Russian-Speaking Hackers Hijack Satellite Links To Hide Cyberspying Operation

'Turla' exploits unencrypted satellite links in Africa and the Middle East to evade detection.

A notorious cyber espionage gang believed to be out of Russia commandeers unencrypted satellite links to mask its information-stealing operations.

The so-called Turla group -- aka Snake  -- hijacks unencrypted downstream satellite links from customers of satellite providers in the Middle East and Africa, and then uses those connections to exfiltrate data from its cyber espionage victims, researchers from Kaspersky Lab say. Turla is best known for targeting government agencies, embassies, military, pharmaceutical, and research organizations in the US, Kazakhstan, Russia, Vietnam, and China.

Unencrypted one-way satellite communications are widely known to be vulnerable to hacking. A researcher at Black Hat USA last month demonstrated how he was able to hack the Globalstar Simplex satellite data service using equipment he purchased for less than $1,000. Colby Moore, information security officer with Synack, says an attacker could intercept, spoof or interfere with satellite communications between tracking devices, satellites or ground stations because the Globalstar network doesn't encrypt those links nor digitally sign or authenticate the data packets. Globalstar maintains that "many … Globalstar devices have encryption" deployed by its integrators.

Kurt Baumgartner, principal security researcher at Kaspersky Lab, says his firm believes the Turla cyber espionage gang has been employing hijacked satellite links for about seven years now--almost as long as the group has been in action. "We've seen these IPs cycled" in Turla's activities, he says.

It's all about keeping their underlying command and control infrastructure operational and hidden from the prying eyes of researchers and others. But Turla isn't the only group that's employed satellite communications for their C&C, Baumgartner says. "We've seen a couple of other groups" as well, he says. 

The notorious Hacking Team is among those that have used satellite-based IPs, as has the Xumuxu hacker group and the pro-Iranian Rocket Kitten hacking group.

"This is an unusual technique," Baumgartner says. "It's selectively used by them [Turla]. Almost everything Turla does has some sort of criteria selection … Turla is one of the stealthier actors who have put a lot of effort into maintaining and investing in infrastructure so they're really trying to maintain the anonymity of their infrastructure."

They're basically spoofing the legitimate satellite customer, who is none the wiser, he says. "The data they are stealing flows over the link paid by" the customer, he says. Turla doesn't bother hacking that customer's data--that's not its goal. "They wouldn't be able to do [this hijacking] if the link was encrypted," Baumgartner notes.

Source: Kaspersky Lab

The technique works like this: Turla "listens" via an inexpensive antenna-based system for downstream communications from a satellite provider to spot active IP addresses of users online and then hijacks that connection. The pilfered satellite link is then used to siphon stolen information from "high profile" targets of Turla, according to Kaspersky's research.

"The data travels through conventional lines to the satellite Internet provider's teleports, then up to the satellite, and finally down from the satellite to the users with the chosen IPs," Kaspersky says in its new Turla research, published today.

Kaspersky Lab stops short of calling out Turla as a Russian nation-state group: it describes Turla as a "Russian-speaking" cyberspying operation. But other security firms, including Recorded Future, believe it's a Russian-based hacking operation.

Mapping How Tor’s Anonymity Network Spread Around the World

Click to Open Overlay Gallery LUKE MILLANTA

ONLINE PRIVACY PROJECTS come and go. But as the anonymity software Tor approaches its tenth year online, it’s grown into a powerful, deeply-rooted privacy network overlaid across the internet. And a new real-time map of that network illustrates just how widespread and global that network has become.

On Friday, freelance Sydney-based coder Luke Millanta launched Onionview, a web-based project that counts and tracks the geographic location of Tor nodes, the volunteer computers that bounce encrypted traffic around the web to offer Tor users anonymity. His goal, in part, was to show the network’s scale and how much it’s grown. “People think that Tor is 10 people running computers in their basements,” Millanta says. “When people see the map, they say ‘Holy shit. That’s what 6,000 nodes around the world looks like.'”

Millanta’s map also makes it possible to compare which countries host the largest chunks of the Tor network. Despite Tor’s origins as a research project at the US Navy and later at MIT, privacy-loving Germany has overtaken the US in total nodes, with France, the Netherlands, and Russia coming close behind. Here’s a breakdown of the nodes by country:

1. Germany: 1,364
2. United States: 1,328
3. France: 714
4. Netherlands: 472
5. Russia: 270
6. United Kingdom: 261
7. Sweden: 210
8. Canada: 209
9. Switzerland: 148
10. Romania: 117

Onionview’s visualization also captures just how much Snowden’s NSA surveillance revelations swelled Tor’s footprint: Five years ago, the network consisted of less than 2,000 nodes, compared with 6,425 today. Even in 2012, Snowden’s leaked NSA documents showed that the agency was having trouble identifying Tor users. With thousands of more turns now in the network’s global maze, tracking Tor users online is likely harder than ever.

