Officials Say School District Near Albany Hit by Cyberattack

An Albany-area school district is investigating a malware attack that forced students in grades 7 through 12 into all-remote learning on Monday, district officials announced.

Officials at the Guilderland Central School District said on the district’s website that specialists investigating “technical interruptions” that happened last Thursday “have determined that the district was the victim of a cyber attack by a threat actor group which used malware to encrypt certain systems throughout the district.”

Officials with the 5,700-student district said they are investigating to determine “whether any sensitive data may have been impacted.” They said school buildings would be closed to students in grades 7 through 12 on Monday.

School districts and other government agencies around the country have been plagued by of an epidemic of ransomware attacks in recent years. The computer system of Florida’s Broward County Public Schools was hacked earlier this month by a criminal gang that threatened to post students’ and employees’ personal information online if it didn’t get $40 million in ransom.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/xtuMhdwNH3o/officials-say-school-district-near-albany-hit-cyberattack

Apple’s iPhone Privacy Clampdown Arrives After 7-Month Delay

Apple is following through on its pledge to crack down on Facebook and other snoopy apps that secretly shadow people on their iPhones in order to target more advertising at users.

The new privacy feature, dubbed “App Tracking Transparency,” rolled out Monday as part of an update to the operating system powering the iPhone and iPad. The anti-tracking shield included in iOS 14.5 arrives after a seven-month delay during which Apple and Facebook attacked each other’s business models and motives for decisions that affect billions of people around the world.

“What this feud demonstrates more than anything is that Facebook and Apple have tremendous gatekeeping powers over the market,” said Elizabeth Renieris, founding director of the Technology Ethics Lab at the University of Notre Dame.

But Apple says it is just looking out for the best interests of the more than 1 billion people currently using iPhones.

“Now is a good time to bring this out, both because of because of the increasing amount of data they have on their devices, and their sensitivity (about the privacy risks) is increasing, too,” Erik Neuenschwander, Apple’s chief privacy engineer, told The Associated Press in an interview.

Once the software update is installed — something most iPhone users do — even existing apps already on the device will be required to ask and receive consent to track online activities. That’s a shift Facebook fiercely resisted, most prominently in a series of full-page newspaper ads blasting Apple.

Until now, Facebook and other apps have been able to automatically conduct their surveillance on iPhones unless users took the time and trouble to go into their settings to prevent it — a process that few people bother to navigate.

“This is an important step toward consumers getting the transparency and the controls they have clearly been looking for,” said Daniel Barber, CEO of DataGrail, a firm that helps companies manage personal privacy.

In its attacks on Apple’s anti-tracking controls, Facebook blasted the move as an abuse of power designed to force more apps to charge for their services instead of relying on ads. Apple takes a 15% to 30% cut on most payments processed through an iPhone app.

Online tracking has long helped Facebook and thousands of other apps accumulate information about their user’s interests and habits so they can show customized ads. Although Facebook executives initially acknowledged Apple’s changes would probably reduce its revenue by billions of dollars annually, the social networking company has framed most of its public criticism as a defense of small businesses that rely on online ads to stay alive.

Apple, in turn, has pilloried Facebook and other apps for prying so deeply into people’s lives that it has created a societal crisis.

In a speech given a few weeks after the Jan. 6 attacks on the U.S. Capitol, Apple CEO Tim Cook pointed out how personal information collected through tracking by Facebook and other social media can sometimes push people toward more misinformation and hate speech as part of the efforts to show more ads.

“What are the consequences of not just tolerating but rewarding content that undermines public trust in life-saving vaccinations?” Cook asked. “What are the consequences of seeing thousands of users join extremist groups and then perpetuating an algorithm that recommends more?”

It’s part of Apple’s attempt to use the privacy issue to its competitive advantage, Barber said, a tactic he now expects more major brands to embrace if the new anti-tracking controls prove popular among most consumers.

In a change of tone, Facebook CEO Mark Zuckerberg recently suggested that Apple’s new privacy controls could actually help his company in the long run. His rationale: The inability to automatically track iPhone users may prod more companies to sell their products directly on Facebook and affiliated services such as Instagram if they can’t collect enough personal information to effectively target ads within their own apps.

