Finding Cyber Aptitude in the US - the Cyber Executive Order; Air Strike Response to Cyber Attack; Putin's Great Wall of Russia for Cyber
Students at 1,240 U.S. colleges (24% of all U.S. colleges) are participating in Cyber Fast Track, competing to show they have the aptitude and grit to win more than $2 million in scholarships for SANS classes as well as hundreds of thousands in scholarships at their schools. The deadline for entries is this Friday, May 10. More than 5,000 students (out of the 12,500 who have tried) have already done well enough to move into round two of the program. America's most desirable cybersecurity employers are planning internships for high performers, and the colleges appreciate the program because it identifies great talent in their own student bodies for part time jobs in IT and IT security at school.
www.cyber-fasttrack.org
Cybersecurity Executive Order
Israel Responded to Cyberattacks with Air Strike: Real-time Hybrid Warfare
Putin Signs Law to Create Isolated Russian Internet
"Cyber Event" Disrupted Power Grid Operations in Western US in March
Git Ransomware
Supply Chain Hackers Eroding Trust in Software Distribution Systems
Qakbot Uses Obfuscation to Maintain Persistence
International Law Enforcement Authorities Take Down Dark Web Marketplaces
Agency Cybersecurity Leaders Response to Shared Services Policy
Firefox and Certificate Expiration
Google Access Transparency for Cloud Services
Microsoft is Offering Free Election Security Tools
*************************** Sponsored By Splunk ******************************
Take Your SIEM to the Cloud. A SIEM solution is like a radar system. Without one, IT is flying blind and organizations are vulnerable to cyberthreats. But a cloud-based SIEM solution could add even more benefits to an organization's security defenses. Download Take Your SIEM to the Cloud to learn how to improve your security posture using a cloud-based SIEM. http://www.sans.org/info/212670
--Cybersecurity Executive Order
The goal of the recently-issued White House Executive Order on cybersecurity is to develop a "superior cybersecurity workforce," according to an administration official. The order calls for the Homeland Security Secretary to establish a job rotation program to allow cybersecurity experts move between agencies. It directs the Office of Personnel management (OPM) to create a list of tests that can be used to evaluate federal employees and identify those with cybersecurity skills. It also seeks to establish a cybersecurity competition open to government workers and members of the armed services.
[Paller] There is a very big idea in the Executive Order. That is the aptitude testing. The Brits discovered two sources of extremely high talent that is ready and has not been tapped. One source is adults who are already employed in the workforce but not in IT roles and who have extraordinary aptitude for solving cyber security problems. The second is students in college or high school who never got introduced to tech who also have the curiosity and tenacity and problem-solving and quick learning that separates the great cyber security professionals from the ones who just keep doing what doesn't work. Aptitude identification programs for both groups worked wonderfully in the UK and have been tested at scale in the United States. Preliminary data shows they will work as well here as they do in the UK. The Federal government is leading the quest to make aptitude testing programs work, and the Executive Order shines a bright light on their promise. The key to the importance of aptitude testing is that a great number of people who are in the cyber security field do not have the natural aptitude to work on the front lines of cybersecurity -- identifying and excising intrusions. Their aptitude deficit leaves countries and companies deeply at risk. Programs that identify natural talent combined with great training is the shortest path to solving our country's high-end cyber security skills shortage.
UK Success adults: https://www.infosecurity-magazine.com/news-features/all-you-need-cyber-retraining/: All You Need to Know about the Cyber Retraining Academy
US test adults: https://www.fedscoop.com/cyber-reskilling-academy-1500-applicants/:More than 1,500 feds applied for first Cyber Reskilling Academy cohort
Students: www.girlsgocyberstart.org and www.cyber-fasttrack.org
[Williams] The executive order seems to be a mixed bag. On the one hand, it highlights the need for aptitude assessments and retraining. That's extremely positive. On the other hand, it establishes a "president's cup" cybersecurity competition. I'm rather concerned that the results of this will be skewed against some classified organizations who must adapt to use unclassified tools and techniques in the competition.
