ProtonMail (Wrongly?) Criticized for Disclosing User IP to Authorities

Blaming ProtonMail misses important lessons of the case, as request from authorities ticked the necessary requirements under Swiss law

ProtonMail, a privacy and security-focused email provider based in Switzerland, has been strongly criticized for providing the IP address of a customer to Swiss authorities, ultimately leading to the arrest of a climate activist in France. But simply blaming ProtonMail misses the important lessons of this case.

Background

French authorities were aware that a group ‘of interest’ (the Youth for Climate collective and associated groups) used the jmm18[@]protonmail.com email address. According to police reports, the climate group had hardened its interests along general anti-capitalist lines, and were taking part in illegal squatting and damage to property.

Since Switzerland is not part of the EU, the French police could not demand that the Swiss authorities obtain and hand over the IP address of the email user. Instead, it approached Switzerland via Europol. Switzerland acquiesced with Europol, and required ProtonMail to deliver up the IP address. Since the request ticked all the necessary requirements under Swiss law, ProtonMail had no option but to obey.

It should be stressed that ProtonMail cannot deliver the content of its end-to-end encryption – this is solely about the user’s IP address.

ProtonMail

ProtonMail is not happy with the events. It published a blog titled Important clarifications regarding arrest of climate activist on September 6, 2021, commenting, “We are also deeply concerned about this case and deplore that the legal tools for serious crimes are being used in this way.”

Several points stand out in this blog – most importantly that ProtonMail had no alternative but to comply with the Swiss court order. ProtonMail does not know the identity of its users. “We only know that the order for data from the Swiss government came through channels typically reserved for serious crimes.” It did not know that the target of observation was a group of French climate activists – for all ProtonMail knew, it could have been a gang of international terrorists.

Noticeably, the blog provides no information on the details of the case. However, it directs readers to the ProtonMail transparency report, and the ProtonMail privacy policy. The former states, “ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities.” The latter includes, “If permitted by law, we will always contact a user first before any data disclosure.”

It is possible that ProtonMail was required to monitor the IP or IPs used by the email address over a period of time, while simultaneously under a gagging order not to disclose the fact. Only after an arrest could matters be made public.

Lessons to be learned

SecurityWeek talked to European privacy activist and advocate Peter Sunde Kolmisoppi. He works on projects designed to help people protect their privacy (such as Njal.la, a privacy aware domain service with both VPS and VPN), but also encourages groups and political entities on increasing the right to privacy. He is a co-founder of The Pirate Bay and the founder of Flattr and Njal.la.

Sunde does not blame ProtonMail for what happened, but that doesn’t mean he is not angry at what did happen. The primary problem, he suggests, is that ProtonMail is “based in a country that has a government that can control their actions. That’s the main flaw. A lot of activists, technologists and hosters have this idea that certain countries are ‘bulletproof’ when it comes to privacy. That’s certainly not the case.”

This is the first lesson to be learned – to recognize that all companies are subject to the laws of the country where they reside, irrespective of their own principles and preferences.

He believes the solution here would be to decentralize the service – something eminently feasible given todays’ global public cloud. “The basic problem here is again that we’ve centralized things. Organizations, services – e-mail is among the easiest of all services to have decentralized – and trust.” But ProtonMail is what it is, and alternative ideas are irrelevant to the current situation.

“It’s not the fault of ProtonMail, he says, it’s the fault of the authorities. And I’m sure that ProtonMail will take lessons from this to improve their threat model.” ProtonMail has started to stress the availability of its onion service to allow users with heightened threat conditions to gain the additional protection of Tor, and provides clear access to its own VPN, ProtonVPN, on the home page.

Swiss law treats VPN different to email. “Under current Swiss law, email and VPN are treated differently, and ProtonVPN cannot be compelled to log user data,” wrote ProtonMail in its blog. The implication is that the French authorities may not have been able to secure the IP address had the activists been using ProtonMail with Tor and VPN as well as ProtonMail.

