The main bridge of layer-1 blockchain between Binance Chain, Ethereum, and Bitcoin was exploited, but the BTC bridge isn’t impacted.

If you’re a fan of Battlefield 1 - and you're not alone.

Als je een fan bent van Battlefield 1 - en je bent niet de enige.

DDoS Attack by Phantom Squad: EA, Battlefield 1 servers go downIf you are an Electronic Arts (EA) customer then don’t worry you are not alone since tons of other users…

DDoS-aanval door Phantom Squad: EA, Battlefield 1 servers gaan platAls je een klant bent van Electronic Arts (EA) dan hoef je je geen zorgen te maken je bent niet alleen aangezien tonnen andere gebruikers...

DDoS Attack by Phantom Squad: EA, Battlefield 1 servers go down

If you are an Electronic Arts (EA) customer then don’t worry you are not alone since tons of other users…

Hackers Exploit Harmony’s Horizon Blockchain Bridge to Steal $100 Million

Part 1: Historic To 2022 – The Threat Of Malevolence – Information Security Buzz

In our series of letters from African journalists, writer and columnist Jonathan Marcus looks at how cyber-security is changing.

In onze reeks brieven van Afrikaanse journalisten bekijkt schrijver en columnist Jonathan Marcus hoe cyberveiligheid aan het veranderen is.

Whilst the conceptual and academic discussions around dangerous forms of code have been on the agenda of decades past, it was in 1983 when the bright young student, Fred Cohen (who I think of as a distant friend) created the first prototype virus, followed in the mid-eighties when the Sunday Times ran a very small article on the dangers of these new computer viruses – a threat in ‘those’ times which was denounced as but a passing nuisance which posed no real dangers to the world of computing. However, it was the emergence of the first big hitter boot sector viruses to arrive on removable media which changed the opinion of risk, when in 1986 in the form of Boot-Sector infector tagged Brain, the work of brothers Basit and Amjad Farooq Alvi, who ran a computer store in Pakistan. But it was the creativity of the Computer Virus Community which would go on to demonstrate that this new logical danger was more than the, assumed passing nuisance, elevating encompass Macro Viruses and eventually the intelligent crafted code of the Worm – it was time to act.

Het was echter de opkomst van de eerste grote klapper met bootsectorvirussen op verwisselbare media die de mening over risico veranderde, toen in 1986 in de vorm van Boot-Sector infector tagged Brain, het werk van de broers Basit en Amjad Farooq Alvi, die een computerwinkel in Pakistan runden. Maar het was de creativiteit van de Computer Virus Gemeenschap die zou gaan om aan te tonen dat dit nieuwe logische gevaar was meer dan de, verondersteld voorbijgaande overlast, verheffen tot Macro Virussen en uiteindelijk de intelligent vervaardigde code van de Worm - het was tijd om te handelen. 1 is een voorbeeld te zien uit een database van duizenden virale objecten die ik in de loop der jaren heb verzameld - en die een voorbeeld geven van de patronen van enorme groei in de loop der decennia - en zoals te zien is in fig.

Whilst the conceptual and academic discussions around dangerous forms of code have been on the agenda of decades past, it was in 1983 when the bright young student, Fred Cohen (who I think of as a distant friend) created the first prototype virus, followed in the mid-eighties when the Sunday Times ran a very small article on the dangers of these new computer viruses – a threat in ‘those’ times which was denounced as but a passing nuisance which posed no real dangers to the world of computing. However, what was not considered by that assessment was, society, business and more importantly Governments were moving away from the robust security imposed by the world of Mainframes and Supercomputers and were thus in a state of transition toward the lower-cost, COTS (Commercial-of-the-Shelf), cheaper, more cheerful, and what was certainly more user-friendly technology in the form of the Desktop PC, leading on eventually the interconnected architecture of Client Server environments.

It didn’t take long to realise that the assessment that these new computer viruses were, but a passing nuisance was flawed as the emergence of virial adversity started to appear on a regular basis, with several malicious objects active in the wild such as Elk Cloner (targeting Apple). However, it was the emergence of the first big hitter boot sector viruses to arrive on removable media which changed the opinion of risk, when in 1986 in the form of Boot-Sector infector tagged Brain, the work of brothers Basit and Amjad Farooq Alvi, who ran a computer store in Pakistan. Then quickly followed by mal-agents such as Jerusalem, Ping-Pong, AIDS, Michelangelo, and many, many others. But it was the creativity of the Computer Virus Community which would go on to demonstrate that this new logical danger was more than the, assumed passing nuisance, elevating encompass Macro Viruses and eventually the intelligent crafted code of the Worm – it was time to act.

Below at Fig 1 is a sample set from a database of thousands of viral objects I have collected over the years – giving an example of the patterns of enormous growth over the decades – and as can be seen at Fig 2, still active, and detectable today.

Clearly, one of the most challenging dangers of the day was the introduction and transmission of malicious objects via removable media which created a logical path from system-to-system as media was interchanged (more on that in Part 2 as this is a re-emergence in 2022). Some of the very first countermeasures to defend against this threat within military circles was to utilise simple tools, such as that shown at Fig 3 below in the form of a simple protective device which denied passing the of the Boot Sector virus.

Getting up-to Date – 22022 and beyond

Moving up to the current day of 2022, the very same threats which plagued us back in those early of days of malicious software object are still with us, but in today’s complex environments are now cloaked in a much more challenging guise!

In 2022 the malicious opportunities have gone off the scale, when compared to the early days of malicious objects in circulation – threats ranging from Cryptomining, Ransomware, conjoined with the, what seems to be continuous incursions of Phishing attacks, and the circulation of Trojans – all of which are imposing adverse conditions on our important business, and personal data objects – See Fig 5:

The Threat Landscape dictates that a solution beyond that of a tactical approach is required, with a robust strategic solution to provision a higher-level of robust defence for data at rest, and data-interaction – exchange on Removable Media.

As anyone who monitors cyber-researches will know, the current level of threats and the ingenious ways in which the attacker finds to infiltrate the local, and networked device security posture are a daily continuation of Active and Persistent Threats (APT) which are only limited by the imagination of the attacking assailant – see Fig 6 for one such example, out of a cast of many:

In fact, to understand the level of success the adverse incursion enjoys, you only need to refer to Fig 7 which provides the view ofprima facie insecurity of a big brand, global organisation.

