Cyber-attack

UK Accuses Russian Military of “Malicious Cyber Attack”

The British Foreign Minister has pointed the blame at the Russian government, specifically their military for a global cyber attack that ripped thru European businesses a year ago, accusing the Russians of “weaponizing information” in the realm of cyber warfare.

Foreign Minister Tariq Ahmad said, “the U.K. government judges that the Russian government, specifically the Russian military, was responsible for the destructive NotPetya cyberattack of June 2017.”

The fast-spreading outbreak of data-scrambling software centered on Ukraine, which is embroiled in a conflict with Moscow-backed separatists in the country’s east. It spread to companies that do business with Ukraine, including U.S. pharmaceutical company Merck, Danish shipping firm A.P. Moller-Maersk and FedEx subsidiary TNT.
Ahmad said the “reckless” attack cost organizations hundreds of millions of dollars.
British Defense Secretary Gavin Williamson accused Russia of “undermining democracy, wrecking livelihoods by targeting critical infrastructure and weaponizing information” with malicious cyber attacks.
“We must be primed and ready to tackle these stark and intensifying threats,” Williamson said.
Denmark’s defense minister, Claus Hjort Frederiksen, said that the hack was meant to specifically cause damage. “Russians have lifted this up to a higher level where the aim is to cause harm just like in a military attack,” he was quoted as saying by the Jyllands-Posten newspaper.
President Vladimir Putin’s spokesman, Dmitry Peskov, denied Russia’s involvement.
“We categorically deny the accusations. We consider them unfounded and baseless and see them as a continuation of a groundless Russophobic campaign,” he said in a conference call with reporters.

While the Russians continue to claim that they are blameless, it remains a fact that too many of these attacks come from within their own borders and they’ve done precious little to stop them. And their businesses have been scarcely affected.

To read the entire article from the Washington Post, click here:

Photo courtesy Wikipedia

US Military Reviewing Rules for Fitness Trackers After Data Exposed

All wireless trackers used by U.S. military personnel are being evaluated after it was discovered that fitness trackers used by many troops and civilians can be easily hacked and used to expose the identities of service members working in sensitive and hazardous locations.

The review came after reports in The Washington Post and elsewhere that a global heat map posted online by the fitness-tracking company Strava reveals the outlines of U.S. military bases in some of the most dangerous locations in the world – along with the routes taken by supply convoys and patrols.
In the latest discoveries on Monday, experts and Internet sleuths found further ways of using the publicly available Strava data to identify individual users of the tracking service by name, along with the jogging routes they use in war zones such as Iraq and Afghanistan.
On one of the Strava sites, it is possible to click on a frequently used jogging route and see who runs the route and at what times. One Strava user demonstrated how to use the map and Google to identify by name a U.S. Army major and his running route at a base in Afghanistan.
On another Internet site, it is possible to establish the names and home towns of individuals who have signed up for a social sharing network where runners post their routes and speeds. One popular route on a base in Iraq has been nicknamed “Base Perimeter” by the U.S. runners who regularly use it. Another outside the big U.S. base in Kandahar, Afghanistan, is called “Sniper Alley.”
The U.S. military said in an emailed response to questions from The Post on Monday that new technologies pose challenges that are constantly being reviewed.
“The rapid development of new and innovative information technologies enhances the quality of our lives but also poses potential challenges to operational security and force protection. We constantly refine policies and procedures to address such challenges,” said the Central Command press office.

While there is no clear regulatory or legal framework for companies such as Strava that collect information on individuals using newly available technologies, it is also easy to see where the enemies of the US military could easily hack into the database and plan terrorist activities targeting U.S. servicemembers.

To read the entire article from The Chicago Tribune, click here:

Photo courtesy Wikipedia

British Worry Russian Submarines Could Cut Internet To NATO

There is a new worry among Western Europe’s NATO Allies according to Chief Marshall Stuart Peach, head of Britain’s military that the Russians could try to sever global underwater communications cables, potentially triggering catastrophic repercussions for the economy and way of life in the West.

According to military and government analysts, most of the global internet and telephone traffic that Western governments and economies rely so heavily on are carried by undersea cables that run on the seabeds of the world.