This is the second lesson – when using any service, be aware of the additional security protection that may be available, and use it.

Sunde’s anger is directed against the authorities rather than ProtonMail. It seems that the route taken to get the IP address was originally intended for just the most serious of crimes – not to be used against climate activists (although in fairness we don’t really know what else the authorities were hoping or expecting to find).

“Switzerland is not part of the EU, so we’re not sure why Switzerland nor the EU looked at this as a case as important enough to go to these extreme measures,” he told SecurityWeek. “There should have been many people that could have stopped this insanity.”

He continued with the third lesson to be learned: “In general, I would say that people should not trust any single entity/provider to protect any secret communication, because most of these organizations can be forced to do things, or there can be backdoors or security issues with other things. An app for secure chat is great but it will ultimately come down to if your computer/phone is secure – and it is not.”

Finally, wearing his activist hat, he added, “I think we need to shame both the Swiss and EU authorities for allowing this ridiculous thing to happen; and hopefully this situation will lead to better decisions on what they will do in the future.”

It is worth also adding that although there is no direct comparison, the primary argument that has led the European courts to issue the Schrems II ruling has been the ability of the NSA to obtain European personal information. In this instance, the French authorities obtained personal information of European residents through the cooperation of Europol and the Swiss authorities.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/mZzCv7sNaxY/protonmail-wrongly-criticized-disclosing-user-ip-authorities

Cisco Patches High-Severity Security Flaws in IOS XR

Cisco this week released patches for multiple high-severity vulnerabilities in the IOS XR software and warned that attackers could exploit these bugs to reboot devices, elevate privileges, or overwrite and read arbitrary files.

The most severe of these issues is CVE-2021-34720 (CVSS score 8.6), a bug that could be exploited remotely without authentication to exhaust device packet memory, leading to a denial of service (DoS) condition.

The issue was identified in the IP Service Level Agreements (IP SLA) responder and Two-Way Active Measurement Protocol (TWAMP) features of IOS XR and exists because socket creation failures are not handled correctly during the IP SLA and TWAMP processes.

By sending specific IP SLA or TWAMP packets, an attacker could trigger the vulnerability to exhaust the packet memory. This could result in the crash of the IP SLA process or could affect other processes, such as routing protocols.

Cisco also patched a separate issue (CVE-2021-34718, CVSS 8.1) in the SSH Server process of IOS XR that could be exploited by a remote attacker to overwrite and read arbitrary files. Exploitation of this bug requires authentication.

[ READ: Microsoft Warns of Information Leak Flaw in Azure Container Instances ]

The issue exists because arguments that the user supplies for a specific file transfer method aren’t sufficiently validated. Thus, a low-privileged attacker could specify Secure Copy Protocol (SCP) parameters at authentication, which could allow them to elevate privileges and retrieve and upload files on a device.

Two other high severity privilege escalation bugs (CVE-2021-34719 and CVE-2021-34728) were also addressed in IOS XR, along with a denial of service flaw (CVE-2021-34713) affecting ASR 9000 series aggregation services routers that could lead to line card reboots.

Software updates were released to address all of these vulnerabilities and Cisco says it is not aware of any public exploits or malicious attacks targeting them.

Seven other security bugs were addressed in IOS XR software this week, all rated medium severity. Cisco included all of these vulnerabilities in its September 2021 semi-annual bundle of IOS XR Software security advisories.

In a separate advisory on Thursday, the U.S. government’s Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to apply the Cisco patches as soon as possible.

“An attacker could exploit some of these vulnerabilities to take control of an affected system. […]CISA encourages users and administrators to review the […] Cisco advisories and apply the necessary updates,” CISA said.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/MclEEclLGzI/cisco-patches-high-severity-security-flaws-ios-xr

HAProxy Vulnerability Leads to HTTP Request Smuggling

A critical security vulnerability in HAProxy could allow attackers to bypass security controls and access sensitive data without authorization, according to a warning from security research outfit JFrog.

