The CyberWire Pro Policy Briefing for 4.16.20

Summary

By the CyberWire staff

At a glance.

US warns of North Korean financially motivated cyberattacks.
The scope of the UK's restriction of Huawei from core networks grows clearer.
Telework may outlast the COVID-19 emergency.
The US FBI is issuing more public warnings of cyber threats.

US Government issues a warning about North Korean cybercrime.

In what the New York Times sees as a sign that deterrence of North Korea in cyberspace is beginning to fail, the US Government has issued an unusually comprehensive advisory about Pyongyang's cyberspace offensive. The joint advisory, to which the Departments of State, the Treasury, and Homeland Security, and the Federal Bureau of Investigation contributed, and which they approved, concentrates on the threat North Korean hacking poses to the international financial system. The DPRK's activities are grouped under three main heads:

"Cyber-enabled Financial Theft and Money Laundering." A great deal of this activity involves stealing alt-coin, cryptocurrency.
"Extortion Campaigns." That is, ransomware. One unusual form of extortion is the DPRK's use of "long-term paid consulting arrangements...to ensure that no such further malicious cyber activity takes place." That is, they run cyber protection rackets.
"Cryptojacking," which still affords some prospect of a modest return, and Pyongyang needs all the financial help it can get.

The unusually long public advisory includes advice on how to defend oneself against North Korean attacks. The US Government is also offering rewards of up to $5 million for tips about illicit DPRK cyber activities, which you can submit to the State Department’s Rewards for Justice website. To the New York Times' observation that deterrence may be failing, in all fairness it should be noted that cyber deterrence of Pyongyang has been for decades at best a work in progress. Deterrence is always at some level a counter-value proposition, and the less of value that you’ve got to lose, the harder you may be to deter.

The reality of the UK's partial exclusion of Huawei takes shape.

Ericsson has won the contract to provide BT with the equipment it will need to replace Huawei gear in the big British telco's networks, SDxCentral reports. The BBC says BT complains it will take until 2023 to purge Huawei kit. This suggests that the British decision to ban Huawei from its “core” networks, widely seen at the time as disappointingly soft (especially by the US and Australia), may be biting harder than thought it would. Huawei has cautioned the UK against making what the BBC calls "a 5G u-turn," and there are signs of backbench sentiment in favor of even stronger restrictions on the Chinese manufacturer.

Security, post-pandemic.

One of the things organizations are learning is what sort of work can be done remotely. It's likely that some of the habits being built up now will persist beyond the current emergency. FCW, for one, thinks that a great deal of the surge in telework the US Department of Defense is seeing may well turn into a permanent way of doing business.

The US FBI increases its warnings as COVID-19-themed cybercrime spikes.

CPO Magazine notes that the US Federal Bureau of Investigation (FBI) has "stepped up its efforts to notify the public" of criminal attempts to take advantage of the coronavirus emergency. The Bureau has increased the frequency of its alerts. It only issued nine during all of last year; it's already issued four during March and April. Not all of these deal directly with COVID-19 (one in March, for example, was a warning about human trafficking) but it does seem that the tempo of cybercrime engendered by the pandemic has moved the FBI in the direction of more frequent public engagement than had been the norm.

Selected Reading

BT delays removal of Huawei from EE's core network (BBC News) BT says plans to remove the Chinese-made equipment from the sensitive core network have been delayed.

Analysis | The Cybersecurity 202: Democrats accuse Trump administration of voter suppression in mail ballot fight (Washington Post) They’re calling Wisconsin’s primary the ‘highest form of voter suppression.'

What the Cyberspace Solarium report means for the private sector (Reason.com) The Cyberspace Solarium Commission's report was released into the teeth of the COVID-19 crisis and hasn't attracted the press it probably deserves.

GAO to Pentagon: Practice the Cyber Policies You Preach (Nextgov.com) The Defense Department has yet to fully implement multiple initiatives to improve basic cyber hygiene.

The key to the nation’s cyber defense? Behavioral analysis (Fifth Domain) National leaders would be wise to listen to the Cyberspace Solarium Commission and consider the benefits of a human and behavior-centric approach to cybersecurity.

