Cloud Hosting

23 June 2023

Image source, Crowdstrike

Cyber security firm Crowdstrike illustrates the biggest hacker threats with cartoons

A cyber-attack that took over iPhones at a Russian technology company is being blamed on US government hackers. Could the attack, and the response from the Russian government, be rewriting the narrative of who the good guys and bad guys are in cyber-space?

Camaro Dragon, Fancy Bear, Static Kitten and Stardust Chollima - these aren't the latest Marvel film superheroes but the names given to some of the most feared hacking groups in the world.

For years, these elite cyber teams have been tracked from hack to hack, stealing secrets and causing disruption allegedly under orders from their governments.

And cyber-security companies have even created cartoon images of them.

Camaro Dragon - Checkpoint's latest illustration for an alleged Chinese group hacking European foreign affairs workers

With dots on a world map, marketeers at these companies regularly warn customers about where these "advanced persistent threats" (APTs) are coming from - usually Russia, China, North Korea and Iran.

But parts of the map remain conspicuously empty.

So why is it so rare to hear about Western hacking teams and cyber-attacks?

A major hack in Russia, unearthed earlier this month, might provide some clues.

Defenders under attack

From his desk overlooking the Moscow Canal, the cyber-security worker watched as strange pings began to register on the company wi-fi network.

Dozens of staff mobile phones were simultaneously sending information to strange parts of the internet.

But this was no ordinary company.

Kaspersky HQ, in Moscow

This was Russia's biggest cyber company Kaspersky, investigating a potential attack on its own employees.

"Obviously our minds turned straight to spyware but we were pretty sceptical at first," chief security researcher Igor Kuznetsov says.

"Everyone's heard about powerful cyber tools which can turn mobile phones into spying devices but I thought of this as a kind of urban legend that happens to someone else, somewhere else."

After painstaking analysis of "several dozen" infected iPhones, Igor realised their hunch had been right - they had indeed unearthed a large sophisticated surveillance-hacking campaign against their own staff.

The type of attack they had found is the stuff of nightmares for cyber defenders.

The hackers had invented a way to infect iPhones simply by sending an iMessage that automatically deletes itself once the malicious software is injected into the device.

"Wham, you're infected - and you don't even see it," Igor says.

'Reconnaissance operation'

The victims' entire phone contents were now being pinged back to the attackers at regular intervals. Messages, emails and pictures were shared - even access to cameras and microphones.

Keeping to Kaspersky's long-standing rule of not pointing fingers, Igor says they are not interested in from where this digital espionage attack was launched.

"Bytes don't have nationalities - and anytime a cyber-attack is blamed on a certain country, then it's done with an agenda," he says.

But the Russian government is less concerned about that.

On the same day Kaspersky announced its discovery, Russian security services put out an urgent bulletin saying they had "uncovered a reconnaissance operation by American intelligence services carried out using Apple mobile devices".

The Russian cyber-intelligence service made no mention of Kaspersky but claimed "several thousand telephone sets" belonging to both Russians and foreign diplomats had been infected.

The bulletin even accused Apple of actively helping in the hacking campaign. Apple denies it was involved.

The alleged culprit - the United States National Security Agency (NSA) - told BBC News it had no comment.

Igor insists Kaspersky did not coordinate with the Russian security services and the government's bulletin took them by surprise.

The NSA has elite hackers working for the US

Some in the cyber-security world will be surprised by this - the Russian government had appeared to be issuing a joint announcement with Kaspersky, for maximum impact, the kind of tactic increasingly used by Western countries to expose hacking campaigns and loudly point fingers.

And this announcement was swiftly and predictably followed by a chorus of agreement from America's allies in cyber-space - the UK, Australia, Canada and New Zealand - known as the Five Eyes.

China's response was a rapid denial saying the story was all part of a "collective disinformation campaign" from the Five Eyes countries.

Chinese Foreign Ministry official Mao Ning added China's regular response: "The fact is the United States is the empire of hacking."

'Targeting China'

But now, like Russia, China seems to be adopting a more aggressive approach to calling out Western hacking.

And that warning came with a statistic from Chinese company 360 Security Technology - it had discovered "51 hacker organisations targeting China".

The company did not respond to requests for comment.

Last September, China also accused the US of hacking a government-funded university responsible for aeronautics and space research programmes.

