Operation Ghost Stories: FBI Releases Russian Spy Ring Papers, Video

Via Fox News -

The FBI on Monday released surveillance tapes, photos and hundreds of pages of documents that shed new light on operation "Ghost Stories," the bureau's investigation of a ring of Russian sleeper agents that ended after more than a decade in the biggest spy swap since the Cold War.

Called illegals because they took civilian jobs instead of operating inside Russian embassies and military missions, the spies, including New York real estate agent Anna Chapman, mostly settled into quiet lives in middle-class neighborhoods.

Their long-range assignment from Moscow: burrow deep into U.S. society and cultivate contacts with academics, entrepreneurs and government policymakers on subjects from defense to finance.

The heavily-edited files provide a glimpse into the intensive surveillance the deep cover agents were under, in some cases for almost a decade, showing the middle-class spies with their children, shopping or in one case attending a graduation ceremony.

The code name Ghost Stories appears to refer to the ring's efforts to blend invisibly into the fabric of American society. An FBI spokesman said the decision to release the material on Halloween was coincidental.

[...]

The U.S. swapped the 10 deep cover agents for four Russians imprisoned for spying for the West at a remote corner of a Vienna airport on July 9, in a scene reminiscent of the carefully-choreographed exchange of spies at Berlin's Glienicke Bridge during the Cold War.

While freed Soviet spies typically kept a low profile after their return to Moscow, Chapman became a lingerie model, corporate spokeswoman and television personality. Donald Heathfield, whose real name is Andrey Bezrukov, lists himself as an adviser to the president of a major Russian oil company on his LinkedIn account. President Dmitry Medvedev awarded all 10 of the freed deep-cover operatives Russia's highest honors at a Kremlin ceremony.

------------------------------------------------------------------------------

FBI: Operation Ghost Stories - Inside the Russian Spy Case
http://www.fbi.gov/news/stories/2011/october/russian_103111/russian_103111

The arrests of 10 Russian spies last year provided a chilling reminder that espionage on U.S. soil did not disappear when the Cold War ended. The highly publicized case also offered a rare glimpse into the sensitive world of counterintelligence and the FBI’s efforts to safeguard the nation from those who would steal our vital secrets.

Our case against the Russian Foreign Intelligence Service (SVR) operatives—dubbed Operation Ghost Stories—went on for more than a decade. Today we are releasing dozens of still images, surveillance video clips, and documents related to the investigation as part of a Freedom of Information Act request.

Libya's Prime Minister Confirms Presence of Chemical Weapons

Via Fox News (Oct 30, 2011) -

Libya's interim prime minister has confirmed the presence of chemical weapons in Libya and says foreign inspectors would arrive later this week to deal with the issue.

Prime Minister Mahmoud Jibril said Sunday that Libya has no interest in keeping such weapons.

Last week, Ian Martin, the top U.N. envoy to Libya, told the U.N. Security Council that undeclared chemical weapons sites have been located in Libya.

Jibril did not provide any details about the chemical weapons.

In August, Fox News interviewed Rep. Mike Rogers, R.-Mich., who said he saw a chemical weapon stockpile in the country during a 2004 trip. At the time, he said the U.S. was concerned about "thousands of pounds of very active mustard gas."

He also said there is some sarin gas that is unaccounted for.

A Russian-drafted U.N. resolution, to be voted on this week, calls on Libyan authorities to destroy stockpiles of chemical weapons in coordination with international authorities.

In February, the U.S. State Department told reporters that some chemical weapons remained in the country and the U.S. government was encouraging the Libyans to secure the sites.

Read more: http://www.foxnews.com/world/2011/10/30/libyas-prime-minister-confirms-presence-chemical-weapons/

CSIS Report: Canada Spy Agency Warned Gov Weeks Before Crippling Cyber Attack

Via The Globe and Mail (Canada) -

Canada's spy agency warned the government that federal departments were under assault from rogue hackers just weeks before an attack crippled key computers.

A newly released intelligence assessment, prepared last November, sounded a security alarm about malicious, targeted emails disguised as legitimate messages — the very kind that shut down networks two months later.

“The systems and networks used by various Canadian government departments have been attacked directly or indirectly,” says the Canadian Security Intelligence Service report.

