Chinese hackers linked to breach of control systems used in electric grids

by Lisa Vaas 

breached Telvent's network, the company has informed its customers in a letter. Telvent is the maker of an industrial control system that remotely controls smart grid networks used in portions of the electric grid. Telvent told its customers that on Sept. 10, it learned that hackers had breached its internal firewall and security systems, implanted malicious software, and stolen project files.

.....Experts detected digital fingerprints implicating a Chinese hacking group that has been tied to cyber-espionage campaigns against Western interests.

...

KrebsOnSecurity cited Joe Stewart, director of malware research at Dell SecureWorks, who said that website and malware names mentioned in a more recent letter from Telvent can be traced to a Chinese hacking team known as the "Comment Group."

.....

Researchers told Bloomberg that during two months of monitoring last year, targeted companies spanned a vast scale as data "bled from one victim to the next":

...from oilfield services leader Halliburton Co. (HAL) to Washington law firm Wiley Rein LLP; from a Canadian magistrate involved in a sensitive China extradition case to Kolkata-based tobacco and technology conglomerate ITC Ltd. (ITC)

.......

Evidence indicates that at least 20 organizations have been harvested for data, many of whose secrets could give China a leg up on its path to becoming the world’s largest economy.

Bloomberg cited unnamed security experts who said that the breaches have sprung data leaks in major oil companies, who've lost seismic maps charting oil reserves, while patent law firms have been squeezed for clients' trade secrets and investment banks have been targeted for market analysis regarding global ventures of state-owned companies.

.....

Meanwhile, the Obama adminstration and Congress have grown increasingly vocal about Chinese and Russian cyber espionage and attacks, with the White House close to completing the first draft of a cybersecurity executive order designed to bring about stronger cyber security around the nation's water, electrical and transportation systems.

.....

Click here to read more ....

Network Surveillance Devices Discovered via Shodan

Contributed By:
shawn merdinger 

It’s no secret that Shodan has turned up some interesting findings over the past few years – everything from critical infrastructure devices, to VoIP phones, solar and wind farms, HVAC systems, even a online crematorium.

Now, we can add surveillance devices like BlueCoat Proxy and PacketShaper boxes, Cisco routers running Lawful Intercept code and various vendors’ CALEA Mediation Devices into what Shodan has pre-scanned and savvy researchers searching Shodan can find.

.....

BLUECOAT

In the case of Blue Coat, the company’s filtering technology was identified in October, 2011 by Citizenlab.org based out of the University of Toronto and documented here: https://citizenlab.org/2011/11/behind-blue-coat/  Highlights include 12 BlueCoat devices identified in Syria.  This research was also picked up by Forbes and Bruce Schneier as well.

Finding BlueCoat devices by searching Shodan can reveal these filtering and packet shaping boxes deployed around the world.

.....

CISCO SYSTEMS' LAWFUL INTERCEPT

Other vendors’ products in the surveillance space are also identifiable via Shodan searches.  Cisco Systems’ Lawful Intercept is a specialized architecture that is well documented and utilizes specific Cisco IOS images on certain platforms.  Unfortunately, hundreds of Cisco routers running Lawful Intercept code versions are in the Shodan database simply because the router owners configured the SNMP community read string as “public.”  As a result, Shodan scanners queried the router using SNMP and public community string and the router returned the Cisco IOS version, along with other SNMP details.

.......

IMPACT

So what is the impact of these kinds of devices being exposed through researchers’ Shodan searches and disclosure?  That is not an easy question to answer, given the unknowns in this kind of situation.

Obviously, there is a risk of attackers targeting and sabotaging these surveillance devices for any number of reasons, from political or criminal motivations to simple personal amusement, a.k.a. "Teh Lulz"

...........

Overall, one must treat these search results with skepticism.  After all, they may be honeypots, or test systems, or not in use, or whatever.  Simply because a router is on the Internet and has a Lawful Intercept capable image loaded doesn’t necessarily mean it is being used for that purpose.

