Cyber wrap

Posted By Michael Chi on June 7, 2017 @ 11:45

Provocative quotes from the Emir of Qatar that recently appeared on a Qatar government website have been attributed to a Russian cyber attack. The comments, which expressed support for Iran, Hamas, Hezbollah and the Muslim Brotherhood have been removed but ended up being one of many reasons already for this week's diplomatic fracas. Saudi Arabia, the United Arab Emirates, Egypt, Bahrain, Yemen and even Libya have suspended diplomatic relations with Qatar, cut sea, air and land connections, and expelled Qatari visitors and residents. The move isn’t a bolt-from-the-blue, coming as the latest and most extreme escalation in a string of disagreements—neighbouring countries have long rebuked Qatar for its support for Islamists and violent extremists in the region, including Islamic State, and previously had recalled diplomats over an eight month period in 2014.

Prime Minister Malcolm Turnbull and Minister Assisting the PM for Cyber Security Dan Tehan held a roundtable with major telco and internet companies last Wednesday to discuss strategies to protect Australians from cyber attacks. The roundtable echoed Tehan’s remarks at ASPI’s launch event for its review of the government’s Cyber Security Strategy, where he suggested that telcos could play an expanded gatekeeper role for Australia’s networks.

The Shadow Brokers—the group behind recent leaks of NSA hacking tools used in WannaCry—have announced they’re open for business, revealing details about their new monthly data dump service. For the bargain price of the cryptocurrency equivalent of USD$23,251, potential subscribers will receive a data dump, which will reportedly have something for everyone, from exploits and tools, banking data, and nuclear weapons and missile program data. Given the value subscribing could have in mitigating the next major cyber attack, companies and governments  are facing ethical and legal dilemmas about whether to subscribe or not.

On the other hand, the question of money might prove to be irrelevant, as it’s been suggested by commentators, including Edward Snowden, that the group is a front for Russian Intelligence, and that the solicitations for money are a distraction from the organisation’s goals in collecting foreign intelligence and burning the NSA’s toolsets and capability. Previous attempts to sell exploits have been characterised as clumsy and poorly thought out. Moreover, some “creative” acronym analysis seems to support the Russian intelligence theory.

Hillary Clinton has come out firing, dissecting the role that disinformation had in her defeat during the 2016 presidential election. She pins the blame squarely on a number of Russian agents using cutting edge analytics, marketing and machine learning to algorithmically generate fake news and influence voters through social media. More importantly, it’s likely only the beginning of an information war that’ll characterise elections to come, and an issue that will continue to dog Facebook.

In response to the recent attack in London, British Prime Minister Theresa May has come out strongly against the inaction that internet companies have demonstrated on the issue of extremist communications, stating that there is ‘far too much tolerance of extremism in our country’. The PM also suggested that Britain’s counterterrorism strategy needs to be reviewed to increase the powers of police and security services. Similar comments have come from Malcolm Turnbull, who has called out social media messaging companies as not doing enough to provide security agencies with access to encrypted communications.

A defamation case in Switzerland also demonstrates the increasing scrutiny social media is facing. In what seems to be a world first, a Zurich man who ‘liked’ defamatory social media posts has been fined 4,000 Swiss Francs (USD$4,100). The man liked a post that (falsely) accused a third party of antisemitism, racism, and fascism—the trifecta! It’s unclear whether the charges will stick through the appeals process. However, in the meantime, avid Tweeters who rely on the disclaimer ‘retweet doesn’t equal endorsement’ might want to be more cautious.

Sydney-based ticketing start-up Qnect has been grappling with a perplexing security incident this week, with hackers directly SMSing individual Qnect users with a warning that their personal data (e-mails, credit card information) has been stolen and will be released online unless a ransom is paid. It’s likely that the names, e-mails and phone numbers were gathered by exploiting an autocomplete function that tends to overshare. As a result, the founders are reassuring customers that financial data hasn't been exposed and that the threats are just a bluff.

Lastly, for those readers playing ASPI Bingo, you can mark ‘cybersecurity’ and ‘submarines’ off your sheet: the British and American Security Information Council has released a report finding that Vanguard-class ballistic missile submarines (the ones armed with world-ending nukes) remain vulnerable to catastrophic cyber attack.

Article printed from The Strategist: https://www.aspistrategist.org.au

URL to article: https://www.aspistrategist.org.au/cyber-wrap-167/

[1] attributed: https://www.reuters.com/article/us-gulf-qatar-usa-idUSKBN18U0B1

[2] Russian cyber attack: http://edition.cnn.com/2017/06/06/politics/russian-hackers-planted-fake-news-qatar-crisis/index.html?sr=twcnni060617russian-hackers-planted-fake-news-qatar-crisis1011PMVODtopPhoto&linkId=38426738

[3] expressed support: http://www.haaretz.com/middle-east-news/.premium-1.793817

[4] suspended diplomatic relations with Qatar: https://www.theguardian.com/world/2017/jun/05/saudi-arabia-and-bahrain-break-diplomatic-ties-with-qatar-over-terrorism

