Author Archives: Shannon Vavra

Chinese hackers stole another NSA-linked hacking tool, research finds

Posted on by

The U.S. intelligence community was rocked in 2017 when a group of mysterious hackers known as the Shadow Brokers leaked a trove of National Security Agency hacking tools for public consumption. The exact identity of the leakers remains unknown to this day. According to a growing body of security research, though, hackers with suspected links to the Chinese government may have had access to some of the same tools before they were published, and the Shadow Brokers may not be the only thieves the U.S. intelligence community has to worry about. According to new research from Israeli security firm Check Point published Monday, a group of Chinese hackers known as APT31 appear to have copied an exploit developed by Equation Group, a hacking group broadly believed to be associated with the NSA, more than two years before the Shadow Brokers leaked the trove of NSA tools. The exploit, which Check […]

The post Chinese hackers stole another NSA-linked hacking tool, research finds appeared first on CyberScoop.

Continue reading Chinese hackers stole another NSA-linked hacking tool, research finds→

Allegations of planted evidence raise questions about hacking ecosystem in India

Posted on by

Recent allegations that planted evidence may have been used to frame an activist in a terrorism case are raising new questions about the surveillance and hacking ecosystem in India. The human rights activist in question, Rona Wilson, is one of several people accused of plotting to overthrow the Indian government in connection with a violent demonstration in Bhima Koregaon, India in 2017. Wilson is among the several activists accused of instigating violence at the demonstration. Cases against the defendants have largely relied on digitally-collected evidence, according to Amnesty International. He has been incarcerated for nearly three years. A new forensic analysis of Wilson’s computer, conducted by Boston-based Arsenal Consulting, is now raising questions about the viability of the evidence, who put it there and the extent to which hacking in India is used to further the government’s prosecutions. Details about the ecosystem of surveillance and cyber mercenary groups in India […]

The post Allegations of planted evidence raise questions about hacking ecosystem in India appeared first on CyberScoop.

Continue reading Allegations of planted evidence raise questions about hacking ecosystem in India→

Misinformation flooded Parler around Capitol insurrection, research finds

Posted on by

The overwhelming majority of news links shared on Parler in the days surrounding the Capitol insurrection last month were filled with misinformation, according to an analysis by NewsGuard and PeakMetrics. In all, 87% of news links shared on Parler around the Jan. 6 riots contained misinformation, the analysis published Wednesday concluded.  One of the most popular sites shared across the social networking platform was a site that appeared to be an American news outlet, called American Conservatives Today, but which actually was run from North Macedonia and plagiarized stories from The Gateway Pundit. The site, which was created in December of last year, spread lies that the voting equipment maker Dominion Voting Systems was switching votes from then-President Donald Trump to then-candidate Joe Biden. Other popular misinformation-based sites that spread falsehoods on Parler included a video website linked with Alex Jones, InfoWars.com’s founder, which spread lies that Biden was interested […]

The post Misinformation flooded Parler around Capitol insurrection, research finds appeared first on CyberScoop.

Continue reading Misinformation flooded Parler around Capitol insurrection, research finds→

White House warns SolarWinds breach cleanup will take time

Posted on by

The White House has a message for America: it’s going to take a long time to sort through the fallout from the massive espionage operation spurred on by the SolarWinds breach uncovered late last year. Deputy National Security Advisor for Cyber and Emerging Technology Anne Neuberger stressed during a White House briefing Wednesday that the way the suspected Russian hackers infiltrated a SolarWinds network management software update with malicious code has made it more difficult for federal investigators to track down the details of the compromise. “We believe it took them months to plan and execute this compromise. It will take us some time to uncover this layer by layer,” Neuberger said, estimating it will take a number of months for the U.S. government to get its hands around the issue properly. “Many of the private sector compromises are technology companies including networks of companies whose products can be used […]

The post White House warns SolarWinds breach cleanup will take time appeared first on CyberScoop.

Continue reading White House warns SolarWinds breach cleanup will take time→

Nigerian man sentenced 10 years for $11 million phishing scam

Posted on by

A Nigerian national, Obinwanne Okeke, has been sentenced to 10 years in prison for allegedly coordinating an international spearphishing campaign that has cost victims approximately $11 million in losses. The scheme, which lasted from 2015 to 2019, targeted Unatrac Holding Limited, a British firm that acted as the export sales office for Caterpillar, with fake invoices and wire transfer requests. The FBI opened an investigation into the alleged scam in 2018 after Unatrac raised alarm about an email compromise operation that had targeted the firm, according to court documents. The scheme collected the credentials of hundreds of victims over the course of the operation, according to the FBI press release on the matter. It’s the kind of business email compromise scam that plagues businesses around the world. There were $1.7 billion worth of losses caused by BEC scams in 2019 alone, the most recent year the FBI has published data […]

The post Nigerian man sentenced 10 years for $11 million phishing scam appeared first on CyberScoop.

