Digital Insecurity

Mindanao Daily Mirror

The cyber attack on Germany's government network several months ago, tells us nothing new about espionage but a lot about risk in the digital age. And that calls for some rethinking, said already German columnist Matthias von Hein.

What is still safe in the digital age? What can even be kept safe? Those questions are a cause for public concern after it was revealed that hackers had successfully breached Germany's well-protected government network — copying, stealing and spying for more than a year. The only thing that is clear at this point is that the digital cat-and-mouse game is heading into the next round. 

Just an hour ago, next news are on my desk. Two of Germany's largest public broadcasters, ZDF (Zweites Deutsches Fernsehen, the 2nd National TV broadcaster and  the WDR (the Westdeutscher Rundfunk - West German Radio), have been attacked by a Russian hacking group, according to reports. It remains unclear what the group's intention was or whether any sensitive data was stolen.

A Russian hacking group known as "Sandworm" targeted them.

Security officials told German weekly Der Spiegel that hackers had managed to compromise the broadcasters' networks already in June. Although the cyber attack was detected relatively quickly, it remains unknown what the group was after or whether any sensitive data was compromised.

ZDF confirmed the attack on Friday, adding that only 10 computers on its network were affected. WDR decline to comment for "security reasons."

Sandworm is a hacking group believed to be run by Russia's military intelligence service, GRU. According to US federal investigators, the group is suspected of also being behind the attack on the US Democrats' computer servers during the 2016 presidential election.

The group first appeared in 2013 and, according to German intelligence, has targeted NATO servers, several western telecom companies and Ukrainian energy suppliers.

Earlier this year, the German government admitted that its computer network had been compromised via a piece of malware. The Russian hacking group APT28 is believed to have been behind the attack.

Germany's intelligence service (BND) had warned two weeks ago of the potential cyber threats facing several key bodies, including the country's public broadcasters and media companies.

The BND also said that the Spiez Laboratory in Switzerland, which specializes in chemical weapons research, was also among Sandworm's targets. Its Swiss lab had been tasked with analyzing the Soviet-era nerve agent Novichok that was used to poison former Russian double agent Sergei Skripal in Salisbury.

A spokesperson for Spiez Laboratory said officials had encountered one phishing attack, sent via a document used in a workshop. However, the institute itself had not been affected.

Once again, the prime suspect in the attack is a hacker group with links to Russia’s GRU intelligence agency. Thus far, however, German authorities have found no solid evidence leading to the perpetrators. But the fact that hackers exhibited no interest in economic gain after infiltrating a government network would seem to point away from ordinary cybercriminals. 

This was clearly a case of espionage. And that – as long as one is not dealing with corporate espionage – is something conducted at the behest of the state. And it is most certainly the case when such attacks are carried out with a great deal of sophistication and staffing resources over a long period of time. 

Digital insecurity - an important topic for each and everyone nowadays.

More (global) cyber attacks

WED, MAY 17, 2017 BY THE MINDANAO DAILY MIRROR LEAVE A COMMENT

IN MY OPINIONKlaus Doring

Several weeks ago, I mentioned in this corner that the German government plans cyber attack ‘hackback’ ahead of national elections in September. Indeed, there are many cyber attack fears ahead of it. How much more now!

Latest example: several British NHS (National Health Sysyem) divisions reported problems with their computer systems on Friday afternoon local time (May 12, 2017)  –  while hospitals in London, northwest England and other parts of the country alerted patients to the temporary closures.

“We are aware of a major IT secure system attack. All IT systems have been tem-porarily shut down,” Derby-shire Community Health Services said on Twitter. NHS Merseyside in the north of England reassured its patients via Twitter that it was working to solve the problem. Sure!

The NHS later confirmed several hospitals’ computer systems had been hit by the Wanna Decryptor ransom-ware variant, but that patient data had not been accessed. “This attack was not speci-fically targeted at the NHS and is affecting organizations from across a range of sectors,” NHS Digital, a division of NHS England that handles information technology issues, said in a statement.

Ransom-ware attacks  are becoming more more frequent. British hospitals have been hit by ransom-ware attacks before, with hackers typically encrypting files and demanding a bitcoin bounty to unlock the files. The malware typically spreads through networks.

In 2016 an NHS division canceled operations and diverted major trauma cases when it was hit by a virus.

Intel Security reported in 2016 that hospitals were increasingly being targeted by ransom-ware operations, with one operator earning almost US$121 million (111 million Euro).”A combination of legacy systems with weak security, a lack of employee security awareness, a fragmented workforce, and the pressing need for immediate access to information has led the criminal underground to prey on hospitals,” the report said.

In 2016 British leaders unveiled a multibillion-pound national cybersecurity strategy that included new police units to target organized online gangs and even retaliation for major attacks.

Already 2016, hackers hold German hospital data hostage. Several hospitals in Germany have come under attack by ransom-ware, a type of virus that locks files and demands cash to free data it maliciously encrypted. Ac-cording to present know-ledge, it was an attachment in an email that allowed the virus to enter the system. It will take weeks until all systems are up and running again. First thing, one might notice the system isn’t running smoothly anymore. Error messages are popping up, and the system is suspiciously slow.

Hospitals have fallen victim to ransom-ware – a type of malware that makes data inaccessible to its rightful owner. Hackers then demand ransom payments in ex-change for a key that unlocks the files.

Ransom payments happened also in Hollywood. Blackmailing hospitals into paying ransom has also been reported in other parts of the world, most notably in the US state of California where a Hollywood hospital paid about $17,000 (15,000 EURO) in the digital currency bitcoins to hackers this month.

Import is to have regular backups.  If the virus encrypted data is being backed up, one just restore the backup files. Fact is, each one of us and our surroundings are being watched by Big Brother…. A world of glass!