Cloud Hosting

This 95-page report is the first comprehensive offering from the long list of Senate and House committees that are investigating various matters related to the Capitol insurrection. It's by far one of the most thorough fact-finding efforts and was released Tuesday in a bipartisan fashion.

Two Senate committees on Tuesday released the most comprehensive government report on the security failures leading up to the US Capitol insurrection on January 6, revealing new details about unheeded warnings, critical miscommunications and intelligence shortcomings.

Congressional investigators pored through thousands of documents, received written statements from 50 police officers who defended the Capitol and received testimony from a wide array of current and former officials who played a role in the security preparations and response.

READ: Bipartisan Senate report investigating January 6 Capitol attack

Here are six takeaways from the report and its recommendations, which were released on a bipartisan basis by the Senate Rules Committee and the Senate Homeland Security Committee.

The report concluded that the US Capitol Polices main intelligence unit was aware of the potential for violence in the days and weeks ahead of January 6. Period. Full stop. They were warned.

But not everyone was aware. The inquiry determined that USCPs decentralized intelligence operation meant some people saw these warnings while other officials were left in the dark.

RELATED: Injured Capitol Police officer in emotional statement to court: You have stolen moments away from me that I cant get back

The Metropolitan Police Department in Washington, DC, told Capitol Police that hotel bookings roughly doubled in comparison to pro-Trump rallies in November and December, the Senate report said.

It was becoming clear to security officials and ordinary citizens alike that January 6 would be different. A private citizen emailed USCPs general mailbox on December 28 saying there were tweets from people organizing to storm the Capitol on January 6th, according to the report.

Still, USCP maintained its assessment that January 6 would likely resemble the minor pro-Trump rallies in November and December.

The report said, The USCP Chief has no unilateral authority to request assistance from the National Guard. This is a simple statement, but it explains a lot about the failures that day.

Then-Capitol Police Chief Steven Sund wanted to call in the troops for backup but needed to coordinate with other Hill security officials. When the officials tried to deal with the request, they were unfamiliar with the laws and regulations that needed to be followed, the inquiry found.

The red tape hindered the much-needed National Guard response, according to the report. And thats why one of the first recommendations from the Senate report is to empower the Capitol Police chief to have unilateral authority to request military support in emergency situations.

It seems like a no-brainer, but for this to happen, Congress will need to pass a new law.

The Senate inquiry uncovered some embarrassing failures within the civil disturbance unit of the Capitol Police, which is essentially the forces riot police or emergency response squad.

The Capitol Police activated seven of these special units in advance of January 6, but only four of those platoons were outfitted special protective equipment like helmets and shields, the report said. And when one of the platoons tried to get its equipment, it was on a locked bus.

The senators recommended that the special unit receive better training and more funding.

Plenty of Trump supporters posted plenty of violent threats and dangerous assertions on the internet in the run-up to January 6. The report said these were found on message boards, social media, memes, or hashtags. But intelligence officials struggled with how aggressively to police political speech, and how to differentiate the real threats from typical internet nonsense.

FBI and (Department of Homeland Security) officials stressed the difficulty in discerning constitutionally protected free speech versus actionable, credible threats of violence, the report said, noting that officials have said they need to make improvements and do better in the future.

Weve already heard from many of the brave police officers who risked their lives defending the Capitol, including some who were injured and others who engaged in hand-to-hand combat.

But the report fleshed this out, providing new accounts from the frontlines of the battle.

We did what we could against impossible odds and a volatile crowd which many times threatened us with phrases like Were gonna kill you!' one officer told the committees. I felt at this time a tangible fear that maybe I or some of my colleagues might not make it home alive.

Another officer described how they were called a Nazi. Black officers have spoken out about the racial abuse at the hands of the mob, including being called the N-word. In a previously unreported incident, one officer said they saw someone give a Nazi salute to the Capitol.

This 95-page report is the first comprehensive offering from the long list of Senate and House committees that are investigating various matters related to the Capitol insurrection. Its by far one of the most thorough fact-finding efforts and was released Tuesday in a bipartisan fashion.

But as comprehensive as it is, it only examined one piece of the bigger puzzle. It looked at the security, planning and response failures by law enforcement. But what about efforts by extremist groups to plan for violence in DC? What about former President Donald Trump and the Republican officials who fanned the flames? Congress isnt equipped to probe these issues.

Senate aides said investigators intentionally avoided the most politicized topics like Trumps culpability because they wanted to keep the probe bipartisan. Sources told CNN that to keep Republicans in the fold, the report avoided using the word insurrection to describe the attack.

