Security

Russian Cybersecurity Giant Kaspersky Tries To Maintain Neutrality During Ukraine War (vice.com) 161

Posted by BeauHD from the time-to-pick-a-side dept.
An anonymous reader quotes a report from Motherboard, written by Joseph Cox: Around the same time Russian forces launched a massive rocket into a square in Kharkiv, Ukraine's second-largest city, killing and wounding an as of yet unknown number of people, Eugene Kaspersky, head of his namesake Russian cybersecurity firm, tweeted that he hoped negotiations between Ukraine and Russia would lead to "a compromise." The statement encapsulates the company's position since Russia invaded Ukraine six days ago -- that of attempted neutrality in a war where silence or fence sitting is implicitly siding with the Russian forces. In another statement to Motherboard sent on Monday, the company said "As a technology and cybersecurity service provider the company is not in a position to comment or speculate on geopolitical developments outside of its area of expertise."

Kaspersky is one of the best-known Russian companies, and for years its antivirus product has been among the most used in the world. The antivirus software also harvests telemetry data for Kaspersky's researchers who can then use that to identify and counter new threats. Its researchers are some of the best in the world, with its Global Research & Analysis Team (GReAT) regularly publishing leading research on various government malware operations. Famously the company first revealed details of a U.S. government hacking group that it dubbed Equation Group. Kaspersky has also researched suspected Russian government linked hackers. Eugene's tweet also brings something else to the surface again: how much is Kaspersky, the company, influenced by the Russian government, even if indirectly? As a Russian firm operating in Moscow under Russian laws, it may feel the need to toe the line on Russian issues.

Kaspersky's company statement on Monday added that "Kaspersky is focused on its mission to build a safer world. For 25 years, the company delivers deep threat intelligence and security expertise that is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. Kaspersky's business operations remain stable. The company guarantees the fulfillment of its obligations to partners and customers -- including product delivery and support and financial transaction continuity. The global management team is monitoring the situation carefully and is ready to act very quickly if needed." Kaspersky may not currently feel it is in a position to speculate or take a position on the invasion of Ukraine. But with a 40 mile long Russian military convoy making its way to Kyiv, and with the prospect of more cyber attacks playing a role in the invasion, Kaspersky may need to take a side.
IT

Web Hosting Provider Namecheap To Ban Russia-Based Users, Citing Ukraine (pcmag.com) 136

Posted by msmash from the how-about-that dept.
Domain and web hosting provider Namecheap is terminating all service with the company's Russian-based users over the Kremlin's invasion of Ukraine. From a report: "Unfortunately, due to the Russian regime's war crimes and human rights violations in Ukraine, we will no longer be providing services to users registered in Russia," US-based Namecheap told Russian users in an email on Monday. The company is asking Russian users to transfer their domains to another provider by March 6. Otherwise their sites will resolve to a 403 Forbidden page. In addition, Namecheap has begun blocking Russian clients from using the company's web hosting and private email services over Russian internet domains, including .ru and .su. "While we sympathize that this war may not affect your own views or opinion on the matter, the fact is, your authoritarian government is committing human rights abuses and engaging in war crimes so this is a policy decision we have made and will stand by," the company added. The decision has caused some Russian users to complain they've been unfairly targeted. "Whoever came up with this idea is an idiot and should be fired," wrote one user on Twitter, who claims Namecheap is "blanket targeting" civilians, instead of going after Russia's government.
Security

Nvidia Says Employee, Company Information Leaked Online After Cyber Attack (cnn.com) 9

Posted by msmash from the security-woes dept.
U.S. chipmaker Nvidia said on Tuesday a cyber attacker has leaked employee credentials and some company proprietary information online after their systems were breached. From a report: "We have no evidence of ransomware being deployed on the Nvidia environment or that this is related to the Russia-Ukraine conflict," the company's spokesperson said in a statement. The Santa Clara, California-based company said it became aware of the breach on Feb. 23. Nvidia added it was working to analyze the information that has been leaked and does not anticipate any disruption to the company's business. A ransomware outfit under the name "Lapsus$" has reportedly claimed to be responsible for the leak and seemingly has information about the schematics, drivers and firmware, among other data, about the graphics chips.
Security