“It’s possible that we may even be in a stronger position if Apple’s changes encourage more businesses to conduct more commerce on our platforms by making it harder for them to use their data in order to find the customers that would want to use their products outside of our platforms,” Zuckerberg said last month during a discussion held on the audio chat app Clubhouse.

In the same interview, Zuckerberg also asserted most people realize that advertising is a “time-tested model” that enables them to get more services for free or at extremely low prices.

“People get for the most part that if they are going to see ads, they want them to be relevant ads,” Zuckerberg said. He didn’t say whether he believes most iPhone users will consent to tracking in exchange for ads tailored to their interests.

Google also depends on personal information to fuel a digital ad network even bigger than Facebook’s, but it has said it would be able to adjust to the iPhone’s new privacy controls. Unlike Facebook, Google has close business ties with Apple. Google pays Apple an estimated $9 billion to $12 billion annually to be the preferred search engine on iPhone and iPad. That arrangement is currently one element of an antitrust case filed last year by the U.S. Justice Department.

Facebook is also defending itself against a federal antitrust lawsuit seeking to break the company apart. Meanwhile, Apple is being scrutinized by lawmakers and regulators around the world for the commissions it collects on purchases made through iPhone apps and its ability to shake up markets through new rules that are turning it into a de facto regulator.

“Even if Apple’s business model and side in this battle is more rights protective and better for consumer privacy, there is still a question of whether we want a large corporation like Apple effectively ‘legislating’ through the app store,” Renieris said.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/X886Qqs_2bc/apple%E2%80%99s-iphone-privacy-clampdown-arrives-after-7-month-delay

Supreme Court Asked to Give Access to Secretive Court’s Work

Civil liberties groups are asking the Supreme Court to give the public access to opinions of the secretive court that reviews bulk email collection, warrantless internet searches and other government surveillance programs.

The groups say in an appeal filed with the high court Monday that the public has a constitutional right to see significant opinions of the Foreign Intelligence Surveillance Court. They also argue that federal courts, not the executive branch, should decide when opinions that potentially affect the privacy of millions of Americans should be made public.

The appeal was filed by Theodore Olson, the American Civil Liberties Union, the Knight First Amendment Institute at Columbia University and Yale Law School’s Media Freedom and Information Access Clinic. Olson is on the Knight institute’s board and was the Bush administration’s top Supreme Court lawyer as the FISA court’s role was expanded after the Sept. 11 terrorist attacks.

“You’re talking about judicial decisions here that may affect millions of people. The public needs to know the outlines of what those decisions are and how far they go,” Olson said in an interview with The Associated Press. “Because of my experience with it, I know that government, with the best of intentions, will tend to err on the side of keeping everything secret.”

The Foreign Intelligence Surveillance Court was established in 1978 to receive applications from the FBI to eavesdrop on people it suspects of being agents of a foreign power, such as potential spies or terrorists. After Sept. 11, Congress expanded the court’s role to consider broad surveillance programs.

In recent decisions, judges ruled that opinions sought by the groups couldn’t be made public, even in censored form, and that they didn’t even have the authority to consider releasing the opinions.

Legislation adopted in 2015 includes a provision that requires the government to consider releasing significant FISA court opinions. But the law doesn’t apply to opinions written before it was enacted and leaves the review process entirely to the executive branch.

The high-court appeal says the First Amendment’s guarantee of freedom of the press demands greater access.

The Justice Department had no comment on the filing Monday. Its response is due at the court by late May.

The ACLU has been seeking the FISA court opinions for years, and the current case dates to 2016.

“These opinions and orders address, among other matters, the lawfulness of bulk email searches, the government’s authority to surreptitiously install malware on Americans’ computers, and the use of warrantless internet surveillance for cybersecurity purposes,” the appeal says.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/mItYW88iq7c/supreme-court-asked-give-access-secretive-court%E2%80%99s-work

Capcom Says Older VPN Device at Heart of Ransomware Attack

Japanese video game giant Capcom revealed on Tuesday that, as part of the November 2020 ransomware attack, adversaries targeted an older backup VPN device for initial access.

