Geopolitical Impact on Cyber Threats from Nation-State Actors
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Identifying Threats Associated with Man-In-The-Middle Attacks During Communication Between a Mobile Device and the Back End Server in Mobile Banking Applications
IOSR Journal of Computer Engineering (IOSR-JCE) e-ISSN: 2278-0661, p- ISSN: 2278-8727Volume 16, Issue 2, Ver. IX (Mar-Apr. 2014), PP 35-42 www.iosrjournals.org Identifying Threats Associated With Man-In-The-Middle Attacks during Communication between a Mobile Device and the Back End Server in Mobile Banking Applications Anthony Luvanda1,*Dr Stephen Kimani1 Dr Micheal Kimwele1 1. School of Computing and Information Technology, Jomo Kenyatta University of Agriculture and Technology, PO Box 62000-00200 Nairobi Kenya Abstract: Mobile banking, sometimes referred to as M-Banking, Mbanking or SMS Banking, is a term used for performing balance checks, account transactions, payments, credit applications and other banking transactions through a mobile device such as a mobile phone or Personal Digital Assistant (PDA). Mobile banking has until recently most often been performed via SMS or the Mobile Web. Apple's initial success with iPhone and the rapid growth of phones based on Google's Android (operating system) have led to increasing use of special client programs, called apps, downloaded to the mobile device hence increasing the number of banking applications that can be made available on mobile phones . This in turn has increased the popularity of mobile device use in regards to personal banking activities. Due to the characteristics of wireless medium, limited protection of the nodes, nature of connectivity and lack of centralized managing point, wireless networks tend to be highly vulnerable and more often than not they become subjects of attack. This paper proposes to identify potential threats associated with communication between a mobile device and the back end server in mobile banking applications. -
Attribution and Response to Cybercrime/Terrorism/Warfare Susan W
Journal of Criminal Law and Criminology Volume 97 Article 2 Issue 2 Winter Winter 2007 At Light Speed: Attribution and Response to Cybercrime/Terrorism/Warfare Susan W. Brenner Follow this and additional works at: https://scholarlycommons.law.northwestern.edu/jclc Part of the Criminal Law Commons, Criminology Commons, and the Criminology and Criminal Justice Commons Recommended Citation Susan W. Brenner, At Light Speed: Attribution and Response to Cybercrime/Terrorism/Warfare, 97 J. Crim. L. & Criminology 379 (2006-2007) This Symposium is brought to you for free and open access by Northwestern University School of Law Scholarly Commons. It has been accepted for inclusion in Journal of Criminal Law and Criminology by an authorized editor of Northwestern University School of Law Scholarly Commons. 0091-4169/07/9702-0379 THE JOURNALOF CRIMINAL LAW & CRIMINOLOGY Vol. 97. No. 2 Copyright 0 2007 by NorthwesternUniversity. Schoolof Low Printedin U.S.A. "AT LIGHT SPEED": ATTRIBUTION AND RESPONSE TO CYBERCRIME/TERRORISM/WARFARE SUSAN W. BRENNER* This Article explains why and how computer technology complicates the related processes of identifying internal (crime and terrorism) and external (war) threats to social order of respondingto those threats. First, it divides the process-attribution-intotwo categories: what-attribution (what kind of attack is this?) and who-attribution (who is responsiblefor this attack?). Then, it analyzes, in detail, how and why our adversaries' use of computer technology blurs the distinctions between what is now cybercrime, cyberterrorism, and cyberwarfare. The Article goes on to analyze how and why computer technology and the blurring of these distinctions erode our ability to mount an effective response to threats of either type. -
Advanced Persistent Threats
