Cyber attacks/defence/incdents (merged)

[57Chevy]

'Stuxnet virus set back Iran’s nuclear program by 2 years'
article link
Top German computer consultant tells 'Post' virus was as effective as military strike, a huge success; expert speculates IDF creator of virus.

The Stuxnet virus, which has attacked Iran’s nuclear facilities and which Israel is suspected of creating, has set back the Islamic Republic’s nuclear program by two years, a top German computer consultant who was one of the first experts to analyze the program’s code told The Jerusalem Post on Tuesday.

“It will take two years for Iran to get back on track,” Langer said in a telephone interview from his office in Hamburg, Germany. “This was nearly as effective as a military strike, but even better since there are no fatalities and no full-blown war. From a military perspective, this was a huge success.”

article continues....
                        (Reproduced under the Fair Dealings provisions of the Copyright Act)

to add related thread:
U.S. sees "huge" cyber threat in the future

 

[57Chevy]

Iran's nuclear ambition is dented:

Iran no longer has the capability to create a nuclear weapon on its own, Israel's deputy prime minister, said Wednesday.

The assessment would seem to make military action less likely in the near future and suggests the program has been seriously damaged by sabotage, sanctions or both.

It lends weight to the theory that a highly sophisticated computer worm, called Stuxnet, was inserted last year into Iran's uranium enrichment program and forced the replacement of 1,000 uranium enrichment centrifuges by making them spin too fast and, therefore, break.

Previously, reports had suggested the regime may have been able to build a bomb in about a year.

Moshe Yaalon said Western pressure would force Iran to consider whether its nuclear program was worth pursuing. "I believe that this effort will grow, and will include areas beyond sanctions, to convince the Iranian regime that, effectively, it must choose between continuing to seek nuclear capability and surviving," he told Israeli radio.

"I don't know if it will happen in 2011 or in 2012, but we are talking in terms of the next three years."

Analysts say Stuxnet was so complex it was probably written by a "state actor" rather than an amateur hacker.

article limk

                        (Reproduced under the Fair Dealings provisions of the Copyright Act)

 

[57Chevy]

Canada ill-prepared for attacks on critical energy infrastructure: Study
article link

OTTAWA — Nearly a decade after the 9/11 attacks, Canada still hasn't developed a reliable strategy for protecting such critical energy infrastructure as refineries, power plants and offshore petroleum platforms, according to a new study commissioned by the Defence Department.

Inaction by the federal government has left key energy assets vulnerable to a range of threats, from terrorism and natural disasters to the emerging danger of a cyberattack, says the study quietly released last month but now reported for the first time by Postmedia News.

An attack that disrupts or damages energy infrastructure would not only have major social and economic impacts, but could also stoke "cross-border tensions" with the United States, which looks to Canada as a dependable supplier within increasingly integrated North American energy markets.

"The protection and resilience of critical infrastructure have often been described as major priorities for the government, yet the reality appears rather different from the rhetoric," writes Angela Gendron, a senior fellow at the Canadian Centre of Intelligence and Security Studies at Carleton University in Ottawa. Her study was commissioned by Defence R&D Canada, the research arm of the Department of National Defence.

Canada urgently needs to develop a national plan — and ideally appoint a central body to enforce it — to replace the patchwork of rules and safeguards currently being implemented by provinces and private industry, Gendron warns.

One of the diplomatic cables recently released by WikiLeaks contains a list compiled by the U.S. State Department of infrastructure around the world that Washington considers critical to American security, economic and public-health interests. Canadian sites include the James Bay hydroelectric power project in Quebec, the Seven-Mile dam in British Columbia, AECL's medical isotope-producing nuclear reactor in Chalk River, Ont., and the network of natural-gas pipelines operated by TransCanada Gas of Calgary.

However, Canada has yet to publicly identify the exact sites it considers critical to the nation's interests.

In the wake of the Sept. 11, 2001 attacks, the federal government created the department of Public Safety and Emergency Preparedness to oversee Canada's national-security efforts.

A Public Safety spokesman noted that the department released a national critical-infrastructure strategy in May that paves the way for the federal government and the provinces to develop and test plans for protecting key sectors. The department has made significant progress in implementing the strategy, such as through the publication of a "risk-management guide" for critical sectors, the spokesman said in an emailed statement.

But Gendron says the strategy is too "reactive" and relies too much on the voluntary participation of the private sector, which has been reluctant to share data with the government.