NATO has prioritized missions to protect these undersea lines of communication and is working “to match and understand Russian fleet modernization,” Chief Marshall Stuart Peach told the Royal United Services Institute (RUSI), a defense think tank in London.
“Your emails, what you order on Amazon, your phone calls, online banking, it’s all done through undersea cables not through satellites,” said Peter Roberts, director of military sciences at RUSI.
Roberts warned that “the threat from Russia is very real” and that Russian tapping of submarine cables was already happening.
“In the school of Russian warfare at sea it’s not about aircraft carriers, it’s about the undersea domain,” said Roberts.
There have been reports of Russia damaging communication lines in the North Atlantic as early as the 1970s, according to Igor Sutyagin, an expert in U.S.-Russian affairs at RUSI, who spent more than a decade in Russian prison on charges of espionage for the United States.

The Russian Embassy in London dismissed the claims as sensationalist, however, a look at how they used electronic warfare when they occupied the Crimea is a textbook operation on what European leaders are fearing. They cut off the main cable connection from the Crimea to the outside world, and any non-Russian news or information was blocked from reaching civilians.

Russia annexed the Crimea during the upheaval in Ukraine and many experts are looking at how they handled the Crimea as the playbook for how they’d try to replicate the same tactics in a future conflict.

To read the entire article from NBC News, click here:

Photo courtesy Wikipedia

How to Spot Fake Russian News Bots in Your Timeline

Earlier this week British Prime Minister Theresa May said in a speech that social media was inundated with Russian attempts to distort the news and elections and accused Moscow of “planting fake stories” online as part of a “campaign of cyber-espionage and disruption”.

She was using the information after both British and US intelligence services identified several prominent news services were exposed as Russian bots.

Earlier in November, the US Senate Select Committee on Intelligence provided a list of 2,753 suspended, Russian-linked Twitter accounts.

Many of these fake Russian bot accounts have been traced directly to the Internet Research Agency, in St Petersburg. The Russian government-backed agency reportedly runs social media accounts disseminating “disinformation”.

This “troll farm” was exposed by a whistleblower in the New York Times in 2015. A BBC investigation has also uncovered a pro-Russia “troll factory” in Ukraine.
The Oxford Internet Institute – part of the University of Oxford and recipients of the Democracy award for its analysis of propaganda – says bots “significantly impact [on]public life during important policy debates, elections, and political crises” and “flourished during the 2016 US presidential election”.
Bot-spotting tips
The Atlantic Council’s Digital Forensic Research Lab (DFRL) offers social-media users tips for spotting a bot:
Frequency: Bots are prolific posters. The more frequently they post, the more caution should be shown. The DFRL classifies 72 posts a day as suspicious, and more than 144 per day as highly suspicious.
Anonymity: Bots often lack any personal information. The accounts often have generic profile pictures and political slogans as “bios”.
Amplification: A bot’s timeline will often consist of re-tweets and verbatim quotes, with few posts containing original wording.
Common content: Networks of bots can be identified if multiple profiles tweet the same content almost simultaneously.
The Digital Forensic Research Lab’s full list of tips can be found here.
There has been a move away from fully automated bots to semi-automated accounts.
Such accounts are harder to identify, as they intersperse their activity with references to popular culture and personalized replies.

To read the entire article from The BBC, click here:

Photo courtesy Wikipedia

Hackers Steals US, South Korea War Plans for Crushing North Korea

Computer hackers believed to be from North Korea, hacked into a South Korean defense department site and stole a large amount of classified military documents, a South Korean spokesman said on Wednesday.

The documents supposedly include the United States and South Korean war plans to wipe out the North Korean leadership.

Democratic Party representative Rhee Cheol-hee said in radio appearances on Wednesday that 235 gigabytes of military documents were taken from the Defense Integrated Data Center in September last year, citing information from unnamed South Korean defense officials.
This May an investigative team inside the defense ministry announced the hack had been carried out by North Korea, but did not disclosed what kind of information had been taken.
Pyongyang has denied responsibility for the cyberattacks in its state media, criticizing Seoul for “fabricating” claims about online attacks.
Rhee, currently a member of the National Assembly’s committee for national defense, said about 80 percent of the hacked data has not yet been identified, but that none of the information was expected to have compromised the South Korean military as it was not top classified intelligence.