'Fair play'

"China and Russia have slowly figured out the Western model for cyber exposure is incredibly effective and I think we are seeing a shift," Rubrik Zero Labs head and former cyber intelligence worker Steve Stone says.

"I'll also say I think that's a good thing. I have zero issue with other countries revealing what Western countries are doing. I think it's fair play and I think it's appropriate."

Many brush off the Chinese charge of the US being the empire of hacking as hyperbole - but there is some truth in it.

According to the International Institute for Strategic Studies (IISS), the US is the only tier-one cyber power in the world, based on attack, defence and influence.

The paper's lead researcher, Julia Voo, has also noticed a shift.

"Espionage is routine for governments and now it's so often in the form of cyber-attacks - but there's a battle of narrative going on and governments are asking who is behaving responsibly and irresponsibly in cyber-space," she says.

And compiling a list of APT hacking groups and pretending there are no Western ones is not a truthful depiction of reality, she says.

UK hackers operate from Government Communications Headquarters (GCHQ), in Cheltenham

"Reading the same reports about hacking attacks from only one side adds to a general ignorance," Ms Voo says.

"A general education of the public is important, because this is basically where a lot of tensions between states are going to be playing out in the future."

"It's not super-detailed but more than other countries," she says.

'Data bias'

But the lack of transparency could also stem from cyber-security companies themselves.

Mr Stone calls it a "data bias" - Western cyber-security companies fail to see western hacks, because they have no customers in rival countries.

But there could also be a conscious decision to put less effort into some investigations.

"I don't doubt that there's likely some companies that may pull the punch and hide what they may know about a Western attack," Mr Stone says.

But he has never been part of a team that deliberately held back.

Image source, Crowdstrike

Static Kitten is the name given to an Iranian government-sponsored hacking group

Lucrative contracts from governments such as the UK or US are a major revenue stream for many cyber-security companies too.

As one Middle Eastern cyber-security researcher says: "The cyber-security intelligence sector is heavily represented by Western vendors and greatly influenced by their customers' interests and needs."

The expert, who asked to remain anonymous, is one of more than a dozen volunteers regularly contributing to the APT Google Sheet - a free-to-view online spreadsheet tracking all known instances of threat-actor activities, irrespective of their origins.

It has a tab for "Nato" APTs, with monikers such as Longhorn, Snowglobe and Gossip Girl, but the expert admits it is pretty empty compared with tabs for other regions and countries.

'Less noise'

He says another reason for the lack of information on Western cyber-attacks could be because they are often stealthier and cause less collateral damage.

"Western nations tend to conduct their cyber operations in a more precise and strategic manner, contrasting with the more aggressive and broad attacks associated with nations like Iran and Russia," the expert says.

"As a result, Western cyber operations often yield less noise."

The other aspect to a lack of reporting could be trust.

It is easy to brush off Russian or Chinese hacking allegations because they often lack evidence.

But Western governments, when they loudly and regularly point the finger, rarely, if ever, provide any evidence either.

Continue reading here:
Why is it so rare to hear about Western cyber-attacks? - BBC

Read More..

Without prior Congressional review or a legislative amendment, the DOJs selective enforcement of a key Federal statute neither provides risk mitigation to the industry facing billions of dollars of losses nor deters industrial espionage and cyber theft, which are rampant.

Recent policy announcements by the U.S. Department of Justice (DOJ) regarding the selective prosecution under the Computer Fraud and Abuse Act of 1986 (CFAA) has had the unintended consequence of alerting cyber criminals that the DOJ cannot walk and chew gum at the same time.

The CFAA, a landmark 1986 legislation, prohibits accessing a computer without authorization or in excess of authorization. Enacted in the aftermath of press coverage of high-profile criminal hacking incidents, heightened national security threats from rogue foreign actors, and a finding that traditional theft and trespass statutes were ill-suited to address cybercrimes, the CFAA imposed criminal penalties, including fines and imprisonment, granting the FBI and the Justice Department the authority to investigate and prosecute. The CFAA further provides private civil causes of action for individuals or entities harmed by the perpetrators unauthorized access.

Since then, the CFAA has been amended by Congress multiple times, including via the USA Patriot Act, and each time the law expanded its definition of criminalized computer acts and broadened its jurisdiction to include any internet-enabled electronic device, including computers and cell phones, due to the interstate nature of most Internet communication.

