 The winner of the 6th Annual Best Scientific Cybersecurity Paper Competition is How Shall We Play a Game? A Game-theoretical Model for Cyber-warfare Games by Tiffany Bao, Yan Shoshitaishvili, Ruoyu Wang, Christopher Kruegel, Giovanni Vigna, and David Brumley. These researchers are from Carnegie Mellon University and University of California, Santa Barbara. Follow the link above for more detail. Congratulations!
|
|
 Cyber Scene
CRAZY (CYBER) RICH...
North Koreans: Column A menu
Over 50 fake social media profiles have reportedly bolstered North Korean IT sales to obtain needed hard currency by avoiding sanctions, according to the 14 September Wall Street Journal. The operatives posed as Japanese, while in fact working on the Chinese side of the North Korean border (see combo platter segment below) and duping unsuspecting web designers as well as those sucked into the trap. One of the suspects was linked to the killing in the Kuala Lumpur airport following an apparent high profile assassination. LinkedIn as well as many additional legitimate cyber entities were also duped.
In early September, the US released 176 charges against a North Korean operative linked to a "cyber army", according to Aruna Viswanatha and Dustin Volz of the Wall Street Journal. The US charges focused on the 2014 attack on Sony, but also cited the $81 million theft from Bangladesh's account at the New York Federal Reserve Bank.
Chinese: Column B menu
In addition to Equifax's major and much publicized hack of customer data, the Wall Street Journal reported on 12 September on Equifax's fear of Chinese corporate spying two years before the consumer financial data attack. In 2015, Equifax sought the help of the FBI and CIA, as the company feared that employees who subsequently went to work for Chinese companies had downloaded proprietary corporate data related to how credit scores were obtained, algorithmic applications, and other corporate secrets. It appeared that Chinese firm Ant, an affiliate of Alibaba, had offered to triple salaries to certain Equifax employees to jump ship.
And just as the CEO, Jack Ma, of China's e-commerce tech giant Alibaba announced on 10 September that he will soon retire, changes are occurring in the face of some limited regulation resulting in Ant Financial (the above-mentioned affiliate of Alibaba) and Tencent (known for WeChat) are re-branding their work. Rather than refer to this as "fintech" they are now calling it "techfin" intended to "play up technology offerings instead of financial services."
Russians: Column C menu (part Asian/Tatar too!)
First and foremost, two New York Times seasoned intelligence journalists Scott Shane and Mike Mazzetti launched a 12-page special report on 20 September entitled "The Plot to Subvert an Election: Unraveling the Russia Story So Far" which delves into the overwhelming power of Russia's hacks, leaks, and social media "fakery" to include online trolls reaching an audience of "nearly as many Americans as would vote in the (2016) election." In addition to including some seemingly new material (e.g., the Russian-based fake twitter which drove the pro-Putin "peacemaker" banner in Manhattan), the report includes activity back to 2014 and an 8-page timeline ending, so far, in September 2018. The scope of the report, mirroring the magnitude of the cyber activity it examines, warrants attention. The timeline itself is stunning and aids in digesting Russia's role in the 2016 election, giving one pause about the 2018 midterms in November.
Combo platters:
Chinese-Russian: Back to Alibaba, China's financial services firm has taken a 10% stake in Mail.Ru Group, one of Russia's biggest commercial tech players, as reported by the Wall Street Journal. A Russian head of a state-owned investment fund noted, following the Putin-Xi Jinping meeting in mid-September, that "Russo-Chinese cooperation in tech is one of the most promising avenues for bilateral relations."
Chinese-North Korean: See above regarding the Chinese platform in Shengang near the North Korean border aiding North Korean operatives bilking US IT users.
BIG TECH: Keeping up with the tech-rich catch-up connections
Just as cyber technology seeks to connect the world digitally, users and regulators are now picking up the pace of connecting (the dots) with the connectors. The last four weeks of media discussion have generated a huge data dump. Even Congress, wedged between an August recess for the House (the Senate canceled its recess) and mid-terms looming ahead, ominously for some and excitedly for others in November, has resumed its inquiries.
The Rein/Reign of Congress?
