Chinese Cyberspies Target Military Organizations in Asia With New Malware

A cyber-espionage group believed to be sponsored by the Chinese government has been observed targeting military organizations in Southeast Asia in attacks involving previously undocumented malware, Bitdefender reported on Wednesday.

Linked to the Chinese People’s Liberation Army (PLA) over half a decade ago, the Naikon advanced persistent threat (APT) was revealed last year to have conducted a five-year stealth campaign against targets in Australia, Indonesia, the Philippines, Vietnam, Thailand, Myanmar, and Brunei. The group has been known to focus on government and military organizations.

Although reports on Naikon’s activity were so far published only in 2015 and 2020, the persistent APT has been quietly operational for at least a decade, making changes to its infrastructure and toolset to ensure it can stay under the radar.

Last year, after its activity was exposed, Naikon made a similar move: it switched to a new backdoor, although it continued to use previously known malware for the first stages of attack. The group has also been abusing legitimate software for nefarious purposes.

The latest campaign ran between June 2019 and March 2021, and one of the new backdoors, dubbed RainyDay, was first used in attacks in September 2020, Bitdefender says. To remain undetected, the APT would mimic legitimate software running on the infected machines. The purpose of the attacks remains espionage and data exfiltration, and the group continues to focus on Southeast Asian targets.

The RainyDay backdoor allows the attackers to perform reconnaissance on the infected machines, deploy reverse proxies, install scanners, execute tools for password dumping, move laterally on the victim’s network, and achieve persistence.

Naikon has always used DLL side-loading for the RainyDay execution, “and there was always a vulnerable executable along with a DLL file and the rdmin.src file containing the encrypted backdoor payload,” Bitdefender explains.

The same execution technique along with the use of rdmin.src are employed by China-linked Cycldek (Goblin Panda, Conimes) for the deployment of the FoundCore RAT. Furthermore, the shellcode used for payload extraction and other payload characteristics suggest a close connection between the two malware families and a possible overlap in activity between the two groups.

The similarities are not surprising, considering that Chinese threat actors are known to be sharing infrastructure and tools, and because Naikon was previously observed using exploits attributed to other threat groups, in an attempt to evade detection.

As part of the latest attacks, the adversary also deployed a second new backdoor called Nebulae, likely as a precautionary measure.

Attempting to impersonate a legitimate application, the Nebulae backdoor can harvest drive information, list and modify files and directories, execute and terminate processes, and download and run files from the command and control (C&C) server.

“The data we obtained so far tell almost nothing about the role of the Nebulae in this operation, but the presence of a persistence mechanism could mean that it is used as a backup access point to victims in the case of a negative scenario for actors,” Bitdefender notes.

Furthermore, admin domain credentials were used for lateral movement, likely after being stolen at an early stage of the attack. Persistence was typically achieved manually, while data of interest was exfiltrated to Dropbox.

“Our research confidently points to an operation conducted by the Naikon group based on the extraction of the C&C addresses from Nebulae samples. The particular domain dns.seekvibega.com obtained from such a sample points out to the Naikon infrastructure,” Bitdefender concludes.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/x4B2lYYfTQI/chinese-cyberspies-target-military-organizations-asia-new-malware

US Government Taking Creative Steps to Counter Cyberthreats

An FBI operation that gave law enforcement remote access to hundreds of computers to counter a massive hack of Microsoft Exchange email server software is a tool that is likely to be deployed “judiciously” in the future as the Justice Department, aware of privacy concerns, develops a framework for its use, a top national security official said Wednesday.

The department this month announced that it had obtained a warrant from a federal judge in Texas to remove web shells, or malicious code that gives hackers a foothold into networks, from hundreds of vulnerable computers affected by a hack that Microsoft has blamed on a group operating from China.

The FBI operation was designed to disrupt the effects of a hack that affected many thousands of servers running the Microsoft Exchange email program. Many victims took steps on their own to safeguard their systems, but for those that who did not, the Justice Department stepped in to do it for them with a judge’s approval.

It was the virtual equivalent of police going around the neighborhood locking doors that criminals had opened remotely.

[ READ: Industry Reactions to FBI Cleaning Up Hacked Exchange Servers ]

“We have a decision to make, which is are we going to go ahead and do that action ourselves or are we just going to leave that malware there, sort of unremediated,” said Assistant Attorney General John Demers, speaking at a virtual discussion hosted by the Project for Media & National Security at George Washington University.

He said the operation was one of the very first of its kind and was the subject of extensive discussion by the FBI and the Justice Department. The department is figuring out how it plans to use that capability in the future.

“We don’t yet have sort of worked out what our criteria are going to be going forward,” Demers said. “Now that we’ve had this experience, that’s the kind of discussion we’re having internally now.