The CFAA prohibitions broadly apply to hacking for malicious purposes (i.e., breaking in with stolen passwords to steal data or encrypted files), to insider threats where employees who have authorized access to a certain portion of their employers computer gain unauthorized access to other portions of the same computer, and to former employees who gain access to their work computers after access is revoked upon termination of employment.

TheU.S.SupremeCourtinVanBurenv. UnitedStates, 14 S.Ct 1648 (2021) ended the decades long split in federal circuit courts rulings on the definition of unauthorized access and access in excess of authorization with a finding that the burden of authorized access or access in excess of authorization rests on the employer to restrict access and establish security protocols to regulate access; an employee exercising permissible access does not lose access if the purpose of that access is not as intended by the employer. However, the enforceability of unauthorized access or access in excess of authorization is strengthened by the Supreme Court decision where access had been definitively terminated or restricted by the employer.

Contrary to the extensive statutory guidelines and case law precedents, the DOJ has recently announced that the Department will not charge defendants in certain types of exceeds authorization cases based on the theory that a defendants authorization to access a particular file, database, folder, or user account was conditioned by a contract, agreement, or policy, with the narrow exception of contracts, agreements, or policies that entirely prohibit defendants from accessing particular files, databases, folders or user accounts on a computer in all circumstances. The DOJ further states that defendants will not be charged where authorization to access a computer, or a particular area on a computer, was automatically withdrawn under the terms of a contract or other written document once the user did something, or some other particular condition was met.

The DOJs prosecutorial discretion, exercised in this policy directive, appears to be overbroad and vague. Without prior Congressional review or a legislative amendment, the DOJs selective enforcement of a key Federal statute neither provides risk mitigation to the industry facing billions of dollars of losses nor deters industrial espionage and cyber theft, which are rampant. Twin cases, one in the real estate industry (CREXi) and a second in the entertainment industry (Ticketmaster), conspicuously illustrate the DOJs unequal application of the CAs mandate despite their similarity in fact pattern.

In both cases, the fact pattern conforms to the type of without authorization cases that the DOJ has specifically identified for prosecution in its policy directive: Unlike the exceeds authorization cases, which the DOJ has directed it will only prosecute for the narrow exception of contracts, agreements, or policies that entirely prohibit defendants from accessing particular files, databases, folders, or user accounts on a computer in all circumstances, the DOJ has provided no such limiting guidance for without authorization cases. Inexplicably, the DOJ chose to bring criminal charges in one case (Ticketmaster), while the other case (CREXi) has languished in court for three years.

CoStarGroupetal.v.CommercialReal EstateExchange,Inc. is a civil case pending in the Central District Court of California Court in Los Angeles for alleged theft of intellectual property for the purpose of developing a competing business. The complaint alleges that defendant Commercial Real Estate Exchange, Inc. (CREXi} employees accessed CoStars subscription database without permission; CREXis former account executives hacked into CoStars password protected database by using passwords issued to CoStar customers, and then downloaded CoStars broker directories to build a clone directory on CREXi, using the stolen data to generate customer leads. The complaint specifies that at least one of theCREXi executives involved, the head of its New York office, used credentials to which he had never had any entitlement. According to the complaint, two of the other executives used a former employers credentials after they left to work for CREXi.

In a second case with a similar fact pattern, which was before the Eastern District of New York, in Brooklyn, the DOJ intervened with criminal charges against the defendant, Ticketmaster, because its employees repeatedly - and illegally accessed a competitors computers without authorization using stolen passwords to unlawfully collect business intelligence. Ticketmaster agreed to pay a criminal penalty of $10 million in exchange for deferred prosecution and a compliance and ethics program designed to prevent and detect violations of the Computer Fraud and Abuse Act and other applicable laws, and to prevent the unauthorized and unlawful acquisition of confidential information belonging to its competitors.

According to William Sweeney, FBI Assistant Director-in-Charge assigned to the Ticketmaster case; When employees walk out of one company and into another, its illegal for them to take proprietary information with them. Ticketmaster used stolen information to gain an advantage over its competition, and then promoted the employees who broke the law. This investigation is a perfect example of why these laws exist to protect consumers from being cheated in what should be a fair marketplace. Should the same standard not apply to the CoStarcase?

