Spitfire List Web site and blog of anti-fascist researcher and radio personality Dave Emory.

News & Supplemental  

← FTR#1198 The Narco-Fascism of Chiang Kai-shek and the Kuomintang, Part 5   |   FTR#1199 The Narco-Fascism of Chiang Kai-shek and the Kuomintang, Part 6 →

Cyber Attribution, the Mega-Hacks of 2021, and the Existential Threat of Blind Faith in Bad-Faith

Posted by Pterrafractyl ⋅ August 17, 2021Post a comment Email This Post Email This Post Print This Post Print This Post
Tags  , , , , , , , , , , , , , , , , ,

Move over COVID. 2021 is turn­ing out to be anoth­er year of the dig­i­tal virus. One mas­sive hack­ing sto­ry after anoth­er. Unre­lat­ed sto­ries in many cas­es, we are told. In par­tic­u­lar:

1. The Solar­Winds mega-hack announced in Decem­ber of 2020, blamed on Rus­sia. Specif­i­cal­ly, blamed on the hack­ing group known as ‘Cozy Bear’/APT29/Pawn Storm. Microsoft dubbed them Nobeli­um.

2. The Microsoft Exchange mega-hack dis­closed in March 2021, blamed on Chi­na. Specif­i­cal­ly, blamed on a pre­vi­ous­ly uniden­ti­fied state-backed group Microsoft dubbed Hafni­um.

3. The rev­e­la­tions about NSO Group’s over­sight (or lack there­of) of its pow­er­ful spy­ware sold to gov­ern­ments around the world.

4. The emerg­ing sto­ry of Can­diru, one of NSO Group’s fel­low “com­mer­cial sur­veil­lance ven­dors”, sell­ing toolk­its over­flow­ing with zero-day exploits, spe­cial­iz­ing in tar­get­ing Microsoft prod­ucts.

But how unre­lat­ed are these sto­ries? That’s the big ques­tion we’re going to explore in this post. A ques­tion punc­tu­at­ed by anoth­er meta-sto­ry we’ve looked at many times before: the meta-sto­ry of a cyber­at­tri­bu­tion par­a­digm seem­ing­ly designed to allow pri­vate com­pa­nies and gov­ern­ments to con­coct an attri­bu­tion sce­nario for what­ev­er guilty par­ty they want to fin­ger. As long as there was some sort of ‘clue’ found by inves­ti­ga­tors — like piece of Cyril­lic or Man­darin text or mal­ware pre­vi­ous­ly attrib­uted to a group — these clues were strung togeth­er in a “pat­tern recog­ni­tion” man­ner to arrive at a con­clu­sion about the iden­ti­ty of the per­pe­tra­tors. Attri­bu­tion con­clu­sions often arrived at with incred­i­ble lev­els of con­fi­dence. Recall how the Japan­ese cyber­se­cu­ri­ty firm Trend­Mi­cro attrib­uted a 2017 US Sen­ate email phish­ing cam­paign to ‘Pawn Storm’/Fancy Bear with 100 per­cent cer­tain­ty, and they made this high­ly cer­tain attri­bu­tion based heav­i­ly on how sim­i­lar the hack was to the 2017 hacks of Emmanuel Macron’s emails via a phish­ing cam­paign that Trend­Mi­cro attrib­uted at the time with 99 per­cent cer­tain­ty to Pawn Storm/Fancy Bear and yet the ANSSI, the French government’s cyber­se­cu­ri­ty agency, was leav­ing open the pos­si­bil­i­ty that the hack they could be the work of “oth­er high-lev­el” hack­ers try­ing to pin the blame on “Pawn Storm” (anoth­er name for “Fan­cy Bear”). Trend­Mi­cro was mak­ing 99 per­cent cer­tain attri­bu­tions that the French gov­ern­ment said could be any range of actors. That was the state of affairs for cyber­at­tri­bu­tions in 2017 and noth­ing has changed in the years since. High­ly cer­tain attri­bu­tions con­tin­ued to be piled on top of high­ly cer­tain attri­bu­tions — almost always point­ing towards Russ­ian, Iran, Chi­na, or North Korea — built on a foun­da­tion of what appear to be large­ly guess­work. Often high­ly moti­vat­ed guess­work.

It’s that will­ing­ness by cyber­se­cu­ri­ty firms and gov­ern­ments to make strong ‘100 per­cent cer­tain’ dec­la­ra­tions about who was behind a hack, based on seem­ing­ly no com­pelling evi­dence, that con­tin­ues plague our col­lec­tive under­stand­ing of glob­al dig­i­tal threats. A lack of under­stand­ing that could have grave glob­al impli­ca­tions going for­ward. Because as we’re going to see, the repeat­ed pre­vail­ing nar­ra­tive encour­ag­ing the pub­lic to fix­ate their hack­ing fears on Russ­ian and Chi­nese hack­ers is a nar­ra­tive that con­ve­nient­ly leaves out the explo­sion over the last decade of a glob­al indus­try of pow­er­ful legal cut­ting-edge spy­ware sold to gov­ern­ments around the world. Dozens of gov­ern­ments that did­n’t pre­vi­ous­ly have access to spy­ware of this cal­iber. In oth­er words, the default ‘Rus­sia or Chi­na did!’ nar­ra­tive acts as a cov­er sto­ry to deflect sus­pi­cions from all the oth­er coun­tries (or pri­vate enti­ties) with access to the kind of spy­ware pre­vi­ous­ly assumed to be the exclu­sive to a hand­ful of nations with known pow­er­ful hack­ing capa­bil­i­ties.

Also loom­ing large in this dis­cus­sion is the sto­ry of the “Shad­ow­Bro­kers” sto­ry of 2016 and the leak of Vault7, the CIA’s hack­ing toolk­it that includ­ed fea­tures explic­it­ly designed to con­fuse this “pat­tern recog­ni­tion” approach to cyber­at­tri­bu­tion. The toolk­it lit­er­al­ly con­tained fea­tures that inject­ed Cyril­lic or Man­darin or oth­er ‘clues’ into the mal­ware code. This was all revealed months before Trend­Mi­cro made its ‘100 per­cent cer­tain’ attri­bu­tion of the Macron email hacks based on pat­tern recog­ni­tion. And yet, oth­er than the acknowl­edg­ment by France’s ANSSI that some­one could be inten­tion­al­ly leav­ing false ‘clues’, the sto­ry of the Shad­ow­Bro­kers and the dig­i­tal ‘clues’ left by Vault7 did not appear to impact the report­ing or analy­sis of the Macron hack in any mean­ing­ful way. It’s a big part of the meta-sto­ry here: no mat­ter how many reports come out that should raise major ques­tions about the qual­i­ty of cur­rent cyber­at­ti­bu­tions based on “pat­tern recog­ni­tion”, noth­ing actu­al­ly changes in terms of how the cyber­se­cu­ri­ty car­ries out its attri­bu­tions.

For exam­ple, as we’re going to see, when the Solar­Winds hack was first uncov­ered, it was a team led Adam Mey­ers, the vice pres­i­dent for threat intel­li­gence at Crowd­Strike, who first exam­ined the hack. In an inter­view describ­ing their ear­ly inves­ti­ga­tion, Mey­ers claimed to be ful­ly expect­ing to find some sort of ‘cul­tur­al arti­fact’ like Cyril­lic or Man­darin and expressed dis­may that noth­ing was found. They nonethe­less attrib­uted the hack to Rus­sia. We’re nev­er giv­en a clear expla­na­tion why. The whole episode, and Mey­er­s’s shock at a lack of any ‘clues’, sug­gests the elite cyber­se­cu­ri­ty firms like Crowd­Strike are not only will­ing to uti­lize “pat­tern recog­ni­tion” to car­ry out these attri­bu­tions but are rou­tine­ly doing so, rais­ing the ques­tion of whether or not hack­ers these days just now know to leave ‘clues’ in order to sat­is­fy the cyber­se­cu­ri­ty indus­try and their clients.

Now, when we learn that it was Crowd­Strike who led the Solar­Winds hack inves­ti­ga­tion rely­ing heav­i­ly on look­ing for ‘cul­tur­al arti­facts’ in the mal­ware, it’s also import to recall how Crowd­Strike itself was lit­er­al­ly found­ed in 2011 by Dmitri Alper­ovitch on the con­vic­tion that hacks should be respond­ed to with clear pub­lic attri­bu­tions as a pri­ma­ry means of ward­ing off future attacks. Before Crowd­Strike, the idea of pub­licly nam­ing cul­prits was anath­e­ma in the cyber secu­ri­ty indus­try in large part because it is so dif­fi­cult to tru­ly know who the cul­prit is due to this hall-of-mir­rors nature of dig­i­tal evi­dence. So in that sense, we should­n’t at all be sur­prised to learn that Crowd­Strike con­tin­ues to make base­less attri­bu­tions. It’s Crowd­Strike’s busi­ness mod­el.

As we’re also going to see, it’s not like cyber­se­cu­ri­ty indus­try always plays dumb about the pos­si­bil­i­ty of actors spoof­ing the ‘pat­tern recog­ni­tion’ meth­ods by inten­tion­al­ly leav­ing ‘clues’ like Cyril­lic. When the Solar­Winds mega-hack sto­ry broke, it broke in the wake of a dis­clo­sure by cyber­se­cu­ri­ty firm Fire­Eye that its own “Red Team” suite of hack­ing tools — kits of known exploits used to test clients sys­tems for vul­ner­a­bil­i­ties — was stolen by unknown hack­ers. Imme­di­ate­ly, experts warned how a toolk­it like that could be used by gov­ern­ments to cov­er their tracks. But that’s real­ly the only time we’re going see this kind of basic insight plain­ly stat­ed. Right at the start of it with the Fire­Eye attack. For the rest of the time, this obvi­ous prob­lem with our glob­al cyber­at­tri­bu­tion regime is sys­tem­at­i­cal­ly ignored. Still.

NSO Group: A Quick Review

First, recall how NSO Group first came to the pub­lic’s atten­tion in rela­tion to Michael Fly­n­n’s appoint­ment in May of 2016 to the advi­so­ry board of OSY Tech­nolo­gies and con­sult­ed for Fran­cis­co Part­ners. Fran­cis­co Part­ners was NSO Group’s own­er at the time and OSY hap­pened to be an NSO Group off­shoot.

Next, recall how Fran­cis­co Part­ners end­ed up sell­ing NSO Group to a Euro­pean pri­vate equi­ty firm, Novalpina, in ear­ly 2019 fol­low­ing the inter­na­tion­al out­rage over the role NSO Group’s mal­ware played in the assas­si­na­tion of Jamal Khashog­gi. We’re going to learn more about that sale and why it hap­pened (hint: Sau­di Ara­bi­a’s access to that spy­ware was part of a larg­er diplo­mat­ic process).

In May of 2019, we learned that NSO Group was sell­ing its clients the “zero-click” capa­bil­i­ty of infect­ing smart­phones via What­sApp and there was noth­ing vic­tims could do to pre­vent it. The exploit worked auto­mat­i­cal­ly when the attack­ers called the vic­tim’s phone via What­sApp. But we also learned that Israel was treat­ing access to this kind of mal­ware as a diplo­mat­ic tool in its nego­ti­a­tions with its region­al part­ners. Beyond that, there was osten­si­bly a lim­i­ta­tion on how this pow­er­ful mal­ware is used by client states: the Israeli gov­ern­ment was set­ting geo­graph­i­cal lim­i­ta­tions on where the mal­ware could be deployed.

So the pic­ture that had already emerged about NSO Group was that of a provider of cut­ting-edge hack­ing toolk­its to gov­ern­ments around the world, but also a point of lever­age in Israel’s own diplo­mat­ic toolk­it. It was the kind of cor­po­rate pro­file that sug­gests any scan­dals involv­ing NSO Group are implic­it­ly gov­ern­ment-relat­ed scan­dals. And that pic­ture of a com­pa­ny that dis­trib­utes pow­er­ful hack­ing tools as part of Israel’s diplo­mat­ic efforts gets all the more intrigu­ing when we fac­tor in the chap­ter of the #TrumpRus­sia saga involv­ing Michael Fly­nn, Eric Prince, Michael Cohen, and the Saudi/UAE scheme to build nuclear pow­er plants across the Mid­dle East (except for Iran). In oth­er words, there’s no way of sep­a­rat­ing the NSO Group sto­ry from the larg­er sto­ry of the cozy­ing rela­tion­ship between Israel and its Sun­ni allies in a region­al alliance against Iran and the still-unre­solved agen­da of Michael Fly­nn, Erik Prince, and the net­work of oth­er US con­ser­v­a­tives in Don­alt Trump’s orbit who had major agen­da’s of their own involv­ing the Mid­dle East.

That’s all part of the con­text we’re going to have to keep in mind when read­ing about these new rev­e­la­tions that appears to show the wide­spread use of NSO Group’s pow­er­ful mal­ware against a num­ber of jour­nal­ist, activists, and even gov­ern­ment min­is­ters around the world. And the more we’re learn­ing about the his­to­ry of the NSO Group, the clear­er it’s becom­ing that the NSO Group’s mal­ware has been secret­ly used by dozens of gov­ern­ments around the world for at least decade now.

And as we’re going to see with the sto­ry of Can­diru, it’s impor­tant to keep in mind that NSO Group is mere­ly one of a num­ber of secre­tive firms sell­ing cut­ting-edge hack­ing toolk­its to gov­ern­ments around the world. This is a glob­al indus­try.

Final­ly, it’s impor­tant to keep in mind anoth­er major dimen­sion of this sto­ry: the explo­sion of gov­ern­ment access to these pow­er­ful hack­ing tools over the last decade has pre­sum­ably coin­cid­ed with an explo­sion of actu­al hack­ing. Well, that pre­sumed explo­sion of actu­al hack­ing just hap­pened to coin­cide with the emer­gence of high­ly ‘noisy’ and high-pro­file ‘Russ­ian hack­er’ cam­paigns. As we’ve seen, fol­low­ing the out­break of con­flict in Ukraine, a num­ber of very pub­licly vis­i­ble mass phish­ing attacks were waged against NATO gov­ern­ments and insti­tu­tions. It was described by cyber­se­cu­ri­ty experts as a sig­nif­i­cant shift in the behav­ior of Russ­ian gov­ern­ment-backed hack­ers and yet we were nonethe­less told that these high-pro­file hacks must be com­ing from Rus­sia despite a lack of any sol­id tech­ni­cal evi­dence. It was the rise of the “pat­tern recog­ni­tion” form of cyber­at­tri­bu­tion, which con­sis­tent­ly found pat­terns of “Russ­ian hack­ers”. Recall how the first hack of the DNC, the 2015 hack, took place amidst a giant phish­ing cam­paign that hit 50–60,000 email address­es and was described is very dif­fer­ent from tra­di­tion­al Russ­ian gov­ern­ment hack­er phish­ing cam­paigns that would nor­mal­ly just have 5 to 6 care­ful­ly craft­ed phish­ing emails. Noth­ing has done a more effec­tive job at obscur­ing from the glob­al pub­lic the emer­gence of this glob­al super-hack­ing capa­bil­i­ty bet­ter than the pre­vail­ing nar­ra­tive that all hacks are being done by Rus­sia and Chi­na. Hard­ly any­one even both­ers ask­ing if it could be any­one else any­more.

Final­ly, it’s impor­tant to keep in mind anoth­er major dimen­sion of this sto­ry: the explo­sion of gov­ern­ment access to these pow­er­ful hack­ing tools over the last decade has pre­sum­ably coin­cid­ed with an explo­sion of actu­al hack­ing. Well, that pre­sumed explo­sion of actu­al hack­ing just hap­pened to coin­cide with the emer­gence of high­ly ‘noisy’ and high-pro­file ‘Russ­ian hack­er’ cam­paigns. As we’ve seen, fol­low­ing the out­break of con­flict in Ukraine, a num­ber of very pub­licly vis­i­ble mass phish­ing attacks were waged against NATO gov­ern­ments and insti­tu­tions. It was described by cyber­se­cu­ri­ty experts as a sig­nif­i­cant shift in the behav­ior of Russ­ian gov­ern­ment-backed hack­ers and yet we were nonethe­less told that these high-pro­file hacks must be com­ing from Rus­sia despite a lack of any sol­id tech­ni­cal evi­dence. It was the rise of the “pat­tern recog­ni­tion” form of cyber­at­tri­bu­tion, which con­sis­tent­ly found pat­terns of “Russ­ian hack­ers”. Recall how the first hack of the DNC, the 2015 hack, took place amidst a giant phish­ing cam­paign that hit 50–60,000 email address­es and was described is very dif­fer­ent from tra­di­tion­al Russ­ian gov­ern­ment hack­er phish­ing cam­paigns that would nor­mal­ly just have 5 to 6 care­ful­ly craft­ed phish­ing emails.

Let’s not for­get that the glob­al­iza­tion of NSA-lev­el spy­ware was one of the obvi­ous pos­si­ble log­i­cal con­clu­sions of the Snow­den affair. Yes, it was remark­able what a stun­ning edge the NSA had over almost every oth­er gov­ern­ment. A desire for a lev­el­ing of the play­ing field was under­stand­able and the glob­al­iza­tion of super-spy­ware is one of the obvi­ous ways to achieve that. There are no easy answer on this top­ic. It’s a ‘less­er evil’ sit­u­a­tion.

So we have to ask: what role have these very high-pro­file pub­lic mass hack­ing cam­paigns waged over the last decade and blamed on ‘Rus­sia hack­ers’ (or ‘Chi­nese hack­ers’) played in obscur­ing the real­i­ty that dozens of gov­ern­ments around the world sud­den­ly got access to qui­et super hack­ing tools? The tim­ing sure has been con­ve­nient. And it’s not hard to imag­ine that the high pro­file ‘noisy’ phish­ing cam­paigns of the last decade simul­ta­ne­ous­ly ran zero-click super-mal­ware like NSO Group’s unstop­pable What­sApp exploit mal­ware. One of the key sell­ing points of this NSO Group mal­ware is how dif­fi­cult it is to detect. A lot of peo­ple and orga­ni­za­tions have pre­sum­ably been hacked with­out ever dis­cov­er­ing the source of the hack. How often have orga­ni­za­tions over the past decade, espe­cial­ly gov­ern­ments, dis­cov­ered they were hacked by a com­pa­ny’s ‘legal’ hack­er toolk­it like NSO Group’s and just assumed it was ‘Russ­ian hack­ers’ due to the waves of glob­al high-pro­file ‘Russ­ian hack­er’ cam­paigns? It’s a ques­tion that looms ever larg­er as the client list of this glob­al legal hack­ing indus­try con­tin­ues to grow in the shad­ows.

**************************

Let’s Play “What’s Wrong With This Pic­ture?”

Ok, so let’s start off with an overview of the arti­cles we’re going to be review­ing. An overview that screams the ques­tion “What’s wrong with this pic­ture?”. Again, it’s four major sto­ries. Unre­lat­ed sto­ries we are told: 1. The Solar­Winds mega-hack of Decem­ber 2020 (blamed on Rus­sia). 2. The Microsoft Exchange mega-hack of March 2021 (blamed on Chi­na). 3. Rev­e­la­tions of NSO Group abus­es. 4. Rev­e­la­tions that Can­diru is sell­ing cut­ting-edge spy­ware show­ing, spe­cial­ized in tar­get­ing Microsoft­’s sys­tems. We are told those are four large­ly unre­lat­ed sto­ries. What’s wrong with this pic­ture?

* Decem­ber 8, 2020: Fire­Eye, a Top Cyber­se­cu­ri­ty Firm, Says It Was Hacked by a Nation-State:

The sto­ry that got the ball rolling. At least pub­licly. Cyber­se­cu­ri­ty firm Fire­Eye informs the world of a night­mare sce­nario. FireEye’s “Red Team” code suite was stolen. So who­ev­er man­aged to hack Fire­Eye obtained a toolk­it of vir­tu­al­ly all the most pow­er­ful known exploits. A dig­i­tal trea­sure trove that had sud­den­ly fall­en into the hands of who­ev­er already had the where­with­al to pull off this hack. And as experts warned, nation-states could poten­tial­ly hide their own tracks using this toolk­it. This is basi­cal­ly going to be the only time we see an expert admit that gov­ern­ments around the world could be inten­tion­al­ly , an implic­it admis­sion as to how shod­dy con­tem­po­rary cyber­at­tri­bu­tion tru­ly are today. So who did it? Fire­Eye was­n’t ready to name a cul­prit. The FBI announced was it was con­fi­dent it was car­ried out by a nation-state, and while they would name a spe­cif­ic nation it was pret­ty clear Rus­sia was the prime sus­pect. No rea­son for these sus­pi­cions are giv­en.

* Decem­ber 14, 2020: Russ­ian gov­ern­ment hack­ers are behind a broad espi­onage cam­paign that has com­pro­mised U.S. agen­cies, includ­ing Trea­sury and Com­merce:

The night­mare explodes. We learn it was­n’t just Fire­Eye after Fire­Eye informs Solar­Winds that it was Solar­Wind­s’s own Ori­on update soft­ware that deliv­ered the mal­ware onto FireEye’s sys­tems. It was a rather omi­nous update giv­en that the same Ori­on soft­ware is on anoth­er 18,000 client net­works. Oh, and the US was already nam­ing names: It was Rus­sia again. Specif­i­caly APT29/Cozy Bear/Pawn Storm, the infa­mous hack­ing group thought to work for Rus­si­a’s FSB (or SVR, it’s unclear) and that the US claims was behind the first hack of the Demo­c­ra­t­ic Nation­al Com­mit­tee (DNC) in 2015. Cozy Bear was also behind this new mega-hack. That was the line from the US a week after Fire­Eye first announced the hack. Rus­sia did it. No rea­sons for this attri­bu­tion are giv­en, of course, but is treat­ed as more of a giv­en since numer­ous US gov­ern­ment agen­cies were hit. Simul­ta­ne­ous­ly, we are told that the aggres­sive nature of this hack was unprece­dent­ed for Cozy Bear.

We also get an ear­ly impor­tant clue about how the Solar­Winds hack was car­ried out: Solar­Winds informed the world that it sus­pects Microsoft’s Office 365 email may have been “an attack vec­tor” used by the hack­ers. In oth­er words, the Solar­Winds hack start­ed with the hack of Microsoft­’s prod­ucts.

* Decem­ber 15, 2020: Fire­Eye Dis­cov­ered Solar­Winds Breach While Prob­ing Own Hack:

In some addi­tion­al report­ing on the break­ing Solar­Winds news, we learn that Fire­Eye isn’t actu­al­ly ready to join the US gov­ern­ment in attribut­ing the hack to Rus­sia due to a lack of evi­dence.

* Decem­ber 15, 2020: Microsoft’s Role In Solar­Winds Breach Comes Under Scruti­ny:

More infor­ma­tion is com­ing out about the role Microsoft prod­uct vul­ner­a­bil­i­ties played in the hack. The hack­ers were trick­ing Microsoft­’s authen­ti­ca­tion con­trols. This includes forg­ing authen­ti­ca­tion tokens for Microsoft­’s Azure cloud ser­vices and cre­at­ing pass­word cre­den­tials for legit­i­mate process­es enabling them to read emails from Microsoft­’s Exchange Online cloud-based email ser­vice. Keep in mind that the Microsoft-Exchange mega-hack that is announced in March was tar­get­ing the non-cloud self-host­ed Microsoft Exchange email servers. So when the Solar­Winds hack­ers demon­strate an abil­i­ty to break into the cloud-based Exchange servers, they were demon­strat­ing a capa­bil­i­ty that was­n’t exact­ly the same as that used to exe­cute the Microsoft Exchange mega-hack but awful­ly close. And yet we will be assured by Microsoft that the Microsoft-Exchange hack was car­ried out by Chi­na.

* Decem­ber 21, 2020: Trea­sury Department’s Senior Lead­ers Were Tar­get­ed by Hack­ing:

The US Trea­sury Depart­ment gives us an update on the scope of the hack. The hack­ers gained access to agency emails in July 2020, via the manip­u­la­tion of inter­nal soft­ware keys. Specif­i­cal­ly, we are told the hack­ers per­formed a com­plex step inside Microsoft’s Office 365 sys­tem to cre­ate an encrypt­ed “token” that iden­ti­fies a com­put­er to the larg­er net­work. This tak­en allowed the hack­ers to fool the sys­tem into think­ing they were legit­i­mate users. So spoof­ing Microsoft cre­den­tials appears to be one of the Solar­Winds hack­er spe­cial­ties.

* Febuary 4, 2021: Solar­Winds CEO Con­firms Office 365 Email ‘Com­pro­mise’ Played Role In Broad-Based Attack:

It’s con­firmed! Solar­Winds con­firms the hack start­ed via a com­pro­mised Microsoft Office 365 email account. The hack­ers used a pre­vi­ous­ly unknown zero-day vul­ner­a­bil­i­ty in Microsoft­’s Offi­cer 365 email soft­ware to gain access to and exploit the devel­op­ment envi­ron­ment for the Solar­Winds Ori­on.

But beyond that, we learn that 30 per­cent of the pri­vate sec­tor and gov­ern­ment vic­tims of the colos­sal hack­ing cam­paign had no direct con­nec­tion to Solar­Winds. It’s the kind of rev­e­la­tion that rais­es the dis­turb­ing ques­tion of whether or not these hack­ers had some oth­er yet-to-be-dis­cov­ered tech­nique for infil­trat­ing net­works. Which obvi­ous­ly rais­es a num­ber of ques­tions about whether or not oth­er Microsoft exploits were being used by these hack­ers. After all, the hack­ers man­aged to infil­trate Solar­Wind­s’s own net­work via a zero-day Microsoft exploit. Why would­n’t it work else­where? In oth­er words, the Solar­Winds mega-hack might actu­al­ly be part of an even larg­er Microsoft super-mega-hack. A still unrec­og­nized super-mega-Microsoft-hack.

* Feb­ru­ary 05, 2021: Microsoft: No Evi­dence Solar­Winds Was Hacked Via Office 365:

Not true! None of it! That’s the line from Microsoft a day after Solar­Wind­s’s CEO appears to con­firm that the exploita­tion of a Microsoft Office 365 email vul­ner­a­bil­i­ty was­n’t just used in the hack but used to exe­cute the ini­tial com­pro­mise of Solar­Wind­s’s soft­ware devel­op­ment envi­ron­ment. Microsoft does admit that Microsoft ser­vices were indeed tar­get­ed by the Solar­Winds hack­ers, but insists that the hack­ers gained priv­i­leged cre­den­tials in anoth­er way, imply­ing it was due to soft­ware con­fig­u­ra­tion issues on the client end and not due to vul­ner­a­bil­i­ties in Microsoft­’s prod­ucts. And what about all the reports from Solar­Winds and the US gov­ern­ment that they found evi­dence of an Office 365 email exploit? “As we said at the time, and based upon all inves­ti­ga­tions since, we have found no indi­ca­tions that our sys­tems were used to attack oth­ers.” That was Microsoft­’s line. Still.

* Feb­ru­ary 19, 2021: Solar­Winds Hack­ers Kept Going After Microsoft Until Jan­u­ary:

Microsoft gave us an update on its Solar­Winds inves­ti­ga­tion. The com­pa­ny acknowl­edge that its own net­works were plun­dered dur­ing the attack, and even some of its source was stolen. The source code report­ed involved the cloud-based ver­sions of Asure, Intune, and Exchange (email serv­er soft­ware). We are also told the hack­ers were search­ing Microsoft­’s net­works for use­ful secrets like API keys, cre­den­tials, and secu­ri­ty tokens that may have been embed­ded in the source code.

* March 5, 2021: At Least 30,000 U.S. Orga­ni­za­tions New­ly Hacked Via Holes in Microsoft’s Email Soft­ware:

A new mega-hack is upon us! Back-to-back mega-hacks. This time Microsoft is the main tar­get. The soft­ware giant informed the world that hun­dreds of thou­sands of Microsoft Exchange Servers were attacked around the world. The attack was first detect­ed by Volex­i­ty on Jan­u­ary 6, dur­ing the Capi­tol insur­rec­tion, with a large down­load to an ille­git­i­mate user, although days lat­er Volex­i­ty issued an update that it found evi­dence of the attack start­ing on Jan­u­ary 3rd. Days lat­er this qui­et hack explod­ed into a loud glob­al ran­sack­ing. Vir­tu­al­ly every self-host­ed Microsoft Exchange email serv­er in the world con­nect­ed to the inter­net was hit over the next two months. Or at least is assumed hit. That’s a lot of hacked email. And poten­tial­ly voice­mail. Microsoft was con­tin­u­ing to assure us the hack had noth­ing to do with the Solar­Winds hack, and also that the Solar­Winds hack had noth­ing to do with any Microsoft vul­ner­a­bil­i­ties. They were seri­ous­ly tout­ing the ‘don’t wor­ry about Microsoft secu­ri­ty’ line dur­ing the Exchange mega-hack dis­clo­sure.

* March 10, 2021: Microsoft Exchange Hack Could Be Worse Than Solar­Winds:

With more infor­ma­tion about the Hafni­um hack com­ing in the more this is look­ing like the worst worst case sce­nario. Or at least worse than the Solar­Winds hack, which would make this the worst yet. Lit­er­al­ly the worst hack ever. So far. Give it a few months.

The hack start­ed on Jan 3, with “Hafni­um” qui­et­ly hack­ing away at dozens of tar­gets until Microsoft issued a patch in ear­ly March. At that point, it was a crim­i­nal free-for-all race that includ­ed at least a dozen more crim­i­nal actors.

A big part of what make it the worst hack ever is the scale, with poten­tial­ly hun­dreds of thou­sands of Exchange email servers all hit in short order but this is an attack that can be auto­mat­ed. The hack­ers need­ed scrips and time to let the scripts to their work.

But anoth­er part of what arguably makes this the worst hack ever is that the abil­i­ty to remote­ly take over the Exchange serv­er soft­ware does­n’t just poten­tial­ly give the hack­ers the abil­i­ty to read emails. It also poten­tial­ly give hack­ers the abil­i­ty to com­pro­mise the Microsoft Active Direc­to­ry sys­tem, which is the sys­tem used for ID authen­ti­ca­tion across the Microsoft ecosys­tem of soft­ware. So if you cor­rupt the Active Direc­to­ry sys­tem on a com­put­er, you can poten­tial­ly get super-user access to all the Microsoft soft­ware run­ning on that com­put­er’s net­work. And the catch here is that Microsoft Exchange serv­er only runs on Win­dows. So any­one run­ning it is run­ning it on a Win­dows Serv­er oper­at­ing sys­tem. So com­pro­mis­ing the Active Direc­to­ry sys­tem on the com­put­er run­ning the Microsoft Exchange serv­er soft­ware can hand over com­plete con­trol of the serv­er. This also means the hack­ers could have bur­rowed in all sorts of hid­den back­doors all over the vic­tim net­works. This was a huge deep hack.

But here’s the big detail we learn from Ed Hunter, CISO at Infoblox, a cyber­se­cu­ri­ty com­pa­ny, who is com­ment­ing to a reporter about the hack: the vul­ner­a­bil­i­ty has been present in the Microsoft Exchange code­base for a decade. As Hunter put it, “one has to won­der how long this vul­ner­a­bil­i­ty has been a close­ly held – and used – tool in this threat actor’s tool­box.”

And, again, it was just two weeks ear­li­er that Microsoft dis­closed that the Solar­Winds hack­ers stole Exchange source code for the cloud-based ver­sion of Exchange. But in this case, it was the self-host Exchange servers that got hacked. All of them. Hun­dreds of thou­sands of email servers around the world. Also keep in mind the Solar­Winds hack­ers had already demon­strat­ed zero-day abil­i­ties to manip­u­late Microsoft­’s cre­den­tial sys­tems. So this hack sure seems close­ly relat­ed to the Solar­Winds hack­ers, and yet Microsoft con­fi­dent­ly assured us that this had noth­ing to do with the Solar­Winds hack and was in fact car­ried out by a state-backed Chi­nese hack­ing group Microsoft dubbed “Hafni­um”.

* April 16, 2021: A ‘Worst Night­mare’ Cyber­at­tack: The Untold Sto­ry Of The Solar­Winds Hack:

Four months after it was first announced, NPR has a big piece on the then-untold sto­ry of how the hack unfold­ed. By that point, the Biden White House was unequiv­i­cal­ly stat­ing Russ­ian intel­li­gence was behind it. While the rea­son Rus­sia is giv­en the attri­bu­tion is, as always, nev­er giv­en, there was by now enough known about the hack to deter­mine that these real­ly were excep­tion­al hack­ers. Mul­ti­ple nev­er-before-seen “zero-day” exploits were uti­lized. Beyond that, the mal­ware was intro­duced into the Solar­Winds soft­ware devel­op­ment pipeline at the very last pos­si­ble moment, dur­ing the com­pi­la­tion process, allow­ing it to evade the stan­dard secu­ri­ty checks for unwant­ed soft­ware. It was proof-of-con­cept and could be used against any­one else using the same com­pi­la­tion soft­are (they did­n’t name the soft­ware). This abil­i­ty to use this attack against oth­er soft­ware devel­op­ers is par­tic­u­lar­ly acute when we recall that this attack cre­at­ed back­doors on the net­works of the many of the largest soft­ware devel­op­ers in the world. Includ­ing Microsoft. Yikes.

And it’s in this April 2021 NPR piece where we get fur­ther con­fir­ma­tion of some­thing that has long been clear but is rare said out loud so clear­ly: con­tem­po­rary cyber­at­tri­bu­tion real­ly does rely heav­i­ly on ‘clues’ like Cyril­lic char­ac­ters or Man­darin in the code and such ‘clues’ are fre­quent­ly found. At least that’s how Adam Mey­ers, the vice pres­i­dent for threat intel­li­gence at Crowd­Strike, described his approach to deter­min­ing the iden­ti­ty of the Solar­Winds hack­ers. And he was lead­ing the team that first inves­ti­gat­ed it. Mey­ers express­es dis­may at how thor­ough the hack­ers were. Thor­ough in the sense that there was no ‘cul­tur­al arti­fact’ like Cyril­lic or Man­darin. Mey­ers describe the lack of any­thing that a human might have inad­ver­tent­ly left behind as a clue as “mind-blow­ing”. His response to the tiny piece of mal­ware used in the ini­tial Solar­Winds hack — dis­trib­uted to all 18,000 clients via the Ori­on soft­ware — and it’s lack of clues as “the cra­zi­est f***ing thing I’d ever seen.” So this update on the Solar­Winds inves­ti­ga­tion includes an update on the gen­er­al state of affairs in cyber­at­tri­bu­tion. A state of affairs where mal­ware that’s cleaned and lacks a ‘cul­tur­al arti­fact’ is “the cra­zi­est f***ing thing I’d ever seen.” This is a good time to recall the sto­ry of the Shad­ow Bro­kers and the CIA’s hack­ing toolk­it that includ­ed fea­tures like leav­ing Cyril­lic or Man­darin char­ac­ters to leave a false lead. This was con­firmed just four years ago. Every­one real­ly is play­ing dumb here. Dou­ble yikes.

* April 23, 2021: Solar­Winds hack­ing cam­paign puts Microsoft in the hot seat:

Microsoft­’s ter­ri­ble, hor­ri­ble, no good, very bad year con­tin­ues. A week after that big NPR piece on Solar­Winds, we learn new sig­nif­i­cant details on the Solar­Winds hack in a new report put out by The Atlantic Coun­cil. The kind of details that have Microsoft scram­bling for expla­na­tions. And cul­prits. Again. It turns out the deliv­ery of the back­door mal­ware via the Solar­Winds Ori­on updat­ing soft­ware was just the first phase of the mega-hack. Once the hack­ers used those back­doors to gain access to vic­tims’ net­works they con­tin­ued to exploit more vul­ner­a­bil­i­ties. In par­tic­u­lar Microsoft vul­ner­a­bil­i­ties involv­ing how Microsoft prod­ucts val­i­date user iden­ti­ties. Now, part of the rea­son Microsoft vul­ner­a­bil­i­ties were heav­i­ly tar­get­ed was because, well, these vul­ner­a­bil­i­ties exist. But the oth­er big rea­son is that Microsoft has more than 85% of the mar­ket share for gov­ern­ment and indus­try. In oth­er words, the juici­est tar­gets — espe­cial­ly gov­ern­ment agen­cies — were almost all run­ning Microsoft tools on their net­works. Microsoft con­tin­ued to deflect blame, sug­gest­ing poor­ly con­fig­ured soft­ware by the clients was the cause. But accord­ing to Sen­a­tor Ron Wyden, the soft­ware Microsoft sup­plies to US fed­er­al agen­cies is itself poor­ly con­fig­ured with default log set­tings that won’t cap­ture the infor­ma­tion need­ed to catch attacks while they’re in progress.

* May 28, 2021: Microsoft says group behind Solar­Winds hack now tar­get­ing gov­ern­ment agen­cies, NGOs:

Cozy Bear/APT29/“Nobelium” is back at it. They’re up to their old tricks, accord­ing to Microsoft. Tar­get­ed phish­ing, with orga­ni­za­tions who signed up to received com­mu­ni­ca­tions from USAID being the tar­gets. 3,000 email accounts at more than 150 dif­fer­ent orga­ni­za­tions. Some­how, the hack­ers man­aged to minick emails from the firm Con­stant Con­tact, the firm that han­dle’s USAID’s email com­mu­ni­ca­tions, to make it look like a USAID com­mu­ni­ca­tion. At least a quar­ter of the tar­get­ed organ­i­sa­tions were involved in inter­na­tion­al devel­op­ment, human­i­tar­i­an issues and human rights work. The US and UK blame Rus­si­a’s SVR (the same agency Cozy Bear/APT is said to work for...long with the FSB).

How did Microsoft deter­mine that this was done by the same hack­ers who pulled off the Solar­Winds hack? That’s nev­er explained. It’s not due to tech­ni­cal sim­i­lar­i­ties. In fact, the Microsoft blog post describ­ing this USAID phish­ing scheme explic­it­ly states that this new attack had few tech­ni­cal sim­i­lar­i­ties to the Solar­Winds hack and sug­gests the hack­ers inten­tion­al­ly changed their tac­tics after the Solar­Winds hack was uncov­ered. Four new zero-day pieces of mal­ware deployed on the com­put­ers of the vic­tims that clicked on the mali­cious link, so keep in mind that if this was the same hack­ing group that is involved with the Solar­Winds hack and/or Microsoft Exchange hack, this crew is sport­ing a sig­nif­i­cant num­ber of zero-day exploits.

* June 25, 2021: Microsoft says new breach dis­cov­ered in probe of sus­pect­ed Solar­Winds hack­ers:

Cozy Bear/APT29/“Nobelium” is at it again. Again. This time, Microsoft tells is the hack­ers some­how hacked a Microsoft agent who had access to Microsoft cus­tomer sup­port tools with sub­scrip­tion infor­ma­tion. Of course, we’ve already been told about how the Solar­Winds hack­ers stole code involv­ing how Microsoft tools ver­i­fy iden­ti­ties, and the same hack­ers report­ed­ly pulled this hack off. So it’s not hard to imag­ine some of those stolen insights were used to car­ry out this hack. But we aren’t told much else from Microsoft oth­er than that it was def­i­nite­ly the Solar­Winds hack­ers who are def­i­nite­ly work­ing for the Russ­ian state. Of that they are sure. Always and for­ev­er, except when it’s Chi­na.

* July 4, 2021: Solar­Winds: How Russ­ian spies hacked the Jus­tice, State, Trea­sury, Ener­gy and Com­merce Depart­ments:

Less than two weeks lat­er, CBS has an arti­cle with more inter­views of fig­ures involved with the Solar­Winds hack inves­ti­ga­tion, includ­ing Brad Smith, pres­i­dent of Microsoft. Smith points to the list of US gov­ern­ment agen­cies hit by the hack and insists that means it was a for­eign intel­li­gence col­lec­tion mis­sion (which ignores the oth­er 18,000 large­ly com­mer­cial group of vic­tims also hit). The piece reveals that the Solar­Winds hack­ers were on US fed­er­al net­works read­ing emails and oth­er traf­fic for months.

It ends an inter­view of Jon Miller, who runs a com­pa­ny Bold­end, that sells cut­ting-edge cyber weapons to US intel­li­gence agen­cies. Miller observes that the notable thing about the Solar­Winds hack was­n’t the sophis­ti­ca­tion. He builds things much more sophis­ti­cat­ed (pre­sum­ably for his US intel­li­gence clients). Instead, what makes this attack stand out is how aggres­sive it was. It’s the kind of assess­ment that sug­gests a lot of dif­fer­ent actors could have pulled this attack of for some time and some­one final­ly did it.

Miller also reminds us of anoth­er cru­cial aspect of both the Solar­Winds and Exchange mega-hacks: It would be triv­ial to turn those back­doors into dig­i­tal bombs that destroy vic­tim net­works. In oth­er words, these mega-hacks could have been A LOT more dam­ag­ing had the hack­ers want­ed them to be. And since the hack­ers like embed­ded them­selves in vic­tim net­works in ways not yet detect­ed, they could decide to unleash those dig­i­tal bombs in the future if they choose to in the future.

* July 15, 2021: Microsoft says Israeli group sold tools to hack Win­dows:

Cit­i­zen­Lab put out a report on an Israeli com­mer­cial hack­ing group behind mal­ware dis­cov­ered tar­get­ing Win­dows. But Can­diru’s toolk­it does­n’t just hit MIcrosoft prod­ucts. It appears to be the same com­pa­ny Google had just attrib­uted to a set of addi­tion­al zero-day exploits tar­get­ing Google’s prod­ucts that Cit­i­zen Lab also con­nect­ed to Can­diru. So Microsoft and Google both announced the dis­cov­ery of Can­diru zero-day exploits as rough­ly the same time.

* July 15, 2021: Microsoft says it blocked spy­ing on rights activists, oth­ers:

In some more report­ing on Can­diru, we learn that the com­pa­ny goes by sev­er­al names. We also learn that its spy­ware “infra­struc­ture” includes webistes “mas­querad­ing as advo­ca­cy orga­ni­za­tions” such as Amnesty Inter­na­tion­al and Black Lives Mat­ter.

* July 15, 2021: Safari Zero-Day Used in Mali­cious LinkedIn Cam­paign:

More on Google’s Threat Assess­ment Group (TAG) secu­ri­ty announce­ment. A Russ­ian-lan­guage group was exploit­ing a vul­ner­a­bil­i­ty in the Safari brows­er on iOS sys­tems. Mali­cious links that exe­cut­ed the vul­ner­a­bil­i­ty were being sent to West­ern Euro­pean gov­ern­ment offi­cials through Linked­In’s direct mes­sage app. It is not­ed that the mali­cious link cam­paign coin­cid­ed with a “Nobeli­um’s” USAID phish­ing cam­paign in May tar­get­ing Win­dows devices.

Dur­ing this same report, Google’s TAG announced a new exploit it dis­cov­ered that was used against Armen­ian activists in April. A zero-day exploit against Microsoft­’s Inter­net Explor­er.

The TAG team also announced three new zero-day exploits attrib­uted to an unnamed “com­mer­cial sur­veil­lance ven­dor” (Can­diru). Two vul­ner­a­bil­i­ties in Google’s Chrome and one in Microsoft­’s Inter­net Explor­er. These exploits were also used against Armen­ian tar­gets but we are told that this was a sep­a­rate cam­paign for the oth­er Armen­ian hack, with one of the Chrome exploits dis­cov­ered in Feb­ru­ary and the sec­ond in June.

Final­ly, the arti­cle notes that secu­ri­ty researchers have iden­ti­fied 33 zero-day vul­ner­a­bil­i­ties until that point in 2021, which is 11 more than the 22 total found in 2020. That’s triple the rate of the pre­vi­ous year, which itself was a record year.

* July 17, 2021: Israeli Com­pa­nies Aid­ed Sau­di Spy­ing Despite Khashog­gi Killing:

NSO Group’s recent headache has begun. The New York Times has an update on NSO Group and long-stand­ing ques­tions about the extent to which the license giv­en to coun­tries to buy NSO Group’s super-spy­ware is used as a tool of Israel’s for­eign pol­i­cy. It’s a ques­tion that relates to more than NSO Group but the entire Israeli ‘com­mer­cial sur­veil­lance’ indus­try that gov­ern­ments around the world turn to. As we should have expect­ed, it turns out the super-spy­ware suites like NSO Group’s Pega­sus soft­ware aren’t just super-spy­ware suites. They’re also diplo­mat­ic tools for the Israeli gov­ern­ment. And that means some­times NSO Groups might effec­tive­ly be forced to keep sell­ing to clients like Sau­di Ara­bia even when its rela­tion­ship with those clients becomes tox­ic. That’s appar­ent­ly what hap­pened fol­low­ing the Sau­di gov­ern­men­t’s assas­si­na­tion of Jamal Khashog­gi. NSO Group can­celed the Sau­di con­tract only to be pres­sured by the Israeli gov­ern­ment to renew it. NSO Group was ulti­mate­ly sold to new pri­vate equi­ty own­ers and pro­ceed­ed to renew the Sau­di con­tract.

But the NSO Group reveals a far more legit­i­mate excuse for its appar­ent neg­li­gence in reg­u­lat­ing its super-spy­ware: the Israeli gov­ern­ment approves of these sales. If you want a sub­scrip­tion for Pega­sus, you bet­ter make sure you’re on at least least decent terms with the Israeli gov­ern­ment. It’s pret­ty

* July 18, 2021: Pri­vate Israeli spy­ware used to hack cell­phones of jour­nal­ists, activists world­wide:

The Wash­ing­ton Post fol­lows up with a huge report that con­firmed a bunch of oth­er things that have been sus­pect­ed about NSO Group: Peo­ple have long accused the com­pa­ny of not hav­ing any safe­guards to ensure the super-spy­ware it sells to gov­ern­ments around the world around only used to track ‘ter­ror­ists and crim­i­nals’. And, yep, there are basi­cal­ly no safe­guards. It’s up to the gov­ern­ment to promise not to abuse the super spy­ware. Although there are geo­graph­ic lim­i­ta­tions. The spy­ware was con­fig­ured to not work on US-based smart­phones and could be lim­it­ed to cer­tain coun­tries. But how it was used inside those approved geo­graph­ic areas was up to the gov­ern­ments. In oth­er words, Pega­sus was abused. A lot. At least that’s accord­ing to an inves­ti­ga­tion released by For­bid­den Sto­ries, a Paris-based jour­nal­ism non­prof­it, and Amnesty Inter­na­tion­al.

How much abused of the NSO Group’s super-spy­ware has been tak­ing place? Well, this report was based on thou­sands phone num­bers leaked that were pur­port­ed­ly the tar­get phone num­bers of NSO Group’s feared Pega­sus spy­ware. Almost unstop­pable spy­ware suits that can hit almost any smart­phone. And if those thou­sands of num­bers real­ly are an accu­rate tar­get list, it was ram­pant abuse, with activists and rival politi­cians fre­quent­ly on the tar­get list. 60 gov­ern­ment agen­cies in 40 coun­tries were allowed to buy sub­scrip­tions to the soft­ware and, again, they policed them­selves.