The Senate Select Committee on Intelligence (SSCI, now a probably household acronym) summoned tech leaders Larry Page (Google), Jack Dorsey (Twitter) and Sheryl Sandberg (Facebook) to testify on 5 September. But Larry was a missing Page, and Senators "tore into" the seat where Mr. Page should have been with terms such as "arrogant" (Sen. Rubio) and "outrage" (Sen. Collins) (See www.senate.gov/ssci for the unabridged version). They were not alone: Bloomberg Businessweek published a long article on 13 September entitled "Where's Larry" noting that the 45-year old tech giant has a very small footprint these days, or a very clever early retirement as he maintains control of Google but has passed along much of the tech direction to subordinates. The 7 September New York Times print article entitled "A Tech Dialogue, Minus Apologies and Grandstanding" by Farhad Manjoo also criticized Mr. Page for his absenteeism, noting that it was a big mistake. He notes that Google, unlike other tech giants, did not take a pose as an upstart but rather as the "grown-up in the room." This reputation is now quite tarnished. The relationship between tech and Congress is critical, particularly as regulatory issues are increasing. Time Magazine's Haley Sweetland Edwards on 17 September noted that as Washington takes on the threat of Big Tech, the relationship has moved from "once darlings" to "decidedly cooler." Mr. Manjoo notes that Facebook COO Sheryl Sandberg and Twitter CEO Jack Dorsey also testified before the House Energy and Commerce Committee where the latter testifier "overflowed with candor." Just prior to the testimony, Ms. Sandberg was the subject of a lengthy examination by the Wall Street Journal's Betsy Morris, Deepa Seetharaman and Robert McMillan on how she was put in the PR hot seat to defend Facebook's reputation in the wake of the Cambridge Analytica exposé and opined about how she was now responsible for fixing the mistakes. She seems to have fared better than the absent Mr. Page. Two days before the Senate testimony, Barron's Jon Swartz had described the tension between Congress on the one hand and Facebook and Twitter on the other as "white-hot intensity." Tension is also impacting one-third of the Senate and all of the House, with seats up for re-election or grabs, in a matter of weeks. So open hearings also provide a podium from which those now reigning may have a platform to try to continue to do so. As discussed in earlier Cyber Scenes, tech is moving much faster that the regulators who are playing catch up.
The Cyber Offensive Beyond the Beltway
In addition to the regulatory aspect of dealing with cyber and the tech giants that wield it, the reach of the US Government now includes suing spies, per the 13 September Economist. In addition to discussion of the North Korean leading the "cyber army" attack on Sony and the NY Fed Bank "heist" discussed above, the 2014 White House began indicting cyber attackers in a broader pattern that also included five Chinese army officers indicted for industrial espionage. (Sadly, these were not the ones involved with Equifax's first hit.) Five Russian FSB members and nine Iranian elite Revolutionary Guard operatives were also charged. The move toward the courts comes as a double-edged sword, but American officials are "seeking to draw a line between old-fashioned spying, which is seen as fair game, and piratical deeds, like election sabotage and spying for profit."
Big cities are also ... more ►
|
|
 SoS Musings
Get Smart About Smart City Cybersecurity
The ultimate goal of a “smart city” is to improve upon the quality of life for those residing within the city. However the execution of attacks on smart city systems could lead to devastating consequences for residents. A smart city deploys technologies with the purpose of managing the performance of urban services via the analysis of data collected by internet-connected devices. These internet-connected devices include environmental sensors, traffic monitors, water level gauges, and more. Smart city systems can be implemented to manage air quality, water flow, traffic signals, transportation, disaster warnings, and more. The compromise of these systems by cyberattackers could lead to mass panic similar to that of the incident in Hawaii on January 13, 2018 in which a false ballistic missile alert was sent out via the Emergency Alert System by an employee, leaving Hawaiians fearing for their lives. Although the incident occurred as a result of human error, it did ignite concerns surrounding the deliberate abuse of such systems by cyberattackers to raise havoc.
Recent research has highlighted the security weaknesses contained by smart city systems and the havoc that could occur if these weaknesses were to be exploited by malicious actors. The panic that followed the false missile alert in Hawaii is what influenced researchers from Threatcare and IBM X-Force Red to further investigate the vulnerability of smart city systems to being hacked and the dangers that could arise as a result of such incidents. Smart city systems provided by companies, Libelium, Echelon and Battelle, were discovered to contain 17 zero-day vulnerabilities that could be exploited by hackers to manipulate the sensors and data used by these systems in order to cause major disruption or harm. The vulnerabilities discovered in the systems examined in this study could lead to a number of disruptive and potentially disastrous outcomes such as the issuing of false alerts pertaining to floods and radiation leaks, creation of gridlocks, shutdown of lights, and more. The ways in which these vulnerabilities emerged call for vendors to prioritize and examine security in the development of these smart city systems.
Many of the vulnerabilities discovered in smart city systems by IBM X-Force and Threatcare were reported to be simple to exploit as they fell into common groupings including default passwords, authentication bypass, and SQL injection. In addition, many of smart city devices used in these systems were found to be vulnerable to remote access online through the use of search engines, Shodan and Censys, which could allow attackers to determine how these devices are being used, where they are located, who they have been purchased by, and the security features they contain. Following the disclosure of discovered security vulnerabilities to the vendors of affected smart city products, patches and software updates were issued. However, further steps need to be taken to ensure the security of these smart city systems.
Researchers have urged manufacturers and users of smart city devices to ... more ►
|
|
 Pub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers. Select the topic name to view its description and links to the publications.
|
|
|
|
|
|