Then again, they could be live systems... who knows?

Click here to read more .... 

New Russian DIY DDoS bot spotted in the wild

By Dancho Danchev

Over the last couple of years, the modular and open source nature of today’s modern DDoS (distributed denial of service) bots inevitably resulted in the rise of the DDoS for hire and DDoS extortion monetization schemes within the cybercrime ecosystem.

These maturing business models require constant innovation on behalf of the cybercriminals providing the easy to use and manage DIY DDoS bots, the foundation of these business models.

......

Sample screenshot of the command and control interface of the Russian DIY DDoS Bot:

• The bot supports SYN flooding, HTTP flooding, POST flooding and the special Anti-DDoS protection type of flooding. 
• It has also built-in anti-antivirus features allowing it avoid detection by popular host-based firewalls.... 
• t will not work under a virtual machine preventing potential analysis of the malicious binaries conducted by a malware researcher. 
• Randomization of the HTTP requests using multiple user-agents in an attempt to trick anti-DDoS protection on the affected hosts. ........

......

Click here to read more .... 

State Sponsored Cyber Threats – The Long View

Strategic Penetration for Future Exploitation

So, what is “strategic penetration or future exploitation”? It is an attack strategy that hedges long-term bets on two potential future worldviews, namely PROSPERITY and CONFLICT that allows for the pursuit of PROSPERITY while seeking out strategic advantage in the event of CONFLICT.

During these types of attacks, critical infrastructure and high-value targets are compromised not for the purpose of stealing intellectual property or engaging in traditional espionage and intelligence activity, but rather to establish a foothold to diminish the operation of those infrastructures in the event of future hostilities.

........................

Key components of a strategic compromise include:

• Initial compromise....
• Narrowly focused scope .....
• Time-shifted intent .....
• Long-term stealth and patience ....
• A Team only......

......

Strategic Penetrations have Strategic Implications

In an environment where existing security models are already broken, addressing this type of threat will be a persistent challenge. It requires us to think not only about how we are vulnerable now, but how we will be vulnerable in ten years or how today’s vulnerabilities could be time shifted for future strategic advantage. It requires new detection techniques focused on host security, supply chain integrity,and implementation and infrastructure management controls. It also requires a vibrant cyber intelligence capability that is not dependent exclusively on technical collection.

Most importantly, it requires a shift in our mindset of how we view the current threat space and breaking our cultural disposition to only think about these issues in a short-term context.

For details

Powerful cyber attack tools widely available, say researchers

Online cyber criminal markets are putting very sophisticated attack tools into the hands of more low-level attackers, say cyber intelligence specialists.

More attackers are now getting their hands on tools like Zeus and SpyEye, according to the cyber intelligence team at the Online Threats Managed Services (OTMS) group of RSA, the security division of EMC.

Such tools are widely available at relatively low cost. The barriers to entry are falling all the time because these tools are also increasingly easy to use with well-developed user interfaces.

…………………….

However, apart from targeted attacks, there has also been an increase in the number of malware infections on machines within business networks.

…………………..

It is now in the open that countries are using malware as part of their cyber espionage programmes, and companies should be planning their cyber security in light of that fact.

………………..

…………………

Click here to read more ...... 
Solutions : www.xcyss.in

Two techies arrested for hacking cell recharge site

Two members of the hacker group, "Indishell", and its offshoots were arrested on Saturday after an extensive investigation by the Gautam Budh Nagar cyber crime cell. The accused, who did BTech in computer science, were charged with hacking into an e-commerce website that specializes in mobile recharge.

..............................

The hackers have cheated a Delhi-based company of more than Rs 50 lakh, police said. The accused, Sumit Gupta (24) and Ankit Singh (22), are from Moradabad in UP, and are considered one of the "most sophisticated hackers in the country". They were arrested from Noida and booked under Sections 420 of the IPC and 66C of the IT Act, 2008.

.............................

