Connect with us

Press Release

Russian SVR was behind the SolarWinds attack, according to the US authorities.

Published

on

Russian SVR was behind the SolarWinds attack, according to the US authorities.

The network of numerous U.S. agencies and commercial computer organisations was breached by hackers thanks to the SolarWinds supply-chain attack, which the U.S. government has officially blamed on Russia.

The White House names the Cozy Bear group of skilled hackers as the perpetrators of the cyber espionage operation using the SolarWinds Orion platform in a statement announcing sanctions against Russia for actions against U.S. interests.

Clearly stated attribution
The White House press release reaffirms earlier media allegations citing unofficial sources that the SolarWinds attack was carried out by the Russian Foreign Intelligence Service, or SVR.

The Cyber Unified Coordination Group (UCG) gave an unnamed Russian-backed cyber group credit for the attack at the beginning of January.

Today, the SVR is officially held responsible by the White House for running “the broad-scope cyber espionage campaign” through its hacking unit, also known as APT29, The Dukes, or Cozy Bear.

According to the White House brief, “the U.S. Intelligence Community has high confidence in its judgement of attribution to the SVR.”

The SolarWinds Vulnerability Reactor (SVR) gained access to more than 16,000 machines worldwide by hacking into the software company’s supply chain. However, the campaign exclusively targeted a small number of targets, including state and federal institutions in the United States and businesses in the cybersecurity industry (FireEye, Malwarebytes, Mimecast). The National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI) of the United States have issued a joint cybersecurity advisory warning about the top five vulnerabilities the SVR is utilising in attacks against American interests.

Organizations should heed the warning and take the appropriate precautions to spot and guard against the SVR’s nefarious behaviour.

Russian businesses are sanctioned
Today, President Biden signed an executive order prohibiting the use of property in connection with damaging actions taken by the Russian Federation’s government.

The Treasury Department has imposed sanctions on the following Russian technology firms for assisting the SVR, Russia’s Federal Security Service (FSB), and Russia’s Main Intelligence Directorate (GRU) in carrying out malicious cyber activities against the United States using the Executive Order issued today by President Biden.

A research facility and technology park funded and run by the Russian Ministry of Defense is called ERA Technopolis. The Main Intelligence Directorate of Russia (GRU) is housed and supported in ERA Technopolis, which also makes use of the personnel and knowledge of the Russian technology industry to develop military and dual-use technologies.

A business called Pasit, with its headquarters in Russia, carried out research and development in support of the hostile cyberoperations of the Russian Foreign Intelligence Service (SVR).

SVA is a Russian state-owned research facility with a focus on cutting-edge information security solutions. In order to facilitate the SVR’s nefarious cyber operations, SVA carried out research and development.

Neobit is an IT security company with offices in Saint Petersburg, Russia, and its clientele include the Russian Ministry of Defense, SVR, and the Federal Security Service of Russia (FSB). Neobit provided research and development in support of the FSB, GRU, and SVR’s cyber activities. Neobit was also designated today for providing material support to the GRU in violation of E.O. 13694, as modified by E.O. 13757, E.O. 13382, and the Countering America’s Adversaries Through Sanctions Act (CAATSA).

Russian Ministry of Defense, SVR, and FSB are a few of the clients of the IT security company AST. The FSB, GRU, and SVR’s cyber operations received technical assistance from AST. In accordance with E.O. 13694, E.O. 13382, and CAATSA, AST was also assigned today to support the FSB.

Positive Technologies is a Russian IT security company that works with clients in the Russian Government, such as the FSB. Positive Technologies holds sizable conventions that are utilised as FSB and GRU recruiting opportunities in addition to offering computer network security solutions to Russian businesses, foreign governments, and worldwide corporations. In accordance with E.O. 13694, E.O. 13382, and CAATSA, Positive Technologies was also designated today to help the FSB.

Without first requesting and receiving a licence from the Office of Foreign Assets Control, US firms and financial institutions are no longer permitted to conduct business with the aforementioned companies (OFAC).

 

Continue Reading

Press Release

Angry IT administrator destroys employer’s databases; sentenced to 7 years in prison

Published

on

Angry IT administrator destroys employer's databases; sentenced to 7 years in prison

Han Bing, a former database manager for Lianjia, a major Chinese real estate agency, was given a 7-year prison term for breaking into company computers and erasing data.