Nvidia Allegedly Hacks Hackers Who Stole Company's Data (tomshardware.com) 57

Posted by BeauHD from the two-can-play-that-game dept.
According to Vx-underground on Twitter, Nvidia has reportedly retaliated against the hacker group that stole over 1TB of the company's data by sneaking back into the hacker's system and encrypting the stolen data. Tom's Hardware reports: LAPSU$, an extortion group in South America, had illegally tapped into Nvidia's mailing server and installed malware on the software distribution server. As a result, the hacker group purportedly extracted over 1TB of Nvidia's data. However, it's unknown what kind of data the hackers had stolen, whether Nvidia's or its clients' data. It would seem that Nvidia has identified the attackers. According to the Vx-underground's Twitter post and backed by screenshots, the chipmaker has infected the perpetrators' system with ransomware and encrypted the stolen data in response to the attack. The group claimed that it had a backup of the data, though.
China

New Chinese Hacking Tool Found, Spurring US Warning To Allies (reuters.com) 14

Posted by BeauHD from the lurking-in-the-shadows dept.
Security researchers with U.S. cybersecurity firm Symantec said they have discovered a "highly sophisticated" Chinese hacking tool that has been able to escape public attention for more than a decade. Reuters reports: The discovery was shared with the U.S. government in recent months, who have shared the information with foreign partners, said a U.S. official. Symantec, a division of chipmaker Broadcom, published its research about the tool, which it calls Daxin, on Monday. "It's something we haven't seen before," said Clayton Romans, associate director with the U.S. Cybersecurity Infrastructure Security Agency (CISA). "This is the exact type of information we're hoping to receive."

CISA highlighted Symantec's membership in a joint public-private cybersecurity information sharing partnership, known as the JCDC, alongside the new research paper. The JCDC, or Joint Cyber Defense Collaborative, is a collective of government defense agencies, including the FBI and National Security Agency, and 22 U.S. technology companies that share intelligence about active cyberattacks with one another. Symantec's attribution to China is based on instances where components of Daxin were combined with other known, Chinese-linked computer hacker infrastructure or cyberattacks, said Vikram Thakur, a technical director with Symantec. [...] "Daxin can be controlled from anywhere in the world once a computer is actually infected," said Thakur. "That's what raises the bar from malware that we see coming out of groups operating from China."
Security

Ukraine Says Its 'IT Army' Has Taken Down Key Russian Sites (bleepingcomputer.com) 60

Posted by msmash from the tussle-continues dept.
Key Russian websites and state online portals have been taken offline by attacks claimed by the Ukrainian cyber police force, which now openly engages in cyber-warfare. From a report: As the announcement of the law enforcement agency's site details, specialists from the force have teamed with volunteers to attack the web resources of Russia and Belarus. The three countries are currently involved in an ongoing and large-scale armed forces conflict that includes a cyber frontline, which manifested even before the invasion. The Ukrainian cyber police have announced having targeted the websites of the Investigative Committee of the Russian Federation, the FSB (Federal Security Service), and the Sberbank, Russia's state-owned bank.
Microsoft

Microsoft Detected 'Destructive Cyberattacks' Against Ukraine Hours Before Russian Invasion (geekwire.com) 26

Posted by msmash from the how-about-that dept.
Microsoft says it began detecting "destructive cyberattacks directed against Ukraine's digital infrastructure" several hours before the Russian military began launching missiles or moving tanks into the country last week. From a report: The disclosure Monday, part of a larger blog post about Ukraine by Microsoft President Brad Smith, provides a glimpse of how cyber-warfare is being used as part of the ongoing invasion. The company says it is giving ongoing guidance to the Ukrainian government about cyberthreats as the situation unfolds. Smith also outlined the company's efforts to combat state-sponsored disinformation campaigns, ensuring that its platforms are not displaying or distributing any content or apps from Russia's state-sponsored RT and Sputnik news organizations, in line with a recent European Union decision. He wrote that there's "a well-orchestrated battle ongoing in the information ecosystem where the ammunition is disinformation, undermining truth and sowing seeds of discord and distrust," he wrote.
Security

Toyota Suspends Domestic Factory Operations After Suspected Cyber Attack (reuters.com) 27

