The FBI has joined forces with the UK’s National Crime Agency (NCA) and other law enforcers to suspend a popular website which sells access to stolen data.

The WeLeakInfo[.]com domain was seized by the Feds after the District Court for the District of Columbia issued a warrant, although its administrators are still at large.

Although the site claimed to be focused on helping breached internet users discover if their personal data had been compromised, by selling access to billions of records it also provided a useful resource for cyber-criminals looking to launch credential stuffing, phishing and other attacks.

“The website had claimed to provide its users a search engine to review and obtain the personal information illegally obtained in over 10,000 data breaches containing over 12 billion indexed records – including, for example, names, email addresses, usernames, phone numbers, and passwords for online accounts,” a statement from the Department of Justice explained. 

“The website sold subscriptions so that any user could access the results of these data breaches, with subscriptions providing unlimited searches and access during the subscription period (one day, one week, one month, or three months).”

The way it operated stood in contrast to legitimate breach notification site HaveIBeenPwned, which only lets users know if their accounts have been compromised, rather than providing access to troves of breached data.

Jake Moore, cybersecurity specialist at ESET, argued that hackers can do a great deal of damage even just with limited sets of breached emails and names.

“The big risk comes from brute force attacks, where criminals use common password combinations against emails to try and break into personal accounts,” he added.

“An incredibly large amount of people still use predictable or simple passwords. Many people’s passwords are also readily available on the dark web, so it quickly and simply becomes an exercise in joining the dots for the cyber-criminals.”

The FBI is seeking any information on the owners and operators of WeLeakInfo.

New research into the latest victims of Emotet has found increased instances of the malware affecting the United States of America’s government and military.

The pernicious malware, which is spread via email, has been infecting organizations all over the world since 2014. By shining a spotlight on Emotet’s recent activities, researchers at Cisco Talos discovered that the US government is among the latest victims to be compromised. 

Researchers made the discovery by closely examining the patterns of outbound email associated with the malware. 

A Talos spokesperson said: “If a person has substantial email ties to a particular organization, when they become infected with Emotet the effects would manifest in the form of increased outbound Emotet email directed at that organization. 

“One of the most vivid illustrations of this effect can be seen in Emotet’s relationship to the .mil (U.S. military) and .gov (U.S./state government) top-level domains (TLDs). 

“When Emotet emerged from its summer vacation back in mid-September 2019, relatively few outbound emails were seen directed at the .mil and .gov TLDs. But sometime in the past few months, Emotet was able to successfully compromise one or more persons working for or with the U.S. government.”

The malware’s successful compromise of at least one US government employee led to what researchers described as a “rapid increase” in the number of infectious Emotet messages directed at the .mil and .gov TLDs in December 2019.

Following a brief spot of respite over the winter holidays, Emotet is once again causing trouble. Cisco Talos said that the upward trend in the quantity of messages directed at .mil and .gov had “continued into January 2020.”

Emotet works by stealing someone’s email, then impersonating the victims and sending copies of itself in reply. The malicious emails are delivered through a network of stolen SMTP accounts. 

Recipients, conned into thinking that they are receiving a message from a friend or professional colleague, open the email and are then infected.

The simplicity of Emotet’s attack strategy belies its effectiveness. “This relatively simple email-man-in-the-middle social engineering approach has made Emotet one of the most prolific vehicles for delivering malware that we have seen in modern times,” said researchers. 

The London Office for Rapid Cybersecurity Advancement (LORCA) has announced the 20 scale-ups selected to join its fourth cohort of cyber-innovators.

The latest group is LORCA’s largest and most international yet – including companies from the UK, Israel, Spain, Switzerland, Denmark, Singapore and the US – using technologies such as automation and quantum to protect UK industry against the latest threats.

LORCA is hosted and delivered by Plexal at Here East in London’s Queen Elizabeth Olympic Park. The year-long project will support the 20 new companies to scale, secure investment, access new markets and participate in overseas trade missions, with the ultimate aim of growing the British cybersecurity industry.

The scaleups will also receive technical and commercial support from the program’s delivery partner Deloitte and engineering expertise from the Centre for Secure Information Technologies (CSIT) at Queen’s University Belfast.

LORCA lanched in June 2018 with backing from the Department for Digital, Culture, Media & Sport and has enrolled 55 companies into its program.

The latest cohort includes scaleups with a range of cutting-edge solutions, invited to apply based on three innovation themes identified by industry leaders from various sectors:

• Connected Economy
• Connected Everything
• Connected Everyone

Saj Huq, program director, LORCA, said: “LORCA exists to bring cutting-edge technology to market and to enable the most promising cyber-innovators to become globally competitive businesses. The international reach and the variety of solutions within our incoming fourth cohort is an exciting demonstration of both the strength and attractiveness of the UK market, as well as an illustration of the increasingly prominent role that LORCA plays as a convener and collaborator within the global innovation ecosystem.”

