May 12, 2017 BY:
President Trump ordered the federal government to prepare for a devastating cyber attack against America’s electric grid amid growing fears foreign states are set to carry out attacks aimed at plunging the nation into darkness.
A presidential order signed Thursday directed key federal agencies to assess preparations for a prolonged power outage resulting from cyber attacks designed to disrupt the power grid.
An assessment of the danger must be carried out by the Energy Department, Homeland Security, DNI and state and local governments to examine the readiness of the United State to manage a shutdown of the power grid. The assessment will also identify gaps and shortcomings in efforts that would be used restore power.
New cyber security measures outlined in the executive order come as the commander of Cyber Command warned two days earlier that America’s critical infrastructure is vulnerable to disruption by foreign cyber attacks.
Cyber command chief Adm. Mike Rogers said several nations, including Iran, have been tied to disruptions and remote intrusions into U.S. critical infrastructures, such as the electric grid, financial networks, and others.
Rogers said destructive cyber attacks on critical infrastructure are one of his two worst case scenarios. The second involves the threat of cyber intrusions aimed at manipulating data within networks.
Iran tried to disrupt the function of a dam in upstate New York in 2013, and Russia has used industrial control malware called BlackEnergy to attack Ukraine’s electric grid, Rogers said.
“Infiltrations in U.S. critical infrastructure—when viewed in the light of incidents like these—can look like preparations for future attacks that could be intended to harm Americans, or at least to deter the United States and other countries from protecting and defending our vital interests,” Rogers said.
The report on electric grid cyber attacks must be provided to the White House by Aug. 9.
The new order is the result of a Trump administration policy review aimed at improving cyber security for both the government and private sector.
The order states that federal agency heads will be held accountable for protecting networks from cyber attack, an apparent reference to China’s cyber attack on the Office of Personnel Management that led to the theft of some 22 million records on federal workers, including very sensitive personal data.
Homeland Security Adviser Tom Bossert told reporters at the White House in announcing the new order that the OPM hack highlighted the need for improved federal government software and hardware that will focus on sharing services and securing data.
“We saw that with the OPM hack and other things,” he said. “We’ve got to move to the cloud and try to protect ourselves, instead of fracturing our security posture.”
The order does not seek to define an act of war in cyberspace.
However, the directive requires the Pentagon and other security agencies to report within 90 days on cyber warfighting capabilities and defending the industrial base from cyber attacks.
Foreign hackers pose threats to the technology and equipment supply chain including U.S. military systems.
Military cyber warfare efforts are mentioned vaguely in the order. It states that security agencies must “assess the scope and sufficiency of United States efforts to ensure that the United States maintains or increases its advantage in national-security-related cyber capabilities.”
Federal agencies also will draw up “options for deterring adversaries and better protecting the American people from cyber threats,” the directive says.
Declining to telegraph U.S. responses to foreign cyber attacks, Bossert nonetheless said: “If somebody does something in the United States of America that we can’t tolerate, we will act.”
Bossert said the trend line of cyber attacks is moving in the wrong direction. “We see additional attacks, additional numbers, additional volume and occasionally additional successes that trouble us,” he said.
The administration will increase spending for cyber security by $1.5 billion in the coming year, Bossert said.
On infrastructure cyber security, Bossert said additional measures to bolster critical functions are a key element of the order.
Most critical infrastructures are not owned by the federal government, complicating efforts to protect them from foreign attacks.
“The executive order not only requires his departments and agencies to help those critical infrastructure owners and operators, and the most important ones, but to do it in a proactive sense,” Bossert said. “The message is a tilt toward action.”
Bossert said Russian cyber attacks during the 2016 election were not the motivation for the new policy. Several adversaries threaten American cyber security and the new policy is a “United States of America-motivated issue.”
“The Russians are not our only adversary on the Internet, the Russians are not the only people that operate in a negative way on the Internet,” he said.
“The Russians, the Chinese, the Iranians, other nation-states are motivated to use cyber capacity and cyber tools to attack our people and our government and their data,” Bossert added. “And that’s something we can no longer abide.”
Former DNI James Clapper told a Senate hearing this week that he too worries about foreign cyber attacks on U.S. infrastructure.
“I worry about the worst case which is an attack on our infrastructure,” he said. “And I think the Russians have, particularly, have reconnoitered it, and probably at a time of their choosing, which I don’t think right now is likely, but I think, if they want it to, could do great harm.”
The order also highlights the growing threat from automated cyber threats, such as botnets—thousands of hijacked computers operating in concert to conduct cyber attacks.
Under the order, the government will seek to improve security for private sector computers that could be used in botnet attacks.
Paul Rozenzweig, a former Homeland Security cyber security expert, said the order is a good start.
“This order is just a starting point, with a number of reports required over the next few months and significant obligations on the federal agencies to make recommendations for improvement,” he said.
“The rubber will meet the road when we get to the point of deciding which recommendations to implement.”
May 12, 2017 BY:
By Costas Pitas and Carlos Ruano
LONDON/MADRID (Reuters) – A global cyberattack leveraging hacking tools widely believed by researchers to have been developed by the U.S. National Security Agency hit international shipper FedEx, disrupted Britain’s health system and infected computers in nearly 100 countries on Friday.