Posted by msmash from the security-woes dept.
Toyota said it will suspend domestic factory operations on Tuesday, losing around 13,000 cars of output, after a supplier of plastic parts and electronic components was hit by a suspected cyber attack. From a report: No information was immediately available about who was behind the possible attack or the motive. The attack comes just after Japan joined Western allies in clamping down on Russia after it invaded Ukraine, although it was not clear if the attack was at all related. Japanese Prime Minister Fumio Kishida said his government would investigate the incident and whether Russia was involved. Kishida on Sunday announced that Japan would join the United States and other countries in blocking some Russian banks from accessing the SWIFT international payment system. He also said Japan would give Ukraine $100 million in emergency aid.
Security

Conti Ransomware Gang Chats Leaked by Pro-Ukraine Member (therecord.media) 27

Posted by msmash from the security-woes dept.
A member of the Conti ransomware group, believed to be Ukrainian of origin, has leaked the gang's internal chats after the group's leaders posted an aggressive pro-Russian message on their official site, on Friday, in the aftermath of Russia's invasion of Ukraine. From a report: The message appears to have rubbed Conti's Ukrainian members the wrong way, and one of them has hacked the gang's internal Jabber/XMPP server. Internal logs were leaked earlier today via an email sent to multiple journalists and security researchers. Dmitry Smilyanets, a threat intelligence analyst for Recorded Future, who has interacted with the Conti gang in the past, has confirmed the authenticity of the leaked conversations. The leaked data contains 339 JSON files, with each file consisting of a full day's log. Conversations from January 29, 2021, to last February 27, 2022, have been leaked and can be read online here, courtesy of security firm IntelligenceX.
Security

Ukraine Official Urges 'IT Army' of World's Digital Talent To Attack Russian Energy and Financial Firms (venturebeat.com) 149

Posted by FirehoseFavorites from the joining-the-army dept.
VentureBeat reports: In Ukraine today, Mykhailo Fedorov, the country's vice prime minister, announced on Twitter, "We are creating an IT army."

"We need digital talents," wrote Fedorov, who also holds the title of minister of digital transformation — sharing a link to a Telegram channel where he said operational tasks will be distributed. "We continue to fight on the cyber front." On the Telegram channel, the IT army reportedly posted its list of Russian targets — which were also translated into English "for all IT specialists from other countries...."

On Friday, Christian Sorensen, a former U.S. Cyber Command official, told VentureBeat that "hacktivists around the world [will be] working against Russia, because they are the aggressor.... I think things will ramp up against western targets, but Russia and Belarus will be targeted by these groups even more" said Sorensen, formerly the operational planning team lead for the U.S. Cyber Command....

[O]n Friday, a Bloomberg report said that a hacker group that was now forming to bring counterattacks against Russia had amassed 500 members. And today, we have the announcement of Ukraine's IT army — potentially including assistance from hackers around the globe. "Whether sanctioned or not, official or not, if people have or can get the right information, know-how, and desire — they can make an impact," Sorensen said on Friday, prior to the announcement of Ukraine's IT army. "We'll have to wait and see what they are able to do."
The next day Reuters reported that the official website of the Kremlin, "the office of Russian President Vladimir Putin....was down on Saturday, following reports of denial of service (DDoS) attacks on various other Russian government and state media websites.

"The outages came as Ukraine's vice prime minister said it had launched an 'IT army' to combat Russia in cyberspace."

But the Independent reports that the cyberattacks may have been even more extensive: Ukraine's state telecommunications agency announced on Saturday that six Russian government websites, including the Kremlin's, were down, according to The Kyiv Independent.

The agency also stated that the Russian media regulator's website had gone down, and that hackers had got Russian TV channels to play the Ukrainian music.

Note from Slashdot: the blue/purple bar means the story was posted automatically from the firehose without a Slashdot editor selecting it. This happens when a story gets a huge amount of upvotes in the firehose.
Bitcoin

How a US Tech Firm Struggled to Get Its Employees Out of Kyiv (washingtonpost.com) 167

Posted by EditorDavid from the war-zones dept.
On Friday the Washington Post's live updates on the Russia-Ukraine situation included the story of a tech firm trying to get its employees out of Kyiv: John Sung Kim, chief executive of the software outsourcing company JetBridge, has been communicating with his 24 employees in Kyiv, all software developers, through Slack. Half of them are trying to leave Ukraine, but Kim says he is struggling to help them and has been unable to get them train tickets, a rental car or gasoline.