An attacker could exploit the vulnerability – tracked as CVE-2021-40346 (CVSS score of 8.6) – to bypass duplicate HTTP Content-Length header checks. Thus, the attacker could smuggle HTTP requests to the backend server without the proxy server noticing it, or launch a response-splitting attack.

“Our analysis confirmed that the duplication is achieved by making use of the memory layout of HAProxy’s internal representation of an HTTP message to slip a select character from the header’s name to its value. Due to the difficulty in executing such an attack, the risk is low,” according to an HAProxy advisory.

Researchers with JFrog Security, the company credited with discovering the bug, describe the issue as integer overflow in the HAProxy’s parsing of HTTP requests. Specifically, it affects the logic related to the processing of Content-Length headers, in the line responsible for setting a header’s name and value lengths.

[ READ: Researcher Discovers New HTTP Request Smuggling Attack Variants ]

In an HTTP request smuggling attack, an adversary targets the HTTP requests between the frontend and backend servers by sending specially crafted requests containing an additional request. This results in the inner request being smuggled through the frontend, mainly because the same established TCP connection is used to forward the requests to the backend.

JFrog researchers crafted a POST request that contains a GET request in its body. Because of the manner in which the POST request’s header is created, HAProxy ends up forwarding it to the backend server with a value length of 0, meaning that it has no body.

The backend server then parses the request as having no body, and then expects to receive the next request on the same connection. Thus, the GET request that was in fact the POST’s body is treated as a legitimate request, resulting in bypassing HAProxy’s ACL filtering.

“HAProxy is only aware of a single HTTP request being forwarded and thus only returns a single HTTP response (the first) from the backend server back to the client,” according to JFrog’s documentation of the problem.

HAProxy versions 2.0.25, 2.2.17, 2.3.14 or 2.4.4 address the issue with size checks for both name and value lengths. Thus, it is recommended to update HAProxy as soon as possible. Workarounds to mitigate the issue are available as well, if updating isn’t possible.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/ZUMHym0szcw/haproxy-vulnerability-leads-http-request-smuggling

GitHub Patches Security Flaws in Core Node.js Dependencies

GitHub has published documentation on seven vulnerabilities in the Node.js packages and warned that exploitation could expose users to code execution attacks.

“These vulnerabilities may result in arbitrary code execution due to file overwrite and creation when tar is used to extract untrusted tar files or when the npm CLI is used to install untrusted npm packages under certain file system conditions,” GitHub said in an advisory.

A code npm dependency, tar is used to extract and install npm packages. Thousands of projects depend on it and tar has tens of millions of weekly downloads. A core dependency for the npm CLI, @npmcli/arborist allows for the management of node_modules trees.

Four of the identified security holes (two in tar: CVE-2021-32804 and CVE-2021-37713; and two in @npmcli/arborist: CVE-2021-39134 and CVE-2021-39135) impact the npm CLI when a malicious or untrusted npm package is installed and could lead to code execution even when using the –ignore-scripts argument.

Upon package installation, npm CLI ensures contents are written to the appropriate folders only, but the vulnerabilities cross these security boundaries and may lead to arbitrary file overwrites during installation, and subsequent code execution.

Given the large number of projects that depend on tar, GitHub started working on fixes immediately after identifying the issue and also began scanning the npm registry for malicious packages targeting CVE-2021-32804, but says none was identified.

“The scan completed on August 5, 2021 and we did not detect any malicious packages targeting CVE-2021-32804. Note that exploitation of these issues through the npm CLI requires installation of untrusted packages or processing untrusted tar archives using affected versions of tar,” the company said.

The vulnerabilities are addressed in npm CLI versions 6.14.15, 7.21.0, or newer; latest Node.js releases (as of August 31, patches were included in Node 12, 14, and 16); and tar versions 4.4.19, 5.0.11, and 6.1.10.

