Tag: cyberterrorism

As Beijing’s intelligence capabilities grow, spying becomes an increasing flashpoint in US-China ties | CNN

[ad_1]

Hong Kong
CNN
—

For the second time this year, concerns of Chinese spying on the United States have cast a shadow over a planned visit to China by the US’ top diplomat as the two superpowers try to improve fractured ties while keeping a watchful eye on each other.

US Secretary of State Antony Blinken is expected to land in Beijing over the weekend following the postponement of his earlier trip planned for February after a Chinese surveillance balloon meandered across the continental US, hovering over sensitive military sites before being shot down by an American fighter plane.

But with Blinken poised to make a trip seen as a key step to mend fractured US-China communications, another espionage controversy has flared in recent days following media reports that China had reached a deal to build a spy perch on the island of Cuba.

Beijing has said it wasn’t “aware” of the situation, while the White House said the reports were not accurate – with Blinken earlier this week saying China upgraded its spying facilities there in 2019.

The situation is just the latest in a string of allegations of spying between the two in recent months. They underscore how intelligence gathering – an activity meant to go on without detection, out of the public eye – is becoming an increasingly prominent flashpoint in the US-China relationship.

CIA Director Bill Burns secretly traveled to China in May to meet counterparts and emphasize the importance of maintaining open lines of communication in intelligence channels, CNN reported earlier this month.

“Crisis communications are arguably in their worst state since 1979. This puts a premium on both countries’ ability to gather intelligence to understand each other’s capabilities, actions, and strategic intent around the globe,” said Lyle Morris, a senior fellow at the Asia Society Policy Institute’s Center for China Analysis.

That pushes intelligence gathering itself to become “another factor that is complicating US-China relations,” he said.

That’s especially the case, experts say, as China continues to expand its own intelligence gathering capabilities – catching up in an area where the US has traditionally had an edge.

“It’s fair to say that we’ve been spying on each other at various scales for a long time,” said former Central Intelligence Agency (CIA) China analyst Christopher Johnson.

“No doubt there’s been an uptick from both sides, but probably more so on the Chinese side, simply because they’ve gotten larger, more influential, richer, and therefore have more resources to devote than they did in the past,” said Johnson, who is now president of the China Strategies Group consultancy.

Chinese leader Xi Jinping has also pursued a far more assertive foreign policy than his predecessors during his past decade in power.

That’s been accompanied by “a consistent emphasis on enhancing intelligence capabilities, modernizing technology, and improving coordination among different security agencies,” according to Xuezhi Guo, a professor of political science at Guilford College in the US.

China’s main intelligence activities fall under departments within the People’s Liberation Army and its vast civilian agency known as the Ministry of State Security (MSS). Other arms of the Communist Party apparatus also play a role in activities beyond conventional intelligence gathering, experts say.

The MSS, established in 1983, oversees intelligence and counterintelligence both within China and overseas. Its remit has encouraged analogies to a combined CIA and Federal Bureau of Intelligence. But the sprawling Beijing-headquartered MSS is even more secretive – without even a public website describing its activities.

The agency is “expected to play an even more significant role in China’s domestic and international security and stability” in the coming years, amid mounting challenges at home and abroad, Guo said.

In the context of both China’s growing clout and geopolitical frictions, experts say it’s no surprise Beijing is allegedly seeking to establish or expand surveillance facilities in Cuba – or other places around the world – with the US as a key target, but not the only one.

Meanwhile, intelligence gathering in China has become harder.

Xi has consolidated his power and become increasingly focused on security – including building out the state’s ability to monitor its citizens, both online and through China’s extensive surveillance infrastructure.

“The task of collecting intelligence in China is arguably harder than ever and yet more necessary than ever,” said Johnson, the former analyst, pointing to challenges of gaining insight into the government under the centralized leadership of Xi, who maintains a “very small circle of knowledge or trust.”

China’s building of a domestic “surveillance panopticon” has also enabled its counter-intelligence, according to Johnson.

US intelligence has difficulties having operational meetings or “going black” (dodging surveillance) within China, he said, especially during the Covid-19 pandemic when movement was tightly controlled and even more digitally monitored than usual.

CIA operations also suffered a staggering setback starting in 2010, according to The New York Times, when the Chinese government killed or imprisoned more than a dozen sources over two years.

