radiofree.asia

Category: Cyber attacks

  • Cook Islands govt fends off cyberattacks, passes bill to strengthen financial transparency

    Significant attempts were made from overseas to hack into the government’s central network a few weeks ago, Prime Minister Mark Brown has revealed.

    However, the Prime Minister said that the government’s robust firewall security systems were able to fend off these attempts.

    Brown revealed this while speaking in support of the Financial Transactions Reporting Amendment Bill 2024, which was passed in Parliament last week.

    The hacking attempts from overseas had, however, affected a couple of local companies in the hospitality industry in which their systems were compromised, he said.

    “We were able to provide support to reduce any damage caused by these cyber security threats,” Brown said.

    The Financial Transactions Reporting Amendment Bill’s primary purpose is to implement the recommended actions put forth by the Global Forum on Transparency and the Exchange of Information for Tax Purposes.

    This Forum conducts peer reviews and assessments across over 130 jurisdictions in which Cook Islands is a member of. The aim of these reviews is to evaluate the country’s ability to cooperate effectively with established standards, Brown explained.

    ‘Increasing collaboration’
    “The financial transactions reporting requirements that our country have signed up to is an example of the increasing collaboration among international jurisdictions to share information. Additionally, the need to protect the integrity of our financial centres and enhance our cybersecurity measures will only intensify as the world increasingly moves toward digital currencies.

    “Our initial peer reviews took place in 2017, and the Cook Islands received a very positive rating for its capacity to exchange information.

    “In light of the subsequent growth and improvements in both the quality and quantity of information exchanges, as well as enhancements to the standards themselves, a second round of assessment was initiated just last year. This latest round includes a legal framework assessment and peer reviews that also cover technical, operational, and information security aspects.”

    Brown said that during this process several gaps in the legal framework were identified, and the Global Forum provided recommendations aimed at helping the country maintain a positive rating.

    He said Cook Islands is required to address these recommendations by implementing the necessary legislative amendments by the 31st of this month in order to qualify for another round of onsite assessments and reviews in 2025.

    The Prime Minister said the security of information is very important, and the security of tax information, in particular, is of significant importance to the Global Forum.

    He added that some of the areas identified for improvement extend beyond legislative requirements.

    Security codes
    “For example, all doors in the RMD (Revenue Management Division) office that hold tax information must have security codes. The staff that work there must have proper identification cards with ID cards to swipe and allow access to these rooms,” Brown said.

    “It is a big change from how our public service has operated for many years and maybe we do not see the actual need for this level of security. However, the Global Forum has its standards to maintain and we are obligated to maintain those standards, so we must follow suit.

    “Not only that but now there’s also a requirement for proper due diligence to be conducted on employees or people who will work inside these departments. It is these sorts of requirements that compels us in our government agencies, many of them now to change the way we do things and to be mindful of increased security measures that are being imposed on our country. ”

    Justice Minister Vaine “Mac” Mokoroa, who presented the Bill to Parliament, said: “The key concern here is to ensure that the Cook Islands continues to be a leader in the trust industry . . .  our International Trust Act has been at the forefront of the Cook Islands Offshore Financial Services Industry since its enactment 40 years ago, establishing the Cook Islands as a leader in wealth protection and preservation.”

    “At that time, these laws were seen as innovative and ground-breaking, and their success is evident in the growth and development of the sector, as well as in the number of jurisdictions that have copied them, either in whole or in part.”

    Mokoroa said that the Cook Islands Trust Companies Association, which comprises seven Trustee Companies licensed under the Trustee Companies Act, along with the Financial Supervisory Commission, conducted a thorough review of the International Trust Act and recommended necessary changes. These changes were reflected in the Financial Transactions Reporting Amendment Bill.

    Republished from the Cook Islands News with permission.

    This post was originally published on Asia Pacific Report.

  • The Daily Blog hacked – NZ’s most important left media outlet silenced for a day

    Pacific Media Watch

    The Daily Blog, New Zealand’s most important leftwing website of news, views and analyses at the heart of the country’s most conservative mediascape in years, has been hacked.

    It was silenced yesterday for several hours but is back up and running today.

    The Daily Blog editor and founder Martyn Bradbury launched the website in 2013 with the primary objective of “widening political debate” in the lead up to the 2014 New Zealand election.

    Since then, the website has united more than “42 of the country’s leading leftwing commentators and progressive opinion shapers to provide the other side of the story on today’s news, media and political agendas”.

    It has 400,000 pageviews a month.

    “These moments are always a mix of infuriation and terror”, admitted Bradbury in an editorial today about the revived website and he raised several suspected nations for “cyber attack trends” such as “China, Israel and Russia”.

    Bradbury, nicknamed “Bomber” by a former Craccum editor at Victoria University of Wellington, was once branded by the NZ Listener magazine as the “most opinionated man in New Zealand”

    The website includes columns by such outspoken writers and critics as law professor Jane Kelsey, Green Party co-leader Marama Davidson, Palestinian human rights advocate and quality education critic John Minto, political scientist Dr Wayne Hope, social justice academic and former leftwing politician Sue Bradford, and political analyst Morgan Godfery.

    It also hosts the popular live podcasts by The Working Group, which tonight features pre-budget “Economists of the Apocalypse Special” by Bradbury, with Matthew Hooton, Damien Grant and Brad Olson at 7.30pm on its revived website.

    ‘Sophisticated and tricky’
    Explaining why The Daily Blog was displaying a “maintenance page” for most of the day, Bradbury said in his editorial:

    The hack was very sophisticated and very tricky.

    Thank you to everyone who reached out, these moments are always a mix of infuriation and terror.

    We can’t point the finger at who did it, but we can see trends.

    Whenever we criticise China, we get cyber attacks.

    Every time we criticise Israel, we get cyber attacks.

    Every time we criticise Russia, we get cyber attacks.

    Every time we post out how racist NZ is, we get stupid cyber attacks.

    Every time we have a go at New Zealand First’s weird Qanon antivaxx culture war bullshit we get really dumb cyber attacks.

    Every time we criticise woke overreach we get cancelled.

    This hack on us yesterday was a lot more sophisticated and I would be surprised if it didn’t originate offshore.

    We have a new page design up and running in the interim, there will be updates made to it for the rest of week as we iron out all the damage caused and tweak it for TDB readers.

    You never know how important critical media voices are until you lose them!

    Bradbury added that “obviously this all costs an arm and a leg being offline” and appealed to community donors to deposit into The Daily Blog’s bank account 12-3065-0133561-56.

    The Daily Blog can be contacted here.

    This post was originally published on Asia Pacific Report.

  • By the Dawn’s Early Light

    The Baltimore bridge that collapsed on March 26th was named for Francis Scott Key, who wrote the lyrics to the American national anthem “The Star-Spangled Banner” in 1814. His inspiration was the British bombardment of Fort McHenry in the critical port of Baltimore during the War of 1812. The British had just burned the U.S. Capitol and the White House and had set their sights on the Baltimore port, with the guns from hundreds of British ships trained on shelling the American flag. If the flag were taken down, they would know the Americans had surrendered, and the British agreed the shelling would stop. But in the dawn’s early light, the flag still waved, held up by patriots who replaced soldiers who had fallen before them. Francis Scott Key observed all this from a British ship on which he had been allowed on board to negotiate a prisoner release. It is a quite moving story, dramatized here.

    What the dawn’s early light brought on March 26, 2024, by contrast, were shocking news videos of the Francis Scott Key Bridge collapsing when the Singapore-owned cargo ship Dali slammed into it. It was “like something out of an action movie,” said Baltimore Mayor Brandon Scott. Several commentators are calling it a “black swan” event that will have catastrophic effects on global supply chains. Interestingly, the War of 1812 was also about disruptions to U.S. trade with foreign nations, in that case by blockade by the British navy. But more on that, and on how our forebears turned dependence on foreign manufacturers into economic independence, after a look at what went amiss with the Dali and the bridge.

    An Unusual Stroke of Bad Luck

    Before it fell, the Key Bridge was a pivotal artery for traffic, cargo and supplies across the country. The Interstate 695 running across the bridge connects to I-95, one of the country’s busiest and most important supply chain highways, running from the northern to the southern end of the Eastern seaboard. Shipping is expected to resume to full capacity by the end of May, but  rebuilding the bridge to appropriate standards could take five to seven years. That means this strategic artery will no longer be accessible for transporting hazardous materials, which Maryland law forbids to be transported by tunnel (including unleaded fuel, diesel, propane gas, and nitrogen chemicals for fertilizer), along with oversized cargo that cannot fit through roadway tunnels in the area (including tractors and military vehicles).

    Observers contend there is still no plausible explanation for the direct hit to the bridge’s most critical support. The power went out on the ship about three minutes before the strike, yet multiple layers of security for maintaining steering control are mandated by U.S. and international regulation. Even without power, the Dali should have continued in the direction it was headed; but instead it veered to the right, for a direct hit into the key pylon supporting the bridge.

