Information Security & Occasional Forays Into Adjacent Realms
via outstanding reportage by BBC technology reporters Chris Fox & Leo Kelion, comes the tale of United Kingdom, Canadian and United States COVID-19 vaccine researchers and those troublesome Russian spies apparently hell-bent on thievery of the heinous sort - theft of vaccine reseach data and associated secrets by APT29 (aka CozyBear, The Dukes, CozyDuke and YTTRIUM). Also this.
Likely the most significant exposé of retail software security mismanagement this fiscal year - Wired New York-based Senior Writer Andy Greenberg's 'How Spies Snuck Malware Into the Google Play Store -- Again' is making the rounds here at Casa Infosec. It's the Must Read for this week, and possibly the entire month {except for - maybe - this superb piece of security journalism - another Andy Greenberg effort, take a gander, if you will}.
"GOOGLE'S PLAY STORE for Android apps has never had a reputation for the strictest protections from malware. Shady adware and even banking trojans have managed over the years to repeatedly defy Google's security checks." - via Wired writer Andy Greenberg
Image via Maxar
via David Gilbert, writing at Vice comes this outstanding piece on the despots running Iran into the ground. Literally.
'"Dear compatriots, before going to the hospital or health center, install and use this software to determine if you or your loved ones have been infected with the coronavirus,” said the message, which claimed to come from the Ministry of Health...' 'Of course, the app couldn't tell citizens if they had coronavirus. But what it could do is hoover up huge amounts of data on citizens, including names, addresses, dates of birth, and even track people's location in real time."' - via David Gilbert, writing at Vice
via the respected information security capabilities of Robert M. Lee & the superlative illustration talents of Jeff Haas at Little Bobby Comics.
via the inimitable War Is Boring, comes news of an alleged effort (to the tune of a million simoleans) targeting an at-risk Chinese-Australian citizen to assist the People's Repbublic of China in their illicit toils to infiltrate and spy on the Australian Parliament. Stay tuned - the implications for the other Five-Eyes Nations may be equally dire (with espionage mounted by the People's Repbublic of China & Russia).
"A report aired by Channel 9 television on Sunday night reported that 32-year-old luxury car dealer Bo “Nick” Zhao was in debt to Chinese backers when he was approached by a suspected Chinese intelligence group to run for parliament for the governing Liberal Party. Zhao, who had informed the Australian Security Intelligence Organisation (ASIO) about the incident, was found dead in a Melbourne hotel room in March under mysterious circumstances.' - via War Is Boring, comes news of espionage efforts led by the Communist Chinese
Specifically, in charges filed by Letitia Wu, Special Agent assigned to the Counterintelligence Division, United States Federal Bureau of Investigation: Three suspects have been charged (the preceding downloadable file, stored at the Washington Post, was published with the original reporting) (with one detained in the United States, as the remaining two are (reportedly) physically within the sovereign boundaries of the Kingdom of Saudi Arabia) for allegedly violating 18 USC 951: Acting as Agent of Foreign Government Without Notice to Attorney General and 18 USC 1519: Destruction, Alteration, or Falsification of Records in Federal Investigations.
'The Justice Department has charged two former Twitter employees with spying for Saudi Arabia by accessing the company’s information on dissidents who use the platform, marking the first time federal prosecutors have publicly accused the kingdom of running agents in the United States.' '...'Prosecutors said a third individual, Saudi citizen Ahmed Almutairi, acted as an intermediary between Saudi officials and the Twitter employees. He is also charged with spying. Alzabarah and Almutairi are believed to be in Saudi Arabia.' - via Ellen Nakashima and Greg Bensinger - both reporters at the Washington Post
Mighty Fine Buckeyes, Folks. Mighty Fine.
Astounding flaws, reported by both Symantec and Ars Technica... What happended to OpSec? As importantly: The true ramifications for our country are yet unknown... Unless of course, this and other 'leaks' of the same or similar ilk - are, in fact - structured information operations of the highest caliber. Crafted to ensnare the miscreant espionage bounders wandering amongst us... You be the judge.
Key Findings
- The Buckeye attack group was using Equation Group tools to gain persistent access to target organizations at least a year prior to the Shadow Brokers leak.
- Variants of Equation Group tools used by Buckeye appear to be different from those released by Shadow Brokers, potentially indicating that they didn't originate from that leak.