“This is not a tool of first resort that we’re going to be using a couple times a week as different intrusions come up,” he added. “This does require working with the private sector on the right solution. It does require testing to be sure that you’re not going to otherwise disrupt someone’s computer system.” Such operations will be done judiciously in the future, he said.

Demers acknowledged concerns from some privacy advocates that the government, without permission of the computer system operators, had gained remote access and removed the web shells. But he pointed out that the department did obtain a judge’s permission and said the government felt compelled to act because, after a period of several weeks, there were still unremediated web shells that continued to serve as access point for “hackers of all stripes.”

“And so the choice that the government had was just continue to leave those open or take the court-authorized action that we did, and ultimately we decided to move ahead,” Demers said. “But to the extent possible before then, we had been notifying every victim that we could identify of the intrusion.”

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/W-n23PbWhIQ/us-government-taking-creative-steps-counter-cyberthreats

Death of the Manual Pen-Test: Blind Spots, Limited Visibility

Manual penetration testing (pen-testing) is increasingly challenged by automated methods of vulnerability discovery and management. The reasons are not difficult to understand: the cost and coverage of manual testing is too high and too limited.

A new survey of more than 100 IT and security managers involved in the pen-testing practices of companies with more than 3,000 employees provides more details. The survey was conducted by Informa Tech on behalf of CyCognito.

The survey/report indicates that the primary reasons for conducting pentesting are to measure the company’s security posture (70 percent), and to prevent breaches (69 percent). It is clear from other responses, however, that there is widespread concern over whether pentesting can deliver on these requirements.

The main concerns are that pentesting does not cover the entire infrastructure, leaving blind spots (60 percent); it examines only known assets rather than discovering and testing assets that may have been forgotten, or not recognized, in cloud environments (47 percent); the cost of pen-testing is too high for it to be used extensively (44 percent); and, related to the cost, the results of pen-testing provides just periodic snapshots in time that might no longer be accurate the day after the testing (36 percent).

These concerns are not a criticism of the pen-testers themselves. Pen-testers still provide, says CyCognito, “a valid way to surface some vulnerabilities in specific, scoped portions of an attack surface at a single point in time.” Pen-testing is conducted by skilled professionals who bring human creativity to complex challenges.

The implication of this statement is that manual pen-testing still has a place in testing the security of perhaps the customer’s most important assets; but only as an addition to overall attack surface automated monitoring.

The primary reason that pen-testing cannot be extended across the entire attack surface is cost. Seventy-nine percent of the respondents said that pentesting is costly, with 78 percent saying that cost prevents the testing of all apps, and 76 percent saying that the cost prevents more frequent testing. To put these costs into perspective, 12 percent spend more than $1 million annually on pen-testing, while another 8 percent spend between $500,000 and $1 million.

Thirty-five percent spend less than $100,000 – and it is open to conjecture whether minimum pentesting is being done simply to comply with regulations that require it. Noticeably, ensuring compliance was the third most common driver for pentesting, at 65%.

Apart from cost, coverage is also a concern with manual pen-testing. The biggest concern, at 60 percent, is that it only provides limited test coverage over a portion of the attack surface, leaving behind too many blind spots. Forty-seven percent of the respondents were also concerned that their penetration tests look at only known assets and don’t discover new or unknown ones.

In fact, 47 percent of the respondents believe that pentesting covers less than half of their company’s attack surface. Thirty-eight percent believe it covers more than 50 percent, with the remaining 10 percent not knowing.

This lack of coverage extends to time as well as attack surface. Because of the cost of pen-testing, it can only be done infrequently. A company that has a good security posture and is in compliance on the day of the testing, could have a poor posture and be out of compliance within days of the test.

In reality, the company may never get a true picture of its security posture from pen-testing since in 24 percent of cases, it takes more than 2 weeks from testing to receipt of the tester’s report. During this time, new vulnerabilities could be introduced with no possibility of them being found by the tester.

It is clear that the size of digital infrastructures – which is continuing to increase with the process of digitization – the growth of cloud-based assets; and the movement towards dispersed assets through the new work-from-home (WFH) paradigm, means that manual pentesting is nowhere near capable of protecting the modern network. Although CyCognito does not specify the need for automated security testing, its description of what is required cannot be achieved with automated software testing.

This is, “The approach needs to enable continuous discovery of all attacker-exposed assets across the organization and in closely related environments such as those belonging to subsidiaries, partners, suppliers, and cloud service providers.”

Rob Gurzeev, CEO and co-founder of CyCognito, adds, “Security tests should tell organizations what attackers are able to see and exploit so that defenders can prevent breaches. But when companies are only able to see assets they already know about, test just a portion of their attack surface, and do that only a few times per year, preventing breaches isn’t possible. So, the biggest takeaway from this report (PDF) is that what organizations want or are hoping to achieve through pentesting versus what they actually are accomplishing are two very different things.”