    Engineering Professor Emerita W. M. Kim Roddis, a registered professional engineer with experience in bridge design, acknowledged in an interview in a March 28 article on GW Today that it was a “one in a million” occurrence. As reported in the George Washington University publication, she was asked how a 1.6-mile-long bridge that carried 31,000 cars per day could suffer such a complete collapse. She responded:

    The container ship Dali lost power multiple times on its way out of Baltimore Harbor. The ship’s inability to steer resulted in it heading at an angle towards the southwestern major bridge pier—the pylon.

    The navigation chart for Baltimore Harbor shows four protective devices called dolphins, one in front of each pier for outgoing and incoming ships. … They essentially serve as bumpers to deflect or slow boats and ships that are headed toward the pylon.

    The [Dali’s] angled course allowed the ship to miss the dolphin and strike the pylon. When the ship collided with the pylon it exerted a huge crushing force on the pier, bursting the pylon apart. This pylon was the only support for the bridge on that side. … The continuity of the structure meant that all three spans came down when the southwestern pylon was lost. …

    The angle the ship came in at was unusual. So, yes, this was an unlikely accident. …  [O]ne-​in-​a-​million is in the right ballpark.

    What About a Cyberattack?

    The FBI issued a statement the morning of the Dali crash saying there was no evidence of a terrorist attack, but insurers and reinsurers will no doubt be investigating, since insurance contracts now typically exclude damage from terrorist attacks. Insurance claims are expected to be high and to spill over into the global reinsurance market. (An interesting bit of trivia is that Dali’s insurer, a company named Britannia, is owned by a company called Wadia Group. Founded in 1726, it built the ship from which Francis Scott Key saw the flag waving over Fort McHenry in 1814.)

    The cyberattack possibility is confirmed in an April 5 article in Security Magazine titled “Protecting Ships from Cyber Terrorism”. The author observes:

    The investigation into Baltimore’s Francis Scott Key Bridge collapse has only just begun, but we’ve already seen news reports containing an unclassified memo from the Cybersecurity and Infrastructure Security Agency (CISA) and comments from the Department of Homeland Security concerning the cause. … At this time, there is no evidence that the incident was anything more than a tragic accident, but the involvement of these U.S. government agencies indicates concerns of a cyberattack.

    Those concerns are highly warranted. For some time, maritime cybersecurity has been top of mind for regional, national and global policymakers. …

    There are plenty of onboard systems to attack. Hackers are known to intercept satellite communications used extensively by ships at sea. They can also spoof or jam GPS systems, manipulate the automatic ID system (AIS), steal vital data, or inject malware or ransomware into any number of onboard systems via infected devices files. Such attacks can throw a ship off course. When combined with a compromised propulsion system, the consequences can be horrific.

    The cyberattack possibility is also confirmed in an article in The Security Ledger titled “Container Ships Easy to Hack, Track, Send Off Course and Even Sink, Security Experts Say”. In fact, training is now offered at the Norwegian University of Science and Technology to prepare for cyberattacks. An article in Norwegian SciTech News titled “What Do You Do If a Hacker Takes Over Your Ship?” begins with this chilling scene involving the hijacking of a ship’s steering:

    You’re on the bridge, with the ship’s course shown on the digital display. But why is the ship continuing to turn west?

    Everything looks normal on the computer screens in the dark wheelhouse — but outside, the land is dangerously close. What’s going on?

    Down in the engine room, workers report via radio that everything is normal, but they wonder why the bridge has changed course. The engines are revving and the ship is picking up speed. The engine room hasn’t done this. What now?

    In July 2020, World Economic Forum head Klaus Schwab warned of “the frightening scenario of a comprehensive cyberattack which would bring a complete halt to the power supply,” such that Covid 19 “would be seen as a small disturbance in comparison ….” And at the WEF annual conference in Davos, Switzerland, in January 2023, WEF managing director Jeremy Jurgens said during a presentation highlighting the WEF Global Security Outlook Report that 93 percent of cyber leaders believed that the current geopolitical instability makes a catastrophic cyber event likely before 2025.

    Time to Repair and Rebuild

    Hopefully the Key Bridge strike was an accident, as most news outlets contend. But whether it was or not, we have serious weaknesses in critical infrastructure that need to be addressed. Bridges such as the Key Bridge are classified as “fracture critical” by the federal government – meaning that if one component of the bridge’s primary structural frame fails, all or most of the span will collapse. There are more than 16,800 such bridges in the U.S., according to the Federal Highway Administration. According to the American Society of Civil Engineers (ASCE) and the federal government, 46,000 U.S. bridges have aging structures and are in “poor” condition. The Dali was 984 feet long—nearly twice the length of the ships used when the bridge was built during the 1970s. To minimize the potential of ships bringing down bridges, say experts, they need to be fortified with dolphins and other structures to protect around their danger points.

    And that is just for the bridges. We also have a deficient electrical grid, aging dams and power facilities, and much more that are vulnerable to attack or structural disintegration. In the last of its “report cards,” which come out every four years, the ASCE estimated in 2021 that total U.S. infrastructure needs were approximately $5.937 trillion. Of that sum, $3.35 trillion was funded, leaving a wide funding gap of more than $2.5 trillion. Where will this money come from? The federal government is $34.6 trillion in debt, and the Government Accounting Office is recommending cutting rather than expanding the budget. We need a work-around that avoids tapping federal coffers.

    The “American System” of Money and Credit

    That brings us back to the War of 1812 and the financial challenges successfully overcome by our forefathers. At the end of the American Revolution, the colonies-turned-states were $44 million in debt, a sum that at the time seemed impossible to repay. But Alexander Hamilton, the first U.S. Treasury Secretary, turned the debt to advantage by using it to capitalize the First U.S. Bank. Debt securities were traded for shares in the bank, paying a 6% dividend. The bank then issued the first U.S. currency, leveraging its capital into credit on the fractional reserve system.

    But the Bank was controversial, and in 1811 its charter was allowed to expire – right before the War of 1812. Then as now, a major issue was disruption to foreign trade. As recounted on the Federal Reserve’s website:

    In the years leading up to the War of 1812, the U.S. economy had been on the upswing. The war with Britain, however, disrupted foreign trade. As one of the United States’ largest trading partners, Britain used its navy to blockade U.S. trade with other nations. The war prevented U.S. farmers and manufacturers from exporting merchandise, blocked U.S. merchants and fishermen from sailing the high seas, and curtailed federal government revenues, which were derived mainly from tariffs on trade. By 1815, the United States found itself heavily in debt, much like it had been at the end of the Revolutionary War thirty years earlier.

    In April 1816, Pres. James Madison finally signed an act establishing the second Bank of the United States. The tale is continued in a 2018 article titled “America’s Stunning Growth Under the Second National Bank”:

    John Quincy Adams’ March 4, 1825 inauguration was the start of one of the most intense periods of economic progress in history. Canals and roads were pushed through, opening up the West to settlement, funneling new-​mined coal to shops and cities, and creating entirely new Midwestern centers of industry. The iron industry, under tariff protection, was reborn after a century of imperial suppression. Railroads began military-​designed construction and grew quickly from nothing to thousands of miles. Financing and planning of these enterprises was coordinated by Federal, military, state, and local authorities. The Bank of the United States drove the program forward with credit regulation that throttled down parasitical speculation and directed public and private investment funds into infrastructure and industry. Researchers affiliated with the Bank-​military-​government leadership team did pioneering work with engines and electricity that led to spectacular advances later on.

    Achievements included the Erie Canal and other canal networks connecting mining with manufacturing centers and Atlantic ports before the railroad era. In later years, the Bank of the United States sponsored creation of the Reading Railroad. The American coal-​mining industry began as a direct result of these projects.

    What Sen. Henry Clay and Lincoln’s economic adviser Henry Carey called the “American System” of government-issued money and credit was used again by Lincoln’s government to win the Civil War and to fund substantial post-war development, including completion of the Transcontinental Railroad linking both ends of the country.

    That system was also used by Franklin Roosevelt’s government under Secretary of Commerce Jesse Jones to get the country through the Great Depression and World War Two. At a time when U.S. banks were bankrupt, critical infrastructure was funded without tapping the federal budget by repurposing and greatly expanding the Reconstruction Finance Corporation (RFC) established earlier by Pres. Hoover to save the banks. Beginning with a modest $500 million in capitalization, it lent or invested over $40 billion from 1932 to 1957. It rebuilt the depressed economy, funded the New Deal and America’s participation in World War II, and returned a net profit to the government.

