Information Technology

Department of Home Affairs Secretary Mike Pezzullo
Screenshot: Asha Barbaschow/ZDNet
Aside from his passion for test cricket and disappointment at not getting the call to be the St George Dragons’ new NRL coach, Secretary for the Department of Home Affairs Mike Pezzullo shared a few things about the future of cybersecurity within Australia and expanded on what to expect from the nation’s 2020 Cyber Security Strategy.
Being interviewed by Alastair MacGibbon, who prior to heading up his own Australian cybersecurity megamix, CyberCX, was former Prime Minister Malcolm Turnbull’s special advisor on cyber, Pezzullo was asked where the government was at with its own cybersecurity.
Placing some of the blame on gaps in legacy systems, the complexity involved in decommissioning decades-old investments, and a large attack surface that is the Commonwealth, Pezzullo said the cybersecurity strategy would provide the opportunity to do better.
“This isn’t a silver bullet that will solve all problems, but we’re looking to consolidate at least the attack surface to better defend it; fewer hubs, so the larger players who have got the depth, they’ve got the skills, they’ve got the resources. 
“In some cases, they’ve got the connectivity to the ASD (Australian Signals Directorate) in real-time. They can provide us with that threat picture that is unique to the signals authority, but also in some cases, larger departments have got more capacity,” Pezzullo explained.
He said while providing a “hard external shell” would not obviate the other work that is needed to protect the endpoint and deal with the human element of cybersecurity, it would at least block out some of the threat.
More wisdom from Mike: Australian Home Affairs thinks its IT is safe because it has a cybermoat
Pezzullo, alongside counterparts from Treasury and the Department of Industry, are all part of a strategies board that has been charged under the cybersecurity strategy with developing what he was hesitant to label as “regulation”.
“The strategies board has formed itself around this issue … we’re going to work through how we get to scale, how are we going to consolidate, and where there are known vulnerabilities because in some cases you’ve got systems that are quite old. Coding’s old, the vulnerabilities are known, but it’s not a simple matter because you’ve got to migrate,” he said. 
“In some cases, taking systems down and offline to even patch creates risk.
“So how do you, with a known vulnerability, mitigate and put alternative measures in place until, over time, new investment comes through to allow you to decommission and build in a world of virtualised systems and a world where cybersecurity is frankly more built into the design of modern systems? 
“While you’re waiting for that investment to flow through, you can decommission some of those older systems [but] how can you at least create a perimeter around those systems that at least block out more of the threat?”
He expects by the end of this financial year, the board will have a single cybersecurity hub strategy that maps out all of the known vulnerabilities and is a place where government can place local defences to protect all points and “harden that external shell”.
“I think the operating model for federal government cyber will need to change, because to do all of the things I’ve just suggested, you can’t just put it in a box and call it ‘cyber’ then have your network operations and your architecture and your deployment of apps over here,” Pezzullo said.
He also said certain assets and networks within government would be designated as critical infrastructure to put ASD in a position to actively defend against cyber threats.
Touching further on the strategies board and the “obligations” it determines for consumers, vendors, small businesses, large enterprises, and those involved in critical infrastructure, Pezzullo said something that “looks like a regulatory scheme”, would, by definition, have to emerge.
“Because whether it’s a function of consumer protection, consumer choice, or whether quite probably, small or medium enterprises, larger enterprises, and ultimately the very top of the commercial food chain — those larger enterprises that run critical infrastructure or assets or networks within critical infrastructure — are going to want to have confidence that the entity that they’re engaging with is accredited; is properly fit for purpose,” he said.
“How exactly we get the regulatory; how we land is the work of the next 12-18 months with the regulatory taskforce.”
Pezzullo said market and regulatory forces inevitably bring about a model that works, adding that he’s hedging on it.
Pointing to the banning of Huawei without mentioning the Chinese company by name, Pezzullo said such industry is being shaped around the emergence of 5G.
“You’ve seen this in 5G where government regulation starts to set the parameters of risk [that] may or may not conform with the definition of being an appropriate vendor,” he said.
“I think cybersecurity is one of those areas we should be seriously looking at in terms of sovereign capability, especially as we think about the recovering reconstruction coming out of COVID. 
“Where are the jobs going to come from, where are the new industries.”
Pezzullo believes the 2020 strategy, alongside the 2016 document and the AU$1.5 billion CESAR package, “will be so transformative”.
“In four or five years’ time, you and I will be sitting here … saying the whole landscape is transformed. There’s a deeper industry, we have more weapons and tools to protect critical sectors, we’re on the front foot in terms of actively defending some of those sectors … we’ve got an innovative sector here that is a continental version of Israel or Singapore,” the secretary added.
READ ALSO More