Several of the identified issues were reported to GitHub by Robert Chen (@chen-robert) and Philip Papurt (@ginkoid). As part of a private security bug bounty program, they received a total bounty payout of $14,500 for the reports.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/fGXEMG2w4QE/github-patches-security-flaws-core-nodejs-dependencies

Mastercard to Acquire Blockchain Analytics Firm CipherTrace

Mastercard

Payments giant Mastercard (NYSE: MA) announced Thursday that it has agreed to acquire cryptocurrency intelligence and blockchain analytics company CipherTrace for an undisclosed sum.

Founded in 2015, CipherTrace focuses on crypto-currency intelligence, anti-money laundering (AML), blockchain analytics and forensics, and compliance solutions. The company first started tracking Bitcoin criminal activity in 2011, and claims to have insight into more than 900 cryptocurrencies.

“Digital assets have the potential to reimagine commerce, from everyday acts like paying and getting paid to transforming economies, making them more inclusive and efficient,” said Ajay Bhalla, president, Cyber & Intelligence at Mastercard. “With the rapid growth of the digital asset ecosystem comes the need to ensure it is trusted and safe. Our aim is to build upon the complementary capabilities of Mastercard and CipherTrace to do just this.”

The transaction is expected to close before the end of the year.

Earlier this year, Mastercard announced that it would buy digital identity verification company Ekata for $850 million. In early 2020, Mastercard acquired third-party risk management firm RiskRecon, and acquired Ethoca in 2019, a firm that helps merchants and issuers to identify and resolve digital frauds such as false chargebacks.

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.

Previous Columns by Mike Lennon:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/mvjk3n9prjw/mastercard-acquire-blockchain-analytics-firm-ciphertrace

US Gov Seeks Public Feedback on Draft Federal Zero Trust Strategy

The U.S. government’s Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) this week announced they are seeking public feedback on draft zero-trust strategic and technical documentation.

The OMB has drafted a federal strategy to transition the U.S. government towards a zero-trust architecture and is now seeking public feedback to improve the documentation and improve the government’s cybersecurity stance.

The draft strategy, which falls in line with the Executive Order on Improving the Nation’s Cybersecurity (EO 14208) that requires for civilian agencies’ enterprise security architecture to be changed based on zero trust principles – clarifies zero trust priorities for these agencies.

[Related Reading: Zero Trust, We Must]

The strategy focuses on consolidating identity systems, implementing multi-factor authentication to combat phishing, encrypting traffic within internal networks, improving application security, and more. With the transition to a zero trust architecture expected to take years, the government is expected to adjust the strategy as new practices and technologies emerge.

Separately, CISA released the Cloud Security Technical Reference Architecture (TRA) and Zero Trust Maturity Model to support EO 14208. The Cloud Security TRA is meant to provide agencies with guidance on the cloud service adoption’s shared risk model, and the building and monitoring of a cloud environment.

Designed to complement OMB’s Zero Trust Strategy, the Zero Trust Maturity Model is expected to help agencies in their journey to zero trust by delivering a roadmap and resources for an optimal zero trust environment.

Public comments and feedback for both the TRA and Zero Trust Maturity Model can be submitted through October 1, 2021, via email.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/vJ7Y0GTZL0o/us-gov-seeks-public-feedback-draft-federal-zero-trust-strategy

Microsoft Warns of Information Leak Flaw in Azure Container Instances

Microsoft has patched an Azure Container Instances (ACI) vulnerability that could have allowed users to access the information of other Azure customers.

The company did not provide technical details on the vulnerability but security researchers with Palo Alto Networks say attackers could have exploited the bug to execute code on other users’ containers, steal sensitive information such as crypto secrets, and even deploy crypto-mining malware.

Microsoft said it it notified customers that might have been affected, through the Service Health Notifications in the Azure Portal. Those that did not receive a notification need take no action, the company added.