    A Modern U.S. National Infrastructure Bank on the “American System” Model

    HR 4052, a proposal for a $5 trillion National Infrastructure Bank, is currently before Congress and has widespread support, with 31 co-sponsors. The proposed bank is designed to be a true depository bank, which can leverage its funds as all banks are allowed to do: with a 10% capital requirement, it can leverage $1 in capital into $10 in loans. For capitalization, the bill proposes to follow the lead of Hamilton’s First U.S. Bank: existing U.S. bonds will be swapped for non-voting bank shares paying a dividend. For liquidity to back the loans, the bank will use incoming deposits or will issue bonds. Included in the many projects the bill covers is electrical grid security, a major need not just for ships and bridges but for infrastructure across the country. For more on this proposal, see the website of the NIB Coalition.

    Our forebears fought the American Revolution, the War of 1812, the Civil War and two World Wars to preserve our freedom and independence, the U.S. Constitution and Bill of Rights. They kept the flag waving in our darkest hours. A Hamiltonian-style national infrastructure bank is one promising tool for preserving that vision today.

    The post By the Dawn’s Early Light first appeared on Dissident Voice.

    This post was originally published on Dissident Voice.

  • How to Interpret Washington’s New Version of “Hacker Script”

    Bloated hype beyond all reason. Illustration: Liu Rui/GT
    Illustration: Liu Rui/GT

    The director of the Federal Bureau of Investigation (FBI), Christopher Wray, made sensational remarks on Wednesday in Congress, elevating the “China threat theory” to a new level. He claimed that hackers associated with the Chinese government are “positioning on American infrastructure in preparation to wreak havoc and cause real-world harm to American citizens and communities.” Targets include water treatment plants, electrical infrastructure and oil and natural gas pipelines, he said. In response, Chinese Foreign Ministry Spokesperson Wang Wenbin explicitly stated that China firmly opposes and cracks down on all forms of cyberattacks in accordance with law. Without valid evident, the US jumped to an unwarranted conclusion and made groundless accusations against China. It is extremely irresponsible and is a complete distortion of facts.

    On the same day, the US government added more than a dozen Chinese companies to a list created by the Defense Department to highlight firms it says are allegedly working with China’s military. US Secretary of Commerce, Gina Raimondo, exaggerated the potential national security risks posed by Chinese electric vehicles entering European market in talks with EU officials. From public opinion manipulation to actual actions, the US’ measures containing China were both intensive and frequent in recent days. The US once again unleashed a cold wind, at a time when communication and exchanges between high-level officials of China and the US have rapidly resumed since the beginning of 2024, and signs of stabilization in China-US relations have increased.

    This has become an increasingly common phenomenon in China-US relations, reflecting the high complexity and uncertainty of US policy toward China and the depth of distortions in the US understanding of China. However, we also notice that Jake Sullivan, the national security advisor to the US president, in his latest remarks on China-US relations on January 30, while emphasizing the need for the US to strengthen its “competitive position,” also highlighted the importance of building stability, managing differences, and stressed the significance of maintaining communication and intensive diplomacy.

    Taking a comprehensive view, US policy toward China is increasingly resembling a tightrope walk, with the key technique lying in maintaining balance. The US government is currently managing this with difficulty, and the challenge of maintaining balance is rapidly intensifying. The US clearly recognizes the serious consequences if balance cannot be upheld, but without timely adjustments, it is only a matter of time before it falls off the tightrope.

    This year is the US presidential election year, and negative topics concerning China will be further magnified and intensified. However, aside from the election factors, people can see at a glance that the two ends of the “balance pole” between the US and China are gradually shifting, with the rational end toward China becoming shorter and the irrational end toward China becoming longer. One major manifestation is the continuous innovation and upgrading of the “China threat theory,” which has contaminated the decision-making atmosphere and environment toward China, resulting in an increasingly imbalanced US policy toward China, even to the extent of losing control. This poses a significant risk for the US, the Asia-Pacific region, and the world.

    Why do American officials and politicians like Christopher Wray work so hard to create and spread the “China threat theory”? The reasons are multifaceted. For example, the most common occasions are often in the US Congress, both because Congress has become a gathering place for anti-China politicians and because Congress controls the purse strings. Using the “China threat” as a gimmick is the best way to secure funding. Additionally, some individuals project their inner world onto China. There are also those who have developed a delusion about China, where anything related to the word “China” becomes a “terrifying monster” that must be guarded against. This is a result of extreme lack of confidence, anxiety, and even delusion in the face of China’s rapid development.

    Also on January 31, the Senate Judiciary Committee hosted a hearing titled “Big Tech and the Online Child Sexual Exploitation Crisis.” The chief executives of five major social media giants, including TikTok CEO Shou Zi Chew attended to testify. Although the meeting had a predetermined theme and many attendees, Chew once again became the focus. Many senators bypassed the main topic and questioned Chew about his relationship with China. Republican Senator Tom Cotton even aggressively questioned Chew’s citizenship with eight questions. It is well known that Chew is from Singapore. Even netizens on X platform couldn’t stand it and condemned Cotton for his “xenophobia” and “blatant racism.” Isn’t this a microcosm of Washington politicians?

    It is evident that the US authorities have the intention to use anti-China rhetoric and need a strategic imaginary enemy or scapegoat in Washington politics. However, this is feeding a monster with malice and hostility toward China. The monster is growing day by day, with an increasing appetite and becoming more cunning. In the past, stories about “Chinese hackers” could satisfy it for a while, but now the story has to be escalated to the level of threatening all Americans. When this monster breaks free, its first target will be the US itself.

    The post How to Interpret Washington’s New Version of “Hacker Script” first appeared on Dissident Voice.

    This post was originally published on Dissident Voice.

  • Highly secretive Five Eyes alliance disrupts China-backed hacker group

    ANALYSIS: By Dennis B. Desmond, University of the Sunshine Coast

    This week the Five Eyes alliance — an intelligence alliance between Australia, the United Kingdom, Canada, New Zealand and the United States — announced its investigation into a China-backed threat targeting US infrastructure.

    Using stealth techniques, the attacker — referred to as “Volt Typhoon” — exploited existing resources in compromised networks in a technique called “living off the land”.

    Microsoft made a concurrent announcement, stating the attackers’ targeting of Guam was telling of China’s plans to potentially disrupt critical communications infrastructure between the US and Asia region in the future.

    This comes hot on the heels of news in April of a North Korean supply chain attack on Asia-Pacific telecommunications provider 3CX. In this case, hackers gained access to an employee’s computer using a compromised desktop app for Windows and a compromised signed software installation package.

    The Volt Typhoon announcement has led to a rare admission by the US National Security Agency that Australia and other Five Eyes partners are engaged in a targeted search and detection scheme to uncover China’s clandestine cyber operations.

    Such public admissions from the Five Eyes alliance are few and far between. Behind the curtain, however, this network is persistently engaged in trying to take down foreign adversaries. And it’s no easy feat.

    Let’s take a look at the events leading up to Volt Typhoon — and more broadly at how this secretive transnational alliance operates.

    Uncovering Volt Typhoon
    Volt Typhoon is an “advanced persistent threat group” that has been active since at least mid-2021. It’s believed to be sponsored by the Chinese government and is targeting critical infrastructure organisations in the US.

    The group has focused much of its efforts on Guam. Located in the Western Pacific, this US island territory is home to a significant and growing US military presence, including the air force, a contingent of the marines, and the US navy’s nuclear-capable submarines.

    It’s likely the Volt Typhoon attackers intended to gain access to networks connected to US critical infrastructure to disrupt communications, command and control systems, and maintain a persistent presence on the networks.

    The latter tactic would allow China to influence operations during a potential conflict in the South China Sea.

    Australia wasn’t directly impacted by Volt Typhoon, according to official statements. Nevertheless, it would be a primary target for similar operations in the event of conflict.

    As for how Volt Typhoon was caught, this hasn’t been disclosed. But Microsoft documents highlight previous observations of the threat actor attempting to dump credentials and stolen data from the victim organisation. It’s likely this led to the discovery of compromised networks and devices.

    Living-off-the-land
    The hackers initially gained access to networks through internet-facing Fortinet FortiGuard devices, such as routers. Once inside, they employed a technique called “living-off-the-land”.

    This is when attackers rely on using the resources already contained within the exploited system, rather than bringing in external tools. For example, they will typically use applications such as PowerShell (a Microsoft management programme) and Windows Management Instrumentation to access data and network functions.

    By using internal resources, attackers can bypass safeguards that alert organisations to unauthorised access to their networks. Since no malicious software is used, they appear as a legitimate user.

    As such, living-off-the-land allows for lateral movement within the network, and provides opportunity for a persistent, long-term attack.

    The simultaneous announcements from the Five Eyes partners points to the seriousness of the Volt Typhoon compromise. It will likely serve as a warning to other nations in the Asia-Pacific region.

    Who are the Five Eyes?
    Formed in 1955, the Five Eyes alliance is an intelligence-sharing partnership comprising Australia, Canada, New Zealand, the UK and the US.