Click here to read more ...... 
Solutions : www.xcyss.in

'Fake' Jaitley surfaces on Twitter again

Senior BJP leader Arun Jaitley has once again become a victim of cyber crime after another fake Twitter account cropped up in his name.

This is the second time in eight months that the leader of the Opposition in the Rajya Sabha has been subjected to such a predicament.

..........................
..........................
Click here to read more ...... 
Solutions : www.xcyss.in

India is in a state of denial on cyber security: Kamlesh Bajaj

Kamlesh Bajaj, former government servant and now CEO of the Data Security Council of India (DSCI), tells Aditi Phadnis that India must beware another attack on its cyber security and suggests ways in which this can be countered.
............................
.............................
Click here to read more ...... 
Solutions : www.xcyss.in

Online impostor held for harassing woman

A Najibabad resident has been arrested for harassing a woman on social networking sites, threatening her and blackmailing her family after befriending her under a fake ID on Facebook and Orkut.
.................................
...................................

Karunakaran said the woman started avoiding Akram on learning he was an impostor but he pestered her to marry him. When she refused, he made fake profiles of her on these sites and posted false and offensive information, even disclosing the woman's mobile number. Thereafter, he informed the woman's mother and other relatives about the profile through electronic means. He met the mother and blackmailed her to pay Rs 5 lakh, if she did not want the complainant to be disgraced or become the victim of an acid or blade attack.
..................................


Click here to read more ...... 
Solutions : www.xcyss.in

India to widen scope of cyber-security coordinator

India is to widen the scope of its cyber-security coordinator in the wake of incendiary Internet data that swept the country earlier this month and forced an exodus of northeastern people from Pune and Bangalore, although a senior official said that there is no move to take up the issue with Pakistan.

...................

India has also reiterated a demand made three years ago to toughen cyber laws to prevent such hate campaigns, the official said.

..................

Click here to read more ...... 
Solutions : www.xcyss.in

India to appoint a cyber security controller in National Security Council

Waking up to the new threat of cyber jehad, India has decided to appoint a cyber security controller in the National Security Council.

Official sources confirmed that the recent incident of morphed images being uploaded on a mass scale to create panic in parts of India; has got the Indian Government in a situation where it has to learn on the job.

...............

................

Click here to read more ...... 
Solutions : www.xcyss.in

NTRO was missing from govt's initial bid to block inflammatory web content

As the security establishment was scrambling to contain fake and inflammatory messages spreading across the internet that contributed to violence and exodus of thousands, one agency was conspicuous by its absence in the crucial initial phase: the intelligence agency that is supposed to counter such cyber crises.

In a bizarre twist to the government's response earlier this month to contain India's first real cyber challenge, the National Technical Research Organization (NTRO) was completely absent from the operation in the initial phase.
.................................

On August 14, the Centre had issued a nation-wide alert about safety of northeast origin people, and by August 17, it had imposed stiff restrictions on SMSs and MMSs over mobile phones. On August 18, the home ministry had forwarded the first list of internet sites and URLs to be blocked.

There were 75 websites and URLs on the first list given to CERT-IN (Computer Emergency Response Team-India) for blocking. Almost all of them were identified by the Intelligence Bureau and some probably by the Research and Analysis Wing. Not one of them was provided by NTRO.
.....................
.....................

The absence of NTRO in the critical initial phase fits into the larger lack of clarity within the security establishment over countering inflammatory messages on the web. The initial rush to block websites and Twitter handles led to widespread uproar against India's intolerance towards internet freedom.
.........................
..........................
Click here to read more ...... 
Solutions : www.xcyss.in

Power grids easy meat for cyber rogues

NEW DELHI: India's power systems could be vulnerable to crippling cyber attacks on a scale that can have serious implications for national security and economy, an enquiry into the July 30-31 grid collapse that grabbed global attention has said.

Although cyber attacks have been ruled out in last month's grid collapse, destabilization of the energy sector could lead to a "cascading effect on national security and economy. It points out that main vulnerabilities are in transmission and distribution sectors.
..................................
...................................