By Andy Greenberg for WIRED

Sharing Cyber Intelligence To Fight Cyber Crime And Fraud-as-a-Service (FaaS)

Wired reported earlier this week that hackers posted a “data dump, 9.7 gigabytes in size… to the dark web using an Onion address accessible only through the Tor browser.” The data included names, passwords, addresses, profile descriptions and several years of credit card data for 32 million users of Ashley Madison, a social network billing itself as the premier site for married individuals seeking partners for affairs.

“I want to show you the dark side of the net,” Etay Maor told me when we met a couple of weeks ago at the IBM offices in Cambridge, Massachusetts. He then proceeded to give me a tour of the Internet’s underground, where cyber criminals and hackers exchange data, swap tips, and offer free and for-fee services. “Information sharing is a given on the dark side,” said Maor, “but for the good guys, it’s not that easy.”

Maor is a senior fraud prevention strategist at IBM and has watched the dark side of the Web at RSA, where he led the cyber threats research lab, and later at Trusteer, a cybersecurity startup which IBM has acquired in 2013 for a reported $1 billion. His focus is cybercrime intelligence, specifically malware—understanding how it is developed and the networks over which it is distributed. Maor is an expert on how cyber criminals think and act and shares his knowledge with IBM’s customers and also with the world at large by speaking at conferences and blogging at securityintelligence.com.

The Web is like an iceberg divided into three segments, each with its own cluster of hangouts for cyber criminals and their digital breadcrumbs. The tip of the iceberg is the “Clear Web” (also called the Surface Web), indexed by Google and other search engines. The very large body of the iceberg, submerged under the virtual water, is the “Deep Web”—anything on the Web that’s not accessible to the search engines (e.g., your bank account). Within the Deep Web lies the “Dark Web,” a region of the iceberg that is difficult to access and can be reached only via specialized networks.

Maor first demonstrated to me how much cybercrime-related information is available on the Clear Web. Simply by searching for spreadsheets with the word “password” in them, you can get the default password list for many types of devices and other things and places of interest to criminals. There is easily accessible information that may have been posted to the Web innocently or by mistake. But there is also a lot of compromised information (e.g., stolen email addresses and their passwords) available on legitimate websites that provide a Web location for dumping data.

Then there are forums for criminals, some masquerading as a benign “hacking community” or “security research forum,” promoting themselves like any other business and/or community, including a Facebook page, and covering their costs or even making some money by displaying ads. One such forum had 1,200 other people accessing it when Maor showed it to me, demonstrating how, with a few clicks of the mouse, you can find lists of stolen credit card numbers including all the requisite information about the card holder.

Maor proceeded to introduce me to Tor, the most popular specialized network providing anonymity for its users, including participants in the underground economy of the Dark Web.  It was developed in the 1990s with the purpose of protecting U.S. intelligence communications online by researchers at the US Naval Research Lab which released the code in 2004 under a free license. It has 2.5 million daily users, some with legitimate reasons to protect their identities, and others who are engaged in criminal activities.

Tor is based on Onion routing, where messages are encapsulated in layers of encryption. The encrypted data is transmitted through a series of network nodes called onion routers, each of which “peels” away a single layer, uncovering the data’s next destination. The sender remains anonymous because each intermediary knows only the location of the immediately preceding and following nodes. The final node in the chain, the “exit node,” decrypts the final layer and delivers the message to the recipient.

While Tor is used by people with legitimate reasons to hide their identity, it (and similar networks) also facilitates a thriving underground economy. This is where you can buy firearms, drugs, fake documents, prescription drugs or engage in pedophilia networks, human trafficking, and organ trafficking. Maor paraphrases Oscar Wilde: “Give a man a mask and he will show his true face.”

Tor is also home to rapidly growing “startups,” offering fraud-as-a-service. A decade ago, says Maor, cybercrime “was one-man operation.  Today, it’s teamwork.”  Furthermore, the whole process, from coding the malware to distributing it to working with money mules, can be easily outsourced.  Everything a cybercriminal might need is now available on the underground forums, some components of the process as a free download, others as a for-fee service, including cloud-based services with guaranteed service level agreements (SLAs). The menu of cybercrime options has grown beyond financial fraud tools, to include advanced targeting tools, Remote Access Tools (RATs), and health care and insurance fraud tools and services.

The explosion of data about us, our lives and our workplaces on the Clear Web has helped the denizens of the Dark Web circumvent traditional online defenses such as passwords. “Fifteen years ago,” says Maor, “it took a lot of work to breach a company. Today, I can go on Linkedin and find out exactly what is the structure of the company I’m interested in.” Knowledge of the reporting structure of a specific company helps criminals’ “social engineering” efforts, manipulating people into performing certain compromising actions or divulging confidential information. Once criminals get to know their targets (e.g., by connecting on Linkedin), the victims may open an email or attachment that will infect their computer and provide the desired access to the company’s IT infrastructure.