Continue reading Nigerian man sentenced 10 years for $11 million phishing scam→

Flaw in popular video software Agora could have let eavesdroppers in on private calls

Posted on by

An error in a popular video calling software development kit could have allowed hackers to spy on private video and audio calls through services including eHarmony or Talkspace, according to McAfee research published Wednesday. The flaw, which stems from an encryption error, affected a video-calling software development kit (SDK) developed by Agora.io that is used by dating services such as eHarmony, Plenty of Fish, MeetMe and Skout and medical applications such as Talkspace, Practo and Dr. First’s Backline, according to McAfee. Agora is used by 1.7 billion devices for a whole host of applications used for educational, retail and gaming purposes as well as for other socializing reasons, the company says. The flaw, known as CVE-2020-25605, is accounted for in an update Agora issued in mid-December, according to McAfee. Agora did not immediately respond to a request for comment. McAfee’s Advanced Threat Research team does not have any evidence that the […]

The post Flaw in popular video software Agora could have let eavesdroppers in on private calls appeared first on CyberScoop.

Continue reading Flaw in popular video software Agora could have let eavesdroppers in on private calls→

Warrantless searches of devices at border allowed, appeals court finds

Posted on by

The U.S. Court of Appeals for the First Circuit ruled earlier this week that Customs and Border Protection agents may conduct warrantless searches of cellphones and electronic devices at the U.S. border, in a ruling that is already raising privacy questions among digital rights advocates. The decision, issued by a panel of judges and authored by Judge Sandra Lynch, states that the government’s interest in searching persons at the border is “at its zenith,” therefore trumping privacy concerns. “Electronic device searches do not fit neatly into other categories of property searches, but the bottom line is that basic border searches of electronic devices do not involve an intrusive search of a person,” Lynch writes. The decision is at odds with an earlier district court finding that these kinds of searches violate the Fourth Amendment because there’s no assurance there is a “reasonable suspicion” that the devices in question contained digital […]

The post Warrantless searches of devices at border allowed, appeals court finds appeared first on CyberScoop.

Continue reading Warrantless searches of devices at border allowed, appeals court finds→

Proofpoint sues Facebook over dummy sites used for anti-phishing training

Posted on by

Proofpoint has filed a lawsuit against Facebook arguing that it should be allowed to use domains that imitate the Facebook and Instagram brands to test customers’ ability to avoid online scams. Cybercriminals often imitate popular brands’ sites, including Facebook and Instagram, to dupe unsuspecting users, then pilfer their credentials or distribute malware. Proofpoint is one of several security companies that provides customers with phishing training that includes look-alike domains of popular brands in order to test clients’ wits on avoiding common cons. By sending messages that appear to be from “Instagrarn” rather than “Instagram,” for instance, Proofpoint and other email security firms test clients’ ability to detect attacks. Social media sites, particularly Facebook and Instagram, are typically among the top most imitated in criminals’ so-called typo-squatting schemes, according to Palo Alto Networks research published in September. The suit, filed Tuesday in an Arizona district court, is a countersuit to Facebook’s […]

The post Proofpoint sues Facebook over dummy sites used for anti-phishing training appeared first on CyberScoop.

Continue reading Proofpoint sues Facebook over dummy sites used for anti-phishing training→

Pro-India hacking group expands mobile malware arsenal

Posted on by

A pro-India hacking group has been using two kinds of invasive Android surveillance software to spy on hundreds of victims’ cell phones for years, according to Lookout research published Thurssday. The malware, which the researchers have dubbed SunBird and Hornbill, are capable of exfiltrating several kinds of sensitive data, including text messages, call logs, contacts, the contents of encrypted messaging applications and target geolocation. The spyware also allows hackers to take pictures with the targets’ cameras or take screenshots of their devices, according to the research. It’s the kind of information that could reveal targets’ most sensitive and secretive day-to-day lives. In order to assess the scope of the operation and its victims, Lookout researchers examined 18GB of data that were incidentally exposed as a result of the hackers insecurely configuring command and control servers. Overall, the attackers targeted 156 victims with phone numbers from India, Pakistan and Kazakhstan over […]

The post Pro-India hacking group expands mobile malware arsenal appeared first on CyberScoop.

Continue reading Pro-India hacking group expands mobile malware arsenal→

Estonia’s diplomacy training aims to shape state behavior in cyberspace

Posted on by

Diplomats from around the world are convening this week to share ideas about what type of behavior should be allowed in cyberspace, and debate what happens when those rules are broken. The virtual confab, organized by the Estonian Ministry of Foreign Affairs and designed for seasoned and green diplomats alike, began Tuesday morning to discuss how international law applies in cyberspace and different attack methods diplomats may encounter when confronting cyber incidents, Estonia’s Ambassador at Large for Cyber Diplomacy Heli Tiirmaa-Klaar told CyberScoop in an interview. While the gathering will touch on historical cyber incidents that have rocked the international norms conversation over the years, including the sweeping WannaCry and NotPetya attacks, the focus of the so-called cyber diplomacy school is not on instruction about the technical details of cyber incidents. It’s about how to negotiate and shape behavior of other governments. “This is not technical training,” Tiirma-Klaar said. “What is […]

The post Estonia’s diplomacy training aims to shape state behavior in cyberspace appeared first on CyberScoop.

Continue reading Estonia’s diplomacy training aims to shape state behavior in cyberspace→