US Cyber Command lets individual Russian operators know that Uncle Sam cares.
The US is reaching out directly to individuals involved in Russian influence operations. US Cyber Command is reported to be direct-messaging election-meddling trolls (New York Times). The message is as simple as it is direct: we know who you are and what you're doing, and you'd be well-advised to stop (Ars Technica). Observers differ as to how effective this will be as a deterrent (Slate), but recent US indictments of individual Russian nationals for their role in influence operations give the warnings some point (Slate). And it's unknown what other retaliatory operations Cyber Command may have under preparation or in progress.
A look back at TRITON/TRISIS.
FireEye attributed to Russia "with high" confidence the TRITON/TRISIS attack against safety systems in a Saudi petrochemical facility. FireEye concluded that the Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM) in Moscow wrote some of the code. It's possible but uncertain it was entirely a Russian operation. The question is complex: several actors had motive to hit the facility. FireEye's evidence is compelling but circumstantial (Forbes).
Dragos, presenting at the ICS Security Conference, described Xenotime, the threat actor behind TRISIS/TRITON. Cyberattacks like this are designed to kill. Dragos CEO Lee offered some encouragement when he cautioned people against forming a picture of the attacker as hyper-competent and effectively invincible. Instead, remember that attackers make mistakes, too. With TRISIS they shut the facility down, twice, which wasn't their intention. They wanted it to operate in an unsafe mode. Lee suggested an alternative picture of industrial control system hackers: they're 18 to 30 years old, in their first government job, dealing with management and PowerPoint, "just like you" (The CyberWire).
Indictments and information operations.
The US Department of Justice has indicted a Russian national, Elena Alekseevna Khusyaynova, for conspiracy to influence US 2018 elections. Her indictment marks the first charges brought in connection with midterm voting. She's an accountant managing the finances for "Project Lakhta," an influence campaign intended as usual to inflame existing American political and cultural flash points. Ms Khusyaynova isn't in custody, but if she's ever tried, she could face five years' imprisonment.
Project Lakhta used the familiar trolls farmed along the Neva, but it also sought, with some success, to rope unwitting Americans into the op, often by forming and moderating social media groups. Moscow doesn't particularly care who gets elected as long as Americans grow to hate and mistrust one another. As the Justice Department points out in its comments on the Khusyaynova indictment, "The conspirators’ alleged activities did not exclusively adopt one ideological view; they wrote on topics from varied and sometimes opposing perspectives."
Observers are struck by the "weaponization" of Internet advertising technology (Data and Society). The means may be novel, the precepts less so. As the Grugq observes, "People keep rediscovering the basic principles of propaganda that were documented a century ago. It’s basically like every new technology demonstrates the old maxim: 6 months in the laboratory can save an afternoon in the library!"
Apple calls for an American GDPR, and takes a whack at the "data-industrial complex."
Apple CEO Tim Cook has called for a comprehensive US privacy law. He said Wednesday the effects of the EU's GDPR had been positive, and he expressed the hope that the US would follow suit with comparable regulation. Apple of course has long differentiated itself from other Silicon Valley tech giants by its public commitment to privacy. Apple sells devices, not data, which would be the basic product of companies like Google and Facebook (Washington Post). Mr. Cook has famously pointed across Silicon Valley in the general direction of Google and said, "If you're not paying for the product, you are the product."
Cook also strongly reiterated the company's long-standing opposition to any weakening or subversion of device encryption. Giving governments easy access to people's devices is a threat, he maintains, to basic rights to privacy. Not everyone may feel that way, especially those in what Cook called the "data industrial complex" (Washington Post).
Former Facebook security chief Alex Stamos replied to Cook with a tu quoque: how about coming clean on how the iCloud works? And what about those VPN apps you took down at the request of the Chinese government (Naked Security)?
Supply-chain seeding attack recedes further into implausibility.
Amazon and Supermicro have joined Apple in demanding that Bloomberg retract its story about Chinese supply-chain poisoning of motherboards with spy chips. There's still neither confirmation nor retraction of the story, but at this point Bloomberg effectively stands alone (Serve the Home). Security Boulevard reflects on the story and offers some advice for journalists covering cyber stories.
Crime and punishment.
A collection of Hoosiers who play Call of Duty are accused (but not, apparently, charged, at least yet) of stealing some $3 million in cryptocurrency. They are thought to have used a swatting operation to coerce a co-conspirator into working with them (News BTC). There seems to be an odd and disturbing subculture of swatting among online gamers, many of whom see this as a legitimate way of disciplining other gamers whom they think are in one way or another out-of-line and recalcitrant (WIRED).
