americas-government
Snowden Used Low-Cost Tool to Best N.S.A.
Intelligence officials investigating how Edward J. Snowden gained access to a huge trove of the country’s most highly classified documents say they have determined that he used inexpensive and widely available software to “scrape” the National Security Agency’s networks, and kept at it even after he was briefly challenged by agency officials.
Using “web crawler” software designed to search, index and back up a website, Mr. Snowden “scraped data out of our systems” while he went about his day job, according to a senior intelligence official. “We do not believe this was an individual sitting at a machine and downloading this much material in sequence,” the official said. The process, he added, was “quite automated.”
U.S. offers companies broad standards to improve cybersecurity
The U.S. government on Wednesday released the final version of standards meant to help companies in nationally critical industries better defend against cyber attacks, and officials now face the challenge of getting the private sector to adopt the voluntary measures.
Criticized for being too vague and toothless, the so-called cybersecurity framework turned a vast amount of industry input into guidelines designed for 16 different sectors whose disruption could be devastating to the country.
The release from the National Institute of Standards and Technology comes exactly one year after President Barack Obama issued an executive order directing the agency to compile voluntary minimum cybersecurity standards as one step to counter the lack of progress on cybersecurity law in Congress
Cybersecurity in slow lane one year after Obama order
Nearly a year after President Barack Obama issued an executive order to improve the cybersecurity of the nation’s vital assets, the administration doesn’t have much to show: The government is about to produce only some basic standards, with little incentive for the private sector to participate.
The program’s early weaknesses are a sign that — even as high-profile breaches at Target and other retailers compromise the data of millions of consumers — the White House and Congress have made minimal progress on the potentially more serious issue of protecting power plants, oil pipelines and major banks from a crippling cyberattack
Cybersecurity expert explains importance of NCCIP Act
Kellerman is the managing director at Alvarez & Marsal, a Washington, DC-based global professional services firm that offers strategic guidance and advisory services to other businesses. Kellerman is a Certified Information Security Manager (CISM) with 17 years of experience in cybersecurity, risk management, and incident response. He served as a commissioner on the Commission on Cybersecurity for the 44th President
The NCCIP Act is currently pending legislation in the House of Representatives, but Kellerman is optimistic that the bill will be approved later in 2014.
The NCCIP is a unique piece of legislation that will allow the DHS to take a more active role in the realm of cybersecurity by forming a partnership with private businesses to share information, provide support responding to the cybersecurity threats, and offer education and training to businesses that request it.
americas-private sector
Cyber-attack on Pennsylvania company possibly linked to Target data breach
A western Pennsylvania heating and refrigeration contractor said it was the victim of a “sophisticated cyber-attack operation” that is being investigated by the US Secret Service and possibly linked to the data breach that enabled hackers to access millions of credit card numbers belonging to Target store customers.
Fazio Mechanical Services Inc, of Sharpsburg, issued the statement after internet security bloggers identified it as the third-party vendor through which hackers accessed Target’s customer information. Target had previously told reporters the store believed hackers accessed 40m of its customers’ card numbers through a vendor’s system
Largest Ever DDoS Cyber Attack Hits US and European Victims
Multiple reports suggest the largest ever DDoS attack – peaking at 400Gbps – has hit targets in the US and Europe though who is behind the attack, and who the victims were remains a mystery.
Last year a DDoS (distributed denial of service) attack on the anti-spamming group Spamhaus was declared the “biggest in the history of the internet” peaking at 300 gigabits per second (Gbps).
On Monday reports from the US and France suggest an attack peaking at 400Gbps had been launched using a new technique which allows an attacker to easily amplify their attack while hiding their identity.
How Cybersecurity Laws Are Outdated
Washington and the private sector are both scrambling to protect their critical systems from cyberattacks. Can the two of them cooperate to stay safe?
John Bussey, assistant managing editor and executive business editor of The Wall Street Journal, spoke about cybersecurity with Mike McConnell, vice chairman of Booz Allen Hamilton and former White House national intelligence director and director of the National Security Agency. Here are edited excerpts of their conversation.
Banking Cyber-Attack Trends to Watch
When it comes to cyberthreats, what are the major concerns for banking institutions in 2014? Distributed-denial-of-service attacks waged as a mode of distraction to perpetrate fraud across numerous banking channels are a growing threat. But financial institutions also are concerned about ransomware attacks designed to wage account takeover fraud, as well as mobile malware and insider threats.
The key for banking institutions in 2014 will be to focus on detecting and mitigating multiple risks across multiple channels. “We will see more blended attacks that combine DDoS with some form of attempted data compromise,” says Doug Johnson, vice president and senior adviser of risk management policy for the American Bankers Association.
Other threats that will require renewed attention include spear-phishing attacks and call-center schemes waged against employees, as well as nation-state threats and third-party breaches.
Bitcoin Exchange Bitstamp Halts Withdrawals After Cyber Attack
Bitcoin exchange Bitstamp temporarily halted withdrawals and deposits on Tuesday due to a cyber attack that caps off a rocky stretch for the crypto currency.