A well-delivered cyber assault can disrupt services to critical users like hospitals and metro rail systems and such an attack may choose to target distribution where the bulk of automation is evident.
.....................
.....................
Click here to read more ......
Solutions : www.xcyss.in

Winning Cyber Battles Without Fighting

In military operations, good leaders never make a move without the best available intelligence and a strong sense of situational awareness. To do otherwise is tantamount to flying blind, something a good pilot or business leader should avoid.

Unfortunately, too many leaders of industry and commerce seem to be flying blind in today’s cyber domain.

“The Cyber-readiness Reality Check,” an independent survey recently commissioned by the company, CounterTack, Inc., reveals that more than one-third of cyber security executives at companies with revenues greater than $100 million are unable to see an attack once it finds its way inside the perimeter of their systems.

..............................

The problem is exacerbated when senior leadership defers to the IT department in all matters pertaining to information security. “That’s our CIO’s responsibility,” is a comment often heard when speaking with senior and chief executives about cyber defense.

................

While IT security departments certainly must bear responsibility, the executive leader at the top of any organization should understand and take ownership of the problem if security is to have a fighting chance of attaining the resources needed for effective self-defense.

.........................

.........................

Click here to read more ...... 
Solutions : www.xcyss.in

Pakistan plans bigger cyber attack?

A highly-classified government report on the recent incident of what has been described as the worst cyber attack on the country has said that it should not be treated as an 'isolated incident' as this exercise was not merely aimed at spreading communal hatred, but also to test the effectiveness of network of 'modules and sleeper cells' of subversive outfits in states like Karnataka, Andhra Pradesh, Maharashtra and Kerala.

.................................

Outfits like the Jamaat-e-Islami, Harkat-ul-Jihad-al-Islami, Simi and Indian Mujahideen are already on the watch list of intelligence agencies for spreading communally-sensitive messages and pictures that triggered a massive exodus of people from the Northeast.

Intelligence agencies in their report have warned that outfits like HuJI, Indian Mujahideen, Simi and even the PFI have a formidable network in southern India and have 'increased their support base manifold' in the last few yeas in Karnataka, Andhra Pradesh and Kerala.

Thus, the report adds, this incident should be treated as a warning signal to sensitise security agencies to launch a massive offensive against these groups in the affected states.

............................

...........................

Click here to read more ...... 
Solutions : www.xcyss.in

Targeted cyber attacks aimed at critical infrastructure

The trend we’ve seen until now is that targeted attacks use customised malware and refined targeted social engineering to gain unauthorised access to sensitive information. However, cyber criminals are increasingly targeting critical sectors including energy for mass destruction, say industry players.
......................
.................................

Symantec has identified a new series of targeted attacks, dubbed the Shamoon attacks, where critical infrastructure including power is coming under threat. According to the global security service provider’s July 2012 intelligence report, during the first half of the year, the total number of daily targeted attacks continued to increase at a minimum rate of 24 per cent with an average of 151 threats being blocked each day during May and June.

The report also states that globally the defence industry has been the biggest target in the first half of the year, with an average of 7.3 attacks per day.

India may not be immune to the global trend. After all, we became the top spam-sending nation during the first quarter of 2012. The country contributed to about 20 per cent of the globe’s total spam volume followed by Indonesia (13 per cent), South Korea (12 per cent), and Russia (10 per cent).
.....................................
Cyber criminals are abandoning spam emails only to resort to other more lucrative means such as targeted attacks.
...........................
Click here to read more ...... 
Solutions : www.xcyss.in

Balance Internet freedom with national security: US to India

The United States advised India to ensure Internet freedom while seeking to preserve national security, as the Indian government asked social networking websites like Facebook and Twitter to check pages carrying inflammatory messages.

................

................

The general principle of respect for freedom of expression, respect for the unique characteristics of the online environment, needs to be respected, even as they work through whether there are things these companies can do to help calm the environment..........