Known for multi-million-selling game franchises, including Resident Evil, Street Fighter, Ace Attorney, and Devil May Cry, Capcom has offices across Asia, Europe, and North America. In November 2020, the company suspended some operations after identifying unauthorized access to its internal network.

In early 2021, the company confirmed that the personal data of thousands of people was affected in the incident, and now it says that a total of 15,649 people were impacted, down 766 people from the original estimation.

The game maker notes that the affected systems are unrelated to those that are used to purchase or play Capcom games online, and that external servers are used for these operations.

“As described in previous announcements, none of the at-risk data contains credit card information. All online transactions etc. are handled by a third-party service provider on a separate system (not involved in this attack), and as such Capcom does not maintain any such information internally,” Capcom says.

According to the game maker, its investigation into the incident has revealed that an older backup VPN device maintained at the North American subsidiary (Capcom U.S.A., Inc., located in California) was leveraged as an entry point into the company’s internal network.

At the time, the company says, the North American subsidiary, just as the entire Capcom Group, had transitioned to a new model of VPN devices, but the spread of COVID-19 in the State of California had forced it to keep older VPN devices as an emergency backup.

The attackers breached the older devices to compromise systems at Capcom offices in the U.S. and Japan, which resulted in data theft. The attackers also abused the fact that the game maker was transitioning to new defensive measures, but hadn’t yet implemented them, as they were still in the process of being verified.

At the next stage of attack, on November 1, ransomware was dropped on systems at both Capcom U.S. and Japan offices, and data on those systems was encrypted. The next day, the company’s networks started experiencing issues impacting access to certain systems, such as email and file servers.

Capcom also notes that it has since adopted additional protection measures to address the incident and ensure that its network is protected from future similar attacks.

The company also notes that the threat actor behind the attack did not specify an amount to be paid as ransom, although they did leave messages with instructions to start negotiations. Capcom says it never attempted to make contact with the attackers and that as such it is “not aware of any ransom demand amounts.”

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/4GGJEG3fBvU/capcom-says-older-vpn-device-heart-ransomware-attack

Cybersecurity VC Funding Hit Record in 2020 With $7.8 Billion Invested

Despite the coronavirus pandemic, 2020 was a record year in terms of venture capital funding for cybersecurity companies, with more than $7.8 billion invested, according to a new report from business information platform Crunchbase.

Data from Crunchbase shows that cybersecurity venture funding has been on an upwards trend over the past decade, with roughly 1,500 companies receiving funding since 2017, 58% of which were seed-stage and 32% were early-stage firms.

A total of 702 deals were announced in 2019, for a total amount of approximately $7.6 billion. In 2020, while the number of deals dropped to 665, the total investment increased to $7.8 billion. Considering the fact that more than $3.7 billion has already been invested in cybersecurity companies in the first months of 2021, it’s possible that the record will be broken again this year.

Cybersecurity funding

“The cybersecurity industry has been experiencing rapid global growth for the past decade and, with many companies forced to transition online, the pandemic only increased this urgency and the relevance of the industry,” Crunchbase said in its report.

“Highly publicized and damaging data breaches have also played a large part in the rapid expansion of the cybersecurity industry,” it added.

In the United States, which leads in terms of the money raised by the cybersecurity industry over the past decade with nearly $30 billion, funding increased by 22% from 2019 to 2020. In comparison, the overall venture market in the U.S. recorded a growth of 15%.

The U.S. is followed by Israel ($2.7 billion), China ($1.8 billion), the UK, and Canada in terms of how much their cybersecurity companies raised between 2011 and 2020. Israel recorded an increase of 65% in 2020 compared to the previous year.

More than three-quarters of the global cybersecurity funding announced in 2020 went to companies in the United States, which received a total of $5.9 billion from investors. While nearly half of the funding went to companies in California, firms in New York, Massachusetts, Texas, Minnesota and Maryland have also secured significant investments.

As for the investors themselves, the top 10 for 2019 and 2020 are Accel, Insight Partners, Techstars, Y Combinator, TenEleven Ventures, Lightspeed Venture Partners, Clearsky, ForgePoint Capital, Intel Capital, Salesforce Ventures, and Sequoia Capital.