"The other half of my team wants to stay and fight," said Kim. "I got on an all-hands with them this morning and told them it's not their responsibility to be soldiers and there's other ways they can contribute since they're software engineers, but there's nothing I can say to dissuade them." Kim said JetBridge's clients are almost exclusively Silicon Valley tech companies that are publicly traded or have raised venture capital financing. "The universal issue other than transportation logistics seems to be grandparents. 'My babushka' is the common theme of why they're torn from actually leaving," he said. The fallout from Russia's invasion has also impacted JetBridge's employees in Belarus. "The males in Belarus are scared that there's going to be military conscription, and unlike the Ukrainians, my Belarusian engineers have zero desire to pick up a rifle. Zero," he said.

In anticipation of European Union sanctions on Belarus, Kim said JetBridge has started paying employees in bitcoin.
EU

NATO Secretary-General Warns Cyberattacks Could Trigger Article 5 (nbcnews.com) 73

Posted by BeauHD from the latest-developments dept.
NATO Secretary-General Jens Stoltenberg said Friday that cyberattacks could trigger Article 5 of the organization's charter, the so-called "commitment clause" that considers an attack on any NATO ally an attack on all. NBC News reports: Stoltenberg's comment comes as national security professionals and cybersecurity industry professionals remain on high alert for any major attacks. While conflict on the ground in Ukraine continues to escalate, little has been seen thus far in terms of major cyberwar activities. Still, some hacker and activist groups have sprung into action. One ransomware group announced Friday that it supported the Russian government and would respond to cyberattacks on Russia by going after "critical infrastructures of an enemy." As for attacks on Ukraine, the country's computer emergency response team said Friday that it had seen a large email phishing campaign from Belarus targeted at military personnel. The statement comes amid a major cyberattack on Nvidia that was initiated at the same time as the Russian cyber warfare division started their offensive against Ukraine. Security researchers are concerned that somebody could put something malicious in one of the software updates that are then sent out to Nvidia's clients.
Security

NVIDIA Hit By Major Cyberattack That May Have 'Completely Compromised' Parts of Its Business (wccftech.com) 48

Posted by BeauHD from the suspicious-timing dept.
An anonymous reader quotes a report from Wccftech: NVIDIA has seemingly been hit by a major cyberattack that may have completely compromised parts of its business, reports The Telegraph. In their exclusive report, The Telegraph reports that the cyberattack was initiated at the same time as the Russian cyber warfare division started their offensive against Ukraine. All Nato allies have announced major sanctions on Russia and this could potentially be why Russia has decided to target major companies such as NVIDIA.

The report further states that the cyberattack on NVIDIA has completely compromised parts of their business and there are already reports from several users coming in regarding services disruption. The scale of this attack is currently unknown but it clearly seems to be a major one as NVIDIA had to take several systems offline to pacify the intrusion before it could spread further: "'The ultimate concern is that somebody may have put something in one of the software updates,' Dr Woodward said, pointing to the devastating SolarWinds hack that exploited American software companies to gain access to US government computer systems. 'They'll be going through trying to make sure to see if there's any indication that anything has been changed in their software that they then shipped to their clients.'" NVIDIA's mail servers were also partially operational during this time so it's entirely likely that there might have been a breach in confidential documents. But it is not confirmed yet if any data was stolen. In a brief statement, an Nvidia spokesperson confirmed the report, saying: "We are investigating an incident. We don't have any additional information to share at this time."
Security

Ukraine Says Belarusian Hackers Are Targeting Its Defense Forces (techcrunch.com) 29

