| | | | |  | | By John Sakellariadis | Presented by Raven | With help from Maggie Miller
| | | — Russian hackers are trying a new tactic: Posing as Ukrainian telecom providers to help further the goals of the invasion. HAPPY MONDAY, and welcome to Morning Cybersecurity! Is it me or is it an absolutely stunning Monday wherever this newsletter finds you? Yep, it's me. I'm officially hitched to my better half, and the world already looks brighter. In the immortal words of (TV's) Peter the Great: Huzzah! Got tips, feedback or commentary for MC? Email me at jsakellariadis@politico.com . You can also follow @POLITICOPro and @MorningCybersec on Twitter. Full team contact info is below — right beneath the world's sprightliest newsletter.
| | | | HAPPENING 9/29 - POLITICO'S AI & TECH SUMMIT : Technology is constantly evolving and so are the politics and policies shaping and regulating it. Join POLITICO for the 2022 AI & Tech summit to get an insider look at the pressing policy and political issues shaping tech, and how Washington interacts with the tech sector. The summit will bring together lawmakers, federal regulators, tech executives, tech policy experts and consumer advocates to dig into the intersection of tech, politics, regulation and innovation, and identify opportunities, risks and challenges ahead. REGISTER FOR THE SUMMIT HERE. | | | | | Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You'll also receive daily policy news and other intelligence you need to act on the day's biggest stories.
| | | Air Force Secretary Frank Kendall kicks off the Air and Space Forces Association's 2022 Air, Space and Cyber Conference at 9:15 a.m.
| | | FIRST IN MC: TELECOMS, TAKE NOTE — Russian state-sponsored hackers are masquerading as Ukrainian telecommunications organizations to conduct phishing attacks against Ukraine, analysts at Recorded Future found as part of a report out this morning. The hackers — linked to the GRU, the Russian military intelligence organization — are alleged in the report to be behind faked websites posing as telecom groups in Ukraine, sending spear phishing emails to victims in order to support actions on the ground. Analysts were not able to ascertain the victims, but they reported their findings through a liaison to Ukraine's Computer Emergency Response Team. "It's difficult to ascertain what their end goal is, but it's got a high fidelity concentration around significant entities within Ukraine itself," a Recorded Future analyst granted anonymity due to the sensitive nature of their work told Maggie. — Same old enemy: The report attributes the phishing efforts to hacking group UAC-0013, which CERT-UA has linked to Sandworm. These are the same Russian military hackers behind the 2017 NotPetya worm that caused global damage and the 2015 and 2016 attacks on energy infrastructure that temporarily turned off the lights in parts of Ukraine. In April, Ukrainian authorities linked Sandworm to an attempted attack on the Ukrainian energy sector. The Recorded Future analyst described the group as "ravenous" for Ukrainian targets since the Russian invasion began in February. Telecommunications groups have been a key target of Russian hackers throughout the conflict, and Kyivstar, Ukraine's largest mobile phone network operator, has been among the telecom groups facing significant cyber and physical threats. A senior Ukrainian official warned last week that Ukraine expects "concerted" Russian cyberattacks against key sectors in the coming months. The Recorded Future analyst stressed that cyber threats from Russia are still active. "This is still ongoing, it's still active," the analyst said. "It's not slowing down at all, their operations are continuing, and they are changing tack ever so slightly for each campaign that is occurring." READING THE RUSSIAN TEA LEAVES — Policymakers cannot mitigate Russian cyber attacks until they recognize that "Russian" cyber activity encompasses a variegated landscape of state-backed, semi-independent and independent cyber actors, according to a report out today from the Atlantic Council. The network of Russian hackers that has harried the West in recent years is "large, complex, and often opaque" argues Justin Sherman, the report's author. Beyond the operators nested within Russia's military and intelligence services, it includes front companies, patriotic hackers and cybercriminals. Problem, solution — Given the kaleidoscopic nature of the threat, Sherman recommends that U.S. and allied policymakers examine the relationship each Russian group has to the Kremlin, design group-specific responses to Russian hacking campaigns and study how Moscow views its ties to each hacking outfit.