Looking at the output from the BreachAware scrape, here we have a very high-profile company who are situated in the Credit References tier; here we may conclude that they are also the custodians of the data of just about every subscribed UK resident, and beyond. Thus, where we note they have suffered a total of 10,367 security breaches, and have leaked 39,044 data items and objects, it is an assumption that such details (adverse intelligence) will go on to suffer secondary levels of abuse in the hands of their new, unauthorised custodians – here the implication is again, the end target cyber-exposure to abuse rises by a factor of the unknown.

The World of Cyber Security Has Moved On

Granted, the world of Cyber Security and defensive applications has moved on from the old days of malicious objects going into circulation in the wild – yet the levels cyber insecurity have increased, and have now reached a position which may suggest, digital-insecurity is out of control. For example, whilst it is not uncommon to find that the Operating System (O/S) of choice for Corporate, SME, and Government alike is of course Windows, it should be a grave concern that in 2022 at the Pwn2Own Vancouver Hacking Contest, Security Researchers were able to successfully hack this new shiny Flagship of Microsoft, Windows 11 O/S no less than three times using Zero-Day exploits. Here the world of cyber security may be exemplified as has not moving on far enough!

When looking toward the SME, compared to their larger corporate counterparts, they tend to be obviously lacking in the aspect of disposable budgets to invest in their Cyber Security Posture. Furthermore, with their smaller capacities in the areas of Human Resources and Skills, they are again, clearly behind the curve of their larger corporate communities, and are not thus as well equipped to defend themselves from the almost daily ingress cyber security threats.

SMEs are increasingly moving to e-commerce and digitising their business. Moreover, they are largely dependent on their phones to do business, whether it is sending emails or conducting online transactions, all of which expand their exposure to malware. Again, through what has been assessed as lower-levels of Security Awareness in the SME community, the likelihood of an increased threat posed by the existing potential ease of downloading malware secreted away by innocent-looking apps, emails, or an URL, the average SMEs are very exposed to all forms of cyber-compromise.

SME Managing Director Comment: ‘I don’t have time to over focus on Cyber Security – all my main resource is focused on producing goods, to generate income – I just hope that my small business does not fall to the attention of, what people call hackers’

Possibly, that sentiment is further demonstrated by the results of a CNBCI Survey Monkey survey taken from 2,000 SME, of which only 5% of owners considered cybersecurity to be a big risk (see URL below). However, it needs to be acknowledged that a Cyber Attack can cripple a small business, be that in the form of compromised data, reputational damage, the loss of clients, right down to a state in which recovery is beyond reach – endgame!

Travelling Users and Executives are always a potential target. One Achilles heel can be the data that is being carried – maybe on a laptop with a hard drive storing data in open format, protected only by say a Windows User ID and associated password, or maybe on a USB key, or other form of storage. When it comes to physical aspects, such systems may be stored in the aircraft hold, or the overhead locker – and remembering that our user may be using forms of open public WiFi environment – add to this the need to charge their devices from public power charging portals, and the risk of potential insecurity to creep into the traveling experience increases to a commensurate level of multi-factored exposure.

The Corporates, Big Businesses and Others

Within the Corporate sector you would expect to discover more cyber-resilience, yet this is not always the case. To exemplify one such bad example, I look back to the big-name brand who own a chain of public houses (pubs to you and me) and a global coffee shop brand. The Cyber Security Team, from Manager down were aware that there was a dormant Ransomware agent residing on one of their servers, which they chose to ignore for two reasons:
• The server we tagged for decommissioning, so why waste time?

What was not anticipated was, a wondering browsing user would discover this interesting looking file, and with one click lock down 7 servers in the logical path of the agent, some of which were critical – going on to takeout a POS (Point of Sale) system at a remote site located in the East Midlands (UK), at which point the Ransomware agent then disabled the local Anti-Malware/Virus application, and mailed out the stored user data, including personal and credit card details – again, being sent onto the potential of secondary level abuse.

In Part 2, with a little creative imagination, we will be considering the methodologies which may be applied to not only secure the data objects from prying eyes and abuse, but will also be considering the application of technology we may already own to secure our precious data-objects from compromise and abuse by APT’s and other forms of dangerous logic such as Ransomware – and look to develop a strategy which may be embed the practice of developed operational robust security practices into the daily lifecycle of securing and protecting our data. It can be done, we just may have to accept a different approach to delivering, what may move one step closer to robust cyber resilience.

Een groep aanvallers die verantwoordelijk was voor de grote Exchange-aanval van vorig jaar en ook andere zerodaylekken heeft ...

Microsoft has published a blog post that reveals how it uses the Hafnium group to hide activity on Windows systems.

Microsoft heeft een blogbericht gepubliceerd waarin wordt onthuld hoe het de Hafnium-groep gebruikt om activiteit op Windows-systemen te verbergen.

Bij slachtoffers ontdekte Microsoft een malware-exemplaar genaamd Tarrask dat via de Windows Task Scheduler taken aanmaakt om toegang tot de computer te behouden. Volgens het techbedrijf laat het gebruik van de Windows Taakplanner op deze manier zien dat de Hafnium-groep een unieke kennis van het Windows-subsysteem heeft en deze expertise gebruikt om de activiteiten op besmette systemen te verbergen en toegang te behouden. Daarnaast geeft het techbedrijf tips om de beschreven activiteiten van de Hafnium-groep te detecteren.

Among victims, Microsoft discovered a malware copy called Tarrask that creates tasks through the Windows Task Scheduler to maintain access to the computer. Through the Task Scheduler it is possible to perform all kinds of tasks. According to the tech company, using the Windows Task Scheduler in this way shows that the Hafnium group has a unique knowledge of the Windows subsystem and uses this expertise to hide activity on infected systems and maintain access.

Bij slachtoffers ontdekte Microsoft een malware-exemplaar genaamd Tarrask dat via de Windows Task Scheduler taken aanmaakt om toegang tot de computer te behouden. Via de Taakplanner is het mogelijk om allerlei taken uit te voeren. De malware gebruikt dit echter als een "persistence mechanism", zo laat Microsoft weten. Zo worden bij het aanmaken van een nieuwe taak verschillende registersleutels aangemaakt.