“There is no indication any customer data was accessed due to this vulnerability. Out of an abundance of caution, notifications were sent to customers potentially affected by the researcher activities, advising they revoke any privileged credentials that were deployed to the platform before August 31, 2021,” Microsoft said in a statement.

All Azure customers are encouraged to rotate privileged credentials on a frequent basis, as a precautionary measure.

The issue, which is being called Azurescape, could lead to the compromise of the Kubernetes clusters hosting ACI, thus providing attackers with full control over other Azure customers’ containers, according to Palo Alto Network researchers.

While built to prevent attacks from malicious neighbor containers – cross-account or cross-tenant attacks – ACI was found to use an older runC (standard container runtime) version that was vulnerable to multiple container escape flaws.

[ READ: Critical Vulnerability Exposed Azure Cosmos DBs for Months ]

Using a modified version of the proof-of-concept code exploiting one of those bugs — CVE-2019-5736 — the researchers were able to break out of a container and gain a root reverse shell on the underlying host. Next, they found token permissions in the kube-system namespace that allowed them to execute commands on any pod in the cluster, which they used to perform the cross-account attack.

“A malicious Azure user could have compromised the multitenant Kubernetes clusters hosting ACI. As cluster administrator, an attacker could execute commands in other customer containers, exfiltrate secrets and private images deployed to the platform, or deploy cryptominers. A sophisticated adversary would further investigate the detection mechanisms protecting ACI to try to avoid getting caught,” Palo Alto said.

Released in July 2017, ACI is a Container-as-a-Service (CaaS) built on multitenant clusters (Kubernetes and, more recently, Service Fabric Clusters), which supports deployment of containers while eliminating the need to manage the underlying infrastructure.

Two weeks ago, Microsoft addressed a similar issue in Azure Cosmos DB, where users could access other customer’s databases with full administrative rights, potentially taking full control of them.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/bmU9WYm_nks/microsoft-warns-information-leak-flaw-azure-container-instances

Get Ready for PYSA Ransomware Attacks Against Linux Systems

Linux is increasingly targeted by ransomware. Researchers have now detected indications that the PYSA ransomware, often also known as Mespinoza, is also being readied for Linux targets.

PYSA, first detected in December 2019, is thought to be an evolution of Mespinoza, first detected in October 2019. The PYSA acronym stands for ‘Protect Your System Amigo’. So far it has largely been used against Windows systems in the education, healthcare, and government sectors. The FBI issued an alert on PYSA in March 2021.

It is commonly used with the ChaChi Golang-based backdoor. ChaChi is used to locate and exfiltrate data before the PYSA ransomware is activated in a double extortion attack. Researchers at Lacework, a firm that automates security across cloud deployments, now believe that PYSA should be added to the growing list of ransomware that targets Linux.

On July 1, 2021, Alien Labs reported that new samples of REvil ransomware targeting Linux systems had been detected. “REvil ransomware authors have expanded their arsenal to include Linux ransomware, which allows them to target ESXi and NAS devices,” it wrote.

On July 14, 2021, the MalwareHunterTeam disclosed on Twitter, that “the Linux version of HelloKitty ransomware was already using esxcli at least in early March for stopping VMs…”

In August 2021, Malwarebytes found a Linux ELF64 encryptor tied to BlackMatter, the group thought to have grown out of the earlier DarkSide group (best known for its attack on Colonial Pipeline). Analysis determined that the malware is designed to target VMWare ESXi servers.

Lacework researchers now report ‘with moderate confidence’ that its research “represents the PYSA actor expanding into targeting Linux hosts with ChaChi backdoor.” In June 2021, a report from the BlackBerry Research and Intelligence Team demonstrated the PYSA/ChaChi connection.