Apparently, the Senate investigation was significantly watered down before it even started.

This is one the many reasons why so many Democrats, Republicans, former US officials, national security experts, and US Capitol Police officers agree that there should be an independent commission to investigate January 6. Not just to look at narrow questions but to examine the big picture extremism, disinformation, radicalization, incitement, and much more.

Senate Republicans blocked a bill to establish a commission, which now appears to be dead.

Read the original here:
Takeaways from the Senate report on January 6 security failures - WTOP

KrebsOnSecurity recently had occasion to contact the Russian Federal Security Service (FSB), the Russian equivalent of the U.S. Federal Bureau of Investigation (FBI). In the process of doing so, I encountered a small snag: The FSBs website said in order to communicate with them securely, I needed to download and install an encryption and virtual private networking (VPN) appliance that is flagged by at least 20 antivirus products as malware.

The FSB headquarters at Lubyanka Square, Moscow. Image: Wikipedia.

The reason I contacted the FSB one of the successor agencies to the Russian KGB ironically enough had to do with security concerns raised by an infamous Russian hacker about the FSBs own preferred method of being contacted.

KrebsOnSecurity was seeking comment from the FSB about a blog post published by Vladislav BadB Horohorin, a former international stolen credit card trafficker who served seven years in U.S. federal prison for his role in the theft of $9 million from RBS WorldPay in 2009. Horohorin, a citizen of Russia, Israel and Ukraine, is now back where he grew up in Ukraine, running a cybersecurity consulting business.

Horohorins BadB carding store, badb[.]biz, circa 2007. Image: Archive.org.

Visit the FSBs website and you might notice its web address starts with http:// instead of https://, meaning the site is not using an encryption certificate. In practical terms, any information shared between the visitor and the website is sent in plain text and will be visible to anyone who has access to that traffic.

This appears to be the case regardless of which Russian government site you visit. According to Russian search giant Yandex, the laws of the Russian Federation demand that encrypted connections be installed according to the Russian GOST cryptographic algorithm.

That means those who have a reason to send encrypted communications to a Russian government organization including ordinary things like making a payment for a government license or fine, or filing legal documents need to first install CryptoPro, a Windows-only application that loads the GOST encryption libraries on a users computer.

But if you want to talk directly to the FSB over an encrypted connection, you can just install their own client, which bundles the CryptoPro code. Visit the FSBs site and select the option to transfer meaningful information to operational units, and youll see a prompt to install a random number generation application that is needed before a specific contact form on the FSBs website will load properly.

Mind you, Im not suggesting anyone go do that: Horohorin pointed out that this random number generator was flagged by 20 different antivirus and security products as malicious.

Think well before contacting the FSB for any questions or dealing with them, and if you nevertheless decide to do this, it is better to use a virtual machine, Horohorin wrote. And a spacesuit. And, preferably, while in another country.

Antivirus product detections on the FSBs VPN software. Image: VirusTotal.

Its probably worth mentioning that the FSB is the same agency thats been sanctioned for malicious cyber activity by the U.S. government on multiple occasions over the past five years. According to the most recent sanctions by the U.S. Treasury Department, the FSB is known for recruiting criminal hackers from underground forums and offering them legal cover for their actions.

To bolster its malicious cyber operations, the FSB cultivates and co-opts criminal hackers, including the previously designated Evil Corp., enabling them to engage in disruptive ransomware attacks and phishing campaigns, reads a Treasury assessment from April 2021.

While Horohorin seems convinced the FSB is disseminating malware, it is not unusual for a large number of security tools used by VirusTotal or other similar malware sandbox services to incorrectly flag safe files as bad or suspicious an all-too-common condition known as a false positive.

Late last year I warned my followers on Twitter to put off installing updates for their Dell products until the company could explain why a bunch of its software drivers were being detected as malware by two dozen antivirus tools. Those all turned out to be false positives.

To really figure out what this FSB software was doing, I turned to Lance James, the founder of Unit221B, a New York City based cybersecurity firm. James said each download request generates a new executable program. That is because the uniqueness of the file itself is part of what makes the one-to-one encrypted connection possible.

Essentially it is like a temporary, one-time-use VPN, using a separate key for each download James said. The executable is the handshake with you to exchange keys, as it stores the key for that session in the exe. Its a terrible approach. But its what it is.

James said the FSBs program does not appear to be malware, at least in terms of the actions it takes on a users computer.

Theres no sign of actual trojan activity here except the fact it self deletes, James said. It uses GOST encryption, and [the antivirus products] may be thinking that those properties look like ransomware.