DARPA Project Producing Tool to Help Anticipate Military and Industrial Systems’ Cyber Threats (Nextgov.com) The VERDICT tool aims to allow systems engineers to assess cybersecurity even without deep expertise.

Ericsson Beats Out 5G Rivals to Replace BT’s Huawei Gear (SDxCentral) Ericsson beat out rivals in replacing Huawei core network equipment for BT’s ongoing 5G network deployment. The deal follows a recent move by the United Kingdom to limit the use of equipment from China-based vendors in 5G networks.

U.N. Backs Down on Partnership With Chinese Firm for 75th Anniversary (Foreign Policy) The decision comes after U.S. officials and human rights advocates complained that Tencent aids Beijing in surveillance.

Chinese Hackers off to a Busy Start in 2020 With Massive 1Q Cyber Espionage Campaign (CPO Magazine) Chinese hackers are on a massive cyber espionage campaign targeting over 75 organizations throughout the world and using vulnerabilities in various routers and cloud services.

Trump administration warns of North Korean cyber threats (TheHill) The departments of Homeland Security, State and Treasury with the FBI on Wednesday issued a joint alert warning of an increase in cyber threats from North Korea.

US issues guidance on North Korean hackers, offers $5M reward (BleepingComputer) The U.S. government has issued guidance on North Korean hacking activity in a joint advisory published by the U.S. Departments of State, Treasury, and Homeland Security, and the FBI.

U.S. Warns North Korean Hacking Threatens International Finance (Bloomberg) Advisory comes as U.S. adversaries seek to leverage pandemic. Among North Korea’s cyber tactics: hacking websites for others.

Advisory Issued to Raise Awareness of Cyber Threat Posed by North Korea (Homeland Security Today) North Korea targets cyber-enabled infrastructure globally to generate revenue for its regime priorities, including its weapons of mass destruction programs.

U.S. Accuses North Korea of Cyberattacks, a Sign That Deterrence Is Failing (New York Times) Through the attacks, a report says, the North steals and launders money, extorts companies and uses digital currencies to gain cash for its nuclear program.

Guidance on the North Korean Cyber Threat (CISA) The U.S. Departments of State, the Treasury, and Homeland Security, and the Federal Bureau of Investigation are issuing this advisory as a comprehensive resource on the North Korean cyber threat for the international community, network defenders, and the public. The advisory highlights the cyber threat posed by North Korea – formally known as the Democratic People’s Republic of Korea (DPRK) – and provides recommended steps to mitigate the threat. In particular, Annex 1 lists U.S.

DOD's telework surge could be permanent (FCW) A new emphasis on telework at the Defense Department in response to the COVID-19 pandemic could change work culture at the Pentagon, officials said.

CDC, FEMA have created a plan to reopen America. Here’s what it says. (Washington Post) FEMA and CDC officials worked on the plan for at least the past week and the resulting document has been discussed at the White House.

For the Foreseeable Future, U.K. Parliament May Meet in Cyberspace (New York Times) Few places are as ill suited to social distancing as the crammed chambers of the House of Commons, which is now looking for a digital alternative.

A pro-Iranian operation has spread coronavirus disinformation across Facebook and Twitter (The Verge) A group called the IUVM is behind the operation.

()

How Coronavirus Is Eroding Privacy (Wall Street Journal) Governments are using technology to track and monitor individuals in an effort to slow the pandemic. Privacy advocates are wary, concerned that authorities might not be inclined to unwind such practices after the emergency has passed.

The FBI Is Stepping up Its Public Cyber Security Alerts as Criminals Take Advantage of Pandemic Conditions (CPO Magazine) FBI is issuing more cyber security alerts than usual, covering human trafficking, COVID-19 scams, vulnerabilities in networking platforms and cloud-based business email compromise campaigns.

Iotics warns against relaxing data regulations in rush to combat COVID-19 pandemic (News 9) Digital twins of hospitals offer secure, scalable, insights into ICU resources. Supporting COVID-19 response and recovery efforts.