Posted by msmash from the closer-look dept.
Ukrainian cybersecurity officials have warned that Belarusian state-sponsored hackers are targeting the private email addresses of Ukrainian military personnel. From a report: Announcing the activity in a Facebook post, Ukraine's Computer Emergency Response Team (CERT-UA) said that a mass phishing campaign is targeting the private i.ua and meta.ua accounts belonging to Ukrainian military personnel. "After the account is compromised, the attackers, by the IMAP protocol, get access to all the messages," it added. "Later, the attackers use contact details from the victim's address book to send the phishing emails." CERT-UA has attributed the ongoing campaign to the UNC1151 threat group, which Mandiant formally linked to the Belarusian government in November 2021. Mandiant also linked the state-backed cyber-espionage group to the Ghostwriter disinformation campaign, which has been involved in spreading anti-NATO rhetoric and hack-and-leak operations throughout Europe. "The Minsk-based group 'UNC1151' is behind these activities. Its members are officers of the Ministry of Defence of the Republic of Belarus," CERT-UA wrote.
Security

Ukraine Calls on Hacker Underground To Defend Against Russia (reuters.com) 44

Posted by msmash from the security-woes dept.
The government of Ukraine is asking for volunteers from the country's hacker underground to help protect critical infrastructure and conduct cyber spying missions against Russian troops, according two people involved in the project. From a report: As Russian forces attacked cities across Ukraine, requests for volunteers began to appear on hacker forums on Thursday morning, as many residents fled the capital Kyiv. "Ukrainian cybercommunity! It's time to get involved in the cyber defense of our country," the post read, asking hackers and cybersecurity experts to submit an application via Google docs, listing their specialties, such as malware development, and professional references. Yegor Aushev, co-founder of a cybersecurity company in Kyiv, told Reuters he wrote the post at the request of a senior Defense Ministry official who contacted him on Thursday. Aushev's firm Cyber Unit Technologies is known for working with Ukraine's government on the defense of critical infrastructure. Another person directly involved in the effort confirmed that the request came from the Defense Ministry on Thursday morning. Further reading: Washington steels for Russian cyberattacks.
Cellphones

Samsung Shattered Encryption On 100 Million Phones (threatpost.com) 20

Posted by BeauHD from the embarrassingly-bad dept.
Samsung shipped an estimated 100 million smartphones with botched encryption, including models ranging from the 2017 Galaxy S8 on up to last year's Galaxy S21. Threatpost reports: Researchers at Tel Aviv University found what they called "severe" cryptographic design flaws that could have let attackers siphon the devices' hardware-based cryptographic keys: keys that unlock the treasure trove of security-critical data that's found in smartphones. What's more, cyber attackers could even exploit Samsung's cryptographic missteps -- since addressed in multiple CVEs -- to downgrade a device's security protocols. That would set up a phone to be vulnerable to future attacks: a practice known as IV (initialization vector) reuse attacks. IV reuse attacks screw with the encryption randomization that ensures that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts will each be distinct.

The design flaws primarily affect devices that use ARM's TrustZone technology: the hardware support provided by ARM-based Android smartphones (which are the majority) for a Trusted Execution Environment (TEE) to implement security-sensitive functions. TrustZone splits a phone into two portions, known as the Normal world (for running regular tasks, such as the Android OS) and the Secure world, which handles the security subsystem and where all sensitive resources reside. The Secure world is only accessible to trusted applications used for security-sensitive functions, including encryption.

Matthew Green, associate professor of computer science at the Johns Hopkins Information Security Institute, explained on Twitter that Samsung incorporated "serious flaws" in the way its phones encrypt key material in TrustZone, calling it "embarrassingly bad." "They used a single key and allowed IV re-use," Green said. "So they could have derived a different key-wrapping key for each key they protect," he continued. "But instead Samsung basically doesn't. Then they allow the app-layer code to pick encryption IVs." The design decision allows for "trivial decryption," he said.

Samsung responded to the academics' disclosure by issuing a patch for affected devices that addressed CVE-2021-25444: an IV reuse vulnerability in the Keymaster Trusted Application (TA) that runs in the TrustZone. Keymaster TA carries out cryptographic operations in the Secure world via hardware, including a cryptographic engine. The Keymaster TA uses blobs, which are keys "wrapped" (encrypted) via AES-GCM. The vulnerability allowed for decryption of custom key blobs. Then, in July 2021, the researchers revealed a downgrade attack -- one that lets attacker trigger IV reuse vulnerability with privileged process. Samsung issued another patch -- to address CVE-2021-25490 -- that remoged the legacy blob implementation from devices including Samsung's Galaxy S10, S20 and S21 phones.
United States

US Firms Brace for Potential Cyberattacks as Russia Threatens Critics (bloombergquint.com) 41