Special feature

Cyberwar and the Future of Cybersecurity
Today’s security threats have expanded in scope and seriousness. There can now be millions — or even billions — of dollars at risk when information security isn’t handled properly.
Read More

Microsoft said today that Chinese, Iranian, and Russian state-sponsored hackers had tried to breach email accounts belonging to people associated with the Biden and Trump election campaigns.
The “majority of these attacks” were detected and blocked, according to Tom Burt, Corporate Vice President for Customer Security & Trust at Microsoft.
Burt disclosed the incidents in a blog post today after Reuters reported yesterday some of the Russian attacks against the Biden camp.
In a comprehensive blog post, Burt revealed additional attacks and also confirmed a DNI report from August that claimed that Chinese and Iranian hackers were also targeting the US election process.
Russian attacks
According to Microsoft, the attacks carried out by Russian hackers were linked back to a group that the company has been tracking under the name of Strontium and the cyber-security industry as APT28 or Fancy Bear.
Microsoft says this group has been particularly active, targeting more than 200 organizations all over the world between September 2019 and today, with victims including:
US-based consultants serving Republicans and Democrats;
Think tanks such as The German Marshall Fund of the United States and advocacy organizations;
National and state party organizations in the US
The European People’s Party and political parties in the UK
Microsoft said that while Strontium usually carried out spear-phishing email attacks, in recent months, the group has been using brute-force and password spraying techniques as a complementary method to breaching accounts.
Since these attacks are very noisy and easy to detect, Microsoft said Strontium has been hiding its credentials mass-harvesting operations by using “more than 1,000 constantly rotating IP addresses, many associated with the Tor anonymizing service” and by “adding and removing about 20 IPs per day to further mask its activity.”
Iranian attacks
On the other hand, the attacks carried out by Iranian hackers came from a group tracked as Phosphorous (APT35, Charming Kitten, and the Ajax Security Team).
These attacks are a continuation of a campaign that started last year, and which Microsoft detected and warned about in October 2019.
At the time, Microsoft warned that the hackers targeted “a 2020 US presidential campaign,” but did not name which one. Through some open-source detective work, several members of the security community later tied the attacks to the Trump campaign.
Today, Microsoft confirmed that the attacks indeed targeted the Trump campaign, but also revealed new activity related to the group.
“Between May and June 2020, Phosphorus unsuccessfully attempted to log into the accounts of administration officials and Donald J. Trump for President campaign staff,” Burt said.
Furthermore, Burt added that after Microsoft used court orders to take control of 99 Phosphorus domains in March 2019, they used the same tactic again to take over another 25 domains last month, which brought the company’s total to 155 domains formerly owned by Phosphorus.
Chinese attacks
But attacks were also detected from Chinese groups. While currently there are tens of hacking groups that are believed to operate under orders and the protection of the Chinese government, Microsoft said that the attacks targeting US campaigns came from a group known as Zirconium (APT31), which is the same group that Google spotted earlier this year, in June.
Microsoft says it detected thousands attacks orchestrated by this group between March 2020 and September 2020, with the hackers gaining access to almost 150 accounts during that timeframe.
The targets of these attacks usually fell into two categories:
People closely associated with US presidential campaigns and candidates.
Prominent individuals in the international affairs community, academics in international affairs.
In the first category, Microsoft listed the Biden campaign (through non-campaign email accounts belonging to people affiliated with the campaign) and attacks against at least one individual formerly associated with the Trump Administration. More

Pros
✓355 degrees panning
✓Works with 2.4GHz and 5GHz
✓40ft detection range

Cons
✕Slight comms lag

The Reolink E1 zoom indoor security camera is a nice device, small at 111mm high, unobtrusive at 79mm wide, and has a range of features that you can set and forget. 
Like the Netvue Orb and the Heimvision HM302 indoor cameras, the E1 zoom has pan and tilt control. It will pan up to 355 degrees and tilt up to 50 degrees so it can be situated anywhere in a room to give complete coverage.
Unlike most other devices that connect to Wi-Fi, the E1 zoom has a dual-band Wi-Fi connection, so there is no need to faff about trying to connect the device to 2.4GHz.