A declassified copy of the top secret intelligence assessment, Cyberattacks on Canadian Government Departments: An Overview, was obtained by The Canadian Press under the Access to Information Act.

Extensive portions of the Nov. 4, 2010, report — including what are likely direct references to foreign suspects — have been excised due to ongoing sensitivity of the material.

“Canada has been engaged in detecting, monitoring and mitigating a series of ongoing and evolving ... cyberattacks directed against the computer systems and networks used by Canadian government departments,” says the CSIS document.

[...]

Employee Internet access at the Treasury Board and Finance departments — whose systems are shared — was cut off in January after what officials called “an unauthorized attempt” to break into the networks.

A routine evaluation of both departments last year revealed they had not been following all of the government's information technology security requirements.

Records previously released under the access law show government employees in a number of departments were advised last January of attempts to break into their systems, only days before one of the attempts succeeded.

The CSIS assessment notes the “tools and techniques used in these attacks are in a constant state of development and incorporate new computer-related technologies and Internet-related capabilities.”

[...]

In its annual public report last June, the spy service said cyberattacks launched through the Internet were the fastest growing form of espionage.

Attackers target computer systems in search of technology, intellectual property, military strategy and commercial or weapons-related information, the annual report said.

Why a Cybersecurity Treaty Is a Pipe Dream

Via Council on Foreign Relations (Op-Ed for CNN) -

With companies and governments seemingly incapable of defending themselves from sophisticated cyber attacks and infiltration, there is almost universal belief that any durable cybersecurity solution must be transnational. The hacker – a government, a lone individual, a non-state group – stealing valuable intellectual property or exploring infrastructure control systems could be sitting in Romania, China, or Nigeria, and the assault could transit networks across several continents. Calls are therefore growing for a global treaty to help protect against cyber threats.

As a step in that direction, the British government is convening next week the London Conference on Cyberspace to promote new norms of cybersecurity and the free flow of information via digital networks. International diplomacy like this among states and private stakeholders is important and will bring needed attention to these issues. But the London summit is also likely to expose major fault lines, not consensus, on the hardest and most significant problems. The idea of ultimately negotiating a worldwide, comprehensive cybersecurity treaty is a pipe dream.

Read more: Why a Cybersecurity Treaty Is a Pipe Dream

Anonymous Threatens to Expose Zeta Cartel's Secrets

Via Houston Chronicle (Oct 28, 2011) -

An international group of online hackers is warning a Mexican drug cartel to release one of its members, kidnapped from a street protest, or it will publish the identities and addresses of the syndicate's associates, from corrupt police to taxi drivers, as well as reveal the syndicates' businesses.

The vow is a bizarre cyber twist to Mexico's ongoing drug war, as a group that has no guns is squaring off against the Zetas, a cartel blamed for thousands of deaths as well as introducing beheadings and other frightening brutality.

[...]

He also implies that the group will expose mainstream journalists who are somehow in cahoots with the Zetas by writing negative articles about the military, the country's biggest fist in the drug war.

"We demand his release," says the Anonymous spokesman, who is wearing a mask like the one worn by the shadowy revolutionary character in the movie V for Vendetta, which came out in 2006. "If anything happens to him, you sons of (expletive) will always remember this upcoming November 5."

The person reportedly kidnapped is not named, and the video does not share information about the kidnapping other than that it occurred in the Mexican state of Veracruz during a street protest.

Anonymous draws its roots from an online forum dedicated to bringing sensitive government documents and other material to light.

If Anonymous can make good on its threats to publish names, it will "most certainly" lead to more deaths and could leave bloggers and others open to reprisal attacks by the cartel, contends Stratfor, an Austin-based global intelligence company.

"In this viral world on the Internet, it shows how much damage could be done with just one statement on the Web," said Fred Burton of Stratfor, which published a report Friday that probes the implications of the cartel drawing the activists' ire.

Mike Vigil, the retired head of international operations for the Drug Enforcement Administration, said the Zetas must take Anonymous seriously.

"It is a gutsy move," Vigil said. "By publishing the names, they identify them to rivals, and trust me, they will go after them."

