nsa – Tech Today w/ Ken May

‘Very High Level of Confidence’ Russia Used Kaspersky Software For Devastating NSA Leaks

bricko shares a report from Yahoo Finance: Three months after U.S. officials asserted that Russian intelligence used popular antivirus company Kaspersky to steal U.S. classified information, there are indications that the alleged espionage is related to a public campaign of highly damaging NSA leaks by a mysterious group called the Shadow Brokers. In August 2016, the Shadow Brokers began leaking classified NSA exploit code that amounted to hacking manuals. In October 2017, U.S. officials told major U.S. newspapers that Russian intelligence leveraged software sold by Kaspersky to exfiltrate classified documents from certain computers. (Kaspersky software, like all antivirus software, requires access to everything stored on a computer so that it can scan for malicious software.) And last week the Wall Street Journal reported that U.S. investigators “now believe that those manuals [leaked by Shadow Brokers] may have been obtained using Kaspersky to scan computers on which they were stored.” Members of the computer security industry agree with that suspicion. “I think there’s a very high level of confidence that the Shadow Brokers dump was directly related to Kaspersky … and it’s very much attributable, ” David Kennedy, CEO of TrustedSec, told Yahoo Finance. “Unfortunately, we can only hear that from the intelligence side about how they got that information to see if it’s legitimate.” Read more of this story at Slashdot.

See more here:
‘Very High Level of Confidence’ Russia Used Kaspersky Software For Devastating NSA Leaks

Kaspersky says it briefly possessed classified NSA files

Earlier this month, reports surfaced that classified NSA documents detailing how US agencies defend their cyber networks and how they breach foreign ones were stolen by Russian hackers in 2015. Those reports noted that the files were spotted through Kaspersky security software used by an NSA contractor who had saved the classified documents on a home computer. Well, Kaspersky has now provided some more information about the incident and it has acknowledged that it did in fact have classified NSA materials in its possession, the Associated Press reports. The company’s founder, Eugene Kaspersky, said that in 2014, Kaspersky analysts informed him that their software had plucked some classified files from an NSA contractor’s computer. Kaspersky said it was immediately clear what needed to be done — the materials had to be deleted. And so they were. However, whether the files in question were obtained purposefully or as a result of normal functions of the security software is still up in the air. As Kaspersky tells it, the company was already tracking a team of hackers called the Equation Group, which was later revealed to be part of the NSA. The NSA contractor that exposed the files had run Kaspersky software on his computer after infecting it with a bootleg copy of Microsoft Office and while the software cleaned up the viruses, it was also triggered by the Equation Group materials stored on the contractor’s computer. Those were then sent to Kaspersky headquarters for evaluation and as soon as analysts saw that the files were classified NSA documents, they alerted Eugene Kaspersky and subsequently deleted the files. Releasing this information is part of Kaspersky Lab’s recent push towards transparency as mistrust in the US has mounted over the past few months. Best Buy pulled Kaspersky software from its shelves last month and the US government banned the software in all federal agencies. Earlier this year, the FBI was reportedly discouraging private companies from using Kaspersky products, which have been a focus in government investigations of late and an interest of both the Senate and House of Representatives . Earlier this week, in order to regain some trust, Kaspersky announced that it would allow its source code to be reviewed by third parties and would open three “transparency centers” around the world. Jake Williams, a cybersecurity expert and former NSA analyst, told the AP that because Kaspersky was trying to woo US government clients at the time, it made sense that it would have chosen to delete the files. “It makes sense that they pulled those up and looked at the classification marking and then deleted them, ” he said. “I can see where it’s so toxic you may not want it on your systems.” However, he added the fact that an NSA employee put classified material on an already compromised home computer was “absolutely wild.” Source: Associated Press

