Cyber wrap
Posted By
Liam Nevill
on July 20, 2016 @ 13:30
Yesterday’s appointment of Malcolm Turnbull’s new ministry has followed through with the commitment made in last year’s Cyber Security Strategy to create a ministerial position for cyber security. Dan Tehan from Victoria has added Minister assisting the Prime Minister for Cyber Security, in addition to his other roles as Minister for Defence Personnel, Minister for Veteran’s Affairs and Minister assisting the Prime Minister for the centenary of ANZAC.
Part of Tehan’s responsibilities will be leading work with the private sector to implement the government’s cyber strategy. The other change relevant to cyber policy and security is Greg Hunt’s move to the Industry, Innovation and Science portfolio. Mitch Fifield remains in Communications, Angus Taylor retains Assistant Minister for cities and digital transformation, and Fiona Nash has kept the regional communications role.
In the US, Department of Defense leaders are apparently ‘frustrated’ by the pace of Cyber Command’s actions to disrupt Islamic State’s online activities. Cyber Command’s campaign against IS is the first time the US has publicly acknowledged that Cyber Command is engaged in operations, but the seven year-old command was established to tackle state actors, and apparently is having difficulty getting the right people and capabilities in place to overcome IS use of the internet for recruitment, operations and propaganda.
A new Joint Task Force, dubbed ‘Ares’ has been established to conduct cyber operations against IS and coordinate with Central Command’s plans and operations in Iraq and Syria. Officials suggested to The Washington Post that possible actions might include disrupting payment systems, chat apps and other online platforms such as IS’ magazine ‘Dabiq’, but that IS was able to counteract this by switching to new servers and other hardware to stay ahead of US cyber operations against them.
The attempted coup in Turkey over the weekend took advantage of the security features of messaging app WhatsApp to coordinate operations across the country. However it seems that despite realising the advantages of encrypted online communications for their planning, the coup’s leaders didn’t take account of the power of the internet and social media to rally resistance, as President Erdogan did via FaceTime from his plane. While they did seize control of two television channels, access to the internet and social media wasn’t significantly disrupted during the coup.
The military did attempt to throttle access to social media but this appears to have been quickly overhauled by the President after only a few hours. Security researcher ‘the grugq’ noted on Medium that by failing to cut access to cyberspace the coup was bound to fail, as Erdogan could still call on supporters to oppose the coup. Grugq goes on to compare the successful coups in Thailand in 2006 and 2014 to the failure in Turkey, noting that the Thai coups succeeded in part because they quickly denied access to mass communication by political leaders by either cutting the power, or detaining them en masse. He concludes that a successful coup plan needs to better incorporate cyberspace into its execution, and within the first hour cut power to main cities, neutralise leadership and take over all telcos, ISPs and TV stations.
And finally, Pokémon Go has literally taken over the world. Its popularity has made it a target for cyber criminals using third party apps infected with malware, and hackers seeking notoriety who brought down servers for US and European players last Saturday. The DDOS incident was claimed by hacker group ‘PoodleCorp’, who promised more to come. But how can you join in and battle with your friends if you’re a spy and need to protect your identity, location and other sensitive personal information? Luckily the US government has created a guide for employees on how to catch em’ all without breaching operational security, kindly shared by Thomas Rid on Twitter. Some of the advice is good cyber security advice generally, such as avoiding play in areas you don’t want to be geo-tagged and not using personal Gmail accounts. Other tips such as ‘do not attempt to catch Pokémon while driving’ also seem pretty sensible. Wait, is that a Vaporeon?
Liam Nevill is an analyst in ASPI’s International Cyber Policy Centre. He was last seen wandering aimlessly around Lake Burley Griffin searching for water-types. A reward is offered for his safe return.
Article printed from The Strategist: https://www.aspistrategist.org.au
URL to article: https://www.aspistrategist.org.au/cyber-wrap-128/
[1] Cyber Security Strategy to create a ministerial position for cyber security: http://www.computerworld.com.au/article/603585/cabinet-reshuffle-government-boosts-focus-cyber-security/
[2] Minister assisting the Prime Minister for Cyber Security: http://www.theregister.co.uk/2016/07/18/australia_gets_onethird_of_a_minister_for_infosec/
[3] strategy: https://cybersecuritystrategy.dpmc.gov.au/
[4] ‘frustrated’: http://www.ibtimes.co.uk/pentagon-not-impressed-over-slow-start-cyberwar-against-isis-1570947
[5] is the first time the US has publicly acknowledged that Cyber Command is engaged in operations: https://www.washingtonpost.com/news/checkpoint/wp/2015/04/23/for-first-time-pentagon-strategy-addresses-use-of-cyberweapons/?tid=a_inl
[6] apparently is having difficulty getting the right people and capabilities in place to overcome IS: https://www.washingtonpost.com/world/national-security/us-militarys-digital-war-against-the-islamic-state-is-off-to-a-slow-start/2016/07/15/76a3fe82-3da3-11e6-a66f-aa6c1883b6b1_story.html
[7] Joint Task Force, dubbed ‘Ares’ has been established: https://www.engadget.com/2016/07/16/pentagon-joint-task-force-ares/
[8] WhatsApp to coordinate operations across the country: http://www.middleeasteye.net/news/breaking-al-jazeera-obtain-copies-messages-sent-between-coup-plotters-2058035230
[9] , the coup’s leaders didn’t take account of the power of the internet and social media to rally resistance: http://arstechnica.com/information-technology/2016/07/turkish-plotters-used-whatsapp-to-coordinate-coup/
[10] did attempt to throttle access: http://www.dailydot.com/layer8/turkey-coup-social-media-ban-lift/
[11] Security researcher ‘the grugq’ noted on Medium: https://medium.com/@thegrugq/cyberpower-crushes-coup-b247f3cca780#.50i0mtepx
[12] 2006: https://en.wikipedia.org/wiki/2006_Thai_coup_d%27%C3%A9tat
[13] 2014: https://en.wikipedia.org/wiki/2014_Thai_coup_d%27%C3%A9tat
[14] literally taken over the world: http://www.bbc.com/news/technology-36824737
[15] using third party apps infected with malware: https://techcrunch.com/2016/07/18/beware-the-fake-pokemon-go-apps/
[16] servers for US and European players last Saturday: http://www.cbronline.com/news/mobility/security/massive-ddos-cyber-attack-takes-down-pokmon-go-4952177
[17] ‘PoodleCorp’: http://www.independent.co.uk/life-style/gadgets-and-tech/gaming/pokemon-go-down-servers-ddos-attack-hackers-poodlecorp-game-unavailable-a7140811.html
[18] Thomas Rid on Twitter: https://twitter.com/RidT/status/754298406034702336/photo/1?ref_src=twsrc%5Etfw
[19] good cyber security advice generally: http://www.atlasobscura.com/articles/here-are-the-cias-possible-security-guidelines-for-pokemon-go
[20] ‘do not attempt to catch Pokémon while driving’: http://www.abc.net.au/news/2016-07-15/first-pokemon-go-car-crash-reported-in-toowoomba/7631684
[21] Vaporeon: http://www.polygon.com/2016/7/15/12200590/pokemon-go-stampede-central-park-vaporeon
Print This Post