NSO Group’s defense against charges that it was know­ing­ly allow­ing gov­ern­ments to abuse its super-spy­ware was to point out that the com­pa­ny does­n’t police how gov­ern­ments use its soft­ware. It real­ly is up to the gov­ern­ments to polices them­selves, as con­firmed by this study and the ram­pant abuse it reveals. It’s not actu­al­ly a great defense if you think about it, but it gets bet­ter when you keep in mind this is all sanc­tioned and encour­aged by the Israeli gov­ern­ment (and prob­a­bly the US gov­ern­ment).

* July 19, 2021: Microsoft Exchange hack caused by Chi­na, US and allies say:

The US for­mal­ly accus­es Chi­nese state-backed hack­ers of car­ry­ing out the Microsoft Exchange mega-hack. At the same time, the US Jus­tice Depart­ment announced charges against four Chi­nese nation­als who pros­e­cu­tors said were work­ing with China’s Min­istry of State Secu­ri­ty in a dif­fer­ent hack­ing cam­paign that tar­get­ed dozens of com­put­er sys­tems, includ­ing com­pa­nies, uni­ver­si­ties and gov­ern­ment enti­ties. But beyond that, the US accused these state-backed Chi­nese hack­ers of car­ry­ing out ran­somware and oth­er for-prof­it extor­tion hacks for their own per­son­al enrich­ment. In fact, an admin­is­tra­tion offi­cial told reporters that the for­mal attri­bu­tion of the Exchange hack to Chi­na took this many months (recall Microsoft did it imme­di­ate­ly) in part because of the ran­somware and for-prof­it hack­ing oper­a­tions. In oth­er words, the hack­ers the US was accus­ing of work­ing on behalf of the Chi­nese state were behav­ing like reg­u­lar crim­i­nals. But we are nonethe­less assured that, no, they were work­ing for Chi­na. Dmitri Alper­ovitch — co-founder of Crowd­Strike and the guy who pio­neered the mod­ern approach of mak­ing loud evi­dence-free hack­ing accu­sa­tions against coun­tries as a means of pre­vent­ing future attacks — express­es a sense of puz­zle­ment that sanc­tions against Chi­na haven’t been declared yet.

* July 20, 2021: Chi­na says Microsoft hack­ing accu­sa­tions fab­ri­cat­ed by US and allies:

The US’s allies (the UK, New Zealand, Aus­tralia, and EU) join the US in joint­ly con­demn­ing Chi­na for the Microsoft Exchange mega-hack. Anony­mous West­ern secu­ri­ty sources tell reports that they believe Hafni­um new Microsoft was going to plug the Exchange vul­ner­a­bil­i­ty and so shared it with oth­er Chi­na-based hack­ers, cul­mi­nat­ing in the giant glob­al smash-and-grab. It’s anoth­er indi­ca­tion that the Microsoft Exchange mega-hack has the appear­ance of being a crim­i­nal smash-and-grab event and we are now told that this was all how Chi­na planned it to play out. And we are also told that Microsoft was about to plug this mas­sive vul­ner­a­bil­i­ty but were thwart­ed by Chi­nese spies or some­thing. The facts and details may change, but two things always stays the same: Chi­na did it and this def­i­nite­ly did­n’t involve the Solar­Winds hack.

* July 22, 2021: France’s Macron changes phone in light of Pega­sus case:

The NSO Group scan­dal gets extra awk­ward when Emmanuel Macron’s admin­is­tra­tion offi­cial­ly acknowl­edges that it changed Macron’s mobile phone and phone num­ber after the num­ber showed up on a list of poten­tial tar­gets for sur­veil­lance by Moroc­co in the report by For­bid­den Sto­ries and Amnesty Inter­na­tion­al. Israel has formed an inter-min­is­te­r­i­al team to look into the export licens­es issued by the Defence Export Con­trols Agency (DECA). NSO Group con­tin­ues to defend itself by reit­er­at­ing that it does­n’t know the iden­ti­ties of the peo­ple tar­get­ed by Pega­sus. The com­pa­ny can, how­ev­er, retroac­tive­ly acquire the tar­get lists in the event of a com­plaint and uni­lat­er­al­ly shut down the offend­ing gov­ern­men­t’s sub­scrip­tion fol­low­ing an inves­ti­ga­tion. So over­sight only hap­pens if a com­plaint is issued over the abuse of the super-secret dif­fi­cult-to-find spy­ware. There pre­sum­ably aren’t very many com­plaints.

*******************************

That’s the sto­ry we are being asked to buy. Or rather, those are the sto­ries we are being asked to buy. Break­ing sto­ries about two record-break­ing mega-hacks and rev­e­la­to­ry sto­ries about two cut­ting-edge ‘com­mer­cial sur­veil­lance ven­dors’ licens­ing sell­ing zero-day exploits around the world. Sep­a­rate sto­ries, at least that’s what we are told. The Solar­Winds hack and the Microsoft Exchange hack are two com­plete­ly sep­a­rate hacks, one exe­cut­ed by Rus­sia and the oth­er by Chi­na. The fact that the Solar­Winds hack­ers pos­sessed Microsoft zero-day exploits and appeared to ini­ti­ate the hack using those exploits is just ignored. The fact that no actu­al evi­dence indi­cat­ing it was Rus­sia or Chi­na behind the hacks are also just ignored. And the fact that sto­ries about a mas­sive pow­er­ful glob­al “com­mer­cial sur­veil­lance” indus­try sell­ing super-exploits to gov­ern­ments around the world are also just ignored. Or oth­er gov­ern­ment hack­ing toolk­its like the CIA’s Vault7, that had fea­tures specif­i­cal­ly designed to spoof the “pat­tern recog­ni­tion” approach to cyber­at­tri­bu­tion. Ignore all that. It’s a faith-based attri­bu­tion par­a­digm, ripe for bad-faith attri­bu­tions.

FireEye Wakes Up to a “Red Team Tools” Nightmare. Which Could Become Everyone’s Nightmare

Decem­ber 8, 2020, was a dark day for dig­i­tal secu­ri­ty. A worst case sce­nario was play­ing out in real-time. Some­one hacked the secu­ri­ty firm and stole its “Red Team” code suite. A toolk­it of vir­tu­al­ly all the most pow­er­ful known exploits. And as experts warned, nation-states could poten­tial­ly hide their own tracks using this toolk­it. This is basi­cal­ly going to be the only time we see an expert admit that gov­ern­ments around the world could be inten­tion­al­ly. Fire­Eye was­n’t ready to name a cul­prit. But the FBI announced was it was con­fi­dent it was car­ried out by a nation-state, and while they would name a spe­cif­ic nation it was pret­ty clear Rus­sia was the prime sus­pect. No rea­son for these sus­pi­cions are giv­en:

The New York Times

Fire­Eye, a Top Cyber­se­cu­ri­ty Firm, Says It Was Hacked by a Nation-State

The Sil­i­con Val­ley com­pa­ny said hack­ers — almost cer­tain­ly Russ­ian — made off with tools that could be used to mount new attacks around the world.

By David E. Sanger and Nicole Perl­roth
Pub­lished Dec. 8, 2020 Updat­ed Feb. 6, 2021

WASHINGTON — For years, the cyber­se­cu­ri­ty firm Fire­Eye has been the first call for gov­ern­ment agen­cies and com­pa­nies around the world who have been hacked by the most sophis­ti­cat­ed attack­ers, or fear they might be.

Now it looks like the hack­ers — in this case, evi­dence points to Russia’s intel­li­gence agen­cies — may be exact­ing their revenge.

Fire­Eye revealed on Tues­day that its own sys­tems were pierced by what it called “a nation with top-tier offen­sive capa­bil­i­ties.” The com­pa­ny said hack­ers used “nov­el tech­niques” to make off with its own tool kit, which could be use­ful in mount­ing new attacks around the world.

It was a stun­ning theft, akin to bank rob­bers who, hav­ing cleaned out local vaults, then turned around and stole the F.B.I.’s inves­tiga­tive tools. In fact, Fire­Eye said on Tues­day, moments after the stock mar­ket closed, that it had called in the F.B.I.

The $3.5 bil­lion com­pa­ny, which part­ly makes a liv­ing by iden­ti­fy­ing the cul­prits in some of the world’s bold­est breach­es — its clients have includ­ed Sony and Equifax — declined to say explic­it­ly who was respon­si­ble. But its descrip­tion, and the fact that the F.B.I. has turned the case over to its Rus­sia spe­cial­ists, left lit­tle doubt who the lead sus­pects were and that they were after what the com­pa­ny calls “Red Team tools.”

These are essen­tial­ly dig­i­tal tools that repli­cate the most sophis­ti­cat­ed hack­ing tools in the world. Fire­Eye uses the tools — with the per­mis­sion of a client com­pa­ny or gov­ern­ment agency — to look for vul­ner­a­bil­i­ties in their sys­tems. Most of the tools are based in a dig­i­tal vault that Fire­Eye close­ly guards.

The F.B.I. on Tues­day con­firmed that the hack was the work of a state, but it also would not say which one. Matt Gorham, assis­tant direc­tor of the F.B.I. Cyber Divi­sion, said, “The F.B.I. is inves­ti­gat­ing the inci­dent and pre­lim­i­nary indi­ca­tions show an actor with a high lev­el of sophis­ti­ca­tion con­sis­tent with a nation-state.”

The hack rais­es the pos­si­bil­i­ty that Russ­ian intel­li­gence agen­cies saw an advan­tage in mount­ing the attack while Amer­i­can atten­tion — includ­ing FireEye’s — was focused on secur­ing the pres­i­den­tial elec­tion sys­tem. At a moment that the nation’s pub­lic and pri­vate intel­li­gence sys­tems were seek­ing out breach­es of vot­er reg­is­tra­tion sys­tems or vot­ing machines, it may have a been a good time for those Russ­ian agen­cies, which were involved in the 2016 elec­tion breach­es, to turn their sights on oth­er tar­gets.

The hack was the biggest known theft of cyber­se­cu­ri­ty tools since those of the Nation­al Secu­ri­ty Agency were pur­loined in 2016 by a still-uniden­ti­fied group that calls itself the Shad­ow­Bro­kers. That group dumped the N.S.A.’s hack­ing tools online over sev­er­al months, hand­ing nation-states and hack­ers the “keys to the dig­i­tal king­dom,” as one for­mer N.S.A. oper­a­tor put it. North Korea and Rus­sia ulti­mate­ly used the N.S.A.’s stolen weapon­ry in destruc­tive attacks on gov­ern­ment agen­cies, hos­pi­tals and the world’s biggest con­glom­er­ates — at a cost of more than $10 bil­lion.

The N.S.A.’s tools were most like­ly more use­ful than FireEye’s since the U.S. gov­ern­ment builds pur­pose-made dig­i­tal weapons. FireEye’s Red Team tools are essen­tial­ly built from mal­ware that the com­pa­ny has seen used in a wide range of attacks.

Still, the advan­tage of using stolen weapons is that nation-states can hide their own tracks when they launch attacks.

“Hack­ers could lever­age FireEye’s tools to hack risky, high-pro­file tar­gets with plau­si­ble deni­a­bil­i­ty,” said Patrick War­dle, a for­mer N.S.A. hack­er who is now a prin­ci­pal secu­ri­ty researcher at Jamf, a soft­ware com­pa­ny. “In risky envi­ron­ments, you don’t want to burn your best tools, so this gives advanced adver­saries a way to use some­one else’s tools with­out burn­ing their best capa­bil­i­ties.”

A Chi­nese state-spon­sored hack­ing group was pre­vi­ous­ly caught using the N.S.A.’s hack­ing tools in attacks around the world, osten­si­bly after dis­cov­er­ing the N.S.A.’s tools on its own sys­tems. “It’s like a no-brain­er,” said Mr. War­dle.

The breach is like­ly to be a black eye for Fire­Eye. Its inves­ti­ga­tors worked with Sony after the dev­as­tat­ing 2014 attack that the firm lat­er attrib­uted to North Korea. It was Fire­Eye that was called in after the State Depart­ment and oth­er Amer­i­can gov­ern­ment agen­cies were breached by Russ­ian hack­ers in 2015. And its major cor­po­rate clients include Equifax, the cred­it mon­i­tor­ing ser­vice that was hacked three years ago, affect­ing near­ly half of the Amer­i­can pop­u­la­tion.

In the Fire­Eye attack, the hack­ers went to extra­or­di­nary lengths to avoid being seen. They cre­at­ed sev­er­al thou­sand inter­net pro­to­col address­es — many inside the Unit­ed States — that had nev­er before been used in attacks. By using those address­es to stage their attack, it allowed the hack­ers to bet­ter con­ceal their where­abouts.

“This attack is dif­fer­ent from the tens of thou­sands of inci­dents we have respond­ed to through­out the years,” said Kevin Man­dia, FireEye’s chief exec­u­tive. (He was the founder of Man­di­ant, a firm that Fire­Eye acquired in 2014.)

But Fire­Eye said it was still inves­ti­gat­ing exact­ly how the hack­ers had breached its most pro­tect­ed sys­tems. Details were thin.

Mr. Man­dia, a for­mer Air Force intel­li­gence offi­cer, said the attack­ers “tai­lored their world-class capa­bil­i­ties specif­i­cal­ly to tar­get and attack Fire­Eye.” He said they appeared to be high­ly trained in “oper­a­tional secu­ri­ty” and exhib­it­ed “dis­ci­pline and focus,” while mov­ing clan­des­tine­ly to escape the detec­tion of secu­ri­ty tools and foren­sic exam­i­na­tion. Google, Microsoft and oth­er firms that con­duct cyber­se­cu­ri­ty inves­ti­ga­tions said they had nev­er seen some of these tech­niques.

Fire­Eye also pub­lished key ele­ments of its “Red Team” tools so that oth­ers around the world would see attacks com­ing.

Amer­i­can inves­ti­ga­tors are try­ing to deter­mine if the attack has any rela­tion­ship to anoth­er sophis­ti­cat­ed oper­a­tion that the N.S.A. said Rus­sia was behind in a warn­ing issued on Mon­day. That gets into a type of soft­ware, called VM for vir­tu­al machines, which is used wide­ly by defense com­pa­nies and man­u­fac­tur­ers. The N.S.A. declined to say what the tar­gets of that attack were. It is unclear whether the Rus­sians used their suc­cess in that breach to get into FireEye’s sys­tems.

...

On Tues­day, Russia’s Nation­al Asso­ci­a­tion for Inter­na­tion­al Infor­ma­tion Secu­ri­ty held a forum with glob­al secu­ri­ty experts where Russ­ian offi­cials again claimed that there was no evi­dence its hack­ers were respon­si­ble for attacks that have result­ed in Amer­i­can sanc­tions and indict­ments.

Secu­ri­ty firms have been a fre­quent tar­get for nation-states and hack­ers, in part because their tools main­tain a deep lev­el of access to cor­po­rate and gov­ern­ment clients all over the world. By hack­ing into those tools and steal­ing source code, spies and hack­ers can gain a foothold to vic­tims’ sys­tems.

McAfee, Syman­tec and Trend Micro were among the list of major secu­ri­ty com­pa­nies whose code a Russ­ian-speak­ing hack­er group claimed to have stolen last year. Kasper­sky, the Russ­ian secu­ri­ty firm, was hacked by Israeli hack­ers in 2017. And in 2012, Syman­tec con­firmed that a seg­ment of its antivirus source code was stolen by hack­ers.

————

“Fire­Eye, a Top Cyber­se­cu­ri­ty Firm, Says It Was Hacked by a Nation-State” by David E. Sanger and Nicole Perl­roth; The New York Times; 12/08/2020

“Fire­Eye revealed on Tues­day that its own sys­tems were pierced by what it called “a nation with top-tier offen­sive capa­bil­i­ties.” The com­pa­ny said hack­ers used “nov­el tech­niques” to make off with its own tool kit, which could be use­ful in mount­ing new attacks around the world.”

Fire­Eye could­n’t say who pen­e­trat­ed their sys­tems. But they nonethe­less con­fi­dent­ly state it was the work a “a nation with top-tier offen­sive capa­bil­i­ties,” an asser­tion osten­si­bly root­ed in the sophis­ti­cat­ed nature of the attack, the dis­cip­ine of the attack­ers, and the num­ber of nev­er-before-seen tech­niques used by these unknown hack­ers. In oth­er words, a guess made based on pat­tern recog­ni­tion, and not an asser­tion made with real cer­tain­ty. Fire­Eye did­n’t actu­al­ly know this attack came from a nation with top-tier offen­sive capa­bil­i­ties when it made that state­ment. Fire­Eye could­n’t have tru­ly ruled out a pri­vate actor when it made that con­fi­dent state­ment. Or a nation with­out top-tier capa­bilites that pur­chased those top-tier capa­bil­i­ties from a top-tier com­mer­cial mal­ware provider like NSO Group. But mak­ing attri­bu­tions in cyber attacks is a ser­vice Fire­Eye pro­vides. It points towards one of the fun­da­men­tal binds the cyber­se­cu­ri­ty indus­try faces: their clients are pay­ing for answers, whether answers are fea­si­ble or not.

And when the FBI turned the case over to its Rus­sia spe­cial­ist, and ‘con­firmed’ the hack was the work of a state, it was pret­ty clear where the blame was ulti­mate­ly going to go. That ‘con­fir­ma­tion’ was no doubt pred­i­cat­ed in part on the sophis­ti­ca­tion of the hack. And yet the appar­ent prize of this hack was FireEye’s “Red Team” tool kit that repli­cat­ed the most sophis­ti­cat­ed hack­ing tools in the world. Or at least the most sophis­ti­cat­ed known hack­ing tools seen in the wild. It’s implic­it­ly obvi­ous in this very hack that the pos­ses­sion of world-class hack­ing tools isn’t lim­it­ed to major nation-states like the US, Rus­sia, and Chi­na. Beyond that, we are told how the theft of the Fire­Eye Red Team kit was high­ly use­ful to nation-states because it would give them plau­si­ble deni­a­bil­i­ty by allow­ing them to car­ry out risky hacks with­out using their ‘zero-day’ exploits, using some­one else’s tools instead. All of the details about this sto­ry point towards the hall of mir­rors nature of cyber­at­tri­bu­tion inves­ti­ga­tions:

...
It was a stun­ning theft, akin to bank rob­bers who, hav­ing cleaned out local vaults, then turned around and stole the F.B.I.’s inves­tiga­tive tools. In fact, Fire­Eye said on Tues­day, moments after the stock mar­ket closed, that it had called in the F.B.I.

The $3.5 bil­lion com­pa­ny, which part­ly makes a liv­ing by iden­ti­fy­ing the cul­prits in some of the world’s bold­est breach­es — its clients have includ­ed Sony and Equifax — declined to say explic­it­ly who was respon­si­ble. But its descrip­tion, and the fact that the F.B.I. has turned the case over to its Rus­sia spe­cial­ists, left lit­tle doubt who the lead sus­pects were and that they were after what the com­pa­ny calls “Red Team tools.”

These are essen­tial­ly dig­i­tal tools that repli­cate the most sophis­ti­cat­ed hack­ing tools in the world. Fire­Eye uses the tools — with the per­mis­sion of a client com­pa­ny or gov­ern­ment agency — to look for vul­ner­a­bil­i­ties in their sys­tems. Most of the tools are based in a dig­i­tal vault that Fire­Eye close­ly guards.

The F.B.I. on Tues­day con­firmed that the hack was the work of a state, but it also would not say which one. Matt Gorham, assis­tant direc­tor of the F.B.I. Cyber Divi­sion, said, “The F.B.I. is inves­ti­gat­ing the inci­dent and pre­lim­i­nary indi­ca­tions show an actor with a high lev­el of sophis­ti­ca­tion con­sis­tent with a nation-state.”

...

The N.S.A.’s tools were most like­ly more use­ful than FireEye’s since the U.S. gov­ern­ment builds pur­pose-made dig­i­tal weapons. FireEye’s Red Team tools are essen­tial­ly built from mal­ware that the com­pa­ny has seen used in a wide range of attacks.

Still, the advan­tage of using stolen weapons is that nation-states can hide their own tracks when they launch attacks.

“Hack­ers could lever­age FireEye’s tools to hack risky, high-pro­file tar­gets with plau­si­ble deni­a­bil­i­ty,” said Patrick War­dle, a for­mer N.S.A. hack­er who is now a prin­ci­pal secu­ri­ty researcher at Jamf, a soft­ware com­pa­ny. “In risky envi­ron­ments, you don’t want to burn your best tools, so this gives advanced adver­saries a way to use some­one else’s tools with­out burn­ing their best capa­bil­i­ties.”

A Chi­nese state-spon­sored hack­ing group was pre­vi­ous­ly caught using the N.S.A.’s hack­ing tools in attacks around the world, osten­si­bly after dis­cov­er­ing the N.S.A.’s tools on its own sys­tems. “It’s like a no-brain­er,” said Mr. War­dle.
...

And as the arti­cle reminds us, despite all hype about the ‘Shad­ow Bro­kers’ being a Russ­ian hack­er group, the glob­al com­mu­ni­ty has still nev­er tru­ly deter­mined their iden­i­ty. As is the case with near­ly all major hacks, the iden­ti­ties of the per­pe­tra­tors is ulti­mate­ly unknow­able based on the avail­able evi­dence:

...
The hack was the biggest known theft of cyber­se­cu­ri­ty tools since those of the Nation­al Secu­ri­ty Agency were pur­loined in 2016 by a still-uniden­ti­fied group that calls itself the Shad­ow­Bro­kers. That group dumped the N.S.A.’s hack­ing tools online over sev­er­al months, hand­ing nation-states and hack­ers the “keys to the dig­i­tal king­dom,” as one for­mer N.S.A. oper­a­tor put it. North Korea and Rus­sia ulti­mate­ly used the N.S.A.’s stolen weapon­ry in destruc­tive attacks on gov­ern­ment agen­cies, hos­pi­tals and the world’s biggest con­glom­er­ates — at a cost of more than $10 bil­lion.
...

It’s also worth observ­ing how Fire­Eye was declar­ing that the attack­ers tai­lored their world-class capa­bil­i­ties specif­i­cal­ly to tar­get and attack Fire­Eye.” And yet, as we learn, this was­n’t a spe­cif­ic attack on Fire­Eye at all. It was an attack on Fire­Eye and Solar­Wind­s’s 18,000 oth­er cus­tomers. Fire­Eye was just a very juicy tar­get to pil­fer amongst the thou­sands the hack­ers had to choose from:

...
But Fire­Eye said it was still inves­ti­gat­ing exact­ly how the hack­ers had breached its most pro­tect­ed sys­tems. Details were thin.

Mr. Man­dia, a for­mer Air Force intel­li­gence offi­cer, said the attack­ers “tai­lored their world-class capa­bil­i­ties specif­i­cal­ly to tar­get and attack Fire­Eye.” He said they appeared to be high­ly trained in “oper­a­tional secu­ri­ty” and exhib­it­ed “dis­ci­pline and focus,” while mov­ing clan­des­tine­ly to escape the detec­tion of secu­ri­ty tools and foren­sic exam­i­na­tion. Google, Microsoft and oth­er firms that con­duct cyber­se­cu­ri­ty inves­ti­ga­tions said they had nev­er seen some of these tech­niques.

...

On Tues­day, Russia’s Nation­al Asso­ci­a­tion for Inter­na­tion­al Infor­ma­tion Secu­ri­ty held a forum with glob­al secu­ri­ty experts where Russ­ian offi­cials again claimed that there was no evi­dence its hack­ers were respon­si­ble for attacks that have result­ed in Amer­i­can sanc­tions and indict­ments.

Secu­ri­ty firms have been a fre­quent tar­get for nation-states and hack­ers, in part because their tools main­tain a deep lev­el of access to cor­po­rate and gov­ern­ment clients all over the world. By hack­ing into those tools and steal­ing source code, spies and hack­ers can gain a foothold to vic­tims’ sys­tems.
...

Final­ly, note that Fire­Eye is far from the only cyber­se­cu­ri­ty firm to report hav­ing their code stolen by ‘a Russ­ian-speak­ing hack­er group’ last year. McAfee, Syman­tec, and Trend­Mi­cro all report­ed get­ting hit. Which mean the “Red Team code” kits from all those oth­er firms are also float­ing around out there. And in each case, it was “Russ­ian-speak­ing hack­ers”. Who­ev­er has been hack­ing these oth­er secu­ri­ty firms was been leav­ing Russ­ian lan­guage arti­facts in their mal­ware. It’s a thing:

...
McAfee, Syman­tec and Trend Micro were among the list of major secu­ri­ty com­pa­nies whose code a Russ­ian-speak­ing hack­er group claimed to have stolen last year. Kasper­sky, the Russ­ian secu­ri­ty firm, was hacked by Israeli hack­ers in 2017. And in 2012, Syman­tec con­firmed that a seg­ment of its antivirus source code was stolen by hack­ers.
...

And yet, as we’re going to see, that’s not actu­al­ly the case with the Fire­Eye hack. No Russ­ian lan­guage arti­facts, or any oth­er lan­guage arti­facts, were left in the mal­ware used to attack Fire­Eye. And as we’re also going to see, this lack of lan­guage arti­facts in the att­tack — no Cyril­lic, or Man­darin or Per­sion — was seen as a utter shock by the Crowd­Strike fig­ures tasked with study­ing the attack.

FireEye Didn’t Start the Fire. Welcome to the SolarWinds Nightmare. Brought to You by Cozy Bear, According to the FBI, although FireEye isn’t So Sure

The Fire­Eye night­mare explodes into the Solar­Winds wak­ing worst night­mare. It was deter­mined that Solar­Wind­s’s Ori­on update soft­ware deliv­ered the mal­ware onto FireEye’s sys­tems. It’s the kind of omi­nous dis­cov­ery that comes with the impli­ca­tion that the oth­er 18,000 Solar­Winds clients run­ning the Ori­on soft­ware got hit too. Which is basi­cal­ly what hap­pened.

We also got an ear­ly hint from Solar­Winds about how the hack start­ed in the first place: in its cor­po­rate fil­ing dis­clos­ing the hack with the SEC, Solar­Winds indi­cat­ed that Microsoft­’s Office 365 email may have been “an attack vec­tor” used by the hack­ers.

And as we can see, the FBI was ready to name names from the very onset of this inves­ti­ga­tion. It took basi­cal­ly no time at all: APT29 aka Cozy Bear is at it again. That was the line from the FBI. The infa­mous hack­ing group thought to work for Rus­si­a’s FSB (or SVR, it’s unclear) and that the US claims was behind the first hack of the Demo­c­ra­t­ic Nation­al Com­mit­tee (DNC) in 2015 was also behind the new Solar­Winds mega-hack. No rea­sons for this attri­bu­tion are giv­en, of course:

The Wash­ing­ton Post

Russ­ian gov­ern­ment hack­ers are behind a broad espi­onage cam­paign that has com­pro­mised U.S. agen­cies, includ­ing Trea­sury and Com­merce

By Ellen Nakashima and Craig Tim­berg
Decem­ber 14, 2020 at 11:30 a.m. EST

Russ­ian gov­ern­ment hack­ers breached the Trea­sury and Com­merce depart­ments, along with oth­er U.S. gov­ern­ment agen­cies, as part of a glob­al espi­onage cam­paign that stretch­es back months, accord­ing to peo­ple famil­iar with the mat­ter.

Offi­cials were scram­bling over the week­end to assess the nature and extent of the intru­sions and imple­ment effec­tive coun­ter­mea­sures, but ini­tial signs sug­gest­ed the breach was long-run­ning and sig­nif­i­cant, the peo­ple famil­iar with the mat­ter said.

The Russ­ian hack­ers, known by the nick­names APT29 or Cozy Bear, are part of that nation’s for­eign intel­li­gence ser­vice, the SVR, and they breached email sys­tems in some cas­es, said the peo­ple famil­iar with the intru­sions, who spoke on the con­di­tion of anonymi­ty because of the sen­si­tiv­i­ty of the mat­ter. The same Russ­ian group hacked the State Depart­ment and the White House email servers dur­ing the Oba­ma admin­is­tra­tion.

The FBI is inves­ti­gat­ing the cam­paign, which may have begun as ear­ly as spring, and had no com­ment Sun­day. The vic­tims have includ­ed gov­ern­ment, con­sult­ing, tech­nol­o­gy, tele­com, and oil and gas com­pa­nies in North Amer­i­ca, Europe, Asia and the Mid­dle East, accord­ing to Fire­Eye, a cyber firm that itself was breached.

The Russ­ian Embassy in Wash­ing­ton on Sun­day called the reports of Russ­ian hack­ing “base­less.” In a state­ment on Face­book it said, “attacks in the infor­ma­tion space con­tra­dict” Russ­ian for­eign pol­i­cy and nation­al inter­ests. “Rus­sia does not con­duct offen­sive oper­a­tions” in the cyber domain.

All of the orga­ni­za­tions were breached through the update serv­er of a net­work man­age­ment sys­tem made by the firm Solar­Winds, Fire­Eye said in a blog post Sun­day.

The fed­er­al Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency issued an alert Sun­day warn­ing about an “active exploita­tion” of the Solar­Winds Ori­on Plat­form, from ver­sions of the soft­ware released in March and June. “CISA encour­ages affect­ed orga­ni­za­tions to read the Solar­Winds and Fire­Eye advi­sories for more infor­ma­tion and FireEye’s GitHub page for detec­tion coun­ter­mea­sures,” the alert said.

Solar­Winds said Sun­day in a state­ment that mon­i­tor­ing prod­ucts it released in March and June of this year may have been sur­rep­ti­tious­ly weaponized in a “high­ly-sophis­ti­cat­ed, tar­get­ed . . . attack by a nation state.”

The com­pa­ny filed a doc­u­ment Mon­day with the Secu­ri­ties and Exchange Com­mis­sion say­ing that “few­er than 18,000” of its more than 300,000 cus­tomers may have installed a soft­ware patch enabling the Russ­ian attack. It was not clear, the fil­ing said, how many sys­tems were actu­al­ly hacked. The cor­po­rate fil­ing also said that Microsoft’s Office 365 email may have been “an attack vec­tor” used by the hack­ers.

Microsoft said in a blog post Sun­day that it had not iden­ti­fied any Microsoft prod­uct or cloud ser­vice vul­ner­a­bil­i­ties in its inves­ti­ga­tion of the mat­ter.

The scale of the Russ­ian espi­onage oper­a­tion appears to be large, said sev­er­al indi­vid­u­als famil­iar with the mat­ter. “This is look­ing very, very bad,” said one per­son. Solar­Winds prod­ucts are used by orga­ni­za­tions across the world. They include all five branch­es of the U.S. mil­i­tary, the Pen­ta­gon, State Depart­ment, Jus­tice Depart­ment, NASA, the Exec­u­tive Office of the Pres­i­dent and the Nation­al Secu­ri­ty Agency, the world’s top elec­tron­ic spy agency, accord­ing to the firm’s web­site.

Its clients also include the top 10 U.S. telecom­mu­ni­ca­tions com­pa­nies.

“This is a big deal, and giv­en what we now know about where breach­es hap­pened, I’m expect­ing the scope to grow as more logs are reviewed,” said John Scott-Rail­ton, a senior researcher at Cit­i­zen Lab at the Uni­ver­si­ty of Toronto’s Munk School of Glob­al Affairs and Pub­lic Pol­i­cy. “When an aggres­sive group like this gets an open sesame to many desir­able sys­tems, they are going to use it wide­ly.”

Fire­Eye report­ed last week that it was breached and that hack­ing tools it uses to test clients’ com­put­er defens­es were stolen. The Wash­ing­ton Post report­ed that APT29 was the group behind that hack. Fire­Eye and Microsoft, which were inves­ti­gat­ing the breach, dis­cov­ered the hack­ers were gain­ing access to vic­tims through updates to Solar­Winds’ Ori­on net­work mon­i­tor­ing soft­ware, Fire­Eye said in its blog post, with­out pub­licly nam­ing the Rus­sians.

...

At Com­merce, the Rus­sians tar­get­ed the Nation­al Telecom­mu­ni­ca­tions and Infor­ma­tion Admin­is­tra­tion, an agency that han­dles Inter­net and telecom­mu­ni­ca­tions pol­i­cy, Reuters report­ed. They have also been linked to attempts to steal coro­n­avirus coro­n­avirus research.

In 2014 and 2015, the same group car­ried out a wide-rang­ing espi­onage cam­paign that tar­get­ed thou­sands of orga­ni­za­tions, includ­ing gov­ern­ment agen­cies, for­eign embassies, ener­gy com­pa­nies, telecom­mu­ni­ca­tions firms and uni­ver­si­ties.

As part of that oper­a­tion, it hacked the unclas­si­fied email sys­tems of the White House, the Pentagon’s Joint Chiefs of Staff and the State Depart­ment.

“That was the first time we saw the Rus­sians become much more aggres­sive, and instead of sim­ply fad­ing away like ghosts when they were detect­ed, they actu­al­ly con­test­ed access to the net­works,” said Michael Daniel, who was White House cyber­se­cu­ri­ty coor­di­na­tor at the time.

One of its vic­tims in 2015 was the Demo­c­ra­t­ic Nation­al Com­mit­tee. But unlike a rival Russ­ian spy agency, the GRU, which also hacked the DNC, it did not leak the stolen mate­r­i­al. In 2016, the GRU mil­i­tary spy agency leaked hacked emails to the online anti-secre­cy orga­ni­za­tion Wik­iLeaks in an oper­a­tion that dis­rupt­ed the Democ­rats’ nation­al con­ven­tion in the midst of the pres­i­den­tial cam­paign.

The SVR, by con­trast, gen­er­al­ly steals infor­ma­tion for tra­di­tion­al espi­onage pur­pos­es, seek­ing secrets that might help the Krem­lin under­stand the plans and motives of politi­cians and pol­i­cy­mak­ers. Its oper­a­tors also have filched indus­tri­al data and hacked for­eign min­istries.

Because the Oba­ma admin­is­tra­tion saw the APT29 oper­a­tion as tra­di­tion­al espi­onage, it did not con­sid­er tak­ing puni­tive mea­sures, said Daniel, who is now pres­i­dent and chief exec­u­tive of the Cyber Threat Alliance, an infor­ma­tion-shar­ing group for ­cyber­se­cu­ri­ty com­pa­nies.

“It was infor­ma­tion col­lec­tion, which is what nation states — includ­ing the Unit­ed States — do,” he said. “From our per­spec­tive, it was more impor­tant to focus on shoring up defens­es.”

But Chris Painter, State Depart­ment cyber coor­di­na­tor in the Oba­ma admin­is­tra­tion, said even if the Russ­ian cam­paign is strict­ly about espi­onage and there’s no norm against spy­ing, if the scope is broad there should be con­se­quences. “We just don’t have to sit still for it and say ‘good job,’ ” he said.

Sanc­tions might be one answer, espe­cial­ly if done in con­cert with allies who were sim­i­lar­ly affect­ed, he said. “The prob­lem is there’s not even been con­dem­na­tion from the top. Pres­i­dent Trump hasn’t want­ed to say any­thing bad to Rus­sia, which only encour­ages them to act irre­spon­si­bly across a wide range of activ­i­ties.”

At the very least, he said, “you’d want to make clear to [Russ­ian Pres­i­dent Vladimir] Putin that this is unac­cept­able — the scope is unac­cept­able.”

So far there is no sign that the cur­rent cam­paign is being waged for pur­pos­es of leak­ing infor­ma­tion or for dis­rup­tion of crit­i­cal infra­struc­ture, such as elec­tric grids.

Solar­Winds’ mon­i­tor­ing tool has extreme­ly deep “admin­is­tra­tive” access to a network’s core func­tions, which means that hack­ing the tool would allow the Rus­sians to freely root around vic­tims’ sys­tems.

APT29 com­pro­mised Solar­Winds so that any time a cus­tomer checked in to request an update, the Rus­sians could hitch a ride on the weaponized update to get into a victim’s sys­tem. Fire­Eye dubbed the mal­ware that the hack­ers used “Sun­burst.”

“Mon­day may be a bad day for lots of secu­ri­ty teams,” tweet­ed Dmitri Alper­ovitch, a cyber­se­cu­ri­ty expert and founder of the Sil­ver­a­do Pol­i­cy Accel­er­a­tor think tank.

———–

“Russ­ian gov­ern­ment hack­ers are behind a broad espi­onage cam­paign that has com­pro­mised U.S. agen­cies, includ­ing Trea­sury and Com­merce” by Ellen Nakashima and Craig Tim­berg; The Wash­ing­ton Post; 12/14/202

“The Russ­ian hack­ers, known by the nick­names APT29 or Cozy Bear, are part of that nation’s for­eign intel­li­gence ser­vice, the SVR, and they breached email sys­tems in some cas­es, said the peo­ple famil­iar with the intru­sions, who spoke on the con­di­tion of anonymi­ty because of the sen­si­tiv­i­ty of the mat­ter. The same Russ­ian group hacked the State Depart­ment and the White House email servers dur­ing the Oba­ma admin­is­tra­tion.”

Less than a week after the Fire­Eye night­mare hack is first announced to the world, we learn it was just one part of a much larg­er Solar­Winds night­mare. A glob­al espi­onage cam­paign that seem­ing­ly tar­get­ed US gov­ern­ment agen­cies. And the US gov­ern­ment had already deter­mined the cul­prit: APT29/Cozy Bear was behind it. That’s the word we were get­ting from anony­mous sources tied to the inves­ti­ga­tion. It was def­i­nite­ly Rus­sia who had thor­ough­ly hacked the US gov­ern­men­t’s net­works start­ing in March of 2020 and was read­ing all those gov­ern­ment emails and rout­ing through US gov­ern­ment net­works this whole time:

...
The fed­er­al Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency issued an alert Sun­day warn­ing about an “active exploita­tion” of the Solar­Winds Ori­on Plat­form, from ver­sions of the soft­ware released in March and June. “CISA encour­ages affect­ed orga­ni­za­tions to read the Solar­Winds and Fire­Eye advi­sories for more infor­ma­tion and FireEye’s GitHub page for detec­tion coun­ter­mea­sures,” the alert said.

Solar­Winds said Sun­day in a state­ment that mon­i­tor­ing prod­ucts it released in March and June of this year may have been sur­rep­ti­tious­ly weaponized in a “high­ly-sophis­ti­cat­ed, tar­get­ed . . . attack by a nation state.”

...

Solar­Winds’ mon­i­tor­ing tool has extreme­ly deep “admin­is­tra­tive” access to a network’s core func­tions, which means that hack­ing the tool would allow the Rus­sians to freely root around vic­tims’ sys­tems.
...

And note this omi­nous ear­ly detail: in its cor­po­rate fil­ing dis­clos­ing the hack with the SEC, Solar­Winds indi­cat­ed that Microsoft­’s Office 365 email may have been “an attack vec­tor” used by the hack­ers. Now, it’s impor­tant to note that this lan­guage is some­what vague as to whether or not Microsoft­’s Office 365 was used for the ini­tial attack to infect the Solar­Winds net­work or it was used after the Solar­Winds hack to fur­ther exploit the net­works of the 18,000 vic­tims. But as we’re going to see, Solar­Winds does con­firm two months lat­er that, yes, this Microsoft Office 365 email vul­ner­a­bil­i­ty was used in the ini­tial hack of the Solar­Winds net­work:

...
The com­pa­ny filed a doc­u­ment Mon­day with the Secu­ri­ties and Exchange Com­mis­sion say­ing that “few­er than 18,000” of its more than 300,000 cus­tomers may have installed a soft­ware patch enabling the Russ­ian attack. It was not clear, the fil­ing said, how many sys­tems were actu­al­ly hacked. The cor­po­rate fil­ing also said that Microsoft’s Office 365 email may have been “an attack vec­tor” used by the hack­ers.

Microsoft said in a blog post Sun­day that it had not iden­ti­fied any Microsoft prod­uct or cloud ser­vice vul­ner­a­bil­i­ties in its inves­ti­ga­tion of the mat­ter.
...

Final­ly, observe how sim­i­lar the nar­ra­tive we’re hear­ing now is to exact­ly what we heard from the US gov­ern­ment in 2016 fol­low­ing the remark­ably ‘aggres­sive’ and ‘noisy’ sec­ond hack of the DNC that we are told was exe­cut­ed by ‘Fan­cy Bear’ of Rus­si­a’s GRU. Recall how, back in late July 2016, US inves­ti­ga­tors were sug­gest­ing Fan­cy Bear was try­ing to get caught in the DNC hack. That was the expla­na­tion giv­en for the notable appar­ent lack of sophis­ti­ca­tion in the hack that was seen as very dif­fer­ent from pre­vi­ous hacks attrib­uted to Fan­cy Bear. So now we’re more or less hear­ing the same sto­ry in rela­tion to Cozy Bear: this hack was high­ly unchar­ac­ter­is­tic for Cozy Bear in the sense that the hack­ers active­ly fought to main­tain their grip on the net­works even after being caught. But we are nonethe­less assured it’s Cozy Bear:

...
As part of that oper­a­tion, it hacked the unclas­si­fied email sys­tems of the White House, the Pentagon’s Joint Chiefs of Staff and the State Depart­ment.

“That was the first time we saw the Rus­sians become much more aggres­sive, and instead of sim­ply fad­ing away like ghosts when they were detect­ed, they actu­al­ly con­test­ed access to the net­works,” said Michael Daniel, who was White House cyber­se­cu­ri­ty coor­di­na­tor at the time.

One of its vic­tims in 2015 was the Demo­c­ra­t­ic Nation­al Com­mit­tee. But unlike a rival Russ­ian spy agency, the GRU, which also hacked the DNC, it did not leak the stolen mate­r­i­al. In 2016, the GRU mil­i­tary spy agency leaked hacked emails to the online anti-secre­cy orga­ni­za­tion Wik­iLeaks in an oper­a­tion that dis­rupt­ed the Democ­rats’ nation­al con­ven­tion in the midst of the pres­i­den­tial cam­paign.

The SVR, by con­trast, gen­er­al­ly steals infor­ma­tion for tra­di­tion­al espi­onage pur­pos­es, seek­ing secrets that might help the Krem­lin under­stand the plans and motives of politi­cians and pol­i­cy­mak­ers. Its oper­a­tors also have filched indus­tri­al data and hacked for­eign min­istries.
...

They weren’t behav­ing like Cozy Bear, which has nev­er been known to behave this aggres­sive­ly before. But it was def­i­nite­ly Cozy Bear. That’s what the US was con­fi­dent­ly stat­ing less than a week after the Fire­Eye hack was dis­closed. Yet Fire­Eye was­n’t con­vinced. It’s one of the many data points point­ing in the direc­tion of con­tem­po­rary cyber attri­bu­tions being most­ly just made up con­ve­nient nar­ra­tives:

Bloomberg Quint

Fire­Eye Dis­cov­ered Solar­Winds Breach While Prob­ing Own Hack

Kar­tikay Mehro­tra
Pub­lished Dec 15 2020, 7:32 AM
Updat­ed Dec 16 2020, 7:25 AM

(Bloomberg) — When Fire­Eye Inc. dis­cov­ered that it was hacked this month, the cyber­se­cu­ri­ty firm’s inves­ti­ga­tors imme­di­ate­ly set about try­ing to fig­ure out how attack­ers got past its defens­es.

It wasn’t just Fire­Eye that got attacked, they quick­ly found out. Inves­ti­ga­tors dis­cov­ered a vul­ner­a­bil­i­ty in a prod­uct made by one of its soft­ware providers, Texas-based Solar­Winds Corp.

“We looked through 50,000 lines of source code, which we were able to deter­mine there was a back­door with­in Solar­Winds,” said Charles Car­makal, senior vice pres­i­dent and chief tech­ni­cal offi­cer at Man­di­ant, FireEye’s inci­dent response arm.

After dis­cov­er­ing the back­door, Fire­Eye con­tact­ed Solar­Winds and law enforce­ment, Car­makal said.

...

Nation­al Secu­ri­ty Advi­sor Robert O’Brien cut short a trip to the Mid­dle East and Europe to deal with the hack of U.S. gov­ern­ment agen­cies. And Sen­a­tor Richard Blu­men­thal, Demo­c­rat from Con­necti­cut, said a clas­si­fied brief­ing on “Russia’s cyber-attack left me deeply alarmed, in fact down­right scared.”
s
The hack­ers who attacked Fire­Eye stole sen­si­tive tools that the com­pa­ny uses to find vul­ner­a­bil­i­ties in clients’ com­put­er net­works. While the hack on Fire­Eye was embar­rass­ing for a cyber­se­cu­ri­ty firm, Car­makal argued that it may prove to be a cru­cial mis­take for the hack­ers.

“If this actor didn’t hit Fire­Eye, there is a chance that this cam­paign could have gone on for much, much longer,” Car­makal said. “One sil­ver lin­ing is that we learned so much about how this threat actor works and shared it with our law enforce­ment, intel­li­gence com­mu­ni­ty and secu­ri­ty part­ners.” Car­makal said there is no evi­dence FireEye’s stolen hack­ing tools were used against U.S. gov­ern­ment agen­cies.

“There will unfor­tu­nate­ly be more vic­tims that have to come for­ward in the com­ing weeks and months,” he said. While some have attrib­uted the attack to a state-spon­sored Russ­ian group known as APT 29, or Cozy Bear, Fire­Eye had not yet seen suf­fi­cient evi­dence to name the actor, he said. A Krem­lin offi­cial denied that Rus­sia had any involve­ment.

...

Car­makal said the hack­ers took advanced steps to con­ceal their actions. “Their lev­el of oper­a­tional secu­ri­ty is tru­ly excep­tion­al,” he said, adding that the hack­ers would oper­ate from servers based in the same city as an employ­ee they were pre­tend­ing to be in order to evade detec­tion.

...

———–

“Fire­Eye Dis­cov­ered Solar­Winds Breach While Prob­ing Own Hack” by Kar­tikay Mehro­tra; Bloomberg Quint; 12/15/2020

““There will unfor­tu­nate­ly be more vic­tims that have to come for­ward in the com­ing weeks and months,” he said. While some have attrib­uted the attack to a state-spon­sored Russ­ian group known as APT 29, or Cozy Bear, Fire­Eye had not yet seen suf­fi­cient evi­dence to name the actor, he said. A Krem­lin offi­cial denied that Rus­sia had any involve­ment.”