    The alliance was formed after World War II to counter the potential influence of the Soviet Union. It has a specific focus on signals intelligence. This involves intercepting and analysing signals such as radio, satellite and internet communications.

    The members share information and access to their respective signals intelligence agencies, and collaborate to collect and analyse vast amounts of global communications data. A Five Eyes operation might also include intelligence provided by non-member nations and the private sector.

    Recently, the member countries expressed concern about China’s de facto military control over the South China Sea, its suppression of democracy in Hong Kong, and threatening moves towards Taiwan.

    The latest public announcement of China’s cyber operations no doubt serves as a warning that Western nations are paying strict attention to their critical infrastructure — and can respond to China’s digital aggression.

    In 2019, Australia was targeted by Chinese state-backed threat actors gaining unauthorised access to Parliament House’s computer network. Indeed, there is evidence that China is engaged in a concerted effort to target Australia’s public and private networks.

    The Five Eyes alliance may well be one of the only deterrents we have against long-term, persistent attacks against our critical infrastructure.

    The Conversation
    Dennis B. Desmond is a lecturer, Cyberintelligence and Cybercrime Investigations, University of the Sunshine Coast. This article is republished from The Conversation under a Creative Commons licence. Read the original article.

    This post was originally published on Asia Pacific Report.

  • Cyber attack on NZ sea level website blamed on anti-climate critics or ‘the Russians’

    By John Lewis of the Otago Daily Times

    Aotearoa New Zealand’s new NZ SeaRise website, designed to show how the country’s coastline will be affected by rising sea levels and land subsidence, has been hit by a cyber attack.

    Project co-leader and Victoria University of Wellington earth sciences Professor Tim Naish said the website went live this morning at 5am, and since then it had been getting 10,000 hits per second which had ”just killed” the website.

    ”We’re trying to get it back up and running,” he said.

    ”The guess is that these are anti-climate change people or the Russians — who knows.

    ”We don’t know for sure, but we think they’re using an autobot. They’re coming from an overseas IP address.

    ”It’s just hitting us with thousands of hits and our website can’t cope.”

    It was frustrating because local government mayors were being asked to comment on the website, but were unable to because it was inaccessible at the moment, he said.

    Frustrating for residents
    It was also frustrating for residents interested in what was going to happen on their own land.

    The NZ SeaRise website shows location-specific sea level rise projections to the year 2300, for every 2km of the coast of New Zealand.

    Climate change and warming temperatures are causing sea levels to rise by 3.5mm a year on average, but until now, the levels did not take into account local vertical land movements.

    Professor Naish said continuous small and large seismic events were adding up to cause subsidence in many parts of New Zealand, and the new projections showed the annual rate of sea level rise could double.

    Project co-leader and GNS Science associate professor Richard Levy said the team had connected vertical land movement data with climate-driven sea level rise to provide locally-relevant sea level projections.

    “Property owners, councils, infrastructure providers and others need to know how sea level will change in the coming decades so that they can consider how risks associated with flooding, erosion and rising groundwater will shift,” he said.

    ”We have estimated future sea levels for 7434 sites around our coastline. The largest increases in sea level will occur along the southeast North Island along the Wairarapa coast.

    Land subsidence rates are high
    ”Here, land subsidence rates are high and sea level could rise by well over 1.5m by 2100 if we follow the least optimistic climate change scenario.

    ”In contrast, land is rising near Pikowai, in the Bay of Plenty, and uplift rates may keep pace with climate change-driven sea level rise, causing a small fall in sea level if we follow the most optimistic climate scenario.”

    Dunedin and Invercargill were not likely to be any closer to inundation by the sea than had already been predicted, because ground movement in the South was ”quite stable”, he said.

    Based on present international emissions reduction policies, global sea levels were expected to have risen about 0.6m by 2100, but for large parts of New Zealand that would double to about 1.2m because of ongoing land subsidence.

    ”We know that global sea-level rise of 25cm-30cm by 2060 is baked in and unavoidable regardless of our future emissions pathway, but what may be a real surprise to people is that for many of our most populated regions, such as Auckland and Wellington, this unavoidable rise is happening faster than we thought.”

    Vertical land movements mean sea level changes might happen 20-30 years sooner than previously expected.

    For many parts of New Zealand’s coast, 30cm of sea-level rise is a threshold for extreme flooding, above which the 100-year coastal storm becomes an annual event.

    Climate change adaptation options
    Joint Otago Regional and Dunedin City Councils’ South Dunedin Future group programme manager Jonathan Rowe welcomed the new information and said it would feed into many aspects of the councils’ work, particularly that relating to the South Dunedin programme which was considering climate change adaptation options.

    ORC operations general manager Gavin Palmer said the information would also feed into flood protection planning to mitigate the impacts of sea level rise in other parts of coastal Otago, such as the Clutha Delta and the Taieri Plain.

    Rowe said for South Dunedin, the new data confirmed previous guidance, that further sea level rise of 24cm-35cm was predicted by 2050-60, and up to 112cm by 2100, depending on global emissions.

    A climate change adaptation plan would be presented to both councils in June, he said.

    Climate Change Minister James Shaw said the findings were “sobering” and the government’s first plan to cut emissions in every part of New Zealand, would be published later this month.

    This article is republished under a community partnership agreement with RNZ. It was first published on the Otago Daily Times website.

    This post was originally published on Asia Pacific Report.

  • Universities must act to prevent espionage and foreign interference, but national laws still threaten academic freedom

    ANALYSIS: By Sarah Kendall, The University of Queensland

    This week, the Parliamentary Joint Committee on Intelligence and Security released its much anticipated report on national security threats affecting the higher education and research sector.

    The 171-page report found the sector is a target for foreign powers using “the full set of tools” against Australia, which can undermine our sovereignty and threaten academic freedom.

    It made 27 recommendations to “harden the operating environment to deny adversaries the ability to engage in the national security risks in the sector”.

    The committee’s recommendations, when correctly implemented, will go a long way towards combating the threat of espionage and foreign interference. But they are not enough to protect academic freedom.

    This is because the laws that make espionage and foreign interference a crime could capture legitimate research endeavours.

    National security risks to higher education and research
    The joint committee found there are several national security threats to the higher education and research sector. Most significant are foreign interference against students and staff, espionage and data theft.

    This includes theft via talent recruitment programmes where Australian academics working on sensitive technologies are recruited to work at foreign institutions.

    These threats have been occurring through cyber attacks and human means, including actors working in Australia covertly on behalf of a foreign government.

    Foreign adversaries may target information on research that can be commercialised or used for national gain purposes.

    The kind of information targeted is not limited to military or defence, but includes valuable technologies or information in any domain such as as agriculture, medicine, energy and manufacturing.

    What did the committee recommend?
    The committee stated that “awareness, acknowledgement and genuine proactive measures” are the next steps academic institutions must take to degrade the corrosive effects of these national security risks.

    Of its 27 recommendations, the committee made four “headline” recommendations. These include:

    1. A university-wide campaign of active transparency about the national security risks (overseen by the University Foreign Interference Taskforce)
    2. adherence to the taskforce guidelines by universities. These include having frameworks for managing national security risks and implementing a cybersecurity strategy
    3. introducing training on national security issues for staff and students
    4. guidance for universities on how to implement penalties for foreign interference activities on campus.

    Other recommendations include creation of a mechanism to allow students to anonymously report instances of foreign interference on campus and diversification of the international student population.

    What about academic freedom?
    Espionage makes it a crime to deal with information on behalf of, or to communicate to, a foreign principal (such as a foreign government or a person acting on their behalf). The person may also need to intend to prejudice, or be reckless in prejudicing, Australia’s national security.

    In the context of the espionage and foreign interference offences, “national security” means defence of Australia.

    It also means Australia’s international relations with other countries. “Prejudice” means something more than mere embarrassment.

    So, an academic might intend to prejudice Australia’s national security where they engage in a research project that results in criticism of Australian military or intelligence policies or practices; or catalogues Australian government misconduct in its dealings with other countries.

    Because “foreign principals” are part of the larger global audience, publication of these research results could be an espionage offence.

    The academic may even have committed an offence when teaching students about this research in class (because Australia has a large proportion of international students, some of whom may be acting on behalf of foreign actors), communicating with colleagues working overseas (because foreign public universities could be “foreign principals”), or simply engaging in preliminary research (because it is an offence to do things to prepare for espionage).

    Research
    Even communicating about research with overseas colleagues could fall foul of espionage and foreign interference laws. Image: The Conversation/Shutterstock

    Foreign interference makes it a crime to engage in covert or deceptive conduct on behalf of a foreign principal where the person intends to (or is reckless as to whether they will) influence a political or governmental process, or prejudice Australia’s national security.

    The covert or deceptive nature of the conduct could be in relation to any part of the person’s conduct.