The Nitro Attacks: Stealing Secrets from the Chemical Industry

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the_nitro_attacks.pdf

Introduction

This document discusses a recent targeted attack campaign directed primarily at private companies involved in the research, development, and manufacture of chemicals and advanced materials. The goal of the attackers appears to be to collect intellectual property such as design documents, formulas, and manufacturing processes. In addition, the same attackers appear to have a lengthy operation history including attacks on other industries and organizations. Attacks on the chemical industry are merely their latest attack wave. As part of our investigations, we were also able to identify and contact one of the attackers to try and gain insights into the motivations behind these attacks. As the pattern of chemical industry targets emerged, we internally codenamed the attack campaign Nitro.

The attack wave started in late July 2011 and continued into mid-September 2011. However, artifacts of the attack wave such as Command and Control (C&C) servers are also used as early as April 2011 and against targets outside the chemical industry. The purpose of the attacks appears to be industrial espionage, collecting intellectual property for competitive advantage.

Targets

The attackers have changed their targets over time. From late April to early May, the attackers focused on human rights related NGOs. They then moved on to the motor industry in late May. From June until mid-July no activity was detected. At this point, the current attack campaign against the chemical industry began. This particular attack has lasted much longer than previous attacks, spanning two and a half months.

A total of 29 companies in the chemical sector were confirmed to be targeted in this attack wave and another 19 in various other sectors, primarily the defense sector, were seen to be affected as well. These 48 companies are the minimum number of companies targeted and likely other companies were also targeted. In a recent two week period, 101 unique IP addresses contacted a command and control server with traffic consistent with an infected machine. These IPs represented 52 different unique Internet Service Providers or organizations in 20 countries.

Companies affected include:

• Multiple Fortune 100 companies involved in research and development of chemical compounds and advanced materials.
• Companies that develop advanced materials primarily for military vehicles.
• Companies involved in developing manufacturing infrastructure for the chemical and advanced materials industry.

[...]

Attribution

The attacks were traced back to a computer system that was a virtual private server (VPS) located in the United States. However, the system was owned by a 20-something male located in the Hebei region in China. We internally have given him the pseudonym of Covert Grove based on a literal translation of his name. He attended a vocational school for a short period of time specializing in network security and has limited work experience, most recently maintaining multiple network domains of the vocational school.

Covert Grove claimed to have the U.S.-based VPS for the sole purpose of using the VPS to log into the QQ instant message system, a popular instant messaging system in China. By owning a VPS, he would have a static IP address. He claims this was the sole purpose of the VPS. And by having a static IP address, he could use a feature provided by QQ to restrict login access to particular IP addresses. The VPS cost was RMB200 (US$32) a month. While possible, with an expense of RMB200 a month for such protection and the usage of a U.S.-based VPS, the scenario seems suspicious. We were unable to recover any evidence the VPS was used by any other authorized or unauthorized users. Further, when prompted regarding hacking skills, Covert Grove immediately provided a contact that would perform ‘hacking for hire’. Whether this contact is merely an alias or a different individual has not been determined.

We are unable to determine if Covert Grove is the sole attacker or if he has a direct or only indirect role. Nor are we able to definitively determine if he is hacking these targets on behalf of another party or multiple parties.

------------------------------------------------------------------------------------

Here is a little gem (missed by many) in Symantec's Nitro Attacks Report....

Page 3:

"Figure 2 shows the country of origin of the organizations targeted by these attacks. While the US and UK again figure highly here, overall the geographical spread is different. This means that the infected computers are rarely located within the organizations’ headquarters or country of origin."

In attempting to explain this, Symantec misses one another option: attackers like to target people that share their native language - making for easier social engineering attacks.

Android Orphans: Visualizing a Sad History of Support

http://theunderstatement.com/post/11982112928/android-orphans-visualizing-a-sad-history-of-support

The announcement that Nexus One users won’t be getting upgraded to Android 4.0 Ice Cream Sandwich led some to justifiably question Google’s support of their devices. I look at it a little differently: Nexus One owners are lucky. I’ve been researching the history of OS updates on Android phones and Nexus One users have fared much, much better than most Android buyers.

I went back and found every Android phone shipped in the United States1 up through the middle of last year. I then tracked down every update that was released for each device - be it a major OS upgrade or a minor support patch - as well as prices and release & discontinuation dates. I compared these dates & versions to the currently shipping version of Android at the time. The resulting picture isn’t pretty - well, not for Android users....