THREAT RESEARCH Defending Against Advanced Persistent Threats Introduction As the name “Advanced” suggests, APT (advanced persistent threat) is one of the most sophisticated and organized forms of network attacks that keep cybersecurity professionals up at night. Unlike many hit & run traditional cyberattacks, an APT is carried out over a prolonged period of time by skilled threat actors who strategize multi-staged campaigns against their targets, employing clandestine tools & techniques such as Remote Administration Tools (RAT), Toolkits, Backdoor Trojans, Social Engineering, DNS Tunneling etc. These experienced cybercriminals are mostly backed & well-funded by nation states and corporation-backed organizations to specifi cally target high value organizations with the following objectives in mind: a Theft of Intellectual Property & classifi ed data i.e. Cyber Espionage a Access to critical & sensitive communications a Access to credentials of critical systems a Sabotage or exfi ltration of databases a Theft of Personal Identifi able Information (PII) a Access to critical infrastructure to perform internal reconnaissance To achieve the above goals, APT Groups use novel techniques to obfuscate their actions and easily bypass traditional security barriers that are not advancing at the same rate as the sophisticated attack patterns of cybercriminals. To understand the evolved behavioral pattern of APT Groups in the year 2020, a review of their latest activities revealed interesting developments and a few groundbreaking events¹: a Southeast Asia -
SARS-Cov-2 Vaccine Breakthrough Surveillance and Case Information Resource Washington State Department of Health September 22, 2021
SARS-CoV-2 Vaccine Breakthrough Surveillance and Case Information Resource Washington State Department of Health September 22, 2021 1 Page Break To request this document in another format, call 1-800-525-0127. Deaf or hard of hearing customers, please call 711 (Washington Relay) or email [email protected]. Publication Number 420-339 For more information or additional copies of this report: Disease Control and Health Statistics Public Health Outbreak Coordination, Information, and Surveillance 1610 NE 150th Street, MS: K17-9 Shoreline, WA 98155 Phone: 206-418-5700 (24-hour contact for local health jurisdictions only) Email: [email protected] 2 Page break SARS-CoV-2 Vaccine Breakthrough Surveillance and Case Information Resource Washington State Department of Health September 22, 2021 COVID-19 vaccines are effective and critical tools to aid in the control of this pandemic. Large- scale clinical studies found that COVID-19 vaccines prevented most people from getting COVID- 19 illness, but like most other vaccines, they are not 100 percent effective. This means some fully vaccinated people will still get infected with SARS-CoV-2. These individuals may or may not develop COVID-19 symptoms. Vaccine breakthrough occurs when someone gets infected with an organism they are fully vaccinated against. For the COVID-19 vaccine, this means someone tests positive for SARS-CoV- 2 two weeks or more after receiving the full series of an authorized COVID-19 vaccine. Since millions of people in the United States are getting vaccinated, we expect to see some breakthrough disease. Fortunately, there is evidence from research studies that the COVID-19 vaccine reduces the risk of people getting really sick and needing to go to the hospital or dying from COVID-19. -
North Korean Cyber Capabilities: in Brief
North Korean Cyber Capabilities: In Brief Emma Chanlett-Avery Specialist in Asian Affairs Liana W. Rosen Specialist in International Crime and Narcotics John W. Rollins Specialist in Terrorism and National Security Catherine A. Theohary Specialist in National Security Policy, Cyber and Information Operations August 3, 2017 Congressional Research Service 7-5700 www.crs.gov R44912 North Korean Cyber Capabilities: In Brief Overview As North Korea has accelerated its missile and nuclear programs in spite of international sanctions, Congress and the Trump Administration have elevated North Korea to a top U.S. foreign policy priority. Legislation such as the North Korea Sanctions and Policy Enhancement Act of 2016 (P.L. 114-122) and international sanctions imposed by the United Nations Security Council have focused on North Korea’s WMD and ballistic missile programs and human rights abuses. According to some experts, another threat is emerging from North Korea: an ambitious and well-resourced cyber program. North Korea’s cyberattacks have the potential not only to disrupt international commerce, but to direct resources to its clandestine weapons and delivery system programs, potentially enhancing its ability to evade international sanctions. As Congress addresses the multitude of threats emanating from North Korea, it may need to consider responses to the cyber aspect of North Korea’s repertoire. This would likely involve multiple committees, some of which operate in a classified setting. This report will provide a brief summary of what unclassified open-source reporting has revealed about the secretive program, introduce four case studies in which North Korean operators are suspected of having perpetrated malicious operations, and provide an overview of the international finance messaging service that these hackers may be exploiting. -
