What I'm Reading 2/27/2020 - China and Ransomware All Dy and All Night

Books -

Network Forensics Tracking Hackers Through Cyberspace

Wired for War: The Robotics Revolution and Conflict in the 21st Century

The Ten-Day MBA 4th Ed.: A Step-By-Step Guide To Mastering The Skills Taught In America's Top Business Schools

News / Blogs - 

Axios - Tech can't remember what to do in a down market -

The big picture: Tech has been booming for so long the industry barely remembers what a down market feels like — and most companies are ill-prepared for one.

 Infosec Institute - Introduction to the OWASP API Top Ten -

The creation of an API-specific top ten list was driven by the increased use of APIs and discovery of vulnerabilities within them. In 2019, 485 new API vulnerabilities were discovered, a 17% increase over the previous year. Since APIs are so powerful and exposed to the public internet, education about the threats that they face is extremely important.

Slashdot:  Suckers List:  How Allstate's Secret Auto Insurance Algorithm Squeezes Big Spenders -

Customers who were already paying the highest premiums, of about $1,900 or more every six months, and were due an increase would have borne price hikes of up to 20 percent. But drivers with cheaper policies, who deserved price jumps that were just as big, would be charged a maximum increase of only 5 percent. Customers in the 20 percent group were more likely to be middle-aged.

The Register - Google begs for US Entity List exemption to let Huawei use its mobile services – report -

As Huawei takes the initiative to create its own homegrown alternative to the Play Store, Google has reportedly pleaded with the White House to offer it an exemption to again work with the Chinese tech giant.

Fifth Domain -  How China poses an insider threat -

Central to concerns is China, which for years has been infiltrating the networks of defense contractors and tech companies and stealing their technology, and how the country is now going beyond cyberattacks and increasingly relying on insiders to steal IP instead.

That’s a trend that the intelligence agencies inside the U.S. government have seen since former President Barack Obama and Chinese President Xi Jinping agreed to halt the theft of IP, a deal that hasn’t been entirely successful and pushed the Chinese to steal IP outside of the cyber realm.

Cyberscoop -  Accused Chinese hackers abandon techniques after U.S. indictments -

U.S. indictments against individual Chinese soldiers accused of hacking various American targets have deterred those military personnel from conducting the same kinds of hacks again, according to the co-founder of a firm known for investigating nation-state activity.

...

At the very minimum, he said, attackers had to “reset and re-tool.” Even that would differentiate Chinese hackers from their counterparts in Russia and Iran, who tend to “ignore the indictments and move on,” he said. Exactly why China changes its tactics, while other state-sponsored hackers continue without interruption, remains unclear.

 Cyberscoop - Yet another hacking group is targeting oil and gas companies, Dragos says -

A previously undocumented hacking group has been targeting oil and gas companies along with telecommunications providers from Africa to Central Asia to the Middle East, the industrial cybersecurity company Dragos said Thursday.

The revelation brings to five the number of groups tracked by Dragos that go after the oil and gas sector, highlighting the growing interest shown by well-resourced hackers in probing the industrial control systems (ICS) that underpin energy infrastructure. Oil and gas companies move markets and are strategic national assets, giving cyber operatives plenty of reason to scope them out.

Security Boulevard - New Wave of Ransomware Threatens OT Security and Reliability -

In the past, direct attempts to target machinery, or industrial processes, have been advanced threats (Stuxnet, Duqu, Flame) attributed to nation state attacks. Now, we’re seeing simple, crude examples of ransomware that could have a significant impact on OT networks.

Security Boulevard - NSA Releases Cloud Vulnerability Guidance  -

As a guidance document, it doesn’t attempt to be deeply technical; instead, it provides an overview of the technologies, threats, and vulnerabilities that are common in cloud environments and approaches to reducing cloud risk. This is a valuable reference, and it aligns with where I think every security discussions should start – risk....There are four classes of vulnerabilities listed by the NSA: misconfiguration, poor access control, shared tenancy, and supply chain. The first two constitute the primary responsibility of the customer. The latter two are the CSP’s.

Guidance Document 

Commoncog.com - The ultimate guide to reading a book a week for your career -

The stuff that helps me actually read more is simple, then:

1. Stop being so precious about reading.
2. Read 3 books at a time — one hard, one easy, and one very easy.
3. Read ‘branch books’ differently from ‘tree books’.
4. Read narrative books on Kindle, and non-fiction idea books on phone or paper.
5. Turn reading into a habit, and:
6. Stop reading books you don’t like.

ZDNet - Ransomware victims thought their backups were safe. They were wrong -

"We've seen a number of ransomware incidents lately where the victims had backed up their essential data (which is great), but all the backups were online at the time of the incident (not so great). It meant the backups were also encrypted and ransomed together with the rest of the victim's data," the agency warned.

 Dark Reading - 'Cloud Snooper' Attack Circumvents AWS Firewall Controls -

Researchers at Sophos discovered the attack while inspecting infected Linux and Windows EC2-based cloud infrastructure servers running in Amazon Web Services (AWS). The attack, which Sophos says is likely the handiwork of a nation-state, uses a rootkit that not only gave the attackers remote control of the servers but also provided a conduit for the malware to communicate with their command-and-control servers. According to Sophos, the rootkit also could allow the C2 servers to remotely control servers physically located in the organization as well.