-------------------------------------------------------------------------

This is one case where Apple's full vertical market control of their phone product is a positive.

Carriers have never been good about applying OS patches on mobile phones. It was less important when each carrier had a different OS, but as they increasingly converge toward Android...the bad guys are watching the number of mobile devices that can be exploited with one attack plan increasing in front of them very quickly - all thanks to the carriers themselves.

STRATFOR: Dissecting a Mexican Cartel Bombing in Monterrey

Via STRATFOR (Security Weekly) -

Early Oct. 20, a small sedan apparently filled with cartel gunmen rapidly pulled in front of a military vehicle, drawing the military patrol into a car chase in downtown Monterrey, Mexico. After a brief pursuit, the vehicle carrying the cartel gunmen turned at an intersection. As the military vehicle slowed to negotiate the turn, an improvised explosive device (IED) concealed in a parked car at the intersection detonated. The incident appears to have been intended to lure the military patrol into a designated attack zone. While the ambush did not kill any soldiers, it did cause them to break off their chase.

Though this IED ambush is interesting in itself for a number of reasons, we would like to use it as a lens to explore a deeper topic, namely, how STRATFOR analyzes a tactical incident like this.

Read more: Dissecting a Mexican Cartel Bombing in Monterrey | STRATFOR

-------------------------------------------------------------------------------------

STRATFOR Dispatch: Implications of a Mexican Drug Lord's Capture
http://www.stratfor.com/analysis/20111027-dispatch-implications-mexican-drug-lords-capture

Vice President of Tactical Intelligence Scott Stewart discusses the arrest of Rafael Cardenas Vela and what it means for the Gulf Cartel and for security in Mexico’s northeast.

U.S. Drone Base in Ethi­o­pia is Operational

Via Washington Post -

The Air Force has been secretly flying armed Reaper drones on counterterrorism missions from a remote civilian airport in southern Ethi­o­pia as part of a rapidly expanding U.S.-led proxy war against an al-Qaeda affiliate in East Africa, U.S. military officials said.

The Air Force has invested millions of dollars to upgrade an airfield in Arba Minch, Ethi­o­pia, where it has built a small annex to house a fleet of drones that can be equipped with Hellfire missiles and satellite-guided bombs. The Reapers began flying missions earlier this year over neighboring Somalia, where the United States and its allies in the region have been targeting al-Shabab, a militant Islamist group connected to al-Qaeda.

[...]

The Washington Post reported last month that the Obama administration is building a constellation of secret drone bases in the Arabian Peninsula and the Horn of Africa, including one site in Ethi­o­pia. The location of the Ethio­pian base and the fact that it became operational this year, however, have not been previously disclosed. Some bases in the region also have been used to carry out operations against the al-Qaeda affiliate in Yemen.

The Air Force confirmed Thursday that drone operations are underway at the Arba Minch airport. Master Sgt. James Fisher, a spokesman for the 17th Air Force, which oversees operations in Africa, said that an unspecified number of Air Force personnel ­are working at the Ethio­pian airfield “to provide operation and technical support for our security assistance programs.”

The Arba Minch airport expansion is still in progress but the Air Force deployed the Reapers there earlier this year, Fisher said. He said the drone flights “will continue as long as the government of Ethi­o­pia welcomes our cooperation on these varied security programs.”

China's Internet Users Targeted in Online Rumour Probes

Via BBC -

China is intensifying restrictions on internet use after official reports revealed that three people have been "punished for spreading false rumours" online.

Authorities say they are carrying out inquiries into other suspected cases.

The news comes just over a week after Communist Party leaders agreed a list of "cultural development guidelines".

They include increased controls over social media and penalties for those spreading "harmful information".

The Xinhua news agency quotes regulators as saying that efforts will be stepped up "to stop rumours and punish individuals and websites spreading rumours".

It says a university student was detained after being accused of posting a fake news story about a man killing eight village chiefs in the south-western province of Yunnan.

It goes on to report that a website editor was issued with a warning after publishing a story about an air force fighter crash without confirming the facts.

And it says that a Shanghai resident was held in police custody for 15 days after accusations he had posted a falsified income tax document online.

