Category Archives: Department of Defense (DOD)

Huawei execs admit they don’t know whether their tech is used for surveillance

Posted on by

Huawei has had a lot to deal with over the last few years. Primarily, U.S. government officials have warned that the Chinese technology firm could be used as a tool for government surveillance or other intelligence operations, specifically via backdoors in its mobile networks. The Trump administration has banned Huawei technologies’ use in the federal government and made it difficult for the company to do business in the U.S. In recent months, the Department of Justice has alleged a Huawei subsidiary, has helped Iran run surveillance operations. Huawei technicians have also been accused of helping surveil targets in Africa. In order to answer to each and every accusation, Huawei sent two of its top cybersecurity officials — Chief Security Officer Andy Purdy and Vice President of Risk Management and Partner Relations Tim Danks — to the RSA Conference in San Francisco last week. In an interview with CyberScoop, the company’s executives continued toeing the […]

The post Huawei execs admit they don’t know whether their tech is used for surveillance appeared first on CyberScoop.

Continue reading Huawei execs admit they don’t know whether their tech is used for surveillance→

Ethical hackers submitted more bugs to the Pentagon than ever last year

Posted on by

Outside security researchers alerted the Pentagon about more software vulnerabilities in its networks than ever before, according to statistics released by a Department of Defense unit focused on cyber operations. The Defense Department’s Cyber Crime Center (DC3) on Friday released its annual the numbers from the Vulnerability Disclosure Program (VDP), in which the Pentagon asks ethical hackers, known as “white hats,” to probe its networks for weaknesses, then tell the government what they found. In all, the VDP processed 4,013 vulnerability reports, 2,836 of which led to mitigation activities, the DC3’s Executive Director, Jeffrey Specht, said in the report. Eight percent of the submitted reports were critical or high severity, according to a statement. “It was our busiest year to date with a staggering 21.7% increase of submitted reports from 2017,” the DOD Cyber Crime Center (DC3) report says. The department has been working to uncover vulnerabilities with the help of white hat hackers for […]

The post Ethical hackers submitted more bugs to the Pentagon than ever last year appeared first on CyberScoop.

Continue reading Ethical hackers submitted more bugs to the Pentagon than ever last year→

Pentagon, FBI, DHS to jointly expose a North Korean hacking effort

Posted on by

The Pentagon, FBI, and Department of Homeland Security plan to publicly identify a North Korean hacking campaign as part of a broad information sharing program intended to warn industry against adversarial hacking, CyberScoop has learned. The public disclosure is expected to include details about at least seven different malware samples linked with North Korean hacking efforts. The samples point to cyber-espionage activities carried out by an actor the U.S. refers to as Hidden Cobra, which officials have previously associated with the North Korean government. The files detailed use tools meant to steal data, create and delete files and capture screenshots, according to a person who has viewed the U.S. malware analysis report (MAR). The Department of Defense is expected to add details about the malware to the Virus Total malware repository Friday. The decision marks the first time the Pentagon’s Cyber Command will identify North Korean hacking efforts by name. The report, […]

The post Pentagon, FBI, DHS to jointly expose a North Korean hacking effort appeared first on CyberScoop.

Continue reading Pentagon, FBI, DHS to jointly expose a North Korean hacking effort→

Weak encryption means putting our military at risk

Posted on by

Last month, a brigade of U.S. soldiers deployed to the Middle East received instructions from their superiors to use two commercial encrypted messaging applications, Signal and Wickr, on their government issued cell phones. These leadership cues trickled down from the Department of Defense’s (DoD) position that strong encryption is critical to national security. While U.S. Attorney General William Barr continues to push for a broad mandate for backdoors for law enforcement, those on the front lines of protecting America have notably decided on a different approach. Simply put, weakening encryption means putting our military service members at risk. In a recent letter to Rep. Ro Khanna, D-Calif., DoD Chief Information Officer Dana Deasy made clear that the use of encryption to protect the mobile devices of our service members and their stored data is an “imperative.” Deasy makes clear that the use of commercial encryption and virtual private networks (VPNs) […]

The post Weak encryption means putting our military at risk appeared first on CyberScoop.

Continue reading Weak encryption means putting our military at risk→

DOD contractor Electronic Warfare Associates hit with Ryuk ransomware

Posted on by

Electronic Warfare Associates (EWA), a government contractor that works with the Department of Defense, Department of Justice, and Department of Homeland Security, has been hit with a ransomware attack, CyberScoop has learned. EWA’s CEO and president, Carl Guerreri, confirmed the infection in a Thursday interview with CyberScoop, but wouldn’t reveal further details. He declined to comment on how much of the company’s network was currently down, when the initial ransomware infection had taken place, what the initial infection vector was, or when EWA notified law enforcement. “I don’t want to give out any details for security reasons,” Guerreri told CyberScoop. “We’re coordinating with law enforcement.” The company was hit with Ryuk ransomware, according to security researchers who spoke with ZDNet, which first reported the infection. Guerreri doesn’t know how much money attackers are demanding, but said EWA has no plans to pay a ransom. “I had no intention of paying anything so I didn’t even […]

The post DOD contractor Electronic Warfare Associates hit with Ryuk ransomware appeared first on CyberScoop.