That ear­ly hes­i­tan­cy on FireEye’s behalf to name a cul­prit due to a lack of evi­dence is going to be impor­tant to keep in mind. Because as we see in an NPR arti­cle from April of 2021, four months after the attack, there was­n’t real­ly any new con­clu­sive infor­ma­tion about the hack­ers that emerges. No clue that can pos­i­tive­ly iden­ti­fy the hack­ers and not even the joke ‘clues’ like Cyril­lic or Man­darin char­ac­ters. Noth­ing. The big shock expressed by Adam Mey­ers of Crowd­Strike — the fig­ure who led the ear­ly inves­ti­ga­tion of the Solar­Winds hack — was that there was­n’t any ‘cul­tur­al arti­fact’ like Cyril­lic or Man­darin. And yet we’re going to hear asser­tion after asser­tion that this was the work of Russ­ian gov­ern­ment hack­ers. Nev­er an expla­na­tion why.

Is this the SolarWinds Mega-Hack? Or the Microsoft Mega-hack?

Sim­i­lar­ly, note how Solar­Winds was point­ing an fin­ger at a vul­ner­a­bil­i­ty in Microsoft­’s Office 365 email as being a vec­tor in the hack, and yet Microsoft was vocif­er­ous­ly deny­ing that a vul­ner­a­bil­i­ty in its own prod­ucts played a role at all. As we’ll see, there’s nev­er an expla­na­tion. Just faith. Faith in Microsoft. Faith that was again test­ed days after the ini­tial dis­clo­sure of the hack when Solar­Winds revealed more details on nature of the Microsoft exploits used by the hack­ers. Some­how the hack­ers were trick­ing Microsoft­’s authen­ti­ca­tion con­trols. This includes forg­ing authen­ti­ca­tion tokens for Microsoft­’s Azure cloud ser­vices and cre­at­ing pass­word cre­den­tials for legit­i­mate process­es enabling them to read emails from Microsoft­’s Exchange Online cloud-based email ser­vice. Keep in mind that the Microsoft-Exchange mega-hack that is announced in March was tar­get­ing the non-cloud self-host­ed Microsoft Exchange email servers. So when the Solar­Winds hack­ers demon­strate an abil­i­ty to break into the cloud-based Exchange servers, they were demon­strat­ing a capa­bil­i­ty that was­n’t exact­ly the same as that used to exe­cute the Microsoft Exchange mega-hack but awful­ly close. And yet we will be repeat­ed­ly assured by Microsoft that the Microsoft-Exchange hack was car­ried out by Chi­na and not at all con­nect­ed to the Solar­Winds hack or “com­mer­cial sur­veil­lance ven­dors”. That’s part of what makes these ear­ly dis­clo­sures by Microsoft itself, that the Solar­Winds hack­ers demon­strat­ed a remark­able abil­i­ty to manip­u­late Microsoft sys­tem cre­den­tials, is so sig­nif­i­cant. These are dis­clo­sures Microsoft seems to want to for­get as this looks more and more like a Microsoft mega-hack:

CRN

Microsoft’s Role In Solar­Winds Breach Comes Under Scruti­ny

By Michael Novin­son
Decem­ber 15, 2020, 05:18 PM EST

Microsoft has become ensnared in probes sur­round­ing the recent­ly dis­closed colos­sal U.S. gov­ern­ment hack, with media reports and com­pa­ny mes­sages focus­ing on Office 365, Azure Active Direc­to­ry and a key domain name.

Two key vic­tims in the mas­sive nation-state hack­ing cam­paign report­ed­ly had their Microsoft Office 365 accounts bro­ken into. The Russ­ian intel­li­gence ser­vice hack­ers for months mon­i­tored staff emails sent via Office 365 at the Com­merce Department’s Nation­al Telecom­mu­ni­ca­tions and Infor­ma­tion Admin­is­tra­tion (NTIA) after break­ing into the NTIA’s office soft­ware, Reuters report­ed Sun­day.

The hack­ers are “high­ly sophis­ti­cat­ed” and were able to trick the Microsoft platform’s authen­ti­ca­tion con­trols, accord­ing to Reuters, cit­ing a per­son famil­iar with the inci­dent. The Com­merce Depart­ment said that one of its bureaus had been breached, but didn’t respond to an inquiry about the role of Office 365 in the attack.

Microsoft didn’t pro­vide an on-the-record response to CRN ques­tions about if the com­pa­ny itself was breached as part of this cam­paign, and how sig­nif­i­cant Microsoft’s tech­nol­o­gy was in the hack­ers’ abil­i­ty to exploit cus­tomers. Microsoft said in a blog post Sun­day that its inves­ti­ga­tions haven’t iden­ti­fied any Microsoft prod­uct or cloud ser­vice vul­ner­a­bil­i­ties. Once an attack­er has com­pro­mised a tar­get net­work, they poten­tial­ly have access to a range of sys­tems, accord­ing to a source famil­iar with the sit­u­a­tion.”

On Mon­day, Solar­Winds said it was made aware of an attack vec­tor that was used to com­pro­mise the company’s Microsoft Office 365 emails, accord­ing to a fil­ing with the U.S. Secu­ri­ties and Exchange Com­mis­sion (SEC). Hack­ers had gained access to numer­ous pub­lic and pri­vate orga­ni­za­tions through tro­janized updates to Solar­Winds’ Ori­on net­work mon­i­tor­ing soft­ware, Fire­Eye said in a blog Sun­day.

That same attack vec­tor might have pro­vid­ed access to oth­er data con­tained in Solar­Winds’ Office 365 office pro­duc­tiv­i­ty tool, the com­pa­ny said. Solar­Winds said it’s prob­ing with Microsoft if any cus­tomer, per­son­nel or oth­er data was exfil­trat­ed as a result of this com­pro­mise, but hasn’t uncov­ered any evi­dence at this time of exfil­tra­tion.

“Solar­Winds, in col­lab­o­ra­tion with Microsoft, has tak­en reme­di­a­tion steps to address the com­pro­mise and is inves­ti­gat­ing whether fur­ther reme­di­a­tion steps are required, over what peri­od of time this com­pro­mise exist­ed and whether the com­pro­mise is asso­ci­at­ed with the attack on its Ori­on soft­ware build sys­tem,” the com­pa­ny wrote in its SEC fil­ing.

As for Azure, the hack­ers were able to forge a token which claims to rep­re­sent a high­ly priv­i­leged account in Azure Active Direc­to­ry (AD), the Microsoft Secu­ri­ty Research Cen­ter wrote in a blog Sun­day. The hack­ers could also gain admin­is­tra­tive Azure AD priv­i­leges with com­pro­mised cre­den­tials. Microsoft said this was par­tic­u­lar­ly like­ly if the account in ques­tion is not pro­tect­ed by mul­ti-fac­tor authen­ti­ca­tion.

“Hav­ing gained a sig­nif­i­cant foothold in the on-premis­es envi­ron­ment, the actor has made mod­i­fi­ca­tions to Azure Active Direc­to­ry set­tings to facil­i­tate long term access,” the Microsoft Secu­ri­ty Research Cen­ter wrote.

The hack­ers were observed adding new fed­er­a­tion trusts to an exist­ing ten­ant or mod­i­fy­ing the prop­er­ties of an exist­ing fed­er­a­tion trust to accept tokens signed with hack­er-owned cer­tifi­cates, Microsoft said. They could also use their admin­is­tra­tor priv­i­leges to grant addi­tion­al per­mis­sions to the tar­get Appli­ca­tion or Ser­vice Prin­ci­pal, accord­ing to Microsoft.

Microsoft also observed the hack­ers adding pass­word cre­den­tials or x509 cer­tifi­cates to legit­i­mate process­es, grant­i­ng them the abil­i­ty to read mail con­tent from Exchange Online via Microsoft Graph or Out­look REST. Exam­ples of this hap­pen­ing include mail archiv­ing appli­ca­tions, the firm said. Per­mis­sions usu­al­ly, but not always, con­sid­ered only the app iden­ti­ty rather than the cur­rent user’s per­mis­sions.

And from a domain per­spec­tive, Microsoft on Mon­day took con­trol over a key domain name that was used by the Solar­Winds hack­ers to com­mu­ni­cate with sys­tems com­pro­mised by the back­door Ori­on prod­uct updates, Kreb­sOn­Se­cu­ri­ty report­ed Tues­day. Microsoft has a long his­to­ry of seiz­ing con­trol of domains involved with mal­ware, par­tic­u­lar­ly when those sites are being used to attack Win­dows clients.

Armed with that access, Kreb­sOn­Se­cu­ri­ty said Microsoft should soon have some idea which and how many Solar­Winds cus­tomers were affect­ed. That’s because Microsoft now has insight into which orga­ni­za­tions have IT sys­tems that are still try­ing to ping the mali­cious domain, Kreb­sOn­Se­cu­ri­ty said.

“How­ev­er, because many Inter­net ser­vice providers and affect­ed com­pa­nies are already block­ing sys­tems from access­ing that mali­cious con­trol domain or have dis­con­nect­ed the vul­ner­a­ble Ori­on ser­vices, Microsoft’s vis­i­bil­i­ty may be some­what lim­it­ed,” Kreb­sOn­Se­cu­ri­ty cau­tioned.

...

———-

“Microsoft’s Role In Solar­Winds Breach Comes Under Scruti­ny” by Michael Novin­son; CRN; 12/15/2020

“Two key vic­tims in the mas­sive nation-state hack­ing cam­paign report­ed­ly had their Microsoft Office 365 accounts bro­ken into. The Russ­ian intel­li­gence ser­vice hack­ers for months mon­i­tored staff emails sent via Office 365 at the Com­merce Department’s Nation­al Telecom­mu­ni­ca­tions and Infor­ma­tion Admin­is­tra­tion (NTIA) after break­ing into the NTIA’s office soft­ware, Reuters report­ed Sun­day.”

The ‘Russ­ian hack­ers’ were read­ing gov­ern­ment emails for months. And while we were get­ting assured that it was Rus­sia behind it, it’s worth keep­ing in mind that the idea that it was Rus­sia read­ing these emails is actu­al­ly far more assur­ing than the idea of cyber crim­i­nals doing the same because at least Rus­sia is less inclined to sell or release the data. In oth­er words, these ear­ly aggres­sive­ly high­ly con­fi­dent attri­bu­tions towards Rus­sia aren’t just self-serv­ing from the stand­point of align­ing with US geopo­lit­i­cal inter­ests. They’re also high­ly self-serv­ing for Microsoft, Solar­Winds, and the US gov­ern­ment agen­cies that got hacked by down­play­ing the poten­tial impli­ca­tions of the hack.

Now note these ear­ly details of how Microsoft vul­ner­a­bil­i­ties were used in the attack. The hack­ers were trick­ing Microsoft­’s authen­ti­ca­tion con­trols. They could forge authen­ti­ca­tion tokens enabling access to Microsoft­’s cloud-based Azure ser­vices. But crit­i­cal­ly, they were gain­ing access to read mail con­tent from Exchange Online, effec­tive­ly demon­strat­ing the abil­i­ty to hack Microsoft­’s cloud-based Exchange email servers. This is going to be an impor­tant detail to keep in mind as we read about the Microsoft Exchange serv­er mega-hack dis­closed in March:

...
The hack­ers are “high­ly sophis­ti­cat­ed” and were able to trick the Microsoft platform’s authen­ti­ca­tion con­trols, accord­ing to Reuters, cit­ing a per­son famil­iar with the inci­dent. The Com­merce Depart­ment said that one of its bureaus had been breached, but didn’t respond to an inquiry about the role of Office 365 in the attack.

...

As for Azure, the hack­ers were able to forge a token which claims to rep­re­sent a high­ly priv­i­leged account in Azure Active Direc­to­ry (AD), the Microsoft Secu­ri­ty Research Cen­ter wrote in a blog Sun­day. The hack­ers could also gain admin­is­tra­tive Azure AD priv­i­leges with com­pro­mised cre­den­tials. Microsoft said this was par­tic­u­lar­ly like­ly if the account in ques­tion is not pro­tect­ed by mul­ti-fac­tor authen­ti­ca­tion.

...

Microsoft also observed the hack­ers adding pass­word cre­den­tials or x509 cer­tifi­cates to legit­i­mate process­es, grant­i­ng them the abil­i­ty to read mail con­tent from Exchange Online via Microsoft Graph or Out­look REST. Exam­ples of this hap­pen­ing include mail archiv­ing appli­ca­tions, the firm said. Per­mis­sions usu­al­ly, but not always, con­sid­ered only the app iden­ti­ty rather than the cur­rent user’s per­mis­sions.
...

And note that at this point Microsoft itself is also describ­ing how it observed the hack­ers adding pass­word cre­den­tials or x509 cer­tifi­cates to legit­i­mate process­es to enabling the read­ing of emails. Microsoft­’s own secu­ri­ty researchers were telling us about this. And yet, as we’ll see in the arti­cles below from Feb­ru­ary, Microsoft insists that vul­ner­a­bil­i­ties in its soft­ware played no role at all in the hack and all such reports are mis­in­for­ma­tion.

A week into the Solar­Winds hack dis­clo­sure, the US Trea­sury Depart­ment gives an update. We’re told the depart­men­t’s hack start­ed in July. And in anoth­er indi­ca­tion that the hack­ers had the abil­i­ty to authen­ti­cate the cre­den­tial need­ed to extract data from Microsoft­’s Office 365 email soft­ware, we’re told that’s exact­ly what they were doing on the Trea­sury’s net­work. So both Solar­Winds and the US Trea­sury were giv­ing us strong hints ear­ly on that the sto­ry of the Solar­Winds mega-hack is the sto­ry of a still-unrec­og­nized Microsoft mega-hack:

The New York Times

Trea­sury Department’s Senior Lead­ers Were Tar­get­ed by Hack­ing

The dis­clo­sure was the first acknowl­edg­ment of a spe­cif­ic intru­sion in the vast cyber­at­tack. At the White House, nation­al secu­ri­ty lead­ers met to assess how to deal with the sit­u­a­tion.

By David E. Sanger and Alan Rappe­port
Pub­lished Dec. 21, 2020 Updat­ed Jan. 6, 2021

WASHINGTON — The Russ­ian hack­ers who pen­e­trat­ed Unit­ed States gov­ern­ment agen­cies broke into the email sys­tem used by the Trea­sury Department’s most senior lead­er­ship, a Demo­c­ra­t­ic mem­ber of the Sen­ate Finance Com­mit­tee said on Mon­day, the first detail of how deeply Moscow bur­rowed into the Trump administration’s net­works.

In a state­ment after a brief­ing for com­mit­tee staff mem­bers, Sen­a­tor Ron Wyden of Ore­gon, who has often been among the sharpest crit­ics of the Nation­al Secu­ri­ty Agency and oth­er intel­li­gence agen­cies, said that the Trea­sury Depart­ment had acknowl­edged that “the agency suf­fered a seri­ous breach, begin­ning in July, the full depth of which isn’t known.”

The Trea­sury Depart­ment ranks among the most high­ly pro­tect­ed cor­ners of the gov­ern­ment because of its respon­si­bil­i­ty for mar­ket-mov­ing eco­nom­ic deci­sions, com­mu­ni­ca­tions with the Fed­er­al Reserve and eco­nom­ic sanc­tions against adver­saries. Mr. Wyden said the hack­ers had gained access to the email sys­tem by manip­u­lat­ing inter­nal soft­ware keys.

The depart­ment learned of the breach not from any of the gov­ern­ment agen­cies whose job is to pro­tect against cyber­at­tacks, but from Microsoft, which runs much of Treasury’s com­mu­ni­ca­tions soft­ware, Mr. Wyden said. He said that “dozens of email accounts were com­pro­mised,” appar­ent­ly includ­ing in what is called the depart­men­tal offices divi­sion, where the most senior offi­cials oper­ate.

“Trea­sury still does not know all of the actions tak­en by hack­ers, or pre­cise­ly what infor­ma­tion was stolen,” he said.

An aide to Mr. Wyden said the department’s offi­cials indi­cat­ed that Trea­sury Sec­re­tary Steven Mnuchin’s email account had not been breached.

The newest dis­clo­sures under­scored the administration’s con­flict­ing mes­sages about the source of the attacks and the extent of the dam­age as more reports about the tar­gets leak out. A Trea­sury Depart­ment spokes­woman did not imme­di­ate­ly respond to a request for com­ment.

Mr. Mnuchin addressed the hack­ing ear­li­er on Mon­day and said the department’s clas­si­fied sys­tems had not been breached.

“At this point, we do not see any break-in into our clas­si­fied sys­tems,” he said in an inter­view with CNBC. “Our unclas­si­fied sys­tems did have some access.”

Mr. Mnuchin said that the hack­ing was relat­ed to third-par­ty soft­ware. He added that there had been no dam­age or large amounts of infor­ma­tion dis­placed as a result of the attack and that the agency had robust resources to pro­tect the finan­cial indus­try.

“I can assure you, we are com­plete­ly on top of this,” he said. He did not explain how the Russ­ian pres­ence was not detect­ed in the sys­tem for more than four months.

His state­ment came on the same day that Attor­ney Gen­er­al William P. Barr, at his final news con­fer­ence before step­ping down, sided with Sec­re­tary of State Mike Pom­peo in say­ing that Moscow was almost cer­tain­ly behind the hack­ing. The intru­sion went through a com­mer­cial net­work man­age­ment soft­ware pack­age made by Solar­Winds, a com­pa­ny based in Austin, Texas, and allowed the hack­ers broad access to gov­ern­ment and cor­po­rate sys­tems.

“I agree with Sec­re­tary Pompeo’s assess­ment: It cer­tain­ly appears to be the Rus­sians,” Mr. Barr said, fur­ther under­cut­ting Pres­i­dent Trump’s effort to cast doubt on whether the gov­ern­ment of Pres­i­dent Vladimir V. Putin of Rus­sia was behind the attack. Mr. Trump appears to be alone in the admin­is­tra­tion in his con­tention that Chi­na might have been the source of the hack­ing.

Mr. Mnuchin was among sev­er­al top offi­cials in the gov­ern­ment who met with nation­al secu­ri­ty offi­cials for the first time at the White House on Mon­day to assess the dam­age and dis­cuss how to deal with it.

The meet­ing was a prin­ci­pals com­mit­tee ses­sion led by Robert C. O’Brien, the nation­al secu­ri­ty advis­er. It was held two days after Mr. Trump said the attack on fed­er­al net­works was “under con­trol,” was being exag­ger­at­ed by the news media and might have been car­ried out by Chi­na rather than Rus­sia, which has been iden­ti­fied by intel­li­gence agen­cies, oth­er gov­ern­ment offi­cials and cyber­se­cu­ri­ty firms as the almost cer­tain source of the hack­ing.

The ses­sion was clas­si­fied, but if it was like the brief­in­gs to Con­gress in recent days, the intel­li­gence offi­cials expressed lit­tle doubt that the attack was most like­ly car­ried out by hack­ers asso­ci­at­ed with the S.V.R., Russia’s pre­mier intel­li­gence agency.

But on Mon­day there was no pub­lic dec­la­ra­tion attribut­ing the hack­ing to Rus­sia, per­haps reflect­ing Mr. Trump’s reluc­tance to con­front Moscow over the issue and the doubts he has expressed about the seri­ous­ness of the attack.

The meet­ing, accord­ing to one senior admin­is­tra­tion offi­cial, was intend­ed to “take stock of the intel­li­gence, the inves­ti­ga­tion and the actions being tak­en to reme­di­ate” the attack. Absent from that descrip­tion was any prepa­ra­tion for impos­ing a cost on the attack­er. Mr. Trump did not attend the meet­ing.

...

The list of atten­dees at the meet­ing was notable because it pro­vid­ed some indi­ca­tion of which parts of the gov­ern­ment might have been affect­ed. White House offi­cials said Trea­sury Sec­re­tary Steven Mnuchin, Com­merce Sec­re­tary Wilbur Ross, the act­ing home­land secu­ri­ty sec­re­tary Chad F. Wolf and Ener­gy Sec­re­tary Dan Brouil­lette were present. All of those agen­cies were pre­vi­ous­ly iden­ti­fied by news orga­ni­za­tions as tar­gets of the hack­ing.

John Rat­cliffe, the direc­tor of nation­al intel­li­gence, par­tic­i­pat­ed in the meet­ing; so did Gina Haspel, the C.I.A. direc­tor, and Gen. Paul M. Naka­sone, the direc­tor of the Nation­al Secu­ri­ty Agency and the com­man­der of the Unit­ed States Cyber Com­mand. Sec­re­tary of State Mike Pom­peo, who was the first high-rank­ing admin­is­tra­tion offi­cial to acknowl­edge that Rus­sia was the most like­ly source of the attack before he was under­cut by Mr. Trump, did not attend. His deputy, Stephen E. Biegun, stood in for him.

Gen­er­al Naka­sone, an expe­ri­enced cyber­war­rior who is respon­si­ble for the defense of nation­al secu­ri­ty sys­tems, has been silent since the hack­ing was revealed. At the N.S.A. and Cyber Com­mand, offi­cials said, there was extra­or­di­nary embar­rass­ment that a pri­vate com­pa­ny, Fire­Eye, had been the first to alert the gov­ern­ment that it had been hacked.

Accord­ing to the details released by Mr. Wyden, once the Russ­ian hack­ers used the Solar­Winds soft­ware update to get inside Treasury’s sys­tems, they per­formed a com­plex step inside Microsoft’s Office 365 sys­tem to cre­ate an encrypt­ed “token” that iden­ti­fies a com­put­er to the larg­er net­work.

That coun­ter­feit­ing enabled them to fool the sys­tem into think­ing they were legit­i­mate users — and to sign on with­out try­ing to guess user names and pass­words. Microsoft said last week that it had fixed the flaw that the Rus­sians had exploit­ed, but that did not answer the ques­tion of whether the hack­ers used their access to bore through oth­er chan­nels into the Trea­sury Depart­ment or oth­er sys­tems.

For­mal­ly deter­min­ing who was respon­si­ble for a hack­ing like this one can be time-con­sum­ing work, though the admin­is­tra­tion did so twice in Mr. Trump’s first year in office, point­ing to North Korea for the so-called Wan­naCry attack on the British health care sys­tem and Rus­sia for the “Not­Petya” attack that cost Maer­sk, Fed­er­al Express and oth­er major cor­po­ra­tions hun­dreds of mil­lions of dol­lars.

In this case, offi­cials say, a for­mal dec­la­ra­tion of who was respon­si­ble for the attack — which is need­ed to start any form of retal­i­a­tion — may not come until after Mr. Biden is inau­gu­rat­ed. That would leave the Trump admin­is­tra­tion to focus on dam­age con­trol but skip the hard ques­tions of how to deter Moscow from future attacks.

Capt. Kat­ri­na J. Cheesman, a spokes­woman for Cyber Com­mand, said that so far the mil­i­tary had found “no evi­dence of com­pro­mis­es” in the Pentagon’s net­work. She said that parts of the Defense Department’s “soft­ware sup­ply chain source have dis­closed a vul­ner­a­bil­i­ty with­in their sys­tems, but we have no indi­ca­tion the D.O.D. net­work has been com­pro­mised.”

———–

“Trea­sury Department’s Senior Lead­ers Were Tar­get­ed by Hack­ing” by David E. Sanger and Alan Rappe­port; The New York Times; 12/21/2020

“The Trea­sury Depart­ment ranks among the most high­ly pro­tect­ed cor­ners of the gov­ern­ment because of its respon­si­bil­i­ty for mar­ket-mov­ing eco­nom­ic deci­sions, com­mu­ni­ca­tions with the Fed­er­al Reserve and eco­nom­ic sanc­tions against adver­saries. Mr. Wyden said the hack­ers had gained access to the email sys­tem by manip­u­lat­ing inter­nal soft­ware keys.”

It’s the sec­ond ear­ly indi­ca­tion that the Solar­Winds hack­ers have some advanced Microsoft email exploits: Less than two weeks after the ini­tial Fire­Eye dis­clo­sure, the Trea­sury Depart­ment informs us that it was the manip­u­la­tion of inter­nal soft­ware keys that enabled access to the agen­cy’s emails after the hack­ers entered the gov­ern­ment net­works via the Solar­Winds back­door. Spe­cial­ly Microsoft Office 365 iden­ti­ty tokens:

...
Accord­ing to the details released by Mr. Wyden, once the Russ­ian hack­ers used the Solar­Winds soft­ware update to get inside Treasury’s sys­tems, they per­formed a com­plex step inside Microsoft’s Office 365 sys­tem to cre­ate an encrypt­ed “token” that iden­ti­fies a com­put­er to the larg­er net­work.

That coun­ter­feit­ing enabled them to fool the sys­tem into think­ing they were legit­i­mate users — and to sign on with­out try­ing to guess user names and pass­words. Microsoft said last week that it had fixed the flaw that the Rus­sians had exploit­ed, but that did not answer the ques­tion of whether the hack­ers used their access to bore through oth­er chan­nels into the Trea­sury Depart­ment or oth­er sys­tems.
...

So claims about Microsoft­’s Office 365 email vul­ner­a­bil­i­ties being exploit­ed as part of the Solar­Winds hack were com­ing from not just the Solar­Winds com­pa­ny itself but also the US Trea­sury Depart­ment. Claims Microsoft con­tin­ued to vocif­er­ous­ly dis­pute for months.

And just note again how soon and defin­i­tive the attri­bu­tions to Rus­sia were com­ing from the Trump admin­is­tra­tion: they could­n’t explain how the hack­ers evad­ed detec­tion for months, but every­one was ready to join Mike Pom­peo in declar­ing that Moscow was almost cer­tain­ly behind it. No rea­sons are giv­en. None are nec­es­sary. It’s just a giv­en: if there’s a major hack that hits West­ern 0government agen­cies, it’s either Rus­sia or Chi­na. Because of course it is. Who else could it be? It’s the unques­tioned oper­at­ing par­a­digm for con­tem­po­rary cyber­at­tri­bu­tion:

...
Mr. Mnuchin said that the hack­ing was relat­ed to third-par­ty soft­ware. He added that there had been no dam­age or large amounts of infor­ma­tion dis­placed as a result of the attack and that the agency had robust resources to pro­tect the finan­cial indus­try.

“I can assure you, we are com­plete­ly on top of this,” he said. He did not explain how the Russ­ian pres­ence was not detect­ed in the sys­tem for more than four months.

His state­ment came on the same day that Attor­ney Gen­er­al William P. Barr, at his final news con­fer­ence before step­ping down, sided with Sec­re­tary of State Mike Pom­peo in say­ing that Moscow was almost cer­tain­ly behind the hack­ing. The intru­sion went through a com­mer­cial net­work man­age­ment soft­ware pack­age made by Solar­Winds, a com­pa­ny based in Austin, Texas, and allowed the hack­ers broad access to gov­ern­ment and cor­po­rate sys­tems.

“I agree with Sec­re­tary Pompeo’s assess­ment: It cer­tain­ly appears to be the Rus­sians,” Mr. Barr said, fur­ther under­cut­ting Pres­i­dent Trump’s effort to cast doubt on whether the gov­ern­ment of Pres­i­dent Vladimir V. Putin of Rus­sia was behind the attack. Mr. Trump appears to be alone in the admin­is­tra­tion in his con­tention that Chi­na might have been the source of the hack­ing.

...

The ses­sion was clas­si­fied, but if it was like the brief­in­gs to Con­gress in recent days, the intel­li­gence offi­cials expressed lit­tle doubt that the attack was most like­ly car­ried out by hack­ers asso­ci­at­ed with the S.V.R., Russia’s pre­mier intel­li­gence agency.

...

John Rat­cliffe, the direc­tor of nation­al intel­li­gence, par­tic­i­pat­ed in the meet­ing; so did Gina Haspel, the C.I.A. direc­tor, and Gen. Paul M. Naka­sone, the direc­tor of the Nation­al Secu­ri­ty Agency and the com­man­der of the Unit­ed States Cyber Com­mand. Sec­re­tary of State Mike Pom­peo, who was the first high-rank­ing admin­is­tra­tion offi­cial to acknowl­edge that Rus­sia was the most like­ly source of the attack before he was under­cut by Mr. Trump, did not attend. His deputy, Stephen E. Biegun, stood in for him.
...

Keep in mind how dis­turb­ing these warn­ings about Microsoft vul­ner­a­bil­i­ties were at the time. We already knew by that point that some­one plant­ed back­doors on 18,000 of the com­pa­nies and orga­ni­za­tions around the world, includ­ing numer­ous gov­ern­ment agen­cies. But we did­n’t nec­es­sar­i­ly know what the hack­ers could do on all those net­works after they walked through the back­doors. Learn­ing about these Microsoft exploits told us at least some of what they could do on those net­works. And giv­en how ubiq­ui­tous Microsoft­’s soft­ware is in large orga­ni­za­tions, it’s a safe assump­tion that a large num­ber of those Solar­Winds clients were run­ning Microsoft ser­vices on those net­works.

SolarWinds Update: ‘It Started with a Zero-Day Microsoft Exploit.’ Microsoft Counter-Update: ‘No it Didn’t.’ CISA Update: ‘It’s Not Just SolarWinds.’

It was ear­ly Feb­ru­ary, less than two months after the ini­tial Fire­Eye dis­clo­sure, when we got a con­fir­ma­tion of sorts. The ques­tion of whether or not the Microsoft Office 365 email vul­ner­a­bil­i­ty char­ac­ter­ized as an “attack vec­tor” by Solar­Winds in Decem­ber was actu­al­ly used to exe­cute the ini­tial hack of Solar­Winds. Solar­Winds CEO Sud­hakar Ramakr­ish­na appeared to con­firm that, yes, a Microsoft vul­ner­a­bil­i­ty was used in the ini­tial hack of the Solar­Winds Ori­on soft­ware devel­op­er. A zero-day vul­ner­a­bil­i­ty nev­er seen before. Although Solar­Winds did­n’t iden­ti­fy the spe­cif­ic Office 365 vul­ner­a­bil­i­ty.

But we also got anoth­er updat­ed from Bran­don Wales, act­ing direc­tor of the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency: Rough­ly 30 per­cent of the vic­tim orga­ni­za­tions that found the back­door mal­ware on their net­work had no con­nec­tion to Solar­Winds. Oth­er meth­ods for cre­at­ing back­doors were being deployed by these hack­ers. So we learn that the Solar­Winds hack like­ly start­ed with a Microsoft exploit and also that the hack­ers are infect­ing oth­er net­works through means oth­er than the infect­ed Solar­Winds soft­ware. It’s not great news for Microsoft users:

CRN

Solar­Winds CEO Con­firms Office 365 Email ‘Com­pro­mise’ Played Role In Broad-Based Attack

Solar­Winds CEO Sud­hakar Ramakr­ish­na has ver­i­fied sus­pi­cious activ­i­ty in its Office 365 envi­ron­ment, with a com­pa­ny email account com­pro­mised and used to access accounts of tar­get­ed Solar­Winds staff in busi­ness and tech­ni­cal roles.

By Michael Novin­son
Feb­ru­ary 04, 2021, 07:28 AM EST

Solar­Winds CEO Sud­hakar Ramakr­ish­na ver­i­fied Wednes­day “sus­pi­cious activ­i­ty” in its Office 365 envi­ron­ment allowed hack­ers to gain access to and exploit the Solar­Winds Ori­on devel­op­ment envi­ron­ment.

Hack­ers most like­ly entered SolarWinds’s envi­ron­ment through com­pro­mised cre­den­tials and/or a third-par­ty appli­ca­tion that cap­i­tal­ized on a zero-day vul­ner­a­bil­i­ty, Ramakr­ish­na said.

“We’ve con­firmed that a Solar­Winds email account was com­pro­mised and used to pro­gram­mat­i­cal­ly access accounts of tar­get­ed Solar­Winds per­son­nel in busi­ness and tech­ni­cal roles,” he said in the blog post. “By com­pro­mis­ing cre­den­tials of Solar­Winds employ­ees, the threat actors were able to gain access to and exploit our Ori­on devel­op­ment envi­ron­ment.”

The belea­guered Austin, Texas-based IT infra­struc­ture man­age­ment ven­dor said a Solar­Winds email account was com­pro­mised and used to pro­gram­mat­i­cal­ly access accounts of tar­get­ed Solar­Winds per­son­nel in busi­ness and tech­ni­cal roles.

By com­pro­mis­ing the cre­den­tials of Solar­Winds employ­ees, Ramakr­ish­na said the hack­ers were able to gain access to and exploit the devel­op­ment envi­ron­ment for the Solar­Winds Ori­on net­work mon­i­tor­ing plat­form. Solar­Winds was first noti­fied by Microsoft about a com­pro­mise relat­ed to its Office 365 envi­ron­ment on Dec. 13, the same day news of the hack went pub­lic.

SolarWinds’s inves­ti­ga­tion has not iden­ti­fied a spe­cif­ic vul­ner­a­bil­i­ty in Office 365 that would have allowed the hack­ers to enter the company’s envi­ron­ment through Office 365, he said Wednes­day. A day ear­li­er, Ramakr­ish­na told The Wall Street Jour­nal that one of sev­er­al the­o­ries the com­pa­ny was pur­su­ing is that the hack­ers used an Office 365 account com­pro­mise as the ini­tial point of entry into Solar­Winds.

Microsoft declined to com­ment to CRN. Ramakr­ish­na said Solar­Winds has ana­lyzed data from mul­ti­ple sys­tems and logs, includ­ing from our Office 365 and Azure ten­ants, as part of its inves­ti­ga­tion. The Solar­Winds hack is believed to be the work of the Russ­ian for­eign intel­li­gence ser­vice.

“While it’s wide­ly under­stood any one com­pa­ny could not pro­tect itself against a sus­tained and unprece­dent­ed nation-state attack of this kind, we see an oppor­tu­ni­ty to lead an indus­try-wide effort that makes Solar­Winds a mod­el for secure soft­ware envi­ron­ments, devel­op­ment process­es, and prod­ucts,” Ramakr­ish­na wrote in a blog post Wednes­day.

Some 30 per­cent of the pri­vate sec­tor and gov­ern­ment vic­tims of the colos­sal hack­ing cam­paign had no direct con­nec­tion to Solar­Winds, Bran­don Wales, act­ing direc­tor of the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency, told The Wall Street Jour­nal Fri­day. But he said inves­ti­ga­tors haven’t iden­ti­fied anoth­er com­pa­ny whose prod­ucts were broad­ly com­pro­mised to infect oth­er firms the way Solar­Winds was.

SolarWinds’s inves­ti­ga­tions will be ongo­ing for at least sev­er­al more weeks, and pos­si­bly months, due to the sophis­ti­ca­tion of the cam­paign and actions tak­en by the hack­ers to remove evi­dence of their activ­i­ty, he said. Solar­Winds has not deter­mined the exact date hack­ers first gained unau­tho­rized access to the company’s envi­ron­ment, though innocu­ous code changes were first made to Ori­on in Octo­ber 2019.

The hack­ers delet­ed pro­grams fol­low­ing use to avoid foren­sic dis­cov­ery and mas­quer­ad­ed file names and activ­i­ty to mim­ic legit­i­mate appli­ca­tions and files, he said. The hack­ers had auto­mat­ed dor­man­cy peri­ods of two weeks or more pri­or to acti­va­tion and uti­lized servers out­side the mon­i­tor­ing author­i­ty of U.S. intel­li­gence, he said.

...

———–

“Solar­Winds CEO Con­firms Office 365 Email ‘Com­pro­mise’ Played Role In Broad-Based Attack” by Michael Novin­son; CRN; 02/02/2021

“By com­pro­mis­ing the cre­den­tials of Solar­Winds employ­ees, Ramakr­ish­na said the hack­ers were able to gain access to and exploit the devel­op­ment envi­ron­ment for the Solar­Winds Ori­on net­work mon­i­tor­ing plat­form. Solar­Winds was first noti­fied by Microsoft about a com­pro­mise relat­ed to its Office 365 envi­ron­ment on Dec. 13, the same day news of the hack went pub­lic.”

It’s more or less con­firmed: The Solar­Winds hacked start­ed with the exploita­tion of a vul­ner­a­bil­i­ty in Microsoft­’s Office 365 email. The vul­ner­a­bil­i­ty gave the hack­ers access to the Solar­Winds Ori­on soft­ware devel­op­ment envi­ron­ments. That’s where it all start­ed.

Or at least that’s where the Solar­Winds hack all start­ed. As they note, some 30 per­cent of the vic­tims of this hack don’t actu­al­ly have a direct con­nec­tion to Solar­Winds, rais­ing the pos­si­bil­i­ty of that the Solar­Winds hacks is real­ly part of an even larg­er hack being exe­cut­ed by a group of actors with numer­ous pow­er­ful Microsoft exploit. In oth­er words, we might not be look­ing at the Solar­Winds mega-hack but instead a Microsoft mega-hack that just includes a large Solar­Winds com­po­nent:

...
Some 30 per­cent of the pri­vate sec­tor and gov­ern­ment vic­tims of the colos­sal hack­ing cam­paign had no direct con­nec­tion to Solar­Winds, Bran­don Wales, act­ing direc­tor of the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency, told The Wall Street Jour­nal Fri­day. But he said inves­ti­ga­tors haven’t iden­ti­fied anoth­er com­pa­ny whose prod­ucts were broad­ly com­pro­mised to infect oth­er firms the way Solar­Winds was.
...

So if 30 per­cent of the vic­tims weren’t run­ning Solar­Wind­s’s Ori­on soft­ware, what was the attack vec­tor in their cas­es? That’s a mys­tery, but we have a pret­ty obvi­ous clue if the Solar­Winds hack start­ed with a Microsoft exploit. It’s no won­der Microsoft­’s pub­lic rela­tions team was is hyper-dam­age-con­trol mode, deny­ing all reports going back to Decem­ber that it’s prod­ucts played any role at all in the attack. Recall how it was Microsoft­’s own secu­ri­ty team that was telling us back in Decem­ber how the hack­ers were mod­i­fy­ing cre­den­tials to read emails from Microsoft Exchange Online (the cloud Exchange ser­vice). But once it start­ed looked like the Solar­Winds mega-hack was real­ly the Microsoft mega-hack, it was a com­plete denial from Microsoft. The com­pa­ny has noth­ing to do with any of this and any­one say­ing any­thing to the con­trary they are mis­in­ter­pret­ing or mis­read­ing the avail­able data:

CRN

Microsoft: No Evi­dence Solar­Winds Was Hacked Via Office 365

‘The word­ing of the Solar­Winds 8K [reg­u­la­to­ry] fil­ing was unfor­tu­nate­ly ambigu­ous, lead­ing to erro­neous inter­pre­ta­tion and spec­u­la­tion, which is not sup­port­ed by the results of our inves­ti­ga­tion,’ Microsoft said Thurs­day.

By Michael Novin­son
Feb­ru­ary 05, 2021, 06:52 AM EST

Microsoft said its inves­ti­ga­tion hasn’t found any evi­dence that Solar­Winds was attacked through Office 365, mean­ing the hack­ers gained priv­i­leged cre­den­tials in some oth­er way.

The Red­mond, Wash.-based soft­ware giant said a Dec. 14 reg­u­la­to­ry fil­ing by Solar­Winds gave the impres­sion that Solar­Winds was inves­ti­gat­ing an attack vec­tor relat­ed to Microsoft Office 365. In the fil­ing, Solar­Winds said it’s aware of an attack vec­tor used to com­pro­mise the company’s Office 365 emails that may have pro­vid­ed access to oth­er data con­tained in the company’s office pro­duc­tiv­i­ty tools.

“The word­ing of the Solar­Winds 8K fil­ing was unfor­tu­nate­ly ambigu­ous, lead­ing to erro­neous inter­pre­ta­tion and spec­u­la­tion, which is not sup­port­ed by the results of our inves­ti­ga­tion,” the Microsoft Secu­ri­ty Team wrote in a blog post Thurs­day.

SolarWinds’s inves­ti­ga­tion hasn’t iden­ti­fied a spe­cif­ic vul­ner­a­bil­i­ty in Office 365 that would have allowed the hack­ers to enter the company’s envi­ron­ment through Office 365, CEO Sud­hakar Ramakr­ish­na said Wednes­day. A day ear­li­er, he told The Wall Street Jour­nal one of sev­er­al the­o­ries the firm was pur­su­ing is hack­ers used an Office 365 account com­pro­mise as the ini­tial point of entry into Solar­Winds.

Ramakr­ish­na said Wednes­day that Solar­Winds has con­firmed sus­pi­cious activ­i­ty relat­ed to its Office 365 envi­ron­ment, with a com­pa­ny email account com­pro­mised and used to access accounts of tar­get­ed Solar­Winds staff in busi­ness and tech­ni­cal roles. By com­pro­mis­ing the cre­den­tials of Solar­Winds staff, he said the hack­ers were able to gain access to and exploit the Solar­Winds devel­op­ment envi­ron­ment.

Although data host­ed in Microsoft ser­vices such as email was some­times tar­get­ed by the Solar­Winds hack­ers, Microsoft insists the attack­er gained priv­i­leged cre­den­tials in anoth­er way. The Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency (CISA) isn’t aware of cloud soft­ware oth­er than Microsoft’s tar­get­ed in the Solar­Winds attack, Act­ing Direc­tor Bran­don Wales told The Wall Street Jour­nal Jan. 29.

In many of their break-ins, the Solar­Winds hack­ers took advan­tage of known Microsoft con­fig­u­ra­tion issues to trick sys­tems into giv­ing them access to emails and doc­u­ments stored on the cloud, The Wall Street Jour­nal said. Hack­ers can go from one cloud-com­put­ing account to anoth­er by tak­ing advan­tage of lit­tle-known idio­syn­crasies in the way soft­ware authen­ti­cates itself on the Microsoft ser­vice.

...

Reuters report­ed Dec. 17 that Microsoft was com­pro­mised via Solar­Winds, with sus­pect­ed Russ­ian hack­ers then using Microsoft’s own prod­ucts to fur­ther the attacks on oth­er vic­tims. Microsoft told CRN at the time that sources for the Reuters report are “mis­in­formed or mis­in­ter­pret­ing their infor­ma­tion,“ but acknowl­edged the soft­ware giant had ”detect­ed mali­cious Solar­Winds bina­ries” in its envi­ron­ment.

“No, it [the Reuters arti­cle] is not accu­rate,” the Microsoft Secu­ri­ty Team wrote in its blog post Thurs­day. “As we said at the time, and based upon all inves­ti­ga­tions since, we have found no indi­ca­tions that our sys­tems were used to attack oth­ers.”

Microsoft acknowl­edged Dec. 31 that a com­pa­ny account com­pro­mised by the Solar­Winds hack­ers had been used to view source code in a num­ber of source code repos­i­to­ries. The com­pro­mised Microsoft account, how­ev­er, didn’t have per­mis­sions to mod­i­fy any code or engi­neer­ing sys­tems, and an inves­ti­ga­tion con­firmed no changes were made, Microsoft said at the time.

The com­pa­ny also respond­ed Thurs­day to crit­i­cism for not dis­clos­ing attack details as soon as Microsoft knew about them, say­ing that the com­pa­ny is restrict­ed from shar­ing details in cas­es where Microsoft is pro­vid­ing inves­tiga­tive sup­port to oth­er orga­ni­za­tions. In these types of engage­ments, Microsoft said the vic­tim orga­ni­za­tions have con­trol in decid­ing what details to dis­close and when to dis­close them.

Inves­ti­ga­tors can addi­tion­al­ly dis­cov­er ear­ly indi­ca­tors that require fur­ther research before they are action­able, Microsoft said. Tak­ing the time to thor­ough­ly inves­ti­gate inci­dents is nec­es­sary to pro­vide the best pos­si­ble guid­ance to cus­tomers, part­ners, and the broad­er secu­ri­ty com­mu­ni­ty, Microsoft said.

...

———–

“Microsoft: No Evi­dence Solar­Winds Was Hacked Via Office 365” by Michael Novin­son; CRN; 02/05/2021

““The word­ing of the Solar­Winds 8K fil­ing was unfor­tu­nate­ly ambigu­ous, lead­ing to erro­neous inter­pre­ta­tion and spec­u­la­tion, which is not sup­port­ed by the results of our inves­ti­ga­tion,” the Microsoft Secu­ri­ty Team wrote in a blog post Thurs­day.”

The denials can’t get any stronger. A day after Solar­Winds CEO Sud­hakar Ramakr­ish­na seem to more or less pub­lic con­firm that a vul­ner­a­bil­i­ty in Microsoft­’s Office 365 email played a direct role in the ini­tial attack, Microsoft reit­er­ates that all reports of Microsoft vul­ner­a­bil­i­ties play­ing any role in the Solar­Winds hack of unsub­stan­ti­at­ed and false. That’s the line.

And note how the com­pa­ny acknowl­edges its prod­ucts were hacked in many cas­es on the Solar­Winds vic­tims net­work as part of the sec­ond phase of the hack, but Microsoft insists that the gained priv­i­leged cre­den­tials in anoth­er way. Now, in fair­ness, it’s pos­si­ble Microsoft sys­tems could be hacked on client net­works for rea­sons that have noth­ing to do with vul­ner­a­bil­i­ties in Microsoft­’s code and are instead the fault of mis­con­fig­ured soft­ware on the client end. But that’s what Microsoft was insist­ing at that point in ear­ly Feb­ru­ary, a day after Solar­Wind­s’s CEO seemed to con­firm a Microsoft Office 365 email exploit was used to ini­ti­ate the hack and well after the US gov­ern­ment con­firmed the Solar­Winds hack­ers used a Microsoft Office 365 email exploit dur­ing its plun­der­ing of the Trea­sury Depart­men­t’s net­works. The plau­si­ble deni­a­bil­i­ty of Microsoft­’s insis­tence that client con­fig­u­ra­tion issues were the cause of the hacked Microsoft prod­ucts was rapid­ly dwin­dling. Microsoft­’s insis­tence held strong:

...
Although data host­ed in Microsoft ser­vices such as email was some­times tar­get­ed by the Solar­Winds hack­ers, Microsoft insists the attack­er gained priv­i­leged cre­den­tials in anoth­er way. The Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency (CISA) isn’t aware of cloud soft­ware oth­er than Microsoft’s tar­get­ed in the Solar­Winds attack, Act­ing Direc­tor Bran­don Wales told The Wall Street Jour­nal Jan. 29.

In many of their break-ins, the Solar­Winds hack­ers took advan­tage of known Microsoft con­fig­u­ra­tion issues to trick sys­tems into giv­ing them access to emails and doc­u­ments stored on the cloud, The Wall Street Jour­nal said. Hack­ers can go from one cloud-com­put­ing account to anoth­er by tak­ing advan­tage of lit­tle-known idio­syn­crasies in the way soft­ware authen­ti­cates itself on the Microsoft ser­vice.

...

Reuters report­ed Dec. 17 that Microsoft was com­pro­mised via Solar­Winds, with sus­pect­ed Russ­ian hack­ers then using Microsoft’s own prod­ucts to fur­ther the attacks on oth­er vic­tims. Microsoft told CRN at the time that sources for the Reuters report are “mis­in­formed or mis­in­ter­pret­ing their infor­ma­tion,“ but acknowl­edged the soft­ware giant had ”detect­ed mali­cious Solar­Winds bina­ries” in its envi­ron­ment.