Its images are sharp and clear with a resolution of 2560 x 1920 5-megapixel camera with its daylight and f2.8-8mm autofocus, F1.6, with IR cut.
This camera does not include an SD card, but you can install your own micro SD card up to 64GB in size.
Alternatively, you can back up your 20fps videos to the Reolink Cloud, or purchase an optional Reolink NVR (Network Video Recorder) unit that will support up to 8 or 16 cameras and has a hard drive of either 2TB or 3TB.
Top ZDNET Reviews

Inside the box, there is the camera, a mounting plate, a power adapter, and some screws. There is also a quick start guide, a template for where to drill the holes in the wall for the mount, and a surveillance sign to stick in the window.
Setting up the camera, like the Reolink Argus PT outdoor security camera is simple. All you need to do is install the Reolink app, scan the QR code on the bottom of the camera, and connect the camera to your Wi-Fi.
Then show the QR code that is generated on the app to the security camera, and connect the camera to the app. Streamlined and simple.
The app is also simple to use. Zoom in to see objects in detail and talk to people in the room from wherever. 
You can set email alerts and notifications, and configure a siren to sound at your command or at preconfigured times of the day. You can also record a personalized audio alarm.
Eileen Brown
The sound is excellent, so you can record and hear what is happening at home when you are away. Although my internet connection speed means I had a slight comms lag, it was not an issue to talk through the camera to the person in the room.
In the dark, the camera will detect movement up to 40 feet away, slightly further than the $35 Netvue Orb at 32 feet or the $51 Heimvision HM302 at 30 feet.

Eileen Brown
The more expensive SimCam 1S can detect movement up to 60 feet away. The picture quality is crisp and clear — even in pitch black rooms.
All in all, this is a nice security camera with a good app and crisp images. For around $70, the Reolink E1 Zoom indoor security camera will give you all-round monitoring and peace of mind. More

Image: Coalition

Ransomware incidents have accounted for 41% of cyber insurance claims filed in the first half of 2020, according to a report published today by Coalition, one of the largest providers of cyber insurance services in North America.
The high number of claims comes to confirm previous reports from multiple cyber-security firms that ransomware is one of today’s most prevalent and destructive threats.
“Ransomware doesn’t discriminate by industry. We’ve seen an increase in ransom attacks across almost every industry we serve,” Coalition added.
“In the first half of 2020 alone, we observed a 260% increase in the frequency of ransomware attacks amongst our policyholders, with the average ransom demand increasing 47%,” the company added.
Among the most aggressive gangs, the cyber insurer listed Maze and DoppelPaymer, which have recently begun exfiltrating data from hacked networks, and threatening to release data on specialized leak sites, as part of double extortion schemes.
Based on cyber insurance claims filed by customers who faced a ransomware attack in the first half of 2020, Coalition said the Maze ransomware gang was the most greedy, with the group requesting ransom demands six times larger than the overall average.

Image: Coalition
But besides ransomware incidents, Coalition said it also recorded a spike in the number of cyber insurance claims filed for funds transfer fraud attacks and business email compromise (BEC) events, with the first growing 35% from 2019 to 2020, and the second growing 67%.
Both are similar types of incidents, where criminal gangs trick a company into making a payment into an attacker-controlled account. The difference is that funds transfer fraud attacks can also occur via phone call or mail; BEC attacks are carried out purely via email.
Reported losses from these incidents have ranged from the low thousands to well above $1 million per event, but Coalition says that companies using Microsoft Office 365 have seen 3.2 times more BEC incidents than organizations using other types of email providers.
Nonetheless, Coalition said that in many cases of funds transfer fraud attacks, as well as BEC attacks, lost funds could be recovered, with quick intervention.
“Since the beginning of 2018, […] we’ve been able to recover funds in 55% of all cases, and we’ve recovered 84% of lost funds for these clients,” the cyber insurer said.

Image: Coalition More

Microsoft’s Patch Tuesday security update for Windows 10 version 2004 has reportedly broken Windows Subsystem for Linux 2 (WSL2). 
Multiple Windows 10 version 2004 users are reporting they’re unable to launch WSL2 after installing Tuesday’s security update, detailed in KB4571756. The update pushes Windows 10 2004 up to build number 19041.508. 