Bank InfoSecurity: Trump Order Aims to Boost Federal Cybersecurity Workforce
https://www.bankinfosecurity.com/trump-order-aims-to-boost-federal-cybersecurity-workforce-a-12447
The Register: White House issues Executive Order on cybersecurity, including hacker Hunger Games
https://www.theregister.co.uk/2019/05/03/executive_order_cybersecurity/
Cyberscoop: Trump emphasizes federal cybersecurity workforce, education programs in new executive order
https://www.cyberscoop.com/cybersecurity-workforce-trump-executive-order/
Threatpost: Researchers Weigh in on Trump's Cyber Workforce Executive Order
https://threatpost.com/researchers-trumps-cyber-workforce-executive-order/144370/
White House: Executive Order on America's Cybersecurity Workforce
https://www.whitehouse.gov/presidential-actions/executive-order-americas-cybersecurity-workforce/
--Israel Responded to Cyberattacks with Air Strike: Real-time Hybrid Warfare
The Israeli Defense Force (IDF) bombed a building it said housed Hamas cyberspecialists who had attempted to launch an attack that Israeli forces thwarted. The air strike is believed to be the first real-time kinetic response to a cyberattack. In 2016, NATO declared cyber a battlefield.
[Williams] This action puts many in the line of fire who really haven't been before. If the "cyber is a battlefield and anyone on the battlefield is a combatant" position is widely adopted, cyber defenders will be at risk of bodily harm too. In other words, don't just view this as part of the Hamas/IDF conflict - view it in the larger context of what it will mean if taken to include cyber defense operators as well.
Wired: What Israel's Strike on Hamas Hackers Means for Cyberwar
https://www.wired.com/story/israel-hamas-cyberattack-air-strike-cyberwar/
ZDNet: In a first, Israel responds to Hamas hackers with an air strike
https://www.zdnet.com/article/in-a-first-israel-responds-to-hamas-hackers-with-an-air-strike/
CNBC: Israel says it bombed Hamas compound that committed cyberattacks
https://www.cnbc.com/2019/05/06/israel-conflict-live-response-to-a-cyberattack-will-lead-to-a-shift.html
Softpedia: NATO Declares Cyber an Official Warfare Battleground, Next to Air, Sea and Land (June 2016)
https://news.softpedia.com/news/nato-declares-cyber-as-official-battleground-next-to-air-sea-and-land-505388.shtml
--Putin Signs Law to Create Isolated Russian Internet
Russian President Vladimir Putin has signed the Runet law, which would allow Russia to create its own Internet that operates independently from the rest of the world. The purported goal of the law is to protect the stability of Russia's Internet in the event that foreign adversaries attempt to cut it off from the rest of the world. The law takes effect in November and telecommunications operators must comply with the law's provisions starting in 2021.
[Pescatore] Not really much detail on this, but it sounds more like an attempt to replicate the "Great Firewall of China" approach to censoring Internet access vs. some sort of security strategy. In fact, it seems like recycling of the old USSR communications restrictions that were lifted in 1987 or so. Four years later the Berlin Wall came down, and this strategy seems like at attempt to put back up the cyber version.
[Neely] Putin has a model that Russia could "pull the plug" on the rest of the Internet so Russia could survive a Cyber War, routing traffic through Russian exchange points when they are under threat. Given that Internet threats are a constant, expect traffic to always be routed through these exchange points, creating a model that will resemble the "Great Firewall of China" which facilitates enacting communication restrictions. There are better strategies for creating and securing defenses of critical resources.
[Murray] Recall when there were tanks in Red Square and the only Internet connection to Moscow was a dial connection through Finland. The value of a network is an exponential function of the numbers of nodes and potential connections. Attempts to limit the connections reduce the value by the same function.