EvenundertheDOJsnewandundulyrestrictivepolicy,the alleged accesstoCoStarsdatabase by theheadof CREXisNewYork office was reportedly never authorizedunder any circumstances. Indeed, even the two CREXi executives who purportedly used credentials issued to their former employers pose a problem, as said credentials would have been revoked upon their separation from the company. And, arguably, even that point need not be reached as no authorization existed for any CREXi employee in the first place.

In any event, given the lack of prosecution for this seemingly plain lack of authorization for CREXIs New York office heads database access, it is clear that the DOJs new unduly restrictive approach to exceeds authorization cases is having a chilling effect on prosecutions of the other type cases where no authorization existed at all. In short, the pernicious impact of the DOJs new policy regarding selective prosecutions under the Computer Fraud and Abuse Act of 1986 (CFAA) appears to be stymieing even those prosecutions that on their face fall outside its overly narrow restrictions.

In mid-May, the DOJ announced criminal charges including export violations, smuggling, and theft of trade secrets, in connection with the Disruptive Technology Strike Force, which it co-leads with the Department of Commerce, to counterefforts by hostile nation-states such as Russia and China to illicitly acquiring sensitive U.S. technology. Once again, the DOJs prosecutorial discretion, exercised in this policy directive involving rogue foreign actors, appears to be overbroad and vague, and with an unequal application of CFAA mandates in cases with a similar fact pattern.

The DOJ, in two of the five criminal cases, charged former software engineers for stealing software and hardware source code from U.S. tech companies to sell to China. In the Central District of California, a senior software engineer wasarrested and charged with theft of trade secrets for allegedly stealing source code used in meteorology software, used insmart automotive manufacturing equipment, which the defendant then allegedly marketed to multiple Chinesecompanies. In the Northern District of California, a citizen of the Peoples Republic of China (PRC) and former Apple engineer is charged with allegedly stealing thousands of documents containing the source code for software and hardware.

In the CREXi case, which similarly involves theft of an American companys intellectual property and trade secrets by offshore agents in India, the DOJ has failed to consider intervening with criminal charges against the defendant, CREXi. According to the CoStar complaint, CREXi not only has substantial financial backing from venture capital firms, including Industry Ventures, Jackson Square Ventures, Freestyle Capital, and TenOneTen Ventures, but the company has also used its Indian vendors to steal CoStars intellectual property. Three of its vendor companies are facing court proceedings in India.

Duringa timeof escalating cybersecurity threats,both domesticand foreign, theDOJsfailure to fullyenforce the mandates of theCFAA as intended byCongress anddecided bycase law precedent weakens thelaws broad legal protections against industrial espionage and cyber theft of intellectualproperty and trade secrets.

Image Source: Deposit PhotosImage ID: 68350515Author: stevanovicigor

View original post here:
DOJ Falters on Prosecution of Cybercrimes Due to Unequal ... - IPWatchdog.com

Read More..

A new AI-driven system has created convincing fake victims in the form of multi-lingual chatbots who waste the time of scam callers, in a quest to put a dent in the estimated $55 billion people lose each year to thieves.

Keep talking: the new platform uses voice clones to keep scammers on the line in fake conversations with AI chatbots.

Named Apate, after the Greek goddess of deception, the system will scam the scammers, using convincing voice clones to conduct conversations with real scammers.

Phone scams are run by organised crime groups and currently only a tiny fraction of the criminals are caught, and the money is rarely recovered, says Professor Dali Kaafar, Executive Director of Macquarie Universitys Cyber Security Hub.

The idea came to Professor Kaafar while having lunch with his family, when a scammer called. He put on an entertaining pretence, keeping his kids laughing - and keeping the scammer on the line for 40 minutes.

I realised that, while I had wasted the scammers time so they couldnt get to vulnerable people, which was the point - that was also 40 minutes of my own life I wouldnt get back, Professor Dali says.

Then I started thinking about how we could automate the whole process, and use Natural Language Processing to develop a computerised chatbot that could have a believeable conversation with the scammer, he says.

Professor Kaafar says his team now has patents pending for this highly-effective technology.

We are excited about the potential for this new technology to actively break the scam-calling business model and make it unprofitable, he says.

The hugely lucrative global phone scam trade is growing each year, and the ACCC estimates Australians lost over 3.1 billion to scammers in 2022.