Cyber extortionists tricked victims into opening malicious malware attachments to spam emails that appeared to contain invoices, job offers, security warnings and other legitimate files.
The ransomware encrypted data on the computers, demanding payments of $300 to $600 to restore access. Security researchers said they observed some victims paying via the digital currency bitcoin, though they did not know what percent had given in to the extortionists.
Researchers with security software maker Avast said they had observed 57,000 infections in 99 countries with Russia, Ukraine and Taiwan the top targets.
The most disruptive attacks were reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers.
International shipper FedEx Corp said some of its Windows computers were also infected. “We are implementing remediation steps as quickly as possible,” it said in a statement.
Still, only a small number of U.S.-headquartered organizations were hit because the hackers appear to have begun the campaign by targeting organizations in Europe, said Vikram Thakur, research manager with security software maker Symantec.
By the time they turned their attention to the United States, spam filters had identified the new threat and flagged the ransomware-laden emails as malicious, Thakur said.
The U.S. Department of Homeland Security said late on Friday that it was aware of reports of the ransomware, was sharing information with domestic and foreign partners and was ready to lend technical support.
Telecommunications company Telefonica was among many targets in Spain, though it said the attack was limited to some computers on an internal network and had not affected clients or services. Portugal Telecom and Telefonica Argentina both said they were also targeted.
Private security firms identified the ransomware as a new variant of “WannaCry” that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft’s Windows operating system.
“Once it gets in and starts moving across the infrastructure, there is no way to stop it,” said Adam Meyers, a researcher with cyber security firm CrowdStrike.
The hackers, who have not come forward to claim responsibility or otherwise been identified, likely made it a “worm,” or self spreading malware, by exploiting a piece of NSA code known as “Eternal Blue” that was released last month by a group known as the Shadow Brokers, researchers with several private cyber security firms said.
“This is one of the largest global ransomware attacks the cyber community has ever seen,” said Rich Barger, director of threat research with Splunk, one of the firms that linked WannaCry to the NSA.
The Shadow Brokers released Eternal Blue as part of a trove of hacking tools that they said belonged to the U.S. spy agency.
Microsoft on Friday said it was pushing out automatic Windows updates to defend clients from WannaCry. It issued a patch on March 14 to protect them from Eternal Blue.
“Today our engineers added detection and protection against new malicious software known as Ransom:Win32.WannaCrypt,” Microsoft said in a statement. It said the company was working with its customers to provide additional assistance.
The spread of the ransomware capped a week of cyber turmoil in Europe that kicked off a week earlier when hackers posted a huge trove of campaign documents tied to French candidate Emmanuel Macron just 1-1/2 days before a run-off vote in which he was elected as the new president of France.
On Wednesday, hackers disputed the websites of several French media companies and aerospace giant Airbus.Also, the hack happened four weeks before a British parliamentary election in which national security and the management of the state-run National Health Service (NHS) are important campaign themes.
Authorities in Britain have been braced for possible cyberattacks in the run-up to the vote, as happened during last year’s U.S. election and on the eve of this month’s presidential vote in France.
But those attacks – blamed on Russia, which has repeatedly denied them – followed an entirely different modus operandi involving penetrating the accounts of individuals and political organizations and then releasing hacked material online.
On Friday, Russia’s interior and emergencies ministries, as well as the country’s biggest bank, Sberbank, said they were targeted. The interior ministry said on its website that around 1,000 computers had been infected but it had localized the virus.
The emergencies ministry told Russian news agencies it had repelled the cyberattacks while Sberbank said its cyber security systems had prevented viruses from entering its systems.
NEW BREED OF RANSOMWARE
Although cyber extortion cases have been rising for several years, they have to date affected small-to-mid sized organizations, disrupting services provided by hospitals, police departments, public transportation systems and utilities in the United States and Europe.
“Seeing a large telco like Telefonica get hit is going to get everybody worried. Now ransomware is affecting larger companies with more sophisticated security operations,” Chris Wysopal, chief technology officer with cyber security firm Veracode, said.
The news is also likely to embolden cyber extortionists when selecting targets, Chris Camacho, chief strategy officer with cyber intelligence firm Flashpoint, said.
“Now that the cyber criminals know they can hit the big guys, they will start to target big corporations. And some of them may not be well prepared for such attacks,” Camacho said.
In Spain, some big firms took pre-emptive steps to thwart ransomware attacks following a warning from Spain’s National Cryptology Centre of “a massive ransomware attack.”
Iberdrola and Gas Natural, along with Vodafone’s unit in Spain, asked staff to turn off computers or cut off internet access in case they had been compromised, representatives from the firms said.
In Spain, the attacks did not disrupt the provision of services or networks operations of the victims, the government said in a statement.
(Additional reporting by Jim Finkle, Eric Auchard, Jose Rodriguez, Alistair Smout, Andrea Shalal, Jack Stubbs, Antonella Cinelli, Dustin Volz, Kate Holton, Andy Bruce, Michael Holden, David Milliken, Rosalba O’Brien, Julien Toyer, Tim Hepher, Luiza Ilie, Patricia Rua, Axel Bugge, Sabine Siebold and Eric Walsh; Writing by Mark Trevelyan and Jim Finkle; Editing by Ralph Boulton and Grant McCool)