5/27/2020 - Russia Hitting Critical Infrastructure Again, Another Possible Coronavirus Vaccine, and Facebook Let The Country Tear Itself Apart

Yahoo - Facebook reportedly had evidence that its algorithms were dividing people, but top executives killed or weakened proposed solutions -

One 2016 report found that "64% of all extremist group joins are due to our recommendation tools," with most people joining at the suggestion of Facebook's "Groups You Should Join" and "Discover" algorithms. "Our recommendation systems grow the problem," the researchers said, according to The Journal.

The Journal reported that Facebook teams pitched multiple fixes, including limiting the spread of information from groups' most hyperactive and hyperpartisan users, suggesting a wider variety of groups than users might normally encounter, and creating subgroups for heated debates to prevent them from derailing entire groups.

 Naked Security - Internet giants unite to stop warrantless snooping on web histories -

This week, the US House of Representatives is expected to consider the act that reauthorizes that warrantless data collection: the USA Freedom Reauthorization Act. The House already passed the reauthorization act, sent it to the Senate, and will this week consider the Senate’s tweaks before sending it to President Trump for his signature.

On Friday, leading up to the House’s vote later this week, a group of seven internet companies and organizations suggested that legislators just might want to rethink the legislation’s disregard for Americans’ privacy.

 Security Boulevard - DoJ Continues to Target China’s Thousand Talents Program in U.S. -

The U.S. Department of Justice (DoJ) continues to use every arrow in its prosecutorial quiver to go after those participants who are exposing and sharing U.S. research and technologies to China via the People’s Republic of China’s (PRC) Thousand Talents Program.

The Thousand Talents Program, also referred to as the Thousand Talents Plan, was created to identify and recruit leading experts around the globe to bring their knowledge back to China. While the program primarily targets ethnic Chinese, it has also recruited a small number of non-Chinese individuals.

The U.S. Senate in its November 2019 report, “Threats to the U.S. Research Enterprise: China’s Talent Recruitment Plans,” characterized the Chinese program as part of the country’s “strategic plan to acquire knowledge and intellectual property from researchers, scientists, and the U.S. private sector.”

CSO Magazine -  5 examples of security theater and how to spot them -

Bruce Schneier, the well-known security expert, coined the term "security theater".  His inspiration? The US Transportation Security Administration (TSA). Wasting billions of dollars a year on pointless and invasive airport screening post-9/11 satisfied our emotional need to do something but did not, and does not, make us any safer.

Likewise, cargo cult security is more common in cybersecurity than you might think. The Polynesian cargo cults were newly discovered South Pacific tribes who were so awed by airplanes, and the Western food that arrived in said aircraft, that they built life-sized model airplanes out of sticks, thinking doing so would bring more food. Are you so much smarter? Maybe not. Today technology is so advanced that we are all cargo cultists in one way or another. Going through the motions without understanding the "why" creeps quickly into cargo cult territory.

Finding and eliminating security theater and cargo cult security in your organization can be the difference between preventing a business-destroying data breach and staying afloat until the pandemic is over.

 CNN - Trump threatens to crack down on social media platforms after Twitter labels his tweets -

President Donald Trump on Wednesday threatened to "strongly regulate" or even shut down social media platforms after Twitter applied a fact-check to two of his tweets this week.

Trump did not elaborate on what actions he could take. But the threat is Trump's clearest expression of intent to use the power of government to target his perceived political enemies in the private sector -- businesses that already enjoy wide latitude under the law to moderate their platforms as they see fit. And it raises the stakes for Twitter and Facebook as they grapple with Trump's misleading claims about mail-in voting and his baseless insinuations that a cable TV news host had a hand in an aide's death decades ago.

Fox - Coronavirus vaccine developed in China shows promise after early study in 100 people -

The vaccine, called Ad5-nCoV, is being developed by the Chinese company CanSino Biologics, and was one of the first coronavirus vaccines to enter early human trials back in March. Now, there are more than 100 different coronavirus vaccines in development worldwide, with at least eight of those in the process of human trials.