Continue reading DOD contractor Electronic Warfare Associates hit with Ryuk ransomware→

Navy letter shows military worried about unknown vulnerabilities in DJI drones

Posted on by

The U.S. Navy issued an internal warning in 2017 about vulnerabilities in systems made by Chinese-based drone company DJI that could allow adversaries to siphon data from devices, according to a document obtained through the Freedom of Information Act. “Overall, the system should be considered highly vulnerable in the cyber security realm and employed accordingly,” the document, obtained by the George Washington University’s National Security Archive and shared with CyberScoop, reads. In the warning, the Navy pointed out issues with the way a DJI drone communicates and sends data to a ground station. “While encrypted, open source research indicates numerous techniques available to passively view the video and metadata from the air vehicle as well as assume control over the air vehicle by adversaries,” the warning, dated May 2017, reads. The document has been made public as technology made by Chinese-based companies, which powers much of the internet’s underlying infrastructure, […]

The post Navy letter shows military worried about unknown vulnerabilities in DJI drones appeared first on CyberScoop.

Continue reading Navy letter shows military worried about unknown vulnerabilities in DJI drones→

How the Marine Corps thinks about beating adversaries in cyberspace

Posted on by

There are a whole host of products on the market purporting to be the best way to run defense against nation-state adversaries’ email spearphishing attempts — but there’s one part of defending against spearphishing in particular the U.S. Marine Corps Forces Cyberspace Command’s Chief Technology Officer endorses: context. For Renata Spinks, the goal is not to just make sure employees understand they should avoid clicking on what appear to be malicious links, but to make sure they understand the bigger picture of what they’re protecting, she said Tuesday. “Instead of just [test] phishing attempts, teach your employees why phishing attempts are so important and make it relatable,” Spinks said at the Fortinet Security Summit, produced by FedScoop and StateScoop. “Data is your most critical commodity, but people [are] the best asset you can have.” Spearphishing emails often seek to pilfer off passwords and credentials from victims who click on links or attachments that purport […]

The post How the Marine Corps thinks about beating adversaries in cyberspace appeared first on CyberScoop.

Continue reading How the Marine Corps thinks about beating adversaries in cyberspace→

Pentagon’s next cyber policy guru predicts more collective responses in cyberspace

Posted on by

State-sponsored cyberattacks against just one victim nation at a time could soon provoke a global response, if a growing number of officials around the world have their way. As the Pentagon has experimented with new authorities allowing U.S. Cyber Command to be more offensive in cyberspace, key officials have suggested there is a groundswell of support for multi-nation countermeasures in the digital age. Thomas Wingfield, the incoming deputy assistant secretary of Defense for cyber policy, told CyberScoop that alliances could be a more successful way to deter hackers and strike back when they infiltrate sensitive networks. “I think that’s a more effective way to solve the problem, and I think that is the general [direction] of international law,” said Wingfield, who is still employed at National Defense University. “But I would also say we’re not there yet and states are in the process of moving international law in that direction.” For months now, the U.S. […]

The post Pentagon’s next cyber policy guru predicts more collective responses in cyberspace appeared first on CyberScoop.

Continue reading Pentagon’s next cyber policy guru predicts more collective responses in cyberspace→

Cyber Command has cut hiring time for cybersecurity roles by nearly half, says DOD CISO

Posted on by

Cyber Command has recently cut down the average amount of time it takes to hire someone by approximately 40 percent — 111 days to 44 days — under the Cyber Excepted Service program, according to the Department of Defense CISO Jack Wilmer. The CES program, intended to speed up cybersecurity candidate recruitment in the DOD through initiatives like allowing hiring managers to make direct hires, was originally authorized in 2016 by Congress. The CES also establishes market-based pay scales and allows hiring with or without public notification or vacancy announcements, both intended to decrease red tape in the Pentagons’ hiring process. Wilmer said the decrease has given the Department of Defense a leg up on private sector cybersecurity hiring. Since implementing the CES program, the Pentagon has seen fewer cases of candidates leaving DOD jobs on the table for the private sector. “That is a huge win,” Wilmer said while speaking Thursday at the 2019 Workforce […]

The post Cyber Command has cut hiring time for cybersecurity roles by nearly half, says DOD CISO appeared first on CyberScoop.

Continue reading Cyber Command has cut hiring time for cybersecurity roles by nearly half, says DOD CISO→

Cyber Command flags North Korean-linked hackers behind ongoing financial heists

Posted on by

The Department of Defense has once again called out North Korean hackers by exposing malware samples researchers say are linked to regime-backed financial heists, including past attacks on the interbank messaging system known as the Society for Worldwide Interbank Financial Telecommunication (SWIFT), CyberScoop has learned. Cyber Command assessed that the malware, which it posted to the information sharing platform VirusTotal, is being used in ongoing cyberattacks aimed at the financial sector. “These malware samples are currently used for fund generation and malicious cyber activities including remote access, beaconing, and malware command by malicious cyber actors,” the command said in a tweet. The command did not name victims or describe the magnitude of the scheme. It’s a rare statement from the Pentagon’s cyber-operations division on the intent and capabilities of adversary-linked malware in what appears to be an expansion of the command’s willingness and ability to discuss the intelligence behind its VirusTotal […]

The post Cyber Command flags North Korean-linked hackers behind ongoing financial heists appeared first on CyberScoop.

Continue reading Cyber Command flags North Korean-linked hackers behind ongoing financial heists→