The Celebgate hacker, a former high school teacher, has copped a guilty plea to Federal charges of gaining access to a protected computer and aggravated identity theft. Christopher Brannan will face a minimum sentence of two years, but both sides in the trial have recommended thirty-two months to the judge (US Department of Justice).
Courts and torts.
Google and Facebook are being sued, separately, for violating users' privacy through unauthorized geotracking (Naked Security).
Fallout from the recent indictment of a Treasury Department official charged with leaking sensitive financial information includes fears that banks will be more reluctant to share information concerning potential financial crimes with the Government. They receive civil immunity when they make such disclosures, but they may grow mum if they're not confident that the information they provide the Government won't be leaked (Wall Street Journal). The leak itself looks like an inside-baseball affair, with roots in an intra-bureaucratic squabble that goes back to the previous Administration (Wall Street Journal).
The European Court of Justice has ruled that you can't get yourself off the hook in a lawsuit alleging piracy simply by pointing out that your family members could have done it when you weren't around. Publisher Bastei Lübbe sued one Michael Strotzer in a Munich court for pirating one of the firm's audiobooks. The pathetic Herr Strotzer offered in his defense that his parents has access to his Internet connection, and so they could've done it. Well, no. Upon appeal the European Court of Justice clarified the way in which German law should be interpreted, and that this defense is no defense (Naked Security). Pathetic. First Mutti, then Oma? Sad!
Policies, procurements, and agency equities.
In the US, NSA is working out three contracts collectively known as "Greenway," said to aim at enhancing agency communications. General Dynamics, AT&T, and ManTech are the three primes. Together the three vehicles are reported to have a total contract value of $6.7 billion (Nextgov).
In a vote expected shortly after the midterm elections, the US Congress is thought likely to approve legislation establishing a new civilian cybersecurity agency in the Department of Homeland Security (Washington Examiner).
That Department's National Risk Management Center continues to expand the industrial sectors with which it cooperates. It began with finance, telecommunications, and energy, and intends eventually to expand into a total of sixteen sectors (Federal News Network).
Fortunes of commerce.
ESET appears set for a major change of direction, transforming itself from a software company (its antivirus programs are well-known and widely used) into a cybersecurity consultancy (Tawahul Tech News).
Sputnik says that, despite mistrust and regulatory headwinds in the Five Eyes (the US in particular) Kaspersky Lab is doing quite well in other markets, thank you very much. Not so much in the UK, however, where Kaspersky's global transparency initiative has failed to gain much traction with HM Government (New Statesman).
Huawei remains under suspicion in all Five of the Eyes. In Canada a former defence minister and a former CSIS director urge the Government to keep the company out of the country's 5G network (CTV News), but Prime Minister Trudeau sees no particular reason to particular reason to reverse a decision that would allow the company into Canada. In this respect the letter two US Senators sent the Prime Minister warning him against Huawei may well have backfired (Interpreter). The company is by no means giving up on the international 5G market. It will establish a lab in Germany that would enable the code reviews Huawei believes will facilitate its participation in 5G network build-outs. The lab is expected to open in Bonn on November 16th (CRN).
Following reports that President Trump's iPhone is not secure, denied by the President (TechCrunch), China's Foreign Ministry suggests the President would be much better off using a Huawei device, so give Beijing due credit for a cheeky sense of humor (Reuters).
Google has dropped plans for an incubator campus in Berlin. The proposed center had been protested by locals (Applesque criticism of data collection and use, etc.) who've claimed victory, but Google did not attribute its decision to the unwelcoming reception (BBC). More generally, the company's secrecy and pervasive reach is seen as a liability, and likely to prompt both litigation and legislation (Washington Post).
Facebook, stung by breaches and data handling scandals, is rumored to be in the market to buy a cybersecurity company (The Information). The Motley Fool speculates that FireEye would be a good acquisition for the House of Zuckerberg. Bloomberg Law argues that such an acquisition wouldn't prove a panacea, but of few things do, and that's not necessarily a reason to think a Facebook M&A move would be completely futile.
One of the factors that may have contributed to Big Tech's Gilded Age is the outsized concentration of shareholder power in founders' hands (WIRED).
SIGNAL offers some advice to small businesses working in the Defense contracting space, and how they could usefully approach cybersecurity.
Labor markets.
Apart from familiar difficulties developing an adequate cybersecurity workforce, in the US Government contractors face additional problems with the lengthy clearance process. Some are turning to more easily cleared younger workers (Wall Street Journal).