Ad5-nCoV uses a weakened version of a common cold virus (known as an adenovirus) — which infects human cells but doesn't cause disease — to deliver a fragment of genetic material from SARS-CoV-2, the virus that causes COVID-19. This genetic material provides instructions for making the "spike protein" on the surface of SARS-CoV-2. The idea is that a person's immune system will create antibodies against the spike protein, which will help fight off the coronavirus if the person is later exposed to it.

ZDNet - New fuzzing tool finds 26 USB bugs in Linux, Windows, macOS, and FreeBSD -

Academics say they discovered 26 new vulnerabilities in the USB driver stack employed by operating systems such as Linux, macOs, Windows, and FreeBSD.

...

 Researchers found one bug in FreeBSD, three in MacOS (two resulting in an unplanned reboot and one freezing the system), and four in Windows 8 and Windows 10 (resulting in Blue Screens of Death).

However, the vast majority of bugs, and the most severe, were found in Linux -- 18 in total.

Tech Dirt - How A Feud Among Wolf-Kink Erotica FanFic Authors Demonstrates What The Copyright Office Got Wrong In Its DMCA Report -

I'm not even sure where to start with this one.  Go read the article, and marvel at the fact that there is Wolf-Kink Eritica.

Cyberscoop - German intelligence agencies warn of Russian hacking threats to critical infrastructure -

A Kremlin-linked hacking group has continued its long-running efforts to target German companies in the energy, water and power sectors, according to a confidential German government advisory obtained by CyberScoop.

...

Berserk Bear is best known in the U.S. for a years-long campaign to collect data on U.S. energy companies, which the Trump administration blamed on the Russian government in 2018. It is one of a handful of hacking teams that Moscow can call on to spy on industrial computer networks, analysts say. Another group — known as Sandworm and believed to be operating on behalf of Russia’s GRU military intelligence agency — gained notoriety for cutting off power in Ukraine in 2015 and 2016.

 

What I'm Reading 5/26/2020 - SCADA Vulnerabilities Again

ZDNet - It's time to spin AWS out of Amazon: They regulate utilities, don't they? -

Now, I'd be surprised if AWS hasn't offered all kinds of promises and assurances that such critical competitive data isn't available to the rest of Amazon. But if centuries of corporate misbehavior have taught us anything, it is that companies are quite willing to lie for their own benefit, especially when the bottom line is threatened. Maybe not today, but when times get tough.

There's another competitive issue: Amazon runs on AWS, so it gains a competitive advantage not only from its own scale, but from the scale of AWS too. If you want to compete with Amazon, your webservice also has to compete with AWS. That isn't fair.

Finally, AWS has much higher profitability than Amazon's retail business. Why shouldn't Amazon's retail business have to compete without what is, in effect, the subsidy it gets from AWS income?

 NPR - Stockholm Won't Reach Herd Immunity In May, Sweden's Chief Epidemiologist Says -

Sweden's controversial approach to fighting the coronavirus pandemic has so far failed to produce the expected results, and there are calls within the country for the government to change its strategy.

...

Unfortunately, Sweden's capital will not reach this milestone in May.

"No that will not happen," Tegnell said on Monday in an email to NPR. "Current investigations show different numbers, but [Stockholm's immunity rate] is likely lower [than 30%]. As you might be aware, there is a problem with measuring immunity for this virus."

BBC - Huawei: What would happen if the UK ditched the Chinese firm? -

The consequences could affect how quickly improved internet access is rolled out and how much it will cost. This a time when the country's economy is already in a precarious state because of the coronavirus pandemic.

...

"Removing Huawei would seriously delay 5G, costing the British economy up to £7bn," he added, citing a study published last year by Mobile UK, a trade group that represents UK network operators.

...