In Defense of Cyberterrorism: an Argument for Anticipating Cyber-Attacks
IN DEFENSE OF CYBERTERRORISM: AN ARGUMENT FOR ANTICIPATING CYBER-ATTACKS Susan W. Brenner Marc D. Goodman The September 11, 2001, terrorist attacks on the United States brought the notion of terrorism as a clear and present danger into the consciousness of the American people. In order to predict what might follow these shocking attacks, it is necessary to examine the ideologies and motives of their perpetrators, and the methodologies that terrorists utilize. The focus of this article is on how Al-Qa'ida and other Islamic fundamentalist groups can use cyberspace and technology to continue to wage war againstthe United States, its allies and its foreign interests. Contending that cyberspace will become an increasingly essential terrorist tool, the author examines four key issues surrounding cyberterrorism. The first is a survey of conventional methods of "physical" terrorism, and their inherent shortcomings. Next, a discussion of cyberspace reveals its potential advantages as a secure, borderless, anonymous, and structured delivery method for terrorism. Third, the author offers several cyberterrorism scenarios. Relating several examples of both actual and potential syntactic and semantic attacks, instigated individually or in combination, the author conveys their damagingpolitical and economic impact. Finally, the author addresses the inevitable inquiry into why cyberspace has not been used to its full potential by would-be terrorists. Separately considering foreign and domestic terrorists, it becomes evident that the aims of terrorists must shift from the gross infliction of panic, death and destruction to the crippling of key information systems before cyberattacks will take precedence over physical attacks. However, given that terrorist groups such as Al Qa'ida are highly intelligent, well-funded, and globally coordinated, the possibility of attacks via cyberspace should make America increasingly vigilant. -
2015 Threat Report Provides a Comprehensive Overview of the Cyber Threat Landscape Facing Both Companies and Individuals
THREAT REPORT 2015 AT A GLANCE 2015 HIGHLIGHTS A few of the major events in 2015 concerning security issues. 08 07/15: Hacking Team 07/15: Bugs prompt 02/15: Europol joint breached, data Ford, Range Rover, 08/15: Google patches op takes down Ramnit released online Prius, Chrysler recalls Android Stagefright botnet flaw 09/15: XcodeGhost 07/15: Android 07/15: FBI Darkode tainted apps prompts Stagefright flaw 08/15: Amazon, ENFORCEMENT bazaar shutdown ATTACKS AppStore cleanup VULNERABILITY reported SECURITYPRODUCT Chrome drop Flash ads TOP MALWARE BREACHING THE MEET THE DUKES FAMILIES WALLED GARDEN The Dukes are a well- 12 18 resourced, highly 20 Njw0rm was the most In late 2015, the Apple App prominent new malware family in 2015. Store saw a string of incidents where dedicated and organized developers had used compromised tools cyberespionage group believed to be to unwittingly create apps with malicious working for the Russian Federation since behavior. The apps were able to bypass at least 2008 to collect intelligence in Njw0rm Apple’s review procedures to gain entry support of foreign and security policy decision-making. Angler into the store, and from there into an ordinary user’s iOS device. Gamarue THE CHAIN OF THE CHAIN OF Dorkbot COMPROMISE COMPROMISE: 23 The Stages 28 The Chain of Compromise Nuclear is a user-centric model that illustrates Kilim how cyber attacks combine different Ippedo techniques and resources to compromise Dridex devices and networks. It is defined by 4 main phases: Inception, Intrusion, WormLink Infection, and Invasion. INCEPTION Redirectors wreak havoc on US, Europe (p.28) INTRUSION AnglerEK dominates Flash (p.29) INFECTION The rise of rypto-ransomware (p.31) THREATS BY REGION Europe was particularly affected by the Angler exploit kit. -
Annotated Bibliography Digital Transnational Repression