Volgens het techbedrijf laat het gebruik van de Windows Taakplanner op deze manier zien dat de Hafnium-groep een unieke kennis van het Windows-subsysteem heeft en deze expertise gebruikt om de activiteiten op besmette systemen te verbergen en toegang te behouden. "We erkennen dat geplande taken een effectieve tool voor aanvallers zijn om bepaalde taken te automatiseren om persistentie te bereiken", aldus Microsoft, dat met de nu gepubliceerde blogposting meer bewustzijn over deze techniek wil creëren. Daarnaast geeft het techbedrijf tips om de beschreven activiteiten van de Hafnium-groep te detecteren.

Microsoft waarschuwt voor malware die "verborgen" geplande taken gebruikt - Security.NL

A security vulnerability has been fixed in the F-secure Support tool.

Er is een beveiligingslek verholpen in het F-secure ondersteuningsprogramma.

Er is een kwetsbaarheid verholpen in de F-Secure Support tool, welke wordt gebruikt in Business Suite- en consumentenproducten. F-Secure heeft een update beschikbaar gesteld waarmee de beschreven kwetsbaarheid wordt verholpen. De producten Elements Agent, MDR en alle consumentenproducten ontvangen automatisch updates om de kwetsbaarheid te verhelpen.

A vulnerability has been fixed in the F-Secure Support tool, which is used in Business Suite and consumer products. F-Secure has made available an update that fixes the described vulnerability. Elements Agent, MDR and all consumer products will automatically receive updates to fix the vulnerability.

Er is een kwetsbaarheid verholpen in de F-Secure Support tool, welke wordt gebruikt in Business Suite- en consumentenproducten. Een geauthenticeerde kwaadwillende kan de kwetsbaarheid mogelijk misbruiken om willekeurige code uit te voeren onder hogere rechten. F-Secure heeft een update beschikbaar gesteld waarmee de beschreven kwetsbaarheid wordt verholpen. De producten Elements Agent, MDR en alle consumentenproducten ontvangen automatisch updates om de kwetsbaarheid te verhelpen. Voor de producten Client Security, Server Security en Email and Server Security is een update beschikbaar die handmatig geinstalleerd dient te worden. Voor meer informatie, zie [Link] Onderstaande tabel geeft in detail aan hoe wij tot de inschatting zijn gekomen hoe groot de kans is dat deze kwetsbaarheid in het doorsnee praktijkgeval kan worden misbruikt. De punten worden bij elkaar geteld. Hoe moeilijk is het om de kwetsbaarheid uit te buiten? Is er een oplossing beschikbaar? Onderstaande tabel geeft in detail aan hoe wij tot de inschatting zijn gekomen voor de schade die bij een succesvolle aanval kan ontstaan. De hoogste inschaling bepaalt de totale kans op schade.

Door gebruik van deze security advisory gaat u akkoord met de navolgende voorwaarden. Ondanks dat het NCSC de grootst mogelijke zorg heeft betracht bij de samenstelling van dit beveiligingsadvies, kan het NCSC niet instaan voor de volledigheid, juistheid of (voortdurende) actualiteit van dit beveiligingsadvies. De informatie in dit beveiligingsadvies is uitsluitend bedoeld als algemene informatie voor professionele partijen. Aan de informatie in dit beveiligingsadvies kunnen geen rechten worden ontleend.

 Het NCSC en de Staat zijn niet aansprakelijk voor enige schade ten gevolge van het gebruik of de onmogelijkheid van het gebruik van dit beveiligingsadvies, waaronder begrepen schade ten gevolge van de onjuistheid of onvolledigheid van de informatie in dit beveiligingsadvies.

 Op dit beveiligingsadvies is Nederlands recht van toepassing. Alle geschillen in verband met en/of voortvloeiend uit dit beveiligingsadvies zullen worden voorgelegd aan de exclusief bevoegde rechter te Den Haag. Deze rechtskeuze geldt tevens voor de voorzieningenrechter in kort geding.

NCSC Advisories

Next time you are looking at an alert, how confident are you in what you are seeing? 20%, 40%, 70%? If that figure isn’t high enough, you will always need to ask a human to validate it, and this operational inefficiency prevents us from being able to scale along with the threats...

In our series of letters from African journalists, Steve Peters explains why cybersecurity is a problem.

In onze serie brieven van Afrikaanse journalisten legt Steve Peters uit waarom cyberveiligheid een probleem is.

Over the years I have seen hundreds of companies trial and deploy cybersecurity capabilities, and whilst these evolve, the selection criteria and metrics of success has stayed more static. Meeting with executives at events such as the World Economic Forum, I often get asked what is the one metric I should use to measure success. For me, there is one that is all too often overlooked and ties into another metric that is also too often glossed over: Detection Efficacy.

Bij ontmoetingen met executives op evenementen zoals het World Economic Forum, krijg ik vaak de vraag wat de enige maatstaf is die ik moet gebruiken om succes te meten. Voor mij is er een die al te vaak over het hoofd wordt gezien en die verband houdt met een andere metriek die ook al te vaak wordt verdoezeld: Opsporingsefficiëntie. Ik herinner me dat nog niet zo lang geleden een organisatie een aantal tests deed en zij kwamen terug met de verklaring dat min of meer iedereen dezelfde bedreigingen vond.

Over the years I have seen hundreds of companies trial and deploy cybersecurity capabilities, and whilst these evolve, the selection criteria and metrics of success has stayed more static. Meeting with executives at events such as the World Economic Forum, I often get asked what is the one metric I should use to measure success.

This is not a simple question, and I can guarantee many of you would have differing answers. For me, there is one that is all too often overlooked and ties into another metric that is also too often glossed over: Detection Efficacy.

All too often, I see testing that is capability based rather than usability. I remember not so many years ago, an organization doing some testing and they came back with the statement that more or less everyone found the same threats. I have to say, I was somewhat shocked by their answer. So I started to dig into their statement, and I found that they had a team of ten testing capabilities, whereas when deployed the solution would be 50% of one person's job.

Furthermore, while in the end the results were similar, the journey to get there was very different. Some had triggered thousands of alerts, and others millions. This would mean that you would need a lot more human power to process one solution output to the next. So the time to resolution, which is a metric that is very commonly used in SOC teams MTTD and MTTR (mean time to detect and mean time to respond) would be very different.

Why Not Simply Use These Metrics?

