Cyber wrap
Posted By Zoe Hawkins on May 18, 2016 @ 12:30
In an interesting turn of events, it appears that the 2014 Sony hack, February’s Bangladeshi bank heist and the attempted breach of a Vietnamese bank last year may all be linked [1]. Vietnam’s Tien Phong Bank released a statement over the weekend saying it disrupted an attempted cyber heist [2] valued at US$1.1 million at the end of last year. The thwarted incident and the breach of Bangladesh’s central [3] bank in February are both thought to have targeted SWIFT [4], the central network for global financial transactions, with fraudulent transfer requests. SWIFT’s CEO has denied claims [5] that vulnerabilities in the payment network facilitated the Bangladesh heist, with the company releasing a statement [6] arguing that PDF-targeting malware was used to initiate fraudulent bank transfers. However, security firm BAE has just published a blog [7] highlighting the ‘strong links’ between the methods used in those two bank incidents and the infamous hack of Sony Pictures [8] in 2014. The similarities suggest that these events are part of a broader campaign that could be traced back to a single group of hackers [9].
To counter such breaches in the future, IBM’s super computer, Watson, is now being trained to combat cybercrime [10]. The computing system already excels in many areas, including healthcare [11], cooking [12], finance [13], customer service [14] and playing Jeopardy [15]. IBM describes Watson [16] as ‘a technology platform that uses natural language processing and machine learning to reveal insights from large amounts of unstructured data’. Now, eight universities [17] across the US will be part of the effort to expand Watson’s knowledge on the topic of cybercrime. IBM will provide Watson with 15,000 annotated security documents per month [18], and expects it to attain an expert level of understanding of the cybersecurity landscape and the ability to monitor large scale trends, as well as the ability to detect potential threats. Watch a video explaining the process here [19].
The US Senate has asked President Obama [20] to develop a national definition of cyberwar. Republican Senator Mike Rounds has proposed the Cyber Act of War Act 2016 [21], which would ‘require the President to develop a policy for determining when an action carried out in cyberspace constitutes an act of war against the United States, and for other purposes’. Rounds’ suggestion has raised criticism, including this CFR article [22] that describes the bill as ‘an ill-conceived proposal that deserves to die, quickly, in Congress’.
The US Department of Commerce’s National Telecommunications and Information Administration (NTIA) has published new research [23] revealing that the ongoing encryption debate [24] is eroding public confidence in the safety of the Internet. A survey of 41,000 households in the US revealed that nearly one in two individuals report that privacy and security concerns now prevent them from doing even simple things online. NTIA has raised concerns [25] that this significant loss of trust may ‘reduce economic activity and hamper the free exchange of ideas online’, a trend that could be reversed [26] by encouraging broad use of strong encryption technologies.
Last Wednesday, Chinese and US officials met in DC to discuss cyber issues [27] for the first time since establishing some common cyber principles as part of a broader bilateral agreement in September [28] last year. The first iteration of the new Senior Experts Group, included [29] US representatives from the US Department of State, Department of Defense, and Department of Homeland Security, with Chinese representatives from the Ministry of Foreign Affairs, Ministry of National Defense, Cyberspace Administration of China, and the Ministry of Public Security. According [30] to the Chinese Foreign Ministry’s spokesperson, the discussions took place in a ‘positive, in-depth and constructive way, touching upon norms for state behaviour and cyberspace-related international law and confidence-building measures’. The group is expected to meet twice a year [31], and represents an improvement of bilateral cyber relations after China withdrew from a similar initiative [32] in response to the US indictment of five Chinese military officers in 2014.
Unfortunately, it’s not all good news in Sino–US cyber relations. The recent release of US Defense Department’s annual report to Congress, Military and Security Developments Involving the People’s Republic of China [33], offers a critical assessment of Chinese cyber posturing. It re-issues accusations [34] of China’s attempts on US government networks, describing the use of ‘cyber capabilities to support intelligence collection against the US diplomatic, economic, and defense industrial base sectors that support US national defense programs’. Chinese Defence Ministry spokesman Yang Yujun denounced [35] the report as having ‘deliberately distorted’ Chinese defence policies, while Chinese Foreign Ministry spokesman Hong Lei described [36] it as ‘full of prejudice against China’. At the same time, The New York Times is reporting [37] that Chinese authorities have been secretly reviewing the security features of tech products sold in China by overseas companies. The assessments are supposedly run by a committee within the Cyberspace Administration of China and are expected to create a ‘new front in an already tense relationship with Washington over digital security’.
Lastly, please join us in a moment of silence to honour the timely death of CSI: Cyber [38]. Ok, that’ll do.