The largest deal of 2020 was announced by cloud security company Netskope, which raised $340 million at a valuation of $3 billion.

2020 was also a record year in terms of new unicorns — these are companies valued at more than $1 billion — with six new unicorns. More than 30 cybersecurity firms have become unicorns to date.

SecurityWeek recently contacted several industry professionals for their thoughts on the surge in cybersecurity unicorns. Some believe it’s a result of speculative strategies while others believe it reflects the growing importance of cybersecurity.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/FCo9pwfJs98/cybersecurity-vc-funding-hit-record-2020-78-billion-invested

Another Critical Vulnerability Patched in SAP Commerce

On Tuesday, as part of its April 2021 Security Patch Day, SAP announced the release of 14 new security notes and 5 updates to previously released notes. The only new Hot News note released with this round of patches addresses a critical vulnerability in SAP Commerce.

Tracked as CVE-2021-27602 and featuring a CVSS score of 9.9, the critical security hole could be abused to achieve remote code execution, SAP says.

The issue allows authorized users of the SAP Commerce Backoffice software to inject malicious code in source rules by abusing the scripting capabilities of the Rules engine.

“This can lead to a remote code execution with critical impact on the system’s confidentiality, integrity, and availability,” Onapsis, a firm that specializes in securing Oracle and SAP applications, explains.

To address the vulnerability, SAP introduced “additional validations and output encoding when processing rules.”

Two other Hot News security notes included in this month’s Security Patch Day are updates to previously released notes. The first of them is an update for the Chromium-based browser in SAP Business Client, while the second deals with a missing authorization check in NetWeaver AS JAVA.

SAP’s April 2021 Security Patch Day also saw the release of security notes for four high-severity flaws, namely three information disclosure issues in NetWeaver Master Data Management (CVE-2021-21482), Solution Manager (CVE-2021-21483), and NetWeaver AS for Java (CVE-2021-21485), and an unquoted service path in SAPSetup (CVE-2021-27608).

SAP also released an update for a high-severity note addressing CVE-2020-26832, a missing authorization check in NetWeaver AS ABAP and S4 HANA (SAP Landscape Transformation).

The remaining security notes, all with a severity rating of medium, address vulnerabilities in NetWeaver AS for Java, NetWeaver AS for ABAP, Process Integration (Integration Builder Framework), Process Integration (ESR Java Mappings), Manufacturing Execution (System Rules), Focused RUN, and HCM Travel Management Fiori Apps V2.

Four other vulnerabilities were addressed with security notes released between the March 2021 and April 2021 Security Patch Days.

Organizations are advised to apply the available patches as soon as possible, to ensure their applications remain protected. A study that SAP and Onapsis published last week revealed that, in some cases, threat actors start targeting newly patched vulnerabilities mere days after security updates are released.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/J_HrAWTSwg8/another-critical-vulnerability-patched-sap-commerce

Siemens Releases Several Advisories for ‘NAME:WRECK’ Vulnerabilities

Siemens released a total of 14 new advisories on Tuesday, including five describing the impact and remediations for the NAME:WRECK vulnerabilities disclosed on the same day.

IoT security company Forescout on Tuesday revealed that four popular TCP/IP stacks — specifically FreeBSD, Siemens’ Nucleus, IPnet and NetX — are affected by a total of nine DNS-related flaws that can be exploited for remote code execution (including to take control of targeted devices), DoS attacks, and DNS cache poisoning.

The vulnerabilities, collectively tracked as NAME:WRECK, could affect billions of devices that use these TCP/IP stacks for network communications, but Forescout researchers estimate that at least 100 million devices are exposed to attacks.

Siemens on Tuesday published several advisories related to NAME:WRECK: one advisory to describe two out-of-bounds write flaws that can lead to code execution or DoS attacks, another advisory for a DNS cache poisoning issue, one advisory for two DoS vulnerabilities, and two advisories for the same four DoS and DNS cache poisoning flaws (one is for impact on the SIMOTICS CONNECT 400 remote motor monitoring system).

