Tag Archives: cybercrime

Cyber Crime and the Brain Drain

Trojan-Horse-Virus

Cyber attacks and cyber espionage are on the rise in Latin America, and the source of much of it is Brazilian hackers and Peruvian recent university graduates linking up with Russian-speaking experts, according to internet security analysts.  The region has seen a massive rise in ‘trojans’ – disguised malicious software – especially in the financial sector, and other online threats, said Dmitry Bestuzhev, Latin American head of research for security firm Kaspersky Lab.  The main producers of the malware are Brazil and Peru, he said in an interview with Reuters on Thursday following a regional cyber crime conference.

“Criminals from those two countries produce the majority of malicious code and attack not only their countries but also neighboring ones,” he said, adding that their attacks spread as far as Spain and Portugal. In the last couple of years there has been a rise in Latin American hackers linking up with more experienced criminals in Russia and Eastern Europe, he said, as a kind of shadowy brain drain takes place across the Atlantic.  A significant number of Peruvian students, in particular, attended university in Russia and returned home knowing how to operate malware as well as communicate in Russian.

“They return and often they are demotivated, they have studied six or eight years, and when they return to their country the work offered is low profile and mediocre paid,” said Bestuzhev.  With Peruvian laws also inadequate to deal with the threat, that was encouraging the formation of a hacker hub in the Andean country, he said.  In return, Russian criminals are increasingly using Latin American networks to ‘test’ new malware before unleashing it elsewhere, he added.

Excerpts  ROSALBA O’BRIENLatam cyber attacks rise as Peru, Brazil hackers link up with Russians, Reuters, Aug. 28, 2015

Hacking Back: controlling hackers from defense to offense

CrowdStrike is a vocal advocate of “active defence” technologies that are generating much buzz in the cyber-security world. Their proponents argue that those who think firewalls, antivirus programmes and other security software are enough to keep their networks safe are kidding themselves. Instead, companies should work on the assumption that their systems have been breached, and take the fight to the hackers. The methods they prescribe include planting false information on their systems to mislead data thieves, and creating “honeypot” servers, decoys that gather information about intruders.  There are worries that such talk of active defence may encourage companies to go further, and “hack back” at their tormentors, even though many countries have laws that forbid such activity. In a survey of 181 delegates at last year’s Black Hat event, just over a third said they had already engaged in some form of retaliation against hackers.

Concerns about cyber-vigilantism have not deterred financiers from investing in tech firms that see active defence as a money-spinning opportunity. Take the case of Endgame, a secretive outfit that is adapting technology developed for intelligence agencies for commercial use. In March it raised $23m in a second round of funding and added Kenneth Minihan, a former director of America’s National Security Agency, to its board. Endgame has reportedly developed a system called “Bonesaw” that detects which software is being used by devices connected to the web. This could be used defensively by companies to detect vulnerabilities on their own devices, but could also be used to spot them on someone else’s.

Like many other information-technology businesses, the active-defence firms are deploying cloud computing (the delivery of software and data storage over the internet) and big-data crunching. CrowdStrike has developed a cloud-based service that scoops in intelligence about online threats from across the web and merges them with analysis from its own research team. It charges its customers from $25,000 to hundreds of thousands of dollars a year for its services. At the Black Hat conference researchers from Endgame demonstrated a system dubbed “BinaryPig”, which crunches huge amounts of data swiftly to help identify and understand hackers by seeking patterns in the “malware” that they use to enter others’ systems.

Other companies are concentrating on technology to foil software that hackers use to enter websites to indulge in wholesale “scraping”, or extraction, of their content. CloudFlare, one such start-up, has developed a service called Maze, which it proudly describes as “a virtual labyrinth of gibberish and gobbledygook”. The service detects content-scrapers and diverts them from the site’s useful material into dummy web pages with useless content.

John Strand, an expert in active-defence techniques at SANS Institute, a computer-security training outfit, says the goal of all these technologies is to drive up the costs that hackers incur in the hope this will deter them in future. It is not to wreak havoc in enemy servers. “We deal in poison, not venom,” he says.

But some security boffins argue that companies should be given more legal latitude to probe those servers. Stewart Baker, a former Department of Homeland Security official who now works for Steptoe & Johnson, a law firm, thinks firms should be allowed to “investigate back” in certain carefully prescribed situations. “There’s a difference between being a vigilante and a private investigator,” he insists. He also suggests that governments should consider licensing specialist firms to conduct investigations according to strict guidelines, rather than relying solely on their own cyber-detectives.