In 2021, CNN reported that the agency was overhauling how it trains and manages its network of spies as part of a broad transition to focus more closely on adversaries like China and Russia.

This contrasts with what some US lawmakers and commentators believe has been a too relaxed approach to national security with regards to China, where even private businesses are beholden to the ruling Communist Party, which also seeks to keep tabs on its citizens overseas.

Experts have also warned about the overlap between espionage efforts and operations like those of China’s United Front – a sprawling network of groups that manage the party’s relationship with non-party industries, organizations and individuals around the world.

Heightened concern and awareness about Chinese intelligence gathering – or the potential for it – has exploded in the US in recent years.

That’s played out in debates about the use of Chinese telecoms equipment and social media platforms – think Huawei and TikTok – as well as in government efforts to prosecute economic espionage cases and prevent any influence campaigns from impacting American democracy.

Beijing has said repeatedly that it does not interfere in the “internal affairs” of other countries. Both Huawei and Tiktok have repeatedly denied that their products present a national security risk or would be accessed by the Chinese government.

In the US, there’s also been concern about over-hyping the threat and sparking anti-Chinese sentiment.

The US Justice Department last year ended its 3-year-old China Initiative, a national security program largely focused on thwarting technology theft, including in academia, after a string of cases were dismissed amid concerns of fueling suspicion and bias against Chinese Americans.

US intellectual property had long been a traditional target of Chinese espionage.

A survey of 224 reported instances of Chinese espionage directed at the United States since 2000, conducted using open source data by the Center for Strategic and International Studies (CSIS) think tank in Washington, found nearly half involved cyber-espionage, while over half were seeking to acquire commercial technologies.

Beijing appears to be increasingly pushing back on what it sees as a double standard – as the US’ international surveillance efforts have also been well-documented.

The 2013 leak produced by former National Security Agency contractor Edward Snowden, for example, revealed Washington’s vast global digital surveillance capabilities, against both rivals and allies alike. Meanwhile, the US intelligence community is widely understood to have its own overseas facilities for collecting signals intelligence.

Last month, Beijing released a report from a national cybersecurity agency titled “‘Empire of Hacking’: The US Central Intelligence Agency.” It accused the US of promoting the internet in the 1980s in order to further its intelligence agencies’ efforts to launch “Color Revolutions” and overthrow governments abroad.

“The organizations, enterprises and individuals that use the Internet equipment and software products of the USA have been used as the puppet ‘agents’ by CIA, helping it to be a ‘shining star’ in global cyber espionage wars,” the report also claimed.

China’s own internet is heavily censored with access limited by a “Great Firewall” – part of its extensive efforts to control the flow of information alongside its extensive digital surveillance of its own population.

China’s Foreign Ministry last month again pointed its finger at the US after Washington released a warning alleging that a Chinese state-sponsored hacker had infiltrated networks across US critical infrastructure sectors.

Earlier this month, the ministry also slammed the US for sending what it said were more than 800 flights of large reconnaissance aircraft “to spy on China” last year – though no assertion was made of crossing into Chinese airspace.

The comment came after each country’s military accused the other of misbehavior after a Chinese fighter jet intercepted a US spy plane in international airspace over the South China Sea.

Experts say this rhetorical back-and-forth over each other’s clandestine activities is likely only to continue as US-China competition drives both to ramp up their intelligence gathering – and China continues to expand its own prowess, including through technological advancements such as satellite networks, surveillance balloons and data processing.

“China increasingly has capabilities (that the US has been known for) … this is moving from a one way street historically to a two-way street,” said John Delury, author of “Agents of Subversion: The Fate of John T. Downey and the CIA’s Covert War in China.”

He pointed to how China had long been subject to US offshore surveillance and – prior to the restoration of diplomatic relations in the 1970s – direct aerial surveillance.

“There’s a psychological dimension to this as well,” Delury added, noting that the spy balloon incident earlier this year brought this to the fore – giving Americans the unnerving sense that China “can do this to us now, they have technical capabilities and can look at us.”

Meanwhile, there’s much at stake in how well the two governments can repair official communication – seen as a key element of Blinken’s expected visit on Sunday and Monday.

