- The Strategist - https://www.aspistrategist.org.au -

Cyber wrap

Posted By on June 28, 2017 @ 12:30

Image courtesy of Pixabay user geralt.


The UK Parliament’s e-mail system was targeted by a sustained brute-force password-guessing attack last Friday, forcing parliamentary staff to temporarily block remote email access and mandate password changes. The ‘rudimentary’ but effective attack resulted in the compromise of at least 90 email accounts. A few members of parliament, including Cabinet ministers, saw their details posted for sale online, and it’s possible that embarrassing personal information has been taken, posing a risk of blackmail. More importantly, the details gathered could be used to penetrate other vital systems. It’s not yet clear who conducted the attack or why they did it, but Conservative Party MP Henry Smith trundled out the usual suspects, from Russia, to North Korea, to an anonymous stranger in a basement. Subsequent commentary has criticised the Parliament’s information security practices, from accepting the use of weak passwords that could be ‘guessed’, to lacking basic and decades-old mitigation strategies like IP filtering and 2-factor-authentication, and finally the 10-hour delay before the Parliamentary Digital Service alerted affected personnel.

Attorney-General George Brandis and Minister for Immigration and Border Protection Peter Dutton have issued a joint media release setting out Australia’s agenda ahead of a Five-Eyes meeting in Ottawa—though 10 points from Gryffindor for ‘Ottowah’. The meeting is set to focus on encrypted communications, data sharing and immigration arrangements. Encrypted messaging has dominated the national security debate recently, due to its massive growth to 40% of CT-related commutation intercepts today, compared to 3% just four years ago. Russia is also facing the encryption debate, with the Russian Federal Security Service threatening to block encrypted messaging app Telegram for refusing to decrypt messages after it was used by terrorists in the St. Petersburg metro attack back in April.

Tech firms aren’t happy with the direction of the encryption debate either, with Google’s Legal Counsel Kent Walker stating that companies are in an ‘untenable’ position—caught between needing to fulfil unwieldy treaty-based international evidence requests (which currently take up to 10 months on average) despite systemic legal ambiguity. In a supporting blog post, he’s called for new regulations that clarify data sovereignty, improve current international evidence sharing processes, and introduce agreed norms when it comes to baseline principles of privacy, human rights and due process. Google has also announced that Gmail will no longer be scanned for advertising profiling data to increase consumer confidence.

In news for any legal scholars following the infosec world, the National Law Review, an American journal, has put out a three-part series providing a rundown on China’s recently implemented Cybersecurity Law. Germany has recently introduced new laws that expand the scope of situations in which German police are allowed to access devices and see messages at the source. The law has run into legal challenges, which argues that the new legislation is in contravention of EU laws. Finally, pending legislation, Canada might see it’s Communications Security Establishment legally empowered (with upgraded oversight) to carry out offensive cyber operations, a move that would significantly expand its mandate.

Cyber cooperation has seen big wins this week, with Canada and China signing an agreement to stop using cyber-attacks for industrial espionage. Multilaterally, Thailand’s Ministry of Foreign Affairs will host a seminar next week to discuss ASEAN’s cybersecurity cooperation and practice in the future. And the World Bank is funding a project to stand up Zambia’s National Cybersecurity Agency, with Israeli cybersecurity company CyGov providing advice and expertise.

WannaCry has continued to infect pockets of unpatched systems this week, striking a Honda factory and forcing the factory to temporarily shut down while fixes were applied. WannaCry has also affected traffic cameras in Victoria. Initial statements from the Victorian government indicated that the overall system wasn’t compromised and that all infringements would remain, but that was later reversed, with the government stating they would ‘quarantine’ and review infringements generated by the affected cameras. The contradiction seems to indicate that the Victorian government is struggling with its communications and decision-making processes in the event of cyber incidents.

The US national security community seems to be embracing open source development communities, with the National Security Agency (NSA) joining GitHub to launch a page that shares the details of 32 different projects. Similarly, the Department of Homeland Security has announced a Kaggle competition for passenger screening, sharing valuable training data and offering a US$1.5 million reward to the team that develops an algorithm for body scanners to automatically identify concealed objects. There’s been some involuntary technology sharing between the national security and open source communities, too, with WikiLeaks releasing more technical documentation on CIA hacking tools from ‘Vault7’ The latest leak has provided details on a toolset called ‘Brutal Kangaroo’, designed to spread through infected USBs and, potentially, infiltrate air-gapped computers.

Michael Chi is the CSC intern at ASPI. Image courtesy of Pixabay user geralt.

Article printed from The Strategist: https://www.aspistrategist.org.au

URL to article: https://www.aspistrategist.org.au/cyber-wrap-170/

[1] last Friday: https://www.thetimes.co.uk/article/parliament-cyber-attack-blackmail-danger-after-foreign-state-hacks-mps-tjdlprpn8

[2] rudimentary: https://www.newscientist.com/article/2138672-cyberattack-on-uk-parliament-exploited-weak-email-passwords/?utm_campaign=RSS%7CNSNS&utm_source=NSNS&utm_medium=RSS&campaign_id=RSS%7CNSNS-

[3] 90 email accounts: https://www.theguardian.com/politics/2017/jun/24/cyber-attack-parliament-email-access

[4] details posted for sale: http://www.skynews.com.au/news/top-stories/2017/06/25/hackers-launch-attack-on-british-parliament.html

[5] posing a risk of blackmail: http://www.telegraph.co.uk/news/2017/06/24/parliament-hit-sustained-determined-cyber-attack/

[6] penetrate other vital systems: http://www.datacenterknowledge.com/archives/2017/06/26/u-k-parliament-maintains-restrictions-email-hack/