Raytheon has partnered with universities in the UK and Kuwait in an effort to increase the numbers of qualified cybersecurity professionals. The company announced that it will work with the University of Gloucestershire, Lancaster University, and Kuwait University to attract students into cybersecurity careers (PRNewswire).
There are also, in the US, state-level efforts to redress shortfalls in the labor market. The Ohio National Guard, for one, is involved in one such statewide program (Columbus Dispatch).
While the GRU may see recruiting gold in immiseration and impoverishment, NSA finds that gold at the University of Maryland Baltimore County (Federal News Network). The US Federal Government, prodded by the White House, is also encouraging tech talent from industry to consider tours in Government (Washington Post).
Mergers and acquisitions.
Applied Insight has acquired Organizational Strategies. Both companies work in the US Federal contracting space. The acquisition is expected to deliver enhanced capabilities in mission support for the US Intelligence Community (AP).
Fortinet announced its acquisition of ZoneFox, the Scottish threat-analytics startup, for initial consideration of $18 million. It's an insider-threat security play for Fortinet, which sees ZoneFox's cloud-based threat-hunting technology as complementary to Fortinet's endpoint security and SIEM offerings (CRN).
London-based identity-as-a-service shop Pirean Limited has been acquired by secure business collaboration provider Exostar (Financial News).
Bitdefender is buying RedSocks Security, a network traffic and behavior analysis start-up whose security intelligence technology is expected to complement Bitdefender's endpoint protection expertise. Terms were not immediately disclosed (CRN).
Oracle is acquiring predictive-intelligence-as-a-service shop DataFox for an undisclosed amount. Oracle expects DataFox to enhance its cloud offerings (TechCrunch).
Check Point is buying Dome9 for $175 million. It expects to integrate Dome9's advanced active policy enforcement and multi-cloud protection capabilities into its offerings. Both companies are based in Israel (SecurityWeek). The transaction was handled by the O'Melveny law firm.
Akamai has sold its Akamai Identity Services line to content security provider Verimatrix (Digital TV Europe).
Investments and exits.
CrowdStrike moves closer to an IPO. Reuters reported at the end of last week that the company had retained Goldman Sachs to organize the offering. Plans for the IPO are still in their preliminary stages and could change, but the offering is expected to take place in 2019, and the company is thought to expect a valuation of approximately $3 billion (CRN).
Cloudflare is also said to be considering an IPO, and like CrowdStrike has retained Goldman Sachs to handle the offering. The company is looking for a $3.5 billion valuation (CRN).
Wallarm, an application security shop based in California's Silicon Valley, has received an $8 million Series A round led by Toba Capital (PRWeb).
Another Silicon Valley security firm, Arctic Wolf Networks, which provides security operations center (SOC)-as-a-service, announced Thursday that it's raised $45 million in a Series C round. Future Fund led the round, with participation by Adams Street and Unusual Ventures, as well as further funding from existing investors Redpoint Ventures, Lightspeed Venture Partners, Sonae Investment Management and Knollwood Investment Advisory LLC (Arctic Wolf).
Israeli cybersecurity investment firm Team8 has established an $85-million fund with the intention of investing in eight new cybersecurity start-ups over the next five years. It's being backed by a number of large international firms, including Walmart, Airbus, Softbank Group, Moody’s Corp., Dimension Data, Munich Re, Barclays Plc and Scotiabank (Times of Israel).
MIT spinoff and blockchain shop Algorand has raised $62 million and hired some former Logmein and Fuze executives. The round was led by an international consortium of thirty investors. Algorand intends to launch its blockchain platform next year, and says it's solved the problem of making the technology simultaneously scalable, secure, and decentralized (BostInno).
And security innovation.
In the US, NIST's National Cybersecurity Center of Excellence (NCCOE) has announced its partners in a medical device security initiative, Securing Picture Archiving and Communication Systems (PACS). The companies include Cisco, Clearwater Compliance, DigiCert, ForeScout, Hyland, Symantec, TDi Technologies, Tempered Networks, Tripwire, Virta Labs, and Zingbox Security (Health IT Security).
IBM mulls app stores and thinks they may offer a wisdom of crowds with respect to data security innovation (Security Intelligence).
London's start-up ecosystem remains dynamic. The UK as a whole now has fifteen unicorns in the tech sector (Telegraph). Paris is positioning itself as a competing center of innovation (Telegraph).
Check Point co-founder Marius Nacht sees digitized healthcare and life sciences are the next major opportunity for Israeli innovation (Times of Israel).
"The Chameleon and the Snake" exercise DreamPort conducted for US Cyber Command pitted attackers against defenders, with each side challenged to create and deploy a single tool for use against the another (Fifth Domain).
