#Encrypted Apps Amid Cyberattack
Explore tagged Tumblr posts
Text
Encrypted Apps Advised by U.S. Officials as Cyberattack Concerns Grow

Salt Typhoon is one of the largest cyber breaches in U.S. history, infiltrating at least eight phone companies and affecting global communications. Hackers targeted high-ranking government officials, raising serious security concerns. In response, U.S. officials emphasize using encrypted messaging apps like Signal and WhatsApp to protect sensitive conversations. Encryption ensures only intended recipients can access messages, reducing risks from cyberespionage. With evolving cyber threats, experts also recommend enabling automatic updates and multi-factor authentication to strengthen digital security.
0 notes
Text
FCC Proposes Tougher Cybersecurity Rules for Telecom Firms Amid Rising Threats
The FCC has released a notice of proposed rulemaking designed to enhance cybersecurity within the US telecom sector, following a constant threat from foreign hackers, including the Chinese-linked group Salt Typhoon, which has breached major telecom providers in recent years.
The proposal will implement rigorous security measures by the service providers to prevent unauthorized access, securing the communications. Each year, providers will provide a certification to the FCC for following these enhanced security guidelines for cybersecurity.
Greater Dangers to Telecom NetworksThis makes the proposal all the more urgent, as recent reports detail how US telecom networks continue to suffer from cyberattacks. A state-sponsored hacking group known as Salt Typhoon reportedly breached at least eight telecom providers, some of the attacks dating one to two years. The breaches have raised alarm about the potential compromise of sensitive information, though officials maintain that classified communications remain unaffected.
As recently pointed out by Deputy National Security Advisor Anne Neuberger, it is tough to address these breaches. "We cannot say with certainty that the adversary has been evicted because we still don't know the scope of what they're doing," she said during a press briefing.
Legislative and Security ConcernsThe breaches have also galvanized lawmakers into action. Senators Eric Schmitt (R-MO) and Ron Wyden (D-OR) have called for an investigation into the Department of Defense's failure to secure its unclassified telephone communications against foreign espionage. Their concerns mark the wider vulnerabilities in US communication infrastructure and a need for immediate reforms.
FCC's Call for AccountabilityFCC Chair Jessica Rosenworcel underscored the need to enforce the proposed rule: "While the Commission's counterparts in the intelligence community are determining the scope and impact of the Salt Typhoon attack, we need to put in place a modern framework to help companies secure their networks and better prevent and respond to cyberattacks in the future," she said.
If adopted, the rule would make the telecom companies responsible for protecting their networks against increasingly sophisticated threats. The FCC is seeking to ensure that providers remain vigilant in maintaining strong cybersecurity defenses through annual certifications.
Recommendations for ConsumersWith these events unfolding, policymakers are now encouraging Americans to switch to encrypted apps when making calls or sending messages to better safeguard their personal communications. This shows the increasing ways in which individuals must implement precautions during these times when cyber threats have increased.
A Step Towards a Secure FutureThe proposal from the FCC is a step towards fixing some of the very fundamental vulnerabilities within the nation's telecommunication infrastructure. This decision puts accountability and proactive security policies at the heart of its strategy to limit threats from foreign hackers and ensure better cybersecurity practices for years to come.
If adopted, the rule would be a turning point in the battle against cyber threats, with the intention of keeping US telecom networks resilient against changing challenges.
Read More: https://www.theiconicsuccess.com/fcc-proposes-tougher-cybersecurity-rules-for-telecom-firms-amid-rising-threats/
#IconsEdgeMagazine#GlobalBusinessMagazine#TETechnologyMagazines#IconsEdgeMedia#inspiringbusinessleaders
0 notes
Text
Managed IT Services: Enhancing Business Efficiency & Cybersecurity
For businesses looking to scale and secure their operations, managed IT services have become an essential solution. Whether you’re considering managed service providers (MSP IT), need IT support in London, or are looking for small business IT solutions, having the right IT strategy is critical to staying ahead in today’s technology-driven world.
What is a Managed Service Provider (MSP)?
A managed IT service provider (MSP) delivers comprehensive IT support, handling everything from on-premise IT maintenance to cloud security solutions. The benefits of managed IT services include:
Cost savings – Reducing the need for an in-house IT team.
Enhanced cybersecurity – MSPs provide cybersecurity consultants and computer security consultancy to safeguard business data.
Proactive IT maintenance – Preventing downtime and ensuring smooth operations.
Managed Services Support & IT Solutions
Businesses rely on managed services IT to address key areas such as:
End of support software – Ensuring a seamless transition from EOL (End of Life) software to updated systems.
IT relocation – Moving business-critical infrastructure without disruption.
IT services in healthcare – Providing IT security policy management for sensitive data.
IT support for law firms – Ensuring compliance with legal and data protection standards.
Understanding Business Continuity & Security Policies
A robust IT security policy is crucial for safeguarding business data. This includes rights management in Azure, Azure security score monitoring, and cybersecurity consultants implementing best practices.
Key Concepts in Business Continuity:
What is disaster recovery in IT? – Disaster recovery ensures businesses can recover data and resume operations after cyberattacks or system failures.
What is BAU (Business as Usual)? – BAU refers to maintaining seamless day-to-day operations even amid IT changes.
What are security policies? – Defining policies that manage access, encryption, and cyber threat prevention.
Choosing the Best Authentication & Collaboration Tools
In today’s remote working environment, choosing secure authentication and collaboration tools is vital.
Google Authenticator for Windows – A widely used authentication app for securing accounts.
Best authenticator apps UK – Ensuring businesses have the best multi-factor authentication solutions.
Teams vs Slack – Comparing two of the most popular business communication platforms.
Slack from Microsoft? – Examining how Slack integrates with Microsoft solutions.
Why Feedback is Important in IT Strategy
Understanding the purpose of feedback is critical in IT service management. Feedback ensures:
Continuous improvement in IT strategies.
Better adaptation to roadmap IT initiatives.
Enhanced user experience in IT support London and MSP London services.
Conclusion: The Future of Managed IT Services
The demand for managed IT service providers continues to grow as businesses look for reliable IT consultants in London, robust cybersecurity consultancy, and expert PC repair in Woking. Whether you're a small business or an enterprise, managed service provider benefits include long-term IT sustainability and enhanced security.
Explore Managed IT Services with PilotIQ
If you need managed IT services support, cybersecurity solutions, or IT services for healthcare, visit PilotIQ - https://www.pilotiq.co.uk/ to learn more about how our expert team can help secure and streamline your IT operations.
0 notes
Text
0 notes
Link
0 notes
Text
0 notes
Text
US Officials Urge Americans to Use Encrypted Apps Amid Unprecedented Cyberattack
http://i.securitythinkingcap.com/TGZfRD
0 notes
Text
Exploring Web Development Trends for 2024
The future of web development trends in our quick guide to the trends of 2024. Whether you’re a seasoned pro or just starting, this blog is your go-to for staying updated. Dive into the latest insights and ensure your success in the dynamic world of web development services. Let’s decode the trends together!”
1. Advancement in Single-Page Applications (SPAs):
The era of cumbersome page reloads is fading away. SPAs, led by frameworks like React and Vue.js, introduce seamless navigation and dynamic content updates, promising swift performance and heightened user engagement.
2. Integration of Progressive Web Apps (PWAs):
Blurring the lines between websites and mobile apps, PWAs provide app-like experiences with offline functionality and push notifications. Their flexibility makes them accessible to a broader audience
3. Embrace of Serverless Architectures:
Bid farewell to intricate server management. Serverless architectures delegate backend tasks to cloud providers, allowing developers to focus on crafting compelling front-end experiences.
4. Rise of Artificial Intelligence (AI):
AI is no longer confined to science fiction. From chatbots to personalized content, AI is reshaping user interactions. Anticipate deeper integration into content creation and data analysis
5. Voice Technology Integration:
Virtual assistants like Siri and Alexa pave the way for voice-enabled web apps, enabling intuitive navigation through voice commands. This inclusive feature aligns with user-friendly practices
6. Focus on Cybersecurity:
With the growing threat of cyberattacks, robust security measures take center stage. Data encryption, secure coding practices, and routine vulnerability assessments.
7. Internet of Things (IoT) Integration:
Web apps evolve into control centers for the IoT, allowing users to manage smart devices directly from their browsers.
8. Sustainability Initiatives:
Amid heightened climate change concerns, web developers adopt sustainable practices. This includes optimizing code for reduced energy consumption and creating apps that promote environmental awareness. Such initiatives resonate with eco-conscious
9. Augmented and Virtual Reality (AR/VR) Integration:
AR and VR are no longer niche technologies. Web apps incorporate these immersive elements to offer interactive experiences, impacting user engagement.
10. Emphasis on Collaboration:
Collaboration becomes paramount in web development. Teams work collaboratively across disciplines, emphasizing communication and agile methodologies to create exceptional user experiences.