The troubles experienced by Bitstamp and similar issues at rival exchange Mt. Gox highlight the technical problems still faced by the relatively young and increasingly-popular currency.
Slovenia-based Bitstamp said it stopped processing Bitcoin withdrawals due to “inconsistent results” reported by its “bitcoind” wallet that were caused by a denial-of-service attack. DDoS attacks are increasingly popular cyber intrusions that flood servers with unreasonable amounts of traffic.
Hackers Bust Las Vegas Sands Sites in Cyber Attack on Sheldon Adelson
Sheldon Adelson’s Las Vegas Sands (LVS) appears to have been hit by a cyber attack this week that has crippled a number of the casino giant’s websites and compromised employee data.
The intrusion has prevented guests from using the websites of certain casinos, including the Venetian in Las Vegas.
“Our company-operated websites have been hacked as have some office productivity systems in the U.S.,” a Las Vegas Sands spokesman said. “The company is working closely with the appropriate law enforcement agencies to determine who initiated the hacking activity.”
international
Foreign regimes use spyware against journalists, even in U.S.
Mesay Mekonnen was at his desk, at a news service based in Northern Virginia, when gibberish suddenly exploded across his computer screen one day in December. A sophisticated cyberattack was underway.
But this wasn’t the Chinese army or the Russian mafia at work.
Instead, a nonprofit research lab has fingered government hackers in a much less technically advanced nation, Ethiopia, as the likely culprits, saying they apparently used commercial spyware, essentially bought off the shelf. This burgeoning industry is making surveillance capabilities that once were the exclusive province of the most elite spy agencies, such as National Security Agency, available to governments worldwide.
Iran’s supreme leader tells students to prepare for cyber war
Ayatollah Ali Khamenei has delivered a sabre-rattling speech to Iran’s ‘Revolutionary foster children’ (in other words, university students) to prepare for cyber war.
The supreme leader has urged his country’s students – whom he called “cyber war agents” – to prepare for battle, the semi-official Mehr news agency reported Wednesday.
“You are the cyber-war agents and such a war requires Amman-like insight and Malik Ashtar-like resistance. Get yourself ready for such war wholeheartedly,” wrote Khamenei.The supreme leader was referring to two of Prophet Mohammad’s warrior companions in early Islamic history.
Korea, U.S. hold working-level talks on cybersecurity
South Korea and the United States on Friday held their first working-level talks on cybersecurity to discuss ways to develop joint cyberwarfare capabilities and an emergency response system, South Korea’s Defense Ministry said.
The meeting was called after the defense ministries of the two nations last year agreed to launch the Cyber Cooperation Working Group in light of a series of large-scale hack attacks into South Korean networks, believed to have been masterminded by North Korea.
France to invest 1 billion euros to update cyber defences
France unveiled plans on Friday to bolster long-neglected defences against cyber attacks, with 1 billion euros ($1.36 billion) of investment foreseen to bring the country’s technology up to speed with NATO partners.
Defence Minister Jean-Yves Le Drian presented measures including roll-outs of secure telephones, encryption technology and network surveillance to harden sensitive computer systems now exposed to hacking and espionage.
The spending aims to build up France’s ability to fend off mounting cyber attacks and bolster surveillance after years of neglect. The issue has taken on more urgency in the wake of former NSA contractor Edward Snowden’s disclosures about US cyber surveillance practices.
Japan Faced 12.8 Billion Cyber Attacks in 2013
Japan faced at least 12.8 billion cyber-attacks in 2013 alone, says Tokyo’s National Institute of Information and Communications Technology (NICT).
The cyber-attacks, which are believed to have included phishing campaigns, DDoS (Distributed Denial of Service) attacks, and Hacktivism, had largely targeted government organisations and other state-run activities.
The NICT said it is the highest number of attacks since its inception in 2005
Nationwide Credit Card Failure Stokes Israeli Fears of Cyber-Attacks
Credit card transactions were stymied across Israel for much of Thursday. In the hours required to solve the problem, Israelis stood in line wondering whether to be just frustrated or both frustrated and a little uneasy. Security officials in Israel frequently warn that the country should expect a major cyber-attack. And readers who went online in hopes of seeing what was going on found, on the website of leading daily Haaretz, a story on the credit card problem immediately next to t: “Prepare for cyber-war, Iran’s supreme leader tells students.”
Thursday’s “glitch” turned out to be just that – a software problem reportedly caused by a faulty update that rendered the exchange rate for the U.S. dollar at zero, an amount that literally did not compute. The business journal Calcalist estimates the snafu cost 100,000 shekels ($28,500) a minute in lost business. But the only apparent harm to humans was long lines at supermarkets and gas stations among Israelis who—in the cash squeeze that forces many members of the middle class to survive on monthly bank drafts—routinely whip out a Visa card to pay for a cup of coffee.