Author Archives: Chris Bing

Inside the U.S.’ new state-of-the-art cyberwarfare bunker

Posted on by

The command post for any future U.S.-backed cyberwar is now officially open. Last week, NSA and U.S. Cyber Command leaders posed together and smiled for pictures during a ribbon-cutting ceremony to celebrate the completion of a new, state-of-the-art spy bunker named the “Integrated Cyber Center,” or ICC. Bland in name alone, the groundbreaking facility located inside Fort Meade in Maryland represents the latest step taken by the federal government to equip U.S. spies and a growing force of “cyberwarriors” with the physical infrastructure necessary to combat foreign threats online. Hackers linked to Russia, China, North Korea and Iran have each respectively penetrated important U.S. political groups, government agencies, entertainment studios and U.S. energy companies in recent years. These types of breaches have led lawmakers to openly question whether the federal government is doing enough to deter hackers. “Today we are at the dawn of a new era, facing the reality of wars […]

The post Inside the U.S.’ new state-of-the-art cyberwarfare bunker appeared first on Cyberscoop.

Continue reading Inside the U.S.’ new state-of-the-art cyberwarfare bunker→

Keith Alexander’s cybersecurity company scores huge $78M investment

Posted on by

A Maryland-based cybersecurity startup led by former NSA chief Keith Alexander has scored another big investment. IronNet Cybersecurity announced a $78 million Series B raise Thursday, adding to the $32 million it already pulled in 2015. The funding primarily comes from a group of blue-chip venture capital firms. Return investors Kleiner, Perkins, Caufield and Byers (KPCB) and ForgePoint Capital, previously named Trident Capital. In prepared remarks, company executives said that the fresh funding would be used to hire talent, refine products and expand services. IronNet employs a cadre of former U.S. intelligence and law enforcement officials, including a former NSA general counsel and the former director of operations for U.S. Cyber Command. Thursday’s news was accompanied by the first public description of IronNet’s recently released threat intelligence sharing platform, dubbed “IronDome.” The program is designed to help shared, industry-specific customers exchange data about active cyberthreats in a closed, decentralized pool […]

The post Keith Alexander’s cybersecurity company scores huge $78M investment appeared first on Cyberscoop.

Continue reading Keith Alexander’s cybersecurity company scores huge $78M investment→

Trump administration may throw out the approval process for cyberwarfare

Posted on by

Members of the White House’s National Security Council are pushing to rescind Presidential Policy Directive 20, an important policy memorandum that currently guides the approval process for government-backed cyberattacks, three current U.S. officials familiar with the matter tell CyberScoop. The effort is driven in part by a desire from some NSC staff to create a more streamlined channel for military leaders to get their offensive cyber operations greenlit, insiders familiar with the matter said. The sources spoke under the condition of anonymity to freely discuss sensitive national security matters. The move comes as lawmakers openly question whether U.S. Cyber Command, the nation’s premier cyber warfare unit, is hamstrung from responding to Russian meddling due to bureaucratic red tape. CyberScoop previously reported that multiple congressional committees are considering policies that could empower the military’s cyber mission. But the push for change faces resistance from the intelligence community and several other federal agencies involved in cybersecurity. Senior […]

The post Trump administration may throw out the approval process for cyberwarfare appeared first on Cyberscoop.

Continue reading Trump administration may throw out the approval process for cyberwarfare→

North Korea’s favorite anti-virus software is just an old, ripped off Trend Micro product

Posted on by

An anti-virus program that’s implemented throughout North Korea, software known as “SiliVaccine,” was built using old, ripped off code belonging to global cybersecurity giant Trend Micro, according to new research. The findings by Israeli firm Check Point show how North Korean software makers were able to leverage an illegally copied and repackaged code library to engineer a bootstrapped security platform. This suspicious anti-virus product is still reportedly used in North Korea to stop hackers from targeting the small group of dignitaries allowed to access the internet. Traditionally, Pyongyang has restricted internet usage to a small select segment of  the country’s population. Prior research by cybersecurity firm RecordedFuture detailed how North Korean royalty would use the internet to check popular social media sites and play online games. The SiliVaccine program acquired by Check Point was originally turned over by a South Korean journalist who received a phishing email, which contained other North […]

The post North Korea’s favorite anti-virus software is just an old, ripped off Trend Micro product appeared first on Cyberscoop.

Continue reading North Korea’s favorite anti-virus software is just an old, ripped off Trend Micro product→

Amid ongoing geopolitical tension, researchers find Pakistani hacking operation aimed at India

Posted on by

As well-crafted hacking tools become more ubiquitous, long simmering rivalries between developing nations take on a new dimension: cyber espionage runs rampant. Research released Thursday by Talos Security, Cisco’s internal cybersecurity unit, describes how a long running computer spying campaign against India was likely controlled by operators in Pakistan. Researchers highlighted a stealthy remote access trojan, dubbed “GravityRAT,” that’s been repetitively used to target Indian organizations since at least 2016. During that timeframe, the author of GravityRAT added new features and changed certain capabilities to make it more difficult to detect. This also included making the malware multilingual, so that whenever it was packaged inside a phishing email it had a better chance at tricking people who speak Chinese, Italian, French, German or Spanish. India’s computer emergency response team (CERT) previously published an advisory about GravityRAT, which suggests it targeted multiple Indian entities, according to Talos. The Indian CERT, however, only […]

The post Amid ongoing geopolitical tension, researchers find Pakistani hacking operation aimed at India appeared first on Cyberscoop.

