Cyber News

CyberMoscow tells about fake sites

2021-05-30T16:18:37.421Z

The head of the CyberMoscow project, Grigory Pashchenko, named in an interview with Sputnik radio the clone sites that scammers most often fake. These websites may change names often, but are usually created by the same criminals. A lot of the sites are run out of a country like Macedonia, says Pashchenko.
For instance, a fake Facebook account was set up with the name of Ukraine’s culture minister, part of which was aimed at signing people up for a French course and had ads for a medical treatment. Another phishing page had the picture of Ukraine’s Interior Minister Arsen Avakov, who Pashchenko noted was not exactly liked by the country’s “nationalistic fringe.”

One of the most prolific fake news factories, according to Pashchenko, was created in the fall of 2016 and was a 48 hour shop. In addition to fake Facebook and YouTube accounts, the hackers sold an updated fake Google Chrome browser with a plug-in for a popular Russian news site, Yandex, that lead to the fake site. The new browser came in two versions: for Russia and Ukraine, and sold for $3,000. When victims downloaded the fake browser, it would download the fake Google Chrome plug-in and the fake news sites.

There is some misinformation trickled out from Russia, but it is usually targeted, according to Pashchenko. For example, one fake news site claimed that US intelligence hacked Kiev’s power grid. And a fake news story about Hillary Clinton being exposed as a pedophile spread through the fake news channels even after she had secured the Democratic nomination, Pashchenko said. In this case, the Ukrainian president was already denying the allegations.

Russian hack

Pashchenko explained that the majority of fake sites were created by Russian hacking groups.
The connections are the same fake Russian social media accounts that were used to mount a series of pro-Trump political campaigns during the presidential election. They used online banking to fakely gain the reputation of having more than $100,000 in each of the hacked bank accounts. In addition, fake Facebook and Twitter profiles were used to spread the fake news to the target audience.
But more sophisticated fake sites were used by Russian hackers to create a fake message purportedly from a retired US Air Force officer. It asked for the users’ help in posting information to different anti-Islamic pages.
The fake message included a link to a website with a photo of retired Gen. Philip Breedlove, the commander of the US European Command. This is a photograph used by many social media accounts to show Breedlove speaking at a NATO conference or while receiving an award.
Pashchenko says the fake news was intended to undermine the reputation of US service members.

…

Many of the fake sites with a link to these social media accounts also promoted a fake news report that a Muslim American, Iqbal Thinni, was the new prime minister of Libya.
According to Pashchenko, the hackers’ goal was to create a rift between a NATO ally and a US ally, especially since the United States and several European countries were involved in a coalition to fight ISIS in the country at the time.
Thinni, however, released a statement in response to the report, saying it was fake.
Pashchenko said, in many cases, the hackers also forged emails in an attempt to target NATO military bases in Europe, with the goal of defacing them.
At the time, NATO deployed aircraft carriers to the Baltic states, Poland and the United Kingdom in response to Russian election meddling in the US. And on Friday, Britain announced it had expelled 23 Russian diplomats over the poisoning of former Russian spy Sergei Skripal.

Fake accounts

Some of the social media profiles created by Russian hackers contain fake information. For example, Pashchenko noted that a fake Twitter account was used to convince a donor to leave a $75,000 donation in a US military honor fund.
However, the military service only allowed donations to be left in one of three areas: a fund for veterans, a special fund for military families or the general fund.

Microsoft announced new cyber attacks on US state agencies.

2021-05-28T16:43:58.016Z

Microsoft announced new cyber attacks on US state agencies. Hackers infected computers with malware. More than 100 state police vehicles in Maryland were hacked and radio communication systems disabled. The threats were connected to the Russian intelligence services. The attacks were backed by state sponsors such as North Korea. The US intelligence committee reported a month ago that Russia was behind the cyber attacks on the Democratic National Committee (DNC) during the 2016 US election campaign, which brought Donald Trump to power. Russia has denied any involvement in the attacks. In the following analysis we draw the lessons from the events and present a framework of cyber warfare and cyber war that can contribute to enhancing our understanding of the concept.

The digital battlefield and cyber war both refer to a combination of electromagnetic warfare and conventional military operations. The concept was formalised in 1992 in the work of John Mauldin.

The Digital battlefield requires the use of electromagnetic and computer-mediated weapons. The primary objectives are the destruction of, and information control of, the adversary's armed forces and supporting infrastructure. The secondary objectives are to disable or degrade the adversary's telecommunications systems, air defences, command and control networks, and strategic objectives.

The Digital War allows either sides to attack each other's computer systems and networks. The primary objective of the Digital War is the disruption or destruction of the adversary's computer systems.