Bing is accused of carrying out the conduct in June 2018, when he reportedly accessed the company’s finance system using his administrator rights and “root” account and deleted all previously saved data from two database servers and two application servers.

Large elements of Lianjia’s operations were immediately crippled as a result, leaving tens of thousands of workers without pay for an extended length of time and necessitating a data restoration effort that cost about $30,000.

However, because Lianjia has thousands of offices, employs over 120,000 brokers, owns 51 companies, and has an estimated $6 billion market value, the indirect costs from the firm’s economic disruption were significantly more detrimental.

examination of the staff
H. Bing was one of the five primary suspects in the event involving the data deletion, according to records made public by the court of the People’s Procuratorate of Haidian District, Beijing.

When the administrator refused to reveal his laptop password to the company’s inspectors, suspicions were quickly aroused.

Chinese media outlets who reprinted portions of the disclosed documents explain that “Han Bing stated that his computer had confidential data and the password could only be handed to official authorities, or would only accept entering it personally and being present during the checks.”

The checks were solely carried out to evaluate the response of the five employees who had access to the system because, as the investigators testified in court, they knew that such an operation wouldn’t leave any records on the laptops.

Finally, the experts were able to pinpoint the activity to particular internal IPs and MAC addresses after retrieving access records from the servers. The inspectors even collected WiFi network logs and timestamps, which they afterwards compared against CCTV footage to validate their suspicions.

The forensic expert hired by the company concluded that Bing had wiped the databases using the “shred” and “rm” commands. Rm deletes the files’ symbolic links, whereas shred overwrites the data three times with different patterns to make it unrecoverable.

Unhappy employee?
Unexpectedly, Bing had regularly warned his employer and superiors about security flaws in the finance system, even emailing other administrators to express his concerns.

He was mostly disregarded, nevertheless, as the departmental administrators never gave their approval for the security project he wanted to oversee.

This was supported by the testimony of the director of ethics at Lianjia, who told the court that Han Bing frequently argued with his superiors because he believed his organisational suggestions weren’t valued.

A similar incident occurred in September 2021 when a former employee of a credit union in New York deleted approximately 21.3GB of records in a 40-minute rampage as retaliation for her managers terminating her.

Continue Reading

Press Release

Internet Explorer 11 support will no longer be offered by WordPress.

Published

on

Internet Explorer 11 support will no longer be offered by WordPress.

WordPress, the most well-known and widely used blogging platform, is thinking about removing support for Internet Explorer 11 when its usage falls below 1%.

WordPress has discovered that the cumulative usage of IE 11 is less than 1% using the following three metrics:

according to StatCounter’s GlobalStats, 0.71%.
from W3 Counter, 1.2%
from WordPress.com, 0.46%
When WordPress stopped supporting Internet Explorer 8, 9, and 10 in 2017, these usage figures were comparable.

WordPress plans to discontinue support for Internet Explorer 11 in the future due to the low number of users and the significant expense of maintaining the browser.

“Regarding the present WordPress user experience, the majority of WordPress users ought to be aware by now that a flag was introduced to BrowseHappy around 13 months ago to not recommend IE. In connection with this, the entire IE11 experience is subpar and comes with a significant maintenance cost for developers “Last week, WordPress clarified in a blog post.

WordPress is requesting feedback from individuals and organisations that still use the browser by March 18th in order to formulate their strategies for ceasing support.

WordPress is not the only platform to stop supporting IE 11.

Microsoft Teams’ web app will no longer be supported by Internet Explorer, and Microsoft 365 would stop supporting it on August 17, 2021, according to a 2020 August Microsoft announcement.

Continue Reading

Press Release

Zuckerberg says Facebook is dealing with Spotify on a songs assimilation job codenamed Task Boombox (Salvador Rodriguez/CNBC).

Published

on

Facebook is dealing with Spotify on a songs

Zuckerberg says Facebook is working with Spotify on a music integration project codenamed Project Boombox (Salvador Rodriguez/CNBC)

Salvador Rodriguez / CNBC:
Zuckerberg says Facebook is working with Spotify on a music integration project codenamed Project Boombox  —  – Facebook CEO Mark Zuckerberg on Monday announced that the company is building audio features where users can engage in real-time conversations with others.

Continue Reading

Trending