The 20 companies enrolling in the latest cohort are:

1. Acreto
2. Anzen Technologies Systems
3. Avnos
4. Contingent
5. Continuum Security
6. Darkbeam
7. Heimdal Security
8. Keyless
9. Kinnami
10. L7 Defence
11. Orpheus
12. Osirium
13. Risk Ledger
14. ShieldIOT
15. SureCert
16. ThreatAware
17. ThunderCipher (Licel)
18. Variti
19. VIVIDA
20. Westgate Cyber Security

The December cyber-attack on the southern city of New Orleans has caused over $7m of damage.

New Orleans mayor Latoya Cantrell said yesterday that the already alarmingly high figure continues to grow as the city recovers from the incident. 

A cyber-insurance policy taken out by New Orleans prior to the attack has allowed the Big Easy to recover $3m, but the popular vacation city will still be left cruelly out of pocket as a result of the incident. According to Cantrell, the cost is just something that the city will “have to eat.”

“This is something that we have to deal with as a city and it is an expense that we also have to eat as a city. It speaks to the priority of infrastructure that has always been a priority of mine and it also speaks to the real push for maintenance of infrastructure. This will be ongoing,” Cantrell told Fox8.

The $7m figure does not include the cost of paying a ransom to the attack’s perpetrators, who, despite using ransomware to cripple the city’s computer networks, never issued a ransom demand. 

In a stoic display of optimism, Cantrell told Fox8 that the ravages wrought by the attack, although bad, could have been far worse. 

She said: “The early detection and the intrusion helped us one. IT halted our networks, shut them down completely, which prevented this cyber-attack from being catastrophic.”

Recovery from the attack is still a long way off, according to the city’s chief administrative officer, Gilbert Montano, as New Orleans is currently wading through a significant backlog of work that resulted from the forced reversion to manual governance.

“Now, we’re in the stabilization period. We are trying to rebuild what we had to turn off essentially and that is a long, laborious, time-sensitive process and that’s where I am telling staff and employees we’re looking maybe at a six to eight month window before actual normalcy starts to integrate all of our systems,” said Montano.

Expenses that are included in the $7m figure are the cost of purchasing 3,400 new computers and improving the city’s IT infrastructure in an effort to prevent future cyber-catastrophes.

A worldwide cybersecurity alliance established last year by the International Society of Automation (ISA) has tripled its membership in just six months. 

The ISA Global Cybersecurity Alliance (ISAGCA) drew its first breath in July 2019. The organization was set up with the intention to provide an open, collaborative forum to advance cybersecurity awareness, readiness, and knowledge sharing. 

Founded with six initial members, ISAGCA announced on Tuesday that its ranks have since swelled to include an additional 23 companies and organizations. 

As of the end of 2019, the original vanguard of Schneider Electric, Rockwell Automation, Honeywell, Johnson Controls, Claroty, and Nozomi Networks had been strengthened by the addition of aeSolutions, Bayshore Networks, Beijing Winicssec Technologies Co. Ltd., Digital Immunity, Dragos, exida, ISA Security Compliance Institute, ISA99 Committee, Idaho National Laboratory, LOGIIC (Linking the Oil and Gas Industry to Improve Cybersecurity), Mission Secure, Inc., Mocana Corporation, Munio Security, PAS Global, Radiflow, Senhasegura (supporting member), Tenable, TiSafe, Tripwire, WisePlant, Wallix Group, and Xage Security.

The new adherents to the cause have all joined as founding members. Alliance membership is open to all end users, asset owners, government agencies, and other cybersecurity-focused organizations. 

“The cyber threat to critical infrastructure has never been greater,” said Eddie Habibi, founder and CEO of newly welcomed ISAGCA member PAS Global. 

ISA executive director Mary Ramsey said: “When we pair ISA’s standards expertise with the real-world experience of companies like PAS, we can make major strides in advancing cybersecurity.

“Our founding members are united in their belief that security is a journey, not a destination, and they are committed to developing the resources that asset owners need to make progress.” 

New alliance member Tripwire was sensible of the organization’s potential to influence cybersecurity around the globe. 

A Tripwire spokesman said: “In becoming a founding member of ISA Global Cybersecurity Alliance, Tripwire will participate in creating initiatives to increase industry awareness, creating education and certification programs, and advocating for sensible cybersecurity approaches with regulatory bodies and world governments.”

ISAGCA is organized into four general focus areas: Awareness & Outreach, Compliance & Prevention, Education & Training, and Advocacy & Adoption. Each area has an attached working group, actively working on projects that include creating an easy-to-follow, condensed guide to implementing the ISA/IEC 62443 series of standards and setting up a database of speakers with expertise and experience in automation cybersecurity and associated commitments to wax lyrical at industry events.