I was sat with a group of CISOs not so long ago, and we all agreed that there simply isn’t the human capacity to scale to the needs to today's SOC, as the volume of threats, security tools and things we need to protection–and the time the business allows for MTTD and MTTR gets shorter.

This is the time-paradox problem we face. The only way we solve this challenge is to reduce the number of alerts that require human inspection. We must start to automate some of the simpler levels of detection and response.

Why Don’t We Do This?

If we know we have to make this shift, you can rightfully ask why we are not making better headway. The answer is detection efficacy; talk to most analysts and they will always prefer to have human inspection, cross-checking to ensure we have made the right determination.

This goes back to simple psychology: we are five times more worried about being seen to have made the wrong decision, as we are of getting it right. If you don’t believe me, go read The Chimp Paradox by Steve Peters.

Today's threats are complex, there is no denying it. I go back 30 years, and you could find something unique in each threats’ code (typically a standalone binary) and be confident in knowing what you found. Today, threats are made up of many components that occur in different places both on and off your end-device.

So, knowing if you have a specific threat has become an ever more complex jigsaw puzzle. You need to put enough pieces of the puzzle (different detection alerts) together to have the confidence that what you are seeing is what is definitely there.

I challenge you next time you are looking at an alert: could you put a figure on the detection efficacy? How confident are you in what you are seeing? If that figure isn’t high enough, you will always need to ask a human to validate it.

This becomes a self-propagating problem, as the more alerts that require human inspection, the slower you are to validate the problem, and typically the more you add in incremental tools to spot the problem, but end up simply duplicating the detections.

Having two solutions both give you an answer that you are 40% confident in does not add up to suddenly being 80% confident, as they may be duplications or they could be two disparate things. The only way to confirm a correlation between them is through more human effort.

If we are not able to scale to future demand as the cyber-time paradox problem will only ever get worse (sorry, that's just simple math), we will have to leverage automation to help us scale. If at every stage we require human intervention, that can never happen.

As such we must start to focus on the efficacy of detection. This is both evidence of how often the determination of a threat is right versus wrong technically, but I would challenge it's just as much physiological: if we don’t trust the tools, we will always want humans to validate.

This is the core of how we detect the process, and if we get this right, the outcome will surely improve through less false positives and other noise so teams can scale, and they can focus on the complex problems. With less noise, the MTTD and MTTR inherently improves, and where we have the confidence to truly take the human out of the equation, we can make huge strides forwards.

I’m sure some of you will still argue that for CEOs and other executives– there is a better metric, something along risk lines etc. But businesses inherently take risks, that's typically where the greatest margins can be made. The key being they understand risks. In cyber, if we can’t understand if the problem is real or not, honestly we can’t determine if the risk is real or not, effectively neutering our ability to make any decision.

At Cybereason, we have found that rather than by looking at retrospective threat artifacts and Indicators of Compromise from known attacks, it is more efficient and effective to detect the whole malicious operation (MalOp), and in doing so we have reduced the number of alerts anlaysts have to triage and investigate by a factor of 10X or greater.

Furthermore, the efficacy of those detections moves from the 20-30% confidence level to the 70-80% level, simply by both checking the efficacy at each stage and then building the complex puzzle of pieces into a MalOp. This is how automation enables detection efficacy and allows a security team to scale.



Cybereason is dedicated to teaming with Defenders to end attacks on the endpoint, across enterprise, to everywhere the battle is taking place. Learn more about the AI-driven Cybereason Defense Platform here or schedule a demo today to learn how your organization can benefit from an operation-centric approach to security.

Why Detection Efficacy Should Be in Your Top Metrics

Ukrainian strikes are reported in Russian rear areas. Retaliatory Russian missile fire hits towns near the Belarusian border. Microsoft identifies and disrupts a Russian cyberespionage and influence operation.

The attacks on a Russian military base in Crimea appear to have been linked to espionage, according to the Ukrainian government. The BBC's Alexei Lavrov looks at the impacts of the attack.

De aanvallen op een Russische militaire basis op de Krim lijken volgens de Oekraïense regering te maken te hebben met spionage. Alexei Lavrov van de BBC kijkt naar de gevolgen van de aanval.

Russia's Black Sea Fleet seems to have pulled in its horns, restricting its activities to coastal patrols off Crimea. This morning's situation report from the UK's Ministry of Defence draws some conclusions about how this will continue to limit Russian power projection along the Black Sea coast. The Black Sea Fleet continues to use long-range cruise missiles to support ground offensives but is currently struggling to exercise effective sea control.

De Zwarte Zeevloot van Rusland lijkt de hoorns te hebben aangetrokken en beperkt zijn activiteiten tot kustpatrouilles voor de kust van de Krim. In het situatierapport van het Britse Ministerie van Defensie van vanmorgen worden enkele conclusies getrokken over de wijze waarop dit de Russische machtsprojectie langs de Zwarte-Zeekust zal blijven beperken. De huidige beperkte doeltreffendheid van de Zwarte Vloot ondermijnt de algemene invasiestrategie van Rusland, ten dele omdat de amfibische dreiging voor Odesa nu grotendeels is geneutraliseerd.

Russia's Black Sea Fleet seems to have pulled in its horns, restricting its activities to coastal patrols off Crimea. This morning's situation report from the UK's Ministry of Defence draws some conclusions about how this will continue to limit Russian power projection along the Black Sea coast. "The surface vessels of Russia’s Black Sea Fleet continue to pursue an extremely defensive posture, with patrols generally limited to waters within sight of the Crimean coast. This contrasts with heightened Russian naval activity in other seas, as is typical for this time of year. The Black Sea Fleet continues to use long-range cruise missiles to support ground offensives but is currently struggling to exercise effective sea control. It has lost its flagship, MOSKVA; a significant portion of its naval aviation combat jets; & control of Snake Island. The Black Fleet’s currently limited effectiveness undermines Russia’s overall invasion strategy, in part because the amphibious threat to Odesa has now been largely neutralised. This means Ukraine can divert resources to press Russian ground forces elsewhere." (It not only limits amphibious threats, but also seaborne resupply of Russian forces in the southern portions of Ukraine.)

More strikes hit Russian command posts and rear areas; Russia retaliates against Ukrainian towns in Zhytomyr.

