Author Archives: Chris Bing

Inside the NSA’s CDX, a high-tech competition pitting cadets against elite attackers

Posted on by

Professional hackers from the NSA, U.S. Cyber Command and foreign militaries are launching a barrage of simulated cyberattacks this week as part of a training exercise to help teach students at the service academies for the Navy, Army, Coast Guard, U.S. Merchant Marine and Canadian Royal Military how to better defend sensitive computer networks. The annual NSA-led event, named the Cybersecurity Defense Exercise, or CDX, brings together rising talent with seasoned cyber-warriors in a simulated war games environment, where the undergraduates must monitor, identify and ultimately defend against a wide array of remote computer intrusions. The intrusions themselves are engineered with open-source, commercially available exploits and other hacking tools. “We don’t use anything homegrown,” said CDX Technical Lead James Titcomb, a full-time NSA employee in the spy agency’s information assurance directorate. “We don’t hit them with anything on the level of a nation-state,” Titcomb said. “The idea is that they should […]

The post Inside the NSA’s CDX, a high-tech competition pitting cadets against elite attackers appeared first on Cyberscoop.

Continue reading Inside the NSA’s CDX, a high-tech competition pitting cadets against elite attackers→

Symantec links CIA tools to mysterious group that hacked 40 organizations globally

Posted on by

Malware linked to the CIA, according to documents published by WikiLeaks, was used to hack into government, financial, telecom, energy, aerospace, education and natural resources organizations based in the Middle East, Europe, Asia and Africa, according to newly published research by Symantec. A blog post published Monday by the cybersecurity giant reads: ”spying tools and operational protocols detailed in the recent Vault 7 leak have been used in cyberattacks against at least 40 targets in 16 different countries by a group Symantec calls Longhorn.” On March 23, WikiLeaks began publishing individual packages of supposed CIA documents on nearly a weekly basis as part of a disclosure project it titled Vault 7. The controversial transparency organization redacted a majority of the executable code apparently evident in the original documents to stop readers from copying the digital weapons, according to WikiLeaks editor-in-chief Julian Assange. WikiLeaks’ documents provide descriptions about specific hacking tools […]

The post Symantec links CIA tools to mysterious group that hacked 40 organizations globally appeared first on Cyberscoop.

Continue reading Symantec links CIA tools to mysterious group that hacked 40 organizations globally→

DOJ, FBI officials say there’s been a surge in teenage hackers

Posted on by

A proliferation of cheap, easy-to-use hacking tools on the dark web is causing an increasing number of U.S. teenagers to commit computer crimes, according to FBI and Justice Department officials. Government lawyers are seeing such a noticeable spike in adolescent cases that reminds some of the late 1990s, when the term “script kiddies” was first coined. “When I first joined the computer crime prosecution business, you would have these grey haired lawyers who would talk about the 80s and 90s, when they were prosecuting like 13- and 16-year-olds but that [had] really dropped off,” said Josh Goldfoot, deputy chief of the DOJ’s Computer Crime and Intellectual Property Section.  “The 16-year-olds are coming back as a threat because it’s so easy now on the other side to acquire this type of stuff.” Adolescent hackers are once again becoming common, Goldfoot expounded, because of greater accessibility to exploit kits online and more […]

The post DOJ, FBI officials say there’s been a surge in teenage hackers appeared first on Cyberscoop.

Continue reading DOJ, FBI officials say there’s been a surge in teenage hackers→

NSA cyber-defense chief: ‘I have never been more busy’

Posted on by

The man responsible for leading the National Security Agency’s defensive mission says his team is fielding more calls than ever from agencies across the government. Dangerous, highly capable hackers and a desire by agencies to adopt cloud technology have increased the workload for Information Assurance chief Paul Pitelli and his office, which he says is “sort of like the Geek Squad for defense” in government. Pitelli is a career professional who has served in the NSA for more than 20 years as the secretive spy agency transformed into what it is today — a highly sophisticated technology behemoth with an array of federal responsibilities, including both signals intelligence and protecting sensitive government systems. With the recent retirement of former Information Assurance Directorate head Curtis Dukes, a renown computer scientist and intelligence community icon, Pitelli took on an increased role in an ever important effort to ensure that the Defense Department and broader government […]

The post NSA cyber-defense chief: ‘I have never been more busy’ appeared first on Cyberscoop.

Continue reading NSA cyber-defense chief: ‘I have never been more busy’→

Friction by design: FBI, DHS disagree on when to tell victims they’ve been hacked

Posted on by

Competing interests exist between two of the predominant federal agencies tasked with stopping hackers from attacking the U.S., officials say, and that dynamic shapes how and when the government notifies Americans if they’ve been breached. The Homeland Security Department and FBI follow distinctly different missions, and this extends into cyberspace, according to John Felker, director of the National Cybersecurity and Communications Integration Center. NCCIC is DHS’s around-the-clock office for incident awareness and response. Occasionally, DHS’s efforts to rapidly deploy software updates and immediately notify a victim when a cybersecurity incident occurs clashes with the FBI’s work to fully investigate and ultimately prosecute cybercriminals, Felker said Thursday. “There’s always going to be some tension between our mission space at DHS, which is asset response, threat mitigation — stop the bleeding, if you will — and law enforcement’s threat response, which is to catch a bad guy and make a successful prosecution,” Felker said during McAfee’s […]

The post Friction by design: FBI, DHS disagree on when to tell victims they’ve been hacked appeared first on Cyberscoop.