[7] Conservative Party MP Henry Smith: https://twitter.com/HenrySmithUK/status/878625951025950721

[8] criticised the Parliament’s information security practice: https://www.scmagazineuk.com/updated-uk-parliament-records-unauthorised-attempts-to-access-mp-accounts/article/670991/

[9] accepting the use of weak passwords: https://www.theregister.co.uk/2017/06/26/uk_parliamentary_email_compromised_after_sustained_and_determined_cyber_attack/

[10] basic and decades-old mitigation: http://www.itproportal.com/news/uk-parliament-email-hack-the-industry-reaction/

[11] 10-hour delay before: http://www.dailymail.co.uk/news/article-4635642/Parliament-hit-sustained-cyber-attack.html

[12] issued a joint media release: https://www.attorneygeneral.gov.au/Mediareleases/Pages/2017/SecondQuarter/Tackling-Encryption-and-Border-Security-key-Priorities-at-Five-Eyes-Meeting-in-Ottawah.aspx

[13] Five-Eyes meeting in Ottawa: http://globalnews.ca/news/3526274/five-eyes-intelligence-alliance/

[14] 40% of CT-related commutation intercepts: http://www.theage.com.au/federal-politics/political-news/how-the-turnbull-government-plans-to-access-encrypted-messages-20170609-gwoge0.html

[15] threatening to block encrypted messaging app Telegram: https://www.reuters.com/article/us-russia-telegram-security-idUSKBN19H16R

[16] companies are in an ‘untenable’ position: https://www.cyberscoop.com/google-governments-update-international-data-laws/

[17] supporting blog post: https://blog.google/topics/public-policy/digital-security-and-due-process-new-legal-framework-cloud-era/

[18] clarify data sovereignty: https://www.congress.gov/bill/114th-congress/senate-bill/2986

[19] also announced that Gmail: https://blog.google/products/gmail/g-suite-gains-traction-in-the-enterprise-g-suites-gmail-and-consumer-gmail-to-more-closely-align/

[20] three-part series: http://www.natlawreview.com/article/three-weeks-what-we-know-about-enforcement-china-s-cybersecurity-law-part-1

[21] recently introduced new laws: http://www.zdnet.com/article/police-get-broad-phone-and-computer-hacking-powers-in-germany/

[22] see messages at the source: http://www.dw.com/en/new-surveillance-law-german-police-allowed-to-hack-smartphones/a-39372085

[23] into legal challenges: http://www.ovg.nrw.de/behoerde/presse/pressemitteilungen/36_170622/index.php

[24] pending legislation: http://www.parl.ca/DocumentViewer/en/42-1/bill/C-59/first-reading

[25] legally empowered: https://www.cse-cst.gc.ca/en/cse-act-loi-cst/cyberop

[26] upgraded oversight: https://www.cse-cst.gc.ca/en/cse-act-loi-cst/accountability-responsabilite

[27] carry out: https://news.vice.com/story/cse-is-getting-a-major-upgrade

[28] expand its mandate: https://luxexumbra.blogspot.com.au/2017/06/cse-to-get-foreign-cyber-operations.html

[29] Canada: http://www.pm.gc.ca/eng/news/2017/06/22/joint-communique-2nd-canada-china-high-level-national-security-and-rule-law-dialogue

[30] China: http://ca.china-embassy.org/eng/zjwl/t1397281.htm

[31] stop using cyber-attacks: https://www.infosecurity-magazine.com/news/china-canada-cyber-espionage/

[32] host a seminar next week: http://www.pattayamail.com/thailandnews/thailand-hold-seminar-cyber-security-asean-178802

[33] funding a project to stand up: http://www.biztechafrica.com/article/israeli-firm-cygov-selected-establish-zambian-nati/12590/

[34] providing advice and expertise: https://www.lusakatimes.com/2017/06/26/israeli-firm-cygov-selected-establish-national-cybersecurity-agency/

[35] striking a Honda factory: https://arstechnica.com/security/2017/06/5-weeks-after-wcry-outbreak-nsa-derived-worm-shuts-down-a-honda-factory/

[36] also affected traffic cameras in Victoria: https://omny.fm/shows/mornings-with-neil-mitchell/exclusive-dozens-of-speed-and-red-light-cameras-in

[37] Initial statements from the Victorian government: http://www.3aw.com.au/podcast/exclusive-dozens-of-traffic-cameras-infected-with-virus/

[38] later: https://www.theregister.co.uk/2017/06/25/contractors_duck_and_cover_after_speed_cams_infected_over_usb/

[39] reversed: http://www.camerassavelives.vic.gov.au/utility/latest+news/investigation+underway+into+cameras+affected+by+software+virus

[40] quarantine: http://www.sbs.com.au/news/article/2017/06/25/red-light-speeding-fines-suspended-after-computer-virus-hits-victorias-traffic

[41] GitHub to launch a page: https://nationalsecurityagency.github.io/

[42] details of 32 different projects: http://thehackernews.com/2017/06/nsa-github-projects.html

[43] announced a Kaggle competition: https://www.kaggle.com/c/passenger-screening-algorithm-challenge

[44] develops an algorithm for body scanners: http://www.zdnet.com/article/google-run-contest-will-pay-out-1-5m-for-ai-that-spots-weapons-at-airports/#ftag=RSSbaffb68

[45] releasing more technical documentation: https://wikileaks.org/vault7/#Brutal Kangaroo

[46] Vault7: https://wikileaks.org/vault7/

[47] toolset called ‘Brutal Kangaroo’: https://qz.com/1013361/wikileaks-the-cia-can-remotely-hack-into-computers-that-arent-even-connected-to-the-internet/