Energy assets in Canada tend to be concentrated in certain regions of the country and, increasingly, integrated with U.S. distribution networks. While that has worked to Canada's economic advantage, it has also made such assets "high-value" targets for an attack and heightened the potential impact of a natural disaster such as an earthquake.

The domino effect of a major network failure can be crippling, a reality that hit home in the summer of 2003, when problems at a power utility in Ohio left about 50 million people in Ontario and eight U.S. states in the dark. The blackout cost about $6 billion in economic losses.

Gendron notes that al-Qaida has called on its recruits to strike any petroleum interests that supply the U.S. as part of an "economic jihad" against the Americans.

"As both a target in its own right and as a means of striking at American oil dependency, which al-Qaida has identified as America's greatest strategic vulnerability, Canada is susceptible to a major attack," writes Gendron, who says such an attack should be considered a "low probability/high impact" risk.

If terrorists strike, it might not be a direct "physical" attack.

"Much of Canada's critical energy infrastructure and processes are today managed remotely from central control rooms which use computers and communications networks to control the flow of energy supplies (gas, oil, electricity) through pipelines or grids," says Gendron.

That makes modern energy networks vulnerable to cyberattacks that can be even more difficult to deter than conventional threats, according to Gendron.

"Sophisticated state-led cyber espionage or warfare is a serious issue but easier to deter when the adversary is a state with an easily identifiable government and location than when cyberattacks are carried out by surrogates, criminals, terrorists and hackers who cannot readily be traced."

                                (Reproduced under the Fair Dealings provisions of the Copyright Act)

 

[57Chevy]

good deduction Watson  ;D
______________________________
Western power created virus to sabotage Iran's nuclear plans
The Stuxnet computer virus, which was created to sabotage Iran's nuclear program, was built jointly by at least one Western power and the Israeli secret service, a British security expert claims.

Tom Parker, a U.S.-based security researcher who specialized in tracing cyber attacks, spent months analyzing the Stuxnet code and found evidence that the virus was created by two separate organizations. His evidence supported the claims of intelligence sources that it was a joint, two-step operation.

"It was most likely developed by a Western power, and they most likely provided it to a secondary power, which completed the effort," he said.

The malicious software, which was first detected in June last year, was almost certainly designed to make damaging, surreptitious adjustments to the centrifuges used at Natanz, Iran's uranium enrichment site. While Mahmoud Ahmadinejad, Iran's president, played down its impact, he confirmed that the country's nuclear ambitions had suffered setbacks.

Separate investigations by U.S. experts discovered that Stuxnet worked by increasing the speed of uranium centrifuges to breaking point for short periods. At the same time the virus shut off safety monitoring systems, deceiving operators into thinking that all was normal.

Mr Parker said this part of the attack must have been conceived by "some very talented individuals", and the other by a less talented, or more rushed, group of developers.

The element written by the first group, which was activated after Stuxnet reached its target and was known as the "payload", was complex, well designed and effective, according to Mr Parker's analysis. He believed that this was evidence of the involvement of a major Western power or powers because they had both the expertise and access to the nuclear equipment necessary to test the virus.

In contrast, the way Stuxnet was distributed and its "command and control" features, which allowed it to be remotely altered, included many errors and were poorly protected from surveillance.

"It's a bit like spending billions on a space shuttle and then launching it using the remote control from a pounds 15 toy car," said Mr Parker.

His criticisms of Stuxnet's distribution mechanism were supported by other experts, including Nate Lawson, a computer encryption consultant. "Either the authors did not care if the payload was discovered by the public, they weren't aware of these techniques or they had other limitations, such as time," he said.

Ensuring the virus reached Natanz would have required secret co-operation inside the Iranian nuclear program, a field of state espionage in which Israel's Mossad agency was acknowledged as unrivalled.

— Iran was under pressure on Friday to hold a bilateral meeting with the United States on the first day of talks in Istanbul between the six world powers over its disputed nuclear program, a Western official said.


                              (Reproduced under the Fair Dealings provisions of the Copyright Act)

 

[57Chevy]

poorly protected from surveillance.

Of course....it had to be discovered

this part of the attack must have been conceived by "some very talented individuals", and the other by a less talented, or more rushed, group of developers.

The possible intended discovery after the attack makes both parties more talented than you may think

 

[Edward Campbell]

It's a bit odd, but my guess is that the "first part," the "payload" which was described as being "complex, well designed and effective [and showed the designers had] both the expertise and access to the nuclear equipment necessary to test the virus" was, likely made in Israel. The placing and execution processes, which "included many errors and were poorly protected from surveillance" smacks of the CIA.

