Black Energy Attack on Ukrainian Power Grid

Federal agencies in the US are looking into the Black Energy malware and possible state sponsored hackers that took down the Ukrainian power grid just before Christmas. About 700,000 were affected for several hours. If this proves out, it will be the first documented case of an attack that actually interrupted service and is a grave concern for governments around the world.

Tim Erlin, Director of IT Security and Risk Strategy for Tripwire says, “Industry experts have been talking about how cyber attacks could directly affect the power grid for a long time, so it shouldn’t be a surprise that it’s now actually occurred. Discussing a threat doesn’t count as mitigation. Energy companies need to invest in securing their infrastructure, from control systems to corporate IT. Investment isn’t just about buying products. It’s about people, skills and process. Purchasing the latest security device is easy compared to training security staff effectively.

"All malware, including BlackEnergy, requires an infection vector to get to its target. Attackers will almost always take the path of least resistance. Today, that means published vulnerabilities, misconfigurations and phishing scams. These are all security issues that we can address, with sufficient resources.

 

"It’s myopic to think of this threat as an ‘energy sector’ problem. Any industry that relies on industrial control systems is at risk. Any industry where networked devices cause physical change in the world is a target for these kinetic cyber attacks.”

Smart Cities Need Smart Vaccine against Cyber Attacks

A Smart Vaccine approach is needed to protect the Middle East's smart cities, says security expert Dr. Rocky Termanini. It applies, of course, to other regions, too.

Dr. Termanini is the auther of The Cognitive Early Warning Predictive System Using the Smart Vaccine, to be published by CRC Press in November 2015.

Manufacturers Losing Intellectual Property to Security Breaches

While this isn't new, spies have been stealing IP since there's been IP to steal, the techniques have changed. And while the PRC seems to be villain #1, our so-called allies, such as Israel and France, are just as active.

So, what's a person to do? You can start with Trade Secret Theft, Industrial Espionage, and the China Threat.

This book provides an overview of economic espionage as practiced by a range of nations from around the world—focusing on the mass scale in which information is being taken for China's growth and development. It supplies an understanding of how the economy of a nation can prosper or suffer, depending on whether that nation is protecting its intellectual property, or whether it is stealing such property for its own use. The text concludes by outlining specific measures that corporations and their employees can practice to protect information and assets, both at home and abroad.

Confidential report lists U.S. weapons system designs compromised by Chinese cyberspies

Surprise! PLA hackers have stolen weapons plans from the military.

Why does every system have to be Internet facing? I can see commerical enterprises wanting to save money but using public networks, but government and the military? For them, money is merely a way to keep score. It's not real.

Just as two can keep a secret if one of them is dead, if you want a secure system, segregate it; take it offline. While I'm pained to think of the lost information, it's even more painful to know that it could have been prevented.

China’s Hackers Shifting Focus

According to the Taipei Times, Taiwan's National Security Bureau (NSB) estimates that the PLA’s cyberarmy now numbers more than 100,000, has a budget of more than US$2.71 million and targets telecoms and think tanks. It also believes that the Chinese military has shifted the emphasis of cyberattacks on Taiwan from government institutions to civilian think tanks, telecommunications service providers, Internet node facilities and traffic signal control systems.

This doesn't seem to agree with US evaluations. PRC has long engaged in espionage with the other APT: humans. It's only recently, it seems, that attention has been directed to government, critical infrastructur, and military targets.

NATO cyberwar manual: Civilian hackers can be targets

Salon reports that the handbook is first attempt to codify how international law applies to state-sponsored online attacks.

Use kinetic force against cyber aggressors? Yes! Make the cost of playing too dear.

Huawei too dangerous to do business with?

Here's more on the supply chain security thing from John Dix, editor of Network World.

Last week, three US service providers came out in support of the Chinese companies. (Sorry, I can't find or recall the reference for this.)

In March, the GAO found that defense agencies claimed to have no supply chain security issues, and discovered that DOD had suspect components.

Is this just New Cold War posturing?

Chinese firms draw fire in House Intelligence report; Cisco cuts ties to China's ZTE after Iran probe

Well, of course the Chinese firms would call the charges "baseless."

Seems like the House Intelligence Committee did something right. Reuters reports  that the committee is recommending that Huawai and ZTE be barred from buying US companies because of fears that they could be used for cyber-espionage. Of course, depending on who wins the Presidential election next month, the committee's recommendation has a good chance of being ignored. I'm suprised we allow them to sell kit into the US, or at least the defense establishment. As I said before, cyber-espionage is still esponiage. Is it any easier done over networks than by coopting employees of target companies or government agencies? I'd be more concerned about cyberwarfare. And didn't India ban Chinese telecom firms from selling into the country because of security concerns? Frankly, I'd be as worried about French and Israeli providers.

10/9/12 -- According to Reuters, Cisco cuts ties to China's ZTE after Iran probe. Shall I rest my case now?

Chinese government to crack down on phishing schemes

It was a busy weekend, with new hacks of commerical and political sites.

A couple of recent items (here and here) highlight China's attempts to protect its citizens from the evils of phishing. Maybe they should dial back their espionage, IP theft, and cyberwar efforts instead. China's apparant ham-handed approach to everything is a wonder to observe. Why do something subtle when you can use a cudgel? Sitting on top of all that money, they really don't care what the world, or its citizens, thinks. If the money threat doesn't work, there's always the new carrier-killer missles.

Advanced Persistent Threats: Made in China

RSA released a report on advanced persistent threats. Basically, we're all screwed. This coincides with a story today about Operation Shady RAT, the infiltration of the networks of 72 organizations going back several years. The attacks are attributed to a state actor, China. China seems to be behind all espionage and cyberware attacks, not to mention threats hidden in firmware and other components. I wonder why they're not blamed for financial hacks, too, but that seems to be Russians and Eastern Europeans.