A study commissioned by Huawei last year claimed locking it out would increase a country's 5G investment costs by between 8% and 29% due to reduced competition.

Security Week - Vulnerabilities Found in Emerson SCADA Product Made for Oil and Gas Industry -

A researcher from Kaspersky has identified several vulnerabilities in Emerson OpenEnterprise, a supervisory control and data acquisition (SCADA) solution designed for the oil and gas industry.

Roman Lozko, a researcher at Kaspersky’s ICS CERT unit, discovered four vulnerabilities in Emerson OpenEnterprise. The security flaws were reported to the vendor in December 2019 and patches were released a few months later.

Security Boulevard -  IEC 61850 Meets IEC 62351: Securing GOOSE Power Grid Weaknesses  -

IEC 61850, the international standard for digital substation architecture, tooling standardization, and protocols at electrical substations, is a big win for standardization and ICS security. It has been adopted worldwide, enabling utilities and operators to efficiently commission, interoperate and maintain new equipment.

However, one of its communication protocols, GOOSE, although effective, has displayed several security issues. While many researchers around the world have put forward proposals to address the problem, IEC has already defined a standard way to tackle such defects. 

...

IEC 62351-6 outlines a way to secure IEC 61850 protocols and GOOSE messages by adding a security extension section to the frames.

ZDNet - Turla hacker group steals antivirus logs to see if its malware was detected -

The January 2020 attacks, however, stood out due to the deployment of an updated version of the ComRAT malware, which ESET says contained some pretty clever new features.

...

The latest version, known as ComRAT v4, was first seen in 2017, however, in a report published today, ESET says they've spotted a variation of ComRAT v4 that includes two new features, such as the ability to exfiltrate antivirus logs and the ability to control the malware using a Gmail inbox.

The Verge - YouTube is deleting comments with two phrases that insult China’s Communist Party -

YouTube is automatically deleting comments that contain certain Chinese-language phrases related to criticism of the country’s ruling Communist Party (CCP).

Comments left under videos or in live streams that contain the words “共匪” (“communist bandit”) or “五毛” (“50-cent party”) are automatically deleted in around 15 seconds, though their English language translations and Romanized Pinyin equivalents are not.

 

 

What I'm Reading / Watching 5/25/2020 - Memorial Day Tributes and An Attempt to Reform H-1B Visas Again

Memorial Day today.  Traditionally the start of summer and celebrated for that but also a day to honor the courage of  those who have sacrificed for America.  In light of that I am going to start with the changing of the guard at the Tomb of the Unknowns.

and to understand the courage they are honoring, this is the footage of MSgt John A. Chapman in the battle which cost him his life and earned him the Medal of Honor.  (Warning: May be disturbing)

I know I don't normally do Memorial Day and Veteran's Day stuff, mainly because it seems inadequate, but this year,I felt the need.

Now on to the other stuff

CSO - 4 ways edge computing changes your threat model -

Multiple factors drive the edge-computing phenomenon. The biggest, according to analysts, are network latency, bandwidth costs and performance. The increasing number of devices that organizations connect to the internet is driving the need for near instantaneous data transfers to and from those devices. Modern applications and services—in everything from autonomous vehicles, healthcare devices and operational technology (OT) environments—cannot afford the latencies involved in sending and receiving data between end devices and a data center somewhere in the cloud.

HelpNet Security - Reality bites: Data privacy edition -

May 25th is the second anniversary of the General Data Protection Regulation (GDPR) and data around compliance with the regulation shows a significant disconnect between perception and reality.

Only 28% of firms comply with GDPR; however, before GDPR kicked off, 78% of companies felt they would be ready to fulfill data requirements. While their confidence was high, when push comes to shove, complying with GDPR and GDPR-like laws – like CCPA and PDPA – are not as easy as initially thought.

ZDNet - Chrome: 70% of all security bugs are memory safety issues -

Roughly 70% of all serious security bugs in the Chrome codebase are memory management and safety bugs, Google engineers said this week.