    So, an academic working for a foreign public university (a “foreign principal”, even if the country is one of our allies) may inadvertently commit the crime of foreign interference where they run a research project that involves anonymous survey responses to collect information to advocate for Australian electoral law reform.

    The anonymous nature of the survey may be sufficient for the academic’s conduct to be “covert”.

    Because it is a crime to prepare for foreign interference, the academic may also have committed an offence by simply taking any steps towards publication of the research results (including preliminary research or writing a first draft).

    The kind of research criminalised by the espionage and foreign interference offences may be important public interest research. It may also produce knowledge and ideas that are necessary for the exchange of information which underpins our liberal democracy.

    Criminalising this conduct risks undermining academic freedom and eroding core democratic principles.

    So, how can we protect academic freedom?
    In addition to implementing the recommendations in the report, we must reform our national security crimes to protect academic freedom in Australia. While the committee acknowledged the adequacy of these crimes to mitigate the national security threats against the research sector, it did not consider the overreach of these laws.

    Legitimate research endeavours could be better protected if a “national interest” defence to a charge of espionage or foreign interference were introduced. This would be similar to “public interest” defences and protect conduct done in the national interest.

    “National interest” should be flexible enough so various liberal democratic values — including academic freedom, press freedom, government accountability, and protection of human rights — can be considered alongside national security.

    In the absence of a federal bill of rights, such a defence would go a long way towards ensuring legitimate research is protected and academic freedom in Australia is upheld.The Conversation

    Sarah Kendall is a PhD candidate in law, The University of Queensland. This article is republished from The Conversation under a Creative Commons licence. Read the original article.

    This post was originally published on Asia Pacific Report.

  • Hackers hit PNG financial hub, fail in bid to hold state officials to ransom

    By Gorethy Kenneth in Port Moresby

    The Papua New Guinea government’s financial hub was hit by computer hackers last week, holding state officials at ransom, reports have revealed.

    The ransomware attack on the Department of Finance’s Integrated Financial Management System (IFMS) happened last Thursday, locking out government workers who use the system to run the country’s entire financial system.

    The Acting Treasurer, Finance Minister Sir John Pundari, confirmed the hacking but told the PNG Post-Courier that the system had been restored and no ransom was paid.

    Sir John said workers were using a temporary accounting system after the IFMS was hit last week but did not reveal the real extent of the damage, saying only that the hackers did not steal anything.

    However, they had damaged a system that now puts PNG’s national security at risk.

    This is the first time the country’s central financial hub has been hit to such an extent.

    Ransomware is a collection of malicious software variants, including viruses, designed by hackers to cause extensive damage or gain unauthorised access to computer networks.

    ‘Cyber-attack on core server’
    “The Government Financial System suffered a cyber-attack in the form of ransomware infiltrating our core server at 1am on Friday, 22 of October 2021,” Sir John said.

    “As a result of the ransomware infiltration, the Department of Finance’s IT network was compromised. The department immediately took precautionary steps by closing down the network systems.

    “The department has now managed to fully restore the system, however, because of the risk we are playing it safe by not allowing full usage of the affected network.

    “While we progress cleaning up the server environment, we have put in temporary measures.

    “These include all government departments and agencies having access to commit and process cheques using a controlled environment in Vulupindi Haus.

    “All provinces and districts will also have access to commit funds, through a controlled temporary arrangement.

    ‘Full restored’
    “The department is conscious of the security and integrity of its data, thus, restoration of services to all government agencies, including at the sub-national level will be done gradually, bearing in mind the security of individual networks, so as not to compromise or allow any further spread of this malware or other viruses.

    “At this stage I wish to state clearly that the government financial system has been fully restored.

    “Department of Finance did not pay any ransom to the hacker or any of its third party agents. We have managed to restore normalcy.

    “The government and the people of Papua New Guinea can be assured that the government’s financial services will continue as usual.”

    Gorethy Kenneth is a senior PNG Post-Courier journalist. Republished with permission.

    This post was originally published on Asia Pacific Report.

  • Covid-19 crisis a pretext for West Papua online, offline repression, says Tapol

    Asia Pacific Report newsdesk

    The Indonesian government has used the covid-19 pandemic as a pretext to crack down on West Papuan street protests and to impose online censorship, according to new research published by the human rights watchdog TAPOL.

    Covid-19 protocols have given more power to the police and military to crush protests but they are not fairly implemented across Indonesia in general.

    Peaceful demonstrators, student activists, West Papuan and Indonesian political activist groups, human rights lawyers and defenders and individual civilians experienced extreme repression during 2020 in West Papua and outside West Papua.

    The West Papua 2020 Report
    The West Papua 2020 Report. Image: Tapol screenshot APR

    The findings are in a new study, the West Papua 2020: Freedom Of Expression And Freedom Of Assembly Report, in which TAPOL has collated and analysed incidents recorded by West Papuan and Indonesian civil society organisations.

    The report includes specific recommendations for the Indonesian government and the international community.

    “Online and offline repression in 2020 left almost no space in which West Papuans, or West Papua-related issues, or protest in general, could be freely conducted,” said Pelagio Doutel of TAPOL.

    Doutel called on the Indonesian government to desist from using its own covid-19 protocols to stop free expression, especially treason charges which were in almost all cases “disproportionate” to alleged offences.

    Call to uphold human rights
    He also called on international groups to ensure that the Indonesian government fulfilled its legal obligations by upholding human rights and not arbitrarily criminalising West Papuans.

    The report details repression, consisting of arbitrary dispersals, arbitrary arrests, terror and intimidation, internet shutdowns or cyber attacks against those speaking out in support of West Papua’s self-determination and against the Indonesian government’s treatment of West Papuans.

    The Indonesian police and military were responsible for most of the repression but some actions were carried out by Indonesian right-wing reactionary militias, academic institutions and civilian administrative authorities.

    Regions such as West Papua have seen increasing numbers of the security forces deployed on the streets.

    Security forces arrested as many as 443 people. Of this number, 297 were arrested in West Papua, with 146 people arrested outside West Papua.

    The authorities charged 18 people with treason, all of whom were West Papuans.

    Various arbitrary dispersals took place during protests about West Papua, with dozens of intimidation and harassment incidents taking place before and during protest dispersals.

    Intimidation and harassment
    Intimidation and harassment also took place online.

    Many West Papua-related public discussions that were held online were attacked by unknown individuals with the intention of disrupting them, and event speakers received intimidating phone calls and threatening messages.

    Protests in West Papua continued in 2020 due to ongoing issues of political prisoners, arrested during 2019, and the renewal of the special autonomy law (otsus, otonomi khusus) in West Papua.

    Protests against the Omnibus Law were also held in Indonesia in general, including in West Papua.

    Trials of several high profile Papuan political prisoners from the 2019 West Papua Uprising took place at the beginning of 2020.

    As a result, many street protests and public discussions were held to support and demand the release of political prisoners.

    This post was originally published on Asia Pacific Report.

  • NZ cyber agency chief worried China hacks exploiting security weakness

    RNZ News

    New Zealand’s cyber security agency believes China has been behind numerous hack attacks spanning years.

    The government joined Western allies and Japan in calling out Beijing for so-called state-sponsored hacks, including a major incursion in February when Microsoft email servers were targeted.

    The US has charged four Chinese nationals — three security officials and one contract hacker — with targeting dozens of companies and government agencies in the United States and overseas under the cover of a tech company.

    “What we do is when we see malicious cyber activity on New Zealand networks, that may be through our own capabilities that we have to help protect New Zealand networks or it may be something that’s reported to us, we look at the malware that’s used,” Government Communications Security Bureau Director-General Andrew Hampton told RNZ Checkpoint.

    “We look at how the actor behaves. We look at who they might be targeting and what they do if they get onto a network.

    “That allows us to build a bit of a picture of who the actor is. We then compare that with information that we receive, often from our intelligence partners who are also observing such activity.

    “That allows us to make an assessment, and it’s always a probability assessment about who the actor is.

    The APT 40 group
    “In this case, because of the amount of information we’ve been able to access both from our own capabilities and from our partners, we’ve got a reasonably high level of confidence that the actor who we’ve seen undertaking this campaign over a number of years, and in particular, who was responsible for the Microsoft Exchange compromise, was the APT 40 group — Advanced Persistent Threat Group 40 — which has been identified as associated with the Chinese Ministry of State Security.


    The RNZ National live stream.  Video: Checkpoint

     

    “The actors here are state sponsored actors rather than what we would normally define as a criminal group. What we’re seeing here is a state sponsored actor likely to be motivated by a desire to steal information.”

    Hampton said there was a blurring of lines between what a state agency does, and what a criminal group does.

    “Some of the technical capabilities that previously only state organisations had, have now got into the hands of criminal groups.