“No, it [the Reuters arti­cle] is not accu­rate,” the Microsoft Secu­ri­ty Team wrote in its blog post Thurs­day. “As we said at the time, and based upon all inves­ti­ga­tions since, we have found no indi­ca­tions that our sys­tems were used to attack oth­ers.”

Microsoft acknowl­edged Dec. 31 that a com­pa­ny account com­pro­mised by the Solar­Winds hack­ers had been used to view source code in a num­ber of source code repos­i­to­ries. The com­pro­mised Microsoft account, how­ev­er, didn’t have per­mis­sions to mod­i­fy any code or engi­neer­ing sys­tems, and an inves­ti­ga­tion con­firmed no changes were made, Microsoft said at the time.
...

“As we said at the time, and based upon all inves­ti­ga­tions since, we have found no indi­ca­tions that our sys­tems were used to attack oth­ers.” Have fun inter­pret­ing that one. But as a pub­lic state­ment, it sounds defin­i­tive. There were no Microsoft soft­ware vul­ner­a­bil­i­ties involved at all with the Solar­Winds hack. Peri­od. End of sto­ry.

Another Update from Microsoft: We Were Hacked and Our Source Code Was Viewed. Including for Microsoft Exchange. But Don’t Worry, Nothing was Compromised and Everything is Fine on Our End Now.

Two weeks lat­er, the sto­ry got anoth­er update. From Microsoft: the Solar­Winds hack­ers root­ed around in Microsoft­’s net­works through Jan­u­ary and man­aged to down­load some source code for its Azure, Exchange and Intune cloud-based prod­ucts. Again, keep in mind that Microsoft will be forced to dis­close the Microsoft Exchange mega-hack in a cou­ple of weeks fol­low­ing this update, and in that new mega-hack it was the self-host­ed non-cloud ver­sion of Microsoft Exchange that got hacked. So the hack­ers stole code pret­ty close­ly-relat­ed to the very sys­tem that got mega-hacked. We’re also going to learn that the Microsoft Exchange mega-hack appar­ent­ly start­ed in Jan­u­ary, the same month the Solar­Winds hack­ers were pre­sum­ably (hope­ful­ly) kicked out of Microsoft­’s net­works. And we’ve already seen that the Solar­Winds hack­ers have impres­sive nev­er-before-seen abil­i­ties to trick Microsoft­’s cre­den­tial sys­tems. That’s all part of what makes this lat­est update to the Solar­Winds sto­ry so omi­nous: It sure seems like it’s relat­ed to the Microsoft Exchange mega-hack that Microsoft will dis­close in March, even though Microsoft assures us it’s not and that’s a com­plete­ly sep­a­rate hack by dif­fer­ent Chi­nese hack­ers:

CRN

Solar­Winds Hack­ers Kept Going After Microsoft Until Jan­u­ary

The Solar­Winds hack­ers first viewed a file in a Microsoft source repos­i­to­ry in Novem­ber, and were able to down­load source code for its Azure, Exchange and Intune cloud-based prod­ucts.

By Michael Novin­son
Feb­ru­ary 19, 2021, 06:34 AM EST

The Solar­Winds hack­ers con­tin­ued efforts to infil­trate Microsoft until ear­ly Jan­u­ary, keep­ing up the assault even after Microsoft revealed its source code had been com­pro­mised.

The like­ly Russ­ian hack­ers first viewed a file in a Microsoft source repos­i­to­ry in late Novem­ber, and the Red­mond, Wash.-based soft­ware giant detect­ed unusu­al activ­i­ty in some inter­nal accounts the next month. The hack­ers lost source repos­i­to­ry access after Microsoft secured its com­pro­mised accounts, but the threat actor kept mak­ing unsuc­cess­ful attempts to regain access all the way until ear­ly Jan­u­ary.

“A con­cern­ing aspect of this attack is that secu­ri­ty com­pa­nies were a clear tar­get,” Vasu Jakkal, Microsoft’s cor­po­rate vice pres­i­dent of secu­ri­ty, com­pli­ance and iden­ti­ty, wrote in a blog post Thurs­day. “Microsoft, giv­en the expan­sive use of our pro­duc­tiv­i­ty tools and lead­er­ship in secu­ri­ty, of course was an ear­ly tar­get.”

Microsoft admit­ted the Solar­Winds hack­ers were able to down­load some source code for its Azure, Exchange and Intune cloud-based prod­ucts. The down­loaded Azure source code was for sub­sets of its ser­vice, secu­ri­ty and iden­ti­ty com­po­nents, accord­ing to Microsoft.

The search terms used by the Solar­Winds hack­ers indi­cates they were attempt­ing to find secrets such as API keys, cre­den­tials, and secu­ri­ty tokens that may have been embed­ded in the source code, accord­ing to Microsoft. But the com­pa­ny said it has a devel­op­ment pol­i­cy that pro­hibits stor­ing secrets in source code and runs auto­mat­ed tools to ver­i­fy com­pli­ance.

Microsoft said it sub­se­quent­ly con­firmed that both cur­rent and his­tor­i­cal branch­es of its source code repos­i­to­ries don’t con­tain any live pro­duc­tion cre­den­tials. For near­ly all the Microsoft code repos­i­to­ries accessed by the Solar­Winds hack­ers, only a few indi­vid­ual files were viewed as a result of a repos­i­to­ry search, accord­ing to the com­pa­ny.

...

Microsoft said the Solar­Winds hack­ers weren’t able to access its priv­i­leged cre­den­tials or lever­age Secu­ri­ty Access Markup Lan­guage (SAML) tech­niques against the company’s cor­po­rate domains. But out­side of Microsoft, U.S. inves­ti­ga­tors said one of the prin­ci­pal ways the hack­er has col­lect­ed vic­tim infor­ma­tion is by com­pro­mis­ing the SAML sign­ing cer­tifi­cate using esca­lat­ed Active Direc­to­ry priv­i­leges.

Orga­ni­za­tions that del­e­gate trust to on-premis­es com­po­nents in deploy­ments that con­nect on-premis­es infra­struc­ture and the cloud end up with an addi­tion­al seam they need to secure, the MSRC wrote. As a result, if an on-premis­es envi­ron­ment is com­pro­mised, Microsoft said there’s an oppor­tu­ni­ty for hack­ers to tar­get cloud ser­vices.

“When you rely on on-premis­es ser­vices, like authen­ti­ca­tion serv­er, it is up to a cus­tomer to pro­tect their iden­ti­ty infra­struc­ture,” Jakkal wrote in her blog post. “With a cloud iden­ti­ty, like Azure Active Direc­to­ry, we pro­tect the iden­ti­ty infra­struc­ture from the cloud.”

At the same time, Jakkal said the Solar­Winds hack­ers took advan­tage of aban­doned app accounts with no mul­ti-fac­tor authen­ti­ca­tion to access cloud admin­is­tra­tive set­tings with high priv­i­lege. As orga­ni­za­tions tran­si­tion from implic­it trust to explic­it ver­i­fi­ca­tion, Jakkal said they first must focus on pro­tect­ing iden­ti­ties, espe­cial­ly priv­i­leged user accounts.

“Gaps in pro­tect­ing iden­ti­ties (or user cre­den­tials) like weak pass­words or lack of mul­ti­fac­tor authen­ti­ca­tion are oppor­tu­ni­ties for an actor to find their way into a sys­tem, ele­vate their sta­tus, and move lat­er­al­ly across the envi­ron­ments tar­get­ing email, source code, crit­i­cal data­bas­es and more,” Jakkal said.

The Solar­Winds hack­ers tried and failed to get into Crowd­Strike and read their emails via a Microsoft reseller’s Azure account that was respon­si­ble for man­ag­ing CrowdStrike’s Microsoft Office licens­es. If a cus­tomer buys a cloud ser­vice from a reseller and allows the reseller to retain admin­is­tra­tive access, then a com­pro­mise of reseller cre­den­tials would grant access to the customer’s ten­ant, Microsoft said.

But the abuse of admin­is­tra­tive access wouldn’t be a com­pro­mise of Microsoft’s ser­vices them­selves, the com­pa­ny told CRN on Dec. 24.

———–

“Solar­Winds Hack­ers Kept Going After Microsoft Until Jan­u­ary” by Michael Novin­son; CRN; 02/19/2021

“Microsoft admit­ted the Solar­Winds hack­ers were able to down­load some source code for its Azure, Exchange and Intune cloud-based prod­ucts. The down­loaded Azure source code was for sub­sets of its ser­vice, secu­ri­ty and iden­ti­ty com­po­nents, accord­ing to Microsoft.”

It’s more than a lit­tle omi­nous. In Feb­ru­ary, weeks before the Microsoft Exchange mega-hack was dis­closed, the com­pa­ny gave us an update on its Solar­Winds inves­ti­ga­tion: source code was stolen. Source code involve the cloud-based ver­sions of Azure, Intune, and Exchange. Sure, it sounds like it was only the self-host­ed Exchange servers that got in the mega-hack, not the cloud-based Exchange sys­tems. But when Microsoft admits the Solar­Winds hack­ers obtained source code for Exchange’s cloud-based ser­vice, and then a cou­ple weeks lat­er we’re told the largest hack on record took place when vir­tu­al­ly all of Exchange’s self-host­ed servers got hacked in a zero-day exploit, it’s kind of hard to avoid sus­pi­cions the two events are relat­ed. And yet Microsoft assures us Solar­Winds was the work of ‘Cozy Bear’ and the Exchange hack was from pre­vi­ous­ly unknown state Chi­nese hack­ers. It’s all quite con­ve­nient for Microsoft. The kind of expla­na­tion that avoids a lot of messy ques­tions:

...
The search terms used by the Solar­Winds hack­ers indi­cates they were attempt­ing to find secrets such as API keys, cre­den­tials, and secu­ri­ty tokens that may have been embed­ded in the source code, accord­ing to Microsoft. But the com­pa­ny said it has a devel­op­ment pol­i­cy that pro­hibits stor­ing secrets in source code and runs auto­mat­ed tools to ver­i­fy com­pli­ance.

Microsoft said it sub­se­quent­ly con­firmed that both cur­rent and his­tor­i­cal branch­es of its source code repos­i­to­ries don’t con­tain any live pro­duc­tion cre­den­tials. For near­ly all the Microsoft code repos­i­to­ries accessed by the Solar­Winds hack­ers, only a few indi­vid­ual files were viewed as a result of a repos­i­to­ry search, accord­ing to the com­pa­ny.
...

But, again, keep in mind anoth­er major rea­son Microsoft might want to assure the world that it’s Russ­ian and Chi­nese state actors who car­ried out these mega-hacks: state actors are far more like­ly hack for espi­onage pur­pos­es. And when you hack for espi­onage pur­pos­es you prob­a­bly won’t sell the infor­ma­tion you hacked. Crim­i­nal actors, on the oth­er hand, have very dif­fer­ent moti­va­tions. So for the gen­er­al pub­lic, learn­ing that Rus­sia or Chi­na hacked into your orga­ni­za­tion is far less alarm­ing that learn­ing some crim­i­nal elite hack­er group did it. Although, as we’ll see, the hack­ers we’re told are Chi­nese state hack­ers actu­al­ly run their own per­son­al for-prof­it ran­som schemes.

A New(?) Mega-Hack is Upon Us: The Microsoft Exchange Mega-Hack. Which, Microsoft Promises, is Definitely Totally Unrelated to the SolarWinds Mega-Hack

Do you or your orga­ni­za­tion own a self-host­ed Microsoft Exchange email serv­er that was con­nect­ed to the inter­net between Jan­u­ary and March of this year? Con­grats! It was hacked. Basi­cal­ly all of them got hacked. A glob­al ran­sack­ing that was arguably larg­er than the Solar­Winds hack. And much like the Solar­Winds hack, these hack­ers had the poten­tial to seed vic­tim net­works with back­doors or worse. So it’s anoth­er mega-hack that sets the hack­ers up for even big­ger mega-hacks in the future. Anoth­er Microsoft mega-hack:

Krebs on Secu­ri­ty

At Least 30,000 U.S. Orga­ni­za­tions New­ly Hacked Via Holes in Microsoft’s Email Soft­ware

March 5, 2021

At least 30,000 orga­ni­za­tions across the Unit­ed States — includ­ing a sig­nif­i­cant num­ber of small busi­ness­es, towns, cities and local gov­ern­ments — have over the past few days been hacked by an unusu­al­ly aggres­sive Chi­nese cyber espi­onage unit that’s focused on steal­ing email from vic­tim orga­ni­za­tions, mul­ti­ple sources tell Kreb­sOn­Se­cu­ri­ty. The espi­onage group is exploit­ing four new­ly-dis­cov­ered flaws in Microsoft Exchange Serv­er email soft­ware, and has seed­ed hun­dreds of thou­sands of vic­tim orga­ni­za­tions world­wide with tools that give the attack­ers total, remote con­trol over affect­ed sys­tems.

On March 2, Microsoft released emer­gency secu­ri­ty updates to plug four secu­ri­ty holes in Exchange Serv­er ver­sions 2013 through 2019 that hack­ers were active­ly using to siphon email com­mu­ni­ca­tions from Inter­net-fac­ing sys­tems run­ning Exchange.

Microsoft said the Exchange flaws are being tar­get­ed by a pre­vi­ous­ly uniden­ti­fied Chi­nese hack­ing crew it dubbed “Hafni­um,” and said the group had been con­duct­ing tar­get­ed attacks on email sys­tems used by a range of indus­try sec­tors, includ­ing infec­tious dis­ease researchers, law firms, high­er edu­ca­tion insti­tu­tions, defense con­trac­tors, pol­i­cy think tanks, and NGOs.

In the three days since then, secu­ri­ty experts say the same Chi­nese cyber espi­onage group has dra­mat­i­cal­ly stepped up attacks on any vul­ner­a­ble, unpatched Exchange servers world­wide.

In each inci­dent, the intrud­ers have left behind a “web shell,” an easy-to-use, pass­word-pro­tect­ed hack­ing tool that can be accessed over the Inter­net from any brows­er. The web shell gives the attack­ers admin­is­tra­tive access to the victim’s com­put­er servers.

Speak­ing on con­di­tion of anonymi­ty, two cyber­se­cu­ri­ty experts who’ve briefed U.S. nation­al secu­ri­ty advi­sors on the attack told Kreb­sOn­Se­cu­ri­ty the Chi­nese hack­ing group thought to be respon­si­ble has seized con­trol over “hun­dreds of thou­sands” of Microsoft Exchange Servers world­wide — with each vic­tim sys­tem rep­re­sent­ing approx­i­mate­ly one orga­ni­za­tion that uses Exchange to process email.

Microsoft’s ini­tial advi­so­ry about the Exchange flaws cred­it­ed Reston, Va. based Volex­i­ty for report­ing the vul­ner­a­bil­i­ties. Volex­i­ty Pres­i­dent Steven Adair said the com­pa­ny first saw attack­ers qui­et­ly exploit­ing the Exchange bugs on Jan. 6, 2021, a day when most of the world was glued to tele­vi­sion cov­er­age of the the riot at the U.S. Capi­tol.

But Adair said that over the past few days the hack­ing group has shift­ed into high gear, mov­ing quick­ly to scan the Inter­net for Exchange servers that weren’t yet pro­tect­ed by the secu­ri­ty updates Microsoft released Tues­day.

“We’ve worked on dozens of cas­es so far where web shells were put on the vic­tim sys­tem back on Feb. 28 [before Microsoft announced its patch­es], all the way up to today,” Adair said. “Even if you patched the same day Microsoft pub­lished its patch­es, there’s still a high chance there is a web shell on your serv­er. The truth is, if you’re run­ning Exchange and you haven’t patched this yet, there’s a very high chance that your orga­ni­za­tion is already com­pro­mised.”

Reached for com­ment, Microsoft said it is work­ing close­ly with the U.S. Cyber­se­cu­ri­ty & Infra­struc­ture Secu­ri­ty Agency (CISA), oth­er gov­ern­ment agen­cies, and secu­ri­ty com­pa­nies, to ensure it is pro­vid­ing the best pos­si­ble guid­ance and mit­i­ga­tion for its cus­tomers.

“The best pro­tec­tion is to apply updates as soon as pos­si­ble across all impact­ed sys­tems,” a Microsoft spokesper­son said in a writ­ten state­ment. “We con­tin­ue to help cus­tomers by pro­vid­ing addi­tion­al inves­ti­ga­tion and mit­i­ga­tion guid­ance. Impact­ed cus­tomers should con­tact our sup­port teams for addi­tion­al help and resources.”

Mean­while, CISA has issued an emer­gency direc­tive order­ing all fed­er­al civil­ian depart­ments and agen­cies run­ning vul­ner­a­ble Microsoft Exchange servers to either update the soft­ware or dis­con­nect the prod­ucts from their net­works.

Adair said he’s field­ed dozens of calls today from state and local gov­ern­ment agen­cies that have iden­ti­fied the back­doors in their Exchange servers and are plead­ing for help. The trou­ble is, patch­ing the flaws only blocks the four dif­fer­ent ways the hack­ers are using to get in. But it does noth­ing to undo the dam­age that may already have been done.

White House press sec­re­tary Jen Psa­ki told reporters today the vul­ner­a­bil­i­ties found in Microsoft’s wide­ly used Exchange servers were “sig­nif­i­cant,” and “could have far-reach­ing impacts.”

“We’re con­cerned that there are a large num­ber of vic­tims,” Psa­ki said.

By all accounts, root­ing out these intrud­ers is going to require an unprece­dent­ed and urgent nation­wide clean-up effort. Adair and oth­ers say they’re wor­ried that the longer it takes for vic­tims to remove the back­doors, the more like­ly it is that the intrud­ers will fol­low up by installing addi­tion­al back­doors, and per­haps broad­en­ing the attack to include oth­er por­tions of the victim’s net­work infra­struc­ture.

Secu­ri­ty researchers have pub­lished sev­er­al tools for detect­ing vul­ner­a­ble servers. One of those tools, a script from Microsoft’s Kevin Beau­mont, is avail­able from Github.

Kreb­sOn­Se­cu­ri­ty has seen por­tions of a vic­tim list com­piled by run­ning such a tool, and it is not a pret­ty pic­ture. The back­door web shell is ver­i­fi­ably present on the net­works of thou­sands of U.S. orga­ni­za­tions, includ­ing banks, cred­it unions, non-prof­its, telecom­mu­ni­ca­tions providers, pub­lic util­i­ties and police, fire and res­cue units.

“It’s police depart­ments, hos­pi­tals, tons of city and state gov­ern­ments and cred­it unions,” said one source who’s work­ing close­ly with fed­er­al offi­cials on the mat­ter. “Just about every­one who’s run­ning self-host­ed Out­look Web Access and wasn’t patched as of a few days ago got hit with a zero-day attack.”

Anoth­er gov­ern­ment cyber­se­cu­ri­ty expert who par­tic­i­pat­ed in a recent call with mul­ti­ple stake­hold­ers impact­ed by this hack­ing spree wor­ries the cleanup effort required is going to be Her­culean.

“On the call, many ques­tions were from school dis­tricts or local gov­ern­ments that all need help,” the source said, speak­ing on con­di­tion they were not iden­ti­fied by name. “If these num­bers are in the tens of thou­sands, how does inci­dent response get done? There are just not enough inci­dent response teams out there to do that quick­ly.”

When it released patch­es for the four Exchange Serv­er flaws on Tues­day, Microsoft empha­sized that the vul­ner­a­bil­i­ty did not affect cus­tomers run­ning its Exchange Online ser­vice (Microsoft’s cloud-host­ed email for busi­ness­es). But sources say the vast major­i­ty of the orga­ni­za­tions vic­tim­ized so far are run­ning some form of Inter­net-fac­ing Microsoft Out­look Web Access (OWA) email sys­tems in tan­dem with Exchange servers inter­nal­ly.

“It’s a ques­tion worth ask­ing, what’s Microsoft’s rec­om­men­da­tion going to be?,” the gov­ern­ment cyber­se­cu­ri­ty expert said. “They’ll say ‘Patch, but it’s bet­ter to go to the cloud.’ But how are they secur­ing their non-cloud prod­ucts? Let­ting them with­er on the vine.”

The gov­ern­ment cyber­se­cu­ri­ty expert said this most recent round of attacks is unchar­ac­ter­is­tic of the kinds of nation-state lev­el hack­ing typ­i­cal­ly attrib­uted to Chi­na, which tends to be fair­ly focused on com­pro­mis­ing spe­cif­ic strate­gic tar­gets.

“Its reck­less,” the source said. “It seems out of char­ac­ter for Chi­nese state actors to be this indis­crim­i­nate.”

Microsoft has said the incur­sions by Hafni­um on vul­ner­a­ble Exchange servers are in no way con­nect­ed to the sep­a­rate Solar­Winds-relat­ed attacks, in which a sus­pect­ed Russ­ian intel­li­gence group installed back­doors in net­work man­age­ment soft­ware used by more than 18,000 orga­ni­za­tions.

“We con­tin­ue to see no evi­dence that the actor behind Solar­Winds dis­cov­ered or exploit­ed any vul­ner­a­bil­i­ty in Microsoft prod­ucts and ser­vices,” the com­pa­ny said.

Nev­er­the­less, the events of the past few days may well end up far eclips­ing the dam­age done by the Solar­Winds intrud­ers.

...

————-

“At Least 30,000 U.S. Orga­ni­za­tions New­ly Hacked Via Holes in Microsoft’s Email Soft­ware”; Krebs on Secu­ri­ty; 03/05/2021

“Microsoft said the Exchange flaws are being tar­get­ed by a pre­vi­ous­ly uniden­ti­fied Chi­nese hack­ing crew it dubbed “Hafni­um,” and said the group had been con­duct­ing tar­get­ed attacks on email sys­tems used by a range of indus­try sec­tors, includ­ing infec­tious dis­ease researchers, law firms, high­er edu­ca­tion insti­tu­tions, defense con­trac­tors, pol­i­cy think tanks, and NGOs.”

Some­how Microsoft deter­mined this hack was car­ried out by a pre­vi­ous­ly uniden­ti­fied Chi­nese hack­ing crew. Again, we have no idea how they know this group was Chi­nese or how they know it’s not the same group behind the Solar­Winds hack or all sorts of oth­er hacks. We just know Microsoft was very con­fi­dent­ly declar­ing this mega-hack with extreme par­al­lels to Solar­Winds was­n’t car­ried out by the same crew. Instead, we’re con­fi­dent­ly assured it’s a Chi­nese nation-state-backed hack­ing group that has unchar­ac­ter­is­ti­cal­ly decid­ed to car­ry out what may be the largest hack ever, even larg­er than Solar­Winds. We just have to trust Microsoft:

...
Speak­ing on con­di­tion of anonymi­ty, two cyber­se­cu­ri­ty experts who’ve briefed U.S. nation­al secu­ri­ty advi­sors on the attack told Kreb­sOn­Se­cu­ri­ty the Chi­nese hack­ing group thought to be respon­si­ble has seized con­trol over “hun­dreds of thou­sands” of Microsoft Exchange Servers world­wide — with each vic­tim sys­tem rep­re­sent­ing approx­i­mate­ly one orga­ni­za­tion that uses Exchange to process email.

...

The gov­ern­ment cyber­se­cu­ri­ty expert said this most recent round of attacks is unchar­ac­ter­is­tic of the kinds of nation-state lev­el hack­ing typ­i­cal­ly attrib­uted to Chi­na, which tends to be fair­ly focused on com­pro­mis­ing spe­cif­ic strate­gic tar­gets.

“Its reck­less,” the source said. “It seems out of char­ac­ter for Chi­nese state actors to be this indis­crim­i­nate.”
...

It’s also worth not­ing that Microsoft did­n’t catch this vul­ner­a­bil­i­ty. It was Volex­i­ty, which detect­ed the first major attack coin­cid­ing with the Jan­u­ary 6 far right insur­rec­tion. We are told that the Chi­nese hack­ers qui­et­ly first start­ed the hack dur­ing the insur­rec­tion but tran­si­tioned towards an open smash-and-grab a few days lat­er. So that’s some pret­ty inter­est­ing tim­ing, but Volex­i­ty had an update. They found signs cyber­op­er­a­tions with this zero-day exploit on Jan­u­ary 3, 2021. So the tim­ing with the Capi­tol insur­rec­tion isn’t quite as inter­est­ing as ear­ly report­ing indi­cates.

Also recall how Volex­i­ty was the first com­pa­ny to iden­ti­fy the Solar­Winds mal­ware on their clients’ net­works back in July of 2020. Their warn­ings were ignored but they were the first to find it, at least on record. Volex­i­ty is appar­ent­ly the one com­pa­ny capa­ble of find­ing these cur­rent mega back­door hacks:

...
Microsoft’s ini­tial advi­so­ry about the Exchange flaws cred­it­ed Reston, Va. based Volex­i­ty for report­ing the vul­ner­a­bil­i­ties. Volex­i­ty Pres­i­dent Steven Adair said the com­pa­ny first saw attack­ers qui­et­ly exploit­ing the Exchange bugs on Jan. 6, 2021, a day when most of the world was glued to tele­vi­sion cov­er­age of the the riot at the U.S. Capi­tol.

But Adair said that over the past few days the hack­ing group has shift­ed into high gear, mov­ing quick­ly to scan the Inter­net for Exchange servers that weren’t yet pro­tect­ed by the secu­ri­ty updates Microsoft released Tues­day.
....

And in case the scale of the hack was­n’t clear, note how it appears to be vir­tu­al­ly every sin­gle self-host­ed Out­look Web Access (OWS) serv­er on the plan­et con­nect­ed to the inter­net. Every sin­gle one. It’s a glob­al dig­i­tal night­mare sce­nario:

...

“We’ve worked on dozens of cas­es so far where web shells were put on the vic­tim sys­tem back on Feb. 28 [before Microsoft announced its patch­es], all the way up to today,” Adair said. “Even if you patched the same day Microsoft pub­lished its patch­es, there’s still a high chance there is a web shell on your serv­er. The truth is, if you’re run­ning Exchange and you haven’t patched this yet, there’s a very high chance that your orga­ni­za­tion is already com­pro­mised.”

...

Adair said he’s field­ed dozens of calls today from state and local gov­ern­ment agen­cies that have iden­ti­fied the back­doors in their Exchange servers and are plead­ing for help. The trou­ble is, patch­ing the flaws only blocks the four dif­fer­ent ways the hack­ers are using to get in. But it does noth­ing to undo the dam­age that may already have been done.

...

By all accounts, root­ing out these intrud­ers is going to require an unprece­dent­ed and urgent nation­wide clean-up effort. Adair and oth­ers say they’re wor­ried that the longer it takes for vic­tims to remove the back­doors, the more like­ly it is that the intrud­ers will fol­low up by installing addi­tion­al back­doors, and per­haps broad­en­ing the attack to include oth­er por­tions of the victim’s net­work infra­struc­ture.

...

“It’s police depart­ments, hos­pi­tals, tons of city and state gov­ern­ments and cred­it unions,” said one source who’s work­ing close­ly with fed­er­al offi­cials on the mat­ter. “Just about every­one who’s run­ning self-host­ed Out­look Web Access and wasn’t patched as of a few days ago got hit with a zero-day attack.”
...

And final­ly, it’s hard to avoid mar­veling at the rather stun­ning assur­ances giv­en by Microsoft at this point regard­ing the Solar­Winds hack and the role Microsoft vul­ner­a­bil­i­ties played in that event: Microsoft tells us, “We con­tin­ue to see no evi­dence that the actor behind Solar­Winds dis­cov­ered or exploit­ed any vul­ner­a­bil­i­ty in Microsoft prod­ucts and ser­vices.” This was what Microsoft was telling the pub­lic in March of 2021. As we saw in the pre­vi­ous arti­cle excerpt, which was pub­lished about 6 weeks lat­er, the exploita­tion of Microsoft prod­ucts was the defin­ing fea­ture of the sec­ond phase the Solar­Winds attack. First the Solar­Winds Ori­on soft­ware deployed back­doors on all of the Solar­Winds cus­tomer net­works. Then the hack­ers used those back­doors to roam the net­work, look­ing for valu­able infor­ma­tion to steal. And that meant exploit­ing Microsoft vul­ner­a­bil­i­ties, which they appar­ent­ly did with aban­don. To claim there was no evi­dence that the actor behind Solar­Winds dis­cov­ered or exploit­ed any vul­ner­a­bil­i­ty in Microsoft prod­ucts and ser­vices just a lie. A lie that con­ve­nient­ly helped Microsoft avoid the uncom­fort­able ques­tions about whether or not this Microsoft Exchange mega-back­door and the Solar­Winds mega-back­door hack were part of some sort joint mega-back­door hack run by the same group of peo­ple:

...
Microsoft has said the incur­sions by Hafni­um on vul­ner­a­ble Exchange servers are in no way con­nect­ed to the sep­a­rate Solar­Winds-relat­ed attacks, in which a sus­pect­ed Russ­ian intel­li­gence group installed back­doors in net­work man­age­ment soft­ware used by more than 18,000 orga­ni­za­tions.

“We con­tin­ue to see no evi­dence that the actor behind Solar­Winds dis­cov­ered or exploit­ed any vul­ner­a­bil­i­ty in Microsoft prod­ucts and ser­vices,” the com­pa­ny said.

Nev­er­the­less, the events of the past few days may well end up far eclips­ing the dam­age done by the Solar­Winds intrud­ers.
...

And while Microsoft was aggre­sive­ly dis­tanc­ing itself and this hack from the Solar­Winds hack ear­ly on, with­in a week it was start­ing to look like Solar­Winds was the com­pa­ny that should be doing the dis­tanc­ing. Because this hack was look­ing much more than Solar­Winds. Like an automat­able Solar­Winds that was plun­dered to the full extent avail­able by a vari­ety of crim­i­nal actors. It was ‘Hafni­um’ who qui­et­ly and exclu­sive­ly used this zero-day exploit start­ing from Jan­u­ary 3 until the Microsoft announced the patch on March 2, at which point a crim­i­nal free-for-all that involved at least a half dozen oth­er hack­ing groups ensued to ran­sack any unpatched servers.

But per­haps the most scan­dalous aspect of all this is that zero-day exploit that enabled all this has appar­ent­ly been sit­ting in Microsoft­’s code for at least a decade. How much do you want to bet Jan 3 was­n’t the first time this exploit was exploit­ed?:

Data Cen­ter Knowl­edge

Microsoft Exchange Hack Could Be Worse Than Solar­Winds

The mas­sive hack’s scope keeps grow­ing. Unlike the Solar­Winds exploit, this one can be auto­mat­ed.

Maria Korolov | Mar 10, 2021

The scope of dam­age from the new­ly pub­lic Microsoft Exchange vul­ner­a­bil­i­ty keeps grow­ing, with some experts say­ing that it is “worse than Solar­Winds.”

As of last count, more than 60,000 orga­ni­za­tions have fall­en vic­tim to the attack.

“The scale of the attack is the biggest threat at this time,” said Mark Good­win, man­ag­ing senior ana­lyst at secu­ri­ty con­sult­ing firm Bish­op Fox.

Gov­ern­ment insti­tu­tions have been attacked, large cor­po­ra­tions, and small local busi­ness­es, he told DCK. Accord­ing to the inter­net scan­ning tool Shodan, more than 250,000 servers are vul­ner­a­ble, he added.

Unlike the Solar­Winds breach, the Microsoft Exchange vul­ner­a­bil­i­ty can be exploit­ed in an auto­mat­ed way. If a data cen­ter has an Exchange serv­er acces­si­ble via the pub­lic inter­net, assume it’s been com­pro­mised, he said.

The prob­lem is so severe that Microsoft has released patch­es even for old­er servers that are no longer sup­port­ed, Good­win said.

And, unlike the Solar­Winds breach, which was pri­mar­i­ly exploit­ed by a sin­gle state-spon­sored group, report­ed­ly from Rus­sia, the Microsoft Exchange vul­ner­a­bil­i­ty is open to every­body. Orig­i­nal­ly asso­ci­at­ed with a Chi­nese state-spon­sored group, Hafni­um, at last count half a dozen dif­fer­ent groups are active­ly attack­ing orga­ni­za­tions with vul­ner­a­ble servers.

The Microsoft Exchange vul­ner­a­bil­i­ty gives hack­ers full access to Microsoft Exchange servers which in turn can be lever­aged to com­pro­mise Active Direc­to­ry servers.

“Once you com­pro­mise Active Direc­to­ry, you can go after any­thing you want,” said Srikant Vis­sam­set­ti, senior VP of engi­neer­ing at Atti­vo Net­works, a cyber­se­cu­ri­ty ven­dor. “You get the keys to the king­dom.”

The big prob­lem is that Microsoft Exchange is designed to be accessed by exter­nal users, which means servers can be acces­si­ble via the inter­net – and attack­ers can find them when they scan for vul­ner­a­bil­i­ties.

“There are ways to scan every­thing con­nect­ed to the inter­net to find vul­ner­a­ble sys­tems,” said Jethro Beek­man, tech­ni­cal direc­tor at cyber­se­cu­ri­ty firm For­t­anix. “This has an enor­mous threat of mis­use.”

As a result, the Depart­ment of Home­land Secu­ri­ty last week issued an emer­gency direc­tive for fed­er­al agen­cies, warn­ing that the Microsoft Exchange vul­ner­a­bil­i­ty is being active­ly exploit­ed and order­ing them to take defen­sive action.

“This is a crazy huge hack,” said Chris Krebs, the for­mer direc­tor of the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency, in a Tweet on Fri­day. “The num­bers I’ve heard dwarf what’s report­ed.”

Also on Fri­day, secu­ri­ty firm Huntress released a report of its analy­sis of 3,000 servers, most of which had antivirus or end­point secu­ri­ty solu­tions installed. Of those, 800 were still not patched, and there were more than 350 mali­cious web­shells already installed by attack­ers.

“This has seem­ing­ly slipped past a major­i­ty of pre­ven­ta­tive secu­ri­ty prod­ucts,” said Huntress senior secu­ri­ty researcher John Ham­mond in a report.

The num­ber of affect­ed enter­pris­es is so much high­er with this attack than with Solar­Winds because this attack can be high­ly auto­mat­ed, Attivo’s Vis­sam­set­ti told DCK.

“With some­thing like this, attack­ers can mobi­lize with­in a day,” he said. “They can script the whole thing in just a few hours.”

Cleanup Will Be Messy

Patch­ing the Microsoft Exchange serv­er is not enough if an orga­ni­za­tion has been com­pro­mised.

Enter­pris­es can look for indi­ca­tors of com­pro­mise in log files, but smart attack­ers may erase those traces as well.

Then, attack­ers may have installed back doors or cre­at­ed accounts for them­selves with high lev­els of access, or even con­duct­ed a “gold­en tick­et” attack on Active Direc­to­ry.

“Once you have a gold­en tick­et attack, you pret­ty much have to start over,” said Vis­sam­set­ti. “Chang­ing pass­words is not suf­fi­cient. They’ve got a super admin.”

And the pos­si­bil­i­ties for dam­age are near­ly end­less, he added.

“It will be messy to clean up,” said Oliv­er Tavakoli, CTO at Vec­tra Net­works. “It will effec­tive­ly require back­ing up data, re-imag­ing the Exchange serv­er, scrub­bing the back­up of any accounts which should not be present, reset­ting all pass­words and secrets, and restor­ing the remain­ing back­up data.”

This is while secu­ri­ty teams are already stretched thin by the Solar­Winds attack, he added.

“This hack will com­pete for the same inves­tiga­tive and reme­di­a­tion resources,” he told DCK. “So, hav­ing two such broad attacks occur near the same time places exor­bi­tant strain on the resources.”

And even if the Exchange servers are patched, back doors shut down, and attack­ers ful­ly cleaned out, that’s not the end of it, said Adrien Gen­dre, chief prod­uct and ser­vices offi­cer at Vade Secure.

“Based on our knowl­edge of pri­or inci­dents,” he said, “expect to see a rise in spear phish­ing attacks in the com­ing weeks.”

The attack­ers will be able to use the infor­ma­tion they’ve col­lect­ed while in the sys­tem, such as emails and oth­er doc­u­ments, to craft extreme­ly tar­get­ed and cred­i­ble scam emails, he said.

Time to Ditch Microsoft Exchange

Experts rec­om­mend that com­pa­nies replace on-prem deploy­ments of Microsoft Exchange with cloud-based alter­na­tives like Office 365, which are not vul­ner­a­ble to the attack.

And if there is an attack, the SaaS ven­dor sim­ply installs the patch them­selves. There’s no need for every sin­gle cus­tomer to install their own patch­es, dra­mat­i­cal­ly sim­pli­fy­ing secu­ri­ty.

If that’s not an option, the Exchange servers can be put behind VPNs, For­t­anix’s Beek­man told DCK.

“And there are web appli­ca­tion fire­walls that you can insert between the serv­er and the inter­net,” he added.

Data cen­ter providers that offer man­aged servers to clients are par­tic­u­lar­ly vul­ner­a­ble, because if they them­selves use a vul­ner­a­ble Microsoft Exchange serv­er and their envi­ron­ment is com­pro­mised, client infra­struc­ture could poten­tial­ly be at risk, he added.

This is where secu­ri­ty approach­es like zero trust and micro seg­men­ta­tion can be used to restrict lat­er­al move­ment, he said.

...

The Time­line of the Microsoft Exchange Hack

Secu­ri­ty experts began notic­ing signs of com­pro­mise in ear­ly Jan­u­ary, with the first attacks on Jan­u­ary 3, accord­ing to secu­ri­ty firm Volex­i­ty.

At first, these attacks, which exploit­ed a zero-day vul­ner­a­bil­i­ty, were lim­it­ed to Hafni­um.

Then, after Microsoft final­ly released patch­es on March 2, oth­er crim­i­nal groups start­ed using it in a race to attack as many servers as pos­si­ble before they were patched.

But the vul­ner­a­bil­i­ty has been present in the Microsoft Exchange code­base for a decade, said Ed Hunter, CISO at Infoblox, a cyber­se­cu­ri­ty com­pa­ny.

“One has to won­der how long this vul­ner­a­bil­i­ty has been a close­ly held – and used – tool in this threat actor’s tool­box,” he told DCK.

...

———–

“Microsoft Exchange Hack Could Be Worse Than Solar­Winds” by Maria Korolov; Data Cen­ter Knowl­edge; 03/10/2021

“Unlike the Solar­Winds breach, the Microsoft Exchange vul­ner­a­bil­i­ty can be exploit­ed in an auto­mat­ed way. If a data cen­ter has an Exchange serv­er acces­si­ble via the pub­lic inter­net, assume it’s been com­pro­mised, he said.”

Not only is this hack the kind of hack that any com­mon hack­er crim­i­nal is capa­ble of exe­cut­ing once they know the exploit, but it’s the kind of hack that a sin­gle hack­er could the­o­ret­i­cal­ly turn into a mega-hack with a sim­ple script because this is an automat­able hack. That’s why you should assume you got hit if you were exposed. Every­one exposed got hit because it was easy for any­one to hit every­one.

But every­one was­n’t hit at first. It was “Hafni­um” who qui­et­ly start­ed hack­ing tar­gets, with Volex­i­ty first detect­ing the usage of the zero-day exploit on Jan­u­ary 3 (not Jan 6 as ear­li­er indi­cat­ed). It was after Microsoft released the patch­es on March 2 that oth­er crim­i­nal groups went on a glob­al spree, hit­ting every remain­ing unpatched Exchange serv­er on the plan­et con­nect­ed to the inter­net. As we’re going to see, when the US and its West­ern allies all issue coor­di­nat­ed for­mal state­ments in mid-July, for­mal­ly accus­ing Chi­na of exe­cut­ing the hack, we are told by unnamed sources famil­iar with the inves­ti­ga­tion that it is sus­pect­ed that Hafni­um knew Microsoft was going to close the zero-day vul­ner­a­bil­i­ties (which were no-longer zero-days at that point) and at that point hand­ed the exploits over to crim­i­nals. But we have no idea why that par­tic­u­lar sce­nario was sus­pect­ed, as opposed to Hafni­um being a crim­i­nal actor who sold their exploit to oth­er actors once the patch was released. Or anoth­er actor pre­tend­ing to be a Chi­nese state actor, although it’s unclear what if any ‘Chi­nese’ indi­ca­tors are being left by “Hafni­um”. Microsoft told us it was a nev­er-before Chi­nese state-backed group called Hafni­um and that dec­la­ra­tion alone is treat­ed as ade­quate evi­dence. As with the Solar­Winds hack, it’s faith-based pub­lic attri­bu­tions, which is a big part of the rea­son the read­ing-the-tea-leaves behind-the-scenes meth­ods of attri­bu­tion are so prob­lem­at­ic. That’s what we’re sup­posed to have faith in. Tea-leave-read­ing with huge con­flicts of inter­est:

...
And, unlike the Solar­Winds breach, which was pri­mar­i­ly exploit­ed by a sin­gle state-spon­sored group, report­ed­ly from Rus­sia, the Microsoft Exchange vul­ner­a­bil­i­ty is open to every­body. Orig­i­nal­ly asso­ci­at­ed with a Chi­nese state-spon­sored group, Hafni­um, at last count half a dozen dif­fer­ent groups are active­ly attack­ing orga­ni­za­tions with vul­ner­a­ble servers.

...

Secu­ri­ty experts began notic­ing signs of com­pro­mise in ear­ly Jan­u­ary, with the first attacks on Jan­u­ary 3, accord­ing to secu­ri­ty firm Volex­i­ty.

At first, these attacks, which exploit­ed a zero-day vul­ner­a­bil­i­ty, were lim­it­ed to Hafni­um.

Then, after Microsoft final­ly released patch­es on March 2, oth­er crim­i­nal groups start­ed using it in a race to attack as many servers as pos­si­ble before they were patched.
...

Also observ­er how Chris Krebs, the for­mer direc­tor of the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency, was try­ing to make sense of the incred­i­bly aggres­sive nature of this hack by ques­tion­ing on Twit­ter if this was the work of an out of con­trol cyber­crime gang or con­trac­tors gone wild. Krebs is gen­er­al­ly con­sid­ered a pret­ty cred­i­ble word on these mat­ters. So he was not ready to jump on board the Chi­na-did-it band­wag­on at this point when we were being assured by Microsoft and oth­ers that yes, Chi­na did it. Just take their word for it. Krebs was­n’t tak­ing their word:

...
“This is a crazy huge hack,” said Chris Krebs, the for­mer direc­tor of the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency, in a Tweet on Fri­day. “The num­bers I’ve heard dwarf what’s report­ed.”

...

But it isn’t just the automat­able nature of this hack­ing tech­nique that makes it so scary. It’s also the fact that the hack­ers could lever­age the com­plete con­trol over the Exchange serv­er to com­pro­mise the Active Direc­to­ry servers and that poten­tial­ly gives you the oppor­tu­ni­ty to con­duct a “gold­en tick­et” attack on the Active Direc­to­ry and the hack­ers can give them­selves super-user priv­i­leges. That’s the high­est lev­el. This is a poten­tial­ly dev­as­tat­ing hack. Com­plete con­trol is an apt descrip­tion of what it can con­fer. Thanks in part to a lot of Microsoft exploits:

...
The Microsoft Exchange vul­ner­a­bil­i­ty gives hack­ers full access to Microsoft Exchange servers which in turn can be lever­aged to com­pro­mise Active Direc­to­ry servers.

“Once you com­pro­mise Active Direc­to­ry, you can go after any­thing you want,” said Srikant Vis­sam­set­ti, senior VP of engi­neer­ing at Atti­vo Net­works, a cyber­se­cu­ri­ty ven­dor. “You get the keys to the king­dom.”

...

Patch­ing the Microsoft Exchange serv­er is not enough if an orga­ni­za­tion has been com­pro­mised.

Enter­pris­es can look for indi­ca­tors of com­pro­mise in log files, but smart attack­ers may erase those traces as well.

Then, attack­ers may have installed back doors or cre­at­ed accounts for them­selves with high lev­els of access, or even con­duct­ed a “gold­en tick­et” attack on Active Direc­to­ry.

“Once you have a gold­en tick­et attack, you pret­ty much have to start over,” said Vis­sam­set­ti. “Chang­ing pass­words is not suf­fi­cient. They’ve got a super admin.”

And the pos­si­bil­i­ties for dam­age are near­ly end­less, he added.
...

It’s also worth not­ing anoth­er poten­tial­ly dev­as­tat­ing aspect of this night­mare and the fact that super-user admin priv­i­leges can be obtained by the hack­ers: data cen­ters run­ning Microsoft Exchange servers may have those super-user admin priv­i­leges stolen too. And that poten­tial­ly threat­ens all the data in that data cen­ter:

...
Data cen­ter providers that offer man­aged servers to clients are par­tic­u­lar­ly vul­ner­a­ble, because if they them­selves use a vul­ner­a­ble Microsoft Exchange serv­er and their envi­ron­ment is com­pro­mised, client infra­struc­ture could poten­tial­ly be at risk, he added.

This is where secu­ri­ty approach­es like zero trust and micro seg­men­ta­tion can be used to restrict lat­er­al move­ment, he said.
...

Final­ly, and sig­nif­i­cant­ly, note how long this vul­ner­a­bil­i­ty has exist­ed in Microsoft­’s code: a decade! As one secu­ri­ty expert astute­ly asks, “One has to won­der how long this vul­ner­a­bil­i­ty has been a close­ly held – and used – tool in this threat actor’s tool­box”:

...
But the vul­ner­a­bil­i­ty has been present in the Microsoft Exchange code­base for a decade, said Ed Hunter, CISO at Infoblox, a cyber­se­cu­ri­ty com­pa­ny.

“One has to won­der how long this vul­ner­a­bil­i­ty has been a close­ly held – and used – tool in this threat actor’s tool­box,” he told DCK.
...

For the last 10 years, any­one with access to that code could have poten­tial­ly spot­ted this vul­ner­a­bil­i­ty. Keep this in mind when Microsoft assures us that the theft of its code by the Solar­Winds hack­ers is of no con­se­quence.

SolarWinds Sanctions Arrive. Along With a Lesson in How Attribution Works By CrowdStrike’s Adam Meyers: Surprise! It’s a Hunt for “Cultural Artifacts” ‘Accidentally’ Left Behind

In the span of just four months the world was intro­duced to the two largest hacks on record. Quite a few lessons were hope­ful­ly learned. And if we lis­ten to Adam Mey­ers, the vice pres­i­dent for threat intel­li­gence at the cyber­se­cu­ri­ty firm Crowd­Strike who led the Solar­Winds inves­ti­ga­tion, it was a mas­ter class in hack­ing. That’s what Mey­ers expressed in a high­ly reveal­ing NPR inter­view in April. A mas­ter class in how to obscure one’s tracks.