Article printed from The Strategist: https://www.aspistrategist.org.au
URL to article: https://www.aspistrategist.org.au/cyber-wrap-120/
URLs in this post:
[1] all be linked: http://arstechnica.co.uk/information-technology/2016/05/700m-bangladesh-bank-hackers-implicated-in-attack-on-vietnamese-bank-sony-hack/
[2] disrupted an attempted cyber heist: http://thehill.com/policy/cybersecurity/279999-vietnam-bank-thwarts-11m-cyberheist-using-swift-software?utm_source=&utm_medium=email&utm_campaign=1868
[3] breach of Bangladesh’s central: http://www.theguardian.com/world/2016/mar/15/bangladesh-central-bank-governor-resigns-over-81m-dollar-cyber-heist
[4] targeted SWIFT: http://www.ibtimes.co.uk/vietnams-tpbank-thwarted-1m-cyber-heist-similar-bangladesh-bank-attack-1560211
[5] denied claims: http://www.reuters.com/article/us-bangladesh-heist-swift-idUSKCN0Y320K
[6] statement: https://www.swift.com/insights/press-releases/swift-customer-communication_customer-security-issues
[7] a blog: http://baesystemsai.blogspot.com.au/2016/05/cyber-heist-attribution.html
[8] infamous hack of Sony Pictures: http://www.theverge.com/2014/12/8/7352581/sony-pictures-hacked-storystream
[9] single group of hackers: http://www.forbes.com/sites/thomasbrewster/2016/05/13/81m-bangladesh-bank-hackers-sony-pictures-breach/#759f31af6cdc
[10] combat cybercrime: https://www.wired.com/2016/05/ibm-watson-cybercrime/
[11] healthcare: http://www.ibm.com/smarterplanet/us/en/ibmwatson/health/
[12] cooking: http://www.wired.com/2015/06/hungry-let-supercomputer-chef-watson-tell-cook/
[13] finance: http://www.ibmbigdatahub.com/blog/watson-analytics-revolutionizing-office-finance
[14] customer service: http://www.forbes.com/sites/bruceupbin/2013/05/21/ibms-watson-now-a-customer-service-agent-coming-to-smartphones-soon/#ae3a04a17f38
[15] playing Jeopardy: https://www.youtube.com/watch?v=WFR3lOm_xhE
[16] IBM describes Watson: http://www.forbes.com/sites/stevemorgan/2016/05/10/ibms-watson-vs-hackers-in-the-war-against-cybercrime/#53d8e6843453
[17] eight universities: http://www.cio.com.au/article/599612/universities-help-watson-tackle-cybercrime/
[18] 15,000 annotated security documents per month: http://www.prnewswire.com/news-releases/ibm-watson-to-tackle-cybercrime-300265663.html
[19] here: https://www.youtube.com/watch?v=kao05ArIiok&feature=youtu.be
[20] Senate has asked President Obama: http://searchsecurity.techtarget.com/news/450296272/Senate-asks-President-Obama-for-a-cyber-act-of-war-definition
[21] Cyber Act of War Act 2016: http://www.rounds.senate.gov/imo/media/doc/Bill,%20NDAA%202017%20Related,%20Cyber%20Act%20of%20War.pdf
[22] CFR article: http://blogs.cfr.org/cyber/2016/05/12/the-cyber-act-of-war-act-a-proposal-for-a-problem-legislation-wont-and-shouldnt-try-to-fix/
[23] published new research: https://www.ntia.doc.gov/blog/2016/lack-trust-internet-privacy-and-security-may-deter-economic-and-other-online-activities
[24] ongoing encryption debate: https://www.wired.com/2016/05/security-news-week-tech-versus-government-yet/?mbid=social_twitter
[25] raised concerns: https://www.washingtonpost.com/news/the-switch/wp/2016/05/13/new-government-data-shows-a-staggering-number-of-americans-have-stopped-basic-online-activities/?postshare=3011463353065606&tid=ss_tw
[26] could be reversed: http://thehill.com/policy/technology/280019-survey-security-concerns-keeping-some-from-engaging-online?utm_source=&utm_medium=email&utm_campaign=1868
[27] met in DC to discuss cyber issues: http://www.reuters.com/article/us-usa-china-cyber-idUSKCN0Y22OB
[28] agreement in September: https://www.whitehouse.gov/the-press-office/2015/09/25/fact-sheet-president-xi-jinpings-state-visit-united-states
[29] included: http://www.state.gov/r/pa/prs/ps/2016/05/257103.htm
[30] According: http://www.fmprc.gov.cn/mfa_eng/xwfw_665399/s2510_665401/2535_665405/t1362758.shtml
[31] meet twice a year: http://www.ibtimes.co.uk/hacking-cyber-espionage-us-china-discuss-security-digital-age-1559787
[32] withdrew from a similar initiative: http://usa.chinadaily.com.cn/china/2014-05/20/content_17519303.htm
[33] Military and Security Developments Involving the People’s Republic of China: http://www.defense.gov/Portals/1/Documents/pubs/2016%20China%20Military%20Power%20Report.pdf
[34] re-issues accusations: http://www.reuters.com/article/us-china-usa-idUSKCN0Y602Y
[35] denounced: http://www.bloomberg.com/news/articles/2016-05-13/china-cyber-probes-show-electronic-warfare-focus-pentagon-says
[36] described: http://www.popularmechanics.com/military/a20897/china-is-not-happy-about-the-pentagons-new-military-report/
[37] reporting: http://www.nytimes.com/2016/05/17/technology/china-quietly-targets-us-tech-companies-in-security-reviews.html
[38] death of CSI: Cyber: https://www.yahoo.com/tv/csi-cyber-cancelled-cbs-183347195.html
Click here to print.