Affected products include Nucleus 4, Nucleus NET, Nucleus RTOS, Nucleus ReadyStart, and VSTAR, as well as the Nucleus source code. Siemens has released patches for some of the impacted products and it has also provided workarounds and mitigations to reduce the risk until a patch can be installed or becomes available.

Learn more about vulnerabilities in industrial systems at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits virtual event series

Forescout wrote in its report on the NAME:WRECK vulnerabilities, “According to the website of Nucleus RTOS(which runs the Nucleus TCP/IP stack), it is deployed in more than 3 billion devices. A quick look at Siemens’ page listing customer success stories reveals its use in scenarios such as healthcare (ZOLL defibrillators and ZONARE ultrasound machines), IT (BDT AG storage systems) and critical sys-tems (Garmin avionics navigation). But we believe that most of those 3 billion are actually device components such as MediaTek IoT chipsets and baseband processors used in smartphones and other wireless devices (which is similar to the distribution seen below for ThreadX).”

Siemens on Tuesday also published advisories for vulnerabilities affecting TIM 4R-IE, LOGO! Soft Comfort, Siveillance Video Open Network Bridge (ONVIF), Opcenter Quality, QMS Automotive, Control Center Server (CCS), Tecnomatix RobotExpert, SCALANCE X-200, Solid Edge, and SINEMA Remote Connect Server products.

Schneider Electric advisories

Schneider Electric on Tuesday published two new security advisories. One of them describes four high- and one medium-severity vulnerabilities affecting the C-Bus Toolkit, which is used to configure and commission C-Bus installations. The flaws, related to the handling of files, can be exploited for remote code execution.

The second advisory from Schneider describes a couple of old Windows vulnerabilities affecting its NTZ Mekhanotronika Rus control panels.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/silv9pLXKy8/siemens-releases-several-advisories-namewreck-vulnerabilities

FBI Agents Secretly Deleted Web Shells From Hacked Microsoft Exchange Servers

FBI agents executed a court-authorized cyber operation to delete malicious web shells from hundreds of previously hacked Microsoft Exchange servers in the United States, unbeknownst to their owners, the U.S. Department of Justice (DoJ) said Tuesday.

After a wave of major in-the-wild zero-day attacks against Exchange Server installations that occurred globally in January, savvy organizations scrambled to lock down vulnerable Microsoft email servers and remove web shells that were installed by attackers.

In early attacks observed by Microsoft, attackers were able to exploit a series of vulnerabilities to access on-premises Exchange servers which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to victim environments.

Unfortunately, many organizations were not able to patch systems and/or remove associated malware that was installed.

In what appears to be the first known operation of its kind, the FBI “removed one early hacking group’s remaining web shells which could have been used to maintain and escalate persistent, unauthorized access to U.S. networks.”

According to court documents, FBI agents removed the web shells by issuing a command through the web shell to the server, which was designed to cause the server to delete only the web shell (identified by its unique file path).

“Because the web shells the FBI removed each had a unique file path and name, they may have been more challenging for individual server owners to detect and eliminate than other web shells,” the DoJ explained.

While FBI agents copied and removed web shells that provided attackers with backdoor access to servers, organizations may not be in the clear.

“This operation was successful in copying and removing those web shells,” the Justice Department says. “However, it did not patch any Microsoft Exchange Server zero-day vulnerabilities or search for or remove any additional malware or hacking tools that hacking groups may have placed on victim networks by exploiting the web shells.”

While Microsoft attributed the original attacks in January to the China-linked HAFNIUM threat actors, multiple hacking groups followed soon after the Exchange vulnerabilities were publicized.

HAFNIUM primarily targets entities in the U.S. across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.

With most of the work already done, the FBI is now attempting to notify owners or operators of the computers from which it purged the web shells.

Organizations who still believe they have a Microsoft Exchange Server that remains compromised should contact their local FBI Field Office for assistance.

Company/organization names and IP addresses of those touched by the operation were redacted from publicly available court documents

The uncovering of the operation comes just as four new critical security vulnerabilities in Exchange Server were fixed as part of this month’s Patch Tuesday bundle. Because of the severity of the additional issues, Microsoft teamed with the U.S. National Security Agency (NSA) to urge the immediate deployment of the new fixes.