...................

Click here to read more ...... 
Solutions : www.xcyss.in

Living with the reality of virtual threats

The recent revelations of Pakistan-based websites unleashing doctored pictures of alleged atrocities against Muslims in order to inflame passions in India has once again drawn attention to the enormous potential of the Information Age to challenge our security assumptions.

The computer is the instrument of our age; cyberspace is the oxygen of the internet. So much in our interconnected, globalised, and technologically advancing world depends on cyberspace.

………………………

To a layman, cyber security means simple things: a password that is not stolen, a message that remains confidential, a child that is not exposed to a stalker or paedophile online. When they type in a web address, that is where they should go and not to a spam site. When they click a link that looks genuine, they should not be cheated by a plausible fraud. Their work online should not be tampered with, and so on……………..

THREATS to cyberspace

The international relations theorist Joseph Nye has discerned four different types of threats to cyberspace. The most dramatic is Cyber War — the unauthorised invasion by a government into the systems or networks of another, aiming to disrupt those systems, to damage them partially, or to destroy them entirely.

……………………………

Second threat is Cyber Espionage. Governments can invade the systems of their rivals to steal sensitive information that would be useful for their own purposes. These attacks are usually hard to discover and the case of Operation Shady RAT, the world’s biggest hacking ever, is rather phenomenal.

………………………….

Cyber Crime is the third kind of threat, and the most familiar. While this also has military and political implications, it affects the lives of ordinary Internet users more closely………………...

Cyber Crime also includes pornography, Internet stalking, and personality imitation.

Finally there is Cyber Terrorism. This includes websites spreading extremist propaganda, recruiting terrorists, planning attacks, and otherwise promoting terrorists’ political and social objectives………

Social networking websites are also increasingly becoming targets, not only because of the massive databases they provide, but also in order to spread malware that infect computers. On Facebook there are 50 million Indian users and even if a small fraction of them click unsuspectingly on a malevolent but seemingly ordinary link, you have that many computers opened up to risk and infection.

Another use of social networks, seen recently in India, is to spread inflammatory material with a motivated agenda, such as the doctored pictures of alleged atrocities against Muslims in Assam and Myanmar that incited violence in Mumbai and threats of retaliation elsewhere. Though this does not constitute cyber terrorism in itself, it constitutes a new security threat that cannot be ignored.

………………………..

India’s own style of dealing with cyber threats leaves much to be desired. It is relatively chaotic and there is a constant insecurity that our cyber-defences are insufficient.

…………………………………

…………………………………

Click here to read more ...... 
Solutions : www.xcyss.in

21-year-old Goan kills himself after MMS clip goes viral

A 21-year-old in Goa has killed himself after an MMS that featured him with his girlfriend went viral.

The police says that Arjun Mainkar from a village in North Goa, hanged himself on August 5 . His suicide note says that his girlfriend's family had allegedly threatened to harm his sister as revenge for the MMS.
..............

............

After the MMS was allegedly shot by Arjun, his family as well as his girlfriend's had decided that the couple should get married.

..........
..........
Click here to read more ...... 
Solutions : www.xcyss.in

‘Govt’s Internet crackdown needs to be transparent’

As the government cracks down on websites and social networks that it says are responsible for posting inflammatory and hateful content that led to a mass exodus of people from North-eastern states from south Indian cities, online activists are decrying the lack of transparency with which the government is blocking websites and content.

.....................

“The debate on social media diverts the attention from the issue at hand. While the spotlight is on the role of Twitter,Facebook, SMS and MMS in making people flee Bangalore, there is hardly any discussion on the socio-economic conditions of north-eastern people living in South India. Social media solely cannot be blamed for the events in Britain, Arab or India, said Commander Mukesh Saini (retired), a cyber security expert.

“Misinformation on social media itself cannot become into a monster unless supplemented with some real world information”, he said.

...................
...................

Click here to read more ...... 
Solutions : www.xcyss.in