 

[Cloud Cover]

It's a bit odd, but my guess is that the "first part," the "payload" which was described as being "complex, well designed and effective [and showed the designers had] both the expertise and access to the nuclear equipment necessary to test the virus" was, likely made in Israel. The placing and execution processes, which "included many errors and were poorly protected from surveillance" smacks of the CIA.

Placing= installation subroutines which seems to mean they buried it into some other application that was known as a certainty to be installed or more likely an update to existing software.
Poorly protected from surveillance- the encryption was probably somehow compromised, perhaps even the key was in the open or the implementation algorithim was dated.
It is likely they they used a telecommunications spyware company to send the payload, similar to what SS8 and the government of the United Arab Emirates tried to do 2 years  ago to encrypted BlackBerry smartphones. [In the case of SS8, while it worked, the spyware rapidly and simultaneously drained the batteries of tens of thousands of BlackBerry's, thus alerting the users to the fact their devices were constantly forwarding data off the device.]   

 

[SeaKingTacco]

A while back I had read (can't remember where) an article where it was speculated that stuxnet was introduced to the area of Iran where the enrichment plant is located, embedded in another piece of common software.  Since Iran maintains an air gap around the computers controlling the centrifuge's (that is to say- totally unconnected to the internet or any other network), the perpetrators simply waited for the natural to happen- someone carried it into work on a stick and infected the control system by accident.

An interesting theory, but it sure leaves a lot to chance.

 

[Cloud Cover]

someone carried it into work on a stick and infected the control system by accident.

We've been given free 8GB media cards, USB sticks, wireless mouses, usb reading lights, usb powered personal fans etc by media companies, journalists, law firms, vendors, telecom companies, recruiters and headhunters etc. We generally regift these in places like India and Saudi Arabia    

I was once given a coffee mug which in the bottom held a retractable USB cord to plug in to a computer to keep coffee warm [a java java so to speak.]    When our hardware guy took the mug apart it had not one but 2 microphones, a memory card containing key logging software, and some other malware.  We put it back together, ran it through the dishwasher and sent it back to the TRA a Star of David sticker decal inside it.   

 

[OldSolduer]

This sounds like Tom Clancy stuff....wow...intriguing....

I'm infantry so anything shiny intrigues me.

 

[57Chevy]

We've been given free 8GB media cards, USB sticks, wireless mouses, usb reading lights, usb powered personal fans etc

Photo:
How the stuxnet virus spread

                              (Reproduced under the Fair Dealings provisions of the Copyright Act)


spelling

 

[57Chevy]

U.N: Iran nuke plant recovered from attack
The Iranian nuclear plant at Natanz recovered quickly from a computer attack that led to major equipment breakdown, the U.N. nuclear watchdog says.

The Washington Post said Wednesday it has obtained a draft copy of a report by the International Atomic Energy Agency in Vienna. The report is expected to say production at the Natanz enrichment plant is now above what it was before the attack.

The plant was attacked by a computer worm, Stuxnet, that appears to have been designed to spread harmlessly from computer to computer until it reached machines configured like those at Natanz. IAEA cameras installed at the plant show that about 10 percent of the centrifuges had to be replaced.

"While it has delayed the Iranian centrifuge program at the Natanz plant in 2010 and contributed to slowing its expansion, it did not stop it or even delay the continued buildup of low-enriched uranium," the Institute for Science and International Security said in the report.
                                                    __________________________
More detailed article:
Iran Nuclear Facility Recovers From Cyberattack
                                  (Reproduced under the Fair Dealings provisions of the Copyright Act)

Photo:
The Siemens Simatic S7-300 PLC CPU a target of the virus

 

[a_majoor]

While we have been hearing warnings about possible terrorist or other threat attacks against our infrastructure, this is taking cyberwar to a much higher level. Rather than attacking infrastructure through delivering malware (much like SUXNET was used to temporarily cripple Iranian nuclear ambitions, and how "smart grids" and the Internet of Things" is potentially very vulnerable to hacking), this article suggests the very infrastructure of the Internet itself could be targeted for attack. Workarounds if the Internet is crippled could be difficult to impossible depending on the system:

https://www.schneier.com/blog/archives/2016/09/someone_is_lear.html

Someone Is Learning How to Take Down the Internet

Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses.

First, a little background. If you want to take a network off the Internet, the easiest way to do it is with a distributed denial-of-service attack (DDoS). Like the name says, this is an attack designed to prevent legitimate users from getting to the site. There are subtleties, but basically it means blasting so much data at the site that it's overwhelmed. These attacks are not new: hackers do this to sites they don't like, and criminals have done it as a method of extortion. There is an entire industry, with an arsenal of technologies, devoted to DDoS defense. But largely it's a matter of bandwidth. If the attacker has a bigger fire hose of data than the defender has, the attacker wins.