Upcoming Webinar: Preventing Novel BEC Attacks: Lessons Learned and Best Practices w/ the FBI (April 27)

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.

Previous Columns by Mike Lennon:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/4Zz3DFn3rhk/fbi-agents-secretly-deleted-web-shells-hacked-microsoft-exchange-servers

Iran Calls Natanz Atomic Site Blackout ‘Nuclear Terrorism’

Iran on Sunday described a blackout at its underground Natanz atomic facility an act of “nuclear terrorism,” raising regional tensions as world powers and Tehran continue to negotiate over its tattered nuclear deal.

While there was no immediate claim of responsibility, suspicion fell immediately on Israel, where its media nearly uniformly reported a devastating cyberattack orchestrated by the country caused the blackout.

If Israel was responsible, it further heightens tensions between the two nations, already engaged in a shadow conflict across the wider Middle East. Israeli Prime Minister Benjamin Netanyahu, who met Sunday with U.S. Defense Secretary Lloyd Austin, has vowed to do everything in his power to stop the nuclear deal.

Details remained few about what happened early Sunday morning at the facility, which initially was described as a blackout caused by the electrical grid feeding its above-ground workshops and underground enrichment halls.

Ali Akbar Salehi, the American-educated head of the Atomic Energy Organization of Iran, who once served as the country’s foreign minister, offered what appeared to be the harshest comments of his long career, which included the assassination of nuclear scientists a decade ago. Iran blames Israel for those killings as well.

He pledged to “seriously improve” his nation’s nuclear technology while working to lift international sanctions.

Salehi’s comments to state TV did not explain what happened at the facility, but his words suggested a serious disruption.

Iran vs. Israel: Cyberwar “While condemning this desperate move, the Islamic Republic of Iran emphasizes the need for a confrontation by the international bodies and the (International Atomic Energy Agency) against this nuclear terrorism,” Salehi said.

The IAEA, the United Nations’ body that monitors Tehran’s atomic program, earlier said it was aware of media reports about the incident at Natanz and had spoken with Iranian officials about it. The agency did not elaborate.

However, Natanz has been targeted by sabotage in the past. The Stuxnet computer virus, discovered in 2010 and widely believed to be a joint U.S.-Israeli creation, once disrupted and destroyed Iranian centrifuges at Natanz amid an earlier period of Western fears about Tehran’s program.

Natanz suffered a mysterious explosion at its advanced centrifuge assembly plant in July that authorities later described as sabotage. Iran now is rebuilding that facility deep inside a nearby mountain. Iran also blamed Israel for the November killing of a scientist who began the country’s military nuclear program decades earlier.

Multiple Israeli media outlets reported Sunday that an Israeli cyberattack caused the blackout in Natanz. Public broadcaster Kan said the Mossad was behind the attack. Channel 12 TV cited “experts” as estimating the attack shut down entire sections of the facility.

While the reports offered no sourcing for their information, Israeli media maintains a close relationship with the country’s military and intelligence agencies.

“It’s hard for me to believe it’s a coincidence,” Yoel Guzansky, a senior fellow at Tel Aviv’s Institute for National Security Studies, said of Sunday’s blackout. “If it’s not a coincidence, and that’s a big if, someone is trying to send a message that ‘we can limit Iran’s advance and we have red lines.’”

It also sends a message that Iran’s most sensitive nuclear site is “penetrable,” he added.

Netanyahu later Sunday night toasted his security chiefs, with the head of the Mossad, Yossi Cohen, at his side on the eve of his country’s Independence Day.

“It is very difficult to explain what we have accomplished,” Netanyahu said of Israel’s history, saying the country had been transformed from a position of weakness into a “world power.”

Israel typically doesn’t discuss operations carried out by its Mossad intelligence agency or specialized military units. In recent weeks, Netanyahu repeatedly has described Iran as the major threat to his country as he struggles to hold onto power after multiple elections and while facing corruption charges.

Speaking at the event Sunday night, Netanyahu urged his security chiefs to “continue in this direction, and to continue to keep the sword of David in your hands,” using an expression referring to Jewish strength.