A large ammunition storage facility in Russian-occupied Crimea was largely destroyed in a series of explosions, Reuters reports, and there was comparable damage at an airbase in the occupied province as well. The Guardian summarizes this morning's action in Crimea. "The attacks on Russian-occupied Crimea appear to be escalating. The first took place at an ammunitions depot near Dzhankoi in the north, damaging a railway station and wounding two. Next, there were reports of an explosion about 58 miles (93km) south in Simferopol. Now, there are reports of explosions and black smoke at a military airbase in Gvardeyskoye, near the middle of the region."

Ukrainian officials haven't directly claimed credit for the strikes (which Russia denounced as "sabotage") but their applause, as quoted by Reuters, leaves little doubt as to the origins of the attacks. "Operation 'demilitarisation' in the precise style of the Armed Forces of Ukraine will continue until the complete de-occupation of Ukraine's territories. Our soldiers are the best sponsors of a good mood," Ukrainian presidential chief of staff Andriy Yermak posted to Telegram. "Demilitarisation," of course, has been one of the often-repeated Russian justifications for its special military operation.

In Luhansk, the Guardian reports that a Ukrainian strike hit the Popasna headquarters of the Wagner Group, the private military company that's been providing frontline manpower to Russian forces as regular formations undergo reconstitution. The headquarters' location is thought, Ukrainska Pravda says, to have been compromised by imagery posted in Russian television news reports on the fighting, puff pieces that appear to have had lethal effect. The Telegraph quotes local Ukrainian officials who estimate that Russian casualties from the HIMARS strike amounted to about a hundred. There are rumors, widely circulated but unconfirmed, that Wagner Group boss Yegveny Prigozhin was killed in the strike, but those rumors are so consistent with wishful thinking on the part of Ukraine and its sympathizers that they should be treated with a degree of skepticism. The Telegraph has an account of the Russian media posts that apparently gave away the headquarters' location:

"The attack came a few days after a pro-Kremlin journalist published several photos from a secret base, writing on his social media: 'I arrived in Popasna. Went to Wagner’s HQ. They greeted me like family, told me a few funny stories.'

"The Russian reporter also posted a few photos that revealed the exact location of the base.

"In one of them, Russian mercenaries were seen standing next to a building with shattered windows. The address was visible on a plaque near the front door.

"In another picture, Mr Prigozhin was seen shaking the hand of a uniformed man."

Other strikes have occurred within Russia proper. The Kyiv Independent, citing Russian media reports, claims that a freight railway line in the Kursk oblast was hit this morning tweeting, "Unidentified individuals in Russia's Kursk Oblast on Aug. 16 blew up a part of a railway only used for freight trains, Russian media Baza reported." Kursk is east of Kyiv and north of Kharkiv, and well inside Russian territory.

Russia has retaliated with missile strikes against Ukrainian towns near Belarus. Journalist Olga Tokariuk tweeted this morning, "All Ukraine under an air raid alert now. Explosions as a result from missile strikes reported in the northern Zhytomyr region, bordering Belarus. In the last days, Russia brought a lot of equipment and weapons to Belarusian airfields with a plan to launch more missiles on Ukraine."

Microsoft yesterday outlined recent activity of the Russian government threat actor Redmond calls "SEABORGIUM." The company's report begins, "The Microsoft Threat Intelligence Center (MSTIC) has observed and taken actions to disrupt campaigns launched by SEABORGIUM, an actor Microsoft has tracked since 2017. SEABORGIUM is a threat actor that originates from Russia, with objectives and victimology that align closely with Russian state interests. Its campaigns involve persistent phishing and credential theft campaigns leading to intrusions and data theft."

As is typically the case, different researchers track this (and possibly other, related activities) by different names. "SEABORGIUM overlaps with the threat groups tracked as Callisto Group (F-Secure), TA446 (Proofpoint) and COLDRIVER (Google). Security Service of Ukraine (SSU) has associated Callisto with Gamaredon Group (tracked by Microsoft as ACTINIUM); however, MSTIC has not observed technical intrusion links to support the association."

The group's targets have been found for the most part in the US, the UK, and other NATO allies who support Ukraine during the present war. “SEABORGIUM primarily targets NATO countries, particularly the US and the UK, with occasional targeting of other countries in the Baltics, the Nordics, and Eastern Europe," the report says. “Such targeting has included the government sector of Ukraine in the months leading up to the invasion by Russia, and organizations involved in supporting roles for the war in Ukraine.”

The group gains access through social engineering, phishing campaigns that have targeted both organizations and specific individuals. There's some appearance of linkage to conventional criminal activity, but this seems likely to represent either opportunistic collaboration with gangs or deliberate misdirection. The motives appear to be espionage and influence. "SEABORGIUM intrusions have also been linked to hack-and-leak campaigns, where stolen and leaked data is used to shape narratives in targeted countries. While we cannot rule out that supporting elements of the group may have current or prior affiliations with criminal or other nonstate ecosystems, MSTIC assesses that information collected during SEABORGIUM intrusions likely supports traditional espionage objectives and information operations as opposed to financial motivations."

SEABORGIUM's contribution to disinformation and information operations is interesting. "In late May 2022, Reuters along with Google TAG disclosed details about an information operation, specifically using hack and leak, that they attributed to COLDRIVER/SEABORGIUM. Microsoft independently linked SEABORGIUM to the campaign through technical indicators and agrees with the assessment by TAG on the actor responsible for the operation. In the said operation, the actors leaked emails/documents from 2018 to 2022, allegedly stolen from consumer Protonmail accounts belonging to high-level proponents of Brexit, to build a narrative that the participants were planning a coup. The narrative was amplified using social media and through specific politically themed media sources that garnered quite a bit of reach."

Microsoft's report includes a caution against spreading the narratives that it links to the threat group. "While we have only observed two cases of direct involvement, MSTIC is not able to rule out that SEABORGIUM’s intrusion operations have yielded data used through other information outlets. As with any information operation, Microsoft urges caution in distributing or amplifying direct narratives, and urges readers to be critical that the malicious actors could have intentionally inserted misinformation or disinformation to assist their narrative. With this in mind, Microsoft will not be releasing the specific domain or content to avoid amplification."

What has Microsoft done to disrupt SEABORGIUM? "As an outcome of these service abuse investigations, MSTIC partnered with abuse teams in Microsoft to disable accounts used by the actor for reconnaissance, phishing, and email collection. Microsoft Defender SmartScreen has also implemented detections against the phishing domains represented in SEABORGIUM’s activities."

