Cyber attack against US - Different countries , different intentions (apart from meddling with upcoming 2020 election)

• China, has the capacity and desire to go after American targets for not only diplomatic and military information, but also for attacks on infrastructure and private-sector business.
• Russia, for example, will likely continue to go after critical infrastructure and focus on stealing intel from NATO
• Iran, meanwhile, is likely to focus on social media campaigns to help boost its public image and sway opinions in its favor.
• North Korea will look to boost its coffers with financial hacks. 

https://www.theregister.co.uk/2019/01/30/us_election_meddling/

Nature of Cyberattacks changing in ways that we did not expect

Like

Use of social media to attempt to influence votes or drive division within a nation via Twitter and targeted Facebook advertising campaigns.

Sony hack by North Korea as a pivotal moment when it came to nation states attempting to attack U.S. interests in unconventional ways.

Another social-fueled criminal trend are the rise of "dark markets"
Dark markets that facilitate all matter of crime, from narcotics trafficking, to illegal firearm sales, to identity theft, child exploitation, and computer hacking

More here:
https://threatpost.com/attackers-redefining-objectives-approaches/128276/

Ever heard of EQUATIONDRUG? - It has nothing to do with Drugs, it is an attack platform to control compromised computers.

We need to install software from a valid install CD but, if that is compromised then how can we protect.

Researchers at Kaspersky Lab have uncovered a cyberespionage group that has been operating for at least 15 years and has worked with and supported the attackers behind Stuxnet, Flame and other highly sophisticated operations. 

Once a PC is compromised, the attackers install the EQUATIONDRUG attack platform, which is the main component from which further operations run. The platform includes a variety of modules and has an analog in another platform called GRAYFISH, which is an updated version of the attack framework.

Countries targeted by this group include Russia, Syria, Iran, Pakistan, China, Yemen, Afghanistan, India but also US and UK, between and several others.

GRAYFISH is the most highly evolved version of its attack infrastructure. The attackers began using this platform about seven years ago and have been improving it as they go. - See more at: 

The trump card for the Equation Group attackers is their ability to inject an infected machine’s hard drive firmware. This module, known only by a cryptic name – “nls_933w.dll”, essentially allows the attackers to reprogram the HDD or SSD firmware with a custom payload of their own creation. 

Fanny creates a hidden storage area on the stick. If it infects a computer without an internet connection, it will collect basic system information and save it into the hidden area of the stick. Later, which a stick containing hidden information is plugged into a computer infected by Fanny having an Internet connection, the data will be scooped from the hidden area and sent to the C&C. 

Another incident included an installation CD for Oracle software that included a Trojan dropper for the Equation Group’s malware. This is a tactic that, through the Edward Snowden documents, has been attributed to operations conducted in the past by the National Security Agency.

The C&C infrastructure includes hundreds of domains in a number of countries, including the United States, the UK, Italy and Germany. 

“The scariest thing about them is that we don’t have any samples from 2014. So somewhere in 2013 these guys went off the radar,” he said. “We have no idea what they did in 2014, which is very, very scary.” -

The link below has more information:-

http://threatpost.com/massive-decades-long-cyberespionage-framework-uncovered/111080

Built a free botnet that generates $US1750 a week using free cloud: -

This is not fiction, 2 researches actually did it.

Moral of the story:

Cyberattacks might become more common

Security is still our problem not cloud provider's.

(From the article)

They used automatic tools and processes to spread a currency-mining botnet across some 150 popular free services that each generated about 25 cents a day -- all on the providers' electricity bill.

The bot was bult on free and fast tools including Mandrill and FreeDNS.afraid.org for email address registration, variations on public data breach databases, a custom program on Google App Engine, and the Python Fabric to manage scripts controlling the hundreds of cloud instances.

The link below has more information:-

http://www.theregister.co.uk/2014/07/25/boffins_build_free_supercomputer_from_signup_trials/

Awesome Real-time Cyber Threat map from Kaspersky

It is both real-time and interactive


http://cyberwar.kaspersky.com/

Cyber Incident - Do Business leaders have any plans?