Recently, some of the major companies that provide the basic infrastructure that makes the Internet work have seen an increase in DDoS attacks against them. Moreover, they have seen a certain profile of attacks. These attacks are significantly larger than the ones they're used to seeing. They last longer. They're more sophisticated. And they look like probing. One week, the attack would start at a particular level of attack and slowly ramp up before stopping. The next week, it would start at that higher point and continue. And so on, along those lines, as if the attacker were looking for the exact point of failure.

The attacks are also configured in such a way as to see what the company's total defenses are. There are many different ways to launch a DDoS attack. The more attack vectors you employ simultaneously, the more different defenses the defender has to counter with. These companies are seeing more attacks using three or four different vectors. This means that the companies have to use everything they've got to defend themselves. They can't hold anything back. They're forced to demonstrate their defense capabilities for the attacker.

I am unable to give details, because these companies spoke with me under condition of anonymity. But this all is consistent with what Verisign is reporting. Verisign is the registrar for many popular top-level Internet domains, like .com and .net. If it goes down, there's a global blackout of all websites and e-mail addresses in the most common top-level domains. Every quarter, Verisign publishes a DDoS trends report. While its publication doesn't have the level of detail I heard from the companies I spoke with, the trends are the same: "in Q2 2016, attacks continued to become more frequent, persistent, and complex."

There's more. One company told me about a variety of probing attacks in addition to the DDoS attacks: testing the ability to manipulate Internet addresses and routes, seeing how long it takes the defenders to respond, and so on. Someone is extensively testing the core defensive capabilities of the companies that provide critical Internet services.

Who would do this? It doesn't seem like something an activist, criminal, or researcher would do. Profiling core infrastructure is common practice in espionage and intelligence gathering. It's not normal for companies to do that. Furthermore, the size and scale of these probes -- and especially their persistence -- points to state actors. It feels like a nation's military cybercommand trying to calibrate its weaponry in the case of cyberwar. It reminds me of the US's Cold War program of flying high-altitude planes over the Soviet Union to force their air-defense systems to turn on, to map their capabilities.

What can we do about this? Nothing, really. We don't know where the attacks come from. The data I see suggests China, an assessment shared by the people I spoke with. On the other hand, it's possible to disguise the country of origin for these sorts of attacks. The NSA, which has more surveillance in the Internet backbone than everyone else combined, probably has a better idea, but unless the US decides to make an international incident over this, we won't see any attribution.

But this is happening. And people should know.

This essay previously appeared on Lawfare.com.

EDITED TO ADD: Slashdot thread.

EDITED TO ADD (9/15): Podcast with me on the topic.

 

[MilEME09]

It's just like the internet has two planes of existance, the main stream internet as we know it, and then there is the deep, and dark web. There is much online we don't know about, and much to fear about whos lurking in the dark parts of the internet

 

[a_majoor]

The massive cyber attack that took down large internet sites on 21 Oct 2016 could well have been a bonnet attack from unsecured devices on the "Internet of Things". The question is still "who" is behind this?

http://www.popularmechanics.com/technology/infrastructure/a23504/mirai-botnet-internet-of-things-ddos-attack/

Hackers Wrecked the Internet Using DVRs and Webcams
Hackers Took Down A Huge Chunk Of The Internet This Morning
By Eric Limer
Oct 21, 2016

The internet has been on shaky footing for the better part of Friday thanks to a large-scale attack on a company that runs a large portion of crucial internet infrastructure. It's still too early to know exactly who is behind the attack, but experts have begun to pin down which devices are doing the bulk of the work. It's not computers, but devices from the so-called Internet of Things. We're talking smart fridges, web cams, and DVRs. It may sound funny, being attacked by refrigerators, but don't laugh. It's actually horrifying.

The current assault against Dyn is one of the simplest in a hacker's playbook. The distributed denial of service attack (DDoS) doesn't require breaking into a target's computers or finding any secret weakness. Instead, it involves simply pummeling them with so much traffic they can't possibly keep up. Hackers executing a DDoS call upon millions of machines under their control and command them to ask the target for so many things all at once that the target all but melts down under the strain.

If you visualize it, it looks a little like this:

Executing a DDoS is simple, but only if you have millions of computers at your disposals. These computers—often known as "zombies"—are machines that have been compromised by some sort of virus or malware. This malware doesn't totally disable the computer, but just sits there waiting for the order to attack a target, as part of a swarm called a botnet.

