hacking – praag.org

Russians hack US Joint Chiefs of Staff

Investigators say they believe the same Russian hackers that carried out attacks on the White House and State Department last year and the attempted penetration of the Pentagon last month were responsible for a major cyberattack that shut down the Joint Chiefs of Staff email for the past 11 days, The Daily Beast has learned.

In all of the attacks, hackers broke into unclassified email networks by sending legitimate-looking emails than turned out to be malware or “spear phishing” attempts. In April, President Obama’s unclassified emails were among those compromised, along with the State Department.

Ten days before the July 27 hacking of the Joint Staff system, the Pentagon sent an email warning “at least five” DOD computer users had been targeted, which was first reported by The Daily Beast. The notice linked those attacks to penetrations of unclassified networks at the White House and State Department that began last year.

The Joint Chiefs then suffered what one defense official called the “most sophisticated” attack on its unclassified network, one that has shut down communications ever since for the 4,000 employees on the Joint Staff unclassified server.

Source: Daily Beast

Hacker explains to FBI how he steered airliner mid-flight

A computer security expert has revealed that he accessed aircraft control systems on up to 20 occasions, according to an FBI search warrant.

The founder of One World Labs, Chris Roberts, was detained for questioning and had his hardware confiscated in April by federal agents after exiting a United flight from Chicago to Syracuse, New York following a tweet suggesting he might attempt to hack into a flight’s entertainment system.

In a search warrant application, obtained by APTN National News, Roberts previously claimed to have told agents that during his research he used his skills and equipment to gain access to the aircraft control systems on as many as 20 occasions.

“During these conversations, Mr. Roberts stated … that he had exploited vulnerabilities with IFE systems on aircraft while in flight. He compromised the IFE systems approximately 15 to 20 times during the time period 2011 through 2014. He last exploited an IFE system during the middle of 2014,” FBI Special Agent Mark Hurley wrote in his application.

During at least one of these “test” flights, Roberts “stated that he then overwrote code on the airplane’s Thrust Management Computer while aboard a flight,” the document claims. “He stated that he successfully commanded the system he had accessed to issue the CLB or climb command. He stated that he thereby caused one of the airplane engines to climb resulting in a lateral or sideways movement of the plane.”

The court document does not mention during which particular flights the interference with the aircraft controls took place.

According to the affidavit, Hurley met with Roberts in February and March to discuss IFE security vulnerabilities with regards to the Boeing 737 and 757, and Airbus A320 aircraft. It was during these interview sessions that Roberts revealed that his hacking into IFE that was produced by Panasonic and Thales.

When Roberts revealed his hacking abilities, Hurley writes that he had warned the programmer that accessing plane’s in-flight systems without authorization is a federal crime. Roberts, at the time said he understands and promised not to engage in such activity.

But after his April 15 tweet, the FBI apparently alleged the security expert could attempt to repeat success, and did go on to detain and question the man. The agents and technicians who inspected the aircraft which he flew to Chicago, before connecting to New York, allegedly found tampering on two electronic boxes next to Roberts’s seat. According to affidavit, one of the electronic boxes had been damaged.

“Technical specialists with the FBI believed that he may have just [hacked the plane’s system] again, or attempted to do so using the equipment then in his possession,” it said.

When the agents confiscated Roberts’ equipment in Syracuse – including a MacBook, an iPad, three hard drives and numerous removable USB flash drives – he denied hacking into any systems during the flight from Denver to Chicago.

“We believed that Roberts had the ability and the willingness to use the equipment … to access or attempt to access the IFE and possibly the flight control systems … and that it would endanger public safety to allow him to leave the Syracuse airport that evening with the equipment,” Hurley’s report states.

Roberts meanwhile told the Wired that the FBI has taken his remarks about hacking out of context of their comprehensive discussions with the agency.

‘Terrorists raise money in SA’

Millions of rand stolen from local businesses could end up in hands of terrorists, warns Werksmans attorney Berhard Hotz.

He was speaking in Sandton on Wednesday. Hotz investigates white collar crime and commercial fraud.

He said money that had been stolen from a South African company had landed up in the hands of terrorists at least once. “There is a lack of intelligence,” he said.

He knew of two fake NGOs, previously based in South Africa, who raised money for “orphans” but the money was instead sent to Islamic terror organisations in the Middle East.

International anti-terrorism organisations had detected that the sale of diamonds funded the global arms trade and would continue to do so as diamonds were predicted to grow in value.

Hotz argued that mining for diamonds in South Africa, could provide a legitimate “veneer” for terrorist organisations to make money to fund operations, he said.

