not stolen – then somehow the breach is less important, and that if the ransom is paid and the data unlocked, then it’s no big deal. This might even make it harder to justify spending money to protect against ransomware.
Worse, paying significant sums is a signal to crooks to move into ransomware, and also strengthens the gangs who can then take on more complicated targets. Paying the ransom makes everyone less safe.
Make security practical – Too much software is shipped with too many holes in it; knitting different systems together, which is one of the inevitabilities of any IT infrastructure, only multiplies those security gaps. Vendors need to fix software before shipping, not after. They need to make it much easier for flaws to be dealt with by their customers, for whom patching is a thankless and Sisyphean task. Equally, users of technology have to make sure they are doing everything they can to make their systems secure, which means spending more time, money and effort on security. In many cases, this effort means patching vulnerabilities and making staff aware of the risks to stop the hackers getting through.
None of these changes are easy; getting politicians to understand the internet is hard, making business execs take cybersecurity seriously is difficult, and persuading tech companies to change their development practices takes time. But it’s necessary if we don’t want the ransomware threat to continue to grow.
ZDNET’S MONDAY MORNING OPENER
The Monday Morning Opener is our opening salvo for the week in tech. Since we run a global site, this editorial publishes on Monday at 8:00am AEST in Sydney, Australia, which is 6:00pm Eastern Time on Sunday in the US. It is written by a member of ZDNet’s global editorial board, which is comprised of our lead editors across Asia, Australia, Europe, and North America.
PREVIOUSLY ON MONDAY MORNING OPENER: More

The Department of Homeland Security’s cybersecurity division has ordered federal civilian agencies to install a security patch for Windows Servers, citing “unacceptable risk” posed by the vulnerability to federal networks.
The DHS order was issued via an emergency directive, a rarely-used legal mechanism through which US government officials can force federal agencies into taking various actions.
The target of the DHS’s latest emergency directive is CVE-2020-1472, a vulnerability also known as Zerologon.
The vulnerability is considered extremely dangerous, as it allows threat actors that have a foothold on an internal network to hijack Windows Servers running as domain controllers and effectively take over the entire network.
Microsoft included fixes for the Zerologon vulnerability in the August 2020 Microsoft Patch Tuesday, published on August 11; however, many system administrators did not know how bad the bug really was until this week, on Monday, when security researchers from Secura published a technical report explaining CVE-2020-1472 at the technical level.
This in-depth report was more than enough to allow white-hat and black-hat hackers to create weaponized proof-of-concept Zerologon exploits that went public within hours after the Secura report.
The creation of these exploits, the widespread use of Windows Servers as domain controllers in US government networks, the 10 out of 10 maximum severity rating that the Zerologon bug received, and the “grave impact” of a successful attack is what determined DHS officials to issue a rare emergency directive late Friday afternoon.
“CISA [Cybersecurity and Infrastructure Security Agency] has determined that this vulnerability poses an unacceptable risk to the Federal Civilian Executive Branch and requires an immediate and emergency action,” DHS CISA said in Emergency Directive 20-04.
System admins have until Monday to patch
DHS CISA officials gave federal system administrators until the end of day on Monday to patch all their Windows Servers configured as domain controllers (11:59 PM EDT, Monday, September 21, 2020).
Windows Servers that can’t be patched are to be taken offline and removed from the network, the DHS ordered.
The short deadline for applying security updates is primarily due to the ease of exploitation and severe consequences of a successful Zerologon attack.
Even if Zerologon is not one of those vulnerabilities that can’t be used as the tip of the spear in a cyber-attack and break into a network, the bug is an ideal secondary payload in the second stage of an attack, allowing hackers full control over an entire network if the domain controller was left unpatched.
This entire week, the entire cyber-security community has repeatedly warned about how dangerous this vulnerability really is, despite being a “second stage” exploit.
“You must prioritize patching over detection with this kind of bug,” Andrew Robbins, Adversary Resilience Lead at cyber-security firm SpecterOps, said earlier today on Twitter.
“Once an attacker owns your DC, their persistence options far exceed what even the most advanced organizations can hope to recover from,” Robbins added. “An ounce of patching is worth 10 tons of response.” More

The march of new Belarus, 23.08.2020
Image: Andrew Keymaster
A group of hackers has leaked on Saturday the names and personal details of more than 1,000 high-ranking Belarusian police officers in response to violent police crackdowns against anti-government demonstrations.
The leaked data included names, dates of birth, and the officers’ departments and job titles.
Details for 1,003 police officers were leaked via a Google spreadsheet, with most of the entries being for high-ranking officers, such as lieutenants, majors, and captains.
The hackers provided the data to independent Belarusian news agency Nexta, which published an unredacted version on Saturday on its official Telegram channel.