Half of the 70% are use-after-free vulnerabilities, a type of security issue that arises from incorrect management of memory pointers (addresses), leaving doors open for attackers to attack Chrome's inner components.

The percentage was compiled after Google engineers analyzed 912 security bugs fixed in the Chrome stable branch since 2015, bugs that had a "high" or "critical" severity rating.

Twitter - One of the major reasons for voluntary departures at Slack pre-COVID was "request to work remotely was rejected"

Chuck Grassley - Bipartisan Group of Lawmakers Propose Reforms to Skilled Non-Immigrant Visa Programs to Protect American Workers -

The H-1B and L-1 Visa Reform Act will require U.S. Citizenship and Immigration Services to prioritize for the first time the annual allocation of H-1B visas. The new system would ensure that the best and brightest students being educated in the United States receive preference for an H-1B visa, including advanced degree holders, those being paid a high wage, and those with valuable skills.

 

The legislation explicitly prohibits the replacement of American workers by H-1B or L-1 visa holders, clarifying that working conditions of similarly employed American workers may not be adversely affected by the hiring of an H-1B worker, including H-1B workers who have been placed by another employer at the American worker’s worksite. These provisions address the types of abuses that have been well-documented.

 

Importantly, the legislation will crack down on outsourcing companies that import large numbers of H-1B and L-1 workers for temporary training purposes only to send the workers back to their home countries to do the same job. Specifically, the bill would prohibit companies with more than 50 employees, of which at least half are H-1B or L-1 holders, from hiring additional H-1B employees. The bill gives the U.S. Department of Labor enhanced authority to review, investigate, and audit employer compliance with program requirements, as well as to penalize fraudulent or abusive conduct. It requires the production of extensive statistical data about the H-1B and L-1 programs, including wage data, worker education levels, place of employment, and gender. 

 

In addition, the H-1B and L-1 Visa Reform Act encompasses several reforms of the L-1 visa program, including establishment of a wage floor for L-1 workers; authority for the U.S. Department of Homeland Security to investigate, audit, and enforce compliance with L-1 program requirements; assurance that intra-company transfers occur between legitimate branches of a company and don’t involve “shell” facilities; and a change to the definition of “specialized knowledge” to ensure that L-1 visas are reserved only for truly key personnel.

BBC - Fresh UK review into Huawei role in 5G networks -

The UK government is conducting a new review into the impact of allowing Huawei telecoms equipment to be used in British 5G networks.

The National Cyber Security Centre (NCSC) involvement comes after the US brought fresh sanctions against the Chinese company, citing security fears.

In January, the UK resisted US pressure to ban Huawei from contributing to 5G.

A NCSC spokesman said: "The security and resilience of our networks is of paramount importance."

"Following the US announcement of additional sanctions against Huawei, the NCSC is looking carefully at any impact they could have to the UK's networks."

What I'm Reading (or Watching) 5/24/2020 - Basically a bunch of Tanium stuff and a Judd Nelson classic from 1984

Books -

Network Forensics: Tracking Hackers through Cyberspace - 

On the Internet, every action leaves a mark–in routers, firewalls, web proxies, and within network traffic itself. When a hacker breaks into a bank, or an insider smuggles secrets to a competitor, evidence of the crime is always left behind.

 Learn to recognize hackers’ tracks and uncover network-based evidence in Network Forensics: Tracking Hackers through Cyberspace. Carve suspicious email attachments from packet captures. Use flow records to track an intruder as he pivots through the network. Analyze a real-world wireless encryption-cracking attack (and then crack the key yourself). Reconstruct a suspect’s web surfing history–and cached web pages, too–from a web proxy. Uncover DNS-tunneled traffic. Dissect the Operation Aurora exploit, caught on the wire.