WSL2 provides a full Linux kernel built into WSL2, as well as improved system-call support for all Linux apps, including Docker, FUSE, rsync, and more. WSL2 shipped with Windows 10 version 2004, aka the May 2020 Update, and recently was made available for Windows 10 1903 and 1909. 
As spotted by BleepingComputer and TechDows, a user on GitHub has reported that after installing KB4571756 WSL2 crashes and shows the errors ‘Element not found’ and ‘Process existed with code 4294967295’.
Several other Windows 10 2004 users reported that uninstalling KB4571756 and reverting to build number 19042.487 allows WSL2 to start again.
One user who was on Windows 10 Home didn’t have any problems with WSL2 after installing the update, noting that Windows 10 Home edition doesn’t support Hyper-V natively whereas Windows 10 Pro does. 
Another user who did not have Hyper-V installed also didn’t run into any issues with WSL2 after installing KB457175. 
Microsoft rearchitected WSL 2 so that it provides a Microsoft-written Linux kernel running in a lightweight virtual machine that’s based on the subset of Hyper V. 
Microsoft has yet to acknowledge the WSL2 reports linked to the update. While uninstalling the update via Settings and Update History appears to resolve the issue, Windows 10 2004 users who do that should be aware that it will also remove patches for 20 critical vulnerabilities that were addressed in the September security update.  

Open Source More

Secureworks has acquired Delve to bring a new vulnerability management solution to the firm’s portfolio. 

Announced on Wednesday, Secureworks says the deal will “enrich Secureworks’ intelligence, further differentiate our end-to-end capabilities, and accelerate our transformation to deliver software with security at its core.”
The financial terms of the deal were not disclosed. 
Founded in 2014, Delve offers enterprise clients a vulnerability management platform based on artificial intelligence (AI) and machine learning (ML). 
See also: SugarCRM acquires Node, an AI-as-a-service company
With so many new vulnerabilities reported every day, security professionals and IT administrators face the challenge of working out what bugs are applicable to their businesses, and in what order fixes and patches should be applied based on severity and their potential impact. 
CNET: Security keys to thwart hackers are now easier to use on all your devices
Delve aims to tackle this by way of a Software-as-a-Service (SaaS) solution that applies AI and ML to vulnerability lists in order to sort security flaws into importance and context — including external factors — to assist users in their decision-making. 
Delve has offices in Montreal and New York City. Under the terms of the agreement, the automated vulnerability management platform, which also includes scanning and remediation planning tools, will become part of the Secureworks’ portfolio. 
TechRepublic: Backing up data is more important as people work from home during COVID-19
Technologies developed by the company will also be integrated into Secureworks’ Red Cloak and TDR threat detection platform and application.
“Together, we will expand customers’ access to the solutions and applications they need to make decisions that effectively defend their organizations against the most threatening adversaries,” commented Gabriel Tremblay, Delve CEO. 
The acquisition is expected to close in Q3 2020 subject to regulatory approval. 
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Image: Media_Visuals