    “Also what we’ve seen in a range of countries is individuals who may work part-time in a government intelligence agency, and then may work part-time in a criminal enterprise. Or they may have previously worked in a state intelligence agency and are now out by themselves but still have links links back to the state.

    “We don’t know the full detail of the nature of the relationship, but what we do know is the Ministry of State Security in China, for example, is a very large organisation with many thousands of of employees.

    “So they are big organisations with people on their payroll but they also would have connections with other individuals and organisations.

    Information shared with criminals
    “Something else worth noting with regard to this most recent compromise involving the Microsoft Exchange, what we saw there is once the Ministry of State Security actors had identified the vulnerability and exploited it, they then shared that information with a range of other actors, including criminal groups, so they too could exploit it.

    “This is obviously a real concern to see this type of behaviour occurring,” Hampton said.

    All evidence showed the cyber attacks were all originating from mainland China, Hampton told Checkpoint.

    He said such attacks would be aimed at stealing data or possibly positioning themselves on a system to be able to access information in the future.

    “A common tactic we see, unfortunately, is there may be a vulnerability in a system,” Hampton said.

    “It could be a generic vulnerability across all users of that particular system, and a malicious actor may become aware of that vulnerability, so they would use that to get onto the network.

    “That doesn’t mean they will then start exfiltrating data from day one or something like that. They may just want to to sit there in the event that at some point in the future they may want to start doing that.

    Malicious actors
    “This exploitation of known vulnerabilities is a real concern. This is why all organisations need to keep their security patches up to date, because what can happen is you can have malicious actors use technology to scan whole countries to see who hasn’t updated their patches.

    “They then use that vulnerability to get on the network and they may not do anything with it for some time. Or they might produce a list of all the organisations, say, in New Zealand who haven’t updated their patches.

    “Then they make a decision – okay these are the four to five we want to further exploit.”

    This article is republished under a community partnership agreement with RNZ.

    This post was originally published on Asia Pacific Report.

  • Held to Ransom: Colonial Pipeline and the Vulnerabilities of Critical Infrastructure

    It should be making officials in the White House tremble.  Critical infrastructure supplying 45% of the East Coast’s diesel, gasoline and jet fuel, left at the mercy of a ransomware operation executed on May 6.  In the process, 100 GB of data of Colonial Pipeline was seized and encrypted on computers and servers.  The next day, those behind the operation demanded a ransom, or the material would be leaked.

    The consequences are telling.  The operator, taken offline to enable an investigation to be conducted by US cybersecurity firm Mandiant; fuel left stranded at refineries in Texas; a spike in fuel prices at the pump – up six cents per gallon on the week to $2.967 per gallon of unleaded gasoline.  “Unless they sort it out by Tuesday,” warned oil market analyst Gaurav Sharma, “they’re in big trouble.”  The impact would be felt first in Atlanta, then Tennessee, perpetuating a domino effect to New York. “This is the largest impact on the energy system in the United States we’ve seen from a cyberattack, full stop,” opined Rob Lee of the cybersecurity firm Dragos.

    The company, in unconvincing tones, issued a statement that it was “continuing to work with third-party cybersecurity experts, law enforcement, and other federal agencies to restore pipeline operations quickly and safely.”  President Joe Biden rushed to calm fears that this had compromised fuel security.  “The agencies across the government have acted quickly to mitigate any impact on our fuel supply.” The deputy national security advisor for cyber and emerging technologies Anne Neuberger waffled to the press that the Biden administration was “taking a multi-pronged and whole-of-government response to this incident and to ransomware overall.”

    On May 9, the Federal Motor Carrier Safety Administration within the Department of Transportation issued a temporary hours of service exemption for motor carriers and drivers “transporting gasoline, diesel, jet fuel and other refined petroleum products” across affected States.

    Finding the culprit in such operations is almost boringly predictable.  The Kremlin tends to get top billing on the list of accused, but on this occasion interest centred on DarkSide rather than President Vladimir Putin.  “I’m gonna be meeting with President Putin,” promised Biden, “and so far there is no evidence, based on our intelligence people, that Russia is involved.”  That did not mean that Russian officials were to be spared scrutiny.  There was “evidence that the actors’ ransomware is in Russia – they have some responsibility to deal with this.”  DarkSide, in other words, is being singled out as a bold and enterprising Russian cybercrime outfit, going where even intelligence operatives fear to tread.  Out in that jungle of compromised cybersecurity, money is to be made.

    DarkSide is cybercrime with a professional face, pirates and buccaneers of the internet with some understanding of public relations.  They court the press when they need to.  They even operate with a code of conduct in mind.  And they are experienced.  “Our goal is to make money and not creating problems for society,” lamented the group after the operation.  “We do not participate in geopolitics, do not see need to tie us with a defined government and look for… our motives.”  The firm claimed ignorance that one of its affiliates had taken it upon themselves to target Colonial.  “From today, we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.”

    This event has revealingly exposed the state of poorly protected critical infrastructure run by private companies.  “When those companies are attacked,” remarked deputy national security advisor Elizabeth Sherwood-Randall, “they serve as the first line of defence, and we depend on the effectiveness of their defences.”

    As security analyst Richard Stiennon described it, the decision to shut down the pipeline showed that Colonial understood the risks.  “On the other hand, it shows that Colonial does not have 100% confidence in their operational systems’ cybersecurity defenses.”  Colonial was doing its best to sound competent, stating that it “proactively took certain systems offline to contain the threat.”

    A less generous reading of this is that the company never genuinely appreciated those risks, given inadequate backup systems or forking out funds for software with fewer vulnerabilities.  The company had effectively issued an open invitation to be targeted, despite warnings made in early 2020 by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency that a ransomware attack on a US-based natural gas compression facility had taken place.

    The provider has done little in terms of clearing the air on how it will deal with the ransom threat.  “Colonial is a private company and we’ll defer information regarding their decision on paying a ransom to them,” stated the less than helpful Neuberger.  Neuberger also spoke of the “troubling trend … of targeting companies who have insurance and may be richer targets”.  More had to be done to “determine what we do in addition to actively disrupting infrastructure and holding perpetrators accountable, to ensure we are not encouraging the rise of ransomware.”

    The Biden administration is currently drafting an executive order that will create new digital safety regulations applicable to federal agencies and contractors who develop software for the government.  Those developing the software would have to be compliant with adequate security safeguards.  A layer of investigative bureaucracy is also contemplated: a cybersecurity incident review board.

    At the very least, optimists in the field will see some value in having glaring faults in security systems exposed, even if it pertains to critical infrastructure.  Cyber extortionists can be turned into constructive citizens, identifying vulnerabilities – for a price.  A better option for corporate management and the boardroom would be to listen to the IT crowd.

    The post Held to Ransom: Colonial Pipeline and the Vulnerabilities of Critical Infrastructure first appeared on Dissident Voice.

    This post was originally published on Dissident Voice.

  • Held to Ransom: Colonial Pipeline and the Vulnerabilities of Critical Infrastructure

    It should be making officials in the White House tremble.  Critical infrastructure supplying 45% of the East Coast’s diesel, gasoline and jet fuel, left at the mercy of a ransomware operation executed on May 6.  In the process, 100 GB of data of Colonial Pipeline was seized and encrypted on computers and servers.  The next day, those behind the operation demanded a ransom, or the material would be leaked.

    The consequences are telling.  The operator, taken offline to enable an investigation to be conducted by US cybersecurity firm Mandiant; fuel left stranded at refineries in Texas; a spike in fuel prices at the pump – up six cents per gallon on the week to $2.967 per gallon of unleaded gasoline.  “Unless they sort it out by Tuesday,” warned oil market analyst Gaurav Sharma, “they’re in big trouble.”  The impact would be felt first in Atlanta, then Tennessee, perpetuating a domino effect to New York. “This is the largest impact on the energy system in the United States we’ve seen from a cyberattack, full stop,” opined Rob Lee of the cybersecurity firm Dragos.

    The company, in unconvincing tones, issued a statement that it was “continuing to work with third-party cybersecurity experts, law enforcement, and other federal agencies to restore pipeline operations quickly and safely.”  President Joe Biden rushed to calm fears that this had compromised fuel security.  “The agencies across the government have acted quickly to mitigate any impact on our fuel supply.” The deputy national security advisor for cyber and emerging technologies Anne Neuberger waffled to the press that the Biden administration was “taking a multi-pronged and whole-of-government response to this incident and to ransomware overall.”

    On May 9, the Federal Motor Carrier Safety Administration within the Department of Transportation issued a temporary hours of service exemption for motor carriers and drivers “transporting gasoline, diesel, jet fuel and other refined petroleum products” across affected States.