Ukraine at D+173: OSINT for targeting; espionage and influence ops.

Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers

Google Chrome has been damaged by a bug that appears to be responsible for the Chinese Olympics.

Google Chrome is beschadigd door een bug die verantwoordelijk lijkt te zijn voor de Chinese Olympische Spelen.

Whitepaper called Race Against the Sandbox - Root Cause Analysis of a Tianfu Cup bug that used a Ntoskrnl bug to escape the Google Chrome sandbox.

Whitepaper genaamd Race tegen de Sandbox - Analyse van de hoofdoorzaak van een Tianfu Cup bug die een Ntoskrnl bug gebruikte om te ontsnappen aan de Google Chrome sandbox.

Race Against The Sandbox ≈ Packet Storm

Drones have played an outsized role in Ukraine’s efforts to locate troops and plan out attacks in its war with Russia. But the devices are increasingly thwarted by an invisible enemy: Russia’s electronic warfare arsenal.

Ukrainian drones are increasingly being used by Russian military forces, according to researchers.

Oekraïense drones worden volgens onderzoekers in toenemende mate door Russische strijdkrachten gebruikt.

How electronic warfare is reshaping the war between Russia and UkraineDrones have played an outsized role in Ukraine’s efforts to locate troops and plan out attacks in its war with Russia. Electronic warfare systems have been used by both Russia and Ukraine in recent months to locate, disrupt and jam electronic and GPS signals from weapons and drones. Electronic warfare systems use signals such as radar, radio, and infrared transmissions to detect, interpret and disrupt communication.

Hoe elektronische oorlogsvoering de oorlog tussen Rusland en Oekraïne een nieuwe vorm geeftDrones hebben een grote rol gespeeld in de pogingen van Oekraïne om troepen te lokaliseren en aanvallen te plannen in de oorlog met Rusland. Zowel Rusland als Oekraïne hebben de afgelopen maanden systemen voor elektronische oorlogvoering gebruikt om elektronische en GPS-signalen van wapens en drones te lokaliseren, te verstoren en te storen. Elektronische oorlogsvoeringssystemen maken gebruik van signalen zoals radar, radio en infrarood om communicatie op te sporen, te interpreteren en te verstoren.

How electronic warfare is reshaping the war between Russia and Ukraine

Drones have played an outsized role in Ukraine’s efforts to locate troops and plan out attacks in its war with Russia. But the devices are increasingly thwarted by an invisible enemy: Russia’s electronic warfare arsenal.

Electronic warfare systems have been used by both Russia and Ukraine in recent months to locate, disrupt and jam electronic and GPS signals from weapons and drones. The systems can be used by aircraft, naval ships, ground forces, and helicopters, according to Samuel Bendett, an analyst and expert in unmanned and robotic military systems at the Center for Naval Analyses.

Electronic warfare systems use signals such as radar, radio, and infrared transmissions to detect, interpret and disrupt communication. The stations detect enemy electronic signals and attack the equipment emitting them essentially with white noise, which makes them inoperable.

Although both countries have made use of the technology, Russia in particular has invested in a wide range of equipment — from tactical close-range systems to ones that can supposedly disrupt enemies dozens of kilometers away, Bendett said. And Russia has increasingly made use of these systems as cyberattacks and ground strikes against Ukraine’s communications infrastructure have proved to have limited impact.

“[When] they realized that wasn’t enough, they turned to electronic warfare,” said Makena Young, associate fellow with the Aerospace Security Project at the Center for Strategic and International Studies (CSIS).

Electronic warfare technology isn’t particularly new: Even before the war, Russia actively promoted its electronic warfare systems, according to Valentyn Badrak, director at Ukrainian Center for Army Conversion and Disarmament Studies. It used some of the same systems in previous conflicts, including the invasion of Crimea and eastern Ukraine in 2014 and the Syrian civil war in 2015.

But the systems have seen particularly heavy use in recent months as Russia looks to disrupt Ukraine’s drone strategy.

Ukrainian charities have raised millions of dollars to purchase and develop unmanned aerial vehicles, and the country has launched piloting schools, including Dronarium and Boryviter, to train hundreds of professional drone operators.

More than 400 pilots graduated from these two schools in July, according to the Ukrainian Digital Transformation Ministry.

Ukraine has no centralized supply of drones for the army — some soldiers buy drones themselves, and others receive them from friends, family or charitable funds. Small commercial drones, such as DJI quadcopters, are not designed for war, and make easy targets for sophisticated electronic warfare attacks, according to Bendett.

In addition to small commercial drones used for surveillance, Ukraine’s drone fleet has combat UAVs, like the Turkish Bayraktar TB2 and R18 developed by the Ukrainian drone unit Aerorozvidka.

But drone operators have found it difficult to keep these devices in the air.

“There are entire segments of the front where [Ukrainian drone operators] can’t fly their drones since they are getting jammed by the Russian EW forces,” Bendett said.

The Russian military is currently deploying Krasukha-2 and 4, R-330 Zhitel, Moskva-1, Leer-3, RP-377L/LA Lorandit, and Pole systems, among others, according to Bendett. They primarily target mobile networks, satellite navigation, and communication between drones and their operators, he said.

Electronic warfare systems have already had a major impact, Ukrainian drone operators told The Record. Russia has claimed to have destroyed at least 1,700 Ukrainian drones since the start of the war, although Ukraine hasn’t confirmed this figure.

“To say how many drones we lost, we need to know how many of them we had at the beginning of the war,” said Vadym, the head of the robotics department at Aerorozvidka, who asked to go by his first name due to security reasons.

Although Russia has many strengths with electronic warfare, Ukraine is trying to catch up, according to Badrak.

The Ukrainian electronic warfare arsenal is similar to Russia’s — both countries inherited much of the technology from the USSR and developed systems together prior to the war. In Ukraine, the systems are developed by two private companies — Ukrspetszvyazok and Proximus. Among the most popular, uniquely Ukrainian electronic warfare systems, according to Badrak, are Enclave, Bukovel, and Prometheus-MF5.

But Ukrainian systems face several challenges. Russia’s most commonly-used drone in Ukraine, dubbed “Orlan,” can fly at an altitude of 5,500-6,500 meters, where Ukrainian electronic warfare systems can’t reach, Ukrainian Colonel Dmytro Kashchenko said in an interview with the Ukrainian media.