Building a botnet can be a painstaking process. There are plenty of vulnerable computers in the world, but also plenty of people who take reasonably good care of their trusty phone or laptop, protecting it from infection. However, over the past five years or so, the Internet of Things has introduced millions upon millions of newly internet-connected devices—like DVRs and cameras and smart fridges and thermostats—that hackers can add to their swarms with terrifying ease.

The potential problem has been bubbling up for months, but reached a peak earlier this month when the source code for something called the "Mirai" botnet was released onto the web. Designed to target the Internet of Things specifically, Mirai can scoop up connected devices and add them to a botnet simply by attempting to log into them with their factory-default username and password. Have you changed the password on your smart fridge lately? I thought not.

HAVE YOU CHANGED THE PASSWORD ON YOUR SMART FRIDGE LATELY? I THOUGHT NOT.

The Mirai code focuses on all kinds of smart devices including cameras to internet-connected fridges, but its bread and butter is DVRs. Of the nearly 500,000 devices known to be compromised by the Mirai malware, some 80 percent of them are DVRs, according to an in-depth investigation of by Level 3 communications.

These infected DVRs, along with a few thousand other gadgets, can drive ludicrous amounts of traffic. Devices compromised by this malware were responsible for a 620Gbps attack against the security website Krebs on Security in September, the biggest DDoS the world had ever seen, at the time. Reports from the security firm Flashpoint, by way of Brian Krebs, suggest that it is a botnet based on exactly this technology that is responsible for today's outages, and Dyn has since confirmed this suspicion to TechCrunch.

Last month, security researcher Bruce Schneier started sounding the alarm that someone or something was carefully probing the internet for weakness. A scary prospect on its own, and one followed shortly thereafter by the full release of the Mirai code for any ne'er-do-well to use. Today's attack, it would seem, is a confluence of these two events: An attacker who has been carefully surveying the internet for weak points is now openly wielding one of the most capable blunt weapons we've ever seen blast the web.

The most terrifying part: This is probably only the beginning.

edit to add:

http://gizmodo.com/todays-brutal-ddos-attack-is-the-beginning-of-a-bleak-f-1788071976

Today's Brutal DDoS Attack Is the Beginning of a Bleak Future
William Turton

This morning a ton of websites and services, including Spotify and Twitter, were unreachable because of a distributed denial of service (DDoS) attack on Dyn, a major DNS provider. Details of how the attack happened remain vague, but one thing seems certain. Our internet is frightfully fragile in the face of increasingly sophisticated hacks.

Some think the attack was a political conspiracy, like an attempt to take down the internet so that people wouldn’t be able to read the leaked Clinton emails on Wikileaks. Others think it’s the usual Russian assault. No matter who did it, we should expect incidents like this to get worse in the future. While DDoS attacks used to be a pretty weak threat, we’re entering a new era.

DDoS attacks, at the most basic level, work like this. An attacker sends a flurry of packets, essentially just garbage data, to an intended recipient. In this case, the recipient was Dyn’s DNS servers. The server is overwhelmed with the garbage packets, and can’t handle the incoming connections, eventually slowing down significantly or totally shutting down. In the case of Dyn, it was probably a little more complex than this. Dyn almost certainly has advanced systems for DDoS mitigation, and the people who attacked Dyn (whoever they are) were probably using something more advanced than a PC in their mom’s basement.

Recently, we’ve entered into a new DDoS paradigm. As security blogger Brian Krebs notes, the newfound ability to highjack insecure internet of things devices and turn them into a massive DDoS army has contributed to an uptick in the size and scale of recent DDoS attacks. (We’re not sure if an IoT botnet was what took down Dyn this morning, but it would be a pretty good guess.)

We are nevertheless getting a taste of what the new era of DDoS attacks look like, however. As security expert Bruce Schneier explained in a blog post:

Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don’t know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses.

This sort of attack is deeply different than the headline-grabbing DDoS attacks of years past. In 2011, hacker collective Anonymous rose to fame with DDoS attacks that pale in comparison to today’s attack on Dyn. Instead of taking out an individual website for short periods of time, hackers were able to take down a major piece of the internet backbone for an entire morning—not once but twice. That’s huge.

If hackers are more easily able to amass extensive DDoS botnets, that means the internet as we know it becomes more vulnerable. Attacking major internet infrastructure like Dyn has always been a possibility, but if it becomes easier than ever to launch huge DDoS attacks, that means we might be seeing some of our favorite sites have more downtime than usual. These attacks could extend to other major pieces of internet infrastructure, causing even more widespread outages.