    Finding the culprit in such operations is almost boringly predictable.  The Kremlin tends to get top billing on the list of accused, but on this occasion interest centred on DarkSide rather than President Vladimir Putin.  “I’m gonna be meeting with President Putin,” promised Biden, “and so far there is no evidence, based on our intelligence people, that Russia is involved.”  That did not mean that Russian officials were to be spared scrutiny.  There was “evidence that the actors’ ransomware is in Russia – they have some responsibility to deal with this.”  DarkSide, in other words, is being singled out as a bold and enterprising Russian cybercrime outfit, going where even intelligence operatives fear to tread.  Out in that jungle of compromised cybersecurity, money is to be made.

    DarkSide is cybercrime with a professional face, pirates and buccaneers of the internet with some understanding of public relations.  They court the press when they need to.  They even operate with a code of conduct in mind.  And they are experienced.  “Our goal is to make money and not creating problems for society,” lamented the group after the operation.  “We do not participate in geopolitics, do not see need to tie us with a defined government and look for… our motives.”  The firm claimed ignorance that one of its affiliates had taken it upon themselves to target Colonial.  “From today, we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.”

    This event has revealingly exposed the state of poorly protected critical infrastructure run by private companies.  “When those companies are attacked,” remarked deputy national security advisor Elizabeth Sherwood-Randall, “they serve as the first line of defence, and we depend on the effectiveness of their defences.”

    As security analyst Richard Stiennon described it, the decision to shut down the pipeline showed that Colonial understood the risks.  “On the other hand, it shows that Colonial does not have 100% confidence in their operational systems’ cybersecurity defenses.”  Colonial was doing its best to sound competent, stating that it “proactively took certain systems offline to contain the threat.”

    A less generous reading of this is that the company never genuinely appreciated those risks, given inadequate backup systems or forking out funds for software with fewer vulnerabilities.  The company had effectively issued an open invitation to be targeted, despite warnings made in early 2020 by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency that a ransomware attack on a US-based natural gas compression facility had taken place.

    The provider has done little in terms of clearing the air on how it will deal with the ransom threat.  “Colonial is a private company and we’ll defer information regarding their decision on paying a ransom to them,” stated the less than helpful Neuberger.  Neuberger also spoke of the “troubling trend … of targeting companies who have insurance and may be richer targets”.  More had to be done to “determine what we do in addition to actively disrupting infrastructure and holding perpetrators accountable, to ensure we are not encouraging the rise of ransomware.”

    The Biden administration is currently drafting an executive order that will create new digital safety regulations applicable to federal agencies and contractors who develop software for the government.  Those developing the software would have to be compliant with adequate security safeguards.  A layer of investigative bureaucracy is also contemplated: a cybersecurity incident review board.

    At the very least, optimists in the field will see some value in having glaring faults in security systems exposed, even if it pertains to critical infrastructure.  Cyber extortionists can be turned into constructive citizens, identifying vulnerabilities – for a price.  A better option for corporate management and the boardroom would be to listen to the IT crowd.

    This article was posted on Tuesday, May 11th, 2021 at 7:18am and is filed under Cyber attacks, Cybersecurity, Oil, Gas, Coal, Pipelines.

    This post was originally published on Radio Free.

  • Digital Trails: How the FBI Is Identifying, Tracking and Rounding Up Dissidents

    Americans deserve the freedom to choose a life without surveillance and the government regulation that would make that possible. While we continue to believe the sentiment, we fear it may soon be obsolete or irrelevant. We deserve that freedom, but the window to achieve it narrows a little more each day. If we don’t act now, with great urgency, it may very well close for good.

    —Charlie Warzel and Stuart A. Thompson, New York Times

    Databit by databit, we are building our own electronic concentration camps.

    With every new smart piece of smart technology we acquire, every new app we download, every new photo or post we share online, we are making it that much easier for the government and its corporate partners to identify, track and eventually round us up.

    Saint or sinner, it doesn’t matter because we’re all being swept up into a massive digital data dragnet that does not distinguish between those who are innocent of wrongdoing, suspects, or criminals.

    This is what it means to live in a suspect society.

    The government’s efforts to round up those who took part in the Capitol riots shows exactly how vulnerable we all are to the menace of a surveillance state that aspires to a God-like awareness of our lives.

    Relying on selfies, social media posts, location data, geotagged photos, facial recognition, surveillance cameras and crowdsourcing, government agents are compiling a massive data trove on anyone and everyone who may have been anywhere in the vicinity of the Capitol on January 6, 2021.

    The amount of digital information is staggering: 15,000 hours of surveillance and body-worn camera footage; 1,600 electronic devices; 270,000 digital media tips; at least 140,000 photos and videos; and about 100,000 location pings for thousands of smartphones.

    And that’s just what we know.

    More than 300 individuals from 40 states have already been charged and another 280 arrested in connection with the events of January 6. As many as 500 others are still being hunted by government agents.

    Also included in this data roundup are individuals who may have had nothing to do with the riots but whose cell phone location data identified them as being in the wrong place at the wrong time.

    Forget about being innocent until proven guilty.

    In a suspect society such as ours, the burden of proof has been flipped: now, you start off guilty and have to prove your innocence.

    For instance, you didn’t even have to be involved in the Capitol riots to qualify for a visit from the FBI: investigators have reportedly been tracking—and questioning—anyone whose cell phones connected to wi-fi or pinged cell phone towers near the Capitol. One man, who had gone out for a walk with his daughters only to end up stranded near the Capitol crowds, actually had FBI agents show up at his door days later. Using Google Maps, agents were able to pinpoint exactly where they were standing and for how long.

    All of the many creepy, calculating, invasive investigative and surveillance tools the government has acquired over the years are on full display right now in the FBI’s ongoing efforts to bring the rioters to “justice.”

    FBI agents are matching photos with drivers’ license pictures; tracking movements by way of license plate toll readers; and zooming in on physical identifying marks such as moles, scars and tattoos, as well as brands, logos and symbols on clothing and backpacks. They’re poring over hours of security and body camera footage; scouring social media posts; triangulating data from cellphone towers and WiFi signals; layering facial recognition software on top of that; and then cross-referencing footage with public social media posts.

    It’s not just the FBI on the hunt, however.

    They’ve enlisted the help of volunteer posses of private citizens, such as Deep State Dogs, to collaborate on the grunt work. As Dinah Voyles Pulver reports, once Deep State Dogs locates a person and confirms their identity, they put a package together with the person’s name, address, phone number and several images and send it to the FBI.

    According to USA Today, the FBI is relying on the American public and volunteer cybersleuths to help bolster its cases.

    This takes See Something, Say Something snitching programs to a whole new level.

    The lesson to be learned: Big Brother, Big Sister and all of their friends are watching you.

    They see your every move: what you read, how much you spend, where you go, with whom you interact, when you wake up in the morning, what you’re watching on television and reading on the internet.

    Every move you make is being monitored, mined for data, crunched, and tabulated in order to form a picture of who you are, what makes you tick, and how best to control you when and if it becomes necessary to bring you in line.

    Simply liking or sharing this article on Facebook, retweeting it on Twitter, or merely reading it or any other articles related to government wrongdoing, surveillance, police misconduct or civil liberties might be enough to get you categorized as a particular kind of person with particular kinds of interests that reflect a particular kind of mindset that might just lead you to engage in a particular kinds of activities and, therefore, puts you in the crosshairs of a government investigation as a potential troublemaker a.k.a. domestic extremist.

    Chances are, as the Washington Post reports, you have already been assigned a color-coded threat score—green, yellow or red—so police are forewarned about your potential inclination to be a troublemaker depending on whether you’ve had a career in the military, posted a comment perceived as threatening on Facebook, suffer from a particular medical condition, or know someone who knows someone who might have committed a crime.

    In other words, you might already be flagged as potentially anti-government in a government database somewhere—Main Core, for example—that identifies and tracks individuals who aren’t inclined to march in lockstep to the police state’s dictates.

    The government has the know-how.

    It took days, if not hours or minutes, for the FBI to begin the process of identifying, tracking and rounding up those suspected of being part of the Capitol riots.

    Imagine how quickly government agents could target and round up any segment of society they wanted to based on the digital trails and digital footprints we leave behind.

    Of course, the government has been hard at work for years acquiring these totalitarian powers.

    Long before the January 6 riots, the FBI was busily amassing the surveillance tools necessary to monitor social media posts, track and identify individuals using cell phone signals and facial recognition technology, and round up “suspects” who may be of interest to the government for one reason or another.

    As The Intercept reported, the FBI, CIA, NSA and other government agencies have increasingly invested in corporate surveillance technologies that can mine constitutionally protected speech on social media platforms such as Facebook, Twitter and Instagram in order to identify potential extremists and predict who might engage in future acts of anti-government behavior.

    All it needs is the data, which more than 90% of young adults and 65% of American adults are happy to provide.

    When the government sees all and knows all and has an abundance of laws to render even the most seemingly upstanding citizen a criminal and lawbreaker, then the old adage that you’ve got nothing to worry about if you’ve got nothing to hide no longer applies.