 Throughout the text, step-by-step case studies guide you through the analysis of network-based evidence. You can download the evidence files from the authors’ web site (lmgsecurity.com), and follow along to gain hands-on experience.

Yes, this is the same one I was working on before, I stalled out then, but yesterday I picked it up again and cranked out a chapter so I am back in the saddle again.   

Blogs / News - 

Medium - Diagramming a Secure Network - 

Figuring out how to diagram a network for the first time was a bit overwhelming, but what helped was to understand the borders and components of the external (public), demilitarized zone (segmented), and internal (private) areas of the network. Afterwards, I made a list of what I would include in the diagram and carefully sketched out the rough idea.

...

I then asked myself, “how would I secure this network to prevent sensitive information from being stolen?” I reviewed common attacks, threats, and vulnerabilities and came up with scenarios I could attempt to mitigate.

Tech Crunch - China Roundup: A blow to US-Listed Chinese firms and Tik Tok's new global face -

Further decoupling

Over the years, American investors have been pumping billions of dollars into Chinese firms listed in the U.S., from giants like Alibaba and Baidu to emerging players like Pinduoduo and Bilibili. That could change soon with the Holding Foreign Companies Accountable Act, a new bill passed this week with bipartisan support to tighten accounting standards on foreign companies, with the obvious target being China.

“For too long, Chinese companies have disregarded U.S. reporting standards, misleading our investors. Publicly listed companies should all be held to the same standards, and this bill makes commonsense changes to level the playing field and give investors the transparency they need to make informed decisions,” said Senator Chris Van Hollen who introduced the legislation.

 gitconnected - What You Should Know To Troubleshoot AWS Security Groups & Network ACLs -

If you have been working on AWS for some time, either managing infrastructure or creating some fancy serverless applications, you must have run into some sort of networking issue at least once due to the wrong configuration of AWS Security Groups or Network Access Control Lists (ACL).

Let’s see why are they so critical, and why is it important to know how to troubleshoot them if something goes wrong in your AWS network.

The Verge - New jailbreak tool works on Apple’s just-released iOS 13.5 -

A new tool by hacking group Unc0ver can jailbreak iOS 13.5, the just-released version of Apple’s mobile operating system, Wired reported. The group says the jailbreak, which works on iOS 11 and higher, is built on a zero-day vulnerability, doesn’t drain a device’s battery life, and doesn’t affect the use of Apple services or undermine the iOS sandbox security, according to Wired. 

Other -

YouTube - Getting started with Tanium - 

Playlist of videos on Basic Tanium Network Management functions.

This weeks movie - Judd Nelson's greatest role Eddie Keaton in 1984's "Making the Grade"

full movie available on youtube

Books! Books! Books!

I've been kind of a slug with reading this year.  I generally try to go a couple fiction and a couple non-fiction per month but so far I have been dragging, Mainly because I haven't found anything that has really caught my interest.  So far this year I have:

Reread:

Monster Hunter: International

Monster Hunter: Vendetta

Monster Hunter: Legion

Monster Hunter: Nemesis

Monster Hunter: Siege

(I skipped Alpha because earl Harbringer is my least favorite character in the series)

Horrors of the Dancing Gods

Voice of the Whirlwind

Mote in Gods Eye

The Helmsman

Worlds

Starship Troopers

Rogue Code

New Reads:

Antisocial: Online Extremist, Techno Utopians, and the Hijacking of American Conversation

The 2020 Commission Report on the North Korea Nuclear Attacks Against the United States

Hard Magic

Spellbound

Warbound

The Ten Day MBA: A Step By Step Guide to Mastering the Skills Taught in Americas Top Business Schools

Breach:A Cold War Magic Novel 

The Good Shepherd

Kings of the Wyld (Excellent fantasy world premise)

Daemon (Abandoned, it just sucked too hard)

Team of Teams: New Rules of Engagement for a Complex World

War World: Falkenberg's Regiment

The Lost Fleet: Dauntless

The Lost Fleet: Fearless

The Lost Fleet: Courageous

Black Friday (urban fantasy)

Wearing the Cape

The Blade Itself

Before They Are hanged

Last Argument of Kings

Ongoing: (I intend to finish these I just can't keep my mind on them)

Network Forensics

Wired for War

So... the reason for the list - I think you kind of see where my interests currently lay.  If you could suggest something similar to bur not necessarily by the same authors it would be appreciated.