Meeting with Austin on Sunday, Israeli Defense Minister Benny Gantz said Israel viewed America as an ally against all threats, including Iran.

“The Tehran of today poses a strategic threat to international security, to the entire Middle East and to the state of Israel,” Gantz said. “And we will work closely with our American allies to ensure that any new agreement with Iran will secure the vital interests of the world, of the United States, prevent a dangerous arms race in our region, and protect the state of Israel.”

The Israeli army’s chief of staff, Lt. Gen. Aviv Kochavi, also appeared to reference Iran.

The Israeli military’s “operations in the Middle East are not hidden from the eyes of the enemy,” Kochavi said. “They are watching us, seeing (our) abilities and weighing their steps with caution.”

On Saturday, Iran announced it had launched a chain of 164 IR-6 centrifuges at the plant. Officials also began testing the IR-9 centrifuge, which they say will enrich uranium 50 times faster than Iran’s first-generation centrifuges, the IR-1. The nuclear deal limited Iran to using only IR-1s for enrichment.

Since then-President Donald Trump’s withdrawal from the Iran nuclear deal in 2018, Tehran has abandoned all the limits of its uranium stockpile. It now enriches up to 20% purity, a technical step away from weapons-grade levels of 90%. Iran maintains its atomic program is for peaceful purposes.

The nuclear deal had granted Tehran sanctions relief in exchange for ensuring its stockpile never swelled to the point of allowing Iran to obtain an atomic bomb if it chose.

On Tuesday, an Iranian cargo ship said to serve as a floating base for Iran’s paramilitary Revolutionary Guard forces off the coast of Yemen was struck by an explosion, likely from a limpet mine. Iran has blamed Israel for the blast. That attack escalated a long-running shadow war in Mideast waterways targeting shipping in the region.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/-6_3ESmgsQE/iran-calls-natanz-atomic-site-blackout-nuclear-terrorism

Microsoft Open-Sources ‘CyberBattleSim’ Enterprise Environment Simulator

Microsoft this week announced the open source availability of Python code for “CyberBattleSim,” a research toolkit that supports simulating complex computer systems.

Designed to help advance artificial intelligence and machine learning, the experimental research project was designed to aid in the analysis of how “autonomous agents operate in a simulated enterprise environment using high-level abstraction of computer networks and cybersecurity concepts.”

CyberBattleSim allows for the training of automated agents, and provides a Python-based OpenAI Gym interface for that. In the simulated environments, defenders can leverage reinforcement learning algorithms and set up various cybersecurity challenges.

Reinforcement learning, Microsoft explains, is a type of machine learning that teaches autonomous agents to make decisions based on the interaction with the environment: agents improve strategies through repeated experience, similarly to playing a video game over and over to become better at it.

In software security, reinforcement learning involves the use of agents that play the role of attackers and defenders, and the analysis of their evolution in the simulated environment. The attacker seeks to steal information, while the attacker focuses on blocking the attacker or mitigating their actions.

CyberBattleSim employs OpenAI Gym for building interactive environments, and focuses on the lateral movement phase of a cyber-attack. The project simulates a fixed network with predefined vulnerabilities that the attacker model can exploit for lateral movement, while a defender agent seeks to detect the attacker and contain the intrusion.

“The simulation Gym environment is parameterized by the definition of the network layout, the list of supported vulnerabilities, and the nodes where they are planted. The simulation does not support machine code execution, and thus no security exploit actually takes place in it,” Microsoft explains.

The simulated computer network consists of systems running multiple platforms and aims to illustrate how the use of the latest operating systems and keeping them updated can deliver improved protections. Using the Gym interface, defenders can instantiate automated agents and then analyze their evolution in the environment.

“To perform well, agents now must learn from observations that are not specific to the instance they are interacting with. They cannot just remember node indices or any other value related to the network size. They can instead observe temporal features or machine properties,” the tech giant explains.

Microsoft says CyberBattleSim has a highly abstract nature and cannot be applied to real-world systems, which provides protection against the nefarious use of the trained automated agents.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/dgR98_1Ambk/microsoft-open-sources-cyberbattlesim-enterprise-environment-simulator