| | | | A message from Raven: Online child exploitation is the fastest growing crime type in the world. Reports to the NCMEC CyberTipline of suspected incidents of sexual exploitation of children online increased to 29,397,681 in 2021. There are 325,000 proactive leads that lack crucial funding and policy updates to bring perpetrators and offenders to justice. That's why former law enforcement founded Raven — an advocate for stronger policies to protect children from exploitation. | | | | | | UBER? MORE LIKE OOPSBER — As more details surrounding the Uber breach spilled out over the weekend, cybersecurity experts took to Twitter to debate the "lessons learned" from Thursday's hack. But one idea brooked no dispute: what happened to Uber carries lessons far beyond Uber. First and foremost, the incident offers the latest evidence that common implementations of multi-factor authentication are highly vulnerable to compromise, even as CISA officials launch a new push to evangelize for the security measure. Specifically, hackers are becoming more adept at exploiting common forms of MFA that employ SMS-based one-time passwords or mobile push notifications . While those vulnerabilities are long known, cybercriminals have increasingly abused them this year, including in a spate of high-profile hacks by the Lapsus$ group and the massive phishing campaign that resulted in the compromise of Twilio and Signal. Last week, CISA's Cybersecurity Advisory Committee urged the agency to "ensure that companies fully adopt MFA" by 2025. But the Uber incident demonstrates that all MFA isn't created equal, meaning CISA may have a tougher hill to climb than that deadline implies. Second, Uber's response to last week's breach also highlights a major flaw in existing data breach reporting laws, whose focus on protecting specific classes of data leaves loopholes for victims to hide serious breaches. In a statement last week, Uber claimed it had no evidence the hackers accessed "sensitive user data." Uber's assertion implies the firm did not believe it was obliged to report the breach to regulators, even though the hacker appears to have had near total access to the ride-sharing giant's network. Uber did notify law enforcement about the incident on Thursday, but only after news of the incident went public. Compelling companies to offer more proactive breach notification to the government now represents a key challenge for CISA, which recently began soliciting feedback on a new incident reporting mandate. Finally, coming on the heels of Peiter Zatko's allegations of widespread security lapses at Twitter, the incident offers another hint at the surprisingly porous defenses of some of the highest profile U.S. technology companies. While key aspects of the Uber hack remain unclear, it feels safe to say that if a lone teenager can (allegedly) make quick work of a multi-billion dollar technology company, the overall state of corporate cybersecurity sits somewhere between bad and very bad.
| | | | JOIN THURSDAY FOR A GLOBAL INSIDER INTERVIEW : From climate change to public health emergencies and a gloomy global economic outlook, the world continues to deal with overlapping crises. How do we best confront all of these issues? Join POLITICO Live on Thursday, Sept. 22 at 10:30 a.m. EDT for a virtual conversation with Global Insider author Ryan Heath, featuring World Bank President David Malpass, to explore what it will take to restore global stability and avoid a prolonged recession. REGISTER HERE. | | | | | | | | GAO ON CIO — A nonpartisan congressional agency is recommending legislative and executive changes to improve federal IT management. On Friday, the Government Accountability Office published a report with survey data from private sector chief information officers and federal agency CIOs in an effort to determine what lessons private sector IT managers could offer to those pulling the strings on government networks. The report found substantial overlap in the responsibilities of federal and private sector CIOs, but key differences in their authorities and experience. One fix for Congress — To fill the authorities gap, the report recommended that Congress formalize the position of the federal CIO. At a hearing designed to coincide with the report's Friday release, however, federal CIO Clare Martorana declined to give a "yes" or "no" answer on the value of that recommendation. And one for the White House — Noting a lack of managerial experience among federal agency CIOs, the report also advised the Office and Management and Budget to codify new recruiting guidelines that would prioritize hiring CIOs with communications and management skills.
| | | | A message from Raven:   | | | | | | – How vulnerable are the world's wealthiest organizations to credential abuse? Very, say the authors of new research from cybersecurity firm Bitsight. Bitsight found that 25% of companies on the Fortune 500 had single-sign on credentials for sale on the dark web in 2022. SSO credentials present juicy targets to hackers because they act as a type of all-access pass, allowing users (or hackers impersonating those users) to employ one set of log-in credentials to access different resources across a corporate environment. – Kiwi Farms, a fringe internet forum that became notorious for organizing vicious harassment campaigns against trans individuals, suffered a data breach that could expose the identities of its users, according to a statement released by Kiwi Farms on Sunday. The hack compromised user emails, passwords and IP addresses, wrote Kiwi Farms founder Joshua Moon. It is unclear what other data was taken or who was behind the hack, added Moon, although there is no shortage of individuals and groups with an interest in going after the company.
| | | I feel like this newsletter could use another shot of positivity. How about some good news for K-12 cybersecurity?
| 
In a tweet, Director of K12 Security Information Exchange Douglas Levin celebrates what a new cybersecurity grant program will mean for K-12 cybersecurity across the country. | https://publish.twitter.com/?query=https%3A%2F%2Ftwitter.com%2Fdouglevin%2Fstatus%2F1570758876915695619&widget=Tweet | | | | — European lawmakers introduce regulation that would protect media from member-states' use of spyware. (The Record) — After their ransom efforts fail, embittered cybercriminals destroy a hotel chain's data out of spite. (BBC) — An interview with the individuals behind the Belarusian Cyber Partisans, a hacktivist collective that has launched a series of cyber operations aimed at overthrowing Europe's longest-serving autocrat. (The Record) Chat soon. Stay in touch with the whole team: Eric Geller ( egeller@politico.com); Maggie Miller (mmiller@politico.com); John Sakellariadis (jsakellariadis@politico.com); Konstantin Kakaes (kkakaes@politico.com); and Heidi Vogt (hvogt@politico.com).
| | | | A message from Raven: Raven is on a mission to end child exploitation. Spearheaded by some of the world's most respected retired child exploitation investigators, retired ICAC Commanders, sex offender treatment providers, technology innovators and policy experts in the United States, Raven brings tenacity and expertise to the fight against child predators. We envision a world where children are protected, our law enforcement has appropriate funding and resources, and policy prioritizes victims' safety.
Learn more about Raven and help stop child exploitation. | | | | | | | Follow us on Twitter | | | | Follow us | | | | |
Comments
Post a Comment