Continue reading Friction by design: FBI, DHS disagree on when to tell victims they’ve been hacked→

Chinese hacking unit spied on U.S. trade group ahead of Trump meeting, security firm claims

Posted on by

A prominent trade organization involved in economic policy discussions with the Trump administration was the target of a digital espionage operation with ties to the Chinese government, according to new research gathered by Fidelis Cybersecurity. The news comes as President Donald Trump prepares to meet Thursday with Chinese President Xi Jinping for the first time. The hacker group at the center of Fidelis’ report is known in the security research community as APT 10 — an elite unit with ties to China. One of APT 10’s signature spy tools, dubbed “Scanbox,” was found lurking on several webpages owned by the National Foreign Trade Council, including a digital registration form. The registration page is used by guests to schedule meetings and sign up for NFTC events. The organization says it has about 300 member companies. However, due to Scanbox, when a victim would visit the organization’s registration page they would be served reconnaissance […]

The post Chinese hacking unit spied on U.S. trade group ahead of Trump meeting, security firm claims appeared first on Cyberscoop.

Continue reading Chinese hacking unit spied on U.S. trade group ahead of Trump meeting, security firm claims→

Researcher finds vulnerability in popular microchips used in Android and iPhones

Posted on by

Security researchers have found a crucial vulnerability in a popular chipset used in smartphones that allows for an attacker to launch a remote, Wi-Fi delivered virus to a targeted device. Newer versions of Apple’s iPhone and many of Samsung’s flagship Android phones carry an affected Broadcom manufactured chipset. While Apple patched the vulnerability on Monday with the release of iOS 10.3.1, a variety of different Android devices remain susceptible to the proof-of-concept attack. An Apple security advisory concerning the vulnerability notes, “an attacker within range may be able to execute arbitrary code on the Wi-Fi chip.” iOS 10.3.1 fixes the issue by patching a “stack buffer overflow” problem, the advisory reads. The proof-of-concept exploit was developed by Google Project Zero researcher Gal Beniamini. Google plans to release its own patch in its April security bulletin, but the update will only be available to a “select number of device models,” according to […]

The post Researcher finds vulnerability in popular microchips used in Android and iPhones appeared first on Cyberscoop.

Continue reading Researcher finds vulnerability in popular microchips used in Android and iPhones→

North Korean hackers wanted investigators to think Russians hacked banks

Posted on by

A group of highly skilled bank-raiding hackers accused of working for the North Korean government is using tools that include computer code intended to make it appear like a Russian outfit is responsible, researchers say. Cybersecurity researchers tell CyberScoop that the group, dubbed Lazarus, is fusing Russian language strings into its tools in an effort to confuse defenders and obfuscate attribution. The technique, discovered by Kaspersky and presented Monday at the company’s Security Analyst Summit in St. Maarten, shows how sophisticated threat actors will design attacks in ways that make it more difficult for forensic analysts to track their activity. Lazarus mostly recently has been accused of stealing $81 million from Bangladesh Bank, and was blamed for the infamous Sony hack. A set of outdated Adobe Flash Player and Microsoft Silverlight exploits repeatedly  used by the Lazarus group carry Russian words like chainik, BabaLena, vyzov_chainika, and podgotovkaskotiny in the computer code. On […]

The post North Korean hackers wanted investigators to think Russians hacked banks appeared first on Cyberscoop.

Continue reading North Korean hackers wanted investigators to think Russians hacked banks→

‘Pegasus for Android’: Newly discovered spyware allows attacker to record conversations

Posted on by

Researchers at Google and mobile cybersecurity firm Lookout discovered a malicious smartphone application allowing the customers of a “cyber arms dealers” named NSO Group to remotely spy on victims. A sophisticated piece of spyware is believed to be embedded in a cohort of different espionage apps, enabling the attacker to record a target’s keystrokes, exfiltrate data and listen in on conversations through the device’s compromised microphone. The malware-laden applications were not available in the Google Play store, leading researchers to believe that targeted downloads were camouflaged and sent to specific victims through phishing emails or SMS messages. The malware was found on a few dozen Android devices. Dubbed Chrysaor, researchers believe the code is related Pegasus, another highly complex piece of malware designed to infect Apple’s iOS. Lookout researchers first discovered Pegasus, another product of NSO Group, last year on a prominent Saudi human rights activist’s phone. “Individual victim identities […]

The post ‘Pegasus for Android’: Newly discovered spyware allows attacker to record conversations appeared first on Cyberscoop.

Continue reading ‘Pegasus for Android’: Newly discovered spyware allows attacker to record conversations→

‘Pegasus for Android’: Newly discovered spyware allows attacker to record conversations

Posted on by

Researchers at Google and mobile cybersecurity firm Lookout discovered a malicious smartphone application allowing the customers of a “cyber arms dealers” named NSO Group to remotely spy on victims. A sophisticated piece of spyware is believed to be embedded in a cohort of different espionage apps, enabling the attacker to record a target’s keystrokes, exfiltrate data and listen in on conversations through the device’s compromised microphone. The malware-laden applications were not available in the Google Play store, leading researchers to believe that targeted downloads were camouflaged and sent to specific victims through phishing emails or SMS messages. The malware was found on a few dozen Android devices. Dubbed Chrysaor, researchers believe the code is related Pegasus, another highly complex piece of malware designed to infect Apple’s iOS. Lookout researchers first discovered Pegasus, another product of NSO Group, last year on a prominent Saudi human rights activist’s phone. “Individual victim identities […]

The post ‘Pegasus for Android’: Newly discovered spyware allows attacker to record conversations appeared first on Cyberscoop.

Continue reading ‘Pegasus for Android’: Newly discovered spyware allows attacker to record conversations→