Explore the world of Web Development with Synsoft Global, your trusted partner for all your Web Development Services. As pioneers in cutting-edge technology, we invite you to reach out and discover a myriad of possibilities.
0 notes
Text
Elections amid coronavirus: How officials aim to keep voters safe
Voters in Washington state on March 9 turning in ballots amid the coronavirus outbreak.
John Moore/Getty Images
For the most up-to-date news and information about the coronavirus pandemic, visit the WHO website.
This story is part of Elections 2020, CNET’s full coverage of the 2020 elections.
The coronavirus outbreak has put much of the US out of service, shutting down schools, stores and sports events for the foreseeable future. With several crucial primaries coming up in the US presidential race, election officials need to figure out how to get the vote out while handling a public health crisis.
On Monday, we got a sign of just how fluid the situation is, as Ohio planned to postpone its primary, a day ahead of scheduled voting. Three other states — Arizona, Florida and Illinois — are forging ahead with their primaries Tuesday.
It was just on Friday that election officials for those states issued a group statement saying they planned to keep the primaries going, despite the outbreak. Several of those states are considered battleground states for the presidency.
“They voted during the Civil War. We’re going to vote,” Florida Gov. Ron DeSantis said at a press conference Friday.
That was two days before the Centers for Disease Control and Prevention on Sunday urged against gatherings of more than 50 people throughout the next eight weeks.
Then on Monday afternoon, President Donald Trump advised against gatherings of more than 10 people. At around the same time, Ohio Gov. Mike DeWine announced that he planned to postpone the state’s primary to June 2.
Now playing: Watch this: Coronavirus care gets help from AI
0:26
Controlling the spread of the coronavirus and of COVID-19, the disease that results from it, is reliant on limiting crowd sizes and practicing social distancing, which could be hard to do at polling places. Voting machine manufacturers have told election officials how to best clean machines, but that may not be enough to overcome larger public health concerns.
“We cannot conduct this election tomorrow, the in-person voting for 13 hours tomorrow, and conform to [CDC] guidelines,” DeWine said at a press conference.
While primaries in Georgia and Louisiana have been delayed, and other states are looking at alternative procedures, the general election in November cannot be postponed, meaning that election officials will have to find a way to maintain the race amidst a pandemic.
The alternatives
Lawmakers like Sen. Ron Wyden, a Democrat from Oregon, have proposed legislation that would require all states to offer voters the option to vote by mail. The emergency mandate would go into effect if 25% of states declared a state emergency related to a public health crisis like COVID-19, the senator said. Oregon, nearly 20 years, became the first state to move to voting entirely by mail.
“No voter should have to choose between exercising their constitutional right and putting their health at risk,” Wyden said in a statement. “When disaster strikes, the safest route for seniors, individuals with compromised immune systems or other at-risk populations is to provide every voter with a paper ballot they can return by mail or drop-off site. This is a nonpartisan, commonsense solution to the very real threat looming this November.”
The bill is co-sponsored by Sen. Amy Klobuchar, a Democrat from Minnesota who suspended her presidential campaign earlier this month.
“Americans are facing unprecedented disruptions to their daily lives, and we need to make sure that in the midst of this pandemic, Americans don’t also lose their ability to vote,” Klobuchar said in a statement.
“We cannot conduct this election tomorrow, the in-person voting for 13 hours tomorrow, and conform to [CDC] guidelines.”
Ohio governor Mike DeWine
Wyoming, which is supposed to have a caucus on April 4, suspended the in-person vote and is encouraging people to vote by mail instead.
In Wisconsin, election officials are planning to go on with that state’s primary on April 7, but they would prefer people voted remotely.
“At this point, we are focusing on strongly encouraging everyone to vote absentee by mail in Wisconsin for April 7,” a Wisconsin Elections Commission spokesman said in an email.
While states like Wisconsin and Washington have the opportunity to vote by mail, 16 states in the US don’t, raising concerns for both public health and voter turnout this election.
Election officials have already released cleaning guidelines for voting machines, asking poll workers to regularly clean machines, but with warnings about prolonged exposure to disinfectants damaging the touchscreen.
Another set of cleaning guidelines stated that the voting machines will be cleaned only at the beginning and end of the day — and that their cleanliness would be mostly reliant on voters using hand sanitizers and washing hands in between.
On Tuesday, the Elections Assistance Commission announced that it was allowing state officials to use funds intended for voting machine upgrades to pay for disinfecting wipes and cleaning supplies during the COVID-19 pandemic.
“”Election officials are contingency planners and have been grappling with the tough choices regarding the safety of voters, election workers, and their staff since the threat of this virus emerged,” said EAC Chairman Ben Hovland. “We have immense respect for their leadership and the difficult decisions they are making.”
Wisconsin voting officials don’t see any election security concerns with mail-in ballots, a method that’s considered more secure than online voting.
Interest in voting by app
Voting online is a controversial subject among election security experts. Many argue that there are simply too many vulnerabilities in the chain to ensure a safe, tamper-free ballot.
Despite the warnings, voting by a mobile app has happened in West Virginia, and web voting is allowed in states such as Arizona, Colorado, Missouri and North Dakota.
Voatz CEO Nimit Sawhney said that election officials have been reaching out with more interest about using the company’s mobile voting app.


Startup Voatz uses blockchain technology to record votes that overseas citizens and military personnel can make with their smartphones.
West Virginia Secretary of State; screenshot by Stephen Shankland/CNET
“We’re seeing that the elderly and those with compromised health face a potential life-threatening risk,” Sawhney said in an email. “The conversation about voting resilience, especially in this important election year, is paramount to design in the midst of this uncertainty.”
The company didn’t clarify which states these voting officials represent, or how serious these conversations have been.
Voatz has been used in 50 elections since 2016, with more than 80,000 votes cast on the app. The company says it secures votes from cyberattacks using blockchain to encrypt the data. It also says it’s open to conversations about offering its software for free during the pandemic, though it’s unclear if states’ voting system guidelines would allow a massive switch to a new system at the last minute, since they vary by state.
Even if election officials were allowed to adopt Voatz in response to the coronavirus outbreak, the company is still plagued by cybersecurity concerns. On Friday, cybersecurity firm Trail of Bits published a security assessment of Voatz, with granted access to the company’s core server and backend software.
The research confirmed issues raised by MIT researchers about the app. The MIT review, published in February, warned about vulnerabilities that could allow potential attackers to change votes and de-anonymize voters.
Voatz hired Trail of Bits to conduct a security review last December and found 79 issues with the software — one-third of which were considered high-severity. Those issues included improper use of cryptographic algorithms, personal information that can be leaked to attackers and insufficient monitoring for potential attacks.
Trail of Bits said that Voatz addressed some of the concerns raised, but that 34 of the issues have still not been addressed. In a blog post from Friday, Voatz said that it would be publishing more reports on its own security audits.
“Across our corporate and elections infrastructure, we follow industry best practices, including end-to-end encryption and layered security to provide defense in-depth, and our intention is to continue these practices as we work to help whomever is in need of a safe, alternative method of voting this year,” Sawhney said.
The statement contradicts Trail of Bits’ findings, which note that Voatz’s ballots don’t protect voter identities and are tied to device IDs that are also collected by advertising companies.
Wyden has said he’s skeptical of online voting, and he’s proposed bans on federal funds being used for that purpose.
“Just last week a damning audit showed that not only was Voatz dangerously insecure, but the company had lied about previous audits that showed security holes,” Wyden said. “Internet voting is the wrong answer to this crisis.”
Some primaries will go on, for now
While the coronavirus outbreak has raised concerns about both public health and voter turnout, digital alternatives haven’t been a major part of discussions.
The focus among counties has been to control crowds by either encouraging people to vote by mail — which is already set up in some states — or pushing people to vote in intervals.
“Early voting continues today, and we continue to encourage early voting as a way to limit election polling place traffic,” Matt Dietrich, a public information officer for the Illinois State Board of Elections, said Monday.
The state has had 504,000 early votes cast, and 294,000 mail ballots sent, and expects to set records for early and mail voting in Illinois.
Congress needs to act immediately to ensure Americans don’t need to choose between their health and their constitutional rights.
Sen. Ron Wyden
Rather than hastily introducing a new online voting method, election experts are opting for measured approaches to getting the vote out while keeping people safe from coronavirus. That means improving access for early voting, keeping both voting machines and voters clean, and moving polling locations away from where communities could be affected by the outbreak like retirement homes.
Those are all local decisions by county officials, who set the guidelines for how elections are run in each region. That means that by the time the primaries arrive in your state, the coronavirus’ effect on voter turnout could be significantly different.
If Wyden and Klobuchar’s legislation passes, it would mandate an option to vote by mail across the US, not just in 34 states.
