CISA, Cyber National Mission Force leaders share how they partner: First-ever ops revealed to industry
On April 24, CISA’s Executive Assistant Director for Cybersecurity and U.S. Cyber Command’s Cyber National Mission Force (CNMF) commander delivered a presentation at the RSA Conference on the importance of partnership in defending America’s critical infrastructure while holding malicious cyber actors accountable.
The leaders shared newly declassified details of interagency responses to cyberattacks from nation-state actors and cybercriminals, including how CNMF shares information from foreign operations to enable CISA’s domestic defensive mission. They also discussed how CISA shares information from domestic cyber incidents to enable CNMF’s operations to impose costs on foreign malicious cyber actors. They discussed case studies, including the “SolarWinds” campaign, the mitigation of Chinese hacking of Microsoft Exchange, the disruption of Iranian targeting of an election reporting website, and ongoing data-sharing from cybercriminal targeting of federal agencies and educational institutions to enable CNMF operations.
(Source: CISA)
China revises law to include certain cyberattacks as ‘acts of espionage’
The Chinese government passed an expansion of its counterespionage law on Wednesday, April 26, that would, among other things, allow people to be charged as spies if they target critical infrastructure or government bodies with cyberattacks.
The revised version of the 2014 law was passed by China's Standing Committee of the National People's Congress (NPC), state media outlet Xinhua reported, and will go into effect on July 1.
According to a translation of the most recent draft version of the law, “acts of espionage” now formally include “Network attacks [or] intrusions … targeting state organs, units involved with secrets, or critical information infrastructure” perpetrated or funded by spying organizations and affiliated agents.
More broadly, the espionage law also applies to “agencies, organs, individuals, or other collaborators domestically or outside” China who are involved in cyberattacks.
Since September 2022, the Chinese government has repeatedly accused the U.S. National Security Agency of hacking into the network of the government-backed Northwestern Polytechnical University, stealing data on “sensitive identities” within China.
In February, Cybersecurity and Infrastructure Security Agency chief Jen Easterly warned of “China’s massive and sophisticated hacking program,” saying the country faced cyber intrusions by the Chinese government “every day.”
(Source: The Record)
San Bernardino County sheriff's office struggling to recover from ‘malware’ incident
The San Bernardino County Sheriff’s Department’s public information officer told Recorded Future News that the Southern California department first identified a network disruption on April 7 and later confirmed that it involved malware.
A local news outlet reported on Sunday, April 23, that the department is still struggling to recover from the incident, with officers having to use radios to run license plate checks or get further information on suspects. The agency has 15 patrol stations and about 3,800 employees overall. The department initially shut down email and internet services as well as the computers used by officers in their cars.
The attack began when an officer clicked on a malicious link, according to ABC7.
The San Bernardino agency is the latest law enforcement institution to deal with a cyberattack. Last month, a ransomware group leaked data stolen from the Washington County Sheriff’s Office in northeastern Florida and two weeks ago, a New Jersey police department said it was struggling to rebound from its own ransomware attack.
Several other police departments were forced to resort to pen and paper due to cyberattacks, including offices in Ohio and New York. Even the U.S. Marshals Service was hit with a ransomware attack that exposed troves of sensitive data.
Ransomware groups have also launched several recent attacks on police departments across California, including incidents in Modesto, Oakland and San Francisco.
(Source: The Record)
PaperCut says hackers are exploiting ‘critical’ security flaws in unpatched servers
Print management software maker PaperCut says attackers are exploiting a critical-rated security vulnerability to gain access to unpatched servers on customer networks.
PaperCut offers two print management products, PaperCut NG and PaperCut MF, used by local governments, large enterprises and healthcare and education institutions. PaperCut’s website says it has over 100 million users from more than 70,000 organizations worldwide.
In an advisory last week, PaperCut said that a critical vulnerability it patched earlier in March was under active attack against machines that had yet to install the security update. The vulnerability, tracked as CVE-2023-27350, is scored 9.8 out of a possible 10 in vulnerability severity as it could allow an unauthenticated attacker to remotely execute malicious code on a server without needing credentials.
(Source: TechCrunch)
Google’s new two-factor authentication isn’t end-to-end encrypted, tests show
An examination by security researchers finds an alarming flaw in the search giant's new feature, which syncs your Authenticator app across devices.
Google’s Authenticator app provides unique codes that website logins may ask for as a second layer of security on top of passwords. On Monday, April 24, Google announced a long-awaited feature, which lets you sync Authenticator to a Google account and use it across multiple devices. That’s great news, because in the past, you could end up locked out of your account if you lost the phone with the authentication app installed.
The researchers who uncovered the problem found the app didn’t prompt or offer an option to use a passphrase to protect the “secrets.” In the security community, “secrets” is the term for credentials that work as a key to unlock an account or a tool.
The tests found the unencrypted traffic contains a “seed” that’s used to generate the two-factor authentication codes. Anyone with access to that seed can generate their own codes for your accounts and break in.
You can use Google Authenticator without tying it to your Google account or syncing it across devices, which avoids this issue. Unfortunately, that means it might be best to avoid a useful feature that users spent years clamoring for.
(Source: Gizmodo)
|