Professor Kaafar says despite telecommunications providers blocking well over half a billion scam calls since 2020, Australians are still flooded with these calls and the tiny fraction that get through can wreak havoc on victims.

Phone scams are on the rise globally for a few reasons, he says.

Disruptors: Cyber security innovators Michal Kepkowski, Ian Wood, Nardine Basta and Professor Dali Kaafar have developed new voice technology bots designed to stop scammers stealing money from victims all over the world.

Technology like voice-over-internet protocol (VOIP) makes it easy and cheap for cyber-criminals to mask their location, pretending to call from any number.

Meanwhile on the technology front, it is hard and expensive to update the telecommunications infrastructure and protocols to improve authentication of the calls.

Financially, it's a high-gain, low-cost ratio for scammers, the practice is very lucrative and a relatively low-risk criminal activity - and it's pretty hard for victims to recover this money.

Partnering with communications providers will be the key to making this new technology really effective.

These conditions attract growing numbers of scammers who specialise in playing on human emotions and fears.

"The business model of scammers relies on making a large profit from a small number of victims; only a small percentage of the thousands of calls they make each week are successful, says Professor Kaafar.

Our model ties them up, wastes their time and reduces the number of successful scams, he says. We can disrupt their business model and make it much harder for them to make money."

The team from the Macquarie University Cyber Security Hub began by analysing scam phone calls and pinpointing the social engineering techniques scammers use on their victims, using machine learning techniques and natural language processing to identify typical scam scripts'.

They then trained chatbots on a dataset of real-world scam conversations from recordings of scam calls to transcripts of scam emails, and chat logs from social media platforms so the bot can generate its own conversations resembling those of real-world scam calls.

Professor Kaafar says advances in Natural Language Processing (NLP) and AI human voice cloning have allowed them to develop AI agents that are capable of fluent speech, and can adopt a particular persona and stay on track in a conversation, being convincingly consistent in their responses.

The conversational AI bots we have developed can fool scammers into thinking they are talking to viable scam victims, so they spend time attempting to scam the bots, Professor Kaafar says.

These bots can be trained in any language or accent and because phone scams are a global challenge, this technology can be deployed anywhere in the world.

The team is now trialling the chat bots on live scam calls, redirecting calls intended for victims to their testing prototype, an always-on honeypot with a wide range of personas.

Keep talking: Professor Dali Kaafar, pictured, and the cyber security team hope their new scam-fighting bots will keep scammers on the line for up to 40 minutes and also help identify the latest phone scams so banks can warn customers.

Weve put these dirty numbers all around the internet, getting them into some spam apps, or publishing them on webpages and so on, to make them more likely to receive scam calls," Professor Kaafar says.

We found the bots react pretty nicely to some tricky situations that we were not expecting to get away with, with scammers asking for information that we didnt train the bots for but the bots are adapting, and coming up with very believeable responses.

"The bots are continually learning how to drag the calls out to meet their primary objective: keeping scammers on the line longer. "

The current deployment of Apate bots are already averaging five minutes, and the aim is to get them to 40 minutes.

The scam-fighting bots also contribute to threat intelligence timely information that is gathered about current phone scams and their targets; this helps organisations such as major banks, retailers and government bodies warn customers.

Professor Kaafar says the team is in conversation with a number of telecommunications providers and says they are open to a number of commercial partnerships.

Partnering with communications providers will be the key to making this really effective, Professor Kaafar says.

We see this as having huge potential globally; if we can redirect many of those spam calls that providers are currently blocking, and send the scammers to Apate bots, tying up their time as much as we can, the whole industry will no longer be viable.

"I suggest the ultimate meta-scenario might see scammers adopting AI themselves, training their own scam chatbots which are then diverted into speaking to chatbots owned by the telecommunications providers.

If scam chatbots end up talking to scam-defending chatbots instead of stealing money from real people Id take that as a big win!

Apate is partially funded by the National Intelligence Office under theNational Intelligence and Security Discovery Research Grants program.

Professor Dali Kaafar is theExecutive Director of Macquarie Universitys Cyber Security Hub in the Faculty of Science and Engineering, Macquarie University.

See original here:
Scamming the scammers: New AI fake victims to disrupt criminal ... - Macquarie University

Read More..