ZDNet: Putin signs Runet law to cut Russia's internet off from rest of world
https://www.zdnet.com/article/putin-signs-runet-law-to-cut-russias-internet-off-from-rest-of-world/
The Hill: Putin signs controversial internet law
https://thehill.com/policy/international/441751-putin-signs-controversial-internet-law
1) Ponemon Report: 2019 State of Password and Authentication Security Behaviors. Read the surprising statistics. http://www.sans.org/info/212675
--"Cyber Event" Disrupted Power Grid Operations in Western US in March
(April 30, May 2 & 3, 2019)
A report posted by the US Department of Energy says that a "cyber event" disrupted power grid operations in California, Utah, and Wyoming in early March. The issue "did not impact generation, the reliability of the grid or cause any customer outages." The cyber event involved a denial of service condition caused via a known vulnerability.
E&E News: 'Denial of service' attack caused grid cyber disruption: DOE
https://www.eenews.net/stories/1060254751
E&E News: OE-417 Electric Emergency and Disturbance Report - Calendar Year 2019 (see page 5: 03/05/2019) (PDF)
https://www.eenews.net/assets/2019/04/30/document_ew_03.pdf
SC Magazine: Denial of service event impacted U.S. power utility last month
https://www.scmagazine.com/home/security-news/denial-of-service-event-impacted-u-s-power-utility-last-month/
Tech Crunch: 'Denial of service condition' disrupted US energy company operations
https://techcrunch.com/2019/05/02/ddos-attack-california-energy/
CNBC: An alarmingly simple cyberattack hit electrical systems serving LA and Salt Lake, but power never went down
https://www.cnbc.com/2019/05/02/ddos-attack-caused-interruptions-in-power-system-operations-doe.html
Vice: A 'Cyber Event' Disrupted the Power Grid in California and Wyoming, But Don't Panic Just Yet
https://www.vice.com/en_us/article/9kxb85/cyber-event-california-wyoming-utah-dont-panic
--Git Ransomware
Hackers have been infecting code repositories with ransomware, wiping code and commits and replacing them with a text file ransom demand for Bitcoin. The hackers have targeted users on GitHub, GitLab, and Bitbucket. It is not clear how the attackers gained access to the accounts.
The Register: Mystery Git ransomware appears to blank commits, demands Bitcoin to rescue code
https://www.theregister.co.uk/2019/05/03/git_ransomware_bitcoin/
Bleeping Computer: Attackers Wiping GitHub and GitLab Repos, Leave Ransom Notes
https://www.bleepingcomputer.com/news/security/attackers-wiping-github-and-gitlab-repos-leave-ransom-notes/
Vice: Someone Is Hacking GitHub Repositories and Holding Code Ransom
https://www.vice.com/en_us/article/vb9v33/github-bitbucket-repositories-ransomware
--Supply Chain Hackers Eroding Trust in Software Distribution Systems
Over the past three years, a group of hackers known by several names, including Barium ShadowHammer, and Wicked Panda, have infected software distribution systems at at least six different companies. The group's approach is to infect large numbers of users through these software distribution channels, and then cull the victims for the targets of their espionage efforts. If the group had chosen to distribute ransomware through the infected computers, the results would have been devastating.
[Pescatore] This is a good article to use as the basis of a table top exercise to demonstrate to CEOs and Boards of Directors why the security team should be involved in procurement/supply chain/merger and acquisition decisions. Companies that have done so, and who have invested in the tools and skills to actually make sure software products and services been assessed for malicious capabilities before acquisition have been able to avoid or minimize damage from similar supply chain attacks.
Wired: A Mysterious Hacker Group is on a Supply Chain Hijacking Spree
https://www.wired.com/story/barium-supply-chain-hackers/
--Qakbot Uses Obfuscation to Maintain Persistence
A new variant of the Qakbot or Qbot banking trojan uses new obfuscation tools to evade detection and make itself more difficult to remove from infected devices. Victims are first infected with a dropper. The compromised device then creates scheduled tasks to download portions of the Qakbot malware which are then put together. Qakbot has a history of using scheduled tasks to maintain a foothold in infected devices.