Palo Alto, California-based CyCognito was founded in 2017 by Dima Potekhin (CTO) and Rob Gurzeev (CEO). It has raised a total of $53 million, with the most recent from a $30 million Series B funding round in July 2020.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/RyWCX9sU244/death-manual-pen-test-blind-spots-limited-visibility

CISO Conversations: Raytheon and BAE Systems CISOs on Leadership, Future Threats

CISO Interviews: Intel's Brent Conran and Cisco's Chris Leach

Much of SecurityWeek’s CISO Conversations this series discusses how to be a leader. Here we start with a slight variation: how do you become a leader?

The CISO is the ultimate cybersecurity leader. He or she must lead the security team into battle against the stronger forces of cyber criminals and advanced threat actors; must lead the company workforce into a better understanding of cybersecurity and good security habits; and must guide the board into doing the right things.

This begs a fundamental question: what makes a good leader – is a good leader born or bred? That’s one of the questions we asked our two CISOs – Jennifer Watson of Raytheon Intelligence & Space and Mary Haigh of BAE Systems – for this issue of CISO Conversations dealing with the defense sector.

Jennifer and Mary are not the first women CISOs in the series, but this is the first time that both CISOs are women. It is worth noting that while more young women are breaking into technology careers, there is a greater ratio of women CISOs than women security engineers.

That leaves a massive elephant in the room – a question that I have often asked but never received a satisfactory answer. The intellectual difference between men and women is nil. Does this suggest that there may be something in the psyche or psycho/emotional make-up of women that makes them particularly suited to modern leadership roles?

What makes a good leader?

Raytheon’s Watson believes that true leadership evolves – or perhaps emerges – through a combination of experience and empathy. “I started as a hands-on-the-keyboard kind of person, coming up through the ranks and then moved slowly to the security world, and leadership.” This provides the background from which leadership can emerge.

CISO Leadership

To be a leader in industry, she says, you must have a close and detailed understanding of the business. “I think what really helped me be successful is having that hands-on experience and really being able to empathize with the people, the customers, and the end users that the business is trying to help.”

There’s that word ‘empathy’. The implication is that a leader needs to be able to combine a practical understanding of the mechanics of the business with an emotional understanding of all the people involved.

This perhaps gives us one clue into the relative success of women in leadership. We’re in an era – and security is an area – where the need for diversity is fully understood. Minorities are important within security staffing – but women themselves are one of these minorities. Does this imply that women have a head start over men in the empathy side of leadership, because they already understand the human problems?

“I believe leadership is something that can be learned,” said Watson, “but I do believe that it has to be in there somewhere. It’s about learning to follow first. You have to be able to do the job yourself before you can lead others.” For Watson, leadership qualities were probably innate.

“I’m somebody who is an active listener,” she continued. “I like to hear what people are saying, and I pick up on those things, and I’m able to connect with people at different levels. So, for me, I believe leadership was in there all the time, and it wasn’t something I learned.”

She believes that leadership is a quality she had naturally and subsequently encouraged and honed within her profession – but she does not believe that innate leadership is essential in learning to be a good leader.

BAE’s Mary Haigh has a remarkably similar view – mostly it can be learned, but partly it is in the nature of the person. “I think you can learn a lot of it. I think the bits that you’ve got to dig deeper come as you get into more senior positions. The more senior you get, the more self-aware you must be, and the more you’ve got to understand about yourself to be able to understand your own behavior and your own responses to things. Only then will you be able to understand other people’s responses to what you’re doing – and adjust and adapt and shift to get the best outcome. So, if you don’t have that habit of self-reflection and ability to understand yourself, you’re gonna need to learn that, and that takes some people longer than others.”

Interestingly, neither of our CISOs were willing to entertain the idea that women may have some psycho-emotional advantages over men in being a good CISO. Haigh simply stated, “I’m not a fan of stereotyping certain traits.”

Nevertheless, she added that one essential aspect of being a good CISO is knowing that you cannot know everything; and then raised the ‘imposter syndrome’ (the belief that you don’t deserve or have earned what you’ve got). “Men do suffer from the impostor syndrome as well as women, but it tends to be more prevalent in women. Women don’t feel they deserve the position as much, and that they’ve somehow got to work harder for it. A by-product of feeling you must work harder for it, feeling like you’re a little bit of a fraud, is that you work your socks off and you are aware all the time that you don’t know everything and are more willing to go out and ask the questions. And that is sometimes quite helpful. Maybe that’s a part of what’s made women more successful in this area.”

The advice from both Watson and Haigh is that if you have the drive and dedication, anyone can learn to become a leader – and that applies as much to men as women. Ultimately, being a good CISO has nothing to do with being male or female. As Haigh put it, “I didn’t get to be a CISO because of or in spite of being a woman – I got to be a CISO, full-stop. And that involved the support of a lot of men along the way.”