Cyber criminals are taking advantage of the abundance of data on the Web and its success at connecting and networking over 2 billion people around the world. 80% of cyber attacks are driven by highly organized crime rings in which data, tools and expertise are widely shared, according to a UN study on organized crime, generating $445 billion in illegal profits and brokering one billion-plus pieces of personally identifiable information annually.

Data and networking—aren’t they also great tools in the fight against cybercrime? Not so much. Corporations and security firms have been reluctant to share cybersecurity intelligence. Only 15% of respondents to a recent survey said that “participating in knowledge sharing” is a spending priority.

There have been some efforts to change that, such as the establishment of industry-specific Information Sharing and Analysis Centers (ISACs) and the cross-industryNational Council of ISACs.  The Department of Homeland Security and other government agencies are working to promote specific, standardized message and communication formats to facilitate the sharing of cyber intelligence in real time. The Cybersecurity Information Sharing Act (CISA), a bill creating a framework for companies and federal agencies to coordinate against cyberattacks, is being debated in Congress.

Alejandro Mayorkas, the Deputy Secretary of Homeland Security recently said: “Today’s threats require the engagement of our entire society. This shared responsibility means that we have to work with each other in ways that are often new for the government and the private sector. This means that we also have to trust each other and share information.”

IBM has taken a big step towards greater engagement and information sharing when it launched in April the IBM X-Force Exchange. It is a threat intelligence sharing platform where registered users can mine IBM’s data to research security threats, aggregate cyber intelligence, and collaborate with their peers. IBM says the exchange has quickly grown to 7,500 registered users, identifying in real-time sophisticated cybercrime campaigns. “I’m a fan,” security guru Bruce Schneier responded when I asked him about X-Force Exchange.

“The security industry must share information, all the time, in real time,” says Maor. “It’s a change of mindset, but it has to be done if we want to have some sort of edge against the criminals.”

By Gill Press

Homeland Security chairman: Chattanooga attack could happen ‘anywhere, anytime’

House Homeland Security Chairman Michael McCaul (R-Texas) said on Sunday that the deadly attack on two military facilities in Chattanooga, Tenn., is the type that worries officials the most.

McCaul said an intensive investigation is underway after Mohammad Youssuf Abdulazeez killed four Marines and a sailor last week.

“Well, the FBI is currently doing a forensics examination on his computer, his cell phone, his travels to Jordan, which is right across the border from Syria,” he said on ABC’s “This Week with George Stephanopoulos.” “So we have the threat of foreign fighters, but we also have the threat over the Internet, which is a new sort of threat that's out there, a new generation of terrorists … These Internet directives from a cyber command if you will out of Syria to activate people in the United States to attack.

“And what they are saying is attack military installations and attack police officers. And what we saw was one of the most deadliest attacks on American soil against our U.S. Marines and an American sailor,” he added. “And this is case that we're most worried about.”

McCaul said investigations have “rolled up” Islamic State in Iraq and Syria (ISIS) followers in 60 cases during the past year.

“We have investigations into all 50 states,” he added. “But what keeps us up at night are really the ones that we don't know about. And I'm afraid that this case falls into that category.”

“If it can happen in Chattanooga, it can happen anywhere, anytime, anyplace, and that's our biggest fear,” he said.

By Kyle Balluck 

Cybersecurity Booms as New Stocks Debut

Getty Images

The cybersecurity boom on Wall Street is growing.

This week, the second-ever cybersecurity exchange-traded fund (ETF) — which bundles multiple crime fighting companies to trade as one stock — hit the New York City-based NASDAQ stock exchange.

Prominent security firm Rapid7 also said on Tuesday it was boosting its initial public offering (IPO) goal to $111 million, a 38 percent from a previous estimate in late June.

The ETF, which goes by the symbol “CIBR,” comes on the heels of another wildly popular cyber ETF, which trades on the New York Stock Exchange under the symbol “HACK.”

In less than eight months of trading, HACK has eclipsed $1 billion in assets. According to financial news site ETF Trends, roughly half of ETFs introduced each year fail to even reach $10 million in assets.

Security has become big business on Wall Street as hackers continue to crack the cyber defenses of retailers, banks and government agencies.

Gartner analysts project $77 billion will be spent on cybersecurity this year alone.

Security firms have benefited from the growing frequency of massive breaches in the U.S.

When Target was hacked in late 2013, exposing 40 million customers’ payment card data, the scale shocked the public. But such breaches have become common, with retailers such as Home Depot, banks such as JPMorgan and health insurers such as Anthem all suffering attacks.

Each high-profile incident has also given a slight bump to security firms’ stock.

The recent digital intrusions at the Office of Personnel Management (OPM) showed the phenomenon still exists. HACK closed at a record high the day after the initial breach was announced in early June.

CIBR hopes to capitalize on these booming market forces.

“Along with the clear benefits of an increasingly interconnected world comes the growing need to ensure the security of cyberspace,” said Ryan Issakainen, a senior vice president at First Trust, which is offering the ETF. “This presents significant opportunities for companies involved with this task.”

By Cory Bennett