Tag: Cybersecurity

In late July 2017, hackers referring to themselves as “31337” initiated a campaign that posted sensitive personal data on Pastebin, an online bulletin board where hostile actors have been observed dumping sensitive information for public consumption.  The group released a 32 MB file titled “Mandiant Leak: Op. #LeakTheAnalyst,”claiming that the data was taken from a senior threat intelligence analyst at a well-known computer security vendor.  The company has asserted that none of its internal networks were penetrated by the hackers, although three corporate documents and two customers were exposed via the victim’s personal social media accounts.

Dump posted on Pastebin

The threat analyst’s online credentials had been released into the wild as a result of eight data breaches of third parties that had occurred previously.  Any evidence of corporate compromise, such as screen grabs that purposefully intimated a network breach was manufactured, according to a company statement.  Regardless, according to news reports, company stock felt an immediate impact, dropping 5 percent after the incident was made public.

Private security companies have gained prominence for their efforts in detecting and identifying hostile cyber activity, particularly those perpetuated by suspected nation state or state-affiliated actors.  Notably, another private company – and not the Federal Bureau of Investigation or the Department of Homeland Security – led the mitigation and remediation efforts after the 2016 breach into the Democratic National Committee networks.  Indeed, law enforcement and private sector companies are proving to be a positive collaboration.  Private sector companies have the resources and connections to proactively report criminal activity and support investigations with digital forensics and malware reverse-engineering.  In several instances, both groups have joined forces in an effort to disrupt cybercriminal businesses with ransomware connections.

However, this recent incident is notable as it is one of the first instances where hostile actors have deliberately targeted security and intelligence analysts at private security firms with the intent of revealing their identities for further damage.  In its post advertising the LeakTheAnalyst Op, the group’s motivation is rooted in revenge.

 

“In the #LeakTheAnalyst operation we say ****

the consequence let’s track them on Facebook,

Linked-in, Tweeter, etc. let’s go after everything

they’ve got, let’s go after their countries, let’s

trash their reputation in the field. If during your

stealth operation you pwned an analyst, target

him and leak his personal and professional data,

as a side job of course.”

 

In essence, it may be a harbinger of things to come where hostile cyber actors are seeking to turn the tables on their white hat counterparts.

 

From a larger perspective, companies must consider the negative ramifications of the doxing of their employees and how that potentially affects company branding.  Take for instance the unfortunate events surrounding DigiNotar.  In 2011, DigiNotar’s system was tricked into issuing more than 500 fraudulent digital certificates for top Internet companies. This caused such severe damage to the company’s image and business that confidence was unrecoverable. The company ultimately went bankrupt.

 

While the group intimates that more doxes are to follow, there is some skepticism that the group will or even has the skill set required to conduct more sophisticated attacks to exploit systems and retrieve more sensitive information.  The fact that it appears the group gave off the false impression that it had compromised the company’s networks certainly suggests they may have limited capabilities in this capacity.

 

While the incident demonstrates that even security professionals are subject to targeting and victimization, the greater concern is whether this will be an isolated incident or the beginning of something more serious.  Media attention given to private sector computer security firms in exposing advanced persistent threat (APT) actors or cybercriminals operating in the dark web has certainly gotten the attention of these groups and individuals.  With the recent targeting, it now has placed them in the cross-hairs of at least some of these same entities.

 

It is uncertain if the publicity this incident has generated will entice other more skilled hostile actors – such as APT-affiliated or nationalistic actors – to join in the crusade.  Several suspected APT actors have been “outed” by private security companies, and ongoing coverage has negatively highlighted the activities of patriotic hackers (e.g., the distributed denial-of-service attackers observed against Estonia in 2007, and against U.S. banks during Operation Ababil), and recently, those of Russian Internet trolls during the 2016 U.S. Presidential election.  Where aggrieved unsophisticated hackers pose at most a modest threat, a more motivated and advanced actor set seeking revenge on the very organizations that have established their reputations from their exposure is a different adversary altogether.  Attacking brand image and eroding public confidence puts security company solvency at risk.

 

A bugle has inadvertently been sounded; it remains to be seen if that call is answered.

 

This is a guest post written by Emilio Iasiello.

 

On June 27, 2017, the Cyberspace Administration of China (CAC) released its National Cyber Threat Response Plan to help bolster its cyber security posture.  According to news sources citing a document posted on the CAC website, the Plan includes a four-tier color-coded warning system that ranked the severity of cyber attacks Red (the highest level), Orange, Yellow, or Blue (the lowest level).

Continue reading

On May 11, the U.S. President’s Executive Order (EO) “Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure” was finally signed.  This long awaited EO comes on the heels of leaked earlier versions throughout the first part of 2017.  Each subsequent leaked iteration – a draft was published by the Washington Post in January, a revision was published by the Lawfare Blog in February, and the most comprehensive iteration was leaked in early May and also published by the Lawfare Blog.

Continue reading

3 non-technical positions in high demand in the cybersecurity industry

We keep hearing about the widening skills gap ravaging the Cybersecurity industry. Lack of qualified personnel is slowing its growth and affecting the security level of the customers. But most people outside the industry see these statistics and shrug. The cybersecurity industry is perceived as a very small, elitist segment of the tech market. Even to point of it being a niche industry.

Continue reading

RSAC 2017- more of the same, but some interesting trends emerge

RSAC 2017 is behind us. It has been bigger, noisier and more crowded than any cybersecurity event in history. It’s so big, it’s overwhelming. And if you consider the off-site meetings, mini-conferences, meetups and parties you can forgive an average visitor if he or she feels kind of fuzzy afterward. Vendors don’t have it easy, either. With more than 700 companies and organizations presenting, trying to stand out or simply gauge the competition is extremely difficult.

Continue reading

The Cyber Coordinator: Let the Dog Bite

Former New York Mayor Rudy Giuliani has been tapped to be the President’s new “cyber security czar.”  The appointment has been met with trepidation among those in the information security business who point out Mr. Giuliani’s lack of expertise in anything cyber-related, despite being Chair of the Cybersecurity, Privacy and Crisis Management Practice at a Miami-based law firm and advising companies on information security since 2002.  In fact, critics cite recent reporting revealing that passwords used by Giuliani and 13 other top staff members have been leaked in mass breaches of websites like LinkedIn, MySpace, and others between 2012 and 2016.

Continue reading

Israeli cybersecurity industry- looking back at 2016

Israel is a major force in cybersecurity innovation and development, and Israeli cybersecurity companies are at the forefront of technology, rubbing shoulders with global industry giants. In fact, according to CyberDB data-bank, Israel has the second largest amount of cybersecurity companies in the world, second only to the US. In terms of actual sales Israel cybersecurity exports account for anything between 5-10% of the global cybersecurity market , an amazing figure given Israel’s miniscule size and small population.

Continue reading

Russia and China Are Making their Information Security Case

in December 2016, Russian President Vladimir Putin approved a new information security doctrine, which updates the older 2000 version. The doctrine, a system of official views on the insurance of the national security of the country in the information sphere, regards the main threats to Russia’s security and national interest from foreign information making its way into the country, and sets priorities for countering them.

Continue reading

  • 1
  • 2