Typically, cyber conflict refers to the cyber attack on one side against another. Cyber conflict and digital warfare are not the same, but the former can be understood as a part of conventional operations. This relationship between cyber and conventional operations is highlighted in the following section.

The primary objectives of cyber attacks are always the same: the destruction of the computer systems of the adversary. This destruction is done either by a direct physical attack or by more subtle methods such as disabling or disrupting the computer systems through an electronic attack. In the cyber battlefield, the emphasis is on disruption rather than on destruction.

New leak of personal data in Air India

2021-05-27T06:29:21.946Z

An Air India spokesperson told The Hindu, "The server room used by Air India's flight operations IT experts was also being used by other IT experts, and a few of them, before the server room was monitored by the IT team, used the server room to study algorithms."

"As a standard operating procedure, before the team came for further monitoring, the team at the airport also made a one-time entry and deletion into the server by the analysts. Air India has, since then, adopted a multi-layered security system to guard against such an eventuality."

Tamil Nadu politicians, including AIADMK leader M Thambidurai and Deputy Chief Minister O Panneerselvam, voiced their concern over the data leak. "The government must take immediate steps to avert any embarrassment and damage to the national carrier, following reports that data of airline passengers was breached," they wrote in a letter to Civil Aviation Minister Suresh Prabhu.

Weirdly, Tamil Nadu Health Minister Dr Vijaya Baskar says that he doesn't understand the issue but adds that it must be done as security.

Ransomware Viruses

2021-05-26T13:19:00.104Z

Ransomware viruses are one of the clearest ways for hackers to commercialize their efforts. Like pay-per-click campaigns, ransomware costs would-be victims relatively nothing, unlike those costs associated with the loss of data.Likewise, it's easy for hackers to spread their malware and hold data hostage, as evidenced by a massive digital extortion campaign that took down the Hollywood Presbyterian Medical Center for several days in late 2014.Ransomware is often delivered in the form of an innocuous-looking e-mail that purports to be from a colleague. As one study recently noted, the victims were actually at great risk because in many cases, their infection is attributed to an internal error, "suggesting that the entire enterprise was not able to stop the software code that allowed the hackers to spread the malware. In an era of data breaches and successful data breaches, this type of infection remains all too common."The major financial institutions and governments are likely to feel the weight of this new form of attack, as well. We've already seen warnings from data security experts that if your institution doesn't "have patches on the servers, it's not safe."In a similar vein, the same researchers have identified some alarming parallels with another attack — the theft of global banking system customer data by hackers from Bangladesh's central bank. In that incident, some of the banking data was made public and could be downloaded from the server of Bangladesh's Federal Bank, forcing them to shut down their ATM network for several hours.So just when it seemed the flood gates had been closed on so-called "nation-state hacking," here comes ransomware to the breach door.

There is little doubt that ransomware is a highly effective cyber-weapon. With just a few words on a computer screen, hackers can wreak havoc on systems with software that encrypts files and freezes data or telephones systems to demand a "ransom" in exchange for the key needed to unlock it. As many noted during this most recent spate of hacking attempts, the criminals behind ransomware are usually motivated by either financial gain or to make a political statement.

"People are somewhat powerless to stop the ransomware," said Gary Davis, chief consumer security evangelist at McAfee, a security technology company. "They are not getting the services they need. They are under a lot of pressure."This isn't going to make people feel very good. But even if a company is hit with a ransom demand, there is little the company can do about it.

"There is no good guy with a red cape and mask and ball and chain that you can pay money to to recover your files," Davis said. "The attackers control the ecosystem — the currency, the drivers."
With so little the victim can do to prevent their files from being locked or their systems from becoming locked in this way, it's no surprise that ransomware attacks continue to surge.

Hackers have gained access to a ballistic missle launch system.

2021-05-26T13:11:21.710Z

Hackers have access to a ballistic missile launch system, a US Navy cruiser, a nuclear power plant, and an arms factory. They can also hack into your car’s video system.Worse, the botnet bots are able to launch a coordinated assault on any number of systems, and as they do, they use their vast computing power to see which systems are running poorly, and which are up and running. Once they’ve determined which systems are more important than others, the bots all attack them at once, until they’re too broken to continue the attack.Huge chunks of the Internet — and some cities in the United States — were knocked offline when a botnet crashed the huge Distributed Denial of Service attack.A different kind of attack can be very, very scary. According to Secret Cyber Operations, “The NSA and GCHQ, the two closest points of contact between the US and UK’s hacking and cyberwar-preparedness divisions, have been carrying out information and intelligence operations against both governments’ enemies, and also against their own citizens.”That means that NSA hacks into your computers, and GCHQ can turn on your wifi at a Starbucks, then tap into all of the data passing through that wifi.This is not the stuff of dystopian science fiction.