This could be the beginning of a very bleak future. If hackers are able to take down the internet at will, what happens next? It’s unclear how long it could take for the folks at Dyn to fix this problem, or if they will ever be able to solve the problem of being hit with a huge DDoS attack. But this new breed of DDoS attacks is a scary problem no matter how you look at it.

 

[The Bread Guy]

Here we go again ...

• "Global ransomware attack causes chaos" (BBC)
• "Another Massive Ransomware Outbreak Is Going Global Fast" (Forbes)
• "New Cyberattack Spreads From Russia to the United States" (NY Times)
• "Massive cyber attack spreads across the globe" (FOX Business)
• "Here’s a list of companies attacked by ransomware Petya" (AFP)
• "Cyberattacks do not disrupt operation of Russian banks — regulator" (TASS)
• "Kremlin says its computers not affected by hacker attack" (TASS)
• More via Google News

 

[The Bread Guy]

Statement by CSE on latest attacks ...

CSE continues to closely monitor the recent global cyber/ransomware attacks. As we have seen in recent attacks, today’s attacks continue to indiscriminately target both organizations and individuals.

Our dynamic cyber defence security systems remain ready to defend Government of Canada systems and help protect against future types of similar attacks.

Working with Shared Services Canada and our other partners, Government of Canada networks continue to be well placed to defend against these types of attacks. Thanks to this work, there is no indication at this time that Government of Canada systems were negatively impacted, and that any information, personal or otherwise, was compromised.

As the situation continues to develop, we remain in close contact with our domestic and international partners ‎to address any developments. In addition, we will ensure all relevant information and guidance that is available to CSE is provided to our partners at Public Safety Canada to relay to the private sector.

As always, CSE would like to use this occasion to remind all Canadians as well as organizations to review and implement our Top 10 IT security actions which will go a long way to protect you or your organization from similar attacks in the future. In addition, please check out this month’s addition of CSE’s Cyber Journal to learn more about ransomware.

Thank you.

Greta Bossenmaier
Chief, Communications Security Establishment

 

[The Bread Guy]

A possible NATO Article 5?  This from the SecGen at a NATO news conference yesterday ...

... The cyber attacks we saw in May but also, we have seen this week just underlines the importance of strengthening our cyber defenses, and that’s exactly what NATO is doing. We are implementing our cyber defense pledge which is ensuring that we are strengthening the cyber defenses of both NATO networks but also helping NATO allies to strengthen their cyber defenses. We exercise more, we share best practices and technology and we also work more and more closely with all allies looking into how we can integrate their capabilities, strengthening NATO’s capability to defend our networks. We have also decided that a cyber attack can trigger Article 5 and we have also decided and we are in the process of establishing cyber as a military domain meaning that we will have land, air, sea and cyber as military domains. All of this highlights the advantage of being an alliance of 29 allies because we can work together, strengthen each other and and learn from each other ...

 

[The Bread Guy]

"Mass GPS Spoofing Attack in Black Sea?" ...

An apparent mass and blatant, GPS spoofing attack involving over 20 vessels in the Black Sea last month has navigation experts and maritime executives scratching their heads.

The event first came to public notice via a relatively innocuous safety alert* from the U.S. Maritime Administration:

A maritime incident has been reported in the Black Sea in the vicinity of position 44-15.7N, 037-32.9E on June 22, 2017 at 0710 GMT. This incident has not been confirmed. The nature of the incident is reported as GPS interference. Exercise caution when transiting this area.

But the backstory is way more interesting and disturbing. On June 22 a vessel reported to the U.S. Coast Guard Navigation Center:

GPS equipment unable to obtain GPS signal intermittently since nearing coast of Novorossiysk, Russia. Now displays HDOP 0.8 accuracy within 100m, but given location is actually 25 nautical miles off; GPS display…

After confirming that there were no anomalies with GPS signals, space weather or tests on-going, the Coast Guard advised the master that GPS accuracy in his area should be three meters and advised him to check his software updates.

The master replied:

Thank you for your below answer, nevertheless I confirm my GPS equipment is fine.

We run self test few times and all is working good.

I confirm all ships in the area (more than 20 ships) have the same problem.

I personally contacted three of them via VHF, they confirmed the same.

Sometimes, position is correct, sometimes is not.

GPS sometimes looses position or displays inaccurate position (high HDOP).