Other voices in the industry give warning that letting private companies hack into others’ servers, even to protect their own property, could lead to trouble. “It’s a foolish strategy to up the ante when you don’t know who you are attacking,” says Jeffrey Carr of Taia Global, a security consultancy. Mr Carr notes that hackers who are provoked might strike back even harder, triggering an escalation of hostilities.  Even some of the techniques employed by firms such as CrowdStrike could land firms in trouble. For instance, it might seem cunning for a company to try to trick hackers into losing money, by planting dummy accounts somewhere on their system that made the company’s financial health seem much worse than it is. But if instead of just using the misinformation to make unwise trades, the hackers leaked the figures to the financial markets, the company could find itself in hot water with regulators.

In spite of such risks, which can be minimised through close co-ordination between companies’ IT and legal teams, security experts are predicting that the popularity of active-defence techniques will grow. One reason is that businesses are making increasing use of cloud computing and mobile devices such as smartphones, which make it harder to establish clear defensive perimeters around their IT systems. “If you don’t really know where your castle starts and ends, you can’t really build an effective wall and moat around it,” explains Nils Puhlmann, formerly chief security officer of Zynga, a social-gaming company, and a founder of the Cloud Security Alliance, an industry group.

Business and cyber-crime: Firewalls and firefights, Economist, Aug. 10, 2013, at 53

Who is Hacking Whom? the Iranian Hackers

After breaching the Dutch CA (Certification Authority) DigiNotar, Iranian hackers managed to sign forged certificates for the domains of spy agencies CIA, Mossad and MI6. Leading certification authorities like VeriSign and Thawte were also targeted, as were Iranian dissident sites.  The cyber attack on DigiNotar, a Dutch subsidiary of VASCO Data Security International Inc, is much more serious than previously thought. In July, hackers gained access to the network and infrastructure of several of DigiNotar’s CAs. Once inside, they generated hundreds of forged certificates for third-party domains.  With these certificates hackers can potentially syphon off user login credentials by spoofing a legitimate site, complete with a functioning but forged SSL-certificate, apparently issued by DigiNotar.

The forged certificates match domains of the U.S. Central Intelligence Agency, the Israeli secret service Mossad, and the British spy agency MI6. On top of that, the hackers created false certificates of other CA’s like VeriSign and Thawte, in an attempt to also misuse their trusted position in securing Internet communications……

The cyber attackers even created fake certificates with messages praising the Iranian Revolutionary Guard, NOS reported.  It’s still unknown how successful the hackers have been in harvesting logins and spying on e-mail and chat messages. Most certificates have either elapsed or were revoked after DigiNotar discovered the breach in mid July.

Chris Soghoian, security and privacy researcher at Indiana University and Graduate Fellow at the Center for Applied Cybersecurity Research, said the list is a “very interesting set of sites.” However, he’s skeptical that the hackers could have penetrated into the networks of the spy agencies with the forged certificates.  “Actually I think the secret service domains are the least alarming part. It’s sexy, and will probably lead to a lot of questions and interest from government agencies. Of course, nobody wants to get caught with their pants down, but there’s really no classified information on these domains. Those are on separate, secured internal networks. So the practical security impact of the Iranian government getting a certificate for the CIA is nill. It’s really just very embarrassing, that’s all,” said Soghoian in an interview with Webwereld.

Still, the cyber hack at DigiNotar has a very high profile. “What is alarming is that they forged certificates for other CA’s, like VeriSign and Thawte. But the most problematic are sites like Google and Facebook. And also Walla, which is one the biggest mail providers in Israel.” Through forged SSL certificates of these sites the Iranian regime would be able to syphon the accounts and online communications of countless people, explained Soghoian.

Google has already updated its Chrome browser so it blocks access to any site which uses a DigiNotar certificate. Mozilla and Microsoft are expected to issue patches for their browsers soon. The Microsoft Security Response team tweeted earlier: “We’re in the process of moving all DigiNotar CAs to the Untrusted Root Store which will deny access to any website using DigiNotar CAs.”  This means hundreds of Dutch government sites will become inaccessible by browsers over the coming days if the agencies don’t switch to another certificate issuer in time.

Last week, Dutch security company Fox-IT carried out a forensic examination of the cyber hack at DigiNotar. The preliminary results prompted the government in The Hague to go into crisis mode, putting in effect an immediate stop to any DigiNotar services, and taking over the operational management of the DigiNotar Certification Authority.  The report on this investigation will be sent to the Parliament and made public on Monday.

Andreas Udo, Hackers Forge Certificates to Break into Spy Agencies, PC World, Sept. 4, 2011