“When there’s less communication, the two intelligence communities inside the two governments have to do more and more guesswork,” said Delury. “Then there’s a lot more room for faulty assumptions.”

[ad_2]

Source link

June 14, 2023
Apparent cyberattack forces Florida hospital system to divert some emergency patients to other facilities | CNN Politics

[ad_1]

CNN
—

An apparent cyberattack has forced a network of Florida health care organizations to send some emergency patients to other facilities and to cancel some non-emergency surgeries, the health care network said Friday.

Tallahassee Memorial HealthCare, which operates a 772-bed hospital and multiple specialty care centers, said an “IT security issue” late Thursday night forced it to take down its computer system.

“We are also diverting EMS [emergency medical services] patients and will only be accepting Level 1 traumas from our immediate service area,” the hospital system said in a statement. Level 1 trauma refers to the most acute injuries and illnesses.

Tallahassee Memorial HealthCare spokesperson Tori Lynn Schneider told CNN “some” emergency patients were being diverted to facilities outside of the organization’s network, but declined to say how many patients. All non-emergency and elective procedures scheduled for Monday were canceled because of the hacking incident, Schneider said.

It’s the latest in a series of cyberattacks that have continued to hit resource-strapped US health care providers in the nearly three years of the Covid-19 pandemic. In another case, hackers accessed the personal data of nearly 270,000 patients in an attempted ransomware attack on a Louisiana health care system in October.

The FBI last month shut down the computer infrastructure used by a notorious ransomware gang to attack multiple US hospitals, according to the bureau. But the threat remains as multiple ransomware groups are known to target the health sector.

It’s unclear who was responsible for the apparent hack of Tallahassee Memorial. Tallahassee Memorial did not specify whether it had suffered a ransomware attack, but the organization’s statement described activity, including the need to shut down computer networks, consistent with a ransomware attack.

Staff have been unable to access digital patient records and lab results because of the shutdown, a hospital source told CNN.

Mark O’Bryant, Tallahassee Memorial’s CEO, notified staff in person Friday morning that the system had suffered a “cyberattack,” according to the source.

“To help us contain the issue, please completely turn off all PCs connected to TMH’s network immediately and leave them off until notified otherwise,” Tallahassee Memorial leadership said in a memo sent to employees Friday morning and obtained by CNN.

Max Henderson, a Tallahassee native and cybersecurity specialist who focuses on health care, said the effects of a shutting down a hospital’s computer network can last for weeks or months.

“Immediate, unplanned shutdowns can lead to a loss of recently gathered data regarding diagnosis, clinical notes, shift handovers and other various setbacks for the medical staff,” Henderson, who is senior manager for incident response at security firm Pondurance, told CNN.

“Nearly all hospitals rely on the internet for connectivity with vendors and remote offices for processing information in critical departments such as radiology, pharmacy, medical device maintenance, patient document scanning and payment processing,” Henderson added.

[ad_2]

Source link

February 3, 2023
Iran and Russia were too distracted to meddle in midterm elections, US general says | CNN Politics

[ad_1]

CNN
—

Domestic unrest in Iran and Russia’s war in Ukraine may have distracted Tehran and Moscow from making more of an effort to influence or interfere in the 2022 US midterm election, a top US military cyberofficial said Monday.

“We collectively saw much less focus from foreign adversaries, particularly the Russians” in targeting the 2022 election compared to previous elections, Maj. Gen. William J. Hartman, who leads the Cyber National Mission Force of US Cyber Command, the military’s offensive and defensive hacking unit, said at a press briefing at Fort Meade, home to Cyber Command and the National Security Agency.

Hartman said he was “surprised” by the relative lack of activity from the Russians and Iranians during the midterm election. The US military’s cyber forces have taken a more active role in defending US elections from foreign interference since 2018 by targeting computer networks used by Russia and others to try to sow discord.

Gen. Paul Nakasone, the head of Cyber Command, confirmed to reporters this month that the command conducted offensive and defensive cyber operations in an effort to protect the midterms from foreign interference and influence.

Nakasone declined to go into details on the operations, but said the command focused on taking down the computer infrastructure used by foreign operatives “at key times.”

“There was a campaign plan that we followed and it wasn’t just November 8. it covered before, during and until the elections were certified,” said Nakasone, who also leads the National Security Agency.