Annotated Bibliography Digital Transnational Repression By Noura Al-Jizawi, Siena Anstis, Sophie Barnett, Sharly Chan, Adam Sen, and Ronald J. Deibert Last Updated: May 2021 Copyright Copyright © 2021 Citizen Lab, “Digital transnational Repression,” by Noura Al-Jizawi, Siena Anstis, Sharly Chan, Adam Sen, and Ronald J. Deibert. Licensed under the Creative Commons BY-SA 4.0 (Attribution-ShareAlike Licence) Electronic version first published in 2020 by the Citizen Lab. Citizen Lab engages in research that investigates the intersection of digital technologies, law, and human rights. Document Version: 2.0 New changes in this annual update include: ● Change of terminology from “transnational digital repression” to “digital transnational repression” to align with the discourse ● New summaries collected between October 2020 - May 2021 and added to the document The Creative Commons Attribution-ShareAlike 4.0 license under which this report is licensed lets you freely copy, distribute, remix, transform, and build on it, as long as you: ● give appropriate credit; ● indicate whether you made changes; and ● use and link to the same CC BY-SA 4.0 licence. However, any rights in excerpts reproduced in this report remain with their respective authors; and any rights in brand and product names and associated logos remain with their respective owners. Uses of these that are protected by copyright or trademark rights require the rightsholder’s prior written agreement. 2 Acknowledgements The design of this document is by Mari Zhou. About the Citizen Lab, Munk School of Global Aairs & Public Policy, University of Toronto The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs & Public Policy, University of Toronto, focusing on research, development, and high-level strategic policy and legal engagement at the intersection of information and communication technologies, human rights, and global security. -
Government Hacking What Is It and When Should It Be Used?
Government Hacking What is it and when should it be used? Encryption is a critical component of our day-to-day lives. For much of the world, basic aspects of life rely on encryption to function. Power systems, transport, financial markets, and baby monitors1 are more trustworthy because of encryption. Encryption protects our most vulnerable data from criminals and terrorists, but it can also hide criminal content from governments. Government hacking is one of the approaches national security and law enforcement agencies use to obtain access to otherwise encrypted information (e.g. the FBI hired a hacking company to unlock the iPhone at the center of the San Bernardino case2). It complements their other efforts to obtain exceptional access3 by asking or requiring tech companies to have the technical ability to decrypt users’ content when it is needed for law enforcement purposes. The Internet Society believes strong encryption is vital to the health of the Internet and is deeply concerned about any policy or action that might put that in jeopardy — regardless of its motivation. Government hacking poses a risk of collateral damage to both the Internet and its users, and as such should only ever be considered as a tool of last resort. Government hacking defined We define ‘government hacking’ as government entities (e.g. national security or law enforcement agencies or private actors on their behalf) exploiting vulnerabilities in systems, software, or hardware to gain access to information that is otherwise encrypted, or inaccessible. Dangers of government hacking Exploiting vulnerabilities of any kind, whether for law enforcement purposes, security testing, or any other purpose, should not be taken lightly. -
TCAS II) by Personnel Involved in the Implementation and Operation of TCAS II