Being a leader in cybersecurity

Being a leader, born or bred, does not in itself make a good cybersecurity leader. Cybersecurity is like no other business discipline. It changes faster and further than most other disciplines. Security teams tend to be small but of higher-than-average caliber. And there remain remnants of distrust from the general workforce since the introduction of security inevitably introduces restrictions on the easy flow of work.

Being a CISO requires additional skill sets that need to be integrated into the leadership expertise. The first is a willingness, if not drive, to learn and keep on learning. The second is the ability to build, manage and engage high power teams. And the third is the ability to cultivate and utilize relationships, whether with other business leaders or the general staff.

“Build and use your network to help you,” says Haigh, “whether it’s testing ideas or sharing a problem or going up to a colleague and saying, ‘I don’t know a thing about this – I don’t understand it; can you help me out and explain it?’”

People love being asked questions like that, she continued, “so it’s kind of a two-way thing: they like it, it helps you, and you get to help them someday, so it’s all mutually beneficial.”

On relationships, she added a personal note. Her father recently died, but before he passed, he received many messages from people who had worked with him. “What was just amazing,” she said, “was how many said ‘thank you for your coaching, thank you for the friendly atmosphere that you created. There’s not a single one that said, ‘I’ll never forget the time that you increased our profit margin, or that you delivered that project two weeks early’. The legacy that he left from work was, ‘You created a great place to work; you created somewhere that was trusting and supportive and you taught me lots’.”

The lesson here is that leadership is about the people. Great relationships create great teams that deliver great results. But people and the CISO’s relationship with them are the bedrock.

“Cyber has lots of really tricky problems,” she continued. “There will be times when it goes horribly wrong. It’s in those moments you need your people to have the confidence to tell you it’s going wrong, and tell you the problem, and to believe you can help them sort it out. All those traditional success factors around profit and revenues and delivering things on time… they all come because you’ve created the best atmosphere in your team, because you’re doing good leadership, because you’ve got the right culture – and that’s what people remember.”

This is something she stresses to everyone. “Make sure you’re thinking about how you grow your workforce. Make sure you’ve got good managers with good behaviors who are exciting their teams, supporting their teams, sharing with their teams. In cybersecurity, you can’t afford to have a poor team manager with a team of cyber people, because they’ll walk.”

Mentoring and being mentored is a theme that unites both learning and relationships. Every CISO we have spoken to in this series has stressed the value of mentoring received in their own career path, and the need to personally mentor the next generation of security leaders – and Watson and Haigh are no exception.

Haigh sees the need for mentoring as transcending her own employment. “I’m chair of the Women in Cyber group, and one of the things we recently established is a mentoring scheme called RISE; Raise, Inspire, Support and Empower.” This is a multi-corporation scheme, with other leading companies taking part. “Schemes like this help grow and retain the talent you already have, but they also help grow your own network beyond just the boundary of your walls within the company.”

Receiving advice

Fundamental to mentoring is giving and receiving advice. Watson believes the best advice she ever received was, ‘stay calm, carry on, and be ready for loneliness’. “You have to be calm, and you have to stay calm. That’s the only way you’re going to be able to figure out the real situation. So, the best advice for me was slow down, listen, assess the whole situation, and be flexible in response.”

But there was one other thing. “Be comfortable with being uncomfortable,” she added. “You’re not necessarily going to be anybody’s friend in this world. Sometimes you’re going to get lonely. At times, it’s going to be very lonely in cybersecurity leadership.”

Haigh has already touched on what she considers good advice: growing and maintaining relationships and not being afraid to ask for help. But she adds, “Be willing to take risks with your career. You’ll never be in the position of believing you know everything for your next role – so just give it a go anyway.”

The need for diversity and balance

One thing all CISOs accept is the need to obtain and retain talented staff within cybersecurity teams. While acknowledging that there are some additional hurdles for recruitment within the defense sector, neither Watson nor Haigh consider that recruitment is particularly more difficult than it is in other sectors. Both concentrate on building diversity even more so than accruing security certifications. University degrees are useful because they demonstrate the ability to learn – but the precise degree subject is less important.

Watson seeks balance in her team when recruiting new staff. “I like to sit down and talk to people,” she says. “It’s a conversation – it’s never that deep question-answer interview. It’s more about listening to people and getting a feel for who they are, how they communicate, how they handle things. I truly believe that by doing that kind of interview, diversity naturally occurs. I’m not just looking at what’s on paper when we have the conversation. It’s great when you already know a person a little bit – and you’ve seen them in action. But equally, when you bring somebody in cold off the street for an interview, it’s all about that communication, that conversation. And I just feel that diversity then occurs naturally. I don’t ever go out of my way to ensure certain things are occurring, but then at the end it’s just naturally happened. We have a good, diverse group of people.” The end product, she believes, is both diversity and balance in her team.