As we’ll see, Mey­ers gives us fur­ther con­fir­ma­tion of some­thing that has long been clear but is rare said out loud so clear­ly: con­tem­po­rary cyber­at­tri­bu­tion real­ly does rely heav­i­ly on ‘clues’ like Cyril­lic char­ac­ters or Man­darin in the code and such ‘clues’ are fre­quent­ly found. At least that’s how Adam Mey­ers, the vice pres­i­dent for threat intel­li­gence at Crowd­Strike, described his approach to deter­min­ing the iden­ti­ty of the Solar­Winds hack­ers. Mey­ers express­es dis­may at how thor­ough the hack­ers were. Thor­ough in the sense that there was no ‘cul­tur­al arti­fact’ like Cyril­lic or Man­darin. Mey­ers describe the lack of any­thing that a human might have inad­ver­tent­ly left behind as a clue as “mind-blow­ing”. His response to the tiny piece of mal­ware used in the ini­tial Solar­Winds hack — dis­trib­uted to all 18,000 clients via the Ori­on soft­ware — and it’s lack of clues as “the cra­zi­est f***ing thing I’d ever seen.” Take a moment to process that.

So this April update on the Solar­Winds inves­ti­ga­tion includes an update on the gen­er­al state of affairs in cyber­at­tri­bu­tion. A state of affairs where mal­ware that’s cleaned and lacks a ‘cul­tur­al arti­fact’ is “the cra­zi­est f***ing thing I’d ever seen.” And yet, as we saw, there was vir­tu­al­ly no hes­i­tan­cy in attribut­ing the hack to ‘Cozy Bear’/APT29/‘Nobelium’. This is a good time to recall that the sto­ry of the Shad­ow Bro­kers and the CIA’s hack­ing toolk­it that includ­ed fea­tures like leav­ing Cyril­lic or Man­darin char­ac­ters to leave a false lead was con­firmed just four years ago.

Oh, and the US gov­ern­ment was ready to announce sanc­tions against Rus­sia for the hack. So at the same time sanc­tions were announced, we got an inter­view that fur­ther con­firmed the cyber­at­tri­bu­tion indus­try is pred­i­cat­ed on lunatic assump­tions. It real­ly does seem to be the case that every­one real­ly is play­ing dumb here. Dou­ble yikes.:

Nation­al Pub­lic Radio

A ‘Worst Night­mare’ Cyber­at­tack: The Untold Sto­ry Of The Solar­Winds Hack

Dina Tem­ple-Ras­ton
April 16, 2021 10:05 AM ET

“This release includes bug fix­es, increased sta­bil­i­ty and per­for­mance improve­ments.”

The rou­tine soft­ware update may be one of the most famil­iar and least under­stood parts of our dig­i­tal lives. A pop-up win­dow announces its arrival and all that is required of us is to plug every­thing in before bed. The next morn­ing, rather like the shoe­mak­er and the elves, our soft­ware is mag­i­cal­ly trans­formed.

Last spring, a Texas-based com­pa­ny called Solar­Winds made one such soft­ware update avail­able to its cus­tomers. It was sup­posed to pro­vide the reg­u­lar fare — bug fix­es, per­for­mance enhance­ments — to the com­pa­ny’s pop­u­lar net­work man­age­ment sys­tem, a soft­ware pro­gram called Ori­on that keeps a watch­ful eye on all the var­i­ous com­po­nents in a com­pa­ny’s net­work. Cus­tomers sim­ply had to log into the com­pa­ny’s soft­ware devel­op­ment web­site, type a pass­word and then wait for the update to land seam­less­ly onto their servers.

The rou­tine update, it turns out, is no longer so rou­tine.

Hack­ers believed to be direct­ed by the Russ­ian intel­li­gence ser­vice, the SVR, used that rou­tine soft­ware update to slip mali­cious code into Ori­on’s soft­ware and then used it as a vehi­cle for a mas­sive cyber­at­tack against Amer­i­ca.

“Eigh­teen thou­sand [cus­tomers] was our best esti­mate of who may have down­loaded the code between March and June of 2020,” Sud­hakar Ramakr­ish­na, Solar­Winds pres­i­dent and CEO, told NPR. “If you then take 18,000 and start sift­ing through it, the actu­al num­ber of impact­ed cus­tomers is far less. We don’t know the exact num­bers. We are still con­duct­ing the inves­ti­ga­tion.”

On Thurs­day, the Biden admin­is­tra­tion announced a ros­ter of tough sanc­tions against Rus­sia as part of what it char­ac­ter­ized as the “seen and unseen” response to the Solar­Winds breach.

NPR’s months-long exam­i­na­tion of that land­mark attack — based on inter­views with dozens of play­ers from com­pa­ny offi­cials to vic­tims to cyber foren­sics experts who inves­ti­gat­ed, and intel­li­gence offi­cials who are in the process of cal­i­brat­ing the Biden admin­is­tra­tion’s response — reveals a hack unlike any oth­er, launched by a sophis­ti­cat­ed adver­sary who took aim at a soft under­bel­ly of dig­i­tal life: the rou­tine soft­ware update.

By design, the hack appeared to work only under very spe­cif­ic cir­cum­stances. Its vic­tims had to down­load the taint­ed update and then actu­al­ly deploy it. That was the first con­di­tion. The sec­ond was that their com­pro­mised net­works need­ed to be con­nect­ed to the Inter­net, so the hack­ers could com­mu­ni­cate with their servers.

For that rea­son, Ramakr­ish­na fig­ures the Rus­sians suc­cess­ful­ly com­pro­mised about 100 com­pa­nies and about a dozen gov­ern­ment agen­cies. The com­pa­nies includ­ed Microsoft, Intel and Cis­co; the list of fed­er­al agen­cies so far includes the Trea­sury, Jus­tice and Ener­gy depart­ments and the Pen­ta­gon.

The hack­ers also found their way, rather embar­rass­ing­ly, into the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency, or CISA — the office at the Depart­ment of Home­land Secu­ri­ty whose job it is to pro­tect fed­er­al com­put­er net­works from cyber­at­tacks.

The con­cern is that the same access that gives the Rus­sians the abil­i­ty to steal data could also allow them to alter or destroy it. “The speed with which an actor can move from espi­onage to degrad­ing or dis­rupt­ing a net­work is at the blink of an eye,” one senior admin­is­tra­tion said dur­ing a back­ground brief­ing from the White House on Thurs­day. “And a defend­er can­not move at that speed. And giv­en the his­to­ry of Rus­si­a’s mali­cious activ­i­ty in cyber­space and their reck­less behav­ior in cyber­space, that was a key con­cern.”

“The trade­craft was phe­nom­e­nal”

Net­work mon­i­tor­ing soft­ware is a key part of the back­room oper­a­tions we nev­er see. Pro­grams like Ori­on allow infor­ma­tion tech­nol­o­gy depart­ments to look on one screen and check their whole net­work: servers or fire­walls, or that print­er on the fifth floor that keeps going offline. By its very nature, it touch­es every­thing — which is why hack­ing it was genius.

“It’s real­ly your worst night­mare,” Tim Brown, vice pres­i­dent of secu­ri­ty at Solar­Winds, said recent­ly. “You feel a kind of hor­ror. This had the poten­tial to affect thou­sands of cus­tomers; this had the poten­tial to do a great deal of harm.”

When cyber­se­cu­ri­ty experts talk about harm, they’re think­ing about some­thing like what hap­pened in 2017, when the Russ­ian mil­i­tary launched a ran­somware attack known as Not­Petya. It, too, began with taint­ed soft­ware, but in that case the hack­ers were bent on destruc­tion. They plant­ed ran­somware that par­a­lyzed multi­na­tion­al com­pa­nies and per­ma­nent­ly locked peo­ple around the world out of tens of thou­sands of com­put­ers. Even this much lat­er, it is con­sid­ered the most destruc­tive and cost­ly cyber­at­tack in his­to­ry.

Intel­li­gence offi­cials wor­ry that Solar­Winds might presage some­thing on that scale. Cer­tain­ly, the hack­ers had time to do dam­age. They roamed around Amer­i­can com­put­er net­works for nine months, and it is unclear whether they were just read­ing emails and doing the things spies typ­i­cal­ly do, or whether they were plant­i­ng some­thing more destruc­tive for use in the future.

“When there’s cyber-espi­onage con­duct­ed by nations, Fire­Eye is on the tar­get list,” Kevin Man­dia, CEO of the cyber­se­cu­ri­ty firm Fire­Eye, told NPR, but he believes there are oth­er less obvi­ous tar­gets that now might need more pro­tect­ing. “I think util­i­ties might be on that list. I think health care might be on that list. And you don’t nec­es­sar­i­ly want to be on the list of fair game for the most capa­ble offense to tar­get you.”

The Solar­Winds attack­ers ran a mas­ter class in nov­el hack­ing tech­niques. They mod­i­fied sealed soft­ware code, cre­at­ed a sys­tem that used domain names to select tar­gets and mim­ic­ked the Ori­on soft­ware com­mu­ni­ca­tion pro­to­cols so they could hide in plain sight. And then, they did what any good oper­a­tive would do: They cleaned the crime scene so thor­ough­ly inves­ti­ga­tors can’t prove defin­i­tive­ly who was behind it. The White House has said unequiv­o­cal­ly that Russ­ian intel­li­gence was behind the hack. Rus­sia, for its part, has denied any involve­ment.

“The trade­craft was phe­nom­e­nal,” said Adam Mey­ers, who led the cyber foren­sics team that pawed through that taint­ed update on behalf of Solar­Winds, pro­vid­ing details for the first time about what they found. The code was ele­gant and inno­v­a­tive, he said, and then added, “This was the cra­zi­est f***ing thing I’d ever seen.”

Like razor blades in peanut but­ter cups

Mey­ers is the vice pres­i­dent for threat intel­li­gence at the cyber­se­cu­ri­ty firm Crowd­Strike, and he’s seen epic attacks up close. He worked on the 2014 Sony hack, when North Korea cracked into the com­pa­ny’s servers and released emails and first-run movies. A year lat­er, he was on the front lines when a sus­pect­ed Krem­lin-backed hack­ing team known as “Cozy Bear” stole, among oth­er things, a trove of emails from the Demo­c­ra­t­ic Nation­al Com­mit­tee. Wik­iLeaks then released them in the runup to the 2016 elec­tion.

“We’re involved in all kinds of inci­dents around the globe every day,” Mey­ers said. Typ­i­cal­ly he directs teams, he does­n’t run them. But Solar­Winds was dif­fer­ent: “When I start­ed get­ting briefed up, I real­ized [this] was actu­al­ly quite a big deal.”

The attack began with a tiny strip of code. Mey­ers traced it back to Sept. 12, 2019. “This lit­tle snip­pet of code does­n’t do any­thing,” Mey­ers said. “It’s lit­er­al­ly just check­ing to see which proces­sor is run­ning on the com­put­er, if it is a 32- or 64-bit proces­sor and if it is one or the oth­er, it returns either a zero or a one.”

The code frag­ment, it turns out, was a proof of con­cept — a lit­tle tri­al bal­loon to see if it was pos­si­ble to mod­i­fy Solar­Winds’ signed-and-sealed soft­ware code, get it pub­lished and then lat­er see it in a down­loaded ver­sion. And they real­ized they could. “So at this point, they know that they can pull off a sup­ply chain attack,” Mey­ers said. “They know that they have that capa­bil­i­ty.”

After that ini­tial suc­cess, the hack­ers dis­ap­peared for five months. When they returned in Feb­ru­ary 2020, Mey­ers said, they came armed with an amaz­ing new implant that deliv­ered a back­door that went into the soft­ware itself before it was pub­lished.

To under­stand why that was remark­able, you need to know that fin­ished soft­ware code has a kind of dig­i­tal fac­to­ry seal. If you break that seal, some­one can see it and know that the code might have been tam­pered with. Mey­ers said the hack­ers essen­tial­ly found a way to get under that fac­to­ry seal.

They began by implant­i­ng code that told them any time some­one on the Solar­Winds devel­op­ment team was get­ting ready to build new soft­ware. They under­stood that the process of cre­at­ing soft­ware or an update typ­i­cal­ly begins with some­thing rou­tine such as check­ing a code out of a dig­i­tal repos­i­to­ry, sort of like check­ing a book out of the library.

Under nor­mal cir­cum­stances, devel­op­ers take the code out of the repos­i­to­ry, make changes and then check it back in. Once they fin­ish tin­ker­ing, they ini­ti­ate some­thing called the build process, which essen­tial­ly trans­lates the code a human can read to the code a com­put­er does. At that point, the code is clean and test­ed. What the hack­ers did after that was the trick.

They would cre­ate a tem­po­rary update file with the mali­cious code inside while the Solar­Winds code was com­pil­ing. The hack­ers’ mali­cious code told the machine to swap in their tem­po­rary file instead of the Solar­Winds ver­sion. “I think a lot of peo­ple prob­a­bly assume that it is the source code that’s been mod­i­fied,” Mey­ers said, but instead the hack­ers used a kind of bait-and-switch.

But this, Mey­ers said, was inter­est­ing, too. The hack­ers under­stood that com­pa­nies such as Solar­Winds typ­i­cal­ly audit code before they start build­ing an update, just to make sure every­thing is as it should be. So they made sure that the switch to the tem­po­rary file hap­pened at the last pos­si­ble sec­ond, when the updates went from source code (read­able by peo­ple) to exe­cutable code (which the com­put­er reads) to the soft­ware that goes out to cus­tomers.

The tech­nique remind­ed Mey­ers of old fears around trick-or-treat­ing. For decades, there had been an urban myth that kids could­n’t eat any Hal­loween can­dy before check­ing the wrap­per seal because bad peo­ple might have put razor blades inside. What the hack­ers did with the code, Mey­ers said, was a lit­tle like that.

“Imag­ine those Reese’s Peanut But­ter Cups going into the pack­age and just before the machine comes down and seals the pack­age, some oth­er thing comes in and slides a razor blade into your Reese’s Peanut But­ter Cup,” he said. Instead of a razor blade, the hack­ers swapped the files so “the pack­age gets sealed and it goes out the door to the store.”

The update that went out to Solar­Winds’ cus­tomers was the dan­ger­ous peanut but­ter cup — the mali­cious ver­sion of the soft­ware includ­ed code that would give the hack­ers unfet­tered, unde­tect­ed access to any Ori­on user who down­loaded and deployed the update and was con­nect­ed to the Inter­net.

But there was some­thing else about that code that both­ered Mey­ers: It was­n’t just for Solar­Winds. “When we looked at [it], it could have been recon­fig­ured for any num­ber of soft­ware prod­ucts,” Mey­ers said. In oth­er words, any num­ber of oth­er soft­ware devel­op­ers using the same com­pil­er may also be on the receiv­ing end of a cyber­at­tack, he said, and they just don’t know it yet.

Pick­ing and choos­ing tar­gets

Mey­ers said it’s hard not to admire just how much thought the hack­ers put into this oper­a­tion. Con­sid­er the way they iden­ti­fied tar­gets. The down­side of break­ing into so many cus­tomer net­works all at once is that it is hard to decide what to exploit first. So the hack­ers cre­at­ed a pas­sive domain name serv­er sys­tem that sent lit­tle mes­sages with not just an IP address, which is just a series of num­bers, but also with a thumb­nail pro­file of a poten­tial tar­get.

“So they could then say, ‘OK, we’re going to go after this dot gov tar­get or what­ev­er,’ ” Mey­ers said. “I think lat­er it became clear that there were a lot of gov­ern­ment tech­nol­o­gy com­pa­nies being tar­get­ed.”

The hack­ers also reverse-engi­neered the way Ori­on com­mu­ni­cat­ed with servers and built their own cod­ing instruc­tions mim­ic­k­ing Ori­on’s syn­tax and for­mats. What that did is allow the hack­ers to look like they were “speak­ing” Ori­on, so their mes­sage traf­fic looked like a nat­ur­al exten­sion of the soft­ware.

“So once they deter­mined that a tar­get was of inter­est, they could say, ‘OK, let’s go active, let’s manip­u­late files, let’s change some­thing,’ ” Mey­ers said, and then they would slip in unno­ticed through the back­door they had cre­at­ed. “And there is one oth­er thing I should men­tion: This back­door would wait up to two weeks before it actu­al­ly went active on the host. This was a very patient adver­sary.”

None of the trip­wires put in place by pri­vate com­pa­nies or the gov­ern­ment seems to have seen the attack com­ing. Christo­pher Krebs, who had been in charge of the office that pro­tect­ed gov­ern­ment net­works at DHS dur­ing the Trump admin­is­tra­tion, told NPR that DHS’ cur­rent sys­tem, some­thing known (with­out irony) as Ein­stein, only catch­es known threats. The Solar­Winds breach, he said, was just “too nov­el.”

“Upwards of 90[%] to 95% of threats are based on known tech­niques, known cyber­ac­tiv­i­ty,” Krebs explained. “And that’s not just crim­i­nal actors, that’s state actors, too, includ­ing the Russ­ian intel­li­gence agen­cies and the Russ­ian mil­i­tary. This was a pre­vi­ous­ly uniden­ti­fied tech­nique.”

And there is some­thing else that Ein­stein does­n’t do: It does­n’t scan soft­ware updates. So even if the hack­ers had used code that Ein­stein would have rec­og­nized as bad, the sys­tem might not have seen it because it was deliv­ered in one of those rou­tine soft­ware updates.

The Nation­al Secu­ri­ty Agency and the mil­i­tary’s U.S. Cyber Com­mand were also caught flat-foot­ed. Broad­ly speak­ing, their cyber oper­a­tors sit in for­eign net­works look­ing for signs of cyber­at­tacks before they hap­pen. They can see sus­pi­cious activ­i­ty in much the same way a satel­lite might see troops amass­ing on the bor­der. Crit­ics said they should have seen the hack­ers from the Russ­ian intel­li­gence ser­vice, the SVR, prepar­ing this attack.

“The SVR has a pret­ty good under­stand­ing that the NSA is look­ing out,” Krebs said. “What the SVR was able to do was make the tran­si­tion from wher­ev­er they were oper­at­ing from into the U.S. net­works. They move like ghosts. They are very hard to track.”

The hack­ers did­n’t do any­thing fan­cy to give them the domes­tic foot­print, offi­cials con­firmed. In fact, they just rent­ed servers from Ama­zon and GoDad­dy.

Ear­ly warn­ings

There were some indi­ca­tions, else­where, though, that some­thing was wrong.

In ear­ly July, Steven Adair, the founder of a Wash­ing­ton, D.C.-based cyber­se­cu­ri­ty com­pa­ny called Volex­i­ty, saw some sus­pi­cious activ­i­ty on a clien­t’s com­put­ers. “We traced it back, and we thought it might be relat­ed to a bad update with Solar­Winds,” Adair told NPR. “We addressed the prob­lem, made sure no one was in our cus­tomers’ sys­tems, and we left it at that.”

Adair said he did­n’t feel he had enough detail to report the prob­lem to Solar­Winds or the U.S. gov­ern­ment. “We thought we did­n’t have enough evi­dence to reach out,” he said.

That was the first missed sign.

The sec­ond came three months lat­er when a Cal­i­for­nia-based cyber­se­cu­ri­ty com­pa­ny called Palo Alto Net­works dis­cov­ered a mali­cious back­door that seemed to emanate from the Ori­on soft­ware.

In that case, accord­ing to Solar­Winds’ Ramakr­ish­na, the secu­ri­ty teams at Solar­Winds and Palo Alto worked togeth­er for three months to try to pick up the thread of the prob­lem and walk it back. “None of us could pin­point a sup­ply chain attack at that point,” Ramakr­ish­na told NPR. “The tick­et got closed as a result of that. If we had the ben­e­fit of hind­sight, we could have traced it back” to the hack.

Palo Alto Net­works had agreed to speak to NPR about the inci­dent last month and then can­celed the inter­view just an hour before it was sup­posed to take place. A spokesper­son declined to say why and sent a few blog posts and wrote: “I’m afraid this is all we have to help at this time.”

“Just 3,500 lines long”

It was the cyber­se­cu­ri­ty firm Fire­Eye that final­ly dis­cov­ered the intru­sion. Man­dia, the com­pa­ny’s CEO, used to be in the U.S. Air Force Office of Spe­cial Inves­ti­ga­tions, so his spe­cial­ty was crim­i­nal cas­es and coun­ter­in­tel­li­gence. In the inter­ven­ing years, the kinds of pat­terns he learned to rec­og­nize in spe­cial inves­ti­ga­tions kept appear­ing in his cyber secu­ri­ty work.

The first indi­ca­tion that hack­ers had found their way into FireEye’s net­works came in an innocu­ous way. Some­one on the Fire­Eye secu­ri­ty team had noticed that an employ­ee appeared to have two phones reg­is­tered on his net­work, so she called him. “And that phone call is when we real­ized, hey, this isn’t our employ­ee reg­is­ter­ing that sec­ond phone, it was some­body else,” Man­dia said.

Man­dia had a secu­ri­ty brief­ing a short time lat­er and every­thing he heard remind­ed him of his pre­vi­ous work in the mil­i­tary. “There was a lot of pat­tern recog­ni­tion from me,” he told NPR. “I spent from 1996 to 1998 respond­ing to what I would equate to the Russ­ian For­eign Intel­li­gence Ser­vice, and there were some indi­ca­tors in the first brief­ing that were con­sis­tent with my expe­ri­ence in the Air Force.”

He called a board meet­ing the same day. “It just felt like the breach that I was always wor­ried about.”

What his team dis­cov­ered over the course of sev­er­al weeks was that not only was there an intrud­er in its net­work, but some­one had stolen the arse­nal of hack­ing tools Fire­Eye uses to test the secu­ri­ty of its own clients’ net­works. Fire­Eye called the FBI, put togeth­er a detailed report, and once it had deter­mined the Ori­on soft­ware was the source of the prob­lem, it called Solar­Winds.

Brown, vice pres­i­dent of secu­ri­ty at Solar­Winds, took the Sat­ur­day morn­ing phone call. “He said, ‘Essen­tial­ly, we’ve decom­piled your code. We found mali­cious code,’ ” Brown said. Fire­Eye was sure Solar­Winds “had shipped taint­ed code.”

The taint­ed code had allowed hack­ers into FireEye’s net­work, and there were bound to be oth­ers who were com­pro­mised, too. “We were hear­ing that dif­fer­ent reporters had the scoop already,” Man­dia said. “My phone actu­al­ly rang from a reporter and that per­son knew and I went, OK, we’re in a race.”

Man­dia thought they had about a day before the sto­ry would break.

After that, events seemed to speed up. Solar­Winds’ chief secu­ri­ty offi­cer, Brown, called Ron Ple­sco, a lawyer at the firm DLA Piper, and told him what had hap­pened. One of the first things com­pa­nies tend to do after cyber­at­tacks is hire lawyers, and they put them in charge of the inves­ti­ga­tion. They do this for a spe­cif­ic rea­son — it means every­thing they find is pro­tect­ed by attor­ney-client priv­i­lege and typ­i­cal­ly is not dis­cov­er­able in court.

Ple­sco, who has made cyber­crimes a spe­cial­ty of his prac­tice, knew that once the sto­ry broke it would be say­ing “to the world that, ready, set, go, come after it,” Ple­sco said. “So that puts you on an accel­er­at­ed time­line on two fronts: Fig­ure out what hap­pened if you can and get a fix out as soon as pos­si­ble.”

The com­pa­ny worked with DHS to craft a state­ment that went out on Dec. 13.

To inves­ti­gate a hack, you have to secure a dig­i­tal crime scene. Just as detec­tives in the phys­i­cal world have to bag the evi­dence and dust for prints for the inves­ti­ga­tion lat­er, Solar­Winds had to pull togeth­er com­put­er logs, make copies of files, ensure there was a record­ed chain of cus­tody, all while try­ing to ensure the hack­ers weren’t inside its sys­tem watch­ing every­thing they did.

“I’ve been in sit­u­a­tions where, while you’re in there doing the inves­ti­ga­tion, they’re watch­ing your email, they’re com­pro­mis­ing your phone calls or your Zooms,” Ple­sco said. “So they’re lit­er­al­ly lis­ten­ing in on how you’re going to try to get rid of them.”

By mid-Jan­u­ary, Mey­ers and the Crowd­Strike team had iso­lat­ed what they thought was the attack­’s tiny beat­ing heart. It was an ele­gant, encrypt­ed lit­tle blob of code “just 3,500 lines long,” he said. The best code is short and to the point, like a well-writ­ten sen­tence. This lit­tle encrypt­ed strip, Mey­ers thought, might help them fig­ure out who was behind the attack.

Lit­tle blobs of clues

Think of foren­sic cyber teams as dig­i­tal detec­tives look­ing for pat­terns. Cod­ing tics can some­times help iden­ti­fy per­pe­tra­tors or some­times foren­sic teams find small cul­tur­al arti­facts — such as Per­sian script, or Kore­an hangul. When an elite Russ­ian hack­ing team took over the elec­tri­cal grid in Ukraine in 2015, it had more lit­er­ary aspi­ra­tions: It sprin­kled its mali­cious code with ref­er­ences to Frank Her­bert’s Dune nov­els. That’s why Crowd­Strike found that lit­tle blob of mali­cious code so intrigu­ing.

After weeks of work­ing with the code, Mey­ers con­vened a Zoom call with lead­ers at Solar­Winds and mem­bers of his team from around the world. He shared his screen so every­one could all watch the encryp­tion fall away in real time. He began walk­ing the spec­ta­tors through the code as it was revealed, like a play-by-play analy­sis of a game. Mey­ers kept watch­ing for the big reveal. “We’re hop­ing it’s going to have, you know, vari­able names or maybe some com­ments in Cyril­lic or Man­darin to give us some clue who wrote this thing,” he said.

But as Crowd­Strike’s decryp­tion pro­gram chewed its way through the zeroes and ones, Mey­ers’ heart sank. The crime scene was a bust. It had been wiped down. “They’d washed the code,” Mey­ers said. “They’d cleaned it of any human arti­fact or tool mark. And that was kind of mind-blow­ing that [they] had the where­with­al to hide any­thing that a human might have inad­ver­tent­ly left behind as a clue.”

Holy s***, he thought to him­self, who does that?

...

Big­ger attacks

“It’s one of the most effec­tive cyber-espi­onage cam­paigns of all time,” said Alex Sta­mos, direc­tor of the Inter­net Obser­va­to­ry at Stan­ford Uni­ver­si­ty and the for­mer head of secu­ri­ty at Face­book. “In doing so, they demon­strat­ed not just tech­ni­cal acu­men, but the way they did this demon­strat­ed that they under­stand how tech com­pa­nies oper­ate, how soft­ware com­pa­nies oper­ate. ... This cer­tain­ly is going to change the way that large enter­pris­es think about the soft­ware they install and think about how they han­dle updates.”

Intel­li­gence ana­lysts, already years ahead of the rest of us, are paid to imag­ine the dark­est of sce­nar­ios. What if the hack­ers plant­ed the seeds of future attacks dur­ing that nine months they explored Solar­Winds’ cus­tomer net­works — did they hide code for back­doors that will allow them to come and go as they please at a time of their choos­ing? When hack­ers shut down the Ukraine’s pow­er grid in 2015 and dis­abled a Sau­di refin­ery with com­put­er code a year lat­er, they showed it was pos­si­ble to jump from a cor­po­rate net­work to sys­tem con­trols. Will we find out lat­er that the Solar­Winds hack set the stage for some­thing more sin­is­ter?

Even if this was just an espi­onage oper­a­tion, FireEye’s Man­dia said, the attack on Solar­Winds is an inflec­tion point. “We ... kind of mapped out the evo­lu­tion of threats and cyber,” he said. “And we would have land­ed at this day soon­er or lat­er, that at some point in time, soft­ware that many com­pa­nies depend on is going to get tar­get­ed and it’s going to lead to exact­ly what it led to,” Man­dia said. “But to see it hap­pen, that’s where you have a lit­tle bit of shock and sur­prise. OK, it’s here now, nations are tar­get­ing [the] pri­vate sec­tor, there’s no mag­ic wand you can shake. ... It’s a real com­plex issue to solve.”

...

“This was an intel­li­gence col­lec­tion oper­a­tion meant to steal infor­ma­tion, and it’s not the last time that’s going to hap­pen,” Crowd­Strike’s Mey­ers warned. “This is going to hap­pen every day. ... And I think there’s a lot that we all need to do to work togeth­er to stop this from hap­pen­ing.”

———–

“A ‘Worst Night­mare’ Cyber­at­tack: The Untold Sto­ry Of The Solar­Winds Hack” by Dina Tem­ple-Ras­ton; Nation­al Pub­lic Radio; 04/16/2021

“The Solar­Winds attack­ers ran a mas­ter class in nov­el hack­ing tech­niques. They mod­i­fied sealed soft­ware code, cre­at­ed a sys­tem that used domain names to select tar­gets and mim­ic­ked the Ori­on soft­ware com­mu­ni­ca­tion pro­to­cols so they could hide in plain sight. And then, they did what any good oper­a­tive would do: They cleaned the crime scene so thor­ough­ly inves­ti­ga­tors can’t prove defin­i­tive­ly who was behind it. The White House has said unequiv­o­cal­ly that Russ­ian intel­li­gence was behind the hack. Rus­sia, for its part, has denied any involve­ment.”

A hack­er mas­ter class. They were so smooth they wiped the crime scene of any evi­dence that could def­i­nite­ly prove who did it. The US gov­ern­ment nonethe­less has said unequiv­o­cal­ly that Russ­ian intel­li­gence was behind the hack. With­out delay. Fun­ny how that works.

And with that unequiv­o­cal attri­bu­tion came new US sanc­tions against Rus­sia in retal­i­a­tion for a hack that was so mas­sive even the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency got hacked:

...
On Thurs­day, the Biden admin­is­tra­tion announced a ros­ter of tough sanc­tions against Rus­sia as part of what it char­ac­ter­ized as the “seen and unseen” response to the Solar­Winds breach.

...

For that rea­son, Ramakr­ish­na fig­ures the Rus­sians suc­cess­ful­ly com­pro­mised about 100 com­pa­nies and about a dozen gov­ern­ment agen­cies. The com­pa­nies includ­ed Microsoft, Intel and Cis­co; the list of fed­er­al agen­cies so far includes the Trea­sury, Jus­tice and Ener­gy depart­ments and the Pen­ta­gon.

The hack­ers also found their way, rather embar­rass­ing­ly, into the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency, or CISA — the office at the Depart­ment of Home­land Secu­ri­ty whose job it is to pro­tect fed­er­al com­put­er net­works from cyber­at­tacks.
...

And note who led this inves­ti­ga­tion into the Solar­Winds hack: Adam Mey­ers, the vice pres­i­dent for threat intel­li­gence at the cyber­se­cu­ri­ty firm Crowd­Strike. Our under­stand­ing of the Solar­Winds hack is large­ly con­trolled by Crowd­Strike, the firm that pio­neered the con­tem­po­rary “pat­tern recog­ni­tion” cyber­at­tri­bu­tion par­a­digm. It’s one of the many clues that this inves­ti­ga­tion is com­pro­mised:

...
Net­work mon­i­tor­ing soft­ware is a key part of the back­room oper­a­tions we nev­er see. Pro­grams like Ori­on allow infor­ma­tion tech­nol­o­gy depart­ments to look on one screen and check their whole net­work: servers or fire­walls, or that print­er on the fifth floor that keeps going offline. By its very nature, it touch­es every­thing — which is why hack­ing it was genius.

“It’s real­ly your worst night­mare,” Tim Brown, vice pres­i­dent of secu­ri­ty at Solar­Winds, said recent­ly. “You feel a kind of hor­ror. This had the poten­tial to affect thou­sands of cus­tomers; this had the poten­tial to do a great deal of harm.”

...

“The trade­craft was phe­nom­e­nal,” said Adam Mey­ers, who led the cyber foren­sics team that pawed through that taint­ed update on behalf of Solar­Winds, pro­vid­ing details for the first time about what they found. The code was ele­gant and inno­v­a­tive, he said, and then added, “This was the cra­zi­est f***ing thing I’d ever seen.”

Like razor blades in peanut but­ter cups

Mey­ers is the vice pres­i­dent for threat intel­li­gence at the cyber­se­cu­ri­ty firm Crowd­Strike, and he’s seen epic attacks up close. He worked on the 2014 Sony hack, when North Korea cracked into the com­pa­ny’s servers and released emails and first-run movies. A year lat­er, he was on the front lines when a sus­pect­ed Krem­lin-backed hack­ing team known as “Cozy Bear” stole, among oth­er things, a trove of emails from the Demo­c­ra­t­ic Nation­al Com­mit­tee. Wik­iLeaks then released them in the runup to the 2016 elec­tion.

“We’re involved in all kinds of inci­dents around the globe every day,” Mey­ers said. Typ­i­cal­ly he directs teams, he does­n’t run them. But Solar­Winds was dif­fer­ent: “When I start­ed get­ting briefed up, I real­ized [this] was actu­al­ly quite a big deal.”
...

So what kind of evi­dence would have revealed the iden­ti­ties of these hack­ers that Mey­ers and the oth­er peo­ple work­ing on this case were look­ing for but nev­er found? This is the part of the arti­cle where we get con­fir­ma­tion that it’s as stu­pid as we should have sus­pect­ed. Because in the worlds of Mey­ers, a big part of what they found real­ly frus­trat­ing — and shock­ing — about this case was the lack of ‘a big reveal’ that sud­den­ly makes clear who was behind it. What kind of ‘big reveal’? As Mey­ers put it, “We’re hop­ing it’s going to have, you know, vari­able names or maybe some com­ments in Cyril­lic or Man­darin to give us some clue who wrote this thing.” That’s con­sid­ered to be a ‘big reveal’ from the Crowd­Strike fig­ure lead­ing the inves­ti­ga­tion. The most obvi­ous, eas­i­ly plant­ed ‘clues’. That’s what they were keen­ly look­ing out for to con­fi­dent­ly make an attri­bu­tion. But these devi­ous super-hack­ers man­aged to ‘wash the code’ of any human arti­fact, a move described as “mind-blow­ing” by Mey­ers. It’s that stu­pid.

It’s also the kind of anec­dote that does­n’t just raise mas­sive ques­tions about the verac­i­ty of the Solar­Winds inves­ti­ga­tion but basi­cal­ly every oth­er cyber inves­ti­ga­tion tak­ing place these days. Could the entire indus­try be oper­at­ing in this man­ner? Mak­ing con­clu­sion based on a Cyril­lic or Man­darin ‘big reveal’? Even after the Vault7 leak in 2017 demon­strat­ed to the world that the CIA uses hack­ing tools built to leave ‘clues’ like Cyril­lic and Man­darin char­ac­ters. It real­ly is play­ing dumb pro­fes­sion­al­ly.

Don’t for­get that busi­ness­es like Crowd­Strike and Fire­Eye aren’t just paid to remove mal­ware and pro­tect net­works. They’re paid to name cul­prits too, ide­al­ly. Keep that in mind when assess­ing the cred­i­bil­i­ty of this inves­ti­ga­tion. But also keep in mind that it was Crowd­Strike that blazed the trail in the cyber­at­tri­bu­tion indus­try over the last decade of sim­ply nam­ing nation-states like Chi­na or Rus­sia as the cul­prit for hacks with­out evi­dence as a means of address­ing the fact that hacks are the type of crime that crim­i­nals can, in the­o­ry, exe­cute in a fool-proof man­ner with­out leav­ing evi­dence. Con­fi­dent­ly declar­ing a geopo­lit­i­cal adver­sary like Russ­ian, Chi­na, or North Korea were behind a hack based on ‘pat­tern recog­ni­tion’ and ‘edu­cat­ed guess­es’ is as good a ser­vice as the cyber­se­cu­ri­ty indus­try can pro­vide. Cyber­at­tri­bu­tions are a real geopo­lit­i­cal tool/weapon and these com­pa­nies offer those attri­bu­tions as a com­mer­cial ser­vice. So that’s the ser­vice the world is get­ting: Edu­cat­ed guess­es passed off as con­fi­dent attri­bu­tions based on ‘big reveal’ clues like Man­darin or Cyril­lic in the code. Yes, that stu­pid. Pro­fes­sion­al­ly.

Also keep in mind that when Crowd­Strike’s Adam Mey­ers was mar­veled at how these hack­ers left no trace of Cyril­lic or Man­darin, he was mar­veling over that inten­tion­al­ly-com­pact 3,500 line piece of code. Like they’re going to have the ‘big reveal’ in their ultra-com­pact code. It rais­es the ques­tion of how often these cyber­se­cu­ri­ty com­pa­nies like Crowd­Strike or Fire­Eye real­ly do find a ‘big reveal’ like Cyril­lic or Man­darin in the code of mal­ware they’re inves­ti­gat­ing. Because it would­n’t be sur­prised if hack­ers just rou­tine­ly slip that in their at this point. Why not? It’s like a sure fire way to ensure your hack will get blamed on Rus­sia or Chi­na. Maybe Iran if you use Per­sian. The folks at Crowd­Strike will clear­ly be swayed by your ‘big reveal’ clues:

...
It was the cyber­se­cu­ri­ty firm Fire­Eye that final­ly dis­cov­ered the intru­sion. Man­dia, the com­pa­ny’s CEO, used to be in the U.S. Air Force Office of Spe­cial Inves­ti­ga­tions, so his spe­cial­ty was crim­i­nal cas­es and coun­ter­in­tel­li­gence. In the inter­ven­ing years, the kinds of pat­terns he learned to rec­og­nize in spe­cial inves­ti­ga­tions kept appear­ing in his cyber secu­ri­ty work.

The first indi­ca­tion that hack­ers had found their way into FireEye’s net­works came in an innocu­ous way. Some­one on the Fire­Eye secu­ri­ty team had noticed that an employ­ee appeared to have two phones reg­is­tered on his net­work, so she called him. “And that phone call is when we real­ized, hey, this isn’t our employ­ee reg­is­ter­ing that sec­ond phone, it was some­body else,” Man­dia said.

Man­dia had a secu­ri­ty brief­ing a short time lat­er and every­thing he heard remind­ed him of his pre­vi­ous work in the mil­i­tary. “There was a lot of pat­tern recog­ni­tion from me,” he told NPR. “I spent from 1996 to 1998 respond­ing to what I would equate to the Russ­ian For­eign Intel­li­gence Ser­vice, and there were some indi­ca­tors in the first brief­ing that were con­sis­tent with my expe­ri­ence in the Air Force.”

He called a board meet­ing the same day. “It just felt like the breach that I was always wor­ried about.”

...

By mid-Jan­u­ary, Mey­ers and the Crowd­Strike team had iso­lat­ed what they thought was the attack­’s tiny beat­ing heart. It was an ele­gant, encrypt­ed lit­tle blob of code “just 3,500 lines long,” he said. The best code is short and to the point, like a well-writ­ten sen­tence. This lit­tle encrypt­ed strip, Mey­ers thought, might help them fig­ure out who was behind the attack.

Lit­tle blobs of clues

Think of foren­sic cyber teams as dig­i­tal detec­tives look­ing for pat­terns. Cod­ing tics can some­times help iden­ti­fy per­pe­tra­tors or some­times foren­sic teams find small cul­tur­al arti­facts — such as Per­sian script, or Kore­an hangul. When an elite Russ­ian hack­ing team took over the elec­tri­cal grid in Ukraine in 2015, it had more lit­er­ary aspi­ra­tions: It sprin­kled its mali­cious code with ref­er­ences to Frank Her­bert’s Dune nov­els. That’s why Crowd­Strike found that lit­tle blob of mali­cious code so intrigu­ing.

After weeks of work­ing with the code, Mey­ers con­vened a Zoom call with lead­ers at Solar­Winds and mem­bers of his team from around the world. He shared his screen so every­one could all watch the encryp­tion fall away in real time. He began walk­ing the spec­ta­tors through the code as it was revealed, like a play-by-play analy­sis of a game. Mey­ers kept watch­ing for the big reveal. “We’re hop­ing it’s going to have, you know, vari­able names or maybe some com­ments in Cyril­lic or Man­darin to give us some clue who wrote this thing,” he said.

But as Crowd­Strike’s decryp­tion pro­gram chewed its way through the zeroes and ones, Mey­ers’ heart sank. The crime scene was a bust. It had been wiped down. “They’d washed the code,” Mey­ers said. “They’d cleaned it of any human arti­fact or tool mark. And that was kind of mind-blow­ing that [they] had the where­with­al to hide any­thing that a human might have inad­ver­tent­ly left behind as a clue.”

Holy s***, he thought to him­self, who does that?
...

Now, it’s worth point­ing out that there has actu­al­ly been some Russ­ian-lan­guage arti­facts appar­ent­ly left by the Solar­Winds hack­ers. That was in a report pub­lished by cyber­se­cu­ri­ty com­pa­ny Prodaft, which ana­lyzed a com­mand-and-con­trol (C&C) serv­er used in the Solar­Winds hack. On that serv­er they found an orga­ni­za­tion man­age­ment forum used by the teams of hack­ers where var­i­ous hacked tar­gets were dis­cussed for their poten­tial val­ue. Keep in mind they hacked like 18,000 orga­ni­za­tions at once with the hack so who­ev­er pulled this off prob­a­bly real­ly did have to have teams of hack­ers coor­di­nat­ing their efforts some­where. In that report, where they call the group “Sil­ver­Fish” instead of Nobeli­um, they state: “When tak­ing its first look inside the C&C serv­er, the PTI Team observed that main dash­board of the Sil­ver­Fish C&C pan­el fea­tures a sec­tion named ”Active Teams”, involv­ing sev­er­al com­ments entered by dif­fer­ent user groups such as Team 301, Team 302, etc. Such a design indi­cates that this infra­struc­ture is meant for mul­ti­ple teams. Most com­ments entered by attack­ers for each vic­tim are most­ly in Eng­lish and Russ­ian and include urban slang.” So we can actu­al­ly state that the hack­ers did leave behind Eng­lish and Russ­ian in their team orga­ni­za­tion soft­ware. And giv­en how impor­tant these kinds of ‘clues’ are in mak­ing attri­bu­tions it would­n’t be sur­pris­ing if those Russ­ian com­ments on that serv­er are a major part of what the ‘Rus­sia did it’ attri­bu­tion is based on. But it was the kind of evi­dence the hack­ers had to real­ize was left out in the open, at least once the serv­er is seized by author­i­ties, a sce­nario they had to real­ize was very pos­si­ble. It hap­pened, after all. Keep in mind this was the biggest hack ever and these are clear­ly expe­ri­enced hack­ers. They must real­ize com­mand-and-con­trol servers might be found by inves­ti­ga­tors which means com­ments made on that forum are going to be done with the real­iza­tion that arti­facts like the lan­guage used to make the com­ments could be used lat­er for attri­bu­tion pur­pos­es. These kinds of ‘clues’ play a huge role in mod­ern cyber­at­tri­bu­tion, as Mey­ers made abun­dant­ly clear with his dis­may at the lack of a ‘cul­tur­al arti­fact’ to make his attri­bu­tion on. And as the CIA’s hack­ing tool-kit, with its Russ­ian and Chi­nese lan­guage arti­fact-leav­ing fea­tures, exposed by the Shad­ow­Bro­ker leak made abun­dant­ly clear. These lit­tle lan­guage clues are stu­pid­ly tak­en very seri­ous­ly and the cyber­at­tri­bu­tion indus­try does­n’t even hide it. So did the super sophis­ti­cat­ed hack­ing group that pull off the biggest hack ever leave their Russ­ian lan­guage clues con­scious­ly or with­out real­iz­ing it? That’s what we are being asked to believe, although it’s not actu­al­ly clear if the Russ­ian lan­guage com­ments left in this com­mand-and-con­trol forum were the pri­ma­ry basis for the attri­bu­tion of the Solar­Winds hack to Rus­sia (as opposed to Chi­na) because we still have no idea what the attri­bu­tion was ulti­mate­ly based on. It’s faith-based.

But there are tech­ni­cal details about that attack that are more than just spec­u­la­tion: We are told that the attack effec­tive began on Sept 12, 2019, when some­one appeared to exe­cute a proof-of-con­cept tri­al run of the plan that mere­ly inject­ed an innocu­ous snip­pet of code into the Solar­Winds update pack­age. The hack­ers were test­ing whether or not the code could be insert­ed into the next Solar­Winds update and dis­trib­uted to its cus­tomer net­works with­out Solar­Winds detect­ing it and they accom­plished this feat by inject­ing the code at the very last oppor­tu­ni­ty — dur­ing the com­pi­la­tion process — which effec­tive­ly bypassed all of the stan­dard secu­ri­ty mea­sures deployed by Solar­Winds to ensure only the intend­ed code is deliv­ered to its thou­sands of cus­tomers. It was a suc­cess­ful proof-of-con­cept test. The innocu­ous update was deliv­ered to Solar­Wind­s’s clients around the world. Five months lat­er, in Feb­ru­ary of 2020, the hack­ers returned to repeat the trick with mali­cious code that insert­ed a com­pact 3,500 line pay­load that intro­duced a back­door into the Solar­Winds soft­ware itself on the clients’ sys­tems. A back­door that could be remote­ly accessed. That’s how the hack­ers turned the hack of Solar­Winds into the mega-hack of the thou­sands of cor­po­ra­tions and gov­ern­ment agen­cies. The only thing hold­ing back the hack­ers was the abun­dance of oppor­tu­ni­ty and lim­i­ta­tions of time.

So we have a decent under­stand­ing of how this attack worked tech­ni­cal­ly and when it hap­pened but no clue who did it. No ‘big reveal’ clue was left in the code and they some­how man­aged to avoid leav­ing any Cyril­lic or Man­darin else­where on the Solar­Winds net­work dur­ing this long peri­od of time when the hack­ers clear­ly had deep access. But despite all that, they’re pret­ty sure it was Rus­sia. It’s how cyber­at­tri­bu­tion works in the mod­ern age. Gut feel­ings about the cul­prit. Read­ing the dig­i­tal tea leaves and arriv­ing at a gut feel­ing about the cul­prit and then con­fi­dent­ly declar­ing it to the world. Or just mak­ing it up and con­fi­dent­ly declar­ing it to the world. Con­fi­dent dec­la­ra­tions are the impor­tant part. The under­ly­ing facts the dec­la­ra­tions are based not so much:

...
The attack began with a tiny strip of code. Mey­ers traced it back to Sept. 12, 2019. “This lit­tle snip­pet of code does­n’t do any­thing,” Mey­ers said. “It’s lit­er­al­ly just check­ing to see which proces­sor is run­ning on the com­put­er, if it is a 32- or 64-bit proces­sor and if it is one or the oth­er, it returns either a zero or a one.”

