More Signal. Less Noise.

V2 | Issue 138 | 7.17.20

Cozy Bear blamed for COVID-19 hacking and election meddling. CISA directs patching. Twitter and influence ops.

Summary

By the CyberWire staff

At a glance.

UK, Canada, Australia, and the US blame Russia's Cozy Bear for hacks.
CISA issues emergency directive n Windows DNS Server vulnerability.
The Twitter hack and the potential for disinformation.

Four of the Five Eyes scowl at Cozy Bear.

Australian intelligence services have joined their Five Eyes sisters in the UK, Canada, and the US in pointing to Russia's Cozy Bear as the actor behind cyberespionage directed against such research, the Sydney Morning Herald reports. The Herald also has an explanation of how the stolen trade documents British Foreign Secretary Raab mentioned were used in last year's British general election: they served to drive the Labour Party's retrospectively absurd contention that the Tories intended effectively to privatize the National Health Service and sell it to the Americans.

Russia's embassy in London, responding to "unfriendly statements by Foreign Secretary Dominic Raab," said that Russia didn't hack any biomedical research, didn't attempt to influence any "democratic elections," and that it reiterated its offer to jointly investigate and adjudicate cyber issues. The statement closed with this: "We have also taken note of the Foreign Secretary’s suggestion that the UK Government reserves the right to respond with appropriate measures in the future. In this regard, we would like to state once again that any unfriendly actions against Russia will not be left without a proper and adequate response."

CISA directs US Federal agencies to patch the wormable Windows DNS Server vulnerability.

CISA is quite serious about the Windows DNS Server vulnerability mitigated this week. Emergency Directive 20-03, issued yesterday, told most US Federal agencies to apply the patch by 2:00 PM Eastern time today.

Twitter hack raises concerns about disinformation and influence operations.

The midweek Twitter hack appears to have been, probably, a clever but poorly thought-through criminal caper. The Verdict has a useful rundown of early speculation. But a great deal of concern has been expressed about the potential of such Twitter hijacking to serve the purposes of disinformation and influence operations. It didn’t in this case. But given the extent to which, alas, people get a lot of their news in the form of tweets, the prospects are sobering. They’re even more sobering when one considers how Twitter has come to be used for emergency notification.

Twitter’s own security certainly took a black eye. Perhaps the incident will serve as a learning experience for social media generally, but there have been op-eds (like this one in the Financial Express) calling for a regulatory solution to a problem that seems rooted in human credulity.

Selected Reading

NATO Crafting All-Domain, Euro-Atlantic Strategy As Threats to Alliance Shift (USNI News) NATO is drafting a comprehensive, all-domain strategy that will reset the focus of the alliance on high-end conflict with peer adversaries, a senior official said last week. This “Euro-Atlantic area” strategy will address shortfalls in existing response capability as well as emerging threats in “space, cyber, new technology” for the alliance, and it “will be …

Mega Twitter hack shows the need for countries to have cybersecurity laws for digital firms (The Financial Express) While there is no doubt that social media companies need to spend more on security—there is no law regarding this as of now—platforms also need to have contingency plans ready.

A little bird didn’t tell me (Pursuit) The hack attack on Twitter was aimed at financial gain, but what happens when hacking turns political? University of Melbourne experts look at what is needed.

Trump Confirms US Cyberattack On Russian Trolls (ScreenRant) Trump shares info about an offensive cyberattack.

What Putin’s plot to plunder the Covid-19 vaccine tells us about tyranny | TheArticle (TheArticle) The discovery that computer hackers working for the Russian state have tried to steal the pioneering work of the [...]

Opinion: After Huawei: Abandoned and coerced, Canada prepares for its humiliation (The Globe and Mail) The 'debate' over whether Ottawa would allow the Chinese telecom to help build Canada's 5G networks is as good as dead, as the U.S. exposes the limits of Canadian sovereignty

Why the Trump administration's win over Huawei could be bad news for TikTok (CNN) A week after saying his administration was "looking at" banning video app TikTok in the United States, President Donald Trump claimed credit for personally thwarting the expansion plans of another Chinese-affiliated technology company: Huawei.

US extends Huawei clampdown with list of suspect gear (South China Morning Post) Federal Communications Commission has begun drawing up list of telecoms equipment deemed to pose a security risk

FCC Takes Next Steps In Sealing Off Chinese Equipment (Law360) The Federal Communications Commission on Thursday asked for a fresh round of public comments on the agency's plans to further crack down on foreign-made network components believed to present national security risks.

Barr Warns Company Executives on Pushing Policies at Behest of China (Wall Street Journal) The Attorney General took aim at a range of American companies and industries for what he described as a willingness to accede to authoritarian demands from the Chinese government.

Attorney General Barr accuses Hollywood, Big Tech of collaborating with China (Reuters) U.S. Attorney General William Barr took aim at Hollywood companies, including Walt Disney Co on Thursday as well as large technology firms like Apple, Alphabet's Google and Microsoft Corp over company actions with China.

()

Security clearance processing times are down, continuous evaluation enrollment is up (Federal News Network) Government is closer to meeting its security clearance processing goals for the first time in years, due, in large part, to the steady rise in continuous evaluation enrollment.

