Category: News

The department said it was working with federal law enforcement to gather more information on the nature and scope of the attacks and assess the potential impact on staff and contractors.

It was not clear which divisions at the agency’s headquarters were breached in the attack, and it was also uncertain who the hackers were or where they were based.

A department spokesman declined to comment, and a spokesman for the Energy Information Administration, which publishes data that helps keep oil, gas and electricity markets stable, deferred to DOE headquarters.

In the past, Energy Department installations that design and build nuclear weapons, including the Los Alamos National Lab in New Mexico, have faced scandals over alleged mishandling of classified information. In 2006, for example, after raiding a house trailer containing a suspected small methamphetamine lab, local police found three computer memory sticks containing classified information downloaded from the Los Alamos lab’s computers.

One of the largest security scandals in modern U.S. history, the leaking of hundreds of thousands of State Department cables and military reports to the website WikiLeaks, allegedly occurred because, in an effort to share intelligence more widely with operations in the field, agencies sent classified reports electronically to battlefield intelligence units, where data protection measures were lax.

In late 1999, a Los Alamos nuclear weapons scientist born in Taiwan, Wen Ho Lee, was arrested and indicted for allegedly mishandling classified information from the lab.

Link: http://www.nbcnews.com/technology/technolog/energy-department-hacked-says-no-classified-data-compromised-1B8242980

Officials said the new cyber policies have been guided by a decade of evolution in counterterrorism policy, particularly on the division of authority between the military and the intelligence agencies in deploying cyber weapons. But the intelligence agencies have the authority to carry out clandestine drone strikes and commando raids in places like Pakistan and Yemen, which are not declared war zones.

Obama is known to have approved use of cyber weapons once, early in his presidency, when he ordered an escalating series of cyber attacks against Iran’s nuclear enrichment facilities.

Another senior official said it was quickly determined that the cyber weapons were so powerful that — like nuclear weapons — they should be unleashed only on the direct orders of the commander in chief. That means the administration has ruled out the use of “automatic” retaliation if a cyber attack on America’s infrastructure is detected, even if the virus is traveling at network speeds. During the attacks on Iran’s facilities, which the U.S. never acknowledged, Obama insisted that cyber weapons be targeted narrowly, so that they did not affect hospitals or power supplies.

Link: http://www.startribune.com/nation/189605461.html?refer=y

The leak is part of Operation Last Resort, the group’s campaign to reform computer crime law in the wake of Aaron Swartz’s death, according to the faction’s Twitter account.

The leaks came after computer attacks last weekend in which the hacktivist group turned the United States Sentencing Commission website into a game of Asteroids.

Last Monday, a House panel issued a letter to Attorney General Eric Holder demanding answers regarding the prosecution of Aaron Swartz. The group believes that an overzealous prosecution and outdated computer crime laws may have contributed to Swartz’s suicide.

Swartz, a Harvard researcher who was known for his contributions to the development of RSS and the popular website Reddit, was charged for a slew of crimes including computer and wire fraud after breaking into MIT campus and systematically downloading academic journals from a service called JSTOR.

Link: http://www.foxnews.com/tech/2013/02/04/anonymous-leaks-personal-information-4000-bank-execs/

The release said that this spear phishing campaign continues to show the sophistication and preparation of attackers, especially gathering intelligence on what social engineering will best entice targets. Also, Symantec Intelligence report (June, 2012) revealed that globally, the defense industry (a sub category of the Public Sector) has been the targeted industry of choice in the first half of the year, with an average of 7.3 attacks per day.

Organizations should thus ensure that proper email security is in place and also make patch management a priority, as the vulnerability exploited here was patched in 2011. Businesses will have to engage with IT security solutions providers as their business partners and engage with them in an ongoing, service level agreement based relationships.

Link: http://articles.timesofindia.indiatimes.com/2013-02-02/software-services/36703043_1_symantec-intelligence-report-targets-attackers

In 2012, Cisco added 11,000 smartphones and tablets companywide and has nearing an equal ratio of mobile devices to staff. “At the end of 2012, there were nearly 60,000 smartphones and tablets in use in the organisation—including just under 14,000 iPads—and all of them were Bring Your Own (BYO).” Cisco execs have been giving regular updates about its BYOD program in recent times, no doubt because it sells UTM appliances, identity management and other services against the trend.

SAP/Sybase blogger Eric Lai, who has been tracking large iPad deployments, noted from a conference in early May last year that Cisco had 21,000 iPhones, 8,144 iPads and 2,000 Cius tablets (it killed the device later that month). Outside a 5,000 device BYOD program, SAP offers staff a range of 10 smart devices and under that program manages 20,000 iPads, 20,000 iPhones, 4,000 Samsung Android devices, and a smaller number of BlackBerry and Windows Phone devices.

Link: http://www.cso.com.au/article/452398/cisco_has_14k_byod_ipads_says_android_malware_big_threat/

Schmidt flagged the need to declassify data during his years at the White House and said progress had been made prior to his resignation from the job in May last year. For Schmidt, the suppression of information denies organisations the ability to defend themselves from attack, noting that it can take months for information to be declassified.

From the time the FBI was notified, DHS (Department of Homeland Security) and the Department of Defense all responded [but] it took 102 days from the time it was reported to the time they went out to industry members. If the declassification effort fails — and it is thought to have stalled amid the recent US Congress reshuffle — then Schmidt said the private sector should take charge and share vulnerability and threat data.

In recent years, security researchers have discovered and extensively detailed malware thought to have been developed by nation-states to launch attacks and conduct espionage against foreign interests.

Schmidt said it is also reckless because such attacks can cause collateral damage against critical private infrastructure, and the malware can be reverse-engineered and re-appropriated for further attacks.

Link: http://www.scmagazine.com.au/News/330685,five-eyes-push-to-declassify-security-vulnerability-data.aspx?utm_source=feed&utm_medium=rss&utm_campaign=SC+Magazine+News+feed