No Linux version of PYSA or ChaChi has yet been found in the wild. Lacework’s conclusions come from the discovery of a customized Linux variant of ChaChi on VirusTotal. While the new variant shares characteristics with its Windows counterpart, the researchers note, “A distinguishing characteristic of the Linux version was the presence of debug output containing datetime data.” Its newness is confirmed by just one of the 61 AV engines on VirusTotal detecting it as malware.

This leads the Lacework researchers to believe that the discovered version may have been still in its testing phase. This opinion is strengthened by the observation that the greater part of the ChaChi infrastructure has been parked or offline since June 23-24, 2021. Lacework suspects that the PYSA ransomware is going through a similar process of development into a Linux variant.

Ultimately, this is all circumstantial evidence. Nevertheless, the combination of a trend towards Linux ransomware, the discovery of PYSA’s ChaChi exfiltration tool being redeveloped for Linux, and the current inactivity of the ChaChi infrastructure all point towards PYSA being readied for use against Linux targets. If this proves correct, we can expect to see some PYSA-based big game hunting double extortion ransomware attacks in the coming weeks or months.

Lacework, headquartered in Silicon Valley, was founded in January 2015 by Mike Speiser, Sanjay Kalra, and Vikram Kapoor. It raised $525 million in a Series D funding round in January 2021, bringing the total raised to date to $599 million.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/3vIZmkvlI4M/get-ready-pysa-ransomware-attacks-against-linux-systems

Is the Taliban a Cyber Threat to the West?

Taliban Cyber Capabilities

Two decades ago, the U.S. and its allies invaded Afghanistan as retribution for the 9/11 terrorist attacks carried out by the al-Qaeda terror group. The Taliban, who had harbored al-Qaeda in Afghanistan, was forced out of government. Now, 20 years later, the U.S. has left Afghanistan, and the Taliban has returned. U.S. Defense Secretary Lloyd Austin warned this week that the al-Qaeda extremist group may attempt to regenerate in Afghanistan following the botched American withdrawal that allowed the Taliban to regain control of the country.

But the world has changed in the last 20 years. Most notably, technological advances mean that acts of terror no longer need to be kinetic. Cyberattacks against critical infrastructure can potentially do more harm than the 9/11 attacks. While there are uneasy and unofficial norms of acceptable behavior between the West, Russia and China, no such norms apply to the ‘rogue’ states ‒ most notably North Korea and Iran.

And now, perhaps, Afghanistan. We need to consider whether the Taliban is, or will become, a notable cyber threat to the West.

Does the Taliban pose a cyber threat?

The Taliban is not currently a cyber threat. There are two primary reasons. Firstly, aggressive international behavior is not high on its list of priorities. “They must stabilize their own country and establish a level of governance, security and ‘normality’ and consolidate their position as de facto rulers of Afghanistan, albeit through means unpalatable to international observers,” Brian Lord, CEO of cyber security and business intelligence firm Protection Group International (PGI), told SecurityWeek.

This may not be as easy as we believe. Russia tried and failed to control Afghanistan. The U.S. and its allies tried and failed. Why should we assume that the Taliban will automatically be successful? “In a few weeks, we will see how the power struggle that will erupt between stronger tribal leaders and the Taliban is affecting the country,” commented Dirk Schrader, global VP of security research at New Net Technologies (NNT), now part of Netwrix. “For sure it will be a constant source of unrest in parts of Afghanistan.”

There are areas of the country not under Taliban control, while ISIS ‒ an enemy of the Taliban that has killed both Taliban and al-Qaeda people in Afghanistan ‒ is still able to conduct operations in Kabul. Intelligence firm Flashpoint reported, “The ‘Khorasan’ branch of ISIS [the ‘K’ in ISIS-K] remains very active. It has claimed responsibility for at least 105 military operations inside Afghanistan since May 1, 2021.”