Image: ZDNet

Image: ZDNet
The news agency, which gained popularity with anti-Lukashenko protesters after exposing police brutality during the country’s recent anti-government demonstrations, asked followers to help verify the list’s accuracy, but also help expand it with additional details.
“If you know facts about the crimes of specific people on the list, as well as their personal information (addresses, phones, car numbers, habits, mistresses / lovers) – write to the bot [REDACTED],” Nexta said.
“If the detentions continue, we will continue to publish data on a massive scale,” the news agency added. “No one will remain anonymous under a balaclava.”
In a statement published on its website on Saturday, a spokesperson for the Belarusian Ministry of Internal Affairs confirmed the leak, but also warned that they plan to find and prosecute the hackers and leakers. The website was then taken down with a DDoS attack, according to statements made by various self-proclaimed hackers on Twitter.
Belarus has been in near-total turmoil since August 9, after results for the presidential election race were announced. Officials said incumbent president Alexander Lukashenko won a sixth term in office with around 80% of the votes. Opposition candidate Sviatlana Tsikhanouskaya accused the current regime of massive fraud and claimed victory with at least 60% of the votes. She eventually fled the country, fearing for her physical safety.
Massive protests erupted on the night of the election and continued throughout the past two months. The demonstrations had massive turnouts despite a violent crackdown from police forces.
On-the-ground reports and videos uploaded on social media showed police forcers beating protesters or randomly arresting people on the street, even when they were not protesting.
Detainees and their families accused the Minsk government of intimidation, torture, rape, and even murder. On September 1, the United Nations said it received more than 450 reports of human rights violations by Belarusian police forces in August alone.
Currently, the Belarusian police and military are the only forces still keeping President Lukashenko in power. From abroad, Tsikhanouskaya has asked police and military leadership to step aside.
In spite of a brutal police crackdown, protests have continued like clockwork in Minsk and the major cities. New protests are planned for today, Sunday, September 20. Protests were also held on Saturday, with police forces arresting more than 200 women during an all-women anti-government march. More

Image: Lukas Stefanko

Mozilla has fixed a bug that can be abused to hijack all the Firefox for Android browsers on the same WiFi network and force users to access malicious sites, such as phishing pages.
The bug was discovered by Chris Moberly, an Australian security researcher working for GitLab.
The actual vulnerability resides in the Firefox SSDP component. SSDP stands for Simple Service Discovery Protocol and is the mechanism through which Firefox finds other devices on the same network in order to share or receive content (i.e., such as sharing video streams with a Roku device).
When devices are found, the Firefox SSDP component gets the location of an XML file where that device’s configuration is stored.
However, Moberly discovered that in older versions of Firefox, you could hide Android “intent” commands in this XML and have the Firefox browser execute the “intent,” which could be a regular command like telling Firefox to access a link.
Sample exploitation scenario
To better understand how this bug could be weaponized, imagine a scenario where a hacker walks into an airport or mall, connects to the WiFi network, and then launches a script on their laptop that spams the network with malformed SSDP packets.
Any Android owner using a Firefox browser to navigate the web during this kind of attack would have his mobile browser hijacked and taken to a malicious site, or forced to install a malicious Firefox extension.
Another scenario is if an attacker targets vulnerable WiFi routers. Attackers could leverage exploits to take over outdated routers, and then spam a company’s internal network and force employees to re-authenticate on phishing pages.
Earlier this week, Moberly published proof-of-concept code that could be used to carry out such attacks. Below are two videos of Moberly and an ESET security researcher demonstrating attacks.