Business disruption was the main objective of attackers in the last year, with ransomware, DDoS and malware commonly used.

According to the CrowdStrike Services Cyber Front Lines Report, which offers observations from its incident response and proactive services, a third (36%) of incidents often involved ransomware, destructive malware or denial of service attacks. Crowdstrike determined that these three factors to be focused on “business disruption,” and while an adversary’s main goal in a ransomware attack is financial gain, the impact of disruption to a business can often outweigh the loss incurred by paying the ransom.

Also observed in 25% of the investigated incidents was data theft, including the theft of intellectual property, personally identifiable information and personal health information. IP theft has been linked to numerous nation state adversaries that specialize in targeted intrusion attacks, while PII and PHI data theft can enable both espionage and criminally-motivated operations.

“Typically, this type of data may be used by a cyber-espionage actor to build a dossier on a high-profile target, or a cyber-criminal may sell or ransom the information,” the report said.

To get on to a network, the most popular vector was spear-phishing, accounting for 35% of investigated cases, compared to 16% using web attacks and another 16% using compromised credentials.

Jack Mannino, CEO at nVisium, told Infosecurity that in many cases, we’re struggling with many of the same issues from a decade ago, while we’re seeing an increase in attacks against cloud infrastructure and systems.

“While many organizations have been in the cloud for a while, countless teams are still undertaking transformation and are attempting to replicate security controls that they have developed internally within a new architecture,” he said.

The report also found that organizations that meet Crowdstrike’s 1-10-60 benchmark — detect an incident in one minute, investigate in 10 minutes and remediate within an hour — are improving their chances of stopping cyber-adversaries. However, it found that the vast majority of organizations struggle to meet the 1-10-60 standard in another recent survey, despite the vast majority of organizations seeing adherence to the rule as a “game changer” in ensuring protection. “Adhering to the rule is a challenging benchmark that requires speed and experience,” the report said.

Shawn Henry, chief security officer and president of CrowdStrike Services, said: “The report offers observations into why ransomware and business disruption dominated headlines in 2019 and gives valuable insight into why issues with adversarial dwell time remain a problem for businesses around the world. Strong cybersecurity posture ultimately lies within technology that ensures early detection, swift response and fast mitigation to keep adversaries off networks for good.”

Rui Lopes, engineering and technical support manager at Panda Security, said that the use of cyberspace to carry out all kinds of malicious activities is not going anywhere in 2020, “and while cybersecurity players work to mitigate attacks, organizations struggle on their end with a gap in security experts which may not be covered even if they have a budget for it.”

Phase One of the US-China trade deal has finally been signed, with promises from Beijing that it will improve protection of IP and trade secrets and end forced tech transfers, although security experts will be skeptical.

The majority of the headlines focused on the scrapping of some mooted tariffs on goods from China including mobile phones and computers, as well as promises to increase imports of US goods by $200bn.

However, in the document itself, major sections are devoted to several areas of concern for many US businesses over the past decade or more.

These include the forced transfer of IP to a local Chinese partner that many foreign businesses have been required to follow in order to gain access to the country’s vast market. In the new document, both parties recognize that such transfers should only happen on “voluntary, market-based terms.

“Neither Party shall require or pressure persons of the other Party to transfer technology to its persons in relation to acquisitions, joint ventures, or other investment transactions,” it continued.

The new deal also contains significant new promises by China to improve protection of intellectual property, trade secrets and confidential business information and combat counterfeiting and piracy online.

“China recognizes the importance of establishing and implementing a comprehensive legal system of intellectual property protection and enforcement as it transforms from a major intellectual property consumer to a major intellectual property producer,” it said.

Specifically, China has agreed to impose “heavier punishment” including jail time and monetary fines to deter IP theft.

However, it remains to be seen whether any of the promises made by Beijing are adhered to.

Both the US and UK famously signed an agreement with China in 2015 promising it would cease all economic espionage activity. Experts revealed that activity began to ramp up again from the Chinese side soon after.

China is also increasing its collection of sensitive corporate data from all firms operating within its borders, under a new corporate social credit system, which recently raised alarm bells at the EU Chamber of Commerce in China.

This could effectively achieve the same end for the Chinese government as forced tech transfers, it warned.

“The system of regulatory ratings necessitates the collection of massive amounts of company data, mostly through mandatory data transfers to government authorities, creating an increasingly complete disclosure of a company’s profile,” the report claimed. “Large data transfers are likely to include some sensitive data points, such as technological details and personnel information.”

Researchers have also recently revealed how Chinese state hacking groups are increasingly using local companies as a front for their espionage activities.