- Buckeye's use of Equation Group tools also involved the exploit of a previously unknown Windows zero-day vulnerability. This zero day was reported by Symantec to Microsoft in September 2018 and patched in March 2019.
- While Buckeye appeared to cease operations in mid-2017, the Equation Group tools it used continued to be used in attacks until late 2018. It is unknown who continued to use the tools. They may have been passed to another group or Buckeye may have continued operating longer than supposed. - via Symantec Corporation's Threat Intelligence Blog
I suppose that's one way to do it, eh wot? 'Tis the latest brobdingnagian attempt to stay relevant in the coming world without Facebook (NYSE: FB) for young adults and teens.
Thanks to the Gulliver-level reportage of Josh Constine, writing at TechCrunch, we have now learned of what the company has monikered Project Atlas. Enjoy the future, it's on your kids phones, and they get paid to!
News of additional Huawei bad behavior, via Steve Stecklow, Babak Dehghanpisheh, James Pomfretall (and additional reporting by Nadia El-Gowely, Bozorgmehr Sharafedin and Shadia Nasralla) all writing for Reuters, exposes the questionable activities of Huawei in Iran and Syria and detailed in documents now held by US law enforcement authorities. Bad behavior, indeed.
"U.S. authorities allege CFO Meng Wanzhou deceived international banks into clearing transactions with Iran by claiming the two companies were independent of Huawei, when in fact Huawei controlled them." - News of additional Huawei bad behaviors via Steve Stecklow, Babak Dehghanpisheh, James Pomfretall (and additional reporting by Nadia El-Gowely, Bozorgmehr Sharafedin and Shadia Nasralla)
Image Credit, Chris C. Demchak and Yuval Shavitt from their paper: China’s Maxim – Leave No Access Point Unexploited: The Hidden Story of China Telecom’s BGP Hijacking
via Dan Goodin's, writing (and editing) at Ars Technica, comes his concise prose illustrating the 3rd level of hell that is BGP, plus an intentional espionage-like data gathering operation executing flawlessly for more than a calendar year by the People's Republic of China (PRC) (The evidence is thin, yet highly indicative of some level of foreknowledge (perhaps even Command and Control) by the Communist Chinese regime)). And, then there's this... All In All, Certainly A Caper Worth Concerted Investigation...
Apple Inc. (Nasdaq: AAPL) has quite forcefully denied the (via Reuters, reportedly written by George Stathakopoulos - Apple’s Vice President for Information Security) existence of surreptitious-command-and-control-chip-insertions on system boards within devices manufactured by Super Micro Computer Inc. (NASDAQ: SMCI) under contract with and deployed/implemented by Apple Inc. within the latter's data centers. Interestingly, there is some evidence of security-related issues two years ago betwixt Apple, Inc. and Super Micro Computer Inc.... And then there's The Grugq, whose typically clear and exacting opinions are trusted hereabouts - his view appears here (you'd do well to listen to his take). Regardless of what path you walk in discerning the truth of this particularly murky debacle, one thing is clear - human nature given what it is, there is certainly an abundance of vile perniciousness floating about this scenario that has yet to be revealed.
Update: Axios has announced it has dropped the letter referred to in this post to Sribd, here.
via Dan Goodin's superlative reportage at ArsTechnica, we learn of the action in Panmunjom was - colloquially - the tip of the iceberg...
"It would be highly unusual for any country to cease intelligence gathering operations in the midst of some of the most important talks in their history," Sergio Caltagirone, director of threat intelligence at security firm Dragos, told Ars. Previously, he was a senior threat intelligence analyst at the US National Security Agency. "In fact, we would expect espionage activity to grow during periods of negotiation." - via Dan Goodin reporting at ArsTechnica
via The Daily Beast's Spencer Ackerman and Kevin Poulsen, comes the tale of Guccifer 2.0, an officer of the GRU, Russia’s Main Intelligence Directorate (also known as, the Russian Military Intelligence Directorate); and, of course, there's this and this.. H/T
What more do you want (or need, for that matter), in an astute and equally important - truthful - examination of what makes those pesky Rooskies tick. In this case, personified by that old KGB spymaster Putin. Today's Must Read.
News via Reuters Staff details a complaint from the German domestic intelligence agency (the interestingly monikerd Federal Office for the Protection of the Constitution - Bundesamt für Verfassungsschutz) that Silicon Valley interweb-kingpins (think Facebook, Twitter, et cetera) are anti-democratic...
You be the judge.