Link:
Kaspersky says it briefly possessed classified NSA files

Worker who snuck NSA malware home had his PC backdoored, Kaspersky says

Enlarge (credit: Kaspersky Lab) An NSA worker who reportedly snuck classified materials out of the agency stored them on a home computer that was later infected by a malicious backdoor that allowed third-parties to remotely access the machine, officials with Moscow-based antivirus provider Kaspersky Lab said. The NSA worker—described in some published reports as a contractor and in others as an employee—installed the backdoor after Kaspersky AV had first detected never-before-seen NSA malware samples on his computer. The backdoor was part of a pirated software package that the worker downloaded and installed. To run the pirated software, he first had to disable the AV program on his computer. After being infected, the worker re-enabled the AV program and scanned his computer multiple times, resulting in Kaspersky developing detections for new and unknown variants of the NSA malware. The NSA worker’s computer ran a home version of Kaspersky AV that had enabled a voluntary service known as Kaspersky Security Network . When turned on, KSN automatically uploads new and previously unknown malware to company Kaspersky Lab servers. The setting eventually caused the previously undetected NSA malware to be uploaded to Kaspersky Lab servers, where it was then reviewed by a company analyst. Read 9 remaining paragraphs | Comments

View article:
Worker who snuck NSA malware home had his PC backdoored, Kaspersky says

Russian Hackers Exploited Kaspersky Antivirus To Steal NSA Data on US Cyber Defense: WSJ

An NSA contractor brought home highly classified documents that detailed how the U.S. penetrates foreign computer networks and defends against cyberattacks. The contractor used Kaspersky antivirus on his home computer, which hackers working for the Russian government exploited to steal the documents, the WSJ reported on Thursday (the link could be paywalled; alternative source), citing multiple people with knowledge of the matter. From the report: The hackers appear to have targeted the contractor after identifying the files through the contractor’s use of a popular antivirus software made by Russia-based Kaspersky Lab, these people said. The theft, which hasn’t been disclosed, is considered by experts to be one of the most significant security breaches in recent years. It offers a rare glimpse into how the intelligence community thinks Russian intelligence exploits a widely available commercial software product to spy on the U.S. The incident occurred in 2015 but wasn’t discovered until spring of last year, said the people familiar with the matter. Having such information could give the Russian government information on how to protect its own networks, making it more difficult for the NSA to conduct its work. It also could give the Russians methods to infiltrate the networks of the U.S. and other nations, these people said. Ahead of the publication of WSJ report, Kaspersky founder Eugene Kaspersky tweeted, “New conspiracy theory, anon sources media story coming. Note we make no apologies for being aggressive in the battle against cyberthreats.” Read more of this story at Slashdot.

More:
Russian Hackers Exploited Kaspersky Antivirus To Steal NSA Data on US Cyber Defense: WSJ

US Cyber Command may be splitting off from the NSA

It sounds as though the United States’ Cyber Command will break off from the National Security Agency and be more aligned with the military in the future. The move would “eventually” cleave Cyber Command from the intelligence-focused NSA and instead align it more with the military, according to the Associated Press . “The goal is to give Cyber Command more autonomy, freeing it from any constraints that stem from working alongside the NSA, ” AP reports. The NSA’s core task of intelligence gathering sometimes is at odds with military cyber warfare operations, hence the proposed separation. Prior to this, the two had clashed on getting intel from Islamic State networks (the NSA’s task) and attacking (Cyber Command’s). But there are concerns that splitting off from the NSA could come at a cost. Specifically, Cyber Command’s access to the intelligence agency’s resources including some of the top mathematicians in the country and a “gigantic” super computer, according to AP ‘s sources. The moves to start the separation had begun under President Obama, and now the nitty gritty of how the “divorce” (our word) will proceed is up in the air. The result of that is uncertainty over staffing, resources and leadership. Currently both groups are led by the same person, Admiral Mike Rogers , but the shift could see new leadership for the NSA transfer to a civilian. Cyber Command may remain under military leadership under the Army’s Lieutenant General William Mayville. Mayville served as director of operations for the Joint Staff. This comes after the Cyber Command has gained a bigger seat at the table during military operations and an increased focus on using cyber warfare in places like Russia and the Middle East. Source: Associated Press