“Congress needs to act immediately to ensure Americans don’t need to choose between their health and their constitutional rights,” Wyden said. “My bill with Senator Klobuchar will ensure every American has the chance to vote by mail, and give states the support they need to go ahead with elections in the face of this unprecedented emergency.”
Source link
from WordPress http://justtoosilly.com/2020/03/17/elections-amid-coronavirus-how-officials-aim-to-keep-voters-safe/
0 notes
Text
How to protect yourself from cyberattacks when working from home during COVID-19
The global spread of the COVID-19 (coronavirus) has a notable impact on workplaces worldwide, and many organizations are encouraging employees to work from home. But suddenly working remotely can be a major change for both — organizations and employees. It can bring a number of problems with regard to cybersecurity.
While working from home, the boundaries between work and private life are breaking down. Business is being done over home ISPs, with vulnerable printers and routers, home automation systems in the background and even partners and children listening in on conversations or sharing machines while working for different organizations.
Amid all this chaos, new security threats are surfacing. Some are old attacks brought back now that we have become more vulnerable now, and others are new scams. Traditional security measures that have been used daily for years can’t protect a fully remote staff without adaptation. That means we need to rethink our mindsets and approach to security right now.
Online Work Increases Cyber Security Risks
Without the security protections that office systems afford us — such as firewalls and blacklisted IP addresses — we are far more vulnerable to cyber-attacks.
The most obvious risk is that most of our tasks are done online — and if something’s on the Internet, then there’s always the possibility of a cyber-criminal compromising it.
They might attempt to do this by cracking your password, which could be easier than ever if you’re reusing login credentials for the various online apps which you are using to stay in touch with your team / co workers.
Alternatively, attackers could send phishing emails that are intended to trick you into either handing over your details or downloading a malicious attachment containing a keylogger.
The dangers of phishing should already be a top concern, but things are especially perilous during the coronavirus crisis. A recent report found that there has been a 600% increase in reported phishing emails since the end of February, with many of them cashing in on the uncertainty surrounding the pandemic.
Information Can Be Weaponized
In the past few weeks, attackers have started taking advantage of human weaknesses. Recent example of this is when hackers have developed a malicious mobile application posing as a legitimate one developed by the World Health Organization. A vulnerable person could easily mistake this malicious app for a real WHO app. Once installed, the application downloads the Cerberus banking trojan to steal sensitive data.
These types of attacks essentially weaponize sensitive information, because they can easily be done with applications that provide legitimate benefits, too. Before, attackers had to plan their cons for diverse interests and lures, but right now the entire world is sharing a mutual crisis. COVID-19 has become our common watering hole, but with the right awareness and education, we will be able to defend ourselves.
Devices / Apps Should Be A Concern
Organizations should also be concerned about employees using their own devices and using trusted software / apps.
This ensures that the necessary tools are in place to defend against cyber security risks, such as anti-malware software and up-to-date applications.
It also gives IT team oversight of the organization’s IT infrastructure and allows it to monitor any malicious activity, such as malware or any unauthorized logins.
The Bottom Line
Once and for all, working from home could be a very stressful situation for you because attackers and hackers are already active out there, but with the right tools and proper awareness you can put yourself in a safe environment even while working from home. Below are a few tips you need to follow to stay ahead in this period of adjustment:
Protect your devices with an antivirus solution
Update programs and operating system
Configure Wi-fi encryption
Frequently change login credentials of your router
Use a VPN in case connecting to public Wi-fi networks
Do not exchange sensitive corporate information through possibly insecure connections
Use encrypted communication service like Signal Private Messenger
Signal app is completely free & Ads free for Android, iOS, and for computers. Moreover, it’s easy to install & use and so architecturally secure that you can have the full confidence to say whatever you want without fear of being spied on or your personal data being intercepted by any third party.
Trusted by millions already, Signal is end-to-end encrypted, simple, and free (non-profit). Signal is the only messaging & calling app you need on your phone & desktop to handle all your communications needs safely & privately.
Get Signal App NOW & Stay Safe!
#SignalSafety #StayHome #StaySafeWithSignal
0 notes
Text
intelligence-news.com: China behind powerful cyber attack during Hong Kong protests, Telegram claims
https://mondrian.mashable.com/uploads%252Fstory%252Fthumbnail%252F97963%252F36f47345-74a9-44d8-af1c-ab8edfd77fe9.jpg%252F575x323__filters%253Aquality%252880%2529.jpg?signature=z91JYh1gs12pdflXUnolXL69FUA=&source=https%3A%2F%2Fblueprint-api-production.s3.amazonaws.com Encrypted messaging app Telegram said it was hit with a massive DDoS attack amid widespread protests in Hong Kong. Telegram claims the attack, which caused app interruptions, originated from Chinese IP addresses. Read more here. Read more… More about China, Mashable Video, Hong Kong, Telegram, and CyberattackEncrypted messaging app Telegram said it was hit with a massive DDoS attack amid widespread protests in Hong Kong. Telegram claims the attack, which caused app interruptions, originated from Chinese IP addresses.Read more here. Read more…More about China, Mashable Video, Hong Kong, Telegram, and Cyberattack […]Read More https://is.gd/KitxLh
0 notes
Link
Fen Zhao Contributor
Share on Twitter
Fen Zhao is an early stage investor at Alpha Edison who previously developed public private partnerships at the National Science Foundation in the areas of data science and cybersecurity.
For most people, the thought of a smart device sharing their intimate conversations and sending those recordings along to their acquaintances is the stuff of dystopian nightmares. And for one family in Portland, it’s a nightmare that became all too real when their Amazon Echo sent a recording of a private conversation to a random contact in their phone book.
Mercifully, the recorded conversation was fairly banal — a chat about home renovations. But as smart home technology is swiftly being integrated into our daily lives and private spaces, it’s not difficult to imagine far worse scenarios.
Smart speakers record residents’ conversations. Thermostats equipped with motion sensors track the whereabouts of each household member, and when they leave the house. Refrigerators remember grocery lists and spending habits. One thing is clear: when residents invite smart technology into their homes, they are gambling with their privacy.
Ironically, the smart home may turn out to be the salvation of online privacy itself. Internet companies have gotten away with hoarding people’s personal data for so long in part because of what experts call “the privacy paradox”: while most people claim to care deeply about online privacy, very few of them take action to protect it. Just look at the recent furor over Facebook’s lack of data privacy protections, which resulted in the compromise of 87 million users’ personal information. Though plenty of people tweeted they would #DeleteFacebook, how many actually permanently closed their accounts? Certainly far fewer than 87 million.
While experts disagree about why this paradox exists, at least some of the problem seems rooted in the fact that online space is virtual, whereas our privacy instincts evolved in physical space. By bringing virtual privacy incursions into the physical world—particularly into the protected private space of the home—smart home technology could short-circuit that dynamic.
The internet is intangible, and so its privacy risks appear to be too. It’s one thing to know, in the back of your mind, that Facebook has the ability to comb through your private messages. But when devices in your home are recording your spoken conversations and physical movements, it’s harder to ignore the looming threat of potentially disastrous privacy violations.
If smart fridges and smart locks get people to take online privacy as seriously as physical privacy, they could do what the Equifax hack and other high-profile data breaches could not: actually get people to change their behavior. If users vote for privacy with their feet—or their wallets—they could spur a wholesale rethinking of the online economy, away from one-sided exploitation and toward greater trust and transparency.
Privacy in virtual space
In Western culture, the home has long been recognized as a protected zone; the Talmud includes prohibitions against putting in windows in a house that directly look into a neighbor’s. When a stranger peeps through our window or listens at our door, millennia-old norms tell us we should chase them away. This desire for isolation may stem from a fundamental biological need; whether you’re a human or a possum, physical withdrawal means concealment and protection from predation, making privacy an evolutionary life-or-death matter.
But websites and apps have no physical presence in our lives. A software algorithm, no matter how malicious, doesn’t have the visceral menace of an unknown face at the glass. The internet disarms us by making our interactions feel abstract, even unreal. One 2016 study posited that this sense of unreality leads to contradictory attitudes about online privacy: while people know rationally that they should be concerned about virtual incursions, they simply don’t have a strong “gut feeling” about it intuitively. And when making decisions in the moment, gut feeling often wins out.
The problem is exacerbated by the fact that online, there is less of a clear distinction between private and public space. We use social media to communicate simultaneously with hundreds or thousands of anonymous followers and with our closest friends. Email inboxes, Slack channels, and the like are more obviously “closed” spaces, but even there it’s often unclear to users which algorithms might be listening in. Even Snapchat—known for auto-deleting users’ photos, videos, and chats to protect their privacy—announced it would allow retargeted ads in fall 2017, to relatively little backlash. It’s hard to think about protecting ourselves from the stranger peeping in the window when we’re not even sure if it’s a public or private space he or she is looking into. What’s more, many users tend to imagine online “walls” that aren’t really there.