[Murray] If your systems are compromised, they are compromised. There is little to choose among the capabilities of the malicious software. We must know what software we expect to be on our systems if we expect to recognize that which we do not want.
Talos Intelligence: Qakbot levels up with new obfuscation techniques
https://blog.talosintelligence.com/2019/05/qakbot-levels-up-with-new-obfuscation.html
SC Magazine: Qakbot upgrade includes new obfuscation technique
https://www.scmagazine.com/home/security-news/malware/qakbot-upgrade-includes-new-obfuscation-technique/
Bleeping Computer: Qakbot Assembles Itself from Encrypted Halves to Evade Detection
https://www.bleepingcomputer.com/news/security/qakbot-assembles-itself-from-encrypted-halves-to-evade-detection/
--International Law Enforcement Authorities Take Down Dark Web Marketplaces
Two dark web marketplaces - the Wall Street Market (WSM) and the Silkkitie or Valhalla Marketplace - have been taken down in an international coordinated effort involving Europol and German, Dutch, US, Finnish, and French authorities. Three suspects are in custody in Germany; they face charges in the US related to their alleged operation of the WSM.
Europol: Double Blow to Dark Web Marketplaces
https://www.europol.europa.eu/newsroom/news/double-blow-to-dark-web-marketplaces
KrebsOnSecurity: Feds Bust Up Dark Web Hub Wall Street Market
https://krebsonsecurity.com/2019/05/feds-bust-up-dark-web-hub-wall-street-market/
MeriTalk: DoJ Charges Three Germans for Operating Dark Web Marketplace
https://www.meritalk.com/articles/doj-charges-three-germans-for-operating-dark-web-marketplace/
Justice: 3 Germans Who Allegedly Operated Dark Web Marketplace with Over 1 Million Users Face U.S. Narcotics and Money Laundering Charges
https://www.justice.gov/usao-cdca/pr/3-germans-who-allegedly-operated-dark-web-marketplace-over-1-million-users-face-us
--Agency Cybersecurity Leaders Response to Shared Services Policy
On April 26, the US Office of Management and Budget (OMB) issued a new shared services policy that designates the Department of Homeland Security (DHS) as the Quality Service Management Office (QSMO) in charge of cybersecurity acquisition and standards. At a roundtable discussion last week, information security leaders at US government agencies say that they are fine with the designation provided DHS works with agencies individually.
Nextgov: Agency Cyber Pros Welcome DHS' Leadership If It's Not One-Size-Fits-All
https://www.nextgov.com/cybersecurity/2019/05/agency-cyber-pros-welcome-dhs-leadership-if-its-not-one-size-fits-all/156679/
--Firefox and Certificate Expiration
Mozilla has released out an updated version of Firefox to address a problem involving an expired intermediate signing certificate that disabled most plug-ins and extensions. Users should update to Firefox version 66.0.4.
[Neely] The problem manifests itself by unexpectedly disabling extensions, and users cannot reinstall or re-enable them. Enterprises need to deploy version 60.6.2 ESR, or enable Firefox Studies, which also requires enabling sending telemetry data back to Mozilla, to resolve the problem.
ZDNet: Mozilla releases Firefox 66.0.4 with fix disabled add-ons issue
https://www.zdnet.com/article/mozilla-releases-firefox-66-0-4-with-fix-disabled-add-ons-issue/
Bleeping Computer: Firefox 66.0.4 Released With Fix for Disabled Addons
https://www.bleepingcomputer.com/news/software/firefox-6604-released-with-fix-for-disabled-addons/
--Google Access Transparency for Cloud Services
(March 2019)
Google's Access Transparency service allows customers to view service logs related to their accounts. Access Transparency is supported on six different Google Cloud Platform services; there are plans to add support for more services.