Posted by msmash from the shape-of-things-to-come dept.
A swath of major American businesses -- from major banks to utility companies -- is preparing for possible cyberattacks against their computer networks as Russia on Thursday threatened "consequences" for nations that interfere with its invasion of Ukraine. From a report: Their concerns, echoed in C-suites and around Washington, follow recent warnings from the Biden administration that U.S. firms should harden their defenses against potential cyberattacks that could disrupt the nation's critical infrastructure. American officials say there are no current threats against the U.S. But they have nonetheless urged organizations to plan for worst-case scenarios and more aggressively monitor their computer networks for possible intrusions.

"Right now, everybody needs to be at a heightened alert in the event this continues to escalate, and Russia tries to sway political opinion by causing damage in the United States and its Western allies," said David Kennedy, the chief executive officer of security firm TrustedSec. He said companies should be going through their computer infrastructure "with a fine-tooth comb" to ensure previous intrusions can't be used to cause future, more damaging, attacks. Major U.S. banks, for instance, fear aggressive cyberattacks if Washington imposes deeper financial sanctions on Russia, said two banking executives who spoke on condition of anonymity to discuss private conversations. CEOs of major financial firms and their cybersecurity experts recently met with Treasury officials as Russian threats of war intensified, according to the executives.
Security

Utility Promising To Restore Mining Performance on Nvidia GPUs Actually Malware (web3isgoinggreat.com) 23

Posted by msmash from the closer-look dept.
Web3 is Going Great reports: The popular Tom's Hardware and PC Gamer websites both ran articles about a utility called "Nvidia RTX LHR v2 Unlocker", which claimed to increase the artificially-limited cryptocurrency mining performance of its RTX graphics cards. These graphics cards are shipped with performance-limiting software to reduce the GPUs' attractiveness to cryptocurrency miners, whose thirst for GPUs has made it difficult and expensive for gamers and various others to acquire the hardware. Unfortunately, both publications had to run a second article just a day later to warn their readers away from the software they had just advertised.
China

Chinese Cybersecurity Company Doxes Apparent NSA Hacking Operation (vice.com) 18

Posted by BeauHD from the rare-attributions dept.
An anonymous reader quotes a report from Motherboard: A Chinese cybersecurity company accused the NSA of being behind a hacking tool used for ten years in a report published on Wednesday. The report from Pangu Lab delves into malware that its researchers first encountered in 2013 during an investigation into a hack against "a key domestic department." At the time, the researchers couldn't figure out who was behind the hack, but then, thanks to leaked NSA data about the hacking group Equation Group -- widely believed to be the NSA -- released by the mysterious group Shadow Brokers and by the German magazine Der Spiegel, they connected the dots and realized it was made by the NSA, according to the report.

"The Equation Group is the world's leading cyber-attack group and is generally believed to be affiliated with the National Security Agency of the United States. Judging from the attack tools related to the organization, including Bvp47, Equation group is indeed a first-class hacking group," the report read, referring to the name of the tool the researchers found. "The tool is well-designed, powerful, and widely adapted. Its network attack capability equipped by 0day vulnerabilities was unstoppable, and its data acquisition under covert control was with little effort. The Equation Group is in a dominant position in national-level cyberspace confrontation." Further Reading: Anatomy of Top-Tier Suspected NSA Backdoor Code (The Register)
Security

Cyberattack Hits Ukrainian Banks and Government Websites (cnbc.com) 19

Posted by msmash from the tussle-continues dept.
Several Ukrainian government websites were offline Wednesday as a result of a mass distributed denial of service attack, Mykhailo Fedorov, head of Ukraine's Ministry of Digital Transformation, said in his Telegram channel. From a report: The attack, which also impacted some banks, began around 4 p.m. local time, according to Fedorov. He didn't say which banks were attacked or what the extent of the damage was. Websites for the Ukrainian Ministry of Foreign Affairs, Cabinet of Ministers and Rada, the country's parliament, were among those down as of Wednesday morning Eastern time. The government sites were offline as officials attempted to switch traffic elsewhere to minimize damage, he said. A DDoS attack is when a hacker floods a victim's network or server with traffic so that others are unable to access it.

Slashdot Top Deals