Security researchers from Slovak cyber-security firm ESET said today they discovered a very rare piece of Linux malware that targets Voice-over-IP (VoIP) telephony switches with the end goal of stealing call details metadata.
For the time being, researchers said they merely spotted the malware and analyzed its behavior, but aren’t 100% sure who developed it, and for what purpose.
Considered theories include that the malware, which they named CDRThief, could be used for cyber-espionage or for a type of telephony fraud scheme known as International Revenue Share Fraud (IRSF).
How CDRThief works
But regardless of the end goal, the general conclusion from the ESET team was that CDRThief was developed by a threat actor with deep knowledge of the VoIP landscape.
For starters, the malware only targets two VoIP softswitches running on Linux servers. VoIP softswitches are software programs that run on regular servers and are designed to route calls using software, rather than special hardware.
Second, CDRThief only targets two softswitches programs, namely the VOS2009 and VOS3000 systems from Chinese company Linknat.
“At the time of writing we do not know how the malware is deployed onto compromised devices,” Anton Cherepanov, one of ESET’s top malware hunters, wrote in an analysis today.
“We speculate that attackers might obtain access to the device using a brute-force attack or by exploiting a vulnerability. Such vulnerabilities in VOS2009/VOS3000 have been reported publicly in the past,” Cherepanov added.
However, once the malware has a foothold on a Linux server running Linknat VOS2009 or VOS3000, the malware searches for the Linknat configuration files and extracts credentials for the built-in MySQL database, where the softswitch stores call detail records (CDR, aka VoIP calls metadata).
“Interestingly, the password from the configuration file is stored encrypted,” Cherepanov pointed out.
“However, Linux/CDRThief malware is still able to read and decrypt it. Thus, the attackers demonstrate deep knowledge of the targeted platform, since the algorithm and encryption keys used are not documented as far as we can tell. It means that the attackers had to reverse engineer platform binaries or otherwise obtain information about the AES encryption algorithm and key used in the Linknat code.”
After this step, Cherepanov says the malware connects to the MySQL database and runs SQL queries to gather CDR metadata, which is later uploaded to a remote server.
Attacks on telecoms not a rare sight
The ESET researcher said CDRThief is an extremely narrow piece of malware, built only for stealing VoIP call metadata, and nothing else. The malware doesn’t run shell commands or search and steals other files, at least in its current forms, meaning its creators and the people behind CDRThief attacks knew exactly what they wanted from each of their intrusions.
Furthermore, VoIP softswitches aren’t your regular type of software. They are usually installed on the networks of large telecommunications providers.
Over the past few years, incidents where hackers (usually state-sponsored groups) have targeted telecoms to steal information on traffic and voice calls have increased. This includes:
Operation Soft Cell: Chinese-linked hackers breached 10 telecoms and stole voice call metadata.
The A1 Telekom incident: A whistleblower revealed that Chinese hackers breached the internal network of Austria’s largest telecom provider and queried internal systems for “location, phone numbers and other customer data for certain private A1 customers.”
MessageTap malware: FireEye said it discovered malware specifically designed to Short Message Service Center (SMSC) servers, on a telco’s network, and steal data about SMS traffic. More

Facebook says that Irish regulators believe current user data exchange methods between the US and EU “cannot in practice be used,” leading to an inquiry into the data transfer practices employed by the company. 

The Irish Data Protection Commission (IDPC) is referring to Standard Contractual Clauses (SCCs), mechanisms designed to facilitate data transfers between the EU and non-EU countries. 
In Facebook’s case, SCCs are used to maintain transatlantic data flows including the exchange of EU user data. 
The Wall Street Journal reports that the IDPC sent a preliminary order to the social media giant last month to suspend the transfer of EU user data to the US.
See also: European court strikes down EU-US Privacy Shield user data exchange agreement as invalid
In a blog post penned by Nick Clegg, Facebook’s VP of Global Affairs and Communications on September 9, Clegg said that the IDPC has launched an inquiry into such data transfers and “suggested that SCCs cannot in practice be used for EU-US data transfers,” resulting in what could be a “far-reaching” impact on businesses. 
The EU-US Data Privacy Shield framework, established to enforce high protection standards when information is transferred out of EU borders, was the subject of a case brought to the Court of Justice of the European Union (CJEU) by Max Schrems.
The activist argued that the system could subject EU citizen data to abuse by US law enforcement, which is known to operate widespread surveillance programs. 
In July, the court deemed Privacy Shield as invalid due to GDPR standards, but SCCs — case-by-case data exchange systems that enforce “essential equivalence” to EU data protection standards — are still considered valid by the CJEU. 
Data controllers are required to maintain stringent data protection measures if they use SCCs and if they are found to be in breach, EU regulators have the power to suspend SCC programs.
CNET: Security keys to thwart hackers are now easier to use on all your devices
However, if Facebook complies with the Irish regulators’ stance on SCCs rather than the CJEU, without a way to legally exchange data between EU and US digital borders, the company claims economic damage will follow, and data-driven companies in Europe will also suffer when it comes to growth. 
“In the worst-case scenario, this could mean that a small tech start-up in Germany would no longer be able to use a US-based cloud provider,” Clegg says. “A Spanish product development company could no longer be able to run an operation across multiple time zones. A French retailer may find they can no longer maintain a call center in Morocco.”
TechRepublic: Backing up data is more important as people work from home during COVID-19
The executive added that since the CJEU’s ruling in July, Facebook has been “working hard to follow the steps set out by the court to ensure that we can continue to transfer data in a safe and secure way.”
Facebook has created a European Data Protection Board task force to consider how best to apply the CJEU ruling, and both the EU Commission and the US Department of Commerce are in talks to create an “enhanced” EU-US Privacy Shield. 
Facebook says it will continue to comply with the CJEU ruling “until we receive further guidance.”

Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More