Russian Hackers Spying on NATO: Business as Usual

Following the news of the new Russian 'Sandworm' hack that is exploiting a bug in Microsoft Windows to spy on NATO, EU, Ukraine and others, Tim Erlin, director of IT security and risk strategy for  Tripwire explains why this is no surprise:

"It's a short path from shoe phones to zero days. It's simply not surprising that this kind of activity has been going on. Russia, the United States, Britain and others have long histories of very strong and effective spy organizations. There should be little surprise that these groups have continued their missions through the boom of technology.

"Defending against such a targeted attack is extremely difficult. When the attacker is willing to spend significant resources to compromise you specifically, the playing field can be very uneven. As an industry, we tend to focus on the many broad threats that exist, but these kinds of targeted and sophisticated campaigns may actually do more damage."

Conflict and Cooperation in Cyberspace: The Challenge to National Security, edited by Panayotis Yannakogeorgos and Adam Lowther of the Air Force Research Institute, brings together some of the world’s most distinguished military leaders, scholars, cyber operators, and policymakers in a discussion of current and future challenges that cyberspace poses to the United States and the world. Maintaining a focus on policy-relevant solutions, it offers a well-reasoned study of how to prepare for war, while attempting to keep the peace in the cyberspace domain.

Hong Kong university warns students and staff about US hackers

The India Times reports that following the Snowden leaks, the Chinese University in Hong Kong warned students and staff about basic computer security to ward off an onslaught of US hackers. Is this calling the pot calling the kettle black, or another skirmish in the  new Cold War?

Confidential report lists U.S. weapons system designs compromised by Chinese cyberspies

Surprise! PLA hackers have stolen weapons plans from the military.

Why does every system have to be Internet facing? I can see commerical enterprises wanting to save money but using public networks, but government and the military? For them, money is merely a way to keep score. It's not real.

Just as two can keep a secret if one of them is dead, if you want a secure system, segregate it; take it offline. While I'm pained to think of the lost information, it's even more painful to know that it could have been prevented.

China’s Hackers Shifting Focus

According to the Taipei Times, Taiwan's National Security Bureau (NSB) estimates that the PLA’s cyberarmy now numbers more than 100,000, has a budget of more than US$2.71 million and targets telecoms and think tanks. It also believes that the Chinese military has shifted the emphasis of cyberattacks on Taiwan from government institutions to civilian think tanks, telecommunications service providers, Internet node facilities and traffic signal control systems.

This doesn't seem to agree with US evaluations. PRC has long engaged in espionage with the other APT: humans. It's only recently, it seems, that attention has been directed to government, critical infrastructur, and military targets.

Chinese government to crack down on phishing schemes

It was a busy weekend, with new hacks of commerical and political sites.

A couple of recent items (here and here) highlight China's attempts to protect its citizens from the evils of phishing. Maybe they should dial back their espionage, IP theft, and cyberwar efforts instead. China's apparant ham-handed approach to everything is a wonder to observe. Why do something subtle when you can use a cudgel? Sitting on top of all that money, they really don't care what the world, or its citizens, thinks. If the money threat doesn't work, there's always the new carrier-killer missles.

Computer Virus Hits U.S. Drone Fleet

Here's a good one. It seems these systems at one air base are not connected to the Internet. The suspect virus, which is proving hard to eradicate, was introduced by UBS drive or something similar. Accident? Sloppiness? Cyberwar?

China: Agency Reports 500,000 Cyberattacks in 2010

is this a tit-for-tat? Is China making a clumsy effort to detract from it's own actions? Over the past years, I've heard some scary-smart guys talk about which security threats worry them most, and it's always China. Whether it's cyber espionage and warfare or malware burned into firmware, China is always at the top of the list. As long is China remains the low cost provider, the firmware threat will increase. But it is worrisome to think about all the computers, including those in sensitive areas, that have Chinese components always calling home. At least the US government is preventing Chinese companies from buying US high-tech manufacturers and service providers. Eventually, though, the Chinese will spread enough money around Congress to make this happen, too. This makes Russian cybercrime look pretty tame.