[Pescatore] This is a nice step forward in visibility, one that should be budgeted into the acquisition cost of GCP and then all cloud services, as Google competitors announce similar offerings. This is not full visibility into what Google is doing at the bottom layer of virtualization but gives you the ability to examine (and export into SIEM or other analysis packages) all Google admin actions directly related to your services. It requires certain levels of Google support packages and roles - it is not free, thus the need to push for IT to budget in that cost as part of acquiring the services.
[Neely] Increased transparency to what CSP System Administrators are doing with your account allows equivalent visibility to actions taken by staff on internally hosted systems. Microsoft is putting a toe in the water with their Customer Lockbox for Office 365. Google's offering is available only to customers with Gold, Platinum, Enterprise, four or more Development roles, four or more Production roles, or a combination of the two role-based support agreements.
[Murray] As with other such services, pay for them only if you look at the data. Continue to pay only if you find intelligence in the data on which you take action.
Search Cloud Computing: Google tool signals move to greater cloud transparency
https://searchcloudcomputing.techtarget.com/tip/Google-tool-signals-move-to-greater-cloud-transparency
Google: Access Transparency
https://cloud.google.com/access-transparency/
--Microsoft is Offering Free Election Security Tools
Microsoft plans to release a free open-source software development kit that can be used to help improve election security. ElectionGuard will be available later this summer to election officials and election technology suppliers. ElectionGuard can be used to allow third-party election result validation and to allow voters to check that their ballots were counted correctly.
[Pescatore] Microsoft's partner in this, a small research company called Galois, has been funded by DARPA in this area since 2017 under the System Security Through Integrated Hardware and Firmware program. If the ElectionGuard software is released on GitHub soon, it will be good to see it banged on by security researchers and at the DefCon Voting Village in August. Microsoft also listed as a partner Election Systems & Software, the election system company who last year admitted that from 2000 - 2006 they included modems and PC Anywhere remote access software in systems they sold that were used to program voting machines and tabulate votes! States and localities that procure voting systems should look for the results of testing and integration of technology like ElectionGuard from all system vendors.
[Neely] Tools to help secure systems and validate the results are definitely needed. Resources to update and secure voting systems will need to be identified and budgets will need to be adjusted for systems that were intended to operate without significant change for 20-30 years.
[Murray] While there are thousands of jurisdictions conducting our elections, there are only a handful selling hardware and software into this market. Seems as though this is a more efficient place to focus security efforts. The vendors do not have a good security record. One would like to see those who are building ATMs and gambling devices in the market.
Microsoft: Protecting democratic elections through secure, verifiable voting
https://blogs.microsoft.com/on-the-issues/2019/05/06/protecting-democratic-elections-through-secure-verifiable-voting/
Cyberscoop: Microsoft pushes open-source software kit to election agencies, voting-tech vendors
https://www.cyberscoop.com/microsoft-electionguard-software-kit/
Decoding UTF-16 in UDF Files
https://isc.sans.edu/forums/diary/Text+and+TNULeNULxNULtNUL/24912/
DLink Ransomware Patch (German)
https://eu.dlink.com/de/de/support/support-news/2019/february/28/dns320_trojan_cr1pttor
Jenkins Plugin Vulnerabilities
https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/may/story-of-a-hundred-vulnerable-jenkins-plugins/
Malicious WPAD Domains
https://blog.redteam.pl/2019/05/badwpad-and-wpad-pl-wpadblocking-com.html
VMWare Fusion 11 Guest VM RCE
https://theevilbit.github.io/posts/vmware_fusion_11_guest_vm_rce_cve-2019-5514/
Hackers Are Using Bad Passwords Too
https://www.ankitanubhav.info/post/c2bruting
Amazon S3 Discontinues Path Style Access
https://www.bleepingcomputer.com/news/security/amazon-to-disable-s3-path-style-access-used-to-bypass-censorship/