More Signal. Less Noise.

V3 | Issue 32 | 2.18.21

Starlink unwelcome in Russia? Washington sets expectations for Solorigate recovery. Facebook unfriends Australia?

Summary

By the CyberWire staff

At a glance.

Russia doesn't much care for Starlink.
Washington mulls Solorigate response and recovery.
Facebook's showdown with Australian law.

Russia nixes SpaceX Starlink Internet service.

The Motley Fool says fast Internet for all, even those in the sticks, is a goal of SpaceX’s Starlink project, but Moscow isn’t having it. The 100 mbps service was first extended to Alaska and Canada, then the UK, and by the close of 2021, could span the globe. With an eye to domestic surveillance, national security, and its own satellite Internet venture (“Sphere”), Russia is weighing regulation that would fine residents and firms for using foreign-run services. Starlink will survive the slight, given the 3 billion other currently unconnected prospective clients worldwide.

Washington sets SolarWinds remediation expectations; onlookers clamor for action.

In a press briefing yesterday, according to CyberScoop, Solorigate czar Anne Neuberger warned that “we’re at the beginning stages of understanding” the breach, and remediation will likely take months. Efforts are complicated by the fact that attackers worked in private sector systems (into which intelligence services have limited sight), targeted identity protocols (“the hardest to clean up”), and staged the hack from within the States. Neuberger said her team will probably discover additional follow-on incursions, and possibly activity that would fall beyond the scope of espionage. “It’s fundamentally of concern for the ability of this to become disruptive,” she remarked.

While an executive order initiating an analysis of domestic supply chain concerns is anticipated shortly, an opinion piece in The Hill demands bolder action in the form of incentivized public-private info sharing and “collective defense,” clarified Federal roles, investments in state-of-the-art technology, and Government authority to surveil private networks.

A Lawfare essay explains the rationale behind the Cyberspace Solarium Commission’s recommendation to grant the Secretary of Homeland Security the ability to declare a “cyber state of distress” and access a “cyber response and recovery fund.” Funds would facilitate technical support for events that jeopardize national interests and surpass routine capacities but not the Federal Emergency Management Agency threshold for disasters.

Morrison to Zuckerberg: slap leather.

As we’ve seen, the House of Zuckerberg is peeved with Canberra legislation that singles out Google and Facebook, requiring the tech giants to compensate media outlets, disclose information about how they collect and process user data, and notify outlets four weeks in advance of relevant algorithmic changes.

According to the Associated Press, one concern of Facebook’s was that news fees would be “entirely uncapped and unknowable,” but Australia recently amended the bill to clarify that payments would be “lump sum.” Still, Facebook contends “the value exchange between Facebook and publishers runs in favor of the publishers,” with Facebook producing roughly AU$400 million for publishers last year, and the law “seeks to penalise Facebook for content it didn’t take or ask for.” (Critics maintain the platforms profit from news engagement, user data, and ads.)

While Google continues to strike backroom deals, SeekingAlpha reports Facebook has made good on its promise to cut off in-country access to foreign and domestic outlets and international access to Australian outlets. The Guardian has Prime Minister Morrison’s response: “Facebook’s actions to unfriend Australia today, cutting off essential information services on health and emergency services, were as arrogant as they were disappointing” and “confirm the concerns that an increasing number of countries are expressing about the behaviour of BigTech.” One publisher urged the Government to “stand firm and call Facebook’s bluff,” but the Treasurer indicated Australia may be open to negotiation.

Ex-PM Turnbull called the move “a very foreseeable” result of Canberra’s “holding a gun to the head of private businesses,” saying, “The government will get fantastic publicity…because every media outlet in Australia has a conflict of interest.”

Selected Reading

Florida water plant cyberattack: Senate Intel chair seeks answers (Fox News) Senate Intelligence Chairman Mark Warner has sent a letter to the FBI and Environmental Protection Agency (EPA) seeking more information regarding the recent computer breach at a Florida water treatment facility, citing the need to ensure that potential security weaknesses are addressed.

Warner Calls on FTC and Google to Address the Prevalence of Digital Ad Fraud (Mark R. Warner) U.S. Sen. Mark R. Warner (D-VA), Vice Chairman of the Senate Select Committee on Intelligence and a member of the Banking Committee, wrote a letter to the Federal Trade Commission (FTC) Chairman Joseph Simons expressing concern following a report published by Buzzfeed detailing continued prevalence of digital advertising fraud and inaction by Google to curb these efforts. According Buzzfeed, this scheme has generated hundreds of millions of dollars in fraudulent advertising revenues, with operations spanning more than 125 Android apps and websites.

Prime minister Scott Morrison attacks Facebook for 'arrogant' move to 'unfriend Australia' (the Guardian) The PM says the social media giant’s move to block news on its platform in Australia will harden the resolve of his government

Lack of competition in ad tech affecting publishers, advertisers and consumers (Australian Competition and Consumer Commission) A lack of competition and transparency in the digital advertising technology supply chain is impacting publishers, advertisers and consumers and needs to be addressed, according to the interim report for the ACCC’s Digital advertising services inquiry, released today.

FCC wants to speed Huawei, ZTE equipment removal by rural carriers (South China Morning Post) FCC aims to increase the number of rural network carriers eligible for ‘rip-and-replace’ funds.

The Cybersecurity 202: Investigations into Russian, North Korean hackers are shaping Biden's foreign policy (Washington Post) The Biden administration is plunging ahead in a pair of high-profile cybersecurity investigations into North Korean and Russian hackers, shedding light on how it plans to crack down on foreign hackers after the Trump administration downplayed the issue in the 2016 election and its aftermath.

Biden on ‘Short Leash’ as Administration Rethinks China Relations (New York Times) The Biden administration is under intense pressure to maintain former President Donald J. Trump’s curbs on China, even as it tries to develop a more comprehensive and effective strategy.