Nevertheless, the Taliban is and will remain the dominant power and ‘government’ within Afghanistan. “It must present,” continued Lord, “a position that is internationally non-threatening, at least until the international attention has tired of wailing and hand wringing about Afghanistan’s fate and has turned its attention to newer problems and challenges. They have waited patiently for 20 years; another few will do no harm. They are there for the long-term.”

Religious backgrounder

The Muslim world primarily comprises 70% Sunnis and 30% Shi’ites. The Shi’ites dominate in Iran, Iraq, Azerbaijan, and the Zaydism sect of Houthis in Yemen, and there is a sizable population in Pakistan. The Taliban is an ultra-conservative Deobandi Sunni sect. It first emerged in 1876 in colonial India with the aim of revitalizing Islam based on strict conformance with Sharia law. From its origins, it has no love for any form of western imperialism. Sunnis and Shi’ites are not natural allies, but recent history has shown they can work together in the face of a perceived common enemy.

The second reason for the lack of any realistic current cyber threat from the Taliban is the group simply does not have the capability. “Currently,” Evan Kohlmann, CEO at Flashpoint, told SecurityWeek, “the Taliban’s primary existence in cyberspace comprises a few Telegram channels, and a few websites with RSS feeds where they’re putting out their propaganda. As far as we can tell, they are no more sophisticated than that. They’re not sophisticated enough to get into the more aggressive operations that we see from even small rogue states like North Korea.”

The future

Things change. Right now, the Taliban is in a tight spot. It is on the outside looking in. Without access to international banking and confronting the probability of international sanctions, it is faced with an economic crisis. All it can do is look for help and support from other nations in a similar position.

Geopolitical backgrounder

Afghanistan is not without natural resources. It has lithium, necessary for high tech batteries. It has copper, used in energy production. It has precious gems, that can easily bypass sanctions on the black market. It has borders with three more advanced nations: Iran, China and Pakistan. Pakistan will defer to China in its relationship with Afghanistan, and China will wish to include Afghanistan within its international area of influence. But the Taliban is far closer to Iran in language and culture. The greatest likelihood is that the Taliban will court a relationship with Iran, but with the added probability of Chinese influence.

Iran

“The Iranian/Taliban relationship is not good,” comments Kohlmann; “but as far as we can tell right now, the Taliban is going out of its way to meet with Iran and assure the Iranians they will protect the Shi’ites in western Afghanistan from ISIS.” In exchange, Iran could provide support in terms of food, money, weapons and oil.

Furthermore, Iran’s Islamic Revolutionary Guard Corps (IRGC) has a history of providing cyber expertise, training, and resources to some of the groups it is encouraging, such as the Houthis in Yemen. “It is conceivable that the IRGC will provide expertise and training to the Taliban in both cyber and other areas,” he adds. “I would say that’s where any future Taliban cyber capability will develop from.”

CISO Forum - Virtual Event

A safe haven

It is also worth noting that Iran has a history of operating its foreign policy through proxies, such as Hezbollah and the Houthis. A cyber active Taliban might be an attractive possibility, supported by the probability that Afghanistan will become a safe haven for international cyber-criminal groups over the next few years.

Cyber criminals like to operate from locations where they are tolerated by the government; where law enforcement turns a blind eye so long as the focus of the activity is directed elsewhere in the world; where law enforcement has no incentive for international collaboration with other law enforcement agencies; and where there is no existing meaningful legislation such as the Computer Fraud and Abuse Act (CFAA) in the U.S. or the Computer Misuse Act (CMA) in the UK.

“Afghanistan under the Taliban ticks pretty much all those boxes,” says Lord. “As its infrastructure grows more robust (and China may be instrumental here) it will become a magnet for Organized Crime Groups (OCGs) seeking a safe center of operations from which to conduct what they do with impunity. The ‘safe haven’ will certainly become a characteristic of Afghanistan in the cyber world.”