Multiple studies have shown that the mere existence of a privacy policy on a website makes users feel more secure, even though a policy in itself is no guarantee that their data won’t be sold to third parties.
“How secure are your light bulbs?”
When the internet enters the clearly private space of the home, some of that ambiguity will to disappear. It’s telling that a November 2017 survey by Deloitte found that consumers are more cautious in general about smart home devices compared to general online activities or even other categories of IoT. Forty percent of respondents said that they felt smart home technology “reveals too much about their personal lives,” while another 40 percent said they were worried about their usage being tracked. By comparison, they were less mistrustful of other IoT applications like autonomous vehicles and smart car technology, even though they have similar tracking capabilities.
And that survey only considers peoples’ reaction to fairly abstract privacy risks. The reality is that in a smart home, security vulnerabilities and data breaches can have much more dramatic real-world impacts. On his blog Charged, developer and journalist Owen Williams recently detailed his experience trying to figure out who or what kept overriding his brightness settings for his Phillips Hue smart light bulbs. It turned out that an app he’d enabled to dim his office lights at night had taken over all the bulbs hooked up to Williams’ Hue system and was keeping them at one uniform brightness.
As Williams points out, if a malicious app accomplished the same feat, it could extort money from the user by “randomly changing the brightness or color of lights until they pay.” When a cyberattack results in lights that won’t stop flashing—or doors that won’t lock, windows that won’t close, or a fridge turns itself off and melts all your ice cream—it’s logical that people’s reactions to digital privacy incursions will become that much more extreme.
Image courtesy of RamCreativ
Trust is the antidote
How can internet companies thrive in the privacy-sensitive space of the home? If privacy behavior is mostly about gut feelings, they’ll need to reinforce positive ones by winning consumers’ trust.
Trust has not historically been a major factor in the adoption of complex new technologies—research into technology acceptance models on both virtual and IOT systems shows that usability has been much more important. Even heavy users of Google and Facebook probably wouldn’t say that they trust either company very deeply.
However, a look at another internet giant, Airbnb, shows how this calculus changes when users’ homes and not just their online identities are involved. Airbnb puts trust at the core of its business model. Hosts are only willing to open their homes to strangers because the company empowers them with access to information about potential guests (which the guests themselves choose to provide), including their bio, reviews, and public Facebook profile.
By focusing on forging connections between hosts and guests, Airbnb builds community and reduces the uncertainty that pervades users’ relationships with so many internet companies. Airbnb is also relatively transparent about how it collects and analyzes user data, and often puts it to use in ways that increase users’ control over how they use the platform—for instance, to generate more accurate pricing suggestions for hosts. The result: it pushes users’ concerns about opening their homes or staying in others’ spaces out of the realm of gut feeling into that of a more considered, rational (and easy to ignore) concern.
If they want to thrive amid rising privacy concerns in the long term, manufacturers of smart home products, would be wise to take a page from Airbnb’s book. They should find ways to forge trust through absolute transparency, sharing with customers what data is being collected and how it’s being used. They should create new business models that don’t rely on collecting terabytes and terabytes of personal data, but on building trust – and even community – with customers.=
Companies should not only implement best practices for personal data encryption, storage, sharing, and deletion, but design their products around the customer’s ability to control their own data. If the development of IoT follows this path, the next 10 to 15 years won’t bring an inevitable erosion of privacy, but its renaissance.
via TechCrunch
0 notes
Text
Feds transfer to safe cellular units with machine studying, biometrics
New Post has been published on https://takenews.net/feds-transfer-to-safe-cellular-units-with-machine-studying-biometrics/
Feds transfer to safe cellular units with machine studying, biometrics
Amid the rising use of cellular units for work by federal staff, U.S. protection and intelligence companies are quick adopting biometrics and different other ways of computer systems, smartphones and tablets, in accordance with a brand new report.
Greater than 90% of federal company IT officers in a web-based survey mentioned their organizations present safe cellular entry for work-issued units, however lower than 20% help employees’ private units to entry most company methods. Forty p.c of those self same officers voiced concern about securing private units, in accordance with the web survey of federal authorities IT and cybersecurity officers.
The survey discovered that amongst federal employees: 33% depend on private laptops, 49% depend on private smartphones and 74% depend on private tablets for work – regardless that federal company IT managers do not help most of these units.
Moreover, solely 25% of federal officers surveyed mentioned they’ve totally applied methods to safe endpoints (equivalent to utilizing endpoint detection and response, community entry management, end-to-end encryption and utility management).
Even so, the U.S. authorities is outpacing the non-public sector in deploying the most recent endpoint cellular safety expertise, a research of the survey revealed.
The survey of 167 respondents was funded by Samsung and performed by on-line publications CyberScoop and FedScoop. Responses confirmed greater than half of federal company IT officers fear about cyberattacks utilizing cellular units as a way of accessing company networks.
Whereas 6 in 10 IT officers mentioned that securing government-issued or private cellular units is a prime concern over the following 12 to 18 months, many could also be overlooking expertise they have already got to deal with safety considerations, equivalent to fashionable shopper cellular units that help biometrics, containerization and derived credentialing.
Derived credentials refers to private id verification (PIV) card or widespread entry card (CAC) expertise embedded on a cellular gadget as a substitute of a bodily card.
One prime want indicated by these surveyed is the power to centrally handle and configure cellular units and remotely lock down units and get well information if a breach happens.
“They usually want better steering on rising safety threats, assembly federal safety mandates and technical help for securing units,” the report mentioned.
One downside with counting on consumer-based safety measures is that it merely does not meet authorities requirements, in accordance with Patrick Hevesi, a Gartner analysis director.
Shopper biometrics, equivalent to fingerprint readers and facial recognition expertise on cellular units, don’t sometimes meet the federal authorities’s increased and software program requirements.
“To attempt to get government-grade biometrics right into a smartphone, the prices could be astronomical,” Hevesi mentioned. “So those within the iPhone, the Android telephones are nonetheless not authorities stage.”
Federal companies additionally face a wide range of limitations to securing endpoint units; price range funding, a cumbersome approval processes, lack of inner experience and the necessity for better steering on rising threats and technical help had been among the many most often-cited obstacles.
Finish level safety has historically centered on Linux, Home windows or macOS desktops and laptops and primarily got here within the type of anti-malware software program. That, nevertheless, solely scans for recognized unhealthy recordsdata or apps and blocks them. As a result of cellular units are architected in a different way, anti-malware has not been an efficient safety measure, Hevesi mentioned.
“Now, as a result of a lot is going on on these iPads, iPhones and Androids, the necessity for added [threat defense] capabilities is necessary,” Hevesi mentioned.
About 4 years in the past, cellular menace detection (MTD) software program and providers started to emerge as a solution to detect insecure Wi-Fi networks, alert customers to safety vulnerabilities related to a cellular OS model and even prohibit community entry primarily based on person conduct. (MTD makes use of machine studying and depends on on-device software program and crowdsourced menace intelligence and behavioral anomaly detection.)
Conduct evaluation algorithms in MTD can detect if an worker out of the blue turns off the encryption or passcode operate on their smartphone or activates USB debugging once they’re not a developer. The MTD software program would then shut off the worker’s entry to a company community till they’re once more cleared.
To detect insecure Wi-Fi networks, equivalent to these in a restaurant or airport, MTD software program might use crowdsource databases that mixture info beforehand reported – or it might detect nefarious-looking connections, equivalent to a pineapple Wi-Fi router. That gadget is a small, cheap router that may surreptitiously join smartphones or different cellular units to a distinct community than the Wi-Fi community a person means to affix.
MTD software program can even detect undesirable purposes or so-called “leaky apps” that may not be insecure themselves however might request entry to different cellular instruments, equivalent to location. For instance, many flashlight apps, which activate a cellular gadget’s LED gentle, typically request permission to entry file methods, community information and speak to lists.
“So, it is not essentially malicious, nevertheless it might do one thing unhealthy with that information,” Hevesi mentioned.
The adoption of extra subtle endpoint safety instruments is clear with conventional enterprise mobility administration (EMM) distributors equivalent to McAfee, MobileIron and Symantec who’re partnering with MTD distributors equivalent to Skycure and Zimperium so as to add the expertise to their very own merchandise.
For instance, Microsoft has been working with MTD distributors so as to add risk-based conditional community entry to its Intune cellular utility administration (MAM) instrument.
“So, earlier than I permit entry to Workplace365 on a cellular gadget, if they’ve the MTD put in on it, it might detect the state of well being of the cellular gadget,” Hevesi mentioned. “You are undoubtedly seeing extra curiosity in having superior strategies for shielding cellular units. Not solely authorities companies, however all enterprises are starting to assume extra about this.”