The code frag­ment, it turns out, was a proof of con­cept — a lit­tle tri­al bal­loon to see if it was pos­si­ble to mod­i­fy Solar­Winds’ signed-and-sealed soft­ware code, get it pub­lished and then lat­er see it in a down­loaded ver­sion. And they real­ized they could. “So at this point, they know that they can pull off a sup­ply chain attack,” Mey­ers said. “They know that they have that capa­bil­i­ty.”

After that ini­tial suc­cess, the hack­ers dis­ap­peared for five months. When they returned in Feb­ru­ary 2020, Mey­ers said, they came armed with an amaz­ing new implant that deliv­ered a back­door that went into the soft­ware itself before it was pub­lished.

To under­stand why that was remark­able, you need to know that fin­ished soft­ware code has a kind of dig­i­tal fac­to­ry seal. If you break that seal, some­one can see it and know that the code might have been tam­pered with. Mey­ers said the hack­ers essen­tial­ly found a way to get under that fac­to­ry seal.

They began by implant­i­ng code that told them any time some­one on the Solar­Winds devel­op­ment team was get­ting ready to build new soft­ware. They under­stood that the process of cre­at­ing soft­ware or an update typ­i­cal­ly begins with some­thing rou­tine such as check­ing a code out of a dig­i­tal repos­i­to­ry, sort of like check­ing a book out of the library.

Under nor­mal cir­cum­stances, devel­op­ers take the code out of the repos­i­to­ry, make changes and then check it back in. Once they fin­ish tin­ker­ing, they ini­ti­ate some­thing called the build process, which essen­tial­ly trans­lates the code a human can read to the code a com­put­er does. At that point, the code is clean and test­ed. What the hack­ers did after that was the trick.

They would cre­ate a tem­po­rary update file with the mali­cious code inside while the Solar­Winds code was com­pil­ing. The hack­ers’ mali­cious code told the machine to swap in their tem­po­rary file instead of the Solar­Winds ver­sion. “I think a lot of peo­ple prob­a­bly assume that it is the source code that’s been mod­i­fied,” Mey­ers said, but instead the hack­ers used a kind of bait-and-switch.

But this, Mey­ers said, was inter­est­ing, too. The hack­ers under­stood that com­pa­nies such as Solar­Winds typ­i­cal­ly audit code before they start build­ing an update, just to make sure every­thing is as it should be. So they made sure that the switch to the tem­po­rary file hap­pened at the last pos­si­ble sec­ond, when the updates went from source code (read­able by peo­ple) to exe­cutable code (which the com­put­er reads) to the soft­ware that goes out to cus­tomers.
...

Then there’s the omi­nous obser­va­tion they made about the mal­ware that sur­rep­ti­tious­ly slipped the back­door mal­ware into the Ori­on client update soft­ware: the mal­ware that added the back­door at the last moment dur­ing the com­pi­la­tion process “could have been recon­fig­ured for any num­ber of soft­ware prod­ucts” that rely on the same com­pil­er, rais­ing the dis­tinct pos­si­bil­i­ty of this same attack being used against oth­er soft­ware devel­op­ers. All the hack­ers would need is access to the devel­op­ers’ com­put­ers when they’re com­pil­ing the code. And what did they gain from the Solar­Winds hack? Back­doors onto the net­work of every Solar­Winds client. In oth­er words, not only can the hack­ers use this same com­pil­er trick to embed back­doors in oth­er devel­op­ers soft­ware but they gained the incred­i­ble oppor­tu­ni­ty to do exact­ly that from the Solar­Winds hack. Thou­sands of Solar­Winds clients were undoubt­ed­ly devel­op­ing their own soft­ware using the same com­pil­er and the hack­ers could have deployed the same trick. Maybe they embed a back­door. Maybe some­thing else. It’s an omi­nous obser­va­tion and part of the rea­son the iden­ti­ties of the real hack­ers real­ly is a seri­ous glob­al con­cern. Who­ev­er did this had the oppor­tu­ni­ty to plant the seeds from some­thing orders of mag­ni­tude more dev­as­tat­ing involv­ing a wide array of dif­fer­ent soft­ware tools being devel­oped around the world:

...
But there was some­thing else about that code that both­ered Mey­ers: It was­n’t just for Solar­Winds. “When we looked at [it], it could have been recon­fig­ured for any num­ber of soft­ware prod­ucts,” Mey­ers said. In oth­er words, any num­ber of oth­er soft­ware devel­op­ers using the same com­pil­er may also be on the receiv­ing end of a cyber­at­tack, he said, and they just don’t know it yet.

...

The hack­ers also reverse-engi­neered the way Ori­on com­mu­ni­cat­ed with servers and built their own cod­ing instruc­tions mim­ic­k­ing Ori­on’s syn­tax and for­mats. What that did is allow the hack­ers to look like they were “speak­ing” Ori­on, so their mes­sage traf­fic looked like a nat­ur­al exten­sion of the soft­ware.

“So once they deter­mined that a tar­get was of inter­est, they could say, ‘OK, let’s go active, let’s manip­u­late files, let’s change some­thing,’ ” Mey­ers said, and then they would slip in unno­ticed through the back­door they had cre­at­ed. “And there is one oth­er thing I should men­tion: This back­door would wait up to two weeks before it actu­al­ly went active on the host. This was a very patient adver­sary.”

None of the trip­wires put in place by pri­vate com­pa­nies or the gov­ern­ment seems to have seen the attack com­ing. Christo­pher Krebs, who had been in charge of the office that pro­tect­ed gov­ern­ment net­works at DHS dur­ing the Trump admin­is­tra­tion, told NPR that DHS’ cur­rent sys­tem, some­thing known (with­out irony) as Ein­stein, only catch­es known threats. The Solar­Winds breach, he said, was just “too nov­el.”
...

And note the tim­ing here in the lead up to the Decem­ber 13, 2020, pub­lic announce­ment by Solar­Winds about acknowl­eg­ing the hack: We are told that the first clue some­thing was up took place in ear­ly July 2020, when Volex­i­ty found sus­pi­cious activ­i­ty on a clien­t’s com­put­er traced back to an update with Solar­Winds. We’re then told the sec­ond clue came sev­er­al months lat­er when Palo Alto Net­works con­tact­ed Solar­Winds about a mali­cious back door that appeared to be ema­nat­ing from the Ori­on soft­ware. Solar­Winds then tells us the com­pa­ny work with Palo Alto Net­works for sev­er­al months before giv­ing up and clos­ing the tick­et. If that’s all true, that tick­et must have been closed just days before Fire­Eye con­tact­ed Solar­Winds about its omi­nous dis­cov­ery. Because if the first call from Palo Alto Net­works came ‘sev­er­al months’ after an ‘ear­ly July’ first tip from Volex­i­ty, that call would have had to be around mid-to-late Sep­tem­ber to ear­ly Octo­ber if we inter­pret ‘sev­er­al months’ to be 10–13 weeks. And if Palo Alto Net­works and Solar­Winds then spent anoth­er ‘sev­er­al months’ study­ing the prob­lem before giv­ing up, that would put the ‘giv­ing up’ point at ear­ly Decem­ber at the ear­li­est. So when exact­ly did that tick­et get closed in rela­tion to FireEye’s tip about the larg­er hack? Solar­Winds did­n’t tell us and Palo Alto Net­works isn’t talk­ing:

...
In ear­ly July, Steven Adair, the founder of a Wash­ing­ton, D.C.-based cyber­se­cu­ri­ty com­pa­ny called Volex­i­ty, saw some sus­pi­cious activ­i­ty on a clien­t’s com­put­ers. “We traced it back, and we thought it might be relat­ed to a bad update with Solar­Winds,” Adair told NPR. “We addressed the prob­lem, made sure no one was in our cus­tomers’ sys­tems, and we left it at that.”

Adair said he did­n’t feel he had enough detail to report the prob­lem to Solar­Winds or the U.S. gov­ern­ment. “We thought we did­n’t have enough evi­dence to reach out,” he said.

That was the first missed sign.

The sec­ond came three months lat­er when a Cal­i­for­nia-based cyber­se­cu­ri­ty com­pa­ny called Palo Alto Net­works dis­cov­ered a mali­cious back­door that seemed to emanate from the Ori­on soft­ware.

In that case, accord­ing to Solar­Winds’ Ramakr­ish­na, the secu­ri­ty teams at Solar­Winds and Palo Alto worked togeth­er for three months to try to pick up the thread of the prob­lem and walk it back. “None of us could pin­point a sup­ply chain attack at that point,” Ramakr­ish­na told NPR. “The tick­et got closed as a result of that. If we had the ben­e­fit of hind­sight, we could have traced it back” to the hack.

Palo Alto Net­works had agreed to speak to NPR about the inci­dent last month and then can­celed the inter­view just an hour before it was sup­posed to take place. A spokesper­son declined to say why and sent a few blog posts and wrote: “I’m afraid this is all we have to help at this time.”
...

All in all, it’s hard to say that NPR piece should make read­er’s feel con­fi­dent hacks like this aren’t going to hap­pen again. Even when the hack was detect­ed on client sys­tems and inves­ti­ga­tions were start­ed they still could­n’t find it. Only Fire­Eye, itself a top tier secu­ri­ty firm, was able to detect it on its own sys­tems and all indi­ca­tions are the hack would be ongo­ing today had Fire­Eye not found it.

The Atlantic Council Confirms The SolarWinds Hackers Could Spoof Microsoft Credentials. Microsoft Blames Clients

And just a week after that NPR piece, we got anoth­er big reminder that the Solar­Winds hack was­n’t just a giant hack of the Solar­Winds com­pa­ny. It was a giant hack of Microsoft­’s prod­ucts. That was the mes­sage in a new report put out by The Atlantic Coun­cil, which appeared to con­firm what Microsoft had long been deny­ing: Once the hack­ers used those back­doors to gain access to vic­tims’ net­works they con­tin­ued to exploit more vul­ner­a­bil­i­ties. In par­tic­u­lar Microsoft vul­ner­a­bil­i­ties involv­ing how Microsoft prod­ucts val­i­date user iden­ti­ties. Now, part of the rea­son Microsoft vul­ner­a­bil­i­ties were heav­i­ly tar­get­ed was because, well, these vul­ner­a­bil­i­ties exist. But as the report notes, the oth­er big rea­son Microsoft was tar­get­ed so heav­i­ly is that Microsoft has more than 85% of the mar­ket share for gov­ern­ment and indus­try. In oth­er words, the juici­est tar­gets — espe­cial­ly gov­ern­ment agen­cies — were almost all run­ning Microsoft tools on their net­works.

So what was Microsoft­’s response to the Atlantic Coun­cil report? Microsoft con­tin­ued to deflect blame, sug­gest­ing poor­ly con­fig­ured soft­ware by the clients was the cause. But accord­ing to Sen­a­tor Ron Wyden, the soft­ware Microsoft sup­plies to US fed­er­al agen­cies is itself poor­ly con­fig­ured with default log set­tings that won’t cap­ture the infor­ma­tion need­ed to catch attacks while they’re in progress. As we can see, the Solar­Winds blame game is increas­ing­ly becom­ing Microsoft vs the World:

Asso­ci­at­ed Press

Solar­Winds hack­ing cam­paign puts Microsoft in the hot seat

By FRANK BAJAK
April 23, 2021

BOSTON (AP) — The sprawl­ing hack­ing cam­paign deemed a grave threat to U.S. nation­al secu­ri­ty came to be known as Solar­Winds, for the com­pa­ny whose soft­ware update was seed­ed by Russ­ian intel­li­gence agents with mal­ware to pen­e­trate sen­si­tive gov­ern­ment and pri­vate net­works.

Yet it was Microsoft whose code the cyber spies per­sis­tent­ly abused in the campaign’s sec­ond stage, rifling through emails and oth­er files of such high-val­ue tar­gets as then-act­ing Home­land Secu­ri­ty chief Chad Wolf — and hop­ping unde­tect­ed among vic­tim net­works.

This has put the world’s third-most valu­able com­pa­ny in the hot seat. Because its prod­ucts are a de fac­to mono­cul­ture in gov­ern­ment and indus­try — with more than 85% mar­ket share — fed­er­al law­mak­ers are insist­ing that Microsoft swift­ly upgrade secu­ri­ty to what they say it should have pro­vid­ed in the first place, and with­out fleec­ing tax­pay­ers.

Seek­ing to assuage con­cerns, Microsoft this past week offered all fed­er­al agen­cies a year of “advanced” secu­ri­ty fea­tures at no extra charge. But it also seeks to deflect blame, say­ing it is cus­tomers who do not always make secu­ri­ty a pri­or­i­ty.

Risks in Microsoft’s for­eign deal­ings also came into relief when the Biden admin­is­tra­tion imposed sanc­tions Thurs­day on a half-dozen Russ­ian IT com­pa­nies it said sup­port Krem­lin hack­ing. Most promi­nent was Pos­i­tive Tech­nolo­gies, which was among more than 80 com­pa­nies that Microsoft has sup­plied with ear­ly access to data on vul­ner­a­bil­i­ties detect­ed in its prod­ucts. Fol­low­ing the sanc­tions announce­ment, Microsoft said Pos­i­tive Tech was no longer in the pro­gram and removed its name from a list of par­tic­i­pants on its web­site.

The Solar­Winds hack­ers took full advan­tage of what George Kurtz, CEO of top cyber­se­cu­ri­ty firm Crowd­Strike, called “sys­tem­at­ic weak­ness­es” in key ele­ments of Microsoft code to mine at least nine U.S. gov­ern­ment agen­cies — the depart­ments of Jus­tice and Trea­sury, among them — and more than 100 pri­vate com­pa­nies and think tanks, includ­ing soft­ware and telecom­mu­ni­ca­tions providers.

The Solar­Winds hack­ers’ abuse of Microsoft’s iden­ti­ty and access archi­tec­ture — which val­i­dates users’ iden­ti­ties and grants them access to email, doc­u­ments and oth­er data — did the most dra­mat­ic harm, the non­par­ti­san Atlantic Coun­cil think tank said in a report. That set the hack apart as “a wide­spread intel­li­gence coup.” In near­ly every case of post-intru­sion mis­chief, the intrud­ers “silent­ly moved through Microsoft prod­ucts “vac­u­um­ing up emails and files from dozens of orga­ni­za­tions.”

Thanks in part to the carte blanche that vic­tim net­works grant­ed the infect­ed Solar­winds net­work man­age­ment soft­ware in the form of admin­is­tra­tive priv­i­leges, the intrud­ers could move lat­er­al­ly across them, even jump among orga­ni­za­tions. They used it to sneak into the cyber­se­cu­ri­ty firm Mal­ware­bytes and to tar­get cus­tomers of Mime­cast, an email secu­ri­ty com­pa­ny.

The campaign’s “hall­mark” was the intrud­ers’ abil­i­ty to imper­son­ate legit­i­mate users and cre­ate coun­ter­feit cre­den­tials that let them grab data stored remote­ly by Microsoft Office, the act­ing direc­tor of the Cyber­se­cu­ri­ty Infra­struc­ture and Secu­ri­ty Agency, Bran­don Wales, told a mid-March con­gres­sion­al hear­ing. “It was all because they com­pro­mised those sys­tems that man­age trust and iden­ti­ty on net­works,” he said.

Microsoft Pres­i­dent Brad Smith told a Feb­ru­ary con­gres­sion­al hear­ing that just 15% of vic­tims were com­pro­mised through an authen­ti­ca­tion vul­ner­a­bil­i­ty first iden­ti­fied in 2017 — allow­ing the intrud­ers to imper­son­ate autho­rized users by mint­ing the rough equiv­a­lent of coun­ter­feit pass­ports.

Microsoft offi­cials stress that the Solar­Winds update was not always the entry point; intrud­ers some­times took advan­tage of vul­ner­a­bil­i­ties such as weak pass­words and vic­tims’ lack of mul­ti-fac­tor authen­ti­ca­tion. But crit­ics say the com­pa­ny took secu­ri­ty too light­ly. Sen. Ron Wyden, D‑Ore., ver­bal­ly pum­meled Microsoft for not sup­ply­ing fed­er­al agen­cies with a lev­el of “event log­ging” that, if it had not detect­ed the Solar­Winds hack­ing in progress, would at least have pro­vid­ed respon­ders with a record of where the intrud­ers were and what they saw and removed.

“Microsoft choos­es the default set­tings in the soft­ware it sells, and even though the com­pa­ny knew for years about the hack­ing tech­nique used against U.S. gov­ern­ment agen­cies, the com­pa­ny did not set default log­ging set­tings to cap­ture infor­ma­tion nec­es­sary to spot hacks in progress,” Wyden said. He was not the only fed­er­al law­mak­er who com­plained.

When Microsoft on Wednes­day announced a year of free secu­ri­ty log­ging for fed­er­al agen­cies, for which it nor­mal­ly charges a pre­mi­um, Wyden was not appeased.

“This move is far short of what’s need­ed to make up for Microsoft’s recent fail­ures,” he said in a state­ment. “The gov­ern­ment still won’t have access to impor­tant secu­ri­ty fea­tures with­out hand­ing over even more mon­ey to the same com­pa­ny that cre­at­ed this cyber­se­cu­ri­ty sink­hole.”

...

Even the high­est lev­el of log­ging doesn’t pre­vent break-ins, though. It only makes it eas­i­er to detect them.

And remem­ber, many secu­ri­ty pro­fes­sion­als note, Microsoft was itself com­pro­mised by the Solar­Winds intrud­ers, who got access to some of its source code — its crown jew­els. Microsoft’s full suite of secu­ri­ty prod­ucts — and some of the industry’s most skilled cyber-defense prac­ti­tion­ers — had failed to detect the ghost in the net­work. Not until alert­ed to the hack­ing cam­paign by Fire­Eye, the cyber­se­cu­ri­ty firm that detect­ed it in mid-Decem­ber, did Microsoft respon­ders dis­cov­er the relat­ed breach of their sys­tems.

The intrud­ers in the unre­lat­ed hack of Microsoft Exchange email servers dis­closed in March — blamed on Chi­nese spies — used whol­ly dif­fer­ent infec­tion meth­ods. But they gained imme­di­ate high-lev­el access to users’ email and oth­er info.

Across the indus­try, Microsoft’s invest­ments in secu­ri­ty are wide­ly acknowl­edged. It is often first to iden­ti­fy major cyber­se­cu­ri­ty threats, its vis­i­bil­i­ty into net­works is so great. But many argue that as the chief sup­pli­er of secu­ri­ty solu­tions for its prod­ucts, it needs to be more mind­ful about how much it should prof­it off defense.

“The crux of it is that Microsoft is sell­ing you the dis­ease and the cure,” said Marc Maiffret, a cyber­se­cu­ri­ty vet­er­an who built a career find­ing vul­ner­a­bil­i­ties in Microsoft prod­ucts and has a new start­up in the works called Bin­Mave.

Last month, Reuters report­ed that a $150 mil­lion pay­ment to Microsoft for a “secure cloud plat­form” was includ­ed in a draft out­line for spend­ing the $650 mil­lion appro­pri­at­ed for the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency in last month’s $1.9 tril­lion pan­dem­ic relief act.

A Microsoft spokesper­son would not say how much, if any, of that mon­ey it would be get­ting, refer­ring the ques­tion to the cyber­se­cu­ri­ty agency. An agency spokesman, Scott McConnell, would not say either. Langevin said he didn’t think a final deci­sion has been made.

In the bud­get year end­ing in Sep­tem­ber, the fed­er­al gov­ern­ment spent more than half a bil­lion dol­lars on Microsoft soft­ware and ser­vices.

Many secu­ri­ty experts believe Microsoft’s sin­gle sign-on mod­el, empha­siz­ing user con­ve­nience over secu­ri­ty, is ripe for retool­ing to reflect a world where state-backed hack­ers now rou­tine­ly run roughshod over U.S. net­works.

Alex Wein­ert, Microsoft’s direc­tor of iden­ti­ty secu­ri­ty, said it offers var­i­ous ways for cus­tomers to strict­ly lim­it users’ access to what they need to do their jobs. But get­ting cus­tomers to go along can be dif­fi­cult because it often means aban­don­ing three decades of IT habit and dis­rupt­ing busi­ness. Cus­tomers tend to con­fig­ure too many accounts with the broad glob­al admin­is­tra­tive priv­i­leges that allowed the Solar­Winds cam­paign abus­es, he said. “It’s not the only way they can do it, that’s for sure.”

In 2014–2015, lax restric­tions on access helped Chi­nese spies steal sen­si­tive per­son­al data on more than 21 mil­lion cur­rent, for­mer and prospec­tive fed­er­al employ­ees from the Office of Per­son­nel Man­age­ment.

Cur­tis Dukes was the Nation­al Secu­ri­ty Agency’s head of infor­ma­tion assur­ance at the time.

The OPM shared data across mul­ti­ple agen­cies using Microsoft’s authen­ti­ca­tion archi­tec­ture, grant­i­ng access to more users than it safe­ly should have, said Dukes, now the man­ag­ing direc­tor for the non­prof­it Cen­ter for Inter­net Secu­ri­ty.

“Peo­ple took their eye off the ball.”

———–

“Solar­Winds hack­ing cam­paign puts Microsoft in the hot seat” by FRANK BAJAK; Asso­ci­at­ed Press; 04/23/2021

“This has put the world’s third-most valu­able com­pa­ny in the hot seat. Because its prod­ucts are a de fac­to mono­cul­ture in gov­ern­ment and indus­try — with more than 85% mar­ket share — fed­er­al law­mak­ers are insist­ing that Microsoft swift­ly upgrade secu­ri­ty to what they say it should have pro­vid­ed in the first place, and with­out fleec­ing tax­pay­ers.”

If you want to hack the US gov­ern­ment, be ready to hack Microsoft prod­ucts. That’s the unde­ni­able real­i­ty. Microsoft is basi­cal­ly the soft­ware sup­pli­er for the US gov­ern­ment and oth­er gov­ern­ments around the world. So it should come as no sur­prise to learn that the sec­ond phase of the Solar­Winds hack was basi­cal­ly the exploita­tion of Microsoft prod­uct weak­ness­es after the hack­ers gained access to client net­works. In par­tic­u­lar, vul­ner­a­bil­i­ties in Microsoft­’s iden­ti­ty and access archi­tec­ture which val­i­dates users’ iden­ti­ties and grants them access to email, doc­u­ments and oth­er data. The Solar­Winds hack­ers were repeat­ed­ly imper­son­at­ing legit­i­mate users and cre­at­ing coun­ter­feit cre­den­tials that let them grab data stored remote­ly by Microsoft Office. So the Solar­Winds hack did­n’t just involve the pil­fer­ing of vic­tims’ net­works but also the data stored remote­ly acces­si­ble through Microsoft Office. Those sound like some mas­sive vul­ner­a­bil­i­ties. The Solar­Winds hack was­n’t just the cre­ation and exploita­tion of back­doors placed on 18,000 client net­works. It was the exploita­tion of the infor­ma­tion stored remote­ly via Microsoft Office for those clients too:

...
The Solar­Winds hack­ers took full advan­tage of what George Kurtz, CEO of top cyber­se­cu­ri­ty firm Crowd­Strike, called “sys­tem­at­ic weak­ness­es” in key ele­ments of Microsoft code to mine at least nine U.S. gov­ern­ment agen­cies — the depart­ments of Jus­tice and Trea­sury, among them — and more than 100 pri­vate com­pa­nies and think tanks, includ­ing soft­ware and telecom­mu­ni­ca­tions providers.

The Solar­Winds hack­ers’ abuse of Microsoft’s iden­ti­ty and access archi­tec­ture — which val­i­dates users’ iden­ti­ties and grants them access to email, doc­u­ments and oth­er data — did the most dra­mat­ic harm, the non­par­ti­san Atlantic Coun­cil think tank said in a report. That set the hack apart as “a wide­spread intel­li­gence coup.” In near­ly every case of post-intru­sion mis­chief, the intrud­ers “silent­ly moved through Microsoft prod­ucts “vac­u­um­ing up emails and files from dozens of orga­ni­za­tions.”

Thanks in part to the carte blanche that vic­tim net­works grant­ed the infect­ed Solar­winds net­work man­age­ment soft­ware in the form of admin­is­tra­tive priv­i­leges, the intrud­ers could move lat­er­al­ly across them, even jump among orga­ni­za­tions. They used it to sneak into the cyber­se­cu­ri­ty firm Mal­ware­bytes and to tar­get cus­tomers of Mime­cast, an email secu­ri­ty com­pa­ny.

The campaign’s “hall­mark” was the intrud­ers’ abil­i­ty to imper­son­ate legit­i­mate users and cre­ate coun­ter­feit cre­den­tials that let them grab data stored remote­ly by Microsoft Office, the act­ing direc­tor of the Cyber­se­cu­ri­ty Infra­struc­ture and Secu­ri­ty Agency, Bran­don Wales, told a mid-March con­gres­sion­al hear­ing. “It was all because they com­pro­mised those sys­tems that man­age trust and iden­ti­ty on net­works,” he said.
...

But it gets worse for Microsoft because the hack­ers did­n’t sim­ply exploit vul­ner­a­bil­i­ties in Microsoft­’s prod­ucts. They also rifled through Microsoft­’s trea­sured source code look­ing for the code that valideates users’ iden­ti­ties and grants them access to email, doc­u­ments, and oth­er data. So these super-hack­ers like­ly learned hack to become even more super. At least more super against Microsoft:

...
And remem­ber, many secu­ri­ty pro­fes­sion­als note, Microsoft was itself com­pro­mised by the Solar­Winds intrud­ers, who got access to some of its source code — its crown jew­els. Microsoft’s full suite of secu­ri­ty prod­ucts — and some of the industry’s most skilled cyber-defense prac­ti­tion­ers — had failed to detect the ghost in the net­work. Not until alert­ed to the hack­ing cam­paign by Fire­Eye, the cyber­se­cu­ri­ty firm that detect­ed it in mid-Decem­ber, did Microsoft respon­ders dis­cov­er the relat­ed breach of their sys­tems.
...

But per­haps worst of all is how long these secu­ri­ty defi­cien­cies have been plagu­ing Microsoft. This isn’t a new prob­lem. Which is why it’s so prob­lem­at­ic and scan­dalous that, as Sen­a­tor Wyden angri­ly point­ed out dur­ing a recent con­gres­sion­al hear­ing, that Microsoft has been pro­vid­ing the US gov­ern­ing with prod­ucts that have the default “event log­ging” set­tings turned off. So by default, the US fed­er­al gov­ern­ment does­n’t log these hacks when they hap­pen. That’s appar­ent­ly the case, accord­ing to Sen­a­tor Wyden. The US gov­ern­men­t’s cyber-defens­es have to been fly­ing blind by default thanks to Microsoft:

...
Microsoft offi­cials stress that the Solar­Winds update was not always the entry point; intrud­ers some­times took advan­tage of vul­ner­a­bil­i­ties such as weak pass­words and vic­tims’ lack of mul­ti-fac­tor authen­ti­ca­tion. But crit­ics say the com­pa­ny took secu­ri­ty too light­ly. Sen. Ron Wyden, D‑Ore., ver­bal­ly pum­meled Microsoft for not sup­ply­ing fed­er­al agen­cies with a lev­el of “event log­ging” that, if it had not detect­ed the Solar­Winds hack­ing in progress, would at least have pro­vid­ed respon­ders with a record of where the intrud­ers were and what they saw and removed.

“Microsoft choos­es the default set­tings in the soft­ware it sells, and even though the com­pa­ny knew for years about the hack­ing tech­nique used against U.S. gov­ern­ment agen­cies, the com­pa­ny did not set default log­ging set­tings to cap­ture infor­ma­tion nec­es­sary to spot hacks in progress,” Wyden said. He was not the only fed­er­al law­mak­er who com­plained.

...

Even the high­est lev­el of log­ging doesn’t pre­vent break-ins, though. It only makes it eas­i­er to detect them.
...

Of course, keep in mind that a big advan­tage for the vic­tims of hacks when of no event-log­ging was employed: the less infor­ma­tion you have about what actu­al­ly hap­pened, the more you’re forced to spec­u­late about what hap­pened and the eas­i­er it is to just say it was prob­a­bly Rus­sia or Chi­na or who­ev­er you want to blame. Igno­rance can be both a cud­gel and shield when cyber­at­tri­bu­tion is wield­ed as a weapon.

Final­ly note how we are told the ‘Chi­nese hack­ers’ behind the Microsoft Exchange hack used whol­ly dif­fer­ent infec­tion meth­ods. Now, tech­ni­cal­ly, yes, they may have used a dif­fer­ent zero-day exploit tar­get dif­fer­ent Microsoft prod­ucts. As we’ve seen, it was report­ed­ly an Office 365 email exploit that the hack­ers used to ini­ti­ate the hack on Solar­Wind­s’s net­work and the US Trea­sury Depart­ment con­firmed that an Office 365 email exploit was used after the hack­ers infil­trat­ed their net­works via the back­door. Where­as in the Microsoft Exchange hack, it ws some sort of vul­ner­a­bil­i­ty in the Exchange soft­ware that was exploit­ed. So yes, these are two dif­fer­ent infec­tion meth­ods. But they both relied on manip­u­lat­ing Microsoft­’s cre­den­tial­ing sys­tems. From that per­spec­tive, it’s kind of the same under­ly­ing method:

...
The intrud­ers in the unre­lat­ed hack of Microsoft Exchange email servers dis­closed in March — blamed on Chi­nese spies — used whol­ly dif­fer­ent infec­tion meth­ods. But they gained imme­di­ate high-lev­el access to users’ email and oth­er info.
...

Keep in mind that point­ing out the dif­fer­ent attack meth­ods used in the Solar­Winds and Microsoft Exchange hacks, and cit­ing that as evi­dence of it being dif­fer­ent hack­ing groups, is anoth­er exam­ple of how vague tech­ni­cal ‘dig­i­tal fin­ger­prints’ like the par­tic­u­lar type of mal­ware or exploit used in a hack are used for cyber­at­tri­bu­tion pur­pos­es. It’s the kind of cyber­at­tri­bu­tion phe­nom­e­na that assumes the “com­mer­cial sur­veil­lance” indus­try isn’t sup­ply­ing incred­i­ble zero-day attacks to dozens of gov­ern­ments around the world simul­ta­ne­ous­ly.

The SolarWinds Hackers(?) Go Phishing. With USAID as the Bait.

The mul­ti­fac­eted abil­i­ty of the Solar­Winds hack­ers was on dis­play again with a new announce from Microsoft at the end of May: Remem­ber those warn­ings fol­low­ing the Microsoft Exchange hack about high­ly sophis­ti­cat­ed and tar­get­ed phish­ing cam­paigns emerg­ing from all the infor­ma­tion the hack­ers were able to extract from all those stolen emails? Well, a new high­ly sophis­ti­cat­ed and tar­get phish­ing cam­paign was indeed unleashed. But we are told “Nobeli­um” — the name Microsoft gave to Cozy Bear/APT29 — was the cul­prit. Approx­i­mate­ly 3,000 email accounts at more than 150 dif­fer­ent orga­ni­za­tions in 24 dif­fer­ent coun­tries received emails seem­ing­ly from the Unit­ed States Agency For Inter­na­tion­al Devel­op­ment (USAID), encour­ag­ing vic­tims to down­load a file about elec­tion fraud. The hack­ers car­ried out the hack by break­ing into an email mar­ket­ing account for Con­stant Con­tact, which is used by USAID for offi­cial com­mu­ni­ca­tions. From there, they launched the phish­ing attacks.

Microsoft assures us that no exploits of Microsoft prod­ucts were involved with this phish­ing attempt. At the same time, we’re told noth­ing about how this Con­stant Con­tact email mar­ket­ing account was bro­ken into in the first place. In fact, it’s not actu­al­ly clear at all what ties this phish­ing attack to the Solar­Winds hack. And yet are assured by Microsoft, with high con­fi­dence, that Rus­si­a’s SVR is behind it and that it appeared to be a con­tin­u­a­tion of mul­ti­ple efforts to tar­get gov­ern­ment agen­cies involved in for­eign pol­i­cy as part of intel­li­gence gath­er­ing efforts. And since the SVR is also blamed for the Solar­Winds hack, it’s there­fore behind this phish­ing attempt. That appears to be the ‘log­ic’ at work here.

Now, if we view the Microsoft blog post on this hack, there is one tech­ni­cal fact that relates back to the Solar­Winds hack: the use of zero-day exploits. Vic­tims who fell for the phish­ing emails had four zero-day pieces of mal­ware deployed on their com­put­ers accord­ing to a sec­ond Microsoft blog post about the attack. So the tech­ni­cal traits shared between this phish­ing attack in the ear­li­er Solar­Winds hack are the use of mul­ti­ple zero-day exploits. But dif­fer­ent exploits. The Microsoft blog post describ­ing this USAID phish­ing scheme explic­it­ly states that this new attack bears very lit­tle tech­ni­cal sim­i­lar­i­ties to the Solar­Winds hack and sug­gests the hack­ers inten­tion­al­ly changed their tac­tics after the dis­cov­ery of the Solar­Winds hack. So the pos­ses­sion of mul­ti­ple zero-day exploits is appar­ent­ly being used as a tech­ni­cal indi­ca­tor for attri­bu­tions. If a hack­er is sport­ing lots of zero-day exploits, it’s assumed to be the same hack­er who ran the last hack with lots of zero-day exploits. And since zero-day exploits are wide­ly assumed to large­ly be the exclu­sive prop­er­ty of well-financed nations (the US, Russ­ian, Chi­na, Israel, etc), when a hack involved lots of zero-day exploits the list of sus­pects gets nar­rowed down to that list. That appears to be the pat­tern play­ing out here. A pat­tern that ignores the exis­tence of a robust indus­try sell­ing zero-day exploits to dozens of gov­ern­ments around the world.

But also keep in mind that the Microsoft Exchange mega-hack announced in March also uti­lized zero-day exploits and this hack start­ed with the com­pro­mise of USAID’s Con­stant Con­tac­t’s email account. Is there an Exchange serv­er involved with this ser­vice? It was be nice to know but, again, we aren’t told how the hack start­ed. So how was Microsoft able to deduce that it was the Solar­Winds hacks and no the Exchange hack­ers or some oth­er group? We have no idea, but we are assured that Microsoft fig­ured it all out. We’ll just have to blind­ly trust them on this. As always:

Reuters
Tech­nol­o­gy

Microsoft says group behind Solar­Winds hack now tar­get­ing gov­ern­ment agen­cies, NGOs

Raphael Sat­ter, Kan­ish­ka Singh
May 28, 2021 12:53 PM CDT Updat­ed

May 28 (Reuters) — The group behind the Solar­Winds (SWI.N) cyber attack iden­ti­fied late last year is now tar­get­ing gov­ern­ment agen­cies, think tanks, con­sul­tants, and non-gov­ern­men­tal orga­ni­za­tions, Microsoft Corp (MSFT.O) said on Thurs­day.

“This week we observed cyber­at­tacks by the threat actor Nobeli­um tar­get­ing gov­ern­ment agen­cies, think tanks, con­sul­tants, and non-gov­ern­men­tal orga­ni­za­tions”, Microsoft said in a blog.

Nobeli­um, orig­i­nat­ing from Rus­sia, is the same actor behind the attacks on Solar­Winds cus­tomers in 2020, accord­ing to Microsoft.

The com­ments come weeks after a May 7 ran­somware attack on Colo­nial Pipeline shut the Unit­ed States’ largest fuel pipeline net­work for sev­er­al days, dis­rupt­ing the coun­try’s sup­ply.

“This wave of attacks tar­get­ed approx­i­mate­ly 3,000 email accounts at more than 150 dif­fer­ent orga­ni­za­tions”, Microsoft said on Thurs­day.

While organ­i­sa­tions in the Unit­ed States received the largest share of attacks, tar­get­ed vic­tims came from at least 24 coun­tries, Microsoft said.

At least a quar­ter of the tar­get­ed organ­i­sa­tions were involved in inter­na­tion­al devel­op­ment, human­i­tar­i­an issues and human rights work, Microsoft said in the blog.

Nobeli­um launched this week’s attacks by break­ing into an email mar­ket­ing account used by the Unit­ed States Agency For Inter­na­tion­al Devel­op­ment (USAID) and from there launch­ing phish­ing attacks on many oth­er organ­i­sa­tions, Microsoft said.

In state­ments issued Fri­day, the Depart­ment of Home­land Secu­ri­ty and USAID both said they were aware of the hack­ing and were inves­ti­gat­ing.

The hack of infor­ma­tion tech­nol­o­gy com­pa­ny Solar­Winds, which was iden­ti­fied in Decem­ber, gave access to thou­sands of com­pa­nies and gov­ern­ment offices that used its prod­ucts. Microsoft Pres­i­dent Brad Smith described the attack as “the largest and most sophis­ti­cat­ed attack the world has ever seen”. read more

...

The Unit­ed States and Britain have blamed Rus­si­a’s For­eign Intel­li­gence Ser­vice (SVR), suc­ces­sor to the for­eign spy­ing oper­a­tions of the KGB, for the hack which com­pro­mised nine U.S. fed­er­al agen­cies and hun­dreds of pri­vate sec­tor com­pa­nies.

The attacks dis­closed by Microsoft on Thurs­day appeared to be a con­tin­u­a­tion of mul­ti­ple efforts to tar­get gov­ern­ment agen­cies involved in for­eign pol­i­cy as part of intel­li­gence gath­er­ing efforts, Microsoft said.

The com­pa­ny said it was in the process of noti­fy­ing all of its tar­get­ed cus­tomers and had “no rea­son to believe” these attacks involved any exploita­tion or vul­ner­a­bil­i­ty in Microsoft­’s prod­ucts or ser­vices.
————–

“Microsoft says group behind Solar­Winds hack now tar­get­ing gov­ern­ment agen­cies, NGOs” by Raphael Sat­ter and Kan­ish­ka Singh; Reuters; 05/28/2021

“Nobeli­um launched this week’s attacks by break­ing into an email mar­ket­ing account used by the Unit­ed States Agency For Inter­na­tion­al Devel­op­ment (USAID) and from there launch­ing phish­ing attacks on many oth­er organ­i­sa­tions, Microsoft said.”

As Microsoft announced in May, the Solar­Winds attacks con­tin­ue. Sort of. This was­n’t an exten­sion of the Solar­Winds attack. At least we aren’t told so. Instead, we’re told that the same hack­ers, Nobeli­um, who car­ried out the Solar­Winds attack also car­ried out this new attack tar­get­ing the email mar­ket­ing firm, , that han­dles the emails for USAID. Some­how, the hack­ers were able to send out emails to 3,000 email accounts at more than 150 dif­fer­ent orga­ni­za­tions that looked like they came from USAID, and if vic­tims clicked on the links in the emails they received sophis­ti­cat­ed mal­ware like was deployed in the Solar­Winds attack. Again, Nobeli­um is Microsoft­’s name for APT29/Cozy Bear, the group accused of the 2015 DNC hack (the first DNC hack of the 2016 elec­tion sea­sons).

Now how did the Microsoft arrive at the con­clu­sion that this phish­ing attack was car­ried out by the same “Nobeli­um” Solar­Winds hack­ers? As we should expect, it’s entire­ly unclear. Microsoft first dubbed the Solar­Winds hack­ers “Nobeli­um” back in March of 2020 in a blog post describ­ing the comand-and-con­trol mal­ware from the Solar­Winds hack. ‘Zero-day’ Mal­ware that had nev­er been seen before, adding to the per­ceived sophis­ti­ca­tion of the hack­er. Of course, as we’re going to see with the NSO Group sto­ry, ultra-sophis­ti­cat­ed ‘zero-day’ hacks that have ‘nev­er been seen before’ are effec­tive­ly for sale to gov­ern­ments around world. Any gov­ern­ment with per­mis­sion to buy this soft­ware would sud­den­ly become an ultra-sophis­ti­cat­ed actor with an armory of zero-day exploits nev­er seen before.

So were more zero-day exploits found in this lat­est USAID phish­ing hack? Yes, there were four zero-day pieces of mal­ware deployed accord­ing to a sec­ond Microsoft blog post about the attack. So the tech­ni­cal traits shared between this phish­ing attack in the ear­li­er Solar­Winds hack are the use of mul­ti­ple zero-day exploits. But dif­fer­ent exploits. The Microsoft blog post describ­ing this USAID phish­ing scheme explic­it­ly states that this new attack bears very lit­tle tech­ni­cal sim­i­lar­i­ties to the Solar­Winds hack and sug­gests the hack­ers inten­tion­al­ly changed their tac­tics after the dis­cov­ery of the Solar­Winds hack. So the pos­ses­sion of mul­ti­ple zero-day exploits is appar­ent­ly being used as a tech­ni­cal indi­ca­tor for attri­bu­tions. If a hack­er is sport­ing lots of zero-day exploits, it’s assumed to be the same hack­er who ran the last hack with lots of zero-day exploits. And since zero-day exploits are wide­ly assumed to large­ly be the exclu­sive prop­er­ty of well-financed nations (the US, Russ­ian, Chi­na, Israel, etc), when a hack involved lots of zero-day exploits the list of sus­pects gets nar­rowed down to that list. That appears to be the pat­tern play­ing out here. A pat­tern that ignores the exis­tence of a robust indus­try sell­ing zero-day exploits to dozens of gov­ern­ments around the world.

And note how, while this attack clear­ly involves USAID, it’s not actu­al­ly tar­get­ing USAID. It was an attack that used USAID’s per­sona to tar­get­ing 150 dif­fer­ent orga­ni­za­tions in at least 24 coun­tries. And only around a quar­ter of those tar­get­ed organ­i­sa­tions were involved in inter­na­tion­al devel­op­ment, human­i­tar­i­an issues and human rights work. And yet Microsoft con­fi­dent­ly tells us this hack is a con­tin­u­a­tion of an SVR espi­onage cam­paign tar­get­ing gov­ern­ment agen­cies involved in for­eign pol­i­cy. It’s a remark­ably cher­ry-picked assess­ment:

...
“This wave of attacks tar­get­ed approx­i­mate­ly 3,000 email accounts at more than 150 dif­fer­ent orga­ni­za­tions”, Microsoft said on Thurs­day.

While organ­i­sa­tions in the Unit­ed States received the largest share of attacks, tar­get­ed vic­tims came from at least 24 coun­tries, Microsoft said.

At least a quar­ter of the tar­get­ed organ­i­sa­tions were involved in inter­na­tion­al devel­op­ment, human­i­tar­i­an issues and human rights work, Microsoft said in the blog.

...

The Unit­ed States and Britain have blamed Rus­si­a’s For­eign Intel­li­gence Ser­vice (SVR), suc­ces­sor to the for­eign spy­ing oper­a­tions of the KGB, for the hack which com­pro­mised nine U.S. fed­er­al agen­cies and hun­dreds of pri­vate sec­tor com­pa­nies.

The attacks dis­closed by Microsoft on Thurs­day appeared to be a con­tin­u­a­tion of mul­ti­ple efforts to tar­get gov­ern­ment agen­cies involved in for­eign pol­i­cy as part of intel­li­gence gath­er­ing efforts, Microsoft said.
...

So we have the Solar­Winds mega-hack dis­cov­ered in Decem­ber 2020 ini­tial­ly attrib­uted to a pre­vi­ous­ly unknown group — that gov­ern­ments nonethe­less assure us are the SVR — but lat­er attrib­uted to Cozy Bear/APT29 aka Nobeli­um. Then a May 2021 phish­ing cam­paign that does­n’t actu­al­ly share any of the tech­ni­cal traits of the Solar­Winds hack oth­er than the use of dif­fer­ent zero-day exploits is also attrib­uted to Cozy Bear. Why exact­ly it’s been deter­mined that these two sep­a­rate attacks were done by the same group is nev­er explained, let alone why they’ve deter­mined that group is Rus­si­a’s SVR.

The SolarWinds Hackers(?) Can’t Stop, Won’t Stop...Hacking Microsoft

It’s always a ‘trust us’ nar­ra­tive. A nar­ra­tive that sounds awful­ly sim­i­lar to the sto­ry we got a month lat­er in the last week of June, when Microsoft announced a new Nobelium/Cozy Bear attack. Although it’s more like an update on the May phish­ing attack. Like with the May phish­ing attack report, Microsoft assured us that this new attack is unre­lat­ed to the Solar­Winds hack. And yet Microsoft also assured us that the same group was behind it, Nobeli­um. The rea­son for this attri­bu­tion to Nobeli­um is nev­er giv­en. It’s anoth­er phish­ing attack that isn’t tech­ni­cal­ly relat­ed to the Solar­Winds hack but they’re still sure it’s the same group. The rea­sons nev­er giv­en. Sound­ing famil­iar yet?

But this June attack appears to dif­fer from the May phish­ing attack in a poten­tial­ly sig­nif­i­cant way: one of Microsoft­’s own agents was hacked and cus­tomer infor­ma­tion about Microsoft ser­vices were stolen, allow­ing for tai­lored phish­ing attacks. So who­ev­er pulled this off demon­strat­ed an eeri­ly sim­i­lar abil­i­ty to exploit pre­vi­ous­ly unknown Microsoft vul­ner­a­bil­i­ties. An abil­i­ty demon­strat­ed by both the Solar­Winds and Exchange hack­ers.

Microsoft did­n’t answer ques­tions of whether or not its agent was hacked dur­ing the ini­tial Solar­Winds hack. But we are told that Microsoft dis­cov­ered this phish­ing cam­paign and the hack­ing of its agent as a result of its inves­ti­ga­tion into the ear­li­er Solar­Winds hacks. Part of the rea­son this is poten­tial­ly sig­nif­i­cant is that it once again rais­es the ques­tion of whether or not this new hack of the Microsoft agent — where cus­tomer ser­vice infor­ma­tion was some­how accessed and used to tai­lor phish­ing emails — was exe­cut­ed with some sort of exploit tar­get­ing Microsoft sys­tems. And if that’s the case, we have to ask why these are nec­es­sar­i­ly the Solar­Winds hack­ers and not the Exchange hack­ers. Both pos­sessed Microsoft zero-day exploits.

But beyond the poten­tial rela­tion­ship between the Solar­Winds and Exchange hack­ers, it’s hard to ignore the sto­ry of NSO Group, Can­diru, and the exis­tence of the pri­vate indus­try that cre­ates and sells cut­ting edge mal­ware bristling with zero-day exploits — includ­ing zero-day exploits tar­get­ing Microsoft prod­ucts — that are sold to dozens of gov­ern­ments around the world. And yet ignor­ing the exis­tence of this pri­vate indus­try that makes cut­ting edge zero-day exploits avail­able to dozens of gov­ern­ments around the world is exact­ly what we are asked to do. Over and over. Every time there’s a new hack that shows a rea­son­able degree of sophis­ti­ca­tion or that hits a gov­ern­ment agency (even if many more non-gov­ern­ment agen­cies are hit too), it’s treat­ed as if the only pos­si­ble actors in the world who could have pulled off the hack were Rus­sia, Chi­na, Iran or North Korea. It is sys­tem­at­i­cal­ly ignored that dozens of gov­ern­ments around the world can and do buy the nec­es­sary ‘zero-day’ mal­ware toolk­its to pull off these hacks. Would Sau­di Ara­bia attempt a Solar­Winds-style mega-hack if if they new it was going to be blamed on Rus­sia or Chi­na? There’s no way to respon­si­bly avoid ask­ing these kind of ques­tions when we know Sau­di Ara­bia and dozens of oth­er coun­tries have already pur­chased the abil­i­ty to do so.