[5] cut sea, air and land connections: https://www.ft.com/content/dc24473c-499e-11e7-a3f4-c742b9791d43

[6] expelled Qatari visitors and residents: https://www.usnews.com/news/world/articles/2017-06-05/qatar-asks-citizens-to-leave-uae-within-14-days-embassy

[7] long rebuked Qatar for its support for Islamists and violent extremists: https://foreignpolicy.com/2014/09/30/the-case-against-qatar/

[8] an eight month period in 2014: http://www.aljazeera.com/indepth/features/2017/06/timeline-qatar-gcc-disputes-170605110356982.html

[9] held a roundtable: https://www.pm.gov.au/media/2017-05-31/remarks-cyber-security-roundtable

[10] with major telco and internet companies: http://www.dailytelegraph.com.au/news/nsw/cyber-crime-turnbull-to-hold-crisis-talks-with-major-telcos-and-internet-companies/news-story/a1894ab9d19c919929e72f8956aa062e?nk=870e14e599206d812e5f91a6e690a0a2-1496650452

[11] launch event: https://www.aspi.org.au/events/launch-australias-cyber-security-strategy-execution-and-evolution

[12] review of the government’s Cyber Security Strategy: https://www.aspi.org.au/publications/australias-cyber-security-strategy-execution-and-evolution

[13] Shadow Brokers: https://www.bloomberg.com/news/articles/2017-05-04/seriously-beware-the-shadow-brokers

[14] announced they’re open for business: https://steemit.com/shadowbrokers/@theshadowbrokers/theshadowbrokers-monthly-dump-service-june-2017

[15] bargain price of the cryptocurrency equivalent of USD$23,251: http://www.networkworld.com/article/3198512/security/shadow-brokers-reveal-details-about-june-monthly-dump-service-100-zcash-about-23k.html

[16] reportedly have something for everyone: http://www.networkworld.com/article/3196882/security/shadow-brokers-announce-monthly-data-dump-service.html

[17] are facing ethical: https://arstechnica.com/security/2017/05/new-shadow-brokers-0day-subscription-forces-high-risk-gamble-on-whitehats/

[18] legal dilemmas: https://www.cnet.com/news/wannacry-shadow-brokers-response-team-crowdfund-zcash-cyber-security-hackers/

[19] subscribe or not: https://twitter.com/hackerfantastic/status/869483135918116864

[20] including Edward Snowden: https://twitter.com/Snowden/status/765513662597623808

[21] solicitations for money are a distraction: https://twitter.com/MalwareJake/status/869522980560408577

[22] clumsy and poorly thought out: https://www.theregister.co.uk/2017/01/12/shadow_brokers_retire/

[23] creative” acronym analysis: https://twitter.com/josephfcox/status/870262135628214272

[24] come out firing: https://www.recode.net/2017/5/31/15716226/watch-live-hillary-clinton-code-conference-today

[25] dissecting the role that disinformation: http://www.cnbc.com/2017/05/31/hillary-clinton-speaks-at-code-conference-on-the-information-war.html

[26] only the beginning of an information war: https://www.theatlantic.com/technology/archive/2017/05/hillary-clinton-information-wars/528765/

[27] elections to come: https://www.aspi.org.au/publications/securing-democracy-in-the-digital-age

[28] continue to dog Facebook: http://www.nbcnews.com/tech/tech-news/zuckerberg-shoots-down-investors-calling-transparency-fake-news-n767646

[29] recent attack in London: http://www.bbc.com/news/uk-england-london-40147164

[30] internet companies have demonstrated on the issue of extremist communications: https://www.theatlantic.com/news/archive/2017/06/theresa-mays-terrorism-strategy/529101/

[31] not doing enough to provide security agencies with access to encrypted communications: http://www.zdnet.com/article/australian-pm-calls-on-facebook-and-apple-to-help-access-encrypted-chats/

[32] fined 4,000 Swiss Francs (USD$4,100): http://money.cnn.com/2017/05/31/technology/facebook-like-defamation-switzerland/

[33] grappling with a perplexing security incident: https://www.businessinsider.com.au/the-federal-police-were-called-after-a-sydney-startup-was-hacked-and-blackmailed-2017-5

[34] SMSing individual Qnect users with a warning that their personal data: https://www.facebook.com/SydneyUniversityLawSociety/photos/a.168550916607851.33984.164663603663249/1268748853254713/?type=3

[35] an autocomplete function that tends to overshare: https://twitter.com/tommarmstrong/status/869085557493645316/photo/1

[36] financial data hasn't been exposed: https://www.facebook.com/qnecthq/posts/783281771836223

[37] released a report finding: http://www.basicint.org/publications/stanislav-abaimov-paul-ingram-executive-director/2017/hacking-uk-trident-growing-threat

[38] vulnerable to catastrophic cyber attack: https://www.theguardian.com/uk-news/2017/jun/01/uks-trident-nuclear-submarines-vulnerable-to-catastrophic-hack-cyber-attack