In the present day, most EMM vendor software program can combine with varied MTD brokers working on a cellular gadget, and the software program can mechanically decide if that gadget threat is excessive, medium, low or at no threat in any respect of being compromised.
Whereas Android is the biggest goal for cellular malware and undesirable purposes, iOS cellular assaults proceed to floor, in accordance with a current Gartner report, “Advance and Enhance Your Cell Safety Technique in 2018.”
“Cell safety merchandise have gotten more and more necessary as the speed of cellular assaults continues to develop, although these assaults are nonetheless not on the ranges of conventional endpoint assaults,” the report mentioned.
Gartner suggests IT professionals concerned in endpoint and cellular safety:
This story, “Feds transfer to safe cellular units with machine studying, biometrics” was initially printed by Computerworld.
0 notes
Text
Inside The Hunt For Russia’s Hackers
SAN FRANCISCO — Just past 8 a.m. on March 14, police trod quietly through the snow to the double-fronted doors of Karim Baratov’s lavish home in Ancaster, Ontario. The officers passed by the garage where Baratov’s jet-black Mercedes Benz and Aston Martin DBS were parked, two of the only outward indications that the 22-year-old had money to spend. Minutes later, they took the Canadian-Kazakh hacker away into custody — a subdued end to an international cyber drama that involved the highest levels of the US government, Russian spies, a global cybercrime syndicate, and hundreds of millions of unsuspecting Americans.
The baby-faced Baratov is currently awaiting trial in the US on charges that he helped hack into half a billion Yahoo accounts — the largest known hack in history. His co-conspirators are Alexsey Belan, 29, a notorious Russian hacker still at large, and two Russian intelligence officers, Dmitry Aleksandrovich Dokuchaev, 33, and Igor Anatolyevich Sushchin, 43. The case against them is the starkest public example of the ways in which the Russian government works with cybercriminals to achieve its global agenda through cyberwarfare, and why those attacks have proven so difficult for governments around the world to track, let alone prosecute.
Left to right: Baratov, Dokuchaev, and Sushchin.
Courtesy FBI
Baratov, according to accounts given by US law enforcement, was a hacker for hire. It appears he simply took the wrong job.
“The Yahoo hack is a great example of the US government coming forward and saying we know what you are doing and we can prove it,” said Milan Patel, the former chief technology officer of the FBI’s cyber division and now managing director at the K2 Intelligence cybersecurity firm. “In the past the US and Russia engaged in a lot of tit-for-tat covert operations. But with Russia now, a lot is coming to the forefront and being made public about how they run their cyberactivities.”
“We would tip them off about a person we were looking for, and they would mysteriously disappear, only to appear later on working for the Russian government.”
That’s not always how it was. In the mid-2000s, FBI agents tried to work with their counterparts in the FSB, Russia's Federal Security Service, to investigate hackers, with regular bilateral meetings featuring US and Russian agents working together in the hope that the two countries could stem the growing tide of online crime. At least that’s how the Americans saw it.
“We would tip them off about a person we were looking for, and they would mysteriously disappear, only to appear later on working for the Russian government,” Patel said. “We basically helped the FSB identify talent and recruit by telling them who we were after.”
The arrest of Baratov and his co-conspirators signals a broader US government crackdown on Russian cybercriminals. For years, cybersecurity researchers and US authorities have traced the ties between cybercriminals and the Russian state, including how malware first developed for criminal enterprises has made its way into state-sponsored cyberattacks on Russia’s neighbors, and how botnet armies created by hackers have been repurposed to launch attacks on Russian targets. Now, they appear ready to strike. Earlier this month, Spanish authorities acting on behalf of the US arrested Pyotr Levashov, long known to authorities as one of the world’s most prolific spam kingpins. Five months ago, the US named a number of well-known Russian hackers as being behind the hacks on the Democratic National Committee, which they say were aimed at influencing the US elections. For those following the murky dealings of the world’s top hackers, the names did not come as a surprise. What was new was the willingness of US officials to publicly name the hackers, and to aggressively pursue Russian cybercriminals who aid Russia’s increasingly aggressive strides into cyberwarfare.
"Russia is playing with different rules — or maybe just without rules."
Three Russian hackers told BuzzFeed News over the last month that there was “panic” about how far the arrests would go, and for how long hackers would be pursued by US authorities. US security officials told BuzzFeed News that they would do well to be scared, as “the gloves were coming off” with Russian hackers.
“We’ve reached a boiling point with Russia. They are the closest competitor to the US when it comes to cyberespionage and cyberattacks,” Patel said. “But Russia is playing with different rules — or maybe just without rules.”
Erik Carter for BuzzFeed News
Ask Americans to describe a typical Russian hacker who targets the US and they will likely describe a scruffy Russian teenager in a dimly lit basement, or a chiseled military figure in a warehouse-like room filled with hundreds of hackers, pounding away at their keyboards as they plot to take down the US. The truth is that Russian cyber operations are far more complex than either of those scenarios, with the Russian state relying on a network of hackers it hires within its military and intelligence divisions, as well as cybercriminal networks and hackers for hire it can recruit or co-opt as it needs.
“It’s a multilayered system, and it is very flexible. That’s what makes it so hard to track,” said one FBI agent who currently works within the bureau’s cyber division. He asked to speak off the record so that he could discuss open cases with BuzzFeed News. “Let’s say, for instance that Russian intelligence decide they want to hack into eBay to try and find information about a certain person. They might do that through an existing team they have in place, or they might go to a hacker, who has already infected a computer they want compromised and tell him to give them access or else … or they might just pay a guy who has previously hacked eBay to do it for them again.”
That flexibility makes it very difficult for the FBI, or any other law enforcement agency, to track what is being hacked, and why, the FBI agent said.
“They will use whatever method they need to use to get in, and they have no lines between criminals who are hacking for profit and those who are hacking for the government,” he said. “They might be going into eBay to steal credit cards, or they might be doing it as part of a covert op to target a US member of Congress. They might be doing both, really. It makes it hard to know when a hack is a matter of national security and when it is not.”
The hack on Yahoo that compromised the information of more than 500 million people lays out the complex relationship between the hackers and their targets. The accounts were hacked in 2014, with Yahoo only discovering the compromised accounts in September 2016. Just a few months later, Yahoo announced it had discovered a second, earlier breach, which had affected an additional 500 million people in 2013. Together, the hacks cost the company roughly $350 million, as users fled from the platform amid security concerns. It was, cybersecurity experts said, a death blow for Yahoo.
A spokesman for Yahoo did not answer a request for comment from BuzzFeed News. In a public statement published soon after the indictment was issued, Yahoo wrote: "The indictment unequivocally shows the attacks on Yahoo were state-sponsored. We are deeply grateful to the FBI for investigating these crimes and the DOJ for bringing charges against those responsible."
For weeks, cybersecurity researchers investigating the hacks believed they were looking at a case of corporate espionage. But as the scope of the breach was discovered, researchers began to fear that an enemy of the US was compiling a massive database of all US nationals, complete with personal details and email accounts they could mine for vulnerable information. The indictments issued last month against Baratov, Belan, and the FSB officers revealed that the group had breached Yahoo looking for both political targets and financial targets. The hundreds of millions of other people who had been caught up in the breach were just collateral damage.
The hundreds of millions of other people who had been caught up in the breach were just collateral damage.
“The guys who did this to Yahoo, they were criminals. They could have turned around and sold the entire database to the highest bidder,” the FBI agent said. “We are lucky they didn’t.”
Enough is known about the four men to sketch a rough timeline of how they came together to carry out the hack. Dokuchaev was once known in hacker circles as “Forb,” and he spoke openly about hiring out his services until he was recruited into government work, as the Russian newspaper RBC has reported. At the FSB, Dokuchaev was partnered with Sushchin, and the two recruited Belan, a Latvian-born hacker who had been on a list of the FBI’s most wanted since 2012.
“This is the way it goes: They trap one hacker and then they get him to trap his friends,” said one Russian hacker, who agreed to speak to BuzzFeed News via an encrypted app on condition of anonymity. The hacker, who recently served time in a Russian prison and had fled the country once he was released, said the “pressure was intense” to do work on behalf of Russian intelligence officers. “They press on you. It’s not, like, a nice request. It’s a knock on your door and maybe a knock on your ass. If they can’t threaten you they threaten your family.”
Amedeo DiCarlo, lawyer for Karim Baratov, arrives at the courthouse in a chauffeured Rolls-Royce in Hamilton, Ontario, Canada, on Wednesday, April 5.
Robert Gillies / AP
It’s unclear how the men were connected to Baratov, who immigrated to Canada from Kazakhstan with his family in 2007. Investigators say Baratov was a hacker for hire. In a July 14, 2016, post on his Facebook page, Baratov wrote that he first discovered how profitable hacking could be when he was expelled from his high school for "threatening to kill my ex-friend as a joke." The time off school "allowed me to work on my online projects 24/7, and really move my businesses to the next level." The post, which included photos of a BMW, Audi, and Lamborghini, claims he made “triple and even quadruple the normal amount” of income. He ended the post with "Taking shortcuts doesn't mean shortcutting the end result."