Foreign governments tend to use established agencies to meddle in elections rather than create new organizations to do that on the fly, Hartman said. And the security services in Russia and Iran were preoccupied in the weeks and months before Americans went to the polls in November.

Iranian security forces carried out a bloody crackdown on protesters this fall after a woman died in the custody of the so-called morality police. Russia’s military, meanwhile, pummeled Ukrainian cities with drone and missile strikes to try to turn the tide of the war.

As they have since they were caught flat-footed by Russia’s interference in the 2016 election, US officials prepared for a range of foreign actors to try to influence voters or interfere with the vote in 2022.

Asked in July whether the war in Ukraine would distract Russia from interfering in the US midterm election, FBI Director Christopher Wray said he was “quite confident the Russians can walk and chew gum” and that US officials were preparing accordingly.

But foreign operatives from Iran and Russia generally reused old tactics and tools in their influence operations during the US midterms rather than try anything brand new, Nakasone told reporters this month.

While there weren’t any reports of high-impact foreign interference activity during the midterm elections, there were attempts by Russian, Iranian and Chinese operatives to influence voters, according to researchers.

Suspected Russian operatives used far-right media platforms to denigrate Democratic candidates in battleground states just days before the elections, according to Graphika, a social media analysis firm. For their part, alleged Chinese operatives showed signs of engaging in more “Russian-style influence activities” that stoke American divisions ahead of the midterm vote, according to the FBI.

On Election Day, pro-Russia hackers took responsible for a cyberattack that knocked the website of the Mississippi secretary of state’s website offline. The incident didn’t affect the tallying of votes.

“It is likely that a primary objective of the identified pro-Russia actors was to build the perception of influencing the elections—potentially in hopes of supporting future narratives that would undermine the credibility of the election results,” Mandiant, a cybersecurity firm owned by Google, said in an analysis published Monday.

Mandiant said it had “moderate confidence” that whoever ran that Russian hacktivist group’s channel on the Telegram messaging app was coordinating their operations with actors sponsored by Russia’s military intelligence agency.

“This year some [foreign groups] seemed most interested in reinforcing the notion that they still posed a threat, even if they didn’t push too hard to actually affect outcomes” of the election, John Hultquist, Mandiant’s vice president of intelligence analysis, told CNN.

[ad_2]

Source link

December 20, 2022
Australia blames cyber criminals in Russia for Medibank data breach | CNN Business

[ad_1]

Brisbane, Australia
CNN
—

Cyber criminals in Russia are behind a ransomware attack on one of Australia’s largest private health insurers that’s seen sensitive personal data published to the dark web, the Australian Federal Police (AFP) said Friday.

In a short press conference, AFP Commissioner Reece Kershaw told reporters investigators know the identity of the individuals responsible for the attack on health insurer Medibank, but he declined to name them.

“The AFP is undertaking covert measures and working around the clock with our domestic agencies and international networks including Interpol. This is important because we believe those responsible for the breach are in Russia,” he said.

Medibank says the stolen data belongs to 9.7 million past and present customers, including 1.8 million international customers. The files include health claims data for almost half a million people, including 20,000 based overseas.

This week, the group started releasing curated tranches of customer data onto the dark web, in files with titles including good-list, naughty-list, abortions and boozy, which included those who sought help for alcohol dependency.

Kershaw said police intelligence points to a “group of loosely affiliated cyber criminals” who are likely responsible for previous significant data breaches around the world, without naming specific examples.

“These cyber criminals are operating like a business with affiliates and associates who are supporting the business. We also believe some affiliates may be in other countries,” said Kershaw, who declined to take questions due to the sensitivity of the investigation.

Cyber security experts have said the criminals are likely linked to REvil, a Russian ransomware gang notorious for large attacks on targets in the United States and elsewhere, including major international meat supplier JBS Foods last June.

That breach shut down the company’s entire US beef processing operation and prompted the company to pay an $11 million ransom. Last November, the US State Department offered a $10 million reward for information leading to the identification or location of key leaders of REvil, also known as the Sodinokibi organized crime group.

In mid-January, Russian state news agency TASS reported that at least eight REvil ransomware hackers had been detained by Russia’s Federal Security Service (FSB) at the request of the US.