For few days, GPS gave a position inland (near Gelendyhik aiport) but vessel was actually drifting more than 25 NM from it.

Important: at that time, GPS system considered the position as "Safe within 100m".

See attached.

Then last night, position was correct despite several "lost GPS fixing position" alarm that raised couples seconds only; then signal was back to normal.

Now position is totally wrong again.

See attached pictures that I took on 24 June at 05h45 UTC (30 min ago).

Note: you can also check websites like MarineTraffic and you will probably notice that once in a while all ships in the area are shifting inland next to each other.

I hope this can help.

To back up his report, the master sent photos of his navigation displays, a paper chart showing his actual position and GPS-reported position, and his radar display that showed numerous AIS contacts without corresponding radar returns ...

* - Alert attached.

 

[a_majoor]

Doing it the old fashioned way: getting Kompromat on key people to gain access and physically stealing the devices for downloading. Given the connections that Debbie Wasserman-Schultz had too the various unsavoury goings on during the Democrat primaries, outside of access to secret and sensitive materials, it isn't difficult to speculate the case officer (wherever he is) has all kinds of dirt on a lot of the Washington political establishment. No wonder the media seems determined to avoid this story at all costs:

http://www.nationalreview.com/article/449983/debbie-wasserman-schultz-pakistani-computer-guys-bank-fraud

Debbie Wasserman Schultz and the Pakistani IT Scammers
by ANDREW C. MCCARTHY July 29, 2017 4:00 AM

There’s more than bank fraud going on here. In Washington, it’s never about what they tell you it’s about. So take this to the bank: The case of Imran Awan, Debbie Wasserman Schultz’s mysterious Pakistani IT guy, is not about bank fraud.

Yet bank fraud was the stated charge on which Awan was arrested at Dulles Airport this week, just as he was trying to flee the United States for Pakistan, via Qatar. That is the same route taken by Awan’s wife, Hina Alvi, in March, when she suddenly fled the country, with three young daughters she yanked out of school, mega-luggage, and $12,400 in cash.

By then, the proceeds of the fraudulent $165,000 loan they’d gotten from the Congressional Federal Credit Union had been sent ahead. It was part of a $283,000 transfer that Awan managed to wire from Capitol Hill. He pulled it off — hilariously, if infuriatingly — by pretending to be his wife in a phone call with the credit union. Told that his proffered reason for the transfer (“funeral arrangements”) wouldn’t fly, “Mrs.” Awan promptly repurposed: Now “she” was “buying property.” Asking no more questions, the credit union wired the money . . . to Pakistan.

As you let all that sink in, consider this: Awan and his family cabal of fraudsters had access for years to the e-mails and other electronic files of members of the House’s Intelligence and Foreign Affairs Committees. It turns out they were accessing members’ computers without their knowledge, transferring files to remote servers, and stealing computer equipment — including hard drives that Awan & Co. smashed to bits of bytes before making tracks.

They were fired in February. All except Awan, that is. He continued in the employ of Wasserman Schultz, the Florida Democrat, former DNC chairwoman, and Clinton crony. She kept him in place at the United States Congress right up until he was nabbed at the airport on Monday.

This is not about bank fraud. The Awan family swindles are plentiful, but they are just window-dressing. This appears to be a real conspiracy, aimed at undermining American national security. At the time of his arrest, the 37-year-old Imran Awan had been working for Democrats as an information technologist for 13 years. He started out with Representative Gregory Meeks (D., N.Y.) in 2004. The next year, he landed on the staff of Wasserman Schultz, who had just been elected to the House. Congressional-staff salaries are modest, in the $40,000 range. For some reason, Awan was paid about four times as much. He also managed to get his wife, Alvi, on the House payroll . . . then his brother, Abid Awan . . . then Abid’s wife, Natalia Sova. The youngest of the clan, Awan’s brother Jamal, came on board in 2014 — the then-20-year-old commanding an annual salary of $160,000.

A few of these arrangements appear to have been sinecures: While some Awans were rarely seen around the office, we now know they were engaged in extensive financial shenanigans away from the Capitol. Nevertheless, the Daily Caller’s Luke Rosiak, who has been all over this story, reports that, for their IT “work,” the Pakistani family has reeled in $4 million from U.S. taxpayers since 2009. That’s just the “legit” dough. The family business evidently dabbles in procurement fraud, too. The Capitol Police and FBI are exploring widespread double-billing for computers, other communication devices, and related equipment.