The agency says China has 485 million registered web users.

"We have seen a tightening of control under the Hu Jintao government," said Sarah McDowall, Asia-Pacific regional manager at IHS Global Insight.

"Officials are particularly worried by the rise in popular protests and will have observed the fall of Gaddafi last week. With China facing a leadership change next year, the government feels it cannot soften its stance."

SecureWorks: Duqu Trojan Questions and Answers

http://www.secureworks.com/research/threats/duqu/

The Dell SecureWorks Counter Threat UnitSM (CTU) research team has been analyzing an emerging malware threat identified as the Duqu trojan. This Trojan horse has received a great deal of attention because it is similar to the infamous Stuxnet worm of 2010. This report includes answers to questions about this threat. CTU researchers have put countermeasures in place to detect Duqu C2 traffic, and they continue to monitor for new Duqu samples and update protections as needed.

Chinese Military Suspected in Hacker Attacks on U.S. Satellites

Via Bloomberg BusinessWeek -

Computer hackers, possibly from the Chinese military, interfered with two U.S. government satellites four times in 2007 and 2008 through a ground station in Norway, according to a congressional commission.

The intrusions on the satellites, used for earth climate and terrain observation, underscore the potential danger posed by hackers, according to excerpts from the final draft of the annual report by the U.S.-China Economic and Security Review Commission. The report is scheduled to be released next month.

“Such interference poses numerous potential threats, particularly if achieved against satellites with more sensitive functions,” according to the draft. “Access to a satellite‘s controls could allow an attacker to damage or destroy the satellite. An attacker could also deny or degrade as well as forge or otherwise manipulate the satellite’s transmission.”

A Landsat-7 earth observation satellite system experienced 12 or more minutes of interference in October 2007 and July 2008, according to the report.

Hackers interfered with a Terra AM-1 earth observation satellite twice, for two minutes in June 2008 and nine minutes in October that year, the draft says, citing a closed-door U.S. Air Force briefing.

The draft report doesn’t elaborate on the nature of the hackers’ interference with the satellites.

-----------------------------------------------------------------------------

Hackers Targeted U.S. Government Satellites
http://www.wired.com/threatlevel/2011/10/hackers-attack-satellites/

Google Funded Project Confirms Vast Potential for Geothermal Energy

Via Forbes -

When people talk about alternative energy, they typically discuss the potential of wind and solar projects. Don’t get me wrong – there’s a vast potential in those technologies. But often left out of the discussion is the vast potential for geothermal energy – using the natural heat under the Earth’s surface to produce electricity. Harnessing that energy is one of the cleanest, sustainable ways to produce electricity, and it also has the benefit of being more space efficient than, say, a wind farm.

Of course, like any natural resource, the question becomes – where best to build geothermal plants? To answer that question, researchers at Southern Methodist University, funded by Google.org, compiled data from over 35,000 sites to build a complete picture of geothermal potential in the United States. Their findings? There is a vast potential for geothermal energy that can be tapped with technology existing today. You can check out the mapping for yourself on Google Earth by going here and downloading the info.

How much energy? you ask. Well, the researchers based their estimates on what current technology is able to extract – not any hypothetical future advances. Even so, it turns out that there is three million megawatts of potential geothermal energy below the surface of the United States. That’s ten times the energy of every coal plant in the United States online today.

That’s an enormous potential for much cleaner energy than what we use today.

Mitsubishi Heavy Industries Admits Hackers May Have Snatched Secrets

Via Computerworld (Oct 25, 2011) -

Japan's largest defense contractor backpedaled yesterday, saying it's possible some secrets had been stolen by hackers who broke into the company's network and planted malware in August. The acknowledgement came several weeks after Mitsubishi Heavy Industries, confirming that scores of its servers and PCs had been infected, denied any information had been pilfered.

Previously, a U.S.-based Mitsubishi Heavy spokesman had said that although attackers had uncovered company IP (Internet Protocol) addresses, the attack "was caught at an early stage." But yesterday the company changed its tune, saying that more investigation had revealed a possible loss of information.

"The company recently confirmed unintended transferring of some information on the company's products and technologies between servers within the company," said Mitsubishi Heavy in a statement. "Based on the finding, the company investigated the incident further and recognized the possibility of some data leakage from the server in question."