Neither the US or the South Korean military will comment on anything relating to intelligence matters but spokesmen from both countries are assured that their war-time plans are safe.

Apparently, the hack was made possible by a contractor who performed maintenance on the computer in question and “inadvertently” left a connecting jack linking the military’s intranet with the internet which made the computer vulnerable to a hack.

To read the entire article from Reuters, click here:

Photo courtesy Wikipedia

Iran Warns US Against Further Sanctions, Terrorist Designation

In a bizarre turn of events that seem to be lost on the powers that be in Tehran, the Iranian government warned the United States that further sanctions against them or labeling Iran’s Revolutionary Guard a terrorist organization could result in attacks against US bases near the Iranian border.

In other words, the Iranians have basically stated that if the US labels them a terrorist organization, the Revolutionary Guard will act like terrorists and attack US bases. Their state-run news also threatened missile attacks to the limit of their range.

Iran warned the United States Sunday against imposing new sanctions, as well as against declaring Iran’s powerful Revolutionary Guard a terrorist organization.
The head of the elite military unit also made a veiled threat to attack US military bases in the region.
The state-run IRNA news agency quoted General Mohammad Ali Jafari as saying: “If new sanctions go into effect, the country [US] should move its regional bases to a 2000-kilometer radius, the range of Iranian missiles.”
The US has military bases in countries neighboring Iran, about 300 miles (500 km) from Iran’s borders. They include sites in Bahrain, Iraq, Oman, and Afghanistan.

The Iranians also claim that they will label the US military a terrorist organization in a tit-for-tat move, which they said is akin to deeming the US the equivalent of the Islamic State. The latest war of words has to do with the nuclear deal the previous US administration struck with Iran. President Trump made a campaign promise to void the deal which essentially guarantees a nuclear-capable Iran.

Regardless of whether or not the US voids that deal, there is expected to be sharper sanctions against the Iranians due to their disregard of the nuclear deal’s limits on missile testing, cyber-attacks and their continued support of terrorism.

To read the entire article from The DW, click here:

Photo courtesy Wikipedia

Ally of Merkel Cites Thousands of Cyber Attacks From Russian IP

Despite Russia’s insistence that they are not trying to influence foreign elections, German political party members are claiming that their website has been hit with thousands of cyber-attacks. The vice chairman of German Chancellor Angela Merkel’s Christian Democratic Union says that their website has been hit with thousands of cyber-attacks before Sunday’s televised election debate. And most have come from Russian IP addresses.

With Merkel widely expected to win a fourth term, some German intelligence officials have often voiced concerns on whether Moscow would seek to interfere in the Sept 24 national election.

Ms Julia Kloeckner, vice chairman of Dr Merkel’s Christian Democratic Union (CDU), said on Monday (Sept 4) that her political website had seen some 3,000 attacks on Sunday before the debate between Dr Merkel and Social Democratic leader Martin Schulz.
Following a pattern seen in earlier hacks, the CDU’s headquarters in the state of Rhineland-Palatinate, where Ms Kloeckner is the party’s leader, also experienced “massive attacks” ahead of the debate, she said.
“Many of the senders have Russian IP addresses,” Ms Kloeckner added.
German authorities have blamed a spate of cyber attacks directed at the German parliament, individual lawmakers, political parties and political think-tanks since summer 2015 on APT 28, a Russian hacker group with links to Moscow.

Some in German intelligence believe that Russian President Putin would like a different leader as the German Chancellor than Merkel. The Germans and Merkel despite being dependent on Russia for energy sources have supported economic sanctions against Russia for their actions in Ukraine.

The cyber-attackers were using phishing schemes to insert malicious software and search for vulnerabilities. German police and intelligence officials continue to investigate.

To read the entire article from Reuters click here:

Photo courtesy Wikipedia

Thousands of Military Contractor Files Left Unsecured Online

Veterans and active duty members near separation from the service including intelligence personnel who were seeking employment had their personal information including their resumes left unsecured and available for public consumption. Thousands of files were in the open until being discovered earlier this year.

TigerSwan, a North Carolina-based private security firm had files dating back to 2009 on job applications left unsecured for anyone making an open source search. TigerSwan on Saturday blamed TalentPen, a third-party recruitment company, who they said worked for them during the time period.