Air Force wants to expand training for cyber teams (C4ISRNET) The Air Force has selected an Air National Guard base to be the center for training its defensive cyber teams.

Why Amazon, Apple and Google may have to tighten security settings on smart devices (Your Local Guardian) The UK Government has published proposals which will make it a legal requirement for smart devices to include certain security protections.

Huawei: Jersey to ‘align’ its approach with the UK (Jersey Evening Post) Jersey has been working with telecoms providers to ‘align’ its approach to Chinese telecoms company Huawei with that of the UK, the Economic Development Minister has said.

Israel Adopted Cyber War Protocol to Manage COVID-19 Crisis (Israel Defense) Deputy Director General of Robustness at the Israel National Cyber Directorate outlines Israel’s cyber response to the coronavirus pandemic

Court Ruling Leaves Companies Scrambling for New Ways to Move Data From Europe to the U.S. (Wall Street Journal) A European court declared a trans-Atlantic data-transferring agreement invalid because it could expose Europeans’ data to U.S. government surveillance.

Australian spies join in accusing Russia of 'trying to steal' virus vaccine secrets (The Sydney Morning Herald) Australia, US, UK and Canada have accused Russia of launching hacking attacks on western medical companies working on coronavirus vaccines and drugs.

How Russia's Cozy Bear hunted for coronavirus vaccine secrets (The Telegraph) Investigators working within GCHQ, NCSC and MI5 declare for first time that organisation is an offshoot of Russian intelligence

Russian spies 'target coronavirus vaccine' (BBC News) The UK, US and Canada say state-backed hackers tried to steal coronavirus vaccine research.

Russian hackers target COVID-19 vaccine research with custom malware (BleepingComputer) Hackers likely working for Russian intelligence services have been attacking organizations involved in the research and development of a vaccine against the new coronavirus.

Cozy Bear hackers linked to Kremlin blamed for decade of cyber-espionage (Times) Cozy Bear is the name that cybersecurity companies have given to a Russian hacking group that is believed to be controlled by Moscow. The group, also known as Advanced Persistent Threat 29, is said to

Cozy Bear: Everything we know about the hackers reportedly targeting COVID-19 vaccine research (Tech2) The UK security agency says it is over 80 percent certain the attacks were to collect information on COVID-19 vaccine research or the COVID-19 virus itself.

Cozy Bear and Fancy Bear: what are the Russian hacking operations? (Evening Standard) The British, US and Canadian governments have accused the Russian hacking group Cozy Bear of trying to steal vital coronavirus information, including research about a possible vaccine. UK security minister James Brokenshire went further the next day, slamming the "completely unacceptable" actions of "Russian intelligence officers". - although there's no evidence that anything had been stolen or that damage had been done, he added.

Iran-linked hackers steal sensitive data from US Navy member, researchers say (CyberScoop) Allison Wikoff has spent years tracking suspected Iranian hackers, sifting through data they’ve left behind and analyzing their techniques. But in May, when her colleague stumbled upon a server with 40 gigabytes of the hackers’ training videos and online personas, Wikoff knew she had struck gold.

Iran-Linked Hackers Accidentally Exposed 40 GB of Their Files (SecurityWeek) The Iranian state-sponsored group Charming Kitten accidentally exposed a server storing 40 GB of information related to its operations

Iranian cyberspies leave training videos exposed online (ZDNet) Cyber-security firm IBM X-Force finds video recordings used to train Iranian state hackers.

Why Are Mysterious Fires Still Burning in Iran? (Foreign Policy) The incidents could raise fears of a military miscalculation between Tehran and Washington.

Federal agencies told to patch wormable Windows DNS bug in 24 hours (BleepingComputer) The Cybersecurity and Infrastructure Security Agency (CISA) today asked all U.S. federal executive branch departments and agencies to mitigate the critical SIGRed Windows DNS Server wormable remote code execution (RCE) vulnerability within 24 hours.

Emergency Directive 20-03: Mitigate Windows DNS Server Vulnerability from July 2020 Patch Tuesday (CISA) This page contains a web-friendly version of the Cybersecurity and Infrastructure Security Agency’s Emergency Directive 20-03, “Mitigate Windows DNS Server Remote Code Execution Vulnerability from July 2020 Patch Tuesday”.

Leaders see data as ‘ammunition’ in future warfare (US Army) Army leaders: Data will be 'ammunition' in future multi-d...

The US Navy is making South China Sea memes as its warships anger China and challenge its sweeping claims (Business Insider) In addition to the destroyers, aircraft carriers, and other warships patrolling the area, the US Navy is now making South China Sea memes.

Air Force trusted computing experts eye potential $950 million project for cyber enabling technologies (Military & Aerospace Electronics) The ACT 3 program will emphasize enabling technologies for prototype technologies for operational environments, and ways to buy limited quantities.

Stepping up cyber protections for networks on Navy ships (Federal News Network) The Navy is seeking help from industry to improve the cybersecurity of ship-board networks.

Navy cyber security experts say they plan to deploy shipboard cyber defenses aboard 180 ships by next year (Military & Aerospace Electronics) Delivering cyber baselines enables Navy experts to identify capability risks during a ship’s availability or scheduled modernization.