The company declined to confirm that any diversion of data related to defense or nuclear technologies took place. Mitsubishi Heavy's admission came on the same day that the Japanese newspaper Asahi Shimbun cited unnamed sources who said data on company-built fighter jets, helicopters and nuclear power plants had apparently been stolen during the attack.

McAfee Says Duqu No Threat To Utilities

Via CRN -

Security vendor McAfee has told utilities that the Duqu malware posed no threat, a concern raised by its similarities to the Stuxnet worm that attacked industrial control systems in Iran’s nuclear facility last year.

In a conference call Monday, David Hatchell, utilities account manager for McAfee, said there was “nothing to worry about at this point.”

“It (Duqu) is not targeting industrial control systems that we know of, and it’s not targeting any energy (companies) as far as we know,” Hatchell said.

[...]

“We can clearly see that this is used for espionage,” Peter Szor, senior director of research at McAfee Labs, said during the conference call. Very different industries have been targeted, including a hotel chain. While there was no confirmation from Iran, military industries in the country also could have been targeted. “Basically the goal of the malware is speculation at this point,” he said.

[...]

Szor said the company believes the drivers for Duqu were compiled in November 2010. The keylogger portion of Duqu, which records keyboard strokes, was compiled three months earlier. Szor believes earlier variants of Duqu may have been used to steal data in preparation for the Stuxnet attack. “That’s why I think personally that Duqu was a bit earlier than Stuxnet,” he said.

Variations of Duqu have been confirmed in England, Iran and the U.S., with reports of the Trojan in Austria, Hungary and Indonesia, McAfee said. Similarities to Stuxnet include the same malware-hiding rootkit, use of a stolen certificate authority from Taiwan to enable installation and a set timeframe for operation. Duqu was timed to delete itself after 36 days and the certificate was stolen from C-Media Electronics, according to McAfee.

-----------------------------------------------------------------

McAfee Labs: Duqu – Threat Research and Analysis
http://blogs.mcafee.com/wp-content/uploads/2011/10/Duqu1.pdf

Hackers Likely Have Japanese Warplane, Nuclear Data

Via InformationWeek -

Hackers targeting Japan's defense industry likely obtained sensitive information relating to military warplanes, missiles, as well as design and safety information for nuclear power plants.

On Monday, sources close to the Japanese defense ministry said that while data relating to confidential national security matters didn't appear to have been breached, sensitive information had been stolen, reported the Japan Times.

[...]

Earlier this month, both Mitsubishi Heavy and Kawasaki Heavy Industries suffered attacks after hackers stole email addresses for senior executives at defense contractors, reported the Daily Yomiuri. The email addresses were stolen earlier this year from the Society of Japanese Aerospace Companies (SJAC), an industry association that counts numerous Japanese aeronautics, space, and defense-related import businesses as members and partners.

The recent attack against Mitsubishi Heavy and Kawasaki Heavy Industries followed attacks against numerous Japanese defense contractors over the summer. They came to light when Mitsubishi Heavy filed a complaint to Tokyo police in September, saying that its website had been breached by an attack that targeted 45 company servers, resulting in 38 computers in 11 locations being infected with more than 50 different types of viruses.

Those viruses apparently enabled the attackers to steal data from Mitsubishi Heavy relating to warplanes, nuclear plants, as well as Japan's Type 80 ASM-1 missile, which can be used against ships. Notably, the locations infected by the viruses included the Kobe and Nagasaki shipyards, which build submarines and destroyers, as well a facility in Nagoya that's building a guided missile system, reported Asahi Shimbun.

Meanwhile, in the most recent attack--involving SJAC--the attacker used the industry association as a stepping stone to the defense contractors. "The hacker targeted the industry association, which has inadequate security. We assume the hacker attempted to use it to spread computer viruses throughout the nation's defense industry," a senior Japanese police official told the Daily Yomiuri. Similar attacks were launched against Kawasaki Heavy Industries, and the attacker appeared to have stolen at least some of that company's emails.

But police said that before breaching SJAC, the attacker first exploited a PC at an international telephone service company located in Tokyo. The attacker used that PC to send an email--presumably with a malicious attachment--to someone at SJAC. The malicious attachment was opened, and a PC at SJAC compromised. From there, the attacker used the PC to access an internal server containing the names and email addresses for senior executives at Japanese defense contractors.