Preface This booklet provides the background for a better understanding of the Traffic Alert and Collision Avoidance System (TCAS II) by personnel involved in the implementation and operation of TCAS II. This booklet is an update of the TCAS II Version 7.0 manual published in 2000 by the Federal Aviation Administration (FAA). It describes changes to the CAS logic introduced by Version 7.1 and updates the information on requirements for use of TCAS II and operational experience. Version 7.1 logic changes will improve TCAS Resolution Advisory (RA) sense reversal logic in vertical chase situations. In addition all “Adjust Vertical Speed, Adjust” RAs are converted to “Level-Off, Level-Off” RAs to make it more clear that a reduction in vertical rate is required. The Minimum Operational Performance Standards (MOPS) for TCAS II Version 7.1 were approved in June 2008 and Version 7.1 units are expected to be operating by 2010-2011. Version 6.04a and 7.0 units are also expected to continue operating for the foreseeable future where authorized. 2 Preface................................................................................................................................. 2 The TCAS Solution............................................................................................................. 5 Early Collision Avoidance Systems................................................................................ 5 TCAS II Development .................................................................................................... 6 Initial -
PARK JIN HYOK, Also Known As ("Aka") "Jin Hyok Park," Aka "Pak Jin Hek," Case Fl·J 18 - 1 4 79
AO 91 (Rev. 11/11) Criminal Complaint UNITED STATES DISTRICT COURT for the RLED Central District of California CLERK U.S. DIS RICT United States ofAmerica JUN - 8 ?018 [ --- .. ~- ·~".... ~-~,..,. v. CENT\:y'\ l i\:,: ffl1G1 OF__ CAUFORN! BY .·-. ....-~- - ____D=E--..... PARK JIN HYOK, also known as ("aka") "Jin Hyok Park," aka "Pak Jin Hek," Case fl·J 18 - 1 4 79 Defendant. CRIMINAL COMPLAINT I, the complainant in this case, state that the following is true to the best ofmy knowledge and belief. Beginning no later than September 2, 2014 and continuing through at least August 3, 2017, in the county ofLos Angeles in the Central District of California, the defendant violated: Code Section Offense Description 18 U.S.C. § 371 Conspiracy 18 u.s.c. § 1349 Conspiracy to Commit Wire Fraud This criminal complaint is based on these facts: Please see attached affidavit. IBJ Continued on the attached sheet. Isl Complainant's signature Nathan P. Shields, Special Agent, FBI Printed name and title Sworn to before ~e and signed in my presence. Date: ROZELLA A OLIVER Judge's signature City and state: Los Angeles, California Hon. Rozella A. Oliver, U.S. Magistrate Judge Printed name and title -:"'~~ ,4G'L--- A-SA AUSAs: Stephanie S. Christensen, x3756; Anthony J. Lewis, x1786; & Anil J. Antony, x6579 REC: Detention Contents I. INTRODUCTION .....................................................................................1 II. PURPOSE OF AFFIDAVIT ......................................................................1 III. SUMMARY................................................................................................3 -
How Sophisticated Are Terrorist Attacks on Passenger Rail Transportation
How Sophisticated are Terrorist Attacks on Passenger Rail Project SP 0520 Transportation June 2020 Brian Michael Jenkins and Bruce R. Butterworth Executive Summary Summary of Key Findings Terrorist attacks on passenger rail transportation are statistically rare events in the developed world— only about seven attacks per year are carried out against all of the economically advanced countries combined. However, uncovered plots and attempts indicate continuing terrorist interest in attacking transportation targets. The vast majority of terrorist attacks on passenger rail transportation are aimed at disrupting travel or causing casualties. Most of the attacks (87%) and 100% of the casualties result from attacks on passengers aboard trains and in stations, i.e., where the people are. We have defined sophistication by identifying four criteria, of which at least one must be met: The attack must (1) involve the recruitment of inside assistance, the use of insider knowledge, or the acquisition of specialized skills through training; (2) require the penetration of manned or closely monitored security systems; (3) involve the use of sophisticated weapons, devices, or means (for an IED to be considered sophisticated, it must do more than simply explode—it must have a timing or remote detonating system that guarantees detonation at a remote time or in a specific location, or it must be miniaturized or disguised so as to evade detection); and (4) must be complex—it must involve multiple actors with individual roles or coordinated simultaneous or near-simultaneous attacks at different locations. Using those criteria, we find few of the terrorist attacks on public surface transport are sophisticated.