“We’ve often been too narrow in thinking about who we need to be in cyber roles,” says Haigh. “When I look at my team, I’ve got an ex-West End star, I’ve got someone that did a classical music degree, I’ve got someone that did geopolitics, I’ve got someone that did graphics then computer science. I did physics, someone else did engineering, and someone else doesn’t have a degree at all. But they’re all now experts in cyber. They all bring something different and a different way of thinking – and I think we need that creativity in cyber because we’ve got some big problems to solve. In any area of challenge, you need the best team on it, and the best team is always the most diverse team. Whether that’s diversity in cognitive function, or race, or sexual orientation, or men and women, whatever – it’s diversity right across the page.”

Future threats to the defense sector

The bottom line for all CISOs, regardless of their leadership skills, is to defend their organization against cyber-attacks. We asked Haigh what she considers will be the primary threats to the defense sector in future years.

She replied, “The global growth in cyber power. With cyber power comes both stronger defenses and stronger offences. Obviously as a defense company we’d be squarely in the target lines for that kind of activity. A lot of countries are putting in a lot of money to build up their cyber power.”

Learn More About Security Leadership at SecurityWeek’s CISO Forum

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/kfrBAl9InZ4/ciso-conversations-raytheon-and-bae-systems-cisos-leadership-future-threats

Google Data Protection Case to be Heard in UK Supreme Court

Google on Wednesday began a legal bid at Britain’s highest court to try to block a class action alleging that it illegally tracked millions of iPhone users.

The hearing at the Supreme Court will hear arguments for two days before judges decide whether the claim against the internet search giant should proceed.

The “Google You Owe Us” association, which is led by the former head of consumer rights group Which?, Richard Lloyd, is seeking at least £1 billion ($1.4 billion, 1.1 billion euros) to compensate four million users in England and Wales.

In October 2018, the High Court dismissed the case but the Court of Appeal overturned the decision in October 2019, allowing it to proceed. Google has appealed against the decision, hoping to get the case dismissed on the grounds the claimants have shown insufficient evidence users were adversely affected.

The association accuses Google of circumventing iPhone security options and collecting personal data between August 2011 and February 2012 using the Safari browser.

Information about users’ social or ethnic origin, health, political views, sexual preferences or shopping habits was collected, according to the complaint, which alleges the information was then compiled and offered to advertisers.

“Google illegally misused the data of millions of iPhone users without consent and we want to hold them to account,” Lloyd said in a statement before the hearing.

Google has said the events that happened 10 years ago were responded to at the time.

“Google You Owe Us” has said the door was opened to its complaint following the confidential settlement of a similar case in 2015 which was brought by three individuals.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/PIZHGNzAkDc/google-data-protection-case-be-heard-uk-supreme-court

Cyberspace Solarium Commission: CISA Funding Should Increase by at Least $400M

In a letter to the United States House Committee on Appropriations, two members of the Cyberspace Solarium Commission are asking for an increase in funding for the Cybersecurity and Infrastructure Security Agency (CISA) in fiscal year 2022.

Representatives Jim Langevin (D-R.I.) and Mike Gallagher (R-Wis.) are pressing for an allocation increase of at least $400 million to the Homeland Security Subcommittee, to support CISA’s budget, arguing that the funding is necessary to ensure timely implementation of “key authorities Congress just passed to strengthen CISA.”

The Cyberspace Solarium Commission was established in the National Defense Authorization Act for FY2019 and its goal is to “develop a consensus on a strategic approach to defending the United States in cyberspace against cyber attacks of significant consequences.”

Recent events such as the SolarWinds and Microsoft Exchange Server attacks, the two House representatives say, have led to a significant increase in cyber-activity, with CISA playing a central role in the government’s response to both incidents.

“Meanwhile, CISA continues to provide services to the rest of the U.S. government to identify threats and harden federal networks against future attacks, to the extent that their resources allow,” the two argue.

However, Reps. Langevin and Gallagher note in their letter, more is required from CISA to ensure that federal networks build meaningful security and that national resilience is improved in the face of significant cyber incidents.

As per the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, CISA is required to perform various actions, such as creating a Joint Cyber Planning Office, conducting resource requirement assessments, and finding threats within Federal agency networks, among others.

While CISA’s budget for FY21 has increased by more than $100 million, accompanied by funding through the American Rescue Plan Act of 2021 (ARPA), the agency will require additional funding for FY22, “to significantly expand non-federal network resilience efforts,” the letter reads.

The purpose, the two Solarium Commission members say, is to expand CISA’s critical infrastructure sector engagement capacity, to support targeted outreach, to quickly deploy necessary tools to improve visibility across civilian networks, to grow CISA’s team for increasing operational resilience in the non-federal space, and to ensure CISA’s incident response capabilities can rapidly assist state, local, tribal, and territorial governments, as well as other non-federal partners.