    As for the Fourth Amendment and its prohibitions on warrantless searches and invasions of privacy without probable cause, those safeguards have been rendered all but useless by legislative end-runs, judicial justifications, and corporate collusions.

    We now find ourselves in the unenviable position of being monitored, managed and controlled by our technology, which answers not to us but to our government and corporate rulers.

    Consider that on any given day, the average American going about his daily business will be monitored, surveilled, spied on and tracked in more than 20 different ways, by both government and corporate eyes and ears. A byproduct of this new age in which we live, whether you’re walking through a store, driving your car, checking email, or talking to friends and family on the phone, you can be sure that some government agency, whether the NSA or some other entity, is listening in and tracking your behavior.

    This doesn’t even begin to touch on the corporate trackers that monitor your purchases, web browsing, social media posts and other activities taking place in the cyber sphere.

    For example, police have been using Stingray devices mounted on their cruisers to intercept cell phone calls and text messages without court-issued search warrants. Doppler radar devices, which can detect human breathing and movement within a home, are already being employed by the police to deliver arrest warrants.

    License plate readers, yet another law enforcement spying device made possible through funding by the Department of Homeland Security, can record up to 1800 license plates per minute. Moreover, these surveillance cameras can also photograph those inside a moving car. Reports indicate that the Drug Enforcement Administration has been using the cameras in conjunction with facial recognition software to build a “vehicle surveillance database” of the nation’s cars, drivers and passengers.

    Sidewalk and “public space” cameras, sold to gullible communities as a sure-fire means of fighting crime, is yet another DHS program that is blanketing small and large towns alike with government-funded and monitored surveillance cameras. It’s all part of a public-private partnership that gives government officials access to all manner of surveillance cameras, on sidewalks, on buildings, on buses, even those installed on private property.

    Couple these surveillance cameras with facial recognition and behavior-sensing technology and you have the makings of “pre-crime” cameras, which scan your mannerisms, compare you to pre-set parameters for “normal” behavior, and alert the police if you trigger any computerized alarms as being “suspicious.”

    State and federal law enforcement agencies are pushing to expand their biometric and DNA databases by requiring that anyone accused of a misdemeanor have their DNA collected and catalogued. However, technology is already available that allows the government to collect biometrics such as fingerprints from a distance, without a person’s cooperation or knowledge. One system can actually scan and identify a fingerprint from nearly 20 feet away.

    Developers are hard at work on a radar gun that can actually show if you or someone in your car is texting. Another technology being developed, dubbed a “textalyzer” device, would allow police to determine whether someone was driving while distracted. Refusing to submit one’s phone to testing could result in a suspended or revoked driver’s license.

    It’s a sure bet that anything the government welcomes (and funds) too enthusiastically is bound to be a Trojan horse full of nasty, invasive surprises.

    Case in point: police body cameras. Hailed as the easy fix solution to police abuses, these body cameras—made possible by funding from the Department of Justice—turn police officers into roving surveillance cameras. Of course, if you try to request access to that footage, you’ll find yourself being led a merry and costly chase through miles of red tape, bureaucratic footmen and unhelpful courts.

    The “internet of things” refers to the growing number of “smart” appliances and electronic devices now connected to the internet and capable of interacting with each other and being controlled remotely. These range from thermostats and coffee makers to cars and TVs. Of course, there’s a price to pay for such easy control and access. That price amounts to relinquishing ultimate control of and access to your home to the government and its corporate partners. For example, while Samsung’s Smart TVs are capable of “listening” to what you say, thereby allowing users to control the TV using voice commands, it also records everything you say and relays it to a third party, e.g., the government.

    Then again, the government doesn’t really need to spy on you using your smart TV when the FBI can remotely activate the microphone on your cellphone and record your conversations. The FBI can also do the same thing to laptop computers without the owner knowing any better.

    Drones, which are taking to the skies en masse, are the converging point for all of the weapons and technology already available to law enforcement agencies. In fact, drones can listen in on your phone calls, see through the walls of your home, scan your biometrics, photograph you and track your movements, and even corral you with sophisticated weaponry.

    All of these technologies add up to a society in which there’s little room for indiscretions, imperfections, or acts of independence, especially not when the government can listen in on your phone calls, monitor your driving habits, track your movements, scrutinize your purchases and peer through the walls of your home.

    These digital trails are everywhere.

    As investigative journalists Charlie Warzel and Stuart A. Thompson explain, “This data—collected by smartphone apps and then fed into a dizzyingly complex digital advertising ecosystem … provided an intimate record of people whether they were visiting drug treatment centers, strip clubs, casinos, abortion clinics or places of worship.”

    In such a surveillance ecosystem, we’re all suspects and databits to be tracked, catalogued and targeted.

    As Warzel and Thompson warn:

    “To think that the information will be used against individuals only if they’ve broken the law is naïve; such data is collected and remains vulnerable to use and abuse whether people gather in support of an insurrection or they justly protest police violence… This collection will only grow more sophisticated… It gets easier by the day… it does not discriminate. It harvests from the phones of MAGA rioters, police officers, lawmakers and passers-by. There is no evidence, from the past or current day, that the power this data collection offers will be used only to good ends. There is no evidence that if we allow it to continue to happen, the country will be safer or fairer.”

    As I point out in my book Battlefield America: The War on the American People, this is the creepy, calculating yet diabolical genius of the American police state: the very technology we hailed as revolutionary and liberating has become our prison, jailer, probation officer, Big Brother and Father Knows Best all rolled into one.

    There is no gray area any longer.

  • Image credit: K-Plex
    • The post Digital Trails: How the FBI Is Identifying, Tracking and Rounding Up Dissidents first appeared on Dissident Voice.

    This post was originally published on Dissident Voice.

  • Reserve Bank investigates cyber attack – latest in NZ digital breaches

    The NZ Reserve Bank says it is investigating the breach, which may have exposed “commercially and personally sensitive information”. Image: Alexander Robertson/RNZ

    By RNZ News

    A cyber security expert says attacks like the latest on the Reserve Bank could be due to the type of data systems they are using.

    The Reserve Bank revealed yesterday a third party file sharing service it uses, which contains some sensitive information, had been hacked.

    It is the latest after a string of cyber attacks in the past year targeting several major organisations in New Zealand, including the NZ Stock Exchange – which had its servers knocked out of public view for nearly a week in August.

    Titanium Defence cyber security expert Tony Grasso, who was the cyber lead at the Department of Internal Affairs, told Morning Report file sharing systems could weaken security.

    Grasso said there were still lots of questions about the breach to be answered.

    “The question that will be on my mind, and I’m sure this will be what they’re looking at is, who got in, how did they get in, and more importantly, what information has been taken from this file share, but more interestingly than that, have they got from the file share onto the bank systems internally?”

    However, he said it would be hard to say who could be behind the breach at this stage.

    Foreign intelligence agency?
    “You have to always keep in mind it may be a foreign intelligence national agency whenever something as big as the Reserve Bank … any government department within reason, you always have to have that at the back of your mind,” he said.

    “It would be interesting to find out how they were caught. Our detection systems here are good, if it’s one of those systems that have come from another government agency, a more sensitive government agency, that may indicate it was a foreign actor, or these days criminal gangs are getting together and they’ve become an industry on their own and are really good at getting into organisations.

    “Imagine the ransom you could put on the Reserve Bank if you encrypted all their data, for example.”

    Grasso hoped for a more detailed report from the Reserve Bank on who it could be.

    “The Americans are very good at saying ‘it was definitely a foreign government’ and they normally name them as well. It would be good to know if it was that, if it was a criminal organisation or if was it a just a lone wolf – we have loads of these in our industry.”

    The Reserve Bank said sensitive information “may” have been breached.

    The type of information exposed would depend on who the third party was, Grass said.

    Third party may be IT provider
    “A third party could be just an IT provider and they’re just sharing architecture documents, that would be bad of course. But it could be information around covid for example.

    “If they were working with external agencies about the recovery of the company from covid … it could be papers around how we’re planning for our recovery, I mean who knows.

    “I would hope that sensitive stuff like that isn’t held in a third party file server, I’m fairly sure it wouldn’t be.”

    He said even if its own systems were very secure, having a third party who was insecure connecting to the systems could bring a threat.

    Yesterday, Reserve Bank Governor Adrian Orr said they were investigating the breach with experts and authorities.

    “The nature and extent of information that has been potentially accessed is still being determined, but it may include some commercially and personally sensitive information.

    “It will take time to understand the full implications of this breach, and we are working with system users whose information may have been accessed. Our core functions remain sound and operational.”

    The Reserve Bank declined a request for an interview with Morning Report.

    This article is republished under a community partnership agreement with RNZ.

    Print Friendly, PDF & Email

    This post was originally published on Radio Free.