Tag Archive for: Exclusive

Exclusive: U.S. to give ransomware hacks similar priority as terrorism

/in


The U.S. Department of Justice is elevating investigations of ransomware attacks to a similar priority as terrorism in the wake of the Colonial Pipeline hack and mounting damage caused by cyber criminals, a senior department official told Reuters.

Internal guidance sent on Thursday to U.S. attorney’s offices across the country said information about ransomware investigations in the field should be centrally coordinated with a recently created task force in Washington.

“It’s a specialized process to ensure we track all ransomware cases regardless of where it may be referred in this country, so you can make the connections between actors and work your way up to disrupt the whole chain,” said John Carlin, principle associate deputy attorney general at the Justice Department.

Last month, a cyber criminal group that the U.S. authorities said operates from Russia, penetrated the pipeline operator on the U.S. East Coast, locking its systems and demanding a ransom. The hack caused a shutdown lasting several days, led to a spike in gas prices, panic buying and localized fuel shortages in the southeast.

Colonial Pipeline decided to pay the hackers who invaded their systems nearly $5 million to regain access, the company said.

The DOJ guidance specifically refers to Colonial as an example of the “growing threat that ransomware and digital extortion pose to the nation.”

“To ensure we can make necessary connections across national and global cases and investigations, and to allow us to develop a comprehensive picture of the national and economic security threats we face, we must enhance and centralize our internal tracking,” said the guidance seen by Reuters and previously unreported.

The Justice Department’s decision to push ransomware into this special process illustrates how the issue is being prioritized, U.S. officials said.

A person fills a fuel container at a Shell gas station, after a cyberattack crippled the biggest fuel pipeline in the country, run by Colonial Pipeline, in Washington, D.C., U.S., May 15, 2021. REUTERS/Andrew Kelly/File Photo

“We’ve used this model around terrorism before but never with ransomware,” said Carlin. The process has typically been reserved for a short…

Source…

Exclusive: Grindr’s US security review disclosures contradicted statements made to others

/in


NEW YORK: When Grindr Inc’s Chinese owner sold the popular dating app to an investor consortium last year to comply with a U.S. national security panel order, the parties to the deal gave information to authorities that contradicted disclosures to potential investors and Chinese regulators, Reuters has learned.

They told the Committee on Foreign Investment in the United States (CFIUS) that James Lu, a Chinese-American businessman who is now Grindr’s chairman, had no previous business relationship with a key adviser to the seller, a man named Ding’an Fei, according to a Reuters review of the parties’ written submissions to CFIUS.

Fei, a former private equity executive, was acting as an adviser to Beijing Kunlun Tech Co Ltd, Grindr’s owner at the time, on the deal, the documents show.

“The investors and Ding’an Fei have at no time conducted business together in their personal capacities prior to the proposed transaction,” Kunlun and the investor group, called San Vicente Holdings LLC, wrote to CFIUS in a response dated March 27, 2020.

However, when Lu was raising funds to buy Grindr in the second half of 2019 and early 2020, potential investors were told by firms helping him raise the money that Fei was involved in the effort with him in various capacities, a review of four different fundraising documents shows.

The duo had also done business together in other ventures: Fei was a member of the board of a Chinese restaurant operator in which Lu served as chief executive officer, according to that restaurant company’s 2018-2019 annual report.

The discrepancies and omissions in the parties’ response to U.S. authorities, reported by Reuters for the first time, could prompt a new review from CFIUS, according to six former U.S. officials and lawyers familiar with the panel’s rules. If CFIUS were to find the statements were not true, it can also lead to civil penalties and criminal charges under the false statement provisions of the U.S. penal code, they said.