He does not believe the rest of the world can or will do much to prevent this. “Given we are looking at a few decades of neuralgia about getting national hands trapped in the Afghanistan mangle—the Taliban facilitating online criminality will fall way below the threshold of anything other than some angry voices. And let’s not mistake the Taliban’s ultra-conservative religious demeanor for being averse to such things. They exported opium to the West happily for years – online criminality will be well within tolerance.”

China

And then there’s China. Within a week of the Taliban regaining power, Lord points out that China has already leant forward to engage with the new government. “China will take the lead in flooding Afghanistan with Chinese technology and telecoms infrastructure under one of their long-term economic arrangements. There is no doubt that Afghanistan will become another piece in the jigsaw of Chinese technology proliferation. The Taliban will accept it out of an economic necessity, and they will, in turn, be able to adopt the type of oppressive international national surveillance techniques and impose the type of technology access control already established in China.”

Misinformation and disinformation

Furthermore, suggests Lord, the West needs to avoid being fooled by the Taliban. “The Taliban will need to control (and confuse) the international narrative. They are good at this. They will hit social media, media channels, and the wider internet with a flood of confusing information, misinformation, disinformation, bluff, double bluff and triple bluff. They will need to do this to create sufficient space to consolidate their position of strength while exercising the type of human rights abuses they are known for.”

The West, he says, will need to develop the ability to unpick this narrative, to arrive at the truth and provide clarity on what is happening within Afghanistan. “That remains the key for the world to have continued visibility of the Taliban regime. To my mind, large-scale manipulation of information is a ‘cyber threat’ – even if not a ‘cyberattack’.”

With infrastructure provided by China and cyber expertise from the IRGC ‒ not to mention locally operating cyber-criminal gangs that could be hired ‒ added to an inherent animosity toward the West, Afghanistan will have everything necessary to evolve into a new international cyber threat.

“The parallels to be drawn,” says Schrader, “are those with North Korea and Iran, where access to information, the censored use of the open Internet, the monitoring of communication (if available at all) is part of the daily life.”

The future has a history of confounding predictions. But while the Taliban provides no immediate cybersecurity threat, there is ample potential for it to develop into a major threat on a par with North Korea over the next three to five years.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/YMtnu9wrcaA/taliban-cyber-threat-west

Organizations Warned: STUN Servers Increasingly Abused for DDoS Attacks

Application and network performance management company NETSCOUT warned organizations this week that STUN servers have been increasingly abused for distributed denial-of-service (DDoS) attacks, and there are tens of thousands of servers that could be abused for such attacks by malicious actors.

The Session Traversal Utilities for NAT (STUN) protocol serves as a tool for other protocols in dealing with Network Address Translator (NAT) traversal, helping applications discover the NATs and firewalls that are between them and the Internet. It also enables applications to determine the public IP allocated to them by the NAT.

According to NETSCOUT, threat actors have been adding STUN reflection/amplification to DDoS-for-hire services.

While the amplification rate is only 2.32 to 1, UDP reflection/amplification attacks abusing STUN services can be more difficult to mitigate without overblocking legitimate traffic. NETSCOUT discovered more than 75,000 STUN servers that could be abused for DDoS attacks and the company has seen significant multi-vector attacks that include STUN as a component.

“Observed attack bandwidth (bps) sizes range from ~15 Gbps to ~60 Gbps for single-vector STUN reflection/amplification attacks and up to an aggregate 2 Tbps for multivector attacks that include STUN as a component,” NETSCOUT said.

“The highest observed throughput (pps) for a single-vector STUN reflection/amplification attack is ~6 Mpps and up to an aggregate ~836.3 Mpps for multivector attacks that include STUN as a component,” it added.

The company pointed out that the organizations whose STUN servers are abused in these DDoS attacks can also experience disruptions.

NETSCOUT has provided a series of recommendations for network operators and other organizations on preventing and mitigating DDoS attacks that leverage STUN.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/lpArT9VCMqE/organizations-warned-stun-servers-increasingly-abused-ddos-attacks