View the original here:
US Cyber Command may be splitting off from the NSA

WannaCry ransomware causes Honda plant to shut down

WannaCry isn’t done yet. Honda Motor Co. had to shut down its Sayama plant on Monday after finding the ransomware in its computer network. The plant’s production resumed on Tuesday. The WannaCry ransomware got everyone’s attention in May when UK NHS hospitals fell victim to it. It then quickly spread around the world, affecting over 150 countries and hitting companies like French car manufacturer Renault and FedEx. WannaCry was made possible by a Windows vulnerability uncovered by the NSA and subsequently stolen and released by a hacking group called The Shadow Brokers. WannaCry, which US agencies suspect a North Korean group was behind, took advantage of that vulnerability in computers that hadn’t been updated with Microsoft’s patch or had versions of Windows that were too old to use it. Honda’s Sayama plant, located outside of Tokyo, manufactures the Accord, Odyssey and Step Wagon models and produces around 1, 000 vehicles each day. Production at other plants wasn’t affected. Via: Road Show Source: Reuters

Continue Reading:
WannaCry ransomware causes Honda plant to shut down

New SMB Worm Uses Seven NSA Hacking Tools. WannaCry Used Just Two

An anonymous reader writes: Researchers have detected a new worm that is spreading via SMB, but unlike the worm component of the WannaCry ransomware, this one is using seven NSA tools instead of two. Named EternalRocks, the worm seems to be in a phase where it is infecting victims and building its botnet, but not delivering any malware payload. EternalRocks is far more complex than WannaCry’s SMB worm. For starters, it uses a delayed installation process that waits 24 hours before completing the install, as a way to evade sandbox environments. Further, the worm also uses the exact same filenames as WannaCry in an attempt to fool researchers of its true origin, a reason why the worm has evaded researchers almost all week, despite the attention WannaCry payloads have received. Last but not least, the worm does not have a killswitch domain, which means the worm can’t be stopped unless its author desires so. Because of the way it was designed, it is trivial for the worm’s owner to deliver any type of malware to any of the infected computers. Unfortunately, because of the way he used the DOUBLEPULSAR implant, one of the seven NSA hacking tools, other attackers can hijack its botnet and deliver their own malware as well. IOCs are available in a GitHub repo. Ars Technica quotes security researchers who say “there are at least three different groups that have been leveraging the NSA exploit to infect enterprise networks since late April… These attacks demonstrate that many endpoints may still be compromised despite having installed the latest security patch.” Read more of this story at Slashdot.

Visit link:
New SMB Worm Uses Seven NSA Hacking Tools. WannaCry Used Just Two

‘WannaCry’ ransomware attack spreads worldwide (update)

England’s healthcare system came under a withering cyberattack Friday morning, with ” at least 25 ” hospitals across the country falling prey to ransomware that locked doctors and employees out of critical systems and networks. The UK government now reports that this is not a (relatively) isolated attack but rather a single front in a massive regionwide digital assault. #nhscyberattack pic.twitter.com/SovgQejl3X — gigi.h (@fendifille) May 12, 2017 The attack has impacted hospitals and transportation infrastructure across Europe, Russia and Asia. Organizations in dozens of countries have all been hit with the same ransomware program, a variant of the WannaCry virus, spouting the same ransom note and demanding $300 for the encryption key, with the demand escalating as time passes. The virus’s infection vector appears to through a known vulnerability, originally exploited and developed by the National Security Agency. That information was subsequently leaked by the hacking group known as Shadow Broker which has been dumping its cache of purloined NSA hacking tools onto the internet since last year. The virus appears to have originally spread via email as compressed file attachment so, like last week’s Google Docs issue, make sure you confirm that you email’s attachments are legit before clicking on them. Also, make sure your computers are using software that’s still receiving security updates, and that you’ve installed the latest updates available. Microsoft released a fix for the exploit used as a part of its March “Patch Tuesday” release, but unpatched Windows systems remain vulnerable. Update : Reuters reports a statement from Microsoft indicating that engineers have added detection and protection against the “Ransom:Win32.WannaCrypt” malware, so make sure your Windows Defender or other antivirus is updated before logging on to any corporate networks that may be infected. In a statement, a FedEx representative confirmed its systems are being impacted, saying “Like many other companies, FedEx is experiencing interference with some of our Windows-based systems caused by malware. We are implementing remediation steps as quickly as possible. We regret any inconvenience to our customers.” Source: New York Times