Once the group had gained access to Yahoo, its targets included an economic development minister of a country bordering Russia, an investigative reporter who worked for Russian newspaper Kommersant, and a managing director of a US private equity firm, court documents show. FBI investigators believe that in addition to searching for the political targets requested by the FSB, Belan also used the Yahoo database to line his own pockets by searching for credit card information and devising various schemes to target Yahoo users. In November 2014, he began tampering with the Yahoo database so that anyone interested in erectile dysfunction treatments was redirected to his own online pharmacy store, from which he got a commission for driving traffic to the site.
"It’s a knock on your door and maybe a knock on your ass. If they can’t threaten you they threaten your family."
“When you look at this case, you realize it has national security and criminal elements. It doesn’t fit neatly into one box or the other,” the FBI agent involved in the case said.
Patel said that the FBI often had difficulty distinguishing between cyber cases that were criminal in nature, versus those which were politically motivated, or had ties to the Russian state. “The government is making an effort to bridge the gap between investigations that involve classified national security issues, and those which are criminal because those worlds aren’t separate anymore,” he said, explaining that departments were trying to form more joint task forces and share classified information when possible.
It’s unclear who within the FSB was responsible for the group, or if their orders ultimately came from another arm of Russia’s government. In December 2016, Dokuchaev was arrested in Russia and accused of treason. His arrest appeared to be part of a roundup of Russian military and cybersecurity figures, though little information has emerged since their arrests.
Andrei Soldatov, a Russian investigative journalist and co-author of The Red Web, a book about the Kremlin’s online activities, said that while the Russian government’s tactic of outsourcing cyber operations to various groups is helpful in distancing themselves (and ultimately providing deniability), it also left them vulnerable to hackers running amuck.
“Hackers are not people who are traditionally easy to control,” said Soldatov. “They might disobey you sometimes.”
Erik Carter for BuzzFeed News
When asked why they first started hacking, many Russian hackers say you’ve asked them to solve the question of which came first, the chicken or the egg.
"I hacked because I wanted to get online, and then I was online because I was hacking," said one Russian hacker, who considers himself a veteran of the Russian hacking scene due to his early involvement in credit cards schemes in the 1990s. He agreed to speak with BuzzFeed News on condition of anonymity, as he was concerned for the safety of himself and his family. “In the '90s you could only afford the internet in Russia if you were rich, or a hacker.”
Russians visit a cybercafé on July 25, 1997, in Moscow.
Andres Hernandez / Getty Images
The internet came to Russia after the fall of the Soviet Union. A devastated economy and uncertain political times meant that few had access to the internet, which could cost hundreds of dollars to surf for just a few hours. The Russian hacker said he and his friends got involved in early credit card schemes as a way of paying for internet use, which they then used to discover more about burgeoning online crime.
“We were baby hackers. Nobody knew what was possible,” he said. “But when the internet came to Russia, so did the hackers.”
Police initially ignored cybercriminals, and a de facto rule came into effect that as long as the hackers were targeting people and institutions outside of Russia, they would be left alone by the state.
“We were baby hackers. Nobody knew what was possible,” he said. “But when the internet came to Russia, so did the hackers.”
from DIYS http://ift.tt/2oWy2qQ
0 notes
Text
Inside The Hunt For Russia’s Hackers
SAN FRANCISCO — Just past 8 a.m. on March 14, police trod quietly through the snow to the double-fronted doors of Karim Baratov’s lavish home in Ancaster, Ontario. The officers passed by the garage where Baratov’s jet-black Mercedes Benz and Aston Martin DBS were parked, two of the only outward indications that the 22-year-old had money to spend. Minutes later, they took the Canadian-Kazakh hacker away into custody — a subdued end to an international cyber drama that involved the highest levels of the US government, Russian spies, a global cybercrime syndicate, and hundreds of millions of unsuspecting Americans.
The baby-faced Baratov is currently awaiting trial in the US on charges that he helped hack into half a billion Yahoo accounts — the largest known hack in history. His co-conspirators are Alexsey Belan, 29, a notorious Russian hacker still at large, and two Russian intelligence officers, Dmitry Aleksandrovich Dokuchaev, 33, and Igor Anatolyevich Sushchin, 43. The case against them is the starkest public example of the ways in which the Russian government works with cybercriminals to achieve its global agenda through cyberwarfare, and why those attacks have proven so difficult for governments around the world to track, let alone prosecute.
Left to right: Baratov, Dokuchaev, and Sushchin.
Courtesy FBI
Baratov, according to accounts given by US law enforcement, was a hacker for hire. It appears he simply took the wrong job.
“The Yahoo hack is a great example of the US government coming forward and saying we know what you are doing and we can prove it,” said Milan Patel, the former chief technology officer of the FBI’s cyber division and now managing director at the K2 Intelligence cybersecurity firm. “In the past the US and Russia engaged in a lot of tit-for-tat covert operations. But with Russia now, a lot is coming to the forefront and being made public about how they run their cyberactivities.”
“We would tip them off about a person we were looking for, and they would mysteriously disappear, only to appear later on working for the Russian government.”
That’s not always how it was. In the mid-2000s, FBI agents tried to work with their counterparts in the FSB, Russia's Federal Security Service, to investigate hackers, with regular bilateral meetings featuring US and Russian agents working together in the hope that the two countries could stem the growing tide of online crime. At least that’s how the Americans saw it.
“We would tip them off about a person we were looking for, and they would mysteriously disappear, only to appear later on working for the Russian government,” Patel said. “We basically helped the FSB identify talent and recruit by telling them who we were after.”
The arrest of Baratov and his co-conspirators signals a broader US government crackdown on Russian cybercriminals. For years, cybersecurity researchers and US authorities have traced the ties between cybercriminals and the Russian state, including how malware first developed for criminal enterprises has made its way into state-sponsored cyberattacks on Russia’s neighbors, and how botnet armies created by hackers have been repurposed to launch attacks on Russian targets. Now, they appear ready to strike. Earlier this month, Spanish authorities acting on behalf of the US arrested Pyotr Levashov, long known to authorities as one of the world’s most prolific spam kingpins. Five months ago, the US named a number of well-known Russian hackers as being behind the hacks on the Democratic National Committee, which they say were aimed at influencing the US elections. For those following the murky dealings of the world’s top hackers, the names did not come as a surprise. What was new was the willingness of US officials to publicly name the hackers, and to aggressively pursue Russian cybercriminals who aid Russia’s increasingly aggressive strides into cyberwarfare.
"Russia is playing with different rules — or maybe just without rules."
Three Russian hackers told BuzzFeed News over the last month that there was “panic” about how far the arrests would go, and for how long hackers would be pursued by US authorities. US security officials told BuzzFeed News that they would do well to be scared, as “the gloves were coming off” with Russian hackers.
“We’ve reached a boiling point with Russia. They are the closest competitor to the US when it comes to cyberespionage and cyberattacks,” Patel said. “But Russia is playing with different rules — or maybe just without rules.”
Erik Carter for BuzzFeed News
Ask Americans to describe a typical Russian hacker who targets the US and they will likely describe a scruffy Russian teenager in a dimly lit basement, or a chiseled military figure in a warehouse-like room filled with hundreds of hackers, pounding away at their keyboards as they plot to take down the US. The truth is that Russian cyber operations are far more complex than either of those scenarios, with the Russian state relying on a network of hackers it hires within its military and intelligence divisions, as well as cybercriminal networks and hackers for hire it can recruit or co-opt as it needs.
“It’s a multilayered system, and it is very flexible. That’s what makes it so hard to track,” said one FBI agent who currently works within the bureau’s cyber division. He asked to speak off the record so that he could discuss open cases with BuzzFeed News. “Let’s say, for instance that Russian intelligence decide they want to hack into eBay to try and find information about a certain person. They might do that through an existing team they have in place, or they might go to a hacker, who has already infected a computer they want compromised and tell him to give them access or else … or they might just pay a guy who has previously hacked eBay to do it for them again.”
That flexibility makes it very difficult for the FBI, or any other law enforcement agency, to track what is being hacked, and why, the FBI agent said.
“They will use whatever method they need to use to get in, and they have no lines between criminals who are hacking for profit and those who are hacking for the government,” he said. “They might be going into eBay to steal credit cards, or they might be doing it as part of a covert op to target a US member of Congress. They might be doing both, really. It makes it hard to know when a hack is a matter of national security and when it is not.”