So we have a sec­ond phish­ing attack attrib­uted to Nobelium/Cozy Bear. But unlike the pre­vi­ous phish­ing attack, where Microsoft acknowl­edged there was no appar­ent tech­ni­cal link back to the ear­li­er Solar­Winds hack, this phish­ing attack appears to have employed some sort of vul­ner­a­bil­i­ty in Microsoft­’s prod­ucts. And at the same time Microsoft assures us this was­n’t tech­ni­cal­ly relat­ed to the Solar­Winds hack, Microsoft also reminds of us of what was dis­closed months agao: that data and insights were stolen from Microsoft dur­ing the ini­tial Solar­Winds attack, includ­ing soft­ware instruc­tions gov­ern­ing how Microsoft ver­i­fies user iden­ti­ties. Were any of those stolen vul­ner­a­bil­i­ties used in this hack? Microsoft isn’t say­ing. And that’s a big part of the larg­er sto­ry here: extreme­ly seri­ous alle­ga­tions about who was behind these cyber­at­tacks are being made — with all fin­gers point­ing towards the Russ­ian or Chi­nese gov­ern­ments — with almost no infor­ma­tion being released regard­ing why and how those attri­bu­tions are made. The entire cyber­at­tri­bu­tion indus­try is root­ed in a ‘just trust us on this’ ethos:

Reuters

Microsoft says new breach dis­cov­ered in probe of sus­pect­ed Solar­Winds hack­ers

Joseph Menn
June 25, 2021 8:59 PM CDT Updat­ed

SAN FRANCISCO, June 25 (Reuters) — Microsoft (MSFT.O) said on Fri­day an attack­er had won access to one of its cus­tomer-ser­vice agents and then used infor­ma­tion from that to launch hack­ing attempts against cus­tomers.

The com­pa­ny said it had found the com­pro­mise dur­ing its response to hacks by a team it iden­ti­fies as respon­si­ble for ear­li­er major breach­es at Solar­Winds (SWI.N) and Microsoft.

Microsoft said it had warned the affect­ed cus­tomers. A copy of one warn­ing seen by Reuters said the attack­er belonged to the group Microsoft calls Nobeli­um and that it had access dur­ing the sec­ond half of May.

“A sophis­ti­cat­ed Nation-State asso­ci­at­ed actor that Microsoft iden­ti­fies as NOBELLIUM accessed Microsoft cus­tomer sup­port tools to review infor­ma­tion regard­ing your Microsoft Ser­vices sub­scrip­tions,” the warn­ing reads in part. The U.S. gov­ern­ment has pub­licly attrib­uted the ear­li­er attacks to the Russ­ian gov­ern­ment, which denies involve­ment.

When Reuters asked about that warn­ing, Microsoft announced the breach pub­licly.

After com­ment­ing on a broad­er phish­ing cam­paign it said had com­pro­mised a small num­ber of enti­ties, Microsoft said it had also found the breach of its own agent, who it said had lim­it­ed pow­ers.

The agent could see billing con­tact infor­ma­tion and what ser­vices the cus­tomers pay for, among oth­er things.

“The actor used this infor­ma­tion in some cas­es to launch high­ly-tar­get­ed attacks as part of their broad­er cam­paign,” Microsoft said.

Microsoft warned affect­ed cus­tomers to be care­ful about com­mu­ni­ca­tions to their billing con­tacts and con­sid­er chang­ing those user­names and email address­es, as well as bar­ring old user­names from log­ging in.

Microsoft said it was aware of three enti­ties that had been com­pro­mised in the phish­ing cam­paign.

It did not imme­di­ate­ly clar­i­fy whether any had been among those whose data was viewed through the sup­port agent, or if the agent had been tricked by the broad­er cam­paign.

Microsoft did not say whether the agent was at a con­trac­tor or a direct employ­ee.

A spokesman said the lat­est breach by the threat actor was not part of Nobeli­um’s pre­vi­ous suc­cess­ful attack on Microsoft, in which it obtained some source code.

In the Solar­Winds attack, the group altered code at that com­pa­ny to access Solar­Winds cus­tomers, includ­ing nine U.S. fed­er­al agen­cies.

At the Solar­Winds cus­tomers and oth­ers, the attack­ers also took advan­tage of weak­ness­es in the way Microsoft pro­grams were con­fig­ured, accord­ing to the Depart­ment of Home­land Secu­ri­ty.

Microsoft lat­er said the group had com­pro­mised its own employ­ee accounts and tak­en soft­ware instruc­tions gov­ern­ing how Microsoft ver­i­fies user iden­ti­ties.

A White House offi­cial said the lat­est intru­sion and phish­ing cam­paign was far less seri­ous than the Solar­Winds fias­co.

“This appears to be large­ly unsuc­cess­ful, run-of-the-mill espi­onage,” the offi­cial said.

...

————

“Microsoft says new breach dis­cov­ered in probe of sus­pect­ed Solar­Winds hack­ers” by Joseph Menn; Reuters; 06/25/2021

““A sophis­ti­cat­ed Nation-State asso­ci­at­ed actor that Microsoft iden­ti­fies as NOBELLIUM accessed Microsoft cus­tomer sup­port tools to review infor­ma­tion regard­ing your Microsoft Ser­vices sub­scrip­tions,” the warn­ing reads in part. The U.S. gov­ern­ment has pub­licly attrib­uted the ear­li­er attacks to the Russ­ian gov­ern­ment, which denies involve­ment.”

Nobeli­um “accessed Microsoft cus­tomer sup­port tools to review infor­ma­tion.” That’s the lan­guage used by Microsoft to describe the hack­ing of its agent and use of the obtained infor­ma­tion to run tar­get­ed phish­ing cam­paigns. That’s what we know. What we don’t know is how the agent got hacked in the first place. Was is sim­ply exploit­ing a back­door cre­at­ed by the Solar­Winds hack? Microsoft isn’t say­ing. But we know Microsoft has pre­vi­ous­ly dis­closed that ‘Nobeli­um’ stole code involv­ing Microsoft­’s user ver­i­fi­ca­tion. And DHS tells us these same hack­ers are tak­ing advan­tage of weak­ness­es in the way Microsoft pro­grams were con­fig­ured. A lot of arrows are point­ing in the direc­tion of anoth­er Microsoft vul­ner­a­bil­i­ty being exploit­ed but as always we’re forced to guess:

...
A spokesman said the lat­est breach by the threat actor was not part of Nobeli­um’s pre­vi­ous suc­cess­ful attack on Microsoft, in which it obtained some source code.

...

At the Solar­Winds cus­tomers and oth­ers, the attack­ers also took advan­tage of weak­ness­es in the way Microsoft pro­grams were con­fig­ured, accord­ing to the Depart­ment of Home­land Secu­ri­ty.

Microsoft lat­er said the group had com­pro­mised its own employ­ee accounts and tak­en soft­ware instruc­tions gov­ern­ing how Microsoft ver­i­fies user iden­ti­ties.
...

The bad news sto­ries just keep pil­ing up. What’s next?

Backdoors aren’t Just Backdoors. They’re Digital Bombs Too.

What might be next is the ques­tion omi­nous­ly answered in a CBS News piece from July 4 that includes com­men­tary from Jon Miller, a for­mer hack­er who now runs a com­pa­ny called Bold­end tjat designs and sells cut­ting-edge cyber weapons to US intel­li­gence agen­cies. Accord­ing to Miller, what stood out for him in the Solar­Winds hack was­n’t the sophis­ti­ca­tion mal­ware. Miller claims to cre­ate much more sophis­ti­cat­ed mal­ware in his own work. What sur­prised him was the scope of the attack. Who­ev­er did this did­n’t even both­er try­ing to hide it and seemed to exe­cute it with no regard to the dam­age caused or poten­tial con­se­quences.

And then Miller drops the bomb: when asked if the hack­ers were capa­ble of doing more dam­age than they did and, for exam­ple, destroy all the com­put­ers on the net­work, Miller tells us that not only would that be pos­si­ble but it would be triv­ial. A few dozen addi­tion­al lines of code. So if the Solar­Winds hacks — or Microsoft Exchange hack­ers — want­ed to destroy the com­put­er sys­tems of orga­ni­za­tions around the world, they could have done so. Eas­i­ly.

The piece also include an inter­view of Brad Smith, pres­i­dent of Microsoft. Smith points to the numer­ous gov­ern­ment agen­cies to make the case that it must be a for­eign intel­li­gence operation‑, an obser­va­tion that sys­tem­at­i­cal­ly ignores all the non-gov­ern­ment com­mer­cial vic­tims that also got hit. Smith goes on to make an inter­est­ing defense of the US gov­ern­men­t’s inabil­i­ty to detect and stop the Solar­Winds hack: because the hack­ers launched the hack from US-based servers the NSA was­n’t legal­ly allowed to observe and pre­vent it. Domes­tic net­work secu­ri­ty in the US is the respon­si­bil­i­ty of the pri­vate sec­tor. How those poli­cies change in response to these mega-hacks will be some­thing to watch.

Then Smith issues a warn­ing that, when com­bined with Miller’s warn­ings about dig­i­tal bombs, should send chills down the spines of sys­tem admin­is­tra­tors every­where: Smith warns that its almost cer­tain the Solar­Winds hack­ers plant­ed addi­tion­al back­doors and spread to oth­er net­works. Keep in mind that Microsoft has been one of the lead inves­ti­ga­tors on this, so when Microsoft tells us the Solar­Winds hack­ers are prob­a­bly still resid­ing on these hacked net­works and spread to oth­ers that’s the kind of warn­ing we should take seri­ous­ly. So if you were hop­ing the dis­cov­ery of the Solar­Winds hack meant the clos­ing of all these back­doors on the net­works of thou­sands orga­ni­za­tions around the world your hopes should be dashed by now. Microsoft was basi­cal­ly telling us they don’t think they can real­is­ti­cal­ly expel the hack­ers from all these net­works. So if these hack­ers do decide to actu­al­ly destroy tens of thou­sands of hacked net­works around the world, or con­duct a glob­al ran­somware attack, they could prob­a­bly still do so:

CBS News

Solar­Winds: How Russ­ian spies hacked the Jus­tice, State, Trea­sury, Ener­gy and Com­merce Depart­ments

Bill Whitak­er reports on how Russ­ian spies used a pop­u­lar piece of soft­ware to unleash a virus that spread to 18,000 gov­ern­ment and pri­vate com­put­er net­works.

Cor­re­spon­dent Bill Whitak­er
2021 Jul 04

When Pres­i­dents Biden and Putin met in Gene­va last month – it was the first time that the threat of cyber war eclipsed that of nuclear war between the two old super-pow­ers… and “Solar­Winds” was one big rea­son why. Last year, in per­haps the most auda­cious cyber attack in his­to­ry, Russ­ian mil­i­tary hack­ers sab­o­taged a tiny piece of com­put­er code buried in a pop­u­lar piece of soft­ware called Solar­Winds. As we first report­ed in Feb­ru­ary, the hid­den virus spread to 18,000 gov­ern­ment and pri­vate com­put­er net­works by way of one of those soft­ware updates we all take for grant­ed. After it was installed, Russ­ian agents went rum­mag­ing through the dig­i­tal files of the U.S. depart­ments of Jus­tice, State, Trea­sury, Ener­gy, and Com­merce –among others—and for nine months, they had unfet­tered access to top-lev­el com­mu­ni­ca­tions, court doc­u­ments, even nuclear secrets.

Brad Smith: I think from a soft­ware engi­neer­ing per­spec­tive, it’s prob­a­bly fair to say that this is the largest and most sophis­ti­cat­ed attack the world has ever seen.

Brad Smith is pres­i­dent of Microsoft. He learned about the hack after the pres­i­den­tial elec­tion this past Novem­ber. By that time, the stealthy intrud­ers had spread through­out the tech giants’ com­put­er net­work and stolen some of its pro­pri­etary source code used to build its soft­ware prod­ucts. More alarm­ing: how the hack­ers got in… pig­gy-back­ing on a piece of third par­ty soft­ware used to con­nect, man­age and mon­i­tor com­put­er net­works.

Bill Whitak­er: What makes this so momen­tous?

Brad Smith: One of the real­ly dis­con­cert­ing aspects of this attack was the wide­spread and indis­crim­i­nate nature of it. What this attack­er did was iden­ti­fy net­work man­age­ment soft­ware from a com­pa­ny called Solar­Winds. They installed mal­ware into an update for a Solar­Winds prod­uct. When that update went out to 18,000 orga­ni­za­tions around the world, so did this mal­ware.

“Solar­Winds Ori­on” is one of the most ubiq­ui­tous soft­ware prod­ucts you prob­a­bly nev­er heard of, but to thou­sands of I.T. depart­ments world­wide, it’s indis­pens­able. It’s made up of mil­lions of lines of com­put­er code. 4,032 of them were clan­des­tine­ly re-writ­ten and dis­trib­uted to cus­tomers in a rou­tine update, open­ing up a secret back­door to the 18,000 infect­ed net­works. Microsoft has assigned 500 engi­neers to dig in to the attack. One com­pared it to a Rem­brandt paint­ing, the clos­er they looked, the more details emerged.

Brad Smith: When we ana­lyzed every­thing that we saw at Microsoft, we asked our­selves how many engi­neers have prob­a­bly worked on these attacks. And the answer we came to was, well, cer­tain­ly more than 1,000.

Bill Whitak­er: You guys are Microsoft. How did Microsoft miss this?

Brad Smith: I think that when you look at the sophis­ti­ca­tion of this attack­er there’s an asym­met­ric advan­tage for some­body play­ing offense.

Bill Whitak­er: Is it still going on?

Brad Smith: Almost cer­tain­ly, these attacks are con­tin­u­ing.

The world still might not know about the hack if not for Fire­Eye, a three-and-a-half bil­lion dol­lar cyber­se­cu­ri­ty com­pa­ny run by Kevin Man­dia, a for­mer Air Force intel­li­gence offi­cer.

...

They dis­cov­ered the mal­ware inside Solar­Winds and on Decem­ber 13 informed the world of the brazen attack.

Much of the dam­age had already been done. The U.S. Jus­tice Depart­ment acknowl­edged the Rus­sians spent months inside their com­put­ers access­ing email traf­fic – but the depart­ment won’t tell us exact­ly what was tak­en. It’s the same at Trea­sury, Com­merce, the NIH, Ener­gy. Even the agency that pro­tects and trans­ports our nuclear arse­nal. The hack­ers also hit the biggest names in high tech.

Bill Whitak­er: So, what does that tar­get list tell you?

Brad Smith: I think this tar­get list tells us that this is clear­ly a for­eign intel­li­gence agency. It expos­es the secrets poten­tial­ly of the Unit­ed States and oth­er gov­ern­ments as well as pri­vate com­pa­nies. I don’t think any­one knows for cer­tain how all of this infor­ma­tion will be used. But we do know this: It is in the wrong hands.

And Microsoft­’s Brad Smith told us it’s almost cer­tain the hack­ers cre­at­ed addi­tion­al back­doors and spread to oth­er net­works.

The rev­e­la­tion this past Decem­ber came at a fraught time in the U.S. Pres­i­dent Trump was dis­put­ing the elec­tion, and tweet­ed Chi­na might be respon­si­ble for the hack. With­in hours he was con­tra­dict­ed by his own sec­re­tary of state and attor­ney gen­er­al. They blamed Rus­sia. The Depart­ment of Home­land Secu­ri­ty, FBI and intel­li­gence agen­cies con­curred. The prime sus­pect: the SVR, one of sev­er­al Russ­ian spy agen­cies the U.S. labels “advanced per­sis­tent threats.” Rus­sia denies it was involved.

Brad Smith: I do think this was an act of reck­less­ness. The world runs on soft­ware. It runs on infor­ma­tion tech­nol­o­gy. But it can’t run with con­fi­dence if major gov­ern­ments are dis­rupt­ing and attack­ing the soft­ware sup­ply chain in this way.

Bill Whitak­er: That almost sounds like you think that they went in to foment chaos?

Brad Smith: What we are see­ing is the first use of this sup­ply chain dis­rup­tion tac­tic against the Unit­ed States. But it’s not the first time we’ve wit­nessed it. The Russ­ian gov­ern­ment real­ly devel­oped this tac­tic in Ukraine.

...

Bill Whitak­er: It’s hard to down­play the sever­i­ty of this.

Chris Inglis: It is hard to down­play the sever­i­ty of this. Because it’s only a stone’s throw from a com­put­er net­work attack.

Chris Inglis spent 28 years com­mand­ing the nation’s best cyber war­riors at the Nation­al Secu­ri­ty Agency – sev­en as its deputy direc­tor – and now sits on the Cyber­space Solar­i­um Com­mis­sion – cre­at­ed by Con­gress to come up with new ideas to defend our dig­i­tal domain.

Bill Whitak­er: Why did­n’t the gov­ern­ment detect this?

Chris Inglis: The gov­ern­ment is not look­ing on pri­vate sec­tor net­works. It does­n’t sur­veil pri­vate sec­tor net­works. That’s a respon­si­bil­i­ty that’s giv­en over to the pri­vate sec­tor. Fire­Eye found it on theirs, many oth­ers did not. The gov­ern­ment did not find it on their net­work, so that’s a dis­ap­point­ment.

Dis­ap­point­ment is an under­state­ment. The Depart­ment of Home­land Secu­ri­ty spent bil­lions on a pro­gram called “Ein­stein” to detect cyber attacks on gov­ern­ment agen­cies. The Rus­sians out­smart­ed it. They cir­cum­vent­ed the NSA, which gath­ers intel­li­gence over­seas, but is pro­hib­it­ed from sur­veilling U.S. com­put­er net­works. So the Rus­sians launched their attacks from servers set up anony­mous­ly in the Unit­ed States.

Bill Whitak­er: This hack hap­pened on Amer­i­can soil. It went through net­works based in the Unit­ed States. Are our defense capa­bil­i­ties con­strained?

Chris Inglis: U.S. Intel­li­gence Com­mu­ni­ty, U.S. Depart­ment of Defense, can sug­gest what the inten­tions of oth­er nations are based upon what they learn in their right­ful work over­seas. But they can’t turn around and focus their unblink­ing eye on the domes­tic infra­struc­ture. That winds up mak­ing it more dif­fi­cult for us.

...

It’s not every­day you meet some­one who builds cyber weapons as com­plex as those deployed by Russ­ian intel­li­gence. But Jon Miller, who start­ed off as a hack­er and now runs a com­pa­ny called Bold­end, designs and sells cut­ting-edge cyber weapons to U.S. intel­li­gence agen­cies.

Jon Miller: I build things much more sophis­ti­cat­ed than this. What’s impres­sive is the scope of it. This is a water­shed style attack. I would nev­er do some­thing like this. It cre­ates too much dam­age.

Miller says with the Solar­Winds attack, Rus­sia has demon­strat­ed that none of the soft­ware we take for grant­ed is tru­ly safe, includ­ing the apps on our tele­phones, lap­tops, and tablets. These days, he says, any device can be sab­o­taged.

Jon Miller: When you buy some­thing from a tech com­pa­ny, a new phone or a lap­top, you trust that that is secure when they give it to you. And what they’ve shown us in this attack is that is not the case. They have the abil­i­ty to com­pro­mise those sup­ply chains and manip­u­late what­ev­er they want. Whether it’s finan­cial data, source code, the func­tion­al­i­ty of these prod­ucts. They can take con­trol.

Bill Whitak­er: So, for instance, they could destroy all the com­put­ers on a net­work?

Jon Miller: Oh, eas­i­ly. The mal­ware that they deployed off of Solar­Winds, it did­n’t have the func­tion­al­i­ty in it to do that. But to do that is triv­ial. Cou­ple dozen lines of code.

...

———–

“Solar­Winds: How Russ­ian spies hacked the Jus­tice, State, Trea­sury, Ener­gy and Com­merce Depart­ments” by Bill Whitak­er; CBS News; 07/04/2021

“Much of the dam­age had already been done. The U.S. Jus­tice Depart­ment acknowl­edged the Rus­sians spent months inside their com­put­ers access­ing email traf­fic – but the depart­ment won’t tell us exact­ly what was tak­en. It’s the same at Trea­sury, Com­merce, the NIH, Ener­gy. Even the agency that pro­tects and trans­ports our nuclear arse­nal. The hack­ers also hit the biggest names in high tech.”

The Solar­Wind hack­ers spent months inside numer­ous US gov­ern­ment agency net­works. Pre­sum­ably from Feb­ru­ary 2020 until Decem­ber 2020. 10 or so months of emails. That’s a lot of gov­ern­ment emails. It makes the “Hillary’s emails” sto­ries sound like a sweet lul­la­by of yes­ter­year.

But the Solar­Winds hack was obvi­ous­ly not just tar­get­ing the US gov­ern­ment. Thou­sands of com­pa­nies were hit too. And yet, when asked, the Pres­i­dent of Microsoft insists, “I think this tar­get list tells us that this is clear­ly a for­eign intel­li­gence agency”. It’s what it looks like when every­one plays dumb pro­fes­sion­al­ly:

...
Bill Whitak­er: So, what does that tar­get list tell you?

Brad Smith: I think this tar­get list tells us that this is clear­ly a for­eign intel­li­gence agency. It expos­es the secrets poten­tial­ly of the Unit­ed States and oth­er gov­ern­ments as well as pri­vate com­pa­nies. I don’t think any­one knows for cer­tain how all of this infor­ma­tion will be used. But we do know this: It is in the wrong hands.

And Microsoft­’s Brad Smith told us it’s almost cer­tain the hack­ers cre­at­ed addi­tion­al back­doors and spread to oth­er net­works.

The rev­e­la­tion this past Decem­ber came at a fraught time in the U.S. Pres­i­dent Trump was dis­put­ing the elec­tion, and tweet­ed Chi­na might be respon­si­ble for the hack. With­in hours he was con­tra­dict­ed by his own sec­re­tary of state and attor­ney gen­er­al. They blamed Rus­sia. The Depart­ment of Home­land Secu­ri­ty, FBI and intel­li­gence agen­cies con­curred. The prime sus­pect: the SVR, one of sev­er­al Russ­ian spy agen­cies the U.S. labels “advanced per­sis­tent threats.” Rus­sia denies it was involved.
...

Also note how the fact that the Solar­Winds hack was con­duct­ed with US-based servers, and the fact that the NSA isn’t man­dat­ed with mon­i­tor­ing US net­works, is turn­ing into an argu­ment for giv­ing the NSA author­i­ty to mon­i­tor US net­works. This is a good to recall the sto­ry from ear­li­er this year about the DARPA projects involv­ing the cre­ation of autonomous anti-virus soft­ware that can tra­verse net­works that sound awful­ly sim­i­lar to the “Project TURBINE” plan for mass auto­mat­ed mal­ware implan­ta­tion. Auto­mat­ed ‘anti-mal­ware’ deliv­ered by good­ware. As ques­tions about the con­sti­tu­ion­al­i­ty of NSA mon­i­tor­ing of domes­tic net­works get raised, don’t be sur­prised if auto­mat­ed ‘good­ware’ solu­tions are offered:

...
Chris Inglis spent 28 years com­mand­ing the nation’s best cyber war­riors at the Nation­al Secu­ri­ty Agency – sev­en as its deputy direc­tor – and now sits on the Cyber­space Solar­i­um Com­mis­sion – cre­at­ed by Con­gress to come up with new ideas to defend our dig­i­tal domain.

Bill Whitak­er: Why did­n’t the gov­ern­ment detect this?

Chris Inglis: The gov­ern­ment is not look­ing on pri­vate sec­tor net­works. It does­n’t sur­veil pri­vate sec­tor net­works. That’s a respon­si­bil­i­ty that’s giv­en over to the pri­vate sec­tor. Fire­Eye found it on theirs, many oth­ers did not. The gov­ern­ment did not find it on their net­work, so that’s a dis­ap­point­ment.

Dis­ap­point­ment is an under­state­ment. The Depart­ment of Home­land Secu­ri­ty spent bil­lions on a pro­gram called “Ein­stein” to detect cyber attacks on gov­ern­ment agen­cies. The Rus­sians out­smart­ed it. They cir­cum­vent­ed the NSA, which gath­ers intel­li­gence over­seas, but is pro­hib­it­ed from sur­veilling U.S. com­put­er net­works. So the Rus­sians launched their attacks from servers set up anony­mous­ly in the Unit­ed States.

Bill Whitak­er: This hack hap­pened on Amer­i­can soil. It went through net­works based in the Unit­ed States. Are our defense capa­bil­i­ties con­strained?

Chris Inglis: U.S. Intel­li­gence Com­mu­ni­ty, U.S. Depart­ment of Defense, can sug­gest what the inten­tions of oth­er nations are based upon what they learn in their right­ful work over­seas. But they can’t turn around and focus their unblink­ing eye on the domes­tic infra­struc­ture. That winds up mak­ing it more dif­fi­cult for us.
...

Final­ly note the assess­ment about the rel­a­tive sophis­ti­ca­tion of the Solar­Winds source code by Jon Miller, the for­mer hack­er who now runs a com­pa­ny called Bold­end, designs and sells cut­ting-edge cyber weapons to U.S. intel­li­gence agen­cies. Miller was­n’t impressed by the sophis­ti­ca­tion. He admits to build­ing things much more sophis­ti­cat­ed (that is pre­sum­ably sold to US intel­li­gence agen­cies). What sur­prised Miller was the scale of the attack and that some­one actu­al­ly did some­thing that cre­at­ed so much dam­age. It’s the kind of response from an indus­try pro­fes­sion­al (who isn’t play­ing dumb pro­fes­sion­al­ly) that points towards a real­i­ty where large scale hacks of this nature have long been pos­si­ble, but assumed to be too inflam­ma­to­ry to exe­cute with­out incit­ing invit­ing seri­ous reper­cus­sions. As Miller point­ed out, this attack poten­tial­ly taint­ed the entire glob­al soft­ware sup­ply chain. The same com­pil­er attack that snuck the back­door into Solar­Wind­s’s Ori­on client tool could be reap­plied to the soft­ware being devel­oped by the tens of thou­sands of Solar­Winds cor­po­rate and gov­ern­ment clients. It real­ly was a mas­sive attack. But he’s not sur­prised some­one was able to pull it off tech­ni­cal­ly. He’s sur­prised some­one actu­al­ly did it. It’s an impor­tant dis­tinc­tion to keep in mind when assess­ing the nature of this attack. Thank­ful­ly, anoth­er pos­si­ble night­mare sce­nario was­n’t exe­cut­ed. That being a sce­nario where mal­ware is deployed that actu­al­ly caus­es these net­works to phys­i­cal­ly destroy them­selves. But it they could have if they want­ed to:

...
It’s not every­day you meet some­one who builds cyber weapons as com­plex as those deployed by Russ­ian intel­li­gence. But Jon Miller, who start­ed off as a hack­er and now runs a com­pa­ny called Bold­end, designs and sells cut­ting-edge cyber weapons to U.S. intel­li­gence agen­cies.

Jon Miller: I build things much more sophis­ti­cat­ed than this. What’s impres­sive is the scope of it. This is a water­shed style attack. I would nev­er do some­thing like this. It cre­ates too much dam­age.

Miller says with the Solar­Winds attack, Rus­sia has demon­strat­ed that none of the soft­ware we take for grant­ed is tru­ly safe, includ­ing the apps on our tele­phones, lap­tops, and tablets. These days, he says, any device can be sab­o­taged.

Jon Miller: When you buy some­thing from a tech com­pa­ny, a new phone or a lap­top, you trust that that is secure when they give it to you. And what they’ve shown us in this attack is that is not the case. They have the abil­i­ty to com­pro­mise those sup­ply chains and manip­u­late what­ev­er they want. Whether it’s finan­cial data, source code, the func­tion­al­i­ty of these prod­ucts. They can take con­trol.

Bill Whitak­er: So, for instance, they could destroy all the com­put­ers on a net­work?

Jon Miller: Oh, eas­i­ly. The mal­ware that they deployed off of Solar­Winds, it did­n’t have the func­tion­al­i­ty in it to do that. But to do that is triv­ial. Cou­ple dozen lines of code.
...

Miller is absolute­ly cor­rect. Solar­Winds was­n’t just the mega-hack of Solar­Winds and its thou­sands of clients. It was poten­tial­ly the hack of the glob­al tech­no­log­i­cal sup­ply chain. Some­one exe­cut­ed a very very big hack.

CitizenLab Issues a Warning to the World: Someone is Hacking the Sh*t Out of Microsoft. Legally. Meet Candiru

It was the mid­dle of July this year when the sto­ries of the mega-hacks took a sud­den turn. After months of dis­clos­ing (and deny­ing) one hack after anoth­er involv­ing a Microsoft vul­ner­a­bil­i­ty, Cit­i­zen­Lab had a dra­mat­ic, and the­mat­i­cal­ly appro­pri­ate, new secu­ri­ty warn­ing: a mer­ce­nary spy­ware com­pa­ny has been sell­ing an exploit used against Win­dows users in sev­er­al coun­tries, includ­ing Iran, Lebanon, Spain and the Unit­ed King­dom. Beyond that, the mal­ware has been found tar­get­ing activists, which isn’t par­tic­u­lar­ly sur­pris­ing giv­en the fact that Can­diru’s clients are gov­ern­ments. Can­diru’s exploits aren’t sole­ly against Microsoft prod­ucts. Google’s pop­u­lar Chrome brows­er is also a tar­get. But it sounds like Can­diru spe­cial­izes Microsoft prod­ucts.

Microsoft fixed the vul­ner­a­bil­i­ties iden­ti­fied in Cit­i­zen­Lab’s report. Curi­ous­ly, in its report on the fix, Microsoft nev­er refers to Can­diru by name. Instead, it refers to it as an “Israel-based pri­vate sec­tor offen­sive actor” which the com­pa­ny code­named Sour­gum. Google also issued a report on Can­diru’s tar­get­ing of activists and the zero-day exploits dis­cov­ered used against activists. Google also did­n’t refer to Can­diru by name.

So at least one Can­diru cus­tomer — but per­haps more than one — was run­ning around using zero-day exploits against activists and they got caught. Because it was blamed on Can­diru it could­n’t be attrib­uted to Rus­sia or Chi­na. So who got blamed for these dis­cov­ered hacks against activists? No one:

Reuters
Tech­nol­o­gy

Microsoft says Israeli group sold tools to hack Win­dows

Christo­pher Bing
July 15, 2021 4:45 PM CDT
Updat­ed

July 15 (Reuters) — An Israeli group sold a tool to hack into Microsoft Win­dows, Microsoft and tech­nol­o­gy human rights group Cit­i­zen Lab said on Thurs­day, shed­ding light on the grow­ing busi­ness of find­ing and sell­ing tools to hack wide­ly used soft­ware.

The hack­ing tool ven­dor, named Can­diru, cre­at­ed and sold a soft­ware exploit that can pen­e­trate Win­dows, one of many intel­li­gence prod­ucts sold by a secre­tive indus­try that finds flaws in com­mon soft­ware plat­forms for their clients, said a report by Cit­i­zen Lab.

Tech­ni­cal analy­sis by secu­ri­ty researchers details how Can­diru’s hack­ing tool spread around the globe to numer­ous unnamed cus­tomers, where it was then used to tar­get var­i­ous civ­il soci­ety orga­ni­za­tions, includ­ing a Sau­di dis­si­dent group and a left-lean­ing Indone­sian news out­let, the reports by Cit­i­zen Lab and Microsoft show.

...

Evi­dence of the exploit recov­ered by Microsoft Corp (MSFT.O) sug­gest­ed it was deployed against users in sev­er­al coun­tries, includ­ing Iran, Lebanon, Spain and the Unit­ed King­dom, accord­ing to the Cit­i­zen Lab report.

“Can­diru’s grow­ing pres­ence, and the use of its sur­veil­lance tech­nol­o­gy against glob­al civ­il soci­ety, is a potent reminder that the mer­ce­nary spy­ware indus­try con­tains many play­ers and is prone to wide­spread abuse,” Cit­i­zen Lab said in its report.

Microsoft fixed the dis­cov­ered flaws on Tues­day through a soft­ware update. Microsoft did not direct­ly attribute the exploits to Can­diru, instead refer­ring to it as an “Israel-based pri­vate sec­tor offen­sive actor” under the code­name Sour­gum.

“Sour­gum gen­er­al­ly sells cyber­weapons that enable its cus­tomers, often gov­ern­ment agen­cies around the world, to hack into their tar­gets’ com­put­ers, phones, net­work infra­struc­ture, and inter­net-con­nect­ed devices,” Microsoft wrote in a blog post. “These agen­cies then choose who to tar­get and run the actu­al oper­a­tions them­selves.”

Can­diru’s tools also exploit­ed weak­ness­es in oth­er com­mon soft­ware prod­ucts, like Google’s Chrome brows­er.

On Wednes­day, Google (GOOGL.O) released a blog post where it dis­closed two Chrome soft­ware flaws that Cit­i­zen Lab found con­nect­ed to Can­diru. Google also did not refer to Can­diru by name, but described it as a “com­mer­cial sur­veil­lance com­pa­ny.” Google patched the two vul­ner­a­bil­i­ties ear­li­er this year.

Cyber arms deal­ers like Can­diru often chain mul­ti­ple soft­ware vul­ner­a­bil­i­ties togeth­er to cre­ate effec­tive exploits that can reli­ably break into com­put­ers remote­ly with­out a tar­get’s knowl­edge, com­put­er secu­ri­ty experts say.

Those types of covert sys­tems cost mil­lions of dol­lars and are often sold on a sub­scrip­tion basis, mak­ing it nec­es­sary for cus­tomers to repeat­ed­ly pay a provider for con­tin­ued access, peo­ple famil­iar with the cyber arms indus­try told Reuters.

“No longer do groups need to have the tech­ni­cal exper­tise, now they just need resources,” Google wrote in its blog post.

———–

“Microsoft says Israeli group sold tools to hack Win­dows” by Christo­pher Bing; Reuters; 07/15/2021

““No longer do groups need to have the tech­ni­cal exper­tise, now they just need resources,” Google wrote in its blog post.”

Are you a gov­ern­ment with cash to burn? Wel­come to the world of elite hack­ers. Just be sure to main­tain your sub­scrip­tion fees.

Google’s researchers weren’t exag­ger­at­ing. It real­ly is just a mat­ter of hav­ing the resources — and per­mis­sion from the Israeli (and US?) government(s?) — for a gov­ern­ment to go from hav­ing vir­tu­al­ly no cyber capa­bil­i­ties to hav­ing a suite of zero-day exploits capa­ble of defeat­ing the top tech­nol­o­gy firms in the world.

And yet it’s kind of inter­est­ing that both Google and Microsoft did­n’t actu­al­ly name Can­diru in their reports. Microsoft refers to Can­diru with its own made up code­name Sour­gum. Although Microsoft does point out in its report that Cit­i­zen Lab iden­ti­fied the Sour­gum as Can­diru. But that’s the only ref­er­ence to Can­diru in the report. And Google’s report on Can­diru just refers to a “com­mer­cial sur­veil­lance com­pa­ny.” Recall that this is the same lan­guage Google used in its report on the three zero-day exploits dis­cov­ered tar­get­ing Arme­nia activists. So Google and Microsoft appear to go out of their way to avoid nam­ing names in its reports when the cul­prit is a pri­vate com­pa­ny:

...
Microsoft fixed the dis­cov­ered flaws on Tues­day through a soft­ware update. Microsoft did not direct­ly attribute the exploits to Can­diru, instead refer­ring to it as an “Israel-based pri­vate sec­tor offen­sive actor” under the code­name Sour­gum.

“Sour­gum gen­er­al­ly sells cyber­weapons that enable its cus­tomers, often gov­ern­ment agen­cies around the world, to hack into their tar­gets’ com­put­ers, phones, net­work infra­struc­ture, and inter­net-con­nect­ed devices,” Microsoft wrote in a blog post. “These agen­cies then choose who to tar­get and run the actu­al oper­a­tions them­selves.”

...

On Wednes­day, Google (GOOGL.O) released a blog post where it dis­closed two Chrome soft­ware flaws that Cit­i­zen Lab found con­nect­ed to Can­diru. Google also did not refer to Can­diru by name, but described it as a “com­mer­cial sur­veil­lance com­pa­ny.” Google patched the two vul­ner­a­bil­i­ties ear­li­er this year.
...

Also note how Can­diru’s toolk­it does­n’t just include an array of Microsoft exploits. It also hits oth­er com­mon non-Microsoft apps like Google’s Chrome. And as the arti­cle notes, cyber arms deal­ers like Can­diru often chain mul­ti­ple soft­ware vul­ner­a­bil­i­ties togeth­er to cre­ate effec­tive exploits. In oth­er words, these toolk­its have to con­sists of numer­ous zero-day exploits. That’s the under­ly­ing prod­uct these com­pa­nies are sell­ing: toolk­its that chain togeth­er mulit­ple zero-day exploits:

...
Can­diru’s tools also exploit­ed weak­ness­es in oth­er com­mon soft­ware prod­ucts, like Google’s Chrome brows­er.

...

Cyber arms deal­ers like Can­diru often chain mul­ti­ple soft­ware vul­ner­a­bil­i­ties togeth­er to cre­ate effec­tive exploits that can reli­ably break into com­put­ers remote­ly with­out a tar­get’s knowl­edge, com­put­er secu­ri­ty experts say.
...

Days after Microsoft was forced to patch these vul­ner­a­bil­i­ties, the com­pa­ny issued an update on the actions it was tak­ing against Can­diru’s mal­ware as well as the scope of the use of this mal­ware: Microsoft claimed it blocked tools used to spy on more than 100 peo­ple around the world, includ­ing politi­cians, human rights activists, jour­nal­ists, aca­d­e­mics and polit­i­cal dis­si­dents. Politi­cians got hit too. It’s not sur­pris­ing, but a notable admis­sion. Pre­ci­sion attacks were iden­ti­fied in the Pales­tin­ian ter­ri­to­ry, Israel, Iran, Lebanon, Yemen, Spain, the Unit­ed King­dom, Turkey, Arme­nia, and Sin­ga­pore.

Intrigul­ing, Cit­i­zen Lab said Candiru’s spy­ware infra­struc­ture includ­ed web­sites “mas­querad­ing as advo­ca­cy orga­ni­za­tions” such as Amnesty Inter­na­tion­al and Black Lives Mat­ter. So the next time you hear about a Black Lives Mat­ter web­site and it’s auto­mat­i­cal­ly attrib­uted to Russ­ian and the Inter­net Research Agency, keep this ‘fea­ture’ in mind. Can­diru was sell­ing tools specif­i­cal­ly to mim­ic left-wing orga­ni­za­tions. Also keep in mind that it’s Amnesty Inter­na­tion­al that releas­es a big NSO Group expose days after Can­diru’s mal­ware is revealed, so there’s prob­a­bly quite a few peo­ple in the cyber­se­cu­ri­ty indus­try itself with an inter­est in spy­ing on peo­ple affil­i­at­ed with Amnesty Inter­na­tion­al:

Asso­ci­at­ed Press

Microsoft says it blocked spy­ing on rights activists, oth­ers

By ALAN SUDERMAN
July 15, 2021

RICHMOND, Va. (AP) — Microsoft said Thurs­day it has blocked tools devel­oped by an Israeli hack­er-for-hire com­pa­ny that were used to spy on more than 100 peo­ple around the world, includ­ing politi­cians, human rights activists, jour­nal­ists, aca­d­e­mics and polit­i­cal dis­si­dents.

Microsoft issued a soft­ware update and worked with the Cit­i­zen Lab at the Uni­ver­si­ty of Toron­to to inves­ti­gate the secre­tive Israeli com­pa­ny behind the hack­ing efforts. Cit­i­zen Lab said the com­pa­ny goes by sev­er­al names includ­ing Can­diru, which accord­ing to leg­end is a par­a­sitic fish found in the Ama­zon that attacks human pri­vate parts.

Microsoft said peo­ple tar­get­ed in “pre­ci­sion attacks” by the spy­ware were locat­ed in the Pales­tin­ian ter­ri­to­ry, Israel, Iran, Lebanon, Yemen, Spain, the Unit­ed King­dom, Turkey, Arme­nia, and Sin­ga­pore. Microsoft did not name the tar­gets but described them gen­er­al­ly by cat­e­go­ry.

Cit­i­zen Lab said Candiru’s spy­ware infra­struc­ture includ­ed web­sites “mas­querad­ing as advo­ca­cy orga­ni­za­tions” such as Amnesty Inter­na­tion­al and Black Lives Mat­ter.

The reports by Microsoft and Cit­i­zen Lab shine new light on an opaque and lucra­tive indus­try of sell­ing sophis­ti­cat­ed hack­ing tools to gov­ern­ments and law enforce­ment agen­cies. Crit­ics say such tools are often mis­used by author­i­tar­i­an gov­ern­ments against inno­cent peo­ple.

“A world where pri­vate sec­tor com­pa­nies man­u­fac­ture and sell cyber­weapons is more dan­ger­ous for con­sumers, busi­ness­es of all sizes and gov­ern­ments,” Microsoft said in a blog post.

...

Microsoft said the busi­ness mod­el for com­pa­nies such as Can­diru is to sell its ser­vices to gov­ern­ment agen­cies, which then like­ly choose the tar­gets and run the oper­a­tions them­selves.

Cit­i­zen Lab pub­lished parts of what it said were a leaked pro­pos­al by Can­diru for hack­ing ser­vices that offered a la carte hack­ing options. For 16 mil­lion euros ($18.9 mil­lion), the com­pa­ny would allow the cus­tomer to mon­i­tor 10 devices simul­ta­ne­ous­ly in a sin­gle coun­try. For an extra 5.5 mil­lion euros ($6.5 mil­lion), 25 addi­tion­al devices could be mon­i­tored in five more coun­tries.

Cit­i­zen Lab said Candiru’s spy­ware tar­gets com­put­ers, mobile devices and cloud accounts.

Thursday’s dis­clo­sure by Microsoft was part of what the com­pa­ny said was a broad­er effort to “address the dan­gers” caused by hack­er-for-hire com­pa­nies. Microsoft is sup­port­ing Face­book in its law­suit against NSO Group, which is also based in Israel and is per­haps the most promi­nent pri­vate offen­sive spy­ware com­pa­ny.

Face­book filed a fed­er­al civ­il suit in 2019 alleged­ly that NSO Group tar­get­ed some 1,400 users of Facebook’s encrypt­ed mes­sag­ing ser­vice What­sApp with high­ly sophis­ti­cat­ed spy­ware.

————-

“Microsoft says it blocked spy­ing on rights activists, oth­ers” by ALAN SUDERMAN; Asso­ci­at­ed Press; 07/15/2021

“Microsoft issued a soft­ware update and worked with the Cit­i­zen Lab at the Uni­ver­si­ty of Toron­to to inves­ti­gate the secre­tive Israeli com­pa­ny behind the hack­ing efforts. Cit­i­zen Lab said the com­pa­ny goes by sev­er­al names includ­ing Can­diru, which accord­ing to leg­end is a par­a­sitic fish found in the Ama­zon that attacks human pri­vate parts.”

Can­diru is so secre­tive it uses secret iden­ti­ties. Secre­cy that’s prob­a­bly dri­ven, in part, by the fact that it’s craft­ing the dig­i­tal infra­struc­ture gov­ern­ments are using to hack civ­il soci­ety. Orga­ni­za­tions like Black LIves Mat­ter and Amnesty Inter­na­tion­al. That’s the kind of activ­i­ty one might hide from. Pre­sum­ably the util­i­ty of these fake web­sites is to direct peo­ple there to deliv­er the mal­ware which implies the tar­gets of this mal­ware were at least sym­pa­thet­ic to Black Lives Mat­ter and Amnesty Inter­na­tion­al. Just think about how many schemes tar­get­ing Black Lives Mat­ter attrib­uted to Russ­ian since 2016 that were actu­al­ly a prod­uct of Can­diru’s ready-to-use toolk­it. Or some oth­er “com­mer­cial sur­veil­lance ven­dor” sell­ing sim­i­lar tools:

...
Cit­i­zen Lab said Candiru’s spy­ware infra­struc­ture includ­ed web­sites “mas­querad­ing as advo­ca­cy orga­ni­za­tions” such as Amnesty Inter­na­tion­al and Black Lives Mat­ter.
...

And note the price. Yeah, your aver­age per­son can’t han­dle these kinds of sub­scrip­tion fees. But basi­cal­ly every gov­ern­ment on the plan­et can. Eas­i­ly:

...
Cit­i­zen Lab pub­lished parts of what it said were a leaked pro­pos­al by Can­diru for hack­ing ser­vices that offered a la carte hack­ing options. For 16 mil­lion euros ($18.9 mil­lion), the com­pa­ny would allow the cus­tomer to mon­i­tor 10 devices simul­ta­ne­ous­ly in a sin­gle coun­try. For an extra 5.5 mil­lion euros ($6.5 mil­lion), 25 addi­tion­al devices could be mon­i­tored in five more coun­tries.

Cit­i­zen Lab said Candiru’s spy­ware tar­gets com­put­ers, mobile devices and cloud accounts.
...

It’s too bad Cit­i­zen­Lab could­n’t get the actu­al sub­scrip­tion infor­ma­tion for Can­diru’s many clients to see just how many devices gov­ern­ments are pay­ing to hack. It’s almost $2 mil­lion per hacked device. That’s prob­a­bly a lot of peo­ple. And a lot of prof­it for Can­diru’s investors.

2021: Year of the Zero-Day

Just how much mon­ey is being made by this mer­ce­nary spy­ware indus­try? We’ll obvi­ous­ly nev­er know. But if the dis­cov­ery of new zero-day exploits are any indi­ca­tion of the indus­try’s work, we can say 2021 has been a robust year for the indus­try. As the fol­low­ing Threat­post piece from July 15 describes, there were 33 zero-day exploits report­ed by that date this year com­pared to 22 zero-day exploits in 2021 in total. At this point, 2021 will have triple the num­ber of zero-day exploits of 2020, and 2020 was a record year. There’s sim­ply been an explo­sion of dis­cov­ered zero-days. For exam­ple, at the same time Google issued its own mid-July report on Can­diru’s mal­ware being used against activist, it also dis­closed a new zero-day flaw against the iOS Safari brows­er that was tar­get­ing West­ern Euro­pean gov­ern­ment offi­cials. They note in the report that ‘Russ­ian-lan­guage actors’ were using the exploit at the same time ‘Nobeli­um’ was tar­get­ing users on Win­dows devices to deliv­er Cobalt Strike, sug­gest­ing the two are relat­ed.