Attack on the Belgian Foreign Office

2021-05-26T06:46:15.626Z

The Belgian Federal Prosecutor's Office is investigating a large-scale cyberattack on the Interior Ministry, which could be carried out with "espionage goals."

"As part of its investigation, the Federal Prosecutor's Office has been conducting forensic examinations on computers at several ministries and an intelligence service of the Interior Ministry in a bid to determine the exact nature of the cyber attack," the prosecutor's office said in a statement.

The National Cyber Defence Center at the ministry was established in 2014 to deal with critical incidents and to ensure its IT security.
The cyber-attacks started on Saturday and were identified on Monday morning by IT technicians in the ministry.

On Monday, the cyber-attackers seized the email account of a vice-minister in charge of the Special Intervention Unit, which focuses on major security threats.
"One of the hackers succeeded in obtaining access to the email account of a vice-minister, and tried to access it with the aim of giving the attackers access to the official email account of the minister," the Federal Prosecutor's Office said.
The investigation has also revealed that the hackers used credentials leaked in December from the Belgium-based cryptocurrency exchange Bitfinex.
Among other things, the investigators have found that the same database was used in the attacks on Belgian Justice Ministry and the federal police.
Justice Minister Koen Geens has said that the attackers tried to breach several targets, including his own email account.

"What is disturbing is that the hackers managed to successfully compromise a large number of email accounts of Belgian civil servants," Geens said.
Belgian Interior Minister Jan Jambon has said that "we suspect that it was a deliberate action."
"It is a serious attack, the police was involved in the investigation.
Police noticed the breach on Saturday afternoon and contacted the state.

Russian DNC breach

2021-05-25T09:17:52.963Z

In one month of presence in the infrastructure of an organization, a cyber group can read email correspondence, including top officials, compromise employee credentials, and gain access to interface points with the infrastructures of other organizations or government authorities to attack them.”Russia has been accused of having some involvement in the DNC breach, with some researchers saying that the information may have come from an attack on a building used as a DNC data center.However, no proof of a connection between the two have been found.Fox News contacted a Kremlin spokesperson for comment and received the following response from Dmitry Peskov:“…It is a lie. I don’t know who is behind this but they should be ashamed of themselves. The whole story is nonsense.”

Identifying the attack

2021-05-25T09:12:39.101Z

Identifying a possible source of an attack is a non-trivial task that requires collecting large amounts of information.Hackers employ multiple techniques to pass information between devices.Malicious software exploits are very prevalent, and a huge amount of such malware is created every year.There are many occasions in which the computer with legitimate credentials is used as a vehicle for receiving and passing information.For example, a fake email is used as a proxy server for information sent from the hacker to the real server.When files are transferred to the other computer, a file extender is used

Colonial Pipeline (What they did)

2021-05-25T07:39:36.885Z

DarkSide hackers hacked Colonial Pipeline after Texas riled up over waterHouston's Colonial Pipeline has shut down a portion of its refined product pipeline after a release of noxious fumes was detected, leading to a series of fires.But the Internet had other plans.After Texas officials announced they were preparing to shut down two water plants due to a lack of water, hackers on a DarkSided network decided to take advantage of the situation.According to the New York Times, the hackers targeted the fuel delivery system.

Colonial Pipeline

2021-05-25T07:32:17.447Z

The hacker group DarkSide, allegedly behind the May 7 cyberattack on the American oil pipeline operator Colonial Pipeline, received a total of $ 90 million in cryptocurrency from its victims.
Colonial Pipeline told the victims that a ransomware virus had been installed on their systems and encryption mechanisms had been activated. The hackers threatened to release and ransom users’ data to get the keys to the decryption.
The hack affected the majority of the pipeline system’s assets, but none of the underground petroleum storage tanks were affected.
The ransom could also have been paid in Bitcoin, which is used to the tune of $1,000 in one transaction, and three other altcoins. The attackers would have made $ 14 million for themselves with such a cryptocurrency deal.
The hackers demanded that the deadline to pay the ransom was set for the end of the week. However, the operation was brought to a halt by a team from the FBI. The hackers claimed they had received only 15 percent of the ransom money.
The hackers made an effort to keep their identities secret by changing the company’s name, uniting the malware program with a file recovery tool and demanding money through the dark web instead of legitimate channels.
Colonial Pipeline’s workers also tracked the movement of the hackers in order to catch them. It’s not yet known how long the hackers managed to remain hidden from the authorities.