Another challenge for the Ukrainian army is Russia’s possible deployment of Iranian drones on the battlefield, which are more resistant to electronic warfare systems, according to Badrak. Russia has reportedly signed a contract with Iran to buy 1,000 drones for its army, according to war correspondent Elijah J. Magnier.

In addition to disrupting drones, electronic warfare has been used to block communications in Ukraine.

Because of this, most of the Ukrainian military uses the U.S. L3Harris systems, which are more secure, according to Badrak. Ukrainians also use Elon Musk’s satellite internet Starlink, which is not as affected by Russian electronic warfare systems. “The Russians can locate Starlink terminals, but deciphering the internet stream is very difficult, so we recommend using them,” according to Vadym from Aerorozvidka.

Musk has tweeted that the systems have been targeted by attacks. “Starlink has resisted Russian cyberwar jamming and hacking attempts so far, but they’re ramping up their efforts,” he wrote.

Although some alternative communication channels exist, there isn’t always a way for Ukrainians to protect themselves from Russian electronic warfare systems, according to Bendett. Improving defense involves masking, protecting, and limiting “electronic signatures,” including radio and cellular communications and electronic signals emitted by combat vehicles and systems, he said.

According to Young, “the best way to protect yourself from EW is to make sure your equipment is less vulnerable to these systems and that all of your communications are secure.”

Electronic warfare-resistant equipment is already under development. U.K.-based technology and defense aerospace company QinetiQ, for example, has introduced a new laser-controlled drone that can eliminate the radio connection.

“Most drone manufacturers have taken notice and will look for ways to avoid the impact of EW,” according to Vadym. “There is a solution to any problem, but it takes time,” he said.

For now, the conflict is revealing what war will look like in the future, according to Young.

“Space and cyber capabilities have been used during this war in ways we have never seen before. It’s a quick and easy way to disrupt someone’s communication,” she told The Record.

How electronic warfare is reshaping the war between Russia and Ukraine

De tarieven voor vaste en mobiele breedband lopen in Europese Unie flink uiteen. Waar België behoort tot de duurste landen, daar staat Nederland te boek ...

The Netherlands is one of the most expensive countries in the European Union.

Nederland is een van de duurste landen in de Europese Unie.

De tarieven voor vaste en mobiele breedband lopen in Europese Unie flink uiteen. Dit blijkt uit een uitgebreide studie van de Europese Commissie naar de prijzen van vaste en mobiele internet. België kent op gebied van breedband-internet geen goedkope of relatief laag geprijsde aanbiedingen.

This is according to a comprehensive study by the European Commission on fixed and mobile internet prices. Belgium has no cheap or relatively low-priced offers in terms of broadband internet. Mobile broadband Internet is also expensive, as it is in France, Greece, Portugal and Croatia.

De tarieven voor vaste en mobiele breedband lopen in Europese Unie flink uiteen. Waar België behoort tot de duurste landen, daar staat Nederland te boek als relatief goedkoop.

Dit blijkt uit een uitgebreide studie van de Europese Commissie naar de prijzen van vaste en mobiele internet.

België kent op gebied van breedband-internet geen goedkope of relatief laag geprijsde aanbiedingen. Ook voor geconvergeerde aanbiedingen zoals triple play of quadruple pay moet de consument flink in de buidel tasten. Koopjes zijn in België niet te vinden. Mobiel breedband-internet is eveneens duur, net als in Frankrijk, Griekenland, Portugal en Kroatië. Nederland behoort samen met onder meer Duitsland, Ierland en Luxemburg op dit gebied tot de groep van relatief goedkope landen. Echt voordelig uit ben je in Spanje, Polen en Zweden. Nederland kent in het bijzonder aantrekkelijke prijzen als het gaat om dikke of heel dikke bundels (20 GB).

Over de hele linie genomen, kennen Litouwen en Roemenië de beste tarieven voor breedband-internet in de EU. Alle aanbiedingen behoren in beide landen tot de cluster van goedkoopste tarieven, zo leert een uitgebreide vergelijking. Per land verschilt het nogal voor wat voor soort aanbieding je kiest. Triple play is relatief laag geprijsd in Frankrijk en Spanje. Bundels met een lage bandbreedte zijn voordelig in Oostenrijk en Griekenland. Wil je snelheden van boven de 100 Mbps, dan ben je daar relatief duur uit. Ook in België moet je voor premium mobiele breedband stevig betalen. Deze tarieven liggen daar aanzienlijk boven het Europese gemiddelde.

Belg flink duurder uit met breedband dan Nederlander

We first spoke with Russian business owner Stanislav back in early March, shortly after Russia’s invasion of Ukraine. Almost six months later, we check back in with him to see how he’s doing, and look at a new report that suggests the Russian economy is cratering. Plus, inside a massive breach affecting a police database in Shanghai.

The Russian economy is being hit by sanctions, according to a leading economist.

De Russische economie wordt getroffen door sancties, aldus een vooraanstaand econoom.

For months, Russian President Vladimir Putin has insisted that his country’s economy — facing sanctions, hundreds of global companies pulling out and a shortage of manufacturing materials — is doing just fine. Stanislav, whom The Record only identifies by first name to protect his safety, owns an online marketing business in St. Petersburg, Russia. Back in March, he spoke with the Click Here podcast about Russia’s invasion of Ukraine and the ensuing sanctions, which were already eating away at his bottom line.

Maandenlang heeft de Russische president Vladimir Poetin volgehouden dat de economie van zijn land - die te maken heeft met sancties, de terugtrekking van honderden mondiale bedrijven en een tekort aan productiemiddelen - het prima doet. Stanislav, die in The Record alleen bij zijn voornaam wordt genoemd om zijn veiligheid te beschermen, is eigenaar van een online marketingbedrijf in Sint-Petersburg, Rusland. In maart sprak hij met de Click Here podcast over de Russische invasie in Oekraïne en de daaruit voortvloeiende sancties, die al een zware wissel trokken op zijn resultaten.

For months, Russian President Vladimir Putin has insisted that his country’s economy — facing sanctions, hundreds of global companies pulling out and a shortage of manufacturing materials — is doing just fine.

But according to economists — and everyday Russians — that’s not the full story.

Stanislav, whom The Record only identifies by first name to protect his safety, owns an online marketing business in St. Petersburg, Russia. Back in March, he spoke with the Click Here podcast about Russia’s invasion of Ukraine and the ensuing sanctions, which were already eating away at his bottom line.