For all business leaders, I would start with two questions 

1.  What is a Cyber Incident

2.  Do you know what would be the consequences if one occurs.

How many can answer it?

According to the article:- 

More than 80% of business leaders do not feel fully prepared for the effects of a cyber attack, 

Despite 77% of companies having faced a major cyber incident in the past two years, according to the survey of 360 senior business leaders in the U.S. and around the world, 38% of companies still have no plan in place for such events,

The links below has more information:

http://www.welivesecurity.com/2014/03/18/more-than-80-of-business-leaders-feel-unprepared-for-cyber-attack

Cyberespionage gets interesting - Agent.btz worm may have some cousins circulating the Internet.

I am confident that cyber espionage is going to be one area that is going  to get more intersting and SCARY.

According to the Article:

Agent.btz may have some cousins circulating the Internet, namely the recently-revealed Turla malware - also known as Snake - as well as the infamous Flame, Gauss and Red October malware.

The Agent.btz worm has a long history in cyberattacks. In 2008, it was at the center of an incident eventually dubbed "the most significant breach of U.S. military computers ever" by former Deputy Defense Secretary William J. Lynn III

Turla has also been linked to attacks in the United States, as well as attacks on other countries such as the Ukraine.

The Red October developers must have known about Agent.btz's functionality, as their USB stealer module searches for the worm's data containers. Those containers hold information about infected systems and activity logs.

Both the notorious Flame and Gauss malware use similar naming conventions as Agent.btz, such as '*.ocx' files and 'thumb*.db'.

The following link has more information:

http://www.darkreading.com/attacks-breaches/cyberespionage-worm-may-have-ties-to-mul/240166658

Difference between CNE and CNA - Please note, I am not referring to NOVELL Certifications

SNIPPET from the Article:-

According to Bruce -  U.S. military  terms for what it does in cyberspace. CNE stands for "computer network exploitation." That's spying. CNA stands for "computer network attack." That includes actions designed to destroy or otherwise incapacitate enemy networks. That's -- among other things -- sabotage.

When the Chinese company Huawei tried to sell networking equipment to the U.S., the government considered that equipment a "national security threat," rightly fearing that those switches were backdoored to allow the Chinese government both to eavesdrop and attack US networks. Now we know that the NSA is doing the exact same thing to American-made equipment sold in China, as well as to those very same Huawei switches.

Also, a hacking tool called RCS is used by 21 governments. (Maybe we should officially offer this tool to other nations in a UN Summit.)

The links below has more details:

https://www.schneier.com/blog/archives/2014/03/computer_networ.html

Uroburos - Rootkit - More Details

Snippet:

“This kind of data stealing software is too expensive to be used as common spyware. We assume that the attackers reserve the Uroburos framework for dedicated and critical targets. This is the mainreason why the rootkit was only detected many years after the suspected first infection. Furthermore, we assume that the framework is designed to perform cyber espionage within governments and high profile enterprises but, due to its modularity, it can be easily extended to gain new features and perform further attacks as long as it remains undetected within its target.”

The links below has more details:

https://www.alertlogic.com/uroburos-profile/



Previous story - Uroburos rootkit - Apparently this Malware is 3 years old 

http://martin-news-bytes.blogspot.com/2014/03/uroburos-rootkit-apparently-this.html



Previous story - It is claimed to be from Russian government.

http://martin-news-bytes.blogspot.com/2014/03/20th-century-was-nuclear-threat-from.html

Hey, what's that burning smell - it's nothing, just a cyberattack setting my computer is on fire.

A cyberattack demonstration "frying the machine" was done by targeting the machine's APC embedded controller through a fake firmware update devised by CrowdStrike that spiked the CPU and turned off the fans.

The point, said Alperovitch, is this is a type of cyberattack that enterprises really can expect to see happen in the future, an attack that is not recoverable in terms of data or the machine itself

The link below has more details:

http://www.cio.com/article/748849/RSA_Security_Attack_Demo_Deep_Fries_Apple_Mac_Components