The hack on Yahoo that compromised the information of more than 500 million people lays out the complex relationship between the hackers and their targets. The accounts were hacked in 2014, with Yahoo only discovering the compromised accounts in September 2016. Just a few months later, Yahoo announced it had discovered a second, earlier breach, which had affected an additional 500 million people in 2013. Together, the hacks cost the company roughly $350 million, as users fled from the platform amid security concerns. It was, cybersecurity experts said, a death blow for Yahoo.
A spokesman for Yahoo did not answer a request for comment from BuzzFeed News. In a public statement published soon after the indictment was issued, Yahoo wrote: "The indictment unequivocally shows the attacks on Yahoo were state-sponsored. We are deeply grateful to the FBI for investigating these crimes and the DOJ for bringing charges against those responsible."
For weeks, cybersecurity researchers investigating the hacks believed they were looking at a case of corporate espionage. But as the scope of the breach was discovered, researchers began to fear that an enemy of the US was compiling a massive database of all US nationals, complete with personal details and email accounts they could mine for vulnerable information. The indictments issued last month against Baratov, Belan, and the FSB officers revealed that the group had breached Yahoo looking for both political targets and financial targets. The hundreds of millions of other people who had been caught up in the breach were just collateral damage.
The hundreds of millions of other people who had been caught up in the breach were just collateral damage.
“The guys who did this to Yahoo, they were criminals. They could have turned around and sold the entire database to the highest bidder,” the FBI agent said. “We are lucky they didn’t.”
Enough is known about the four men to sketch a rough timeline of how they came together to carry out the hack. Dokuchaev was once known in hacker circles as “Forb,” and he spoke openly about hiring out his services until he was recruited into government work, as the Russian newspaper RBC has reported. At the FSB, Dokuchaev was partnered with Sushchin, and the two recruited Belan, a Latvian-born hacker who had been on a list of the FBI’s most wanted since 2012.
“This is the way it goes: They trap one hacker and then they get him to trap his friends,” said one Russian hacker, who agreed to speak to BuzzFeed News via an encrypted app on condition of anonymity. The hacker, who recently served time in a Russian prison and had fled the country once he was released, said the “pressure was intense” to do work on behalf of Russian intelligence officers. “They press on you. It’s not, like, a nice request. It’s a knock on your door and maybe a knock on your ass. If they can’t threaten you they threaten your family.”
Amedeo DiCarlo, lawyer for Karim Baratov, arrives at the courthouse in a chauffeured Rolls-Royce in Hamilton, Ontario, Canada, on Wednesday, April 5.
Robert Gillies / AP
It’s unclear how the men were connected to Baratov, who immigrated to Canada from Kazakhstan with his family in 2007. Investigators say Baratov was a hacker for hire. In a July 14, 2016, post on his Facebook page, Baratov wrote that he first discovered how profitable hacking could be when he was expelled from his high school for "threatening to kill my ex-friend as a joke." The time off school "allowed me to work on my online projects 24/7, and really move my businesses to the next level." The post, which included photos of a BMW, Audi, and Lamborghini, claims he made “triple and even quadruple the normal amount” of income. He ended the post with "Taking shortcuts doesn't mean shortcutting the end result."
Once the group had gained access to Yahoo, its targets included an economic development minister of a country bordering Russia, an investigative reporter who worked for Russian newspaper Kommersant, and a managing director of a US private equity firm, court documents show. FBI investigators believe that in addition to searching for the political targets requested by the FSB, Belan also used the Yahoo database to line his own pockets by searching for credit card information and devising various schemes to target Yahoo users. In November 2014, he began tampering with the Yahoo database so that anyone interested in erectile dysfunction treatments was redirected to his own online pharmacy store, from which he got a commission for driving traffic to the site.
"It’s a knock on your door and maybe a knock on your ass. If they can’t threaten you they threaten your family."
“When you look at this case, you realize it has national security and criminal elements. It doesn’t fit neatly into one box or the other,” the FBI agent involved in the case said.
Patel said that the FBI often had difficulty distinguishing between cyber cases that were criminal in nature, versus those which were politically motivated, or had ties to the Russian state. “The government is making an effort to bridge the gap between investigations that involve classified national security issues, and those which are criminal because those worlds aren’t separate anymore,” he said, explaining that departments were trying to form more joint task forces and share classified information when possible.
It’s unclear who within the FSB was responsible for the group, or if their orders ultimately came from another arm of Russia’s government. In December 2016, Dokuchaev was arrested in Russia and accused of treason. His arrest appeared to be part of a roundup of Russian military and cybersecurity figures, though little information has emerged since their arrests.
Andrei Soldatov, a Russian investigative journalist and co-author of The Red Web, a book about the Kremlin’s online activities, said that while the Russian government’s tactic of outsourcing cyber operations to various groups is helpful in distancing themselves (and ultimately providing deniability), it also left them vulnerable to hackers running amuck.
“Hackers are not people who are traditionally easy to control,” said Soldatov. “They might disobey you sometimes.”
Erik Carter for BuzzFeed News
When asked why they first started hacking, many Russian hackers say you’ve asked them to solve the question of which came first, the chicken or the egg.
"I hacked because I wanted to get online, and then I was online because I was hacking," said one Russian hacker, who considers himself a veteran of the Russian hacking scene due to his early involvement in credit cards schemes in the 1990s. He agreed to speak with BuzzFeed News on condition of anonymity, as he was concerned for the safety of himself and his family. “In the '90s you could only afford the internet in Russia if you were rich, or a hacker.”
Russians visit a cybercafé on July 25, 1997, in Moscow.
Andres Hernandez / Getty Images
The internet came to Russia after the fall of the Soviet Union. A devastated economy and uncertain political times meant that few had access to the internet, which could cost hundreds of dollars to surf for just a few hours. The Russian hacker said he and his friends got involved in early credit card schemes as a way of paying for internet use, which they then used to discover more about burgeoning online crime.
“We were baby hackers. Nobody knew what was possible,” he said. “But when the internet came to Russia, so did the hackers.”
Police initially ignored cybercriminals, and a de facto rule came into effect that as long as the hackers were targeting people and institutions outside of Russia, they would be left alone by the state.
“We were baby hackers. Nobody knew what was possible,” he said. “But when the internet came to Russia, so did the hackers.”
from DIYS http://ift.tt/2oWy2qQ
0 notes
Text
Inside The Hunt For Russia’s Hackers
SAN FRANCISCO — Just past 8 a.m. on March 14, police trod quietly through the snow to the double-fronted doors of Karim Baratov’s lavish home in Ancaster, Ontario. The officers passed by the garage where Baratov’s jet-black Mercedes Benz and Aston Martin DBS were parked, two of the only outward indications that the 22-year-old had money to spend. Minutes later, they took the Canadian-Kazakh hacker away into custody — a subdued end to an international cyber drama that involved the highest levels of the US government, Russian spies, a global cybercrime syndicate, and hundreds of millions of unsuspecting Americans.
The baby-faced Baratov is currently awaiting trial in the US on charges that he helped hack into half a billion Yahoo accounts — the largest known hack in history. His co-conspirators are Alexsey Belan, 29, a notorious Russian hacker still at large, and two Russian intelligence officers, Dmitry Aleksandrovich Dokuchaev, 33, and Igor Anatolyevich Sushchin, 43. The case against them is the starkest public example of the ways in which the Russian government works with cybercriminals to achieve its global agenda through cyberwarfare, and why those attacks have proven so difficult for governments around the world to track, let alone prosecute.
Left to right: Baratov, Dokuchaev, and Sushchin.
Courtesy FBI
Baratov, according to accounts given by US law enforcement, was a hacker for hire. It appears he simply took the wrong job.
“The Yahoo hack is a great example of the US government coming forward and saying we know what you are doing and we can prove it,” said Milan Patel, the former chief technology officer of the FBI’s cyber division and now managing director at the K2 Intelligence cybersecurity firm. “In the past the US and Russia engaged in a lot of tit-for-tat covert operations. But with Russia now, a lot is coming to the forefront and being made public about how they run their cyberactivities.”
“We would tip them off about a person we were looking for, and they would mysteriously disappear, only to appear later on working for the Russian government.”
That’s not always how it was. In the mid-2000s, FBI agents tried to work with their counterparts in the FSB, Russia's Federal Security Service, to investigate hackers, with regular bilateral meetings featuring US and Russian agents working together in the hope that the two countries could stem the growing tide of online crime. At least that’s how the Americans saw it.
“We would tip them off about a person we were looking for, and they would mysteriously disappear, only to appear later on working for the Russian government,” Patel said. “We basically helped the FSB identify talent and recruit by telling them who we were after.”