James says he suspects the antivirus false-positives were triggered by certain behaviors which could be construed as malware-like. The screenshot below from VirusTotal says some of the files contents align with detection rules made to find instances of ransomware.

Some of the malware detection rules triggered by the FSBs software. Source: VirusTotal.

Other detection rules tripped by this file include program routines that erase event logs from the users system a behavior often seen in malware that is trying to hide its tracks.

On a hunch that just including the GOST encryption routine in a test program might be enough to trigger false positives in VirusTotal, James wrote and compiled a short program in C++ that invoked the GOST cipher but otherwise had no networking components. He then uploaded the file for scanning at VirusTotal.

Even though James test program did nothing untoward or malicious, it was flagged by six antivirus engines as potentially hostile. Symantecs machine learning engine seemed particularly certain that James file might be bad, awarding it the threat name ML.Attribute.HighConfidence the same designation it assigned to the FSBs program.

KrebsOnSecurity installed the FSBs software on a test computer using a separate VPN, and straight away it connected to an Internet address currently assigned to the FSB (213.24.76.xxx).

The program prompted me to click on various parts of the screen to generate randomness for an encryption key, and when that was done it left a small window which explained in Russian that the connection was established and that I should visit a specific link on the FSBs site.

The FSBs random number generator in action.

Doing so opened up a page where I could leave a message for the FSB. I asked them if they had any response to their program being broadly flagged as malware.

The contact form that ultimately appeared after installing the FSBs software and clicking a specific link at fsb[.]ru.

After all the effort, Im disappointed to report that I have not yet received a reply. Nor did I hear back from S-Terra CSP, the company that makes the VPN software offered by the FSB.

James said that given their position, he could see why many antivirus products might think its malware.

Since they wont use our crypto and we wont use theirs, James said. Its a great explanation on political weirdness with crypto.

Still, James said, a number of things just dont make sense about the way the FSB has chosen to deploy its one-time VPN software.

The way they have set this up to suddenly trust a dynamically changing exe is still very concerning. Also, why would you send me a 256 random number generator seed in an exe when the computer has a perfectly valid and tested random number generator built in? Youre sending an exe to me with a key you decide over a non-secure environment. Why the fuck if youre a top intelligence agency would you do that?

Why indeed. I wonder how many people would share information about federal crimes with the FBI if the agency required everyone to install an executable file first to say nothing of one that looks a lot like ransomware to antivirus firms?

After doing this research, I learned the FSB recently launched a website that is only reachable via Tor, software that protects users anonymity by bouncing their traffic between different servers and encrypting the traffic at every step of the way. Unlike the FSBs clear web site, the agencys Tor site does not ask visitors to download some dodgy software before contacting them.

The application is running for a limited time to ensure your safety, the instructions for the FSBs random number generator assure, with just a gentle nudge of urgency. Do not forget to close the application when finished.

Yes, dont forget that. Also, do not forget to incinerate your computer when finished.

Excerpt from:
Adventures in Contacting the Russian FSB Krebs on Security - Krebs on Security

What is ransomware?

Ransomware is a type of malicious software AKA malware that infects and takes control of a device. It blocks access to files or even whole devices, and then sends a message demanding a ransom to grant access to those files.

This is a common form of cybercrime that has recently affected universities, hospitals and meatworks. Because it blocks vital data from being accessed, it can massively disrupt organisations that use the shared networks and/or the internet which is, well, everyone at this point.

Malware is infectious software that will download onto a computer, phone or other device. It can be shared though phishing emails, links in messages or other online locations, or fake download buttons. Sometimes it can be difficult to tell whether a link or button is malicious in the first place.

When the fake link is clicked, the malware automatically downloads and then hunts through the system or network to identify important data. The software can lock the device or files with a new password, or encrypt files with a secret key, preventing access.

This can be exacerbated because malware can be accompanied by social-engineering tools that trick you into granting admin access, or it can exploit security holes to dive into the important files and software on the computer without even needing to get permission.

There are many ways of encrypting files, but the point is to prevent user access with computer algorithms. Without an up-to-date backup, this data is essentially lost.

The user will then often see a ransom note in the form of a message demanding (usually) money to lift the password or encryption.

Of course, paying the ransom doesnt mean the cyber-criminal will actually lift the encryption, and if you have paid up once, there is incentive for the criminal to do it again.

Credit: cyber.gov.au

The real kicker here is that the infectious software can gain access to a whole network of connected devices, even if it has been downloaded on just one computer which means businesses that have shared data can be completely prevented for accessing anything, including saved files, emails and user profiles.