The two representatives press for an increase in CISA’s allocations for FY22, from approximately $2 billion in FY21 to over $2.425 billion for FY22.

“We recommend an increase of at least $400 million for the FY22 appropriation to respond to these changing requirements,” the two members of the Solarium Commission say. “Without increases […] CISA would fall far short of the strong and effective cybersecurity agency the U.S. badly needs.”

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/isop8QjRdh0/cyberspace-solarium-commission-cisa-funding-should-increase-least-400m

Navy SEALs to Shift From Counterterrorism to Global Threats

Navy SEAL platoons are beefing up capabilities in cyber and electronic warfare and unmanned systems, honing their skills to collect intelligence

Ten years after they found and killed Osama bin Laden, U.S. Navy SEALs are undergoing a major transition to improve leadership and expand their commando capabilities to better battle threats from global powers like China and Russia.

The new plan cuts the number of SEAL platoons by as much as 30% and increases their size to make the teams more lethal and able to counter sophisticated maritime and undersea adversaries. And there will be a new, intensive screening process for the Navy’s elite warriors, to get higher-quality leaders after scandals that rocked the force and involved charges of murder, sexual assault and drug use.

Rear Adm. H. Wyman Howard III, top commander for the SEALs, laid out his plans in an exclusive interview with The Associated Press. He said the Navy’s special operations forces have been focused on counterterrorism operations but now must begin to evolve beyond those missions. For the past two decades, many have been fighting in the deserts of Iraq and mountains of Afghanistan. Now they are focused on going back to sea.

That decision reflects the broader Pentagon strategy to prioritize China and Russia, which are rapidly growing their militaries and trying to expand their influence around the globe. U.S. defense leaders believe that two decades of war against militants and extremists have drained resources, causing America to lose ground against Moscow and Beijing.

The counterterrorism fight had its benefits, allowing the SEALs to sharpen their skills in developing intelligence networks and finding and hitting targets, said Howard, who heads Naval Special Warfare Command, which includes the SEALs and the special warfare combatant-craft crewmen. “Many of these things are transferable, but now we need to put pressure on ourselves to operate against peer threats.”

As a result, Howard is adding personnel to the SEAL platoons to beef up capabilities in cyber and electronic warfare and unmanned systems, honing their skills to collect intelligence and deceive and defeat the enemy.

“We are putting pressure on ourselves to evolve and understand our gaps in capability and what our true survivability is against these threats” posed by global competitors, he said.

Adm. Mike Gilday, the chief of naval operations, said the goal is to better integrate the SEALs into the Navy’s missions at sea.

“As the Navy Special Warfare community returns more and more to its maritime roots, their increased integration across the Fleet — above, under, and on the sea — will unequivocally enhance our unique maritime capabilities to help us compete and win against any adversary,” Gilday said in a statement to the AP.

Increasing the size of the SEAL platoons will add high-tech capabilities. And decreasing the number of units will allow Howard to rid the force of toxic leaders and be more selective in choosing commanders. That decision is a direct result of the erosion in character that Navy officials have seen within the force.

In recent years, SEALs have been involved in a number of high-profile scandals. One of the most well-known was the arrest of Navy Special Operations Chief Edward Gallagher on war crimes charges that included murder of an Islamic State militant captive and attempted murder in the shootings of civilians during a 2017 deployment to Iraq.

Gallagher was acquitted of all charges except one, posing in photos with the dead captive. A jury recommended his rank be reduced, cutting his pension and benefits as he was about to retire. But President Donald Trump intervened and ordered that Gallagher be allowed to retire without losing his SEAL status.

More recently, a SEAL team platoon was pulled out of Iraq in 2019 amid allegations of sexual assault. Members of SEAL Team 10 were involved in cocaine use and tampering with drug tests. And Navy SEAL Adam Matthews was sentenced to a year in military prison for his role in the 2017 hazing-related death of an Army Green Beret in Africa.

Navy leaders also chafed as Navy SEALs broke away from their “quiet professional” ethos, publicizing their participation in the raid into Pakistan that killed bin Laden, the al-Qaida leader responsible for plotting the 9/11 attacks. Two SEALs wrote books about the mission, prompting a rebuke form the Naval Special Warfare commander at the time, Rear Adm. Brian Losey.

“A critical tenant of our ethos is ‘I do not advertise the nature of my work, nor seek recognition for my actions,’” he said.

Since taking over last September, Howard reached out to the Army and the Marine Corps for ideas on how to better screen his commando forces and assess them as they move through the ranks. Almost immediately, he instituted a “double blind” process for candidate interviews that was being used by the Army, so that neither side is influenced by actually seeing the other.