The files, largely resumes, mostly came from members of the military, but also included intelligence veterans, a police chief, and a United Nations worker in the Middle East. The files included personal contact information, such as addresses, phone numbers and private email addresses.
In February, when TigerSwan canceled its contract with TalentPen, TigerSwan claims the recruiter used Amazon cloud services to transfer the resumes it had amassed to TigerSwan.
TigerSwan said that transfer was conducted using high-end encryption and TalentPen was supposed to immediately delete the files. But the files remained on the site and due to an apparent security setting misconfiguration, those files were not encrypted.

TigerSwan said it wasn’t aware of the problem until August 31 and believes that a former recruiter for TalentPen had left the files on-line. TalentPen has dissolved but a former account manager said that there was still activity on their account.

Any veterans who have applied for any positions thru TigerSwan should contact the company and check to see if their records have indeed been compromised.

To read the entire article from The Hill, click here:

Photo courtesy Wikipedia

Op-Ed: When Espionage Pays, Chelsea Manning Steps Out for Vogue

Vogue Magazine recently did a feature including a photo shoot by Annie Leibovitz on Chelsea Manning, who they’re touting as a hero. “Chelsea Manning Changed the Course of History. Now She’s Focusing on Herself” and it is eye-opening and would be comical if it weren’t so serious. Hero? Hardly, she’s fortunate she’s not still in Leavenworth where she was serving her sentence.

For those of you who don’t remember who Chelsea Manning is, back in 2009 the then Bradley Manning, a specialist in the U.S. Army was stationed in Baghdad. He leaked thousands of documents to Wikileaks in 2010 after trying to approach both the Washington Post and the New York Times to turn over classified documents.

After being rebuffed by both the Post and Times, he began to correspond with Wikileaks on social media on both the IRC and Jabber platforms.

The entire story began in January 2010, Manning downloaded 400,000 documents in what later became the Iraq War Logs. Just three days later, he downloaded an additional 91,000 documents which were referred to as the Afghanistan War Logs. Manning then burned them to a CD which was labeled “Lady Gaga” which would get thru any cursory security inspection. He then downloaded the documents to his personal computer.

The next day, Manning wrote to the Washington Post offering to turn over the classified documents with a message that was later recovered.

Items of historical significance of two wars Iraq and Afghanistan Significant Activity, Sigacts, between 0001 January 2004 and 2359 31 December 2009 extracts from CSV documents from Department of Defense and CDNE database.
These items have already been sanitized of any source identifying information.
You might need to sit on this information for 90 to 180 days to best send and distribute such a large amount of data to a large audience and protect the source.
This is one of the most significant documents of our time removing the fog of war and revealing the true nature of 21st century asymmetric warfare.
Have a good day.
Manning, January 9, 2010″

Manning then copied the documents to an SD card in his camera which he planned on taking with him back to the United States on leave. While back in the US, he contacted a Post reporter who didn’t seem interested. The Times didn’t return a phone call so Manning then sought out Wikileaks. He then transmitted all of the documents to Wikileaks on February 3, via the TOR platform.

After returning to Iraq, Manning didn’t know if Wikileaks had received the original 500,000 documents but sent them a diplomatic cable from the US Embassy in Reykjavik, Iceland which was posted on their website immediately. He then posted two videos, one, an airstrike in Baghdad and the other from Afghanistan. Later over a two-week period between late March and early April 2010, Manning downloaded 250,000 diplomatic cables and uploaded them to Wikileaks’ Dropbox. During this time he was actively chatting with someone he believed to be Julian Assange.

In late April, Manning sent a letter to his direct line supervisor, MSG Paul Adkins stating that he was suffering from gender disorder and included a picture of himself dressed as a woman. Adkins kept the information private and didn’t discuss nor share any information within the chain of command for fear that the picture would end up being disseminated in the unit.

Manning was busted from Specialist to PFC after he had an altercation with a female member of his unit and punched the other soldier, Specialist Jihrleah Showman in the face. Manning began a series of chats online with a known hacker Adrian Lamo and admitted being the person behind the leaks. Lamo thought that the leaks that Manning had admitted to were endangering lives and went to the Army’s Criminal Investigation Division or CID.