Decoupling With China Would Hurt U.S. Businesses, Chamber of Commerce Says (Wall Street Journal) The U.S. Chamber of Commerce warned that rising tensions with China could have serious consequences for U.S. businesses, laying out a worse-case scenario where some major industries would be crippled.

The U.S. Needs a Cyber State of Distress to Withstand the Next SolarWinds (Lawfare) The SolarWinds hack exposed shortcomings in the U.S. government’s capacity to respond to cyberattacks. In a hard-hitting, far-reaching, and nearly undetectable attack, the perpetrators behind the SolarWinds intrusion secretly inserted malicious code into a software update and subsequently programmed it to appear legitimate. Among the victims were critical government agencies at the state, local, and federal levels, in addition to major private companies such as Microsoft.

Russia's hack was bad — but if we don't act fast, it will get much worse (TheHill) A strong offense always wins and, in the cyber domain, private companies cannot go up alone against nation-states.

Group of 25 prominent nonprofits urge Congress to pull war powers (TheHill) A group of 25 prominent nonprofit organizations on Wednesday urged Congress to end “forever wars” and rein in presidents' war-making authority.

Civil rights groups ask Biden administration to oppose facial recognition (Washington Post) The groups argue the software ‘would facilitate the mass tracking of each person’s movements in public space — something intolerable in a free and open society.’

WSJ News Exclusive | GameStop Frenzy Prompts SEC to Weigh More Short Sale Transparency (Wall Street Journal) Wall Street’s main regulator is weighing whether to require more transparency of short selling and the opaque network of stock lending and borrowing that facilitates it.

Hassan to chair Senate emerging threats subcommittee (TheHill) Sen. Maggie Hassan (D-N.H.) will chair the Senate Homeland Security and Governmental Affairs Committee’s subcommittee focused on national security threats and spending oversight, committee leaders announced Wednesday.

()

State Senate aims to strengthen cybersecurity after data hack (Madison Park Times) The Washington state Legislature is considering a bill that would centralize the state’s response to cybersecurity threats and strengthen the government&r

DOJ announces charges against North Korean hacker spies accused of conspiring to steal more than $1.3 billion in cash and cryptocurrency (Washington Post) The Justice Department unsealed charges Wednesday against three North Korean hacker spies accused of conspiring to steal and extort more than $1.3 billion in cash and cryptocurrency from banks and businesses around the world.

North Korean Lazarus Group hackers indicted in US (ComputerWeekly) Charges filed relate to Lazarus Group’s long-running cyber crime spree, including financial theft and extortion, the cyber attack on Sony Pictures and WannaCry malware.

Feds Indict North Korean Hackers for Years of Heists and Scams (Wired) The three men are allegedly part of a group that tried to steal $1.3 billion in an extended—and ongoing—cybercrime spree.

DOJ charges three in WannaCry attacks, attempts to steal $1.3B (FCW) In addition to unsealing the charges against three North Korean hackers, the U.S. government also published indicators of compromise for a family of malicious cryptocurrency applications called 'AppleJeus.'

US indicts North Korean hackers for stealing $1.3 billion (BleepingComputer) The U.S. Department of Justice has charged three North Koreans for stealing $1.3 billion in money and cryptocurrency in attacks on banks, the entertainment industry, cryptocurrency companies, and more.

'Criminal syndicate with a flag': North Korean intel operatives charged in hacking campaign (USA TODAY) Feds say North Korean hackers are part of a 'criminal syndicate with a flag' in unsealed indictment.

North Korean hackers are ‘the world’s leading bank robbers,’ U.S. charges (POLITICO) Prosecutors say they were behind the 2014 Sony hack, the 2017 WannaCry ransomware attack, and a range of digital bank heists.

Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe (US Department of Justice) A federal indictment unsealed today charges three North Korean computer programmers with participating in a wide-ranging criminal conspiracy to conduct a series of destructive cyberattacks, to steal and extort more than $1.3 billion of money and cryptocurrency from financial institutions and companies, to create and deploy multiple malicious cryptocurrency applications, and to develop and fraudulently market a blockchain platform.

Assistant Attorney General John C. Demers Delivers Remarks on the National Security Cyber Investigation into North Korean Operatives (US Department of Justice) Today, the Justice Department is announcing charges following a significant national security cyber investigation first disclosed publicly more than two years ago.

In a Dangerous Game of Cat and Mouse, Iran Eyes New Targets in Africa (New York Times) Fifteen people arrested in Ethiopia were part of what American and Israeli officials said was a foiled Iranian plot against diplomats from the United Arab Emirates.

()

Dutch Police post "say no to cybercrime" warnings on hacker forums (BleepingComputer) The Dutch Police have begun posting warnings on Russian and English-speaking hacker forums not to commit cybercrime as law enforcement is watching their activity.

GameStop bull 'Roaring Kitty,' MassMutual hit with securities lawsuit (Financial Post) The social media persona “Roaring Kitty” at the center of last month’s frenzied rally in shares of GameStop Corp violated securities laws and caused “huge…

GameStop hearing on tap with Robinhood, Melvin, Reddit and Citadel CEOs (SeekingAlpha) Get ready for the big show... Robinhood's (RBNHD) Vlad Tenev, Melvin Capital's Gabe Plotkin, Reddit's Steve Huffman and Citadel's Kenneth Griffin and Keith Gill are all set to...

Reddit day trader urges Wall Street probe ahead of GameStop hearing (Silicon Valley Business Journal) Keith Gill, a Wilmington, Mass., resident whose personas include Roaring Kitty on YouTube, will testify at a virtual hearing along with the founder of Melvin Capital, which lost half its value as GameStop shares surged.