Today, those sanctions are hitting the small business owner even harder.

“It’s reducing 20% of my revenues,” he said in July, explaining that his foreign customers can’t pay for his services. “So I’m trying to find a solution for my family.”

A recent report from Yale economists argued that Stanislav’s experience is now common in Russia, despite defiant rhetoric from Putin arguing otherwise. For months, the Russian president has styled himself as the world’s energy czar. He’s bragged that Europe needs Russia’s gas far more than Russia needs the money from selling it.

Jeffrey Sonnenfeld of the Yale School of Management and Steven Tian of the Yale Chief Executive Leadership Institute instead argue that Russia needs to export energy to save its spiraling economy.

Contrary to Putin’s boastful claims, Sonnenfeld and Tian say the country is experiencing massive supply shortages and domestic production has stalled.

“The weapons that the Ukrainians are recovering from the battlefield, you’re finding semiconductor parts in these weapons that were salvaged from radios, from refrigerators,” Tian said. “This is the level of desperation that Putin is having to sink to because he can’t get the parts and equipment that he so desperately needs.”

According to Sonnenfeld, hundreds of thousands of engineers and tech workers have also left the country. That’s left a deficit in skilled workers that Russia needs to succeed in the long-term.

“Russia brings nothing to the world market other than energy, grain and cyber terrorism,” he said. “That’s it.”

Sonnenfeld said that the actual state of the Russian economy, in contrast to the state’s cheery self-reported statistics, is similar to South Africa’s wheezing economy in the 1980s, when it staggered under the weight of global sanctions due to apartheid.

The Click Here podcast spoke with Sonnenfeld and Tian to learn more about what the future might hold for Russians like Stanislav. The interview has been edited and condensed for clarity.

CLICK HERE: Can you give us an encapsulation of how the sanctions against Russia are damaging its economy?

JEFFREY SONNENFELD: In every sector of the economy, we’re seeing declines from 20% all the way up to 60, 70% declines. You can see that unemployment is soaring. Twelve-hundred firms have pulled out of Russia already. Multinational firms have taken away as much as 40% of the GDP, maybe a little bit more. They also have taken away a lot of employment. Russia acknowledges that that was at minimum 12% of their workforce.

CH: What surprised you most about your research into the Russian economy?

JS: What was most surprising is how Putin suppressed any of the bad news. The standard national income statistics that all nations have used at least since the Second World War — including Russia over the last 30 years under [former President Boris] Yeltsin and, believe it or not, even under Putin in the last 20 years — they’ve built up credibility in their numbers. As the oil economy expert Daniel Yergin commented recently, they’ve destroyed 20 years of their own statistical credibility and trust in the last few months.

CH: Can you talk a little bit about the unorthodox ways that you gathered this information?

JS: We just go to the other side to get the data. In a global economy, for every buyer there’s a seller; every seller, there’s a buyer. If Russia’s not going to put out the true information, it’s still available.

STEVEN TIAN: We’re looking at data from the ports industry, we’re looking at proprietary data from corporations and financial institutions, and we’re able to draw across so many different data sources and piece together a really holistic picture of what’s going on in the Russian economy.

CH: So instead of looking at the big dots, you’re looking at all the little dots.

ST: That’s right. That’s the same reason why we don’t just boil it all down to a simple GDP forecast as some others, such as the IMF [International Monetary Fund], without explaining any of it. What we do is we try to give you the entire landscape of what’s going on in the Russian economy at every single level. And no matter how you slice and dice it, the same picture comes out, which is that the Russian economy is really, really, really being devastated.

CH: Can you give us an example of how the economy is being devastated?

ST: These are reports coming out of Russia itself about the automotive industry. It’s not a secret that cannibalization of parts is taking place. Russia has been open about suspending safety regulations when it comes to the production of automobiles. The reason is they don’t have enough airbags. They don’t have enough safety brakes. They’re now making cars without airbags and safety brakes. I don’t know about you, but I wouldn’t want to drive a car without airbags and safety brakes.

You can also look at some of the weapons Russians are using on the battlefield. The Ukranians are recovering weapons with semiconductor parts that were salvaged from radios, refrigerators. This is the level of desperation that Putin is having to sink to because he can’t get the parts and equipment that he desperately needs.

CH: One of the things everybody’s been talking about is how these sanctions are unprecedented. And what I found really interesting about some of the various things you’ve talked about is there actually are some comparisons like the apartheid sanctions.

JS: Those businesses pulling out had symbolic as well as substantive meaning so that the Afrikaners could no longer bury their heads in the sand, the way many average Russians are. They could now see that the rest of the world is seeing them as a rogue nation. What’s going on here is sort of a game of chicken, a game of who can hold out the longest.

CH: What’s the one thing you’re keeping an eye on?

ST: It’s hard to boil it down to any one thing, because ultimately this is not a short-term story. No economic pressure campaign works overnight. That’s never happened throughout history. Rather, the thrust of economic pressure is to structurally degrade and hollow out Russian civil society by eroding its economic capabilities over time, and that’s happening at every single level.

JS: What’s going on here is sort of a game of chicken. And Putin’s desire is to split the West. So what I look to is to make sure that unity is reaffirmed in the West. And we just saw this past week that the EU [European Union] came together for a 15 percent reduction in gas use. The fact that they came together is very important and that continued unity is what I look to see. And that’s what will win out I think, in this waiting game.

Sean Powers and Will Jarvis contributed reporting to this story.

Hackers misbruiken Harmony's Horizon Blockchain brug om $100 miljoen te stelen

Vergelijkbare publicaties

Waarom opsporingsefficiëntie een van uw belangrijkste statistieken moet zijn

Oekraïne op D+173: OSINT voor doelwitbepaling; spionage en beïnvloedingsoperaties.

Race tegen de zandbak ≈ Packet Storm

Hoe elektronische oorlogsvoering de oorlog tussen Rusland en Oekraïne een nieuwe vorm geeft

Belg flink duurder uit met breedband dan Nederlander

Rapport: Sancties verwoesten Russische economie

Gevonden topics

Deel 1: Historisch tot 2022 - De dreiging van kwaadwilligheid - Information Security Buzz

Microsoft waarschuwt voor malware die "verborgen" geplande taken gebruikt - Security.NL

NCSC Advisories