They were facing charges of committing “illegal circulation of payments,” a crime punishable by up to seven years in prison, TASS reported, citing Moscow’s Tverskoi Court.

In March, Ukrainian national Yaroslav Vasinskyi, one of the chief suspects linked to an attack on US software vendor, Kaseya, was extradited from Poland to the US to face charges, according to a statement from the Justice Department.

Jeffrey Foster, associate professor in cyber security studies at Macquarie University, said there’s one major link between the REvil network and the group suspected of hacking the Medibank network.

“The biggest link is that the REvil dark web website now redirects to this website. So that’s the biggest link we have between them, and the only link we have between them,” said Foster, who is monitoring the blog where the group is posting their demands.

“As Russia has stated that they’ve arrested and disbanded REvil, it seems likely this is a case of maybe a former REvil member, who had access to the dark web website to be able to do the redirect which requires access to the hardware,” he said. “Whether or not REvil has returned, we don’t know.”

Medibank first detected unusual activity in its network almost a month ago. On October 20, the company issued a statement saying a “criminal” had stolen information from its ahm health insurance and international student systems, including names, addresses, phone numbers and some claims data for procedures and diagnoses.

An initial ransom demand was made for $10 million (15 million Australian dollars), but the company said after extensive consultation with cybercrime experts it had decided not to pay. It was later lowered to $9.7 million – one for every customer affected, according to Foster.

At the time, Medibank said there was only a “limited chance” that paying the ransom would stop the data being published or returned to the company.

In his statement on Friday, Kershaw, the AFP Commissioner, said Australian government policy did not condone paying ransoms to cyber criminals.

“Any ransom payment small or large fuels the cybercrime business model, putting other Australians at risk,” he said.

Kershaw said investigators at the Australian Interpol National Central Bureau would be talking with their Russian counterparts about the individuals, who he addressed directly with a threat to see them charged in Australia.

“To the criminals, we know who you are. And moreover, the AFP has some significant runs on the scoreboard when it comes to bringing overseas offenders back to Australia to face the justice system,” he said.

Earlier Friday, Australian Prime Minister Anthony Albanese said he was “disgusted” by the attacks and, without naming Russia, said the government of the country they come from should be held accountable.

“The nation where these attacks are coming from should also be held accountable for the disgusting attacks, and the release of information including very private and personal information,” Albanese said.

In a statement Friday, Medibank CEO David Koczkar said it was clear the criminal gang behind the breach was “enjoying the notoriety,” and it was likely they would release more information each day.

“The relentless nature of this tactic being used by the criminal is designed to cause distress and harm,” he said. “These are real people behind this data and the misuse of their data is deplorable and may discourage them from seeking medical care.”

[ad_2]

Source link

November 10, 2022
Chinese hacking group targeting US agencies and companies has surged its activity, analysis finds | CNN Politics

[ad_1]

Washington
CNN
—

An elite Chinese hacking group with ties to operatives indicted by a US grand jury in 2020 has surged its activity this year, targeting sensitive data held by companies and government agencies in the US and dozens of other countries, according to an expert at consulting giant PricewaterhouseCoopers.

The findings highlight the biggest cyber-espionage challenge facing the Biden administration: combating a Chinese hacking program that the FBI has called more prolific than that of all other governments in the world combined.

The Justice Department has aggressively sought to expose the alleged data-stealing campaigns through indictments, and made the case that Chinese hackers have robbed American companies of intellectual property, causing huge losses. But China-based hackers have often developed new tools or otherwise altered their operations, according to analysts.

One of the Chinese groups tracked by PwC has targeted dozens of US organizations in the last year, including government agencies and software or tech firms, said Kris McConkey, who leads PwC’s global cyber threat intelligence practice. The intruders often comb networks for data that could offer insights into foreign or trade policy, he said, but also dabble in cryptocurrency schemes for personal profit. He declined to detail what types of US government agencies, whether at the federal, state or local level, were targeted.

“They are, by far, the most active and globally impactful [hacking group] that we track at the minute,” McConkey, who closely follows China-based hackers, told CNN. He believes the attackers have been successful in breaching at least some organizations because they operate on a vast scale, targeting organizations in at least 35 countries this year alone.