Moberly said he reported the bug to Mozilla earlier this summer.
The bug was fixed in Firefox 79; however, many users may not be running the latest release. Firefox for desktop versions were not impacted.
Reached for comment, a Mozilla spokesperson recommended that users upgrade to the latest version of Firefox for Android to be safe. More

A spam group has picked up a pretty clever trick that has allowed it to bypass email filters and security systems and land in more inboxes than usual.
The trick relies on a quirk in RFC791 — a standard that describes the Internet Protocol (IP).
Among the various technical details, RFC791 is also the standard that describes how IP addresses look. We mostly know them in their most prevalent form of dotted-decimal address (for example, 192.168.0.1).
However, IP addresses can also be written in three other formats:
Octal – 0300.0250.0000.0001 (by converting each decimal number to the octal base)
Hexadecimal – 0xc0a80001 (by convert each decimal number to hexadecimal)
Integer/DWORD – 3232235521 (by converting the hexadecimal IP to integer)
Well, one spammer group has apparently picked up on the trick.
According to a report published yesterday by Trustwave, a spam group has adopted hexadecimal IP addresses for their campaigns since mid-July earlier this year.
The group has been sending emails that contain links to their spam sites, but instead of domain names like “spam-website.com,” the emails contain weird-looking URLs like https://0xD83AC74E.
These are actually hexadecimal IP addresses where the spammers host their spam website infrastructure.
While web browsers are capable of interpreting hexadecimal IP addresses and load the website found on the server, it appears that the trick was enough to help the spam groups evade detection while spewing high volumes of pharma/pill spam messages.
Trustwave says the group’s operations have significantly increased since adopting this trick, as they have been able to land more messages in users’ inboxes.
Image: Trustwave
This campaign also marks the second time hexadecimal IP addresses have been spotted being used in a malware campaign in recent years.
In the summer of 2019, the operators of the PsiXBot trojan have also used hexadecimal IP addresses to hide the location of their command-and-control servers.
Yet, besides the hexadecimal version, malware authors have also abused other IP addressing schemes. In 2011, Zscaler found malicious Word documents that used integer/DWORD IP addresses to hide the location of remotely-stored malicious resources that they’d download on infected hosts.
Just like in the Trustwave report, the previous operations used these strange IP addressing schemes as a way to bypass detection, as not all security software is fully RFC791-compliant. More

Microsoft has released the SecretManagement Preview 3 module for its PowerShell scripting language and command-line shell to help developers manage secrets with a set of cmdlets.  
The SecretManagement Preview 3 release follows a second preview Microsoft released in March and a first preview in February. The tool is designed to help users securely manage secrets in heterogeneous cloud environments. 

However, the third preview of the SecretManagement module does contain breaking changes, so users of earlier previews will need to migrate their secrets before updating. 
SecretManagement helps users store and retrieve secrets locally in an operating system’s built-in vault, such as the Windows Credential Manager. It’s also an “orchestrator for extension vaults which perform the actual secret storage and encryption”. 
“SecretManagement is valuable in heterogeneous environments where you may want to separate the specifics of the vault from a common script which needs secrets,” explains Sydney Smith, a program manager on Microsoft’s PowerShell team. 
“SecretManagement is also as a convenience feature which allows users to simplify their interactions with various vaults by only needing to learn a single set of cmdlets.” 
In this preview Microsoft has separated the SecretManagement module from a built-in default vault and overhauled its design. It’s also separated the interface from accessing secrets and registering vaults from any vault implementation. 
Paul Higinbotham, a senior software engineer on the PowerShell team, explains that since releasing the first alpha of the SecretManagement module it became “clear that the original vision and design suffered some shortcomings”.
A problem with the previous alpha release was that it depended on Windows Credential Manager, but to extend it to other platforms it needed to find an equivalent local vault. 
“It turns out that CredMan is pretty unique, and there are no equivalent solutions on non-Windows platforms,” writes Higinbotham. “In addition community members pointed out that CredMan only works for interactive log-in accounts, and this means SecretManagement pre-release would not work with Windows built-in accounts or over PowerShell remoting.
So with this new design, Microsoft focused on the management of secrets.
“The purpose of SecretManagement is to provide scripts a common way to access secrets from widely different secret store solutions. So the new design leaves it to the individual vault solutions how they are installed, configured, and authenticated.” 
Because of these issues, Microsoft has removed the built-in local vault from SecretManagement, leaving all storage mechanisms as extension vaults only. To address this issue it’s published SecretStore Preview 1, a cross-platform local extension vault. 
According to Microsoft, this extension vault is “configurable and works over all supported PowerShell platforms on Windows, Linux, and macOS”. More