Next, the attacker sent one or more emails from the exploited PC at SJAC, supposedly from an SJAC executive, to defense contractors. In the case of Kawasaki Heavy Industries, the email subject line read, "Prior distribution of documents," and the message included a malicious file attachment titled "Comments on lump sum procurement." Interestingly, the email's subject line and contents were virtually identical to a message that the executive had sent, just 10 hours prior.

Japan's defense contractors aren't the only institutions being targeted by attackers. On Tuesday, Asahi Shimbun reported that a Trojan application sent as an email attachment to Japanese legislators had enabled attackers to spy on lawmakers for at least a month. Once the Trojan application had infected a targeted PC, it downloaded malware from a server in China, enabling the attackers to steal usernames and passwords.

---------------------------------------------------------------

Sophos: Japanese Parliament Hit By Cyber Attack
http://nakedsecurity.sophos.com/2011/10/25/japanese-parliament-hit-by-cyber-attack/

STRATFOR: Mexican Cartel Smuggling Routes

Source: http://www.stratfor.com/content/areas-mexican-cartel-smuggling-routes

Linux 'Tsunami' Backdoor Ported to Target OS X Systems

Via ESET Blog -

We’ve just come across an IRC controlled backdoor that is enables the infected machine to become a bot for Distributed Denial of Service attacks. The interesting part about it is that it’s a Mach-O binary – targeting Mac OS X.

ESET’s research team compared this to samples in our malware collection and discovered that this code is derived from something we’ve seen before. It is actually an OS X port of the Linux family of backdoors that we have been detecting since 2002 as Linux/Tsunami.

The analyzed sample contains a hardcoded list of IRC servers and channel that it attempts to connect to. This client then listens and interprets commands from the channel.

[...]

In addition to enabling DDoS attacks, the backdoor can enable a remote user to download files, such as additional malware or updates to the Tsunami code. The malware can also execute shell commands, giving it the ability to essentially take control of the affected machine.

In terms of functionality, the Mac variant of the backdoor is similar to its older Linux brother, with only the IRC server, channel and password changed and the greatest difference being that it’s a 64-bit Mach-O binary instead of an ELF binary.

Tunisia's Voters Go to the Polls in Arab Spring's First Election

Via The Guardian UK -

People queue to vote as candidates from 110 political parties and scores of independents bid to join Tunisia's new 217-seat government. Turnout in the first free election in Tunisian history was thought to have been high. The Islamist An-Nahda party is expected to win the biggest share of the vote.



-----------------------------------------------------------------------

CFR: Tunisia at the Crossroads
http://www.cfr.org/tunisia/tunisia-crossroads/p26254

"In many ways, the election process may be just as important as the results. A free and fair election would be a first in Tunisia, and strong voter turnout will signal public support for the transition process. As long as voting proceeds without significant irregularities, the international community should applaud the elections as a significant step toward democracy."

SpyEye Changes Phone Numbers to Hijack Out of Band SMS Security

Via Trusteer Blog (Oct 5, 2011) -

The Trusteer research team recently uncovered a stealth new attack carried out by the SpyEye Trojan that circumvents mobile SMS (short message service) security measures implemented by many banks. Using code we captured while protecting a Rapport user, we discovered a two-step web-based attack that allows fraudsters to change the mobile phone number in a victim’s online banking account and reroute SMS confirmation codes used to verify online transactions. This attack, when successful, enables the thieves to make transactions on the user’s account and confirm the transactions without the user’s knowledge.

[...]

Out-of-Band is not a Panacea

This latest SpyEye configuration demonstrates that out-of-band authentication (OOBA) systems, including SMS-based solutions, are not fool-proof. Using a combination of MITB (man in the browser injection) technology and social engineering, fraudsters are not only able to bypass OOBA but also buy themselves more time since the transactions have been verified and fly under the radar of fraud detection systems. The only way to defeat this new attack once a computer has been infected with SpyEye is using endpoint security that blocks MITB techniques. Without a layered approach to security, even the most sophisticated OOBA schemes can be made irrelevant under the right circumstances.