McConkey traced part of the activity to an ostensibly legitimate cybersecurity company based in the Chinese city of Chengdu, but he stopped short of publicly connecting the hacking to the Chinese government. US officials have for years accused China of using front companies to conduct hacking that feeds the government’s sprawling intelligence collection efforts.

China has repeatedly denied allegations of hacking and Beijing has in recent months stepped up its own accusations that Washington has conducted cyber operations against Chinese assets.

Cybersecurity issues have been a repeated source of friction between the world’s two biggest economies; President Joe Biden raised the subject on a call with Chinese President Xi Jinping last year.

McConkey was one of multiple private cyber specialists who exposed the operations, and sometimes the alleged locations, of hackers from China, Iran and elsewhere at a recent conference called LABScon, hosted by US security firm SentinelOne, in Scottsdale, Arizona.

Adam Kozy, who tracked Chinese hackers at the FBI from 2011 to 2013, showed the audience a photo of a People’s Liberation Army building in the city of Fuzhou that allegedly houses officers who conduct information operations against Chinese adversaries. That unit has targeted Taiwan, Kozy said, and “is the main area for China’s disinformation operations.”

In their investigations of foreign hackers, the FBI and Justice Department prosecutors have drawn on those types of revelations from private researchers.

At least one FBI agent and officials from the National Security Agency and the US Cybersecurity and Infrastructure Security Agency attended the conference, a reminder of how reliant government officials are on data held by tech firms to pursue spies and cybercriminals. Sometimes that work happens not in a classified facility but in the halls of a luxury hotel.

Morgan Adamski, a senior NSA official, told conference attendees that the coronavirus pandemic changed how her agency worked with private firms to guard sensitive data targeted by hackers.

“The pandemic actually helped because it no longer revolved around big government meetings in a room, in a SCIF [Sensitive Compartmentalized Information Facility], where you couldn’t use any of the information,” said Adamski, who heads the NSA’s Cybersecurity Collaboration Center, which works with defense contractors to blunt the impact of foreign hacking.

After US defense contractors began working from home during the pandemic, she said, Chinese government hackers exploited the virtual private networking (VPN) software the contractors were using. One hacked contractor, which she didn’t name, shared data with federal agencies so they could build a clearer picture of what was going on.

Asked by CNN whether the NSA and other federal agencies responding to the hacks were able to evict the Chinese hackers, Adamski said it’s an iterative process.

“When you talk about nation-state actors, you kick them out, but they’re going to come back,” Adamski said, “especially if you’re a defense industrial base company that is producing critical military intelligence for the Department of Defense.”

[ad_2]

Source link

October 2, 2022
Biden picks Air Force general to lead NSA and Cyber Command | CNN Politics

[ad_1]

CNN
—

President Joe Biden has nominated an Air Force general to head the nation’s powerful electronic spying agency and the US military command that conducts offensive cyber operations – a crucial position as the US continues to battle Russia, China and other foes in cyberspace.

Lt. Gen. Timothy Haugh, who has served for years in senior US military cyber positions, is Biden’s choice to replace outgoing Army Gen. Paul Nakasone as head of the National Security Agency and US Cyber Command, an Air Force official confirmed to CNN.

Politico first reported on Haugh’s nomination.

The White House did not respond to a request for comment.

Haugh’s nomination could face a roadblock in the Senate after Republican Sen. Tommy Tuberville of Alabama put a hold on senior military nominations because he objects to the department’s abortion travel policy.

Haugh is currently deputy of US Cyber Command, a command of thousands of US military personnel who conduct offensive and defensive cyber operations to protect US critical infrastructure. Officials from the command traveled to Ukraine in late 2021 to prepare Kyiv for an onslaught of Russian cyberattacks that accompanied the full-scale Russian invasion.

The command and NSA also have taken an increasingly active role in helping defend American elections from foreign interference under Nakasone’s leadership over the last five years.

During the 2020 election, Iranian hackers accessed a US municipal website for reporting unofficial election results and Cyber Command kicked the hackers off the network out of concern that they might post fake results on the website, a senior US military official revealed last month.

Haugh’s nomination signals a continued emphasis on election security work at Fort Meade, the sprawling military base in Maryland where the NSA and Cyber Command are housed. As a senior US military cyber official, Haugh has been involved in election security discussions in recent midterm and general elections.

[ad_2]

Source link

April 12, 2021