Manning was arrested by CID on May 27, 2010. After return to the US, he was held at the Quantico, Marine Corps base. On Feb. 28, 2013, Manning pleaded guilty to 10 of the charges he was facing. Manning’s trial began on June 3, 2013. Manning was convicted on July 30, on 17 of the 22 charges, including five counts of espionage and theft, and an amended version of four other charges; however, he was acquitted of aiding the enemy. Manning was sentenced to 21-35 years in prison at Ft. Leavenworth, KS, reduced to PVT, E-1. forfeiture of all pay and allowances and given a dishonorable discharge.

Manning made a statement to the court prior to sentencing saying,

I am sorry that my actions hurt people. I’m sorry that they hurt the United States. I am sorry for the unintended consequences of my actions. When I made these decisions I believed I was going to help people, not hurt people. … At the time of my decisions, I was dealing with a lot of issues.”- Manning

On January 26, 2017, President Obama commuted all but four months of Manning’s sentence. During his time in prison, Manning came out fully as a transgender and was now referred to she.

When Manning was released, she had no job, no money and few prospects. But she became a poster child for the far left as if her gender identity issues made her behavior not only ok but of the heroic variety. A GoFundMe page was set up for Manning.

My how times have quickly changed. Some of our sources report that she’s living in a very expensive area of the New York City with professional security when she steps out.

In the Vogue piece, the magazine commented on her apparel that she was wearing that they described as:

dressed with a mixture of straightforward elegance and function: a casual black sleeveless Marc Jacobs dress with playful paisley lining, a small purse from The Row, Borderline boots by Vetements x Dr. Martens”

Do a quick check online at the cost of those items. Coupled with a Tribeca apartment and a security detail and it would seem espionage against your own country does pay.

Manning isn’t a hero nor worthy of any respect for anything she did. She admitted to hurting the United States and the people she served with. But hey, these are different times we live in. Because she’s transgender, that makes it all perfectly fine with some folks. And you’d think she’s laying low these days and trying to blend into the woodwork. Most convicted felons do. But these are different times we live in.

She’s now an active social media maven, where she lectures the rest of us on how smart she is on national issues.

To quote Yakov Smirnoff… “What a country.”

Featured image courtesy of Wikipedia

The Latest Cyber War Developments Have a New, Worrisome Twist

United States national security officials looking into Russian cyber-meddling of the recent elections are seeing that the recent “ransomware” cyber-attacks are part of an increasing problem. Hackers are now not just in the business of ransom but in chaos and disruption of the internet.

The goals are to disrupt signaling capabilities, disruption of normal systems and demonstrate the instability of the Western democracies. And some say it IS time to worry.

A number of analysts described the Petya/NotPetya incident of June and the WannaCry event in May as ransom attacks, aimed at gaining as much bitcoin as possible. But our analysis of cyber-coercion highlights how ransomware events such as the Petya are often strategically motivated and less about gaining funds than they are about sending a signal. The primary goal instead appears to be limited destruction through malware wiping systems.
North Korea and Russia are the likely originators of these attacks. What’s the motivation, beyond simply the chaos factor? For Russia, the Petya attack could be a means of encouraging the perception of Ukraine as a failed state — a view that aligns with Russian interests.
Cyber-operations amplify larger psychological warfare efforts. North Korea’s goal, most likely, could be to cause general chaos in Western systems, as a means of signaling strength — and its capacity to escalate in any future crisis.
In addition to propaganda, states use cyber-operations to influence elections and conduct disruption operations. Russian interference in the elections of Western states has become so common it is now expected. But instead of just disrupting elections, Russia now seems to be leveraging cyberespionage and propaganda to generate larger crises.
Russia now appears to be using Ukraine as more than a testing ground for cyberwar — it is demonstrating its ability to disrupt faith in public institutions. While the resulting crises after a cyber-event risk inadvertent escalation, the real danger is the erosion of cyber norms. With each new cyber-disruption, the shock decreases, and we grow to expect disorder. The resulting uncertainty and chaos undermines our trust in the open Internet architecture and risks upsetting stability inherent in cyber-exchanges to date.

To read the entire article from The Washington Post, click here:

Photo courtesy Wikipedia