Chinese spy chips are found in hardware used by Apple, Amazon? - Both vendors say "NO"

Nested on the servers’ motherboards, the testers found a tiny microchip, not much bigger than a grain of rice, that wasn’t part of the boards’ original design.

During the ensuing top-secret probe, which remains open more than three years later, investigators determined that the chips allowed the attackers to create a stealth doorway into any network that included the altered machines.

Multiple people familiar with the matter say investigators found that the chips had been inserted at factories run by manufacturing subcontractors in China


https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies

Cyber security is a matter for the boardroom, not the IT team because, cyber security is firmly a business issue, not a technology one

.



There are many aspects to an effective corporate battle plan to defend against a cyber attack, but success is dependent on direction from the top.

1. The first step is to develop a cyber security policy that the leadership team can understand, take seriously, and enforce through accountable management. 
2. Another step is to begin discussing cyber threats in board meetings, which will allow the business to develop a robust approach to ensuring the organisation’s digital security.
3. Get some qualified people from outside to shoot holes in the plans. Find a firm that will tell the hard and uncomfortable truths that technical staff may not mention
4. Finally, at the heart of the problem is a shortage of skills. We really cannot wait for this to fix itself. Those in senior positions need to educate themselves, and overcome their fear of cyber.

Ultimately, cyber security is firmly a business issue, not a technology one

http://www.cityam.com/288564/cyber-security-matter-boardroom-not-team-executives-must

HammerToss Espionage Tool - Using Twitter + Steganoraphy

Hackers always amaze me,
Their ability to adapt and innovate is unbelievable


From the article:

Once APT29 has access to a target network and deems it worthy, it deploys Hammertoss, which communicates through URLs seeded in social media accounts—Twitter in particular—and makes use of steganography in images stored on GitHub or compromised websites to retrieve encrypted instructions.

“It’s unique in its ability to lay low, and thwart defenses.”

“When you look at the flow, from Twitter to GitHub to cloud storage, from a defender’s perspective, that’s not going to look malicious,” said Jordan Berry, threat intelligence analyst at FireEye.

“In this case, there’s no compromised infrastructure to look for and block because they created their own workaround.”



For more info:
https://threatpost.com/new-hammertoss-espionage-tool-tied-to-miniduke-gang/113996

Cyberespionage gets interesting - Agent.btz worm may have some cousins circulating the Internet.

I am confident that cyber espionage is going to be one area that is going  to get more intersting and SCARY.

According to the Article:

Agent.btz may have some cousins circulating the Internet, namely the recently-revealed Turla malware - also known as Snake - as well as the infamous Flame, Gauss and Red October malware.

The Agent.btz worm has a long history in cyberattacks. In 2008, it was at the center of an incident eventually dubbed "the most significant breach of U.S. military computers ever" by former Deputy Defense Secretary William J. Lynn III

Turla has also been linked to attacks in the United States, as well as attacks on other countries such as the Ukraine.

The Red October developers must have known about Agent.btz's functionality, as their USB stealer module searches for the worm's data containers. Those containers hold information about infected systems and activity logs.

Both the notorious Flame and Gauss malware use similar naming conventions as Agent.btz, such as '*.ocx' files and 'thumb*.db'.

The following link has more information:

http://www.darkreading.com/attacks-breaches/cyberespionage-worm-may-have-ties-to-mul/240166658

Uroburos - Rootkit - More Details

Snippet:

“This kind of data stealing software is too expensive to be used as common spyware. We assume that the attackers reserve the Uroburos framework for dedicated and critical targets. This is the mainreason why the rootkit was only detected many years after the suspected first infection. Furthermore, we assume that the framework is designed to perform cyber espionage within governments and high profile enterprises but, due to its modularity, it can be easily extended to gain new features and perform further attacks as long as it remains undetected within its target.”

The links below has more details:

https://www.alertlogic.com/uroburos-profile/



Previous story - Uroburos rootkit - Apparently this Malware is 3 years old 

http://martin-news-bytes.blogspot.com/2014/03/uroburos-rootkit-apparently-this.html



Previous story - It is claimed to be from Russian government.

http://martin-news-bytes.blogspot.com/2014/03/20th-century-was-nuclear-threat-from.html

Uroburos rootkit - Apparently this Malware is 3 years old

It is  designed to capture network traffic and steal files. It's a rootkit made up of two files, a driver and an encrypted virtual file system. The rootkit is able to take control of an infected machine, execute arbitrary commands and hide system activities.

The malware communicates over a peer-to-peer network. Providing it can find one computer with internet access within a compromised network, it's capable of stealing data from other infected computers on the same network – even if they don't have access to the interwebs

Similarities in techniques and technology point to links between Uroburos and a malware-based attack against the US around six years ago.

The link below has more details:

http://www.theregister.co.uk/2014/03/04/uroburos_spyware/

Here is the previous story where it was claimed to be from Russian government.

http://martin-news-bytes.blogspot.com/2014/03/20th-century-was-nuclear-threat-from.html

20th Century was Nuclear Threat from nations; 21st Century is Malware from Nation States

We better  get used to these types of headlines.   

Well, you can figure out the reason

G Data bases its case for Russian government involvement on the complexity of the malware and the presence of Cyrillic words in the malware sample

Uroburos is a rootkit made of two files, "a driver and an encrypted virtual file system," that can "take control of an infected computer, execute arbitrary commands, and hide system activities." The malware is highly dangerous, MN alleges, because its structure is "modular" and "flexible," meaning that new malicious functions can be added to it easily.

The link below has more details:

http://news.cnet.com/8301-1009_3-57619748-83/security-firm-claims-russian-government-makes-malware