Why were they paid so much for doing so little? Intriguing as it is, that’s a side issue. A more pressing question is: Why were they given access to highly sensitive government information? Ordinarily, that requires a security clearance, awarded only after a background check that peruses ties to foreign countries, associations with unsavory characters, and vulnerability to blackmail. These characters could not possibly have qualified. Never mind access; it’s hard to fathom how they retained their jobs. The Daily Caller has also discovered that the family, which controlled several properties, was involved in various suspicious mortgage transfers. Abid Awan, while working “full-time” in Congress, ran a curious auto-retail business called “Cars International A” (yes, CIA), through which he was accused of stealing money and merchandise. In 2012, he discharged debts in bankruptcy (while scheming to keep his real-estate holdings). Congressional Democrats hired Abid despite his drunk-driving conviction a month before he started at the House, and they retained him despite his public-drunkenness arrest a month after. Beyond that, he and Imran both committed sundry vehicular offenses. In civil lawsuits, they are accused of life-insurance fraud.

Congressional Democrats hired Abid despite his drunk-driving conviction a month before he started at the House, and they retained him despite his public-drunkenness arrest a month after. Democrats now say that any access to sensitive information was “unauthorized.” But how hard could it have been to get “unauthorized” access when House Intelligence Committee Dems wanted their staffers to have unbounded access? In 2016, they wrote a letter to an appropriations subcommittee seeking funding so their staffers could obtain “Top Secret — Sensitive Compartmented Information” clearances. TS/SCI is the highest-level security classification.

Awan family members were working for a number of the letter’s signatories. Democratic members, of course, would not make such a request without coordination with leadership. Did I mention that the ranking member on the appropriations subcommittee to whom the letter was addressed was Debbie Wasserman Schultz?

Why has the investigation taken so long? Why so little enforcement action until this week? Why, most of all, were Wasserman Schultz and her fellow Democrats so indulgent of the Awans?

The probe began in late 2016. In short order, the Awans clearly knew they were hot numbers. They started arranging the fraudulent credit-union loan in December, and the $283,000 wire transfer occurred on January 18. In early February, House security services informed representatives that the Awans were suspects in a criminal investigation. At some point, investigators found stolen equipment stashed in the Rayburn House Office Building, including a laptop that appears to belong to Wasserman Schultz and that Imran was using. Although the Awans were banned from the Capitol computer network, not only did Wasserman Schultz keep Imran on staff for several additional months, but Meeks retained Alvi until February 28 — five days before she skedaddled to Lahore.

Strange thing about that: On March 5, the FBI (along with the Capitol Police) got to Dulles Airport in time to stop Alvi before she embarked. It was discovered that she was carrying $12,400 in cash. As I pointed out this week, it is a felony to export more than $10,000 in currency from the U.S. without filing a currency transportation report. It seems certain that Alvi did not file one: In connection with her husband’s arrest this week, the FBI submitted to the court a complaint affidavit that describes Alvi’s flight but makes no mention of a currency transportation report. Yet far from making an arrest, agents permitted her to board the plane and leave the country, notwithstanding their stated belief that she has no intention of returning.

Many congressional staffers are convinced that they’d long ago have been in handcuffs if they pulled what the Awans are suspected of. Nevertheless, no arrests were made when the scandal became public in February. For months, Imran has been strolling around the Capitol. In the interim, Wasserman Schultz has been battling investigators: demanding the return of her laptop, invoking a constitutional privilege (under the speech-and-debate clause) to impede agents from searching it, and threatening the Capitol Police with “consequences” if they don’t relent. Only last week, according to Fox News, did she finally signal willingness to drop objections to a scan of the laptop by federal investigators.

Her stridency in obstructing the investigation has been jarring. As evidence has mounted, the scores of Democrats for whom the Awans worked have expressed no alarm. Instead, we’ve heard slanderous suspicions that the investigation is a product of — all together now — “Islamophobia.” But Samina Gilani, the Awan brothers’ stepmother, begs to differ. Gilani complained to Virginia police that the Awans secretly bugged her home and then used the recordings to blackmail her. She averred in court documents that she was pressured to surrender cash she had stored in Pakistan. Imran claimed to be “very powerful” — so powerful he could order her family members kidnapped.

We don’t know if these allegations are true, but they are disturbing. The Awans have had the opportunity to acquire communications and other information that could prove embarrassing, or worse, especially for the pols who hired them. Did the swindling staffers compromise members of Congress? Does blackmail explain why were they able to go unscathed for so long? And as for that sensitive information, did the Awans send American secrets, along with those hundreds of thousands of American dollars, to Pakistan? This is no run-of-the-mill bank-fraud case.