“If a transaction was approved based on misrepresentations, that could well invalidate the approval of the transaction,” said Brent…

Source…

Exclusive: Suspected Chinese hackers used SolarWinds bug to spy on U.S. payroll agency

/in


By Christopher Bing, Jack Stubbs, Raphael Satter and Joseph Menn



a group of people sitting in front of a building: FILE PHOTO: SolarWinds Corp. banner hangs on the company's IPO at the NYSE in New York

© Reuters/Brendan McDermid
FILE PHOTO: SolarWinds Corp. banner hangs on the company’s IPO at the NYSE in New York

WASHINGTON (Reuters) – Suspected Chinese hackers exploited a flaw in software made by SolarWinds Corp to help break into U.S. government computers last year, five people familiar with the matter told Reuters, marking a new twist in a sprawling cybersecurity breach that U.S. lawmakers have labeled a national security emergency.



a sign on the side of a building: FILE PHOTO: Exterior view of SolarWinds headquarters in Austin

© Reuters/SERGIO FLORES
FILE PHOTO: Exterior view of SolarWinds headquarters in Austin

Two people briefed on the case said FBI investigators recently found that the National Finance Center, a federal payroll agency inside the U.S. Department of Agriculture, was among the affected organizations, raising fears that data on thousands of government employees may have been compromised.

Loading...

Load Error

The software flaw exploited by the suspected Chinese group is separate from the one the United States has accused Russian government operatives of using to compromise up to 18,000 SolarWinds customers, including sensitive federal agencies, by hijacking the company’s Orion network monitoring software.

Security researchers have previously said a second group of hackers was abusing SolarWinds’ software at the same time as the alleged Russian hack, but the suspected connection to China and ensuing U.S. government breach have not been previously reported.

Reuters was not able to establish how many organizations were compromised by the suspected Chinese operation. The sources, who spoke on condition of anonymity to discuss ongoing investigations, said the attackers used computer infrastructure and hacking tools previously deployed by state-backed Chinese cyberspies.

The Chinese foreign ministry said attributing cyberattacks was a “complex technical issue” and any allegations should be supported with evidence. “China resolutely opposes and combats any form of cyberattacks and cyber theft,” it said in a statement.

SolarWinds said it was aware of a single customer that was compromised by the second set of hackers but that it had “not found anything…

Source…

Exclusive Media Invite – Hack the Building 2020

/in


COLUMBIA, Md.–(BUSINESS WIRE)–Nov 9, 2020–

The Maryland Innovation & Security Institute (MISI) and Dreamport, a partnership between MISI and United States Cyber Command (USCYBERCOM), invite media to join cybersecurity, control system and government professionals at Hack the Building, November 16-19 and streaming live on Twitch. Hack the Building is an unrivaled, hands-on live facilities critical infrastructure cybersecurity challenge featuring more than 50 teams from industry, federal labs, building automation companies, academia and government agencies – all competing to infiltrate, disrupt or take over a connected smart building and the computing systems and data inside the building.

As outlined in the official Hack the Building Handbook, the event is a virtual challenge built around a specially-designated, real-world target: A live, fully-equipped 150,000 square-foot “smart” office building near Annapolis, Maryland that teams on-site and remote are challenged to attack through its diverse IT, control systems, Internet of Things (IoT), access control, surveillance camera, building automation and other systems.

Hack the Building was created to address four core goals:

The target building is staged as belonging to “ BCR Industries,” a fictitious defense industrial base “manufacturing and engineering company” mocked-up for the competition to represent an attractive target with “sensitive U.S. government contracts.” This illustrates Hack the Building’s imperative, overarching public-private partnership focus on raising awareness of critical infrastructure protection and evolving cyber risks across interconnected computer networks, control and building systems.

“As once-isolated buildings and physical control systems converge with modern networks, it is crucial for cybersecurity, facility engineering and other disciplines to study attack and defense hands-on and learn from each other,” said Armando Seay, Director and Co-Founder of MISI and event organizer. “Hack the Building’s competition and teams yield immediate, practical cyber defense skills and knowledge – but the returns are even greater for our stakeholders charged with protecting connected offices,…

Source…