Tag Archive for: China’s

China’s Hackers Keep Targeting US Water and Electricity Supplies

/in


An indictment from the US Department of Justice may have solved the mystery of how disgraced cryptocurrency exchange FTX lost over $400 million in crypto. The indictment, filed last week, alleges that three individuals used a SIM-swapping attack to steal hundreds of millions in virtual currency from an unnamed company. The timing and the amount stolen coincides with FTX’s theft. Meanwhile, in a letter obtained by WIRED this week, seven lawmakers have demanded the DOJ stop funding biased and inaccurate predictive policing tools until the agency has a way to ensure law enforcement won’t use them in a way that has a “discriminatory impact.”

In Florida, prosecutors say a 17-year-old named Alan Winston Filion is responsible for hundreds of swatting attacks around the United States. The news of his arrest was first reported by WIRED days before law enforcement made it public. It was the culmination of a multi-agency manhunt to piece together a trail of digital breadcrumbs left by the teenager. In Ukraine, unmanned aerial vehicles have been powerful tools since the Russian invasion began in February 2022. But as the war rages on, another kind of unmanned robot has increasingly appeared on the front-lines: the unmanned ground vehicle, or UGV.

For months lawyers affiliated with an India based hacker-for-hire firm called Appin Technology have used legal threats to censor reporting about the company’s alleged cyber mercenary past. The EFF, Techdirt, MuckRock, and DDoSecrets are now pushing back, publicly sharing details for the first time about the firm’s efforts to remove content from the web. It’s a dangerous world out there, so we’ve also got a list of some major patches issued in January that you can use to update your devices to keep them secure.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

For years Western security officials have warned about the threat of China collecting data about millions of people and the country’s hackers infiltrating sensitive systems. This week, Federal Bureau of Investigation director Christopher Wray said hackers affiliated…

Source…

China’s Hackers Hijack Small Routers to Reach Big Targets

/in


The United States announced the disruption of a botnet made of hundreds of U.S.-based small office or home office (SOHO) routers that were hijacked by state-sponsored hackers from the People’s Republic of China (PRC) in order to be used to attack U.S. infrastructure.

Hacker GreeceChina-backed hackers target U.S. computers. (Photo: Darwin Laganzon, Pixabay, License)“The hackers, known to the private sector as ‘Volt Typhoon,’ used privately-owned SOHO routers infected with the ‘KV Botnet’ malware to conceal the PRC origin of further hacking activities directed against U.S. and other foreign victims,” the U.S. Department of Justice said Wednesday in a statement.

Attorney General Merrick B. Garland stressed that the Justice Department has thwarted a China-supported hacking group that sought to target “America’s critical infrastructure” using a botnet.

That campaign had been the focus of a joint advisory issued in May 2023 by the FBI, National Security Agency, Cybersecurity and Infrastructure Security Agency (CISA), and international partners, according to the statement.

The Justice Department explained that the majority of routers in the KV Botnet were Cisco and NetGear routers, which were vulnerable due to reaching the ‘end-of-life’ status – meaning that they were no longer supported with security patches or other software updates from their manufacturers.

The operation authorized by the court involved removing the KV Botnet malware from the routers and disconnecting them by blocking communications with other devices responsible for controlling the botnet.

The statement referred to court documents, stating that the government extensively tested the operation on the relevant Cisco and NetGear routers without affecting their legitimate functions or collecting content information from the compromised routers.

However, authorities cautioned that the remediated routers remain susceptible to future attacks by Volt Typhoon and other hackers. They strongly recommended that owners of end-of-life SOHO routers in their networks replace them.

“China’s hackers are targeting American civilian critical infrastructure, pre-positioning to cause real-world harm to American citizens…

Source…

DOD Annual Report Details China’s Growing Cyber Capabilities

/in


The report says Beijing is looking to create a “highly informatized force capable of dominating all networks.”

South China Sea, Feb. 11, 2023. Photo credit: DVIDS / Seaman Carson Croom

A recently released report on the People’s Republic of China lays out an array of military and security developments, drawing attention to the increasing pressure campaign against Taiwan and the continued advancement of the country’s cyber capabilities.  

The annual unclassified report to Congress details the current and probable future course of the People’s Liberation Army, Chinese military and security strategy and organizations supporting military goals and developments for the next 20 years.  

As Beijing is growing its military arsenal, it is also expanding and investing in its cyber capabilities as it moves toward a “highly informatized force capable of dominating all networks and expanding the country’s security and development interests.” 

“The PRC has publicly identified cyberspace as a critical domain for national security and declared its intent to expedite the development of its cyber forces,” the report states. 

The threat landscape is becoming increasingly complex and widespread, the report reads, as China’s focus is expanding beyond cyber espionage on other governments and private companies. It is diversifying its focus toward the U.S. defense sector, key critical infrastructure sectors and influence operations campaigns. 

“The PRC seeks to create disruptive and destructive effects – from denial-of-service attacks to physical disruptions of critical infrastructure – to shape decision-making and disrupt military operations beginning in the initial stages and throughout a conflict. The PRC can launch cyberspace attacks that, at a minimum, can cause localized, temporary disruptions to critical infrastructure within the United States, and the PRC believes these capabilities are even more effective against military superior adversaries that depend on information technologies,” the report reads.  

“As a result, the PRC is advancing its cyberspace attack capabilities and has the ability to launch cyberspace attacks – such as disruption of natural gas pipelines for days to…

Source…

US government to investigate China’s Microsoft email breach • The Register

/in


Infosec in brief The July breach of Microsoft Exchange Online by suspected Chinese hackers is the next topic up for review by the Department of Homeland Security’s Cyber Safety Review Board (CSRB). 

DHS secretary Alejandro Mayorkas announced the review last Friday, saying it would assess the Microsoft intrusion, as well as conducting a broader review of identity and authentication infrastructure used by cloud providers. 

“Organizations of all kinds are increasingly reliant on cloud computing to deliver services to the American people, which makes it imperative that we understand the vulnerabilities of that technology,”  Majorkas said. 

This will be the third investigation by the recently formed CSRB. It first reviewed Log4j vulnerabilities discovered in 2021, concluding the exploit would likely be a problem for at least a decade. Its second report, which was released earlier this week, focused on the threats from hacking group Lapsus$. In that report, the CSRB said the international cyber crime group used “simple techniques” to evade security tools, and offered ten recommendations for hardening environments against such attackers. 

The decision to investigate the July Outlook intrusion, and cloud security more broadly, was welcomed by senator Ron Wyden (D-OR), who last week blamed Microsoft for its failure to protect cloud accounts belonging to US government officials and called for the CSRB to investigate the incident. 

“I applaud president Biden and CISA director Easterly for acting on my request for the board to review this recent espionage campaign, including cyber security negligence by Microsoft that enabled it,” Wyden said. “The government will only be able to protect federal systems against cyber attacks by getting to the bottom of what went wrong. Ignoring problems is both a waste of taxpayer dollars and a massive gift to America’s adversaries.”

CISA director Jen Easterly said the CSRB’s findings would help advance cyber security across the cloud – both government and enterprise. 

It’s worth noting that the CSRB has no regulatory or enforcement powers. Rather, “its purpose is to identify relevant lessons learned to inform future improvements,”…

Source…