Additionally. Hotz knew of secret organisations that transferred money from South Africa to Somalia, using passwords, and leaving no paper trail.

He said good IT systems prevented hacking of data. There are Eastern European syndicates in Ukraine, stealing data with very sophisticated software.

World’s most advanced hacking spyware unleashed

A cyber snooping operation reminiscent of the Stuxnet worm and billed as the world’s most sophisticated computer malware is targeting Russian and Saudi Arabian telecoms companies.

Cyber security company Symantec said the malware, called “Regin”, is probably run by a western intelligence agency and in some respects is more advanced in engineering terms than Stuxnet, which was developed by US and Israel government hackers in 2010 to target the Iranian nuclear programme.

The discovery of the latest hacking software comes as the head of Kaspersky Labs, the Russian company that helped uncover Stuxnet, told the Financial Times that criminals are now also hacking industrial control systems for financial gain.

Organised criminals tapping into the networks that run industrial companies, alongside the development of the latest online snooping worm, are signs of the increasingly sophisticated nature of cyber attacks.

“Nothing else comes close to this . . . nothing else we look at compares,” said Orla Cox, director of security response at Symantec, who described Regin as one of the most “extraordinary” pieces of hacking software developed, and probably “months or years in the making”.

However, a western security official said it was difficult to draw conclusions about the origins or purpose of Regin. “It’s dangerous to assume that because the malware has apparently been used in a given country, it did not originate there,” the person said. “Certain states and agencies may well use tools of this sort domestically.”

Symantec said it was not yet clear how Regin infected systems but it had been deployed against internet service providers and telecoms companies mainly in Russia and Saudi Arabia as well as Mexico, Ireland and Iran.

The security software group said Regin could be customised to target different organisations and had hacked Microsoft email exchange servers and mobile phone conversations on major international networks.

“We are probably looking at some sort of western agency,” Ms Cox said. “Sometimes there is virtually nothing left behind – no clues. Sometimes an infection can disappear completely almost as soon as you start looking at it, it’s gone. That shows you what you are dealing with.”

Meanwhile, Eugene Kaspersky, chief executive of Kaspersky Labs, warned that the computer networks that control energy plants and factories are becoming targets for organised crime gangs armed with skilled hackers. He said there was evidence of “more and more very targeted attacks” of the networks that run industrial companies.

The attacks go beyond recent data breaches at US bank JPMorgan and US retailer Home Depot, in which criminals sought credit card details or personal data to attempt false transactions. Mr Kaspersky said criminals have used hacking for everything from bypassing security at ports to stealing grain from a Ukrainian factory by adjusting the digital scales to read a lower weight.

The most public incident of cyber industrial crime was exposed when Europol smashed a drugs ring last year that was hacking into the control systems of the Belgian port of Antwerp, to move containers holding drugs away from the prying eyes of customs inspectors.

Source: FT

No law or policy for ‘mastering the Internet’

Britain’s GCHQ is scanning servers in multiple foreign countries for vulnerable ports, according to German newspaper Heise. Using a tool called Hacienda, the intelligence agency seeks to ‘master the internet’ for sources of espionage.

Spanish for estate, Hacienda can port scan all of the servers in a country to provide information on user endpoints and scan for potential vulnerabilities. The ability to port scan is not new, but the scale of its use by government spies, with 27 countries scanned by 2009, has shocked many familiar with the software.

“In 2009, the British spy agency GCHQ made port scans a ‘standard tool’ to be applied against entire nations,” Heise reports. “Twenty-seven countries are listed as targets of the Hacienda [program].”

The process of scanning entire countries and looking for vulnerable network infrastructure to exploit is consistent with the meta-goal of “Mastering the Internet”, which is also the name of a GCHQ cable-tapping program. Targeted protocols include SSH, HTTP and FTP, among others.

Systems may be attacked simply because they might eventually create a path towards a valuable espionage target, even without indications this will ever be the case. Based on this logic, every device is a target.

The database resulting from the scans is shared with other spy agencies in the UK, US, Canada, Australia and New Zealand. MAILORDER is described in the documents as a secure transport protocol used between the ‘Five Eyes’ spy agencies to exchange collected data.

System and network administrators face the threat of industrial espionage, sabotage and human rights violations created by nation states indiscriminately attacking network infrastructure and breaking into services.

GCHQ says it will not comment on “intelligence matters” but reiterates that everything that it does is done within a strict legal framework. “It is a longstanding policy that we do not comment on intelligence matters,” a GCHQ spokesperson told The Inquirer.