What I'm Reading 5/23/2020

NBC - Experimental coronavirus vaccine reaches advanced trial stages -

It will be tested in 10,260 volunteers across the United Kingdom to determine how effective it is at preventing infection, the university said in a statement. If successful, it could be on the market as early as September, according to British-Swedish drugmaker AstraZeneca, which partnered with the university in April to manufacture and distribute the vaccine.

CNBC - U.S. tech giants are reportedly providing web services to blacklisted Chinese surveillance firms -

A new report claims that Amazon, Microsoft and Google are among a number of American firms that are providing various web services to Chinese surveillance firms accused of human rights abuses and which are now on a U.S. blacklist.

Top10VPN, a site that reviews virtual private network (VPN) services and researches topics on privacy, said in a report that it had identified U.S. technology giants that provide “essential web services that power these companies’ websites.”

 US CERT - CISA, DOE, and UK’s NCSC Issue Guidance on Protecting Industrial Control Systems -

The Cybersecurity and Infrastructure Security Agency (CISA), the Department of Energy (DOE), and the UK's National Cyber Security Centre (NCSC) have released Cybersecurity Best Practices for Industrial Control Systems, an infographic providing recommended cybersecurity practices for industrial control systems (ICS).

 

What I'm Reading 5/21/2020 - Iranian APTs at it Again

Dancho Danchev - Two High-Profile OSINT and Technical Collection Analysis Reports on Iran's Hacking Scene and the Ashiyane Digital Security Team - Available for Free! - 

t's a pleasure and an honor to let you know that I've just made two of my most important and high-profile studies on Iran's Hacking Scene and Iran's Hacking Ecosystem including a high-profile and never-published before SNA (Social Network Analysis) of Iran's Hacking Scene using Maltego publicly accessible with the idea to get more people to read them and actually act upon them potentially assisting the U.S Intelligence Community and U.S Law Enforcement on its way to track down the prosecute the cybercriminals behind these campaigns.

Hacker News -  Iranian APT Group Targets Governments in Kuwait and Saudi Arabia -

Bitdefender said the intelligence-gathering operations were conducted by Chafer APT (also known as APT39 or Remix Kitten), a threat actor known for its attacks on telecommunication and travel industries in the Middle East to collect personal information that serves the country's geopolitical interests.

"Victims of the analyzed campaigns fit into the pattern preferred by this actor, such as air transport and government sectors in the Middle East," the researchers said in a report (PDF) shared with The Hacker News, adding at least one of the attacks went undiscovered for more than a year and a half since 2018.

 Cyberscoop - Japan investigates Mitsubishi Electric breach amid national security concerns -

Data likely stolen in the hack, which Mitsubishi disclosed earlier this year, included specifications of hypersonic missile prototypes that Japan is developing, according to a report in Asahi Shimbun, a Japanese newspaper. The Ministry of Defense had sent the specifications to multiple companies, including Mitsubishi, interested in bidding on the missile contract, the report said.

SC Magazine - Cybersecurity makes World Economic Forum’s top 10 Covid-19 global fallout list -

Nearly 38 percent of those surveyed say changing work patterns will lead to increases in cybersecurity and fraud incidents.

...

Pipikaite added that the corporate digital infrastructure that normally protects most organizations with multiple layers of security has become much tougher to manage while the majority of employees work from home. A blurring of the line separating corporate and personal systems heightens the risk of exposing sensitive information not appropriately secured and monitored on personal devices and home networks. 