Continue reading Amid ongoing geopolitical tension, researchers find Pakistani hacking operation aimed at India→

Researchers found a semi-legit way to turn an Amazon Echo into a wiretap

Posted on by

An Amazon Echo application created by security researchers proves how the popular smart home device can be co-opted to remotely listen to people’s nearby conversations, according to cybersecurity firm CheckMarx. The research describes how an inherent design flaw in the Amazon Echo could be exploited to covertly and remotely launch the Alexa voice assistant on compromised devices. Alexa was engineered to be able to record and react to voice commands within a predetermined distance from the device. During their controlled experiment, CheckMarx researchers disguised a malicious Echo skill by marketing it as a voice-enabled calculator application that leverages Alexa to execute certain commands. “It can be done totally remotely,” said Erez Yalon, manager of application security research at Checkmarx. “While a hacker creates a malicious skill and publish it to the Amazon store, every user that will use this Amazon skill is exposed.” CheckMarx says the trick didn’t “break or hack […]

The post Researchers found a semi-legit way to turn an Amazon Echo into a wiretap appeared first on Cyberscoop.

Continue reading Researchers found a semi-legit way to turn an Amazon Echo into a wiretap→

Cops shut down one of the largest DDoS marketplaces in the world

Posted on by

One of the largest distributed denial of service (DDoS) marketplaces has been shut down by European law enforcement. Webstresser.org, closed by Europol on Wednesday, boasted more than 100,000 users. It offered an array of services that allowed customers to wage attacks on specific targets that crippled internet infrastructure. DDoS attacks work by forcing a flood of artificial internet traffic to a website until the traffic overloads a target and causes it to crash. The traffic often comes from large networks of computer systems that were compromised prior to the attack. “We have a trend where the sophistication of certain professional hackers to provide resources is allowing individuals – and not just experienced ones – to conduct DDoS attacks and other kind of malicious activities online,” Steven Wilson, head of Europol’s European Cybercrime Centre (EC3), said in a statement. “It’s a growing problem, and one we take very seriously.” The shutdown is important […]

The post Cops shut down one of the largest DDoS marketplaces in the world appeared first on Cyberscoop.

Continue reading Cops shut down one of the largest DDoS marketplaces in the world→

The NSA now officially has a new chief

Posted on by

Gen. Paul Nakasone, an experienced military leader with a unique background in cyber-operations and intelligence gathering, has been approved to take over the National Security Agency and U.S. Cyber Command. The Senate confirmed Nakasone, who currently leads Army Cyber Command, by voice vote Tuesday morning. The promotion was expected for months and faced little opposition, but like most things in the Senate, it took some time to schedule. President Donald Trump nominated Nakasone for the job on Feb. 13. The previous NSA chief, Adm. Michael Rogers, is expected to officially retire soon after having served for four years at the top of the spy agency. During his tenure, the NSA attempted a massive reorganization effort known as “NSA21,” which combined certain components of the NSA’s defensive and offensive cyber teams for the first time. The current hierarchy, approved by Congress, prescribes that the leader of NSA is also simultaneously the head of U.S. Cyber Command, a still-nascent cyberwarfare […]

The post The NSA now officially has a new chief appeared first on Cyberscoop.

Continue reading The NSA now officially has a new chief→

A cybersecurity power struggle is brewing at the National Security Council

Posted on by

Senior government officials are worried about the outcome of an ongoing power struggle inside the National Security Council that will shape the fate of the nation’s cybersecurity posture. The arrival of newly appointed national security adviser John Bolton has prompted an attempted power grab by a member of the National Security Council, four current officials with knowledge of the matter told CyberScoop. This effort is causing anxiety across senior levels of government about the future of the cybersecurity coordinator role at the White House — a position that oversees a wide array of programs, including the management and coordination of defensive and offensive cyber-operations. Earlier this week, current Cybersecurity Coordinator Rob Joyce announced his intention to leave the position and return to the National Security Agency, where he spent more than two decades. He will remain in the White House position for another month to help with the transition process. The sources, who spoke […]

The post A cybersecurity power struggle is brewing at the National Security Council appeared first on Cyberscoop.

Continue reading A cybersecurity power struggle is brewing at the National Security Council→

Nation state hackers attempted to use Equifax vulnerability against DoD, NSA official says

Posted on by

A government-backed hacking group tried to breach the Department of Defense via the exact same software vulnerability that was used to breach Equifax, an official with the National Security Agency said Tuesday during a speech at the 2018 RSA conference. “The vulnerability that took down Equifax last year when it was released in March, we had a nation-state actor within 24 hours scanning looking for unpatched servers within the DoD,” said David Hogue, a senior technical director for the NSA’s Cybersecurity Threat Operations Center (NCTOC). The malicious activity caught by NSA shows how most attackers, regardless of skill or available resources, will first rely on simplistic and easily accessible methods to compromise their victims. In this case, the attackers relied on a known vulnerability in the Apache Struts software framework to target the DoD. Hogue said that most data breach incidents that are analyzed by his team are caused by phishing […]

The post Nation state hackers attempted to use Equifax vulnerability against DoD, NSA official says appeared first on Cyberscoop.

Continue reading Nation state hackers attempted to use Equifax vulnerability against DoD, NSA official says→