“All of GCHQ’s work is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorized, necessary and proportionate, and that there is rigorous oversight, including from the Secretary of State, the Interception of Communications and Intelligence Services Commissioners and the Parliamentary Intelligence and Security Committee.

“All our operational processes rigorously support this position,” they added.

British intelligence is permitted to go further in surveillance than similar agencies in other Western countries, according to Edward Snowden. The former NSA contractor believes the powers of the British intelligence establishment are not restricted effectively enough by “law or policy”. The lack of legal restrictions allows UK intelligence services to target more people than is necessary.

Source: RT

Coming soon: Murder by mouse click

According to the US internet security industry, murder committed by hacking into an internet-connected device is a real possibility.

Internet Identity predicted murder by internet in a report last year, stating: “With so many devices being internet connected, it makes murder relatively simple, at least from a technical perspective.”

This year’s report said that though there has yet to be a proved case of murder over the internet it might have happened and not been detected. It noted that former US vice-president Dick Cheney asked to have the wireless function of his pacemaker disabled to prevent it from being hacked.

The report said that, in June, the US Food and Drug Administration demanded that “the healthcare industry address vulnerabilities in internet-connected devices such as pacemakers, which could be hacked to send out lethal jolts of electricity, or insulin pumps, which can be reprogrammed to administer overdoses”.

Internet Identity also foresaw an increase in cyber warfare and cyber espionage. It claimed, as have other industry security companies, that China has a secret military unit that electronically infiltrates the networks of businesses, media houses and governments.

Security researcher Barnaby Jack died mysteriously in San Francisco earlier this year, only days before a scheduled appearance at a Las Vegas hacker conference where he intended to show how an ordinary pacemaker could be compromised in order to kill a man.

In South Africa up to 80% of companies are not running the monitoring software that could show the extent of hacking and cyber espionage.

No suspects in SA Police hack attack

No suspects have been identified in connection with the hacking of the SA Police Service website last month, Police Minister Nathi Mthethwa revealed on Wednesday.

Mthethwa said the investigation was still underway and the level of threat to identified whistleblowers was not yet known.

The information was provided in an answer to a parliamentary question by Freedom Front Plus spokesman Anton Alberts.

Alberts asked the minister whether any steps had been taken to safeguard those whose identities were compromised.

Mthethwa replied: “Full implementation of steps will be finalised after the investigation and the threat assessment is completed.”

Alberts said it was concerning that these people appeared to not receive any protection by police.

He feared the hacking incident would be a set-back for crime-fighting because people with information would be too scared to come forward.

“This is negligence on a huge scale and shows the incompetence of the state’s information technology agency which manages the police’s website. The public’s confidence in the police will definitely be harmed by this.”

In May, a State Information Technology Agency (Sita) official said information posted by citizens alerting police about crime had been left on the police site by mistake.

“The data is collected on that public server. There was a little bit of an oversight, because it should have been removed afterwards,” said divisional head responsible for government solutions, Daniel Mashao.

“We increased the functionality [of the police website] to allow people to be able to report further information. When we did that we should have also decided to move it to the secure site.”

The hacker reportedly performed a data dump when complainants and whistle-blowers’ details were downloaded from the SA Police Service website’s e-mail server and uploaded onto another site.

Mashao said at the time that the information obtained by the hacker comprised about 15,000 lines.

“Most of the information was submitted anonymously. We are concerned because there is information [within the 15,000 lines] where people have given [their] further details to say ‘I know about such and such [a crime].”

Mthethwa re-iterated in his reply that nobody in the witness protection programme had been compromised in any way, contrary to media reports.

The hackers used social networking site Twitter to inform the public that the attack was in connection with the lack of arrests for the August 2012 shooting of 34 protesting mineworkers at Marikana mine in Rustenburg.

Public Service Minister Lindiwe Sisulu also answered questions submitted by Alberts.

He had asked her what security measures were in place at the time.

Sisulu replied that the website had a firewall and network intrusion protection, malware inspection and antivirus software.

It also had an inverse proxy, which took requests from the internet and forwarded them to servers in an internal network.

“Those making requests connect to the proxy and may not be aware of the internal network, and it helps to protect the internal network from intrusions,” Sisulu said.

The website application was developed in 2004/05 and there were no external contractors involved in its maintenance.

Sisulu said the increasing sophistication of cyber-criminals had resulted in a race to implement security measures ahead of attacks.

She said Sita had scanned its websites for vulnerabilities and a process had been underway since February this year to address these vulnerabilities.

“This is unfortunately a tedious process as it requires the redevelopment of large portions of the application.” – Sapa