A quick survey of some recent cyber news . . .
***
Mark Clayton wrote a very interesting piece for The Christian Science Monitor on how experts have ID’d two gangs as those behind most of that pervasive Chinese cyberexploitation. Experts have named one gang “Elderwood” and named the other gang the “Comment Crew.” According to the CSM article, Elderwood was behind Operation Aurora (that infamous hack of Google) and employs “hundreds of people” which are working “from 9 to 5 Beijing time each day” to steal American IP. The article went into greater depth regarding the gangs’ methods and targets.
The article had an interesting quote on attribution from Dmitri Alperovitch, CTO for CrowdStrike:
We’re tracking over a dozen nation-state groups right now that are affiliated with China . . . We have a deep understanding of them and attribution down to the individual level. They’re operating in China, and we’re watching them. Even though they’re unlikely be brought to justice in the US, we understand a lot today.
***
Sens. McCain, Hutchinson, and Chambliss wrote an op-ed for the Wall Street Journal on why a cyber EO would be a bad idea.
Unfortunately, the article is behind a pay wall, so you can get a better snippet in this Lawfare blog post written by Paul Rosenzweig.
Along the same lines, Mr. Rosenzweig wrote for The Heritage Foundation on why “Congress Should Not Enable Executive Orders on Cybersecurity.” What should Congress do?
Congress should:
- Remove unneeded cybersecurity funding in the continuing resolution or specify its uses,
- Reject a regulatory approach to cybersecurity, and
- Consider information sharing.
***
John Reed reported for Foreign Policy on how Gen. Martin Dempsey, Chairman of the Joint Chiefs of Staff, visited with Mark Zuckerberg and other Silicon Valley execs. Gen. Dempsey apparently discussed “the role of venture capital in creating innovation, the pressing need for better cyber security, the cyber security legislation . . . and new approaches to securing computers and networks from malware.”
***
Reuters had an article on how foreign journalists in China are being targeted by malware attacks. According to the article, reporters are getting what appears to be phising e-mails containing malware which would “sen[d] encrypted information from the user’s computer to an external server.” The Chinese Foreign Ministry responded with this:
China is also a victim of Internet attacks. The source of these Internet attacks is very difficult to determine. Reaching conclusions without sufficient evidence or fair and thorough investigations, it’s just not serious.
These blanket denials, in the face of overwhelming evidence to the contrary, are just not serious.
***
While we’re talking China, Angela Moscaritolo wrote for PCMag on how researchers are finding brand new computers preloaded with malware in China. According to the article, cybercriminals managed to infiltrate the supply chain and “introduce[] counterfeit versions of Microsoft Windows embedded with malware on the new PCs . . ..” The malware allowed for remote access to the computer’s microphones and webcams.
***
Interesting Reuters article written by Noel Randewich. Randewich writes that Intel is looking to replace passwords with “a biometric sensor that recognizes the unique patterns of veins on a person’s palm.” While that may not sound much different than a laptop’s fingerprint reader, this new technology smacks of NSTIC. Specifically, the technology would be able to “securely communicate that person’s identity to banks, social networks and other services where the person has accounts,” obviating the need for passwords.
***
Brendan Sasso for The Hill on how Twitter has handed over a user’s tweets to the police . . .
Leave a Reply