In addition, he is intensifying the screening process with more psychological assessments to evaluate personality traits. And he is expanding other assessments done by the subordinates and peers of candidates up for review. The increased scrutiny, said Howard, will extend through all the ranks and will help leaders get a better understanding of each service member’s character. The process, he said, will provide more feedback for individuals so they can improve and will also help top leaders pair commanders with the right teams.

In some cases, Howard said, sailors who already had gone through the initial SEAL screening had to do it again under the new process. Not all did as well the second time.

“We learned that some of the officers that scored in the midrange are officers that I thought would have scored much higher,” he said.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/8GvESPTFOIM/navy-seals-shift-counterterrorism-global-threats

DevSecOps Company Sysdig Raises $188 Million at $1.19 Billion Valuation

DevSecOps company Sysdig on Wednesday announced becoming a “unicorn” after raising $188 million in a Series F funding round at a valuation of $1.19 billion.

The latest funding round, which brings the total raised by the company to $394 million, was led by Premji Invest & Associates and Third Point Ventures, with participation from Accel, Bain Capital Ventures, DFJ Growth, Glynn Capital, Goldman Sachs, Insight Partners, and Next47.

The money will be used by the company to improve its products, grow R&D teams, expand sales and marketing, and enter the market in the APAC region.

Sysdig offers a secure DevOps platform that is designed to provide organizations security and visibility capabilities for their containers, cloud and Kubernetes. The company’s solutions enable customers to secure software build pipelines, detect and respond to runtime threats, monitor the performance and capacity of cloud and container services, and manage cloud posture and compliance.

Sysdig, which started as an open source project, also provides some open source tools that have been downloaded tens of millions of times.

A dozen cybersecurity companies have announced achieving unicorn status so far this year. There has been a surge in the number of firms valued at more than $1 billion in the past year, which some have attributed to speculative strategies and others to the growing importance of cybersecurity.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/4_ZzOVWIaKk/devsecops-company-sysdig-raises-188-million-119-billion-valuation

Dark Hash Collisions: New Service Confidentially Finds Leaked Passwords

New service can tell a company which users have a password known to hackers, without having to know the usernames

Businesses need to keep their user accounts safe. But there are billions of username and password pairs available to hackers on the dark web. User tendency to reuse passwords on multiple accounts means that hackers may already have your users’ credentials, stolen from a breached third party.

The result is the credential stuffing attack. Credential stuffing occurs when hackers systematically attempt hundreds or even thousands of possible username and password pairs until they find one that works.

“Every day you hear about a new billion set of records that hackers are passing around,” comments Steve Thomas, co-founder and CEO of HackNotice. “So, hackers really have the keys to the kingdom; they know every username and password that’s been in use for anything from Spotify to Gmail to all the major services – and even bank accounts. The problem is that users still – the majority of users– still reuse passwords.” Companies are consequently at risk of compromise even if they have never leaked a single user credential.

Hackers may have many thousands of ‘John Smith’ usernames without knowing if any belong to their next target. Their solution is to automate the process of testing every single pair they have, looking for the right one.

There are methods of checking whether passwords are on the dark web and consequently at risk of being used in credential stuffing; but this generally requires giving the user details to another company. This provides a conundrum: security demands that you give the user details to a dark web monitoring service while compliance with privacy regulations could require that you do not.

A new service from HackNotice solves this problem: Dark Hash Collisions (with no association or connection to the crypto mining organization known as DarkHash). HackNotice can tell a company exactly which of its users have a password known to hackers, without having to know the usernames. With no personal user information being passed to HackNotice, compliance is ensured.

Process

HackNotice has spent the last three years gathering every username and password pair it can find on the dark web. It has about 14 billion pairs. This is growing at many more billions each year as new leaks are exposed.

For its Dark Hash Collisions service, the ‘@’ part of email-based user ID is stripped off, leaving just the pure username. HackNotice has now spent many months of Amazon compute power hashing every one of these usernames with SHA-512. The result is a hash and a password. Only the first half of the hash is important to the process.

The customer does similar, creating SHA-512 hashes of the usernames in its user databases. However, it cuts them in half, and passes only the first half to HackNotice. This is the ‘dark hash’ since there is no possibility of it being reversed into the full username.

Nevertheless, that half hash is enough to match against the full hashes in the HackNotice database. Even though no identifiable personal data leaves the customer, HackNotice now has all it needs to determine what passwords associated with each user are available to hackers on the dark web – and consequently present a risk of credential stuffing attacks.

Of course, common names, such as John Smith, may have many thousands or even millions of different passwords in the HackNotice database. HackNotice doesn’t know it is John Smith, but merely matches the half hash it receives with those in its database – and passes them all back to the customer.

The customer can then determine whether any John Smith in its user database has any of the compromised passwords. If it finds a match, it can either force a password reset or require the user to do so.