There is no simple explanation of how the programming works it is complex software engineering that can be continuously updated, and there are different examples that can be spread and downloaded in ways the suit the attacker.

Because malware can pop up in almost anywhere, it is often hard to identify.

A lot of ransomware is designed to look like something real, such as a casual email attachment, something shared via social media, or a website that looks almost like a real website you wanted to visit, but has a few different letters in the URL.

in one sneaky approach, the attacker can even pretend to be somebody from law enforcement who is stopping another cybercrime that they accuse you of, and then demand a fine from you but there are easier ways to get access to a device.

The main thing to remember is that a lot of phishing can be prevented by not clicking suspicious links. Just a little life hack on how not to get hacked.

via GIPHY

More seriously, this in an increasingly big business between ransoms paid, loss of data and downtime, costs of recovery, and other security and investigations, ransomware attacks cost the world $5 billion in 2017.

Cybercriminals are often individuals or work in teams or networks, but there are also crimeware-as-a-service groups that essentially operate as a business.

Technology develops so quickly that defenders and attackers can get stuck in an arms race, so cybersecurity and trained professionals are absolutely essential to an online world, especially as we begin to incorporate more AI and machine learning into our manufacturing. Once ransomware is in a network, its extremely hard to remove.

First and foremost, keep backups. If all your files get encrypted but you have another offline backup, its simple to restore your data.

Always keep your malware security up to date. Attackers obviously try to get around this security, but it is a whole lot better than having none at all. Many companies test their systems with white hat hackers, who attempt to hack their systems to recognise and fix the security flaws.

Teaching people to recognise phishing emails and be cautious about suspicious sites and links is also necessary, but it can only go so far, because phishing material is constantly being improved to blend in better. Dont click on links or open attachments if you dont know the sender of the email. A lot of these emails suggest you need to make a payment, have breached some sort of contract, or pretend to have blocked access to an account.

Because ransomware secretly searches your device, there can be a delay between when a link is clicked and when files are encrypted. There is a rise in predictive analytics and machine learning to help detect this suspicious behaviour and shut it down early.

And finally, if you do get attacked, dont pay up, because its likely to make you seem like an easy target in the future.

We asked Diep Ngyuen, Senior Lecturer in the Faculty of Engineering and Information Technology at UTS, for a little more depth. This is what they said

Cyber attacks target either to bring down networks/systems (make them malfunction) or to compromise the information access authority or integrity.

Although the former is often closer and easier to understand to most people, the latter is more popular and the major target of most daily life cyber attacks.

For example, DoS (Denial-of-Service) attacks can make a network or service inaccessible for some time, disrupting corporates functioning or business. These types of attacks can be easily detected.

However, cybercrimes often target high-value information and attempt to illegally access it or even alter the information.

The information authority or integrity attacks are more difficult to be detected but their consequences can be very damaging, even much worse than the DoS attacks.

To prevent or reduce risks from cyber attacks, IT core engineers/experts and daily users can take different approaches. However, these approaches all aim to early detect cyber threats, then effectively protect or cure the systems when the attacks really happen.

One of the most common precautions [is] to avoid using services/websites, apps, hardware from non-certified or low-reputation sources/providers. These systems often have back doors or vulnerable loopholes that can be leveraged by cybercrimes.

The second precaution would be to update and follow security recommendations from governments and experts, e.g., using multi-factor authentication methods, not to share or be cautious on sharing personal/private information like Date of Birth, photos, [etc] on open platforms (even social media).

The last, but not least, is to become more aware of cyber threats/risks before deciding to take any action (e.g., do you understand the risk of using Apple pay or using activity trackers?).

Cyber security landscape has been changing dramatically over the last 10 years. This is because of the penetration of IT to every corner of our daily life, from working, entertaining, to sleeping.

This is also because of the ever-growing advances in attacks and their countermeasures. In comparison with 10 years ago, the number of connecting devices today has been increased by multiple times.On average, each person now would have more than a few connecting devices (e.g., phones, activity trackers, laptops, sensors at home).

These devices, [while they] bring us lots of conveniences, are making us more vulnerable to cyber threats when they are attacked or compromised. More importantly, most of these newly added devices (e.g., in Internet of Things) are limited in computing and storage capability or referred to as low-end devices in cyber security. They are more susceptible to cyber threats.

The advances in machine learning and AI also empower cybercrimes, allowing them to launch larger scale and more damaging attacks.

In the past, talking about cyber security/attacks is something of defense. Now, it is the responsibility of every single citizen with implications on our daily life.

View original post here:
What is ransomware and how is it dealt with? - Cosmos Magazine