The arrest of Baratov and his co-conspirators signals a broader US government crackdown on Russian cybercriminals. For years, cybersecurity researchers and US authorities have traced the ties between cybercriminals and the Russian state, including how malware first developed for criminal enterprises has made its way into state-sponsored cyberattacks on Russia’s neighbors, and how botnet armies created by hackers have been repurposed to launch attacks on Russian targets. Now, they appear ready to strike. Earlier this month, Spanish authorities acting on behalf of the US arrested Pyotr Levashov, long known to authorities as one of the world’s most prolific spam kingpins. Five months ago, the US named a number of well-known Russian hackers as being behind the hacks on the Democratic National Committee, which they say were aimed at influencing the US elections. For those following the murky dealings of the world’s top hackers, the names did not come as a surprise. What was new was the willingness of US officials to publicly name the hackers, and to aggressively pursue Russian cybercriminals who aid Russia’s increasingly aggressive strides into cyberwarfare.
"Russia is playing with different rules — or maybe just without rules."
Three Russian hackers told BuzzFeed News over the last month that there was “panic” about how far the arrests would go, and for how long hackers would be pursued by US authorities. US security officials told BuzzFeed News that they would do well to be scared, as “the gloves were coming off” with Russian hackers.
“We’ve reached a boiling point with Russia. They are the closest competitor to the US when it comes to cyberespionage and cyberattacks,” Patel said. “But Russia is playing with different rules — or maybe just without rules.”
Erik Carter for BuzzFeed News
Ask Americans to describe a typical Russian hacker who targets the US and they will likely describe a scruffy Russian teenager in a dimly lit basement, or a chiseled military figure in a warehouse-like room filled with hundreds of hackers, pounding away at their keyboards as they plot to take down the US. The truth is that Russian cyber operations are far more complex than either of those scenarios, with the Russian state relying on a network of hackers it hires within its military and intelligence divisions, as well as cybercriminal networks and hackers for hire it can recruit or co-opt as it needs.
“It’s a multilayered system, and it is very flexible. That’s what makes it so hard to track,” said one FBI agent who currently works within the bureau’s cyber division. He asked to speak off the record so that he could discuss open cases with BuzzFeed News. “Let’s say, for instance that Russian intelligence decide they want to hack into eBay to try and find information about a certain person. They might do that through an existing team they have in place, or they might go to a hacker, who has already infected a computer they want compromised and tell him to give them access or else … or they might just pay a guy who has previously hacked eBay to do it for them again.”
That flexibility makes it very difficult for the FBI, or any other law enforcement agency, to track what is being hacked, and why, the FBI agent said.
“They will use whatever method they need to use to get in, and they have no lines between criminals who are hacking for profit and those who are hacking for the government,” he said. “They might be going into eBay to steal credit cards, or they might be doing it as part of a covert op to target a US member of Congress. They might be doing both, really. It makes it hard to know when a hack is a matter of national security and when it is not.”
The hack on Yahoo that compromised the information of more than 500 million people lays out the complex relationship between the hackers and their targets. The accounts were hacked in 2014, with Yahoo only discovering the compromised accounts in September 2016. Just a few months later, Yahoo announced it had discovered a second, earlier breach, which had affected an additional 500 million people in 2013. Together, the hacks cost the company roughly $350 million, as users fled from the platform amid security concerns. It was, cybersecurity experts said, a death blow for Yahoo.
A spokesman for Yahoo did not answer a request for comment from BuzzFeed News. In a public statement published soon after the indictment was issued, Yahoo wrote: "The indictment unequivocally shows the attacks on Yahoo were state-sponsored. We are deeply grateful to the FBI for investigating these crimes and the DOJ for bringing charges against those responsible."
For weeks, cybersecurity researchers investigating the hacks believed they were looking at a case of corporate espionage. But as the scope of the breach was discovered, researchers began to fear that an enemy of the US was compiling a massive database of all US nationals, complete with personal details and email accounts they could mine for vulnerable information. The indictments issued last month against Baratov, Belan, and the FSB officers revealed that the group had breached Yahoo looking for both political targets and financial targets. The hundreds of millions of other people who had been caught up in the breach were just collateral damage.
The hundreds of millions of other people who had been caught up in the breach were just collateral damage.
“The guys who did this to Yahoo, they were criminals. They could have turned around and sold the entire database to the highest bidder,” the FBI agent said. “We are lucky they didn’t.”
Enough is known about the four men to sketch a rough timeline of how they came together to carry out the hack. Dokuchaev was once known in hacker circles as “Forb,” and he spoke openly about hiring out his services until he was recruited into government work, as the Russian newspaper RBC has reported. At the FSB, Dokuchaev was partnered with Sushchin, and the two recruited Belan, a Latvian-born hacker who had been on a list of the FBI’s most wanted since 2012.
“This is the way it goes: They trap one hacker and then they get him to trap his friends,” said one Russian hacker, who agreed to speak to BuzzFeed News via an encrypted app on condition of anonymity. The hacker, who recently served time in a Russian prison and had fled the country once he was released, said the “pressure was intense” to do work on behalf of Russian intelligence officers. “They press on you. It’s not, like, a nice request. It’s a knock on your door and maybe a knock on your ass. If they can’t threaten you they threaten your family.”
Amedeo DiCarlo, lawyer for Karim Baratov, arrives at the courthouse in a chauffeured Rolls-Royce in Hamilton, Ontario, Canada, on Wednesday, April 5.
Robert Gillies / AP
It’s unclear how the men were connected to Baratov, who immigrated to Canada from Kazakhstan with his family in 2007. Investigators say Baratov was a hacker for hire. In a July 14, 2016, post on his Facebook page, Baratov wrote that he first discovered how profitable hacking could be when he was expelled from his high school for "threatening to kill my ex-friend as a joke." The time off school "allowed me to work on my online projects 24/7, and really move my businesses to the next level." The post, which included photos of a BMW, Audi, and Lamborghini, claims he made “triple and even quadruple the normal amount” of income. He ended the post with "Taking shortcuts doesn't mean shortcutting the end result."
Once the group had gained access to Yahoo, its targets included an economic development minister of a country bordering Russia, an investigative reporter who worked for Russian newspaper Kommersant, and a managing director of a US private equity firm, court documents show. FBI investigators believe that in addition to searching for the political targets requested by the FSB, Belan also used the Yahoo database to line his own pockets by searching for credit card information and devising various schemes to target Yahoo users. In November 2014, he began tampering with the Yahoo database so that anyone interested in erectile dysfunction treatments was redirected to his own online pharmacy store, from which he got a commission for driving traffic to the site.
"It’s a knock on your door and maybe a knock on your ass. If they can’t threaten you they threaten your family."
“When you look at this case, you realize it has national security and criminal elements. It doesn’t fit neatly into one box or the other,” the FBI agent involved in the case said.
Patel said that the FBI often had difficulty distinguishing between cyber cases that were criminal in nature, versus those which were politically motivated, or had ties to the Russian state. “The government is making an effort to bridge the gap between investigations that involve classified national security issues, and those which are criminal because those worlds aren’t separate anymore,” he said, explaining that departments were trying to form more joint task forces and share classified information when possible.
It’s unclear who within the FSB was responsible for the group, or if their orders ultimately came from another arm of Russia’s government. In December 2016, Dokuchaev was arrested in Russia and accused of treason. His arrest appeared to be part of a roundup of Russian military and cybersecurity figures, though little information has emerged since their arrests.
Andrei Soldatov, a Russian investigative journalist and co-author of The Red Web, a book about the Kremlin’s online activities, said that while the Russian government’s tactic of outsourcing cyber operations to various groups is helpful in distancing themselves (and ultimately providing deniability), it also left them vulnerable to hackers running amuck.
“Hackers are not people who are traditionally easy to control,” said Soldatov. “They might disobey you sometimes.”
Erik Carter for BuzzFeed News
When asked why they first started hacking, many Russian hackers say you’ve asked them to solve the question of which came first, the chicken or the egg.
"I hacked because I wanted to get online, and then I was online because I was hacking," said one Russian hacker, who considers himself a veteran of the Russian hacking scene due to his early involvement in credit cards schemes in the 1990s. He agreed to speak with BuzzFeed News on condition of anonymity, as he was concerned for the safety of himself and his family. “In the '90s you could only afford the internet in Russia if you were rich, or a hacker.”
Russians visit a cybercafé on July 25, 1997, in Moscow.
Andres Hernandez / Getty Images
The internet came to Russia after the fall of the Soviet Union. A devastated economy and uncertain political times meant that few had access to the internet, which could cost hundreds of dollars to surf for just a few hours. The Russian hacker said he and his friends got involved in early credit card schemes as a way of paying for internet use, which they then used to discover more about burgeoning online crime.
“We were baby hackers. Nobody knew what was possible,” he said. “But when the internet came to Russia, so did the hackers.”
Police initially ignored cybercriminals, and a de facto rule came into effect that as long as the hackers were targeting people and institutions outside of Russia, they would be left alone by the state.
“We were baby hackers. Nobody knew what was possible,” he said. “But when the internet came to Russia, so did the hackers.”
from DIYS http://ift.tt/2oWy2qQ
0 notes