At the beginning of this process, huge numbers may be involved. For every half hash the customer passes to HackNotice, it is likely to receive many compromised passwords back. “If a customer gives us six million half-hashes, we’re probably going to send back on the order of a few billion sets of credentials to check,” explains Thomas. “It will depend on the number of passwords we see for each username, but on average we’ll see anywhere from 4 to a dozen passwords for very distinct usernames, and tens of thousands for very common usernames.”

In computing terms, however, it is a simple task for the customer to see if any compromised username/password pairs exist among its own users.

If the company adopts the HackNotice monitoring service, these numbers will rapidly dwindle. HackNotice continues to add new leaks to its database, but will only return new pairings to the customer.

Advantages

An important aspect of this service is that it can monitor a customer’s at-risk usernames at scale, but never requires the customer to disclose identifiable personal information to a third party. “We want this to be a security service that’s loved by the legal team,” explains Thomas. “Nothing is sent to us that has any privacy concerns, nothing is sent to us that has any compliance concerns. Effectively, what comes in and goes out is all gibberish, but once it gets back into the client’s hands, they have live intelligence.”

That intelligence can be used in various ways. The obvious one is to fortify the company against credential stuffing. But let’s say that a particular user keeps reappearing on the compromised list – the user may have been forced to reset his password, but it has rapidly been re-compromised. This might indicate that the user has very poor password understanding and habits, or it may indicate that there is information stealing malware on the user’s computer.

It is even possible that if a customer gets a large number of hits from the half hashes it submits to HackNotice it could indicate an undetected breach of the customer. Here Thomas warns about jumping to conclusions. “Another possibility is that the user population might have a high correlation with another company, which was actually breached,” he said. For example, a regional bank could have a high user population crossover with a regional telecommunications company, and users might typically reuse credentials with both. So, if the regional telecommunications company were to be breached, the regional bank’s users would be especially at-risk after the data leak. This could also happen with other vendors throughout the supply chain.”

HackNotice also offers a live real-time enquiry option for on demand checks. So, for example, particularly large financial transactions may merit a check on whether the user credentials have been leaked to the dark web. A successful hit doesn’t mean that the user is a fraud, but it does warn the customer that the transaction could be – and that additional anti-fraud measures should be brought into play.

The bottom line is that Dark Hash Collisions can safely detect all a customer’s users that have been compromised and consequently present a risk of credential stuffing. “Compared to current, reactive cybersecurity”, said Thomas, “we can preemptively identify when hackers target clients for the future, stopping attacks before they start.”

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/9p4kMcLOp5Q/dark-hash-collisions-new-service-confidentially-finds-leaked-passwords

Russia-Linked ‘Ghostwriter’ Disinformation Campaign Tied to Cyberspy Group

A widespread disinformation campaign dubbed Ghostwriter is believed to be the work of a state-sponsored cyber-espionage group, cybersecurity firm FireEye reported on Wednesday.

Initially detailed in July 2020 but ongoing for years, the campaign aligns with Russian interests and was initially observed targeting audiences in Lithuania, Latvia, and Poland with NATO-related themes.

Since FireEye’s initial report on Ghostwriter, the activity has expanded with new narratives, and the attackers started leveraging compromised Twitter, Facebook, and Instagram accounts of Polish officials to disseminate content aimed at creating domestic political disruption in the country.

Between October 2020 and January 2021, FireEye’s researchers identified five new Ghostwriter operations conducted in both Polish and English, but which were not aligned with previous activity that relied on compromised websites, spoofed emails, fake personas, and NATO-themed content.

One Ghostwriter operation that did fall in line with previously observed activity promoted for several days in October 2020 content suggesting that NATO was getting its military ready for a war with Russia, and that the battle would take place in Poland, Latvia, and Lithuania. The narrative was promoted via a fabricated article published on several websites, but compromised social media accounts of Polish officials were also used to disseminate the story.

“We assess with high confidence that UNC1151, a suspected state-sponsored cyber espionage group, conducts at least some components of Ghostwriter influence activity; current intelligence gaps, including gaps pertaining to website compromises and the operation of false personas, do not allow us to conclusively attribute all aspects of the Ghostwriter campaign to UNC1151 at this time,” FireEye says.

The group tracked by FireEye as UNC1151, which has not been linked to any known threat actor, has been running operations aimed at credential harvesting and malware delivery through spear phishing attacks. The credentials stealing attacks targeted government, military, and media organizations in Poland, Ukraine, and Baltic countries, but the group was also observed attempting to compromise the accounts of other entities of interest, including journalists and activists.

Using a wide infrastructure that includes domains mimicking web services, as well as subdomains that spoof resources of legitimate organizations, the group is believed to have targeted thousands since 2017, including at least one Ukrainian journalist, one Belarussian blogger, and multiple German individuals. Furthermore, the adversary employed phishing for the distribution of malware such as HALFSHELL.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/eJPfCa0INRk/russia-linked-ghostwriter-disinformation-campaign-tied-cyberspy-group