 Bank Info Security - Hot Offering on Darknet: Access to Corporate Networks -

Late last year, cybercriminals began to shift their focus from buying access to specific corporate servers, sometimes for as little as $20, to purchasing the ability to gain full network-level access, Positive Technologies says. The number of darknet ads for corporate network climbed to 88 in the first quarter of this year, compared to 50 in the fourth quarter, according to the company's report published Wednesday.

Network-level access is generally priced between $2,500 and $10,000, but the price can go as high as $100,000, the report notes.

 Fifth Domain -, IRS hasn’t implemented more than 100 federal watchdog cybersecurity recommendations -

 The Internal Revenue Service has yet to address more than 100 cybersecurity recommendations made by a federal watchdog, including some that require fixing some basic cybersecurity measures.

According to an audit by the Government Accountability Office released May 13, the IRS hasn’t addressed 114 cybersecurity recommendations from previous audits. In addition, the watchdog made 18 new recommendations, bringing the number of open recommendations to 132.

HelpNet Security -  Only 36% of critical infrastructures have a high level of cyber resilience -

To benchmark the cyber resilience of these critical infrastructures, the researchers assessed a number of criteria. These included their ability to manage a major cyberattack, their ability to mitigate the impact of an attack, whether they had the necessary skills to recover after an incident, as well as their best practices, policies and corporate culture.

Infrastructure providers in the US were the most likely to score highly, with 50 percent of companies considered highly resilient. In Europe, the figure was lower at 36 percent. In Japan, is was just 22 percent.

 LA Times - Coronavirus threatens China’s Belt and Road. What happens when it wants half a trillion dollars back? 

Beijing faces mounting calls to reschedule loans for shipping hubs, electrical plants and transport links that look unsustainable as economies struggle and globalization slows. The projects’ reliance on Chinese workers could also draw greater opposition from local populations worried about fresh waves of coronavirus infections.

No major contracts have been canceled due to the pandemic, and the initiative is too important to Xi to be shelved. But seven years after the Chinese leader unveiled his vision of a modern Silk Road connecting continents, the future of travel and trade is uncertain. Analysts say the most ambitious international building spree since the Marshall Plan could be scaled down and refocused toward safer investments. 

Yahoo - Edward Snowden will not be pardoned in his lifetime, says author of new book on the NSA whistleblower -

The Pulitzer Prize-winning Washington Post reporter who documented the scope of the U.S. government’s surveillance on its own citizens after receiving leaked National Security Agency documents from Edward Snowden told Yahoo News that he believes the former NSA contractor will not be pardoned in his lifetime.

...

“Getting pardoned is going to be a very, very big lift for any president,” Gellman told Yahoo News’ “Skullduggery” podcast. “The intelligence community, the national security community, loathes Snowden and have long memories for this sort of thing, and I don’t think he’ll be pardoned in his lifetime.”

 

What I'm Reading 5/20/2020 - ICS/OT Attacks Up 2000% and Trumps Bulk Power Executive Order Examined Again

Security Affairs - Security Service of Ukraine arrested the popular hacker Sanix who sold billions of stolen credentials -

“The Security Service of Ukraine has identified and detained a hacker known as Sanix. Early last year, it caught the attention of global cybersecurity experts by posting on one of the forums the sale of a database with 773 million e-mail addresses and 21 million unique passwords.” reads a press release published by the SSU.

“SBU cyber specialists recorded the sale of databases with logins and passwords to e-mail boxes, PIN codes for bank cards, e-wallets of cryptocurrencies, PayPal accounts, information about computers hacked for further use in botnets and for organizing DDoS attacks”

HelpNet Security - CEOs and CISOs disagree on cyber strategies -

There is also a clear divide between CEOs and CISOs in how they identify the right cybersecurity path forward for their business. CEOs prefer to be proactive and risk-focused (58%), prioritizing maintenance of business stability above all.