Originally posted here:
‘WannaCry’ ransomware attack spreads worldwide (update)

‘WannaCry’ ransomware attack spreads worldwide (update)

England’s healthcare system came under a withering cyberattack Friday morning, with ” at least 25 ” hospitals across the country falling prey to ransomware that locked doctors and employees out of critical systems and networks. The UK government now reports that this is not a (relatively) isolated attack but rather a single front in a massive regionwide digital assault. #nhscyberattack pic.twitter.com/SovgQejl3X — gigi.h (@fendifille) May 12, 2017 The attack has impacted hospitals and transportation infrastructure across Europe, Russia and Asia. Organizations in dozens of countries have all been hit with the same ransomware program, a variant of the WannaCry virus, spouting the same ransom note and demanding $300 for the encryption key, with the demand escalating as time passes. The virus’s infection vector appears to through a known vulnerability, originally exploited and developed by the National Security Agency. That information was subsequently leaked by the hacking group known as Shadow Broker which has been dumping its cache of purloined NSA hacking tools onto the internet since last year. The virus appears to have originally spread via email as compressed file attachment so, like last week’s Google Docs issue, make sure you confirm that you email’s attachments are legit before clicking on them. Also, make sure your computers are using software that’s still receiving security updates, and that you’ve installed the latest updates available. Microsoft released a fix for the exploit used as a part of its March “Patch Tuesday” release, but unpatched Windows systems remain vulnerable. Update : Reuters reports a statement from Microsoft indicating that engineers have added detection and protection against the “Ransom:Win32.WannaCrypt” malware, so make sure your Windows Defender or other antivirus is updated before logging on to any corporate networks that may be infected. In a statement, a FedEx representative confirmed its systems are being impacted, saying “Like many other companies, FedEx is experiencing interference with some of our Windows-based systems caused by malware. We are implementing remediation steps as quickly as possible. We regret any inconvenience to our customers.” Source: New York Times

Original post:
‘WannaCry’ ransomware attack spreads worldwide (update)

‘WannaCry’ ransomware attack spreads worldwide (update)

England’s healthcare system came under a withering cyberattack Friday morning, with ” at least 25 ” hospitals across the country falling prey to ransomware that locked doctors and employees out of critical systems and networks. The UK government now reports that this is not a (relatively) isolated attack but rather a single front in a massive regionwide digital assault. #nhscyberattack pic.twitter.com/SovgQejl3X — gigi.h (@fendifille) May 12, 2017 The attack has impacted hospitals and transportation infrastructure across Europe, Russia and Asia. Organizations in dozens of countries have all been hit with the same ransomware program, a variant of the WannaCry virus, spouting the same ransom note and demanding $300 for the encryption key, with the demand escalating as time passes. The virus’s infection vector appears to through a known vulnerability, originally exploited and developed by the National Security Agency. That information was subsequently leaked by the hacking group known as Shadow Broker which has been dumping its cache of purloined NSA hacking tools onto the internet since last year. The virus appears to have originally spread via email as compressed file attachment so, like last week’s Google Docs issue, make sure you confirm that you email’s attachments are legit before clicking on them. Also, make sure your computers are using software that’s still receiving security updates, and that you’ve installed the latest updates available. Microsoft released a fix for the exploit used as a part of its March “Patch Tuesday” release, but unpatched Windows systems remain vulnerable. Update : Reuters reports a statement from Microsoft indicating that engineers have added detection and protection against the “Ransom:Win32.WannaCrypt” malware, so make sure your Windows Defender or other antivirus is updated before logging on to any corporate networks that may be infected. In a statement, a FedEx representative confirmed its systems are being impacted, saying “Like many other companies, FedEx is experiencing interference with some of our Windows-based systems caused by malware. We are implementing remediation steps as quickly as possible. We regret any inconvenience to our customers.” Source: New York Times