While more than half of CISOs (54%) embrace a more reactive, incident-driven approach to mitigating today’s dynamic cybersecurity threat landscape.

The research also found that, despite claiming vendor fatigue, enterprises use more than 50 security vendors on average with 62% reporting they want even more. 

 The Register - Tech's Volkswagen moment? Trend Micro accused of cheating Microsoft driver QA by detecting test suite -

"Trend Micro simply designed the driver to provide a significant amount of functionality to privileged callers in user-mode, allowing attackers to misuse the driver in several ways. The problem is that Trend Micro's driver is insecure by design, making it a perfect candidate for abuse by malicious actors around the world."

Crucially, a function named MysteriousCheck() in the kernel-level driver code caught Demirkapi's eye. Digging in further, he said he made a startling discovery. MysteriousCheck() appears to detect whether or not a specific Microsoft test suite – the driver verifier – is running on the computer.

This test suite is designed to ensure drivers meet Microsoft's Windows Hardware Quality Labs (WHQL) requirements. If a driver meets this standard, it can be digitally signed by Microsoft, is trusted by Windows, and potentially can be distributed via Windows Update and similar mechanisms.

The State of Security - Attacks Targeting ICS & OT Assets Grew 2000% Since 2018, Report Reveals -

In the data it had collected since 2018, IBM X-Force found that digital attacks targeting industrial control systems (ICSes) and operational technology increased by over 2000%. Many of those attacks involved a combination of exploiting known vulnerabilities in supervisory control and data acquisition (SCADA) and ICS hardware components along with password spraying attacks leveraging brute force login techniques.

SC magazine - Bigger budgets have not entailed more security -

Greater spending on cybersecurity products hasn’t entailed a better organizational security posture. Despite the millions of dollars spent by organizations year on year, the average cost of a cyberattack jumped by 50 percent between 2018 to 2019, hitting $4.6 million per incident.

Actually I'm not sure that the headline and opening paragraph really match with what the rest of the article is saying , but I thought the bit about average cost of a cyberattack continuing to climb was interesting.

CSO - Executive order boots “foreign adversaries” from US electric grid over security concerns -

On May 1, the Trump Administration issued an Executive Order on Securing the United States Bulk-Power System. According to the order, the administration found that “foreign adversaries are increasingly creating and exploiting vulnerabilities in the United States bulk-power system, which provides the electricity that supports our national defense, vital emergency services, critical infrastructure, economy, and way of life.”

...

One electric utility security expert, Joe Weiss, believes that the prime motivator for the executive order is a real cyberattack on the US bulk power system. This attack took the form of a “hardware backdoor” that was discovered when a Chinese transformer was delivered to a US utility. Although Weiss is almost completely mum on the details of this situation, the backdoor is capable of causing a highly damaging event, he tells CSO.

Weiss contends that the utility found the backdoor when it was installing the transformer and was "finding things that should not have been in there.” He also believes there are multiple such transformers with hardware backdoors installed throughout the bulk power grid.

...

Cai said that DOE contacted JSHP to cancel the transportation from the Port of Houston, told JSHP not to install the transformer, and rejected the warranty for the hardware, something no other customer has ever done. Cai said that he called DOE to follow up later and that the department never returned his phone calls. In an email exchange with DOE’s press office, CSO asked the department to confirm or deny Cai’s account and received no response.

I posted quite a bit about this back when Trump first released his Executive Order and then again when Joe Weiss  posted his response.  This article fills in some missing context.  I have to say that Dale Peterson's take, as it is presented here, is absolutely incorrect (at least in my opinion).  Yes, it does no good to close hardware backdoors if you continue to have a system that is insecure by design EXCEPT the hardware backdoor may make the exploit even easier for the adversary to deploy or allow access or control that wouldn't be available through a normal exploit chain AND even if you do re-engineer everything to be secure by design but still allow the manufacturers to install backdoors you have wasted that work.