Putting aside the already addressed prob­lems with plac­ing an empha­sis on the ‘cul­tur­al arti­fact’ lan­guage clues hack­ers leave, it’s worth not­ing that the Nobeli­um hack tar­get­ing users on Win­dows devices was a ref­er­ence to the USAID phish­ing attack. As we saw, Microsoft report­ed mul­ti­ple zero-day pieces of mal­ware deployed on the vic­tims’ net­works from the USAID attack. But Microsoft also report­ed the deploy­ment of Cobalt Strike in its ini­tial post about the phish­ing attack a day ear­li­er. Which should come as no sur­prise. Cobalt Strike, a legit­i­mate secu­ri­ty tool that finds vul­ner­a­bil­i­ties in net­works, has explod­ed in pop­u­lar­i­ty and gone main­stream among crim­i­nals. In oth­er words, we can’t infer much from the fact that both this iOS Safari hack and a hack attrib­uted to Nobeli­um both deployed Cobalt Strike. Cobalt Strike is what savvy cyber­crim­i­nals use these days, and there­fore not a trade­mark indi­ca­tor of a par­tic­u­lar actor. What is a notable coin­ci­dence between the USAID phish­ing hacks and the Safari hack is that both involve zero-day exploits. That’s the pri­ma­ry mean­ing­ful tech­ni­cal indi­ca­tor shared between all of the hacks we are dis­cussing here: Zero-day exploits were deployed. And yet, we can only infer so much. We don’t know who is devel­op­ing or deploy­ing all these zero-days. We just know it could be a much broad­er range of actors than just Russ­ian and Chi­na:

Threat­post

Safari Zero-Day Used in Mali­cious LinkedIn Cam­paign

Author: Eliz­a­beth Mon­tal­bano
July 15, 2021 7:04 am

Researchers shed light on how attack­ers exploit­ed Apple web brows­er vul­ner­a­bil­i­ties to tar­get gov­ern­ment offi­cials in West­ern Europe.

Threat actors used a Safari zero-day flaw to send mali­cious links to gov­ern­ment offi­cials in West­ern Europe via LinkedIn before researchers from Google dis­cov­ered and report­ed the vul­ner­a­bil­i­ty.

That’s the word from researchers from Google Threat Analy­sis Group (TAG) and Google Project Zero, who Wednes­day post­ed a blog shed­ding more light on sev­er­al zero-day flaws that they dis­cov­ered so far this year. Researchers in par­tic­u­lar detailed how attack­ers exploit­ed the vulnerabilities—the preva­lence of which are on the rise–before they were addressed by their respec­tive ven­dors.

TAG researchers dis­cov­ered the Safari WebKit flaw, tracked as CVE-?2021–1879, on March 19. The vul­ner­a­bil­i­ty allowed for the pro­cess­ing of mali­cious­ly craft­ed web con­tent for uni­ver­sal cross site script­ing and was addressed by Apple in an update lat­er that month.

Before the fix, researchers assert Russ­ian-lan­guage threat actors were exploit­ing the vul­ner­a­bil­i­ty in the wild by using LinkedIn Mes­sag­ing to send gov­ern­ment offi­cials from West­ern Euro­pean coun­tries mali­cious links that could col­lect web­site-authen­ti­ca­tion cook­ies, accord­ing to the post by Mad­die Stone and Clement Lecigne from Google TAG.

“If the tar­get vis­it­ed the link from an iOS device, they would be redi­rect­ed to an attack­er-con­trolled domain that served the next-stage pay­loads,” they wrote.

The exploit, which tar­get­ed iOS ver­sions 12.4 through 13.7, would turn off Same-Ori­gin-Pol­i­cy pro­tec­tions on an infect­ed device to col­lect authen­ti­ca­tion cook­ies from sev­er­al pop­u­lar websites–including Google, Microsoft, LinkedIn, Face­book and Yahoo–and then send them via Web­Sock­et to an attack­er-con­trolled IP, researchers wrote. The vic­tim would need to have a ses­sion open on these web­sites from Safari for cook­ies to be suc­cess­ful­ly exfil­trat­ed.

More­over, the cam­paign tar­get­ing iOS devices coin­cid­ed with oth­ers from the same threat actor—which Microsoft has iden­ti­fied as Nobelium–targeting users on Win­dows devices to deliv­er Cobalt Strike, researchers wrote. Secu­ri­ty firm Volex­i­ty described one of these attacks in a report post­ed online in May, the researchers added.

...

Oth­er Zero-Day Attacks

Google researchers also linked three addi­tion­al zero-day flaws they iden­ti­fied this year to a com­mer­cial sur­veil­lance ven­dor, accord­ing to Google TAG’s Shane Hunt­ley. Two of those vul­ner­a­bil­i­ties–CVE-2021–21166 and CVE-2021–30551—were found in Chrome, and one, tracked as CVE-2021–33742, in Inter­net Explor­er.

CVE-2021–21166 and CVE-2021–30551, two Chrome ren­dered remote-code exe­cu­tion (RCE) flaws, were iden­ti­fied sep­a­rate­ly but lat­er believed to be used by the same actor, researchers wrote in the blog. Google researchers dis­cov­ered the for­mer in Feb­ru­ary and the lat­ter in June.

“Both of these 0‑days were deliv­ered as one-time links sent by email to the tar­gets, all of whom we believe were in Arme­nia,” Stone and Lecigne wrote. “The links led to attack­er-con­trolled domains that mim­ic­ked legit­i­mate web­sites relat­ed to the tar­get­ed users.”

When prospec­tive vic­tims clicked the link, they were redi­rect­ed to a web­page that would fin­ger­print their device, col­lect sys­tem infor­ma­tion about the client, and gen­er­ate ECDH keys to encrypt the exploits, researchers wrote. This info—which includ­ed screen res­o­lu­tion, time­zone, lan­guages, brows­er plu­g­ins, and avail­able MIME types—would then be sent back to the exploit serv­er and used by attack­ers to decide whether or not an exploit should be deliv­ered to the tar­get, they said.

Researchers also iden­ti­fied a sep­a­rate cam­paigned in April that also tar­get­ed Armen­ian users by lever­ag­ing CVE-2021–26411, an RCE bug found in Inter­net Explor­er (IE). The cam­paign loaded web con­tent with­in IE that con­tained mali­cious Office doc­u­ments, researchers wrote.

“This hap­pened by either embed­ding a remote ActiveX object using a Shell.Explorer.1 OLE object or by spawn­ing an Inter­net Explor­er process via VBA macros to nav­i­gate to a web page,” Stone and Lecigne explained.

At the time, researchers said they were unable to recov­er the next-stage pay­load, but suc­cess­ful­ly recov­ered the exploit after dis­cov­er­ing an ear­ly June cam­paign from the same actors. Microsoft patched the flaw lat­er that month, they said.

Why There is an Increase in Zero-Days?

All in all, secu­ri­ty researchers have iden­ti­fied 33 zero-day flaws so far in 2021, which is 11 more than the total num­ber from 2020, accord­ing to the post.

While that trend reflects an increase in the num­ber of these types of vul­ner­a­bil­i­ties that exist, Google researchers “believe greater detec­tion and dis­clo­sure efforts are also con­tribut­ing to the upward trend,” they wrote.

Still, it’s high­ly pos­si­ble that attack­ers are indeed using more zero-day exploits for a few rea­sons, researchers not­ed. One is that the increase and mat­u­ra­tion of secu­ri­ty tech­nolo­gies and fea­tures means attack­ers also have to lev­el up, which in turn requires more zero-day vul­ner­a­bil­i­ties for func­tion­al attack chains, they said.

The growth of mobile plat­forms also has result­ed in an increase in the num­ber of prod­ucts that threat actors want to target—hence more rea­son to use zero-day exploits, researchers observed. Per­haps inspired by this increase in demand, com­mer­cial ven­dors also are sell­ing more access to zero-days than in the ear­ly 2010s, they said.

Final­ly, the mat­u­ra­tion of secu­ri­ty pro­tec­tions and strate­gies also inspires sophis­ti­ca­tion on the part of attack­ers as well, boost­ing the need for them to use zero-day flaws to con­vince vic­tims to install mal­ware, researchers not­ed.

“Due to advance­ments in secu­ri­ty, these actors now more often have to use 0‑day exploits to accom­plish their goals,” Stone and Lecigne wrote.

———-

“Safari Zero-Day Used in Mali­cious LinkedIn Cam­paign” by Eliz­a­beth Mon­tal­bano; Threat­post; 07/15/2021

“Before the fix, researchers assert Russ­ian-lan­guage threat actors were exploit­ing the vul­ner­a­bil­i­ty in the wild by using LinkedIn Mes­sag­ing to send gov­ern­ment offi­cials from West­ern Euro­pean coun­tries mali­cious links that could col­lect web­site-authen­ti­ca­tion cook­ies, accord­ing to the post by Mad­die Stone and Clement Lecigne from Google TAG.”

Russ­ian-lan­guage threat actors are behind the big vul­ner­a­bil­i­ty found in Safari tar­get­ing iPhones, accord­ing to Google’s Threat Assess­ment Group (TAG). Mali­cious links were sent via the LinkedIn Mes­sag­ing app to West­ern Euro­pean gov­ern­ment offi­cials that, when clicked, stole the authen­ti­ca­tion cre­den­tials for sites like Google, Microsoft, LinkedIn, Face­book and Yahoo. The kind of hack that opens the vic­tims up to more hacks, along with any orga­ni­za­tions they work for. And based on the tim­ing of this hack­ing cam­paign, and the fact that it coin­cid­ed with the ‘Nobeli­um’ USAID phish­ing cam­paign in May against Win­dows sys­tems that deliv­ered Cobalt Strike, sug­gests it’s the same actor behind both attacks.

But there’s a more sig­nif­i­cant tech­ni­cal link between the Safari hack­ing cam­paign tar­get­ing West­ern gov­ern­ment offi­cials and the USAID phish­ing cam­paign: both deployed zero-days. Microsoft report­ed the deploy­ment of Cobalt Strike in its ini­tial post about the hack but lat­er report­ed mul­ti­ple zero-day pieces of mal­ware deployed on the vic­tims’ net­works from the USAID attack. That’s the real ‘clue’ tying these two hacks. It was some­one sophis­ti­cat­ed enough to have an abun­dance of zero-day hacks. Except, with it’s not real­ly much of a clue the exis­tence of an indus­try filled with secre­tive com­pa­nies like Can­diru. Numer­ous actors on the stage have access to cut­ting-edge zero-days. For all we know the Safari zero-day cam­paign and USAID phish­ing cam­paigns could both be dif­fer­ent Can­diru cus­tomers using ‘Russ­ian lan­guage’ fea­tures to leave those ‘clues’ for Crowd­Strike and oth­ers to find:

...
More­over, the cam­paign tar­get­ing iOS devices coin­cid­ed with oth­ers from the same threat actor—which Microsoft has iden­ti­fied as Nobelium–targeting users on Win­dows devices to deliv­er Cobalt Strike, researchers wrote. Secu­ri­ty firm Volex­i­ty described one of these attacks in a report post­ed online in May, the researchers added.
...

Also note that the Microsoft zero-day exploits iden­ti­fied in a sep­a­rate cam­paign in April tar­get­ing Armen­ian activists is a ref­er­ences to the same Can­diru exploits Cit­i­zen­Lab was report­ing on. They aren’t all Microsoft vul­ner­a­bil­i­ties. Google’s Chrome brows­er was hit. But we’re hear­ing about vul­ner­a­bil­i­ties in Inter­net Explor­er, Office, and some oth­er mys­tery pay­load that could­n’t even be recov­ered ini­tial­ly. That’s a lot of Microsoft holes. It’s fits the Can­diru ‘pat­tern’:

...
Google researchers also linked three addi­tion­al zero-day flaws they iden­ti­fied this year to a com­mer­cial sur­veil­lance ven­dor, accord­ing to Google TAG’s Shane Hunt­ley. Two of those vul­ner­a­bil­i­ties–CVE-2021–21166 and CVE-2021–30551—were found in Chrome, and one, tracked as CVE-2021–33742, in Inter­net Explor­er.

CVE-2021–21166 and CVE-2021–30551, two Chrome ren­dered remote-code exe­cu­tion (RCE) flaws, were iden­ti­fied sep­a­rate­ly but lat­er believed to be used by the same actor, researchers wrote in the blog. Google researchers dis­cov­ered the for­mer in Feb­ru­ary and the lat­ter in June.

“Both of these 0‑days were deliv­ered as one-time links sent by email to the tar­gets, all of whom we believe were in Arme­nia,” Stone and Lecigne wrote. “The links led to attack­er-con­trolled domains that mim­ic­ked legit­i­mate web­sites relat­ed to the tar­get­ed users.”
...

All in all, it’s been such a parade of zero-day exploits that we’ve heard about this year hit­ting Microsoft that it should come as no sur­prise to learn that, just over mid way through this year there’s already been 50 per­cent more zero-days exploits announced than the entire year of 2020. That’s triple the pace of 2020 and 2020 was a record year. Why is this hap­pen­ing? Well, more report­ing is no doubt a fac­tor. But as the Google secu­ri­ty researcher admit, com­mer­cial ven­dors are sell­ing more access to zero-day exploits than they were a decade ago. There are sim­ply many more zero-day pieces of mal­ware in exis­tence and a grow­ing num­ber of actors with the abil­i­ty to deploy them:

...
All in all, secu­ri­ty researchers have iden­ti­fied 33 zero-day flaws so far in 2021, which is 11 more than the total num­ber from 2020, accord­ing to the post.

While that trend reflects an increase in the num­ber of these types of vul­ner­a­bil­i­ties that exist, Google researchers “believe greater detec­tion and dis­clo­sure efforts are also con­tribut­ing to the upward trend,” they wrote.

Still, it’s high­ly pos­si­ble that attack­ers are indeed using more zero-day exploits for a few rea­sons, researchers not­ed. One is that the increase and mat­u­ra­tion of secu­ri­ty tech­nolo­gies and fea­tures means attack­ers also have to lev­el up, which in turn requires more zero-day vul­ner­a­bil­i­ties for func­tion­al attack chains, they said.

The growth of mobile plat­forms also has result­ed in an increase in the num­ber of prod­ucts that threat actors want to target—hence more rea­son to use zero-day exploits, researchers observed. Per­haps inspired by this increase in demand, com­mer­cial ven­dors also are sell­ing more access to zero-days than in the ear­ly 2010s, they said.
...

We’ve seen a lot of omi­nous cyber warn­ings this year. But that stat of zero-days at triple last year’s rate is meta-omi­nous. It’s like the cyber ver­sion of the point in Mar­vel movies where the uni­verse on the cusp of explod­ing. Or implod­ing. Some­thing real­ly bad.

NSO Group: It’s Not Just a Cybermercenary. It’s a Tool of Israel’s Foreign Policy. A Very Important Tool MBS Covets

A cou­ple days lat­er, we get our first big NSO Group update of July. The New York Times has a piece giv­ing us a big update on the con­se­quences NSO Group paid over the role its Pega­sus soft­ware played in the killing of Sau­di dis­si­dent Jamal Khashog­gi. The com­pa­ny did pay a price. Or the own­ers. Although they were paid actu­al­ly: Fol­low­ing Khashog­gi’s killing, NSO Group inves­ti­ga­tion the Saudi’s use of its soft­ware and deter­mined the con­tract should be can­celed. And it was can­celed, at which point the full diplo­mat­ic nature of these ‘export licens­es’ became more appar­ent. The Israeli gov­ern­ment pres­sured NSO Group to renewed the Pega­sus con­tract. When that did­n’t hap­pen, the own­ers sold to a Euro­pean pri­vate equi­ty group and the Sau­di sub­scrip­tion to NSO Group’s tools was renewed. At the end of it all, the one par­ty involved with the Jamal Khashog­gi killing to pay a price was Khashog­gi:

The New York Times

Israeli Com­pa­nies Aid­ed Sau­di Spy­ing Despite Khashog­gi Killing

Ignor­ing con­cerns that Sau­di Ara­bia was abus­ing Israeli spy­ware to crush dis­sent at home and abroad, Israel encour­aged its com­pa­nies to work with the king­dom.

By Ronen Bergman and Mark Mazzetti
July 17, 2021

TEL AVIV — Israel secret­ly autho­rized a group of cyber-sur­veil­lance firms to work for the gov­ern­ment of Sau­di Ara­bia despite inter­na­tion­al con­dem­na­tion of the kingdom’s abuse of sur­veil­lance soft­ware to crush dis­sent, even after the Sau­di killing of the jour­nal­ist Jamal Khashog­gi, gov­ern­ment offi­cials and oth­ers famil­iar with the con­tracts said.

After the mur­der of Mr. Khashog­gi in 2018, one of the firms, NSO Group, can­celed its con­tracts with Sau­di Ara­bia amid accu­sa­tions that its hack­ing tools were being mis­used to abet heinous crimes.

But the Israeli gov­ern­ment encour­aged NSO and two oth­er com­pa­nies to con­tin­ue work­ing with Sau­di Ara­bia, and issued a new license for a fourth to do sim­i­lar work, over­rid­ing any con­cerns about human rights abus­es, accord­ing to one senior Israeli offi­cial and three peo­ple affil­i­at­ed with the com­pa­nies.

Since then, Sau­di Ara­bia has con­tin­ued to use the spy­ware to mon­i­tor dis­si­dents and polit­i­cal oppo­nents.

The fact that Israel’s gov­ern­ment has encour­aged its pri­vate com­pa­nies to do secu­ri­ty work for the king­dom — one of its his­toric adver­saries and a nation that still does not for­mal­ly rec­og­nize Israel — is yet more evi­dence of the reorder­ing of tra­di­tion­al alliances in the region and the strat­e­gy by Israel and sev­er­al Per­sian Gulf coun­tries to join forces to iso­late Iran.

NSO is by far the best known of the Israeli firms, large­ly because of rev­e­la­tions in the last few years that its Pega­sus pro­gram was used by numer­ous gov­ern­mens to spy on, and even­tu­al­ly imprison, human rights activists.

NSO sold Pega­sus to Sau­di Ara­bia in 2017. The king­dom used the spy­ware as part of a ruth­less cam­paign to crush dis­sent inside the king­dom and to hunt down Sau­di dis­si­dents abroad.

It is not pub­licly known whether Sau­di Ara­bia used Pega­sus or oth­er Israeli-made spy­ware in the plot to kill Mr. Khashog­gi. NSO has denied that its soft­ware was used.

Israel’s Min­istry of Defense also licensed for Sau­di work a com­pa­ny called Can­diru, which Microsoft accused last week of help­ing its gov­ern­ment clients spy on more than 100 jour­nal­ists, politi­cians, dis­si­dents and human rights advo­cates around the world.

Microsoft, which con­duct­ed its inves­ti­ga­tion in tan­dem with Cit­i­zen Lab, a research insti­tute at the Uni­ver­si­ty of Toron­to, said Can­diru had used mal­ware to exploit a vul­ner­a­bil­i­ty in Microsoft prod­ucts, enabling its gov­ern­ment clients to spy on per­ceived ene­mies.

Can­diru has had at least one con­tract with Sau­di Ara­bia since 2018.

Israel has also grant­ed licens­es to at least two oth­er firms, Verint, which was licensed before the Khashog­gi killing, and Quadream, which signed a con­tract with Sau­di Ara­bia after the killing.

A fifth com­pa­ny, Cellebrite, which man­u­fac­tures phys­i­cal hack­ing sys­tems for mobile phones, has also sold its ser­vices to the Sau­di gov­ern­ment, but with­out min­istry approval, accord­ing to the news­pa­per Haaretz.

Israel insists that if any Israeli spy­ware were used to vio­late civ­il rights that it would revoke the company’s license.

If the Defense Min­istry “dis­cov­ers that the pur­chased item is being used in con­tra­ven­tion of the terms of the license, espe­cial­ly after any vio­la­tion of human rights, a pro­ce­dure of can­cel­la­tion of the defense export license or of enforc­ing its terms is ini­ti­at­ed,” the min­istry said in a state­ment in response to ques­tions from The New York Times.

The min­istry declined to respond to spe­cif­ic ques­tions about the licens­es it gave to the Israeli firms, but said that “a wide range of secu­ri­ty, diplo­mat­ic and strate­gic con­sid­er­a­tions are tak­en into account” when con­sid­er­ing whether to grant a license to export offen­sive cyber tech­nol­o­gy.

Rev­e­la­tions about the abus­es of NSO prod­ucts led the com­pa­ny to hire a group of out­side con­sul­tants in 2018 to pro­vide advice about which new clients NSO should take on and which to avoid. The group includ­ed Daniel Shapiro, the for­mer Oba­ma admin­is­tra­tion ambas­sador to Israel, and Bea­con Glob­al Strate­gies, a Wash­ing­ton strate­gic con­sult­ing firm.

Bea­con is led by Jere­my Bash, a for­mer C.I.A. and Pen­ta­gon chief of staff; Michael Allen, a for­mer staff direc­tor for the House Intel­li­gence Com­mit­tee; and Andrew Shapiro, a for­mer top State Depart­ment offi­cial.

While the group’s man­date was to vet poten­tial new clients, the inter­na­tion­al out­rage over Mr. Khashoggi’s killing in Octo­ber 2018 led the group to advise NSO to can­cel its Sau­di con­tracts and shut down NSO sys­tems in the king­dom.

Sep­a­rate­ly, NSO con­duct­ed an inter­nal inves­ti­ga­tion into whether any of its tools were used by Sau­di offi­cials for the Khashog­gi oper­a­tion and con­clud­ed that they were not. How­ev­er a law­suit against NSO by a friend of Mr. Khashoggi’s claims that his phone had been hacked by Sau­di Ara­bia using Pega­sus, and that hack gave Sau­di offi­cials access to his con­ver­sa­tions with Mr. Khashog­gi, includ­ing com­mu­ni­ca­tions about oppo­si­tion projects.

Over sev­er­al days in late 2018, exec­u­tives both of NSO and the pri­vate equi­ty firm that owned it at the time, Fran­cis­co Part­ners, met in Wash­ing­ton with the advi­so­ry group.

Accord­ing to sev­er­al peo­ple famil­iar with the meet­ings, the NSO exec­u­tives argued that the Israeli gov­ern­ment was strong­ly encour­ag­ing the com­pa­ny to weath­er the storm and con­tin­ue its work in Sau­di Ara­bia. They also said that Israeli offi­cials had indi­cat­ed to them that the Trump admin­is­tra­tion also want­ed NSO’s work with Sau­di Ara­bia to con­tin­ue.

In the end, NSO man­age­ment heed­ed the advice of the out­side group and can­celed its con­tracts with Sau­di Ara­bia in late 2018. Mr. Shapiro, the for­mer ambas­sador to Israel, end­ed his work for the com­pa­ny short­ly after­ward.

Months lat­er, how­ev­er, after anoth­er pri­vate equi­ty firm bought NSO, the com­pa­ny was once again doing busi­ness with Sau­di Ara­bia.

NSO’s new own­er, Novalpina, reject­ed the advice of the out­side advi­so­ry group and NSO resumed its work in Sau­di Ara­bia in mid-2019. Around that time, Bea­con end­ed its work with NSO.

The new con­tract with the Saud­is came with some restric­tions. For exam­ple, NSO set up its sys­tem to block any attempts by Sau­di offi­cials to hack Euro­pean tele­phone num­bers, accord­ing to a per­son famil­iar with the pro­gram­ming.

But it is clear that Sau­di Ara­bia has con­tin­ued to use NSO soft­ware to spy on per­ceived oppo­nents abroad.

In one case that has come to light, three dozen phones belong­ing to jour­nal­ists at Al Jazeera, which Sau­di Ara­bia con­sid­ers a threat, were hacked using NSO’s Pega­sus soft­ware last year, accord­ing to Cit­i­zen Lab. Cit­i­zen Lab traced 18 of the attacks back to Sau­di intel­li­gence.

After the rev­e­la­tion of the attack on Al Jazeera jour­nal­ists, NSO recent­ly shut down the sys­tem, and at a meet­ing in ear­ly July, the company’s board decid­ed to declare new deals with Sau­di Ara­bia off lim­its, accord­ing to a per­son famil­iar with the deci­sion.

Israel’s defense min­istry is cur­rent­ly fight­ing law­suits by Israeli rights activists demand­ing that it release details about its process for grant­i­ng the licens­es.

The Israeli gov­ern­ment also impos­es strict secre­cy on the com­pa­nies that receive the licens­es, threat­en­ing to revoke them if the com­pa­nies speak pub­licly about the iden­ti­ty of their clients.

...

These busi­ness ties came as Israel was qui­et­ly build­ing rela­tion­ships direct­ly with the Sau­di gov­ern­ment.

Ben­jamin Netanyahu, then Israel’s prime min­is­ter, met sev­er­al times with Sau­di Arabia’s day-to-day ruler, Crown Prince Mohammed bin Salman, and mil­i­tary and intel­li­gence lead­ers of the two coun­tries meet fre­quent­ly.

While Sau­di Ara­bia was not offi­cial­ly par­ty to the Abra­ham Accords — the diplo­mat­ic ini­tia­tives dur­ing the end of the Trump admin­is­tra­tion nor­mal­iz­ing rela­tions between Israel and sev­er­al Arab coun­tries — Sau­di lead­ers worked behind the scenes to help bro­ker the deals.

————–

“Israeli Com­pa­nies Aid­ed Sau­di Spy­ing Despite Khashog­gi Killing” by Ronen Bergman and Mark Mazzetti; The New York Times; 07/17/2021

“The fact that Israel’s gov­ern­ment has encour­aged its pri­vate com­pa­nies to do secu­ri­ty work for the king­dom — one of its his­toric adver­saries and a nation that still does not for­mal­ly rec­og­nize Israel — is yet more evi­dence of the reorder­ing of tra­di­tion­al alliances in the region and the strat­e­gy by Israel and sev­er­al Per­sian Gulf coun­tries to join forces to iso­late Iran.”

It was­n’t just a nation­al secu­ri­ty tool. Pega­sus was effec­tive­ly being used as a diplo­mat­ic tool. A diplo­mat­ic tool to help bring Sau­di Ara­bia and oth­er Per­sian Gulf neighors into an alliance against Iran. Which, we’ll recall, was the meta-theme through­out the #TrumpRus­sia adven­tures involv­ing Michael Fly­nn, Eric Prince, Michael Cohen, and the Saudi/UAE scheme to build nuclear pow­er plants across the Mid­dle East (except for Iran). The secu­ri­ty rela­tion­ship between the US, Israel, Sau­di Ara­bia, and the UAE got a lot deep­er over the last decade and it’s hard to avoid sus­pi­cions that shar­ing access to super spy­ware tools like NSO Group’s Pega­sus was part of that deep­en­ing rela­tion­ship. Just look at the lan­guage the Israeli Defense Min­istry used when describ­ing the process that goes into approv­ing one of these licens­es: ““a wide range of secu­ri­ty, diplo­mat­ic and strate­gic con­sid­er­a­tions are tak­en into account” when con­sid­er­ing whether to grant a license to export offen­sive cyber tech­nol­o­gy.” That’s one way to put it:

...
Israel insists that if any Israeli spy­ware were used to vio­late civ­il rights that it would revoke the company’s license.

If the Defense Min­istry “dis­cov­ers that the pur­chased item is being used in con­tra­ven­tion of the terms of the license, espe­cial­ly after any vio­la­tion of human rights, a pro­ce­dure of can­cel­la­tion of the defense export license or of enforc­ing its terms is ini­ti­at­ed,” the min­istry said in a state­ment in response to ques­tions from The New York Times.

The min­istry declined to respond to spe­cif­ic ques­tions about the licens­es it gave to the Israeli firms, but said that “a wide range of secu­ri­ty, diplo­mat­ic and strate­gic con­sid­er­a­tions are tak­en into account” when con­sid­er­ing whether to grant a license to export offen­sive cyber tech­nol­o­gy.
...

And as we saw, NSO Group isn’t the only com­pa­ny with hack­ing tools the Israeli gov­ern­ment was licens­ing to Sau­di Ara­bia at this time. One com­pa­ny, Quadream, even signed its con­tracts with Sau­di Ara­bia after Khoshog­gi’s killing. So when the NSO Group claims that it can­celed the Sau­di con­tracts in the wake of the Khashog­gi killings, but were then encour­age by the Israeli gov­ern­ment to con­tin­ue work­ing with Sau­di Ara­bia, it’s not an implau­si­ble sce­nario. The licens­ing of cut­ting-edge hack­ing tools is clear­ly part of the Israeli diplo­mat­ic play­book. Which isn’t a sur­prise. It’s a pow­er­ful diplo­mat­ic tool. Crazy dan­ger­ous, but pow­er­ful:

...
After the mur­der of Mr. Khashog­gi in 2018, one of the firms, NSO Group, can­celed its con­tracts with Sau­di Ara­bia amid accu­sa­tions that its hack­ing tools were being mis­used to abet heinous crimes.

But the Israeli gov­ern­ment encour­aged NSO and two oth­er com­pa­nies to con­tin­ue work­ing with Sau­di Ara­bia, and issued a new license for a fourth to do sim­i­lar work, over­rid­ing any con­cerns about human rights abus­es, accord­ing to one senior Israeli offi­cial and three peo­ple affil­i­at­ed with the com­pa­nies.

Since then, Sau­di Ara­bia has con­tin­ued to use the spy­ware to mon­i­tor dis­si­dents and polit­i­cal oppo­nents.

...

NSO sold Pega­sus to Sau­di Ara­bia in 2017. The king­dom used the spy­ware as part of a ruth­less cam­paign to crush dis­sent inside the king­dom and to hunt down Sau­di dis­si­dents abroad.

...

Israel’s Min­istry of Defense also licensed for Sau­di work a com­pa­ny called Can­diru, which Microsoft accused last week of help­ing its gov­ern­ment clients spy on more than 100 jour­nal­ists, politi­cians, dis­si­dents and human rights advo­cates around the world.

...

Israel has also grant­ed licens­es to at least two oth­er firms, Verint, which was licensed before the Khashog­gi killing, and Quadream, which signed a con­tract with Sau­di Ara­bia after the killing.

A fifth com­pa­ny, Cellebrite, which man­u­fac­tures phys­i­cal hack­ing sys­tems for mobile phones, has also sold its ser­vices to the Sau­di gov­ern­ment, but with­out min­istry approval, accord­ing to the news­pa­per Haaretz.

...

The Israeli gov­ern­ment also impos­es strict secre­cy on the com­pa­nies that receive the licens­es, threat­en­ing to revoke them if the com­pa­nies speak pub­licly about the iden­ti­ty of their clients.
...

But, again, the sale of this kind of super-hack­ing soft­ware to gov­ern­ments around the world prob­a­bly was­n’t just an Israeli gov­ern­ment project. The US gov­ern­ment would almost sure­ly have involved in giv­ing its approval, if infor­mal­ly. So we should­n’t be sur­prised to learn NSO Group hired DC-based Bea­con Glob­al Strate­gies — led by fig­ures US nation­al secu­ri­ty state com­mu­ni­ty fig­ure­heads like Jere­my Bash — to effec­tive­ly give its bless­ings to NSO Group’s more con­tro­ver­sial clients. The pic­ture that emerges from the var­i­ous accounts of NSO Group’s inter­nal delib­er­a­tions is a pic­ture where NSO Group want­ed to drop the con­tract but was feel­ing like it was effec­tive­ly being asked by the Israeli gov­ern­ment and Trump admin­is­tra­tion to con­tin­ue the Sau­di con­tract:

...
Rev­e­la­tions about the abus­es of NSO prod­ucts led the com­pa­ny to hire a group of out­side con­sul­tants in 2018 to pro­vide advice about which new clients NSO should take on and which to avoid. The group includ­ed Daniel Shapiro, the for­mer Oba­ma admin­is­tra­tion ambas­sador to Israel, and Bea­con Glob­al Strate­gies, a Wash­ing­ton strate­gic con­sult­ing firm.

Bea­con is led by Jere­my Bash, a for­mer C.I.A. and Pen­ta­gon chief of staff; Michael Allen, a for­mer staff direc­tor for the House Intel­li­gence Com­mit­tee; and Andrew Shapiro, a for­mer top State Depart­ment offi­cial.

While the group’s man­date was to vet poten­tial new clients, the inter­na­tion­al out­rage over Mr. Khashoggi’s killing in Octo­ber 2018 led the group to advise NSO to can­cel its Sau­di con­tracts and shut down NSO sys­tems in the king­dom.

Sep­a­rate­ly, NSO con­duct­ed an inter­nal inves­ti­ga­tion into whether any of its tools were used by Sau­di offi­cials for the Khashog­gi oper­a­tion and con­clud­ed that they were not. How­ev­er a law­suit against NSO by a friend of Mr. Khashoggi’s claims that his phone had been hacked by Sau­di Ara­bia using Pega­sus, and that hack gave Sau­di offi­cials access to his con­ver­sa­tions with Mr. Khashog­gi, includ­ing com­mu­ni­ca­tions about oppo­si­tion projects.

Over sev­er­al days in late 2018, exec­u­tives both of NSO and the pri­vate equi­ty firm that owned it at the time, Fran­cis­co Part­ners, met in Wash­ing­ton with the advi­so­ry group.

Accord­ing to sev­er­al peo­ple famil­iar with the meet­ings, the NSO exec­u­tives argued that the Israeli gov­ern­ment was strong­ly encour­ag­ing the com­pa­ny to weath­er the storm and con­tin­ue its work in Sau­di Ara­bia. They also said that Israeli offi­cials had indi­cat­ed to them that the Trump admin­is­tra­tion also want­ed NSO’s work with Sau­di Ara­bia to con­tin­ue.
....

And then, at the end of all that con­sult­ing about what to do about its Sau­di con­tract, NSO Group can­celed the con­tract. Months lat­er the com­pa­ny is sold to a new pri­vate equi­ty group and the con­tract is re-opened. The com­mit­ment on behalf of the Israeli gov­ern­ment and Trump admin­is­tra­tion to pro­vid­ing Sau­di Ara­bia with these hack­ing tools was so intense that NSO Group some­how found a new own­er who was open to that Sau­di con­tract:

...
In the end, NSO man­age­ment heed­ed the advice of the out­side group and can­celed its con­tracts with Sau­di Ara­bia in late 2018. Mr. Shapiro, the for­mer ambas­sador to Israel, end­ed his work for the com­pa­ny short­ly after­ward.

Months lat­er, how­ev­er, after anoth­er pri­vate equi­ty firm bought NSO, the com­pa­ny was once again doing busi­ness with Sau­di Ara­bia.

NSO’s new own­er, Novalpina, reject­ed the advice of the out­side advi­so­ry group and NSO resumed its work in Sau­di Ara­bia in mid-2019. Around that time, Bea­con end­ed its work with NSO.

The new con­tract with the Saud­is came with some restric­tions. For exam­ple, NSO set up its sys­tem to block any attempts by Sau­di offi­cials to hack Euro­pean tele­phone num­bers, accord­ing to a per­son famil­iar with the pro­gram­ming.

But it is clear that Sau­di Ara­bia has con­tin­ued to use NSO soft­ware to spy on per­ceived oppo­nents abroad.
...

It’s worth keep­ing in mind that it’s pos­si­ble Sau­di Ara­bia was task with a sim­i­lar role to one Israel has long played in the West­ern alliance: spy­ing on oth­er West­ern allies. Might that be part of the rea­son Israel and the US were insis­tent Sau­di Ara­bia get access to these tools? Out­source the out­source ally-spy­ing? Per­haps.

It’s also pos­si­ble the Saud­is were mak­ing access to NSO Group tools a require­ment for the broad­er Mid­dle East peace plan the Trump admin­is­tra­tion and Jared Kush­n­er were work­ing on and this sto­ry reflects those unusu­al cir­cum­stances the US and Israel were acqui­esc­ing to those demands. But these aren’t nor­mal demands. These are tools approach­ing the NSA and GCHQ capa­bil­i­ties in many respects. It’s hard to imag­ine the US and Israel casu­al­ly giv­ing this kind of pow­er away, even to a long-stand­ing mil­i­tary ally like Sau­di Ara­bia. That’s part why ques­tions about deep­er intel­li­gence-shar­ing pacts and/or illic­it quid-pro-quo spy­ing arrange­ments are so intrigu­ing in this sto­ry. NSO Group was ped­dling dig­i­tal nuclear weapons. That could­n’t have been treat­ed light­ly by the US and Israel. And yet 40 or so gov­ern­ments got their hands on these dig­i­tal nuclear weapons. What kind of arrange­ments were made to ensure the inevitable abus­es of these tools don’t tar­get US and Israeli inter­ests? A promise not to abuse it? It’s a mas­sive ques­tion loom­ing over this sto­ry (and the answers point towards lit­tle more than promis­es).

NSO Group’s Worst Nightmare: Sunshine. Lots of Sunshine on Its Shady Activities from Forbidden Stories and Amnesty International

A day after that explo­sive NY Times report, the Wash­ing­ton Post brings us a write up of a huge new inves­ti­ga­tion released by For­bid­den Sto­ries, a Paris-based jour­nal­ism non­prof­it, and Amnesty Inter­na­tion­al, based on thou­sands phone num­bers leaked that were pur­port­ed­ly the tar­get phone num­bers of NSO Group’s feared Pega­sus spy­ware. Phone num­bers that, as we’ll see, include major world lead­ers like Emmanuel Macron. And if those thou­sands of num­bers real­ly are an accu­rate tar­get list, it was ram­pant abuse, with activists and rival politi­cians fre­quent­ly on the tar­get list. There’s also a new unstop­pable zero-day exploit that worked sim­ply by send­ing a SMS text mes­sage or iMes­sage to smart­phones. 60 gov­ern­ment agen­cies in 40 coun­tries were allowed to buy sub­scrip­tions to the soft­ware and, again, they policed them­selves. It start­ed with Mex­i­co get­ting a sub­scrip­tion in 2011. So the Pega­sus super spy­ware has been sold for a decade now to a grow­ing list of gov­ern­ment agen­cies. Those unlucky Armen­ian activists had a lot of com­pa­ny.

What is NSO Group’s response to this report? By point­ing out that it’s up to the gov­ern­ments to decide who gets tar­get­ed and NSO Group does­n’t know. And while that may not be the best response to the crit­i­cism since it’s more or less an admis­sion the abuse alle­ga­tions are like­ly true, it’s an entire­ly plau­si­ble response. NSO Group’s tools are prob­a­bly entire­ly con­trolled by the gov­ern­ments who buy these sub­scrip­tions. It’s absurd to expect gov­ern­ments to hand infor­ma­tion like their intel­li­gence tar­gets over to NSO Group. That’s part of what’s so scan­dalous about this indus­try sup­ply super-spy­ware to gov­ern­ments: it’s hard to imag­ine a sce­nario where there’s mean­ing­ful over­sight pos­si­ble. It’s an indus­try built for unchecked secre­cy by the clients and that’s an indus­try built for abuse.

And yet we are told there are geolo­ca­tion restric­tions on the soft­ware and US-based smart­phones can’t be tar­get­ed by NSO Group’s tools. The phone num­ber list in the report appears to bear that out. So there is some degree of over­sight, sole­ly based on loca­tion. But that’s it. All oth­er over­sight is up to the client, hence all the activists, jour­nal­ists, and polit­i­cal oppo­nent phone num­bers that show up on the tar­get list:

The Wash­ing­ton Post

Pri­vate Israeli spy­ware used to hack cell­phones of jour­nal­ists, activists world­wide

NSO Group’s Pega­sus spy­ware, licensed to gov­ern­ments around the globe, can infect phones with­out a click

By Dana Priest, Craig Tim­berg and Souad Mekhen­net

Updat­ed July 18 at 8:15 p.m. Orig­i­nal­ly pub­lished July 18, 2021

Mil­i­tary-grade spy­ware licensed by an Israeli firm to gov­ern­ments for track­ing ter­ror­ists and crim­i­nals was used in attempt­ed and suc­cess­ful hacks of 37 smart­phones belong­ing to jour­nal­ists, human rights activists, busi­ness exec­u­tives and two women close to mur­dered Sau­di jour­nal­ist Jamal Khashog­gi, accord­ing to an inves­ti­ga­tion by The Wash­ing­ton Post and 16 media part­ners.

The phones appeared on a list of more than 50,000 num­bers that are con­cen­trat­ed in coun­tries known to engage in sur­veil­lance of their cit­i­zens and also known to have been clients of the Israeli firm, NSO Group, a world­wide leader in the grow­ing and large­ly unreg­u­lat­ed pri­vate spy­ware indus­try, the inves­ti­ga­tion found.

The list does not iden­ti­fy who put the num­bers on it, or why, and it is unknown how many of the phones were tar­get­ed or sur­veilled. But foren­sic analy­sis of the 37 smart­phones shows that many dis­play a tight cor­re­la­tion between time stamps asso­ci­at­ed with a num­ber on the list and the ini­ti­a­tion of sur­veil­lance, in some cas­es as brief as a few sec­onds.

For­bid­den Sto­ries, a Paris-based jour­nal­ism non­prof­it, and Amnesty Inter­na­tion­al, a human rights group, had access to the list and shared it with the news orga­ni­za­tions, which did fur­ther research and analy­sis. Amnesty’s Secu­ri­ty Lab did the foren­sic analy­ses on the smart­phones.

The num­bers on the list are unat­trib­uted, but reporters were able to iden­ti­fy more than 1,000 peo­ple span­ning more than 50 coun­tries through research and inter­views on four con­ti­nents: sev­er­al Arab roy­al fam­i­ly mem­bers, at least 65 busi­ness exec­u­tives, 85 human rights activists, 189 jour­nal­ists, and more than 600 politi­cians and gov­ern­ment offi­cials — includ­ing cab­i­net min­is­ters, diplo­mats, and mil­i­tary and secu­ri­ty offi­cers. The num­bers of sev­er­al heads of state and prime min­is­ters also appeared on the list.

Among the jour­nal­ists whose num­bers appear on the list, which dates to 2016, are reporters work­ing over­seas for sev­er­al lead­ing news orga­ni­za­tions, includ­ing a small num­ber from CNN, the Asso­ci­at­ed Press, Voice of Amer­i­ca, the New York Times, the Wall Street Jour­nal, Bloomberg News, Le Monde in France, the Finan­cial Times in Lon­don and Al Jazeera in Qatar.

The tar­get­ing of the 37 smart­phones would appear to con­flict with the stat­ed pur­pose of NSO’s licens­ing of the Pega­sus spy­ware, which the com­pa­ny says is intend­ed only for use in sur­veilling ter­ror­ists and major crim­i­nals. The evi­dence extract­ed from these smart­phones, revealed here for the first time, calls into ques­tion pledges by the Israeli com­pa­ny to police its clients for human rights abus­es.

The media con­sor­tium, titled the Pega­sus Project, ana­lyzed the list through inter­views and foren­sic analy­sis of the phones, and by com­par­ing details with pre­vi­ous­ly report­ed infor­ma­tion about NSO. Amnesty’s Secu­ri­ty Lab exam­ined 67 smart­phones where attacks were sus­pect­ed. Of those, 23 were suc­cess­ful­ly infect­ed and 14 showed signs of attempt­ed pen­e­tra­tion.

For the remain­ing 30, the tests were incon­clu­sive, in sev­er­al cas­es because the phones had been replaced. Fif­teen of the phones were Android devices, none of which showed evi­dence of suc­cess­ful infec­tion. How­ev­er, unlike iPhones, Androids do not log the kinds of infor­ma­tion required for Amnesty’s detec­tive work. Three Android phones showed signs of tar­get­ing, such as Pega­sus-linked SMS mes­sages.

Amnesty shared back­up copies of data on four iPhones with Cit­i­zen Lab, which con­firmed that they showed signs of Pega­sus infec­tion. Cit­i­zen Lab, a research group at the Uni­ver­si­ty of Toron­to that spe­cial­izes in study­ing Pega­sus, also con­duct­ed a peer review of Amnesty’s foren­sic meth­ods and found them to be sound.

In lengthy respons­es before pub­li­ca­tion, NSO called the investigation’s find­ings exag­ger­at­ed and base­less. It also said it does not oper­ate the spy­ware licensed to its clients and “has no insight” into their spe­cif­ic intel­li­gence activ­i­ties.

After pub­li­ca­tion, NSO chief exec­u­tive Shalev Hulio expressed con­cern in a phone inter­view with The Post about some of the details he had read in Pega­sus Project sto­ries Sun­day, while con­tin­u­ing to dis­pute that the list of more than 50,000 phone num­bers had any­thing to do with NSO or Pega­sus.

“The com­pa­ny cares about jour­nal­ists and activists and civ­il soci­ety in gen­er­al,” Hulio said. “We under­stand that in some cir­cum­stances our cus­tomers might mis­use the sys­tem and, in some cas­es like we report­ed in [NSO’s] Trans­paren­cy and Respon­si­bil­i­ty Report, we have shut down sys­tems for cus­tomers who have mis­used the sys­tem.”

He said that in the past 12 months NSO had ter­mi­nat­ed two con­tracts over alle­ga­tions of human rights abus­es, but he declined to name the coun­tries involved.

“Every alle­ga­tion about mis­use of the sys­tem is con­cern­ing me,” he said. “It vio­lates the trust that we give cus­tomers. We are inves­ti­gat­ing every alle­ga­tion.”

NSO describes its cus­tomers as 60 intel­li­gence, mil­i­tary and law enforce­ment agen­cies in 40 coun­tries, although it will not con­firm the iden­ti­ties of any of them, cit­ing client con­fi­den­tial­i­ty oblig­a­tions. The con­sor­tium found many of the phone num­bers in at least 10 coun­try clus­ters, which were sub­ject­ed to deep­er analy­sis: Azer­bai­jan, Bahrain, Hun­gary, India, Kaza­khstan, Mex­i­co, Moroc­co, Rwan­da, Sau­di Ara­bia and the Unit­ed Arab Emi­rates. Cit­i­zen Lab also has found evi­dence that all 10 have been clients of NSO, accord­ing to Bill Mar­czak, a senior research fel­low.

For­bid­den Sto­ries orga­nized the media consortium’s inves­ti­ga­tion, and Amnesty pro­vid­ed analy­sis and tech­ni­cal sup­port but had no edi­to­r­i­al input. Amnesty has open­ly crit­i­cized NSO’s spy­ware busi­ness and sup­port­ed an unsuc­cess­ful law­suit against the com­pa­ny in an Israeli court seek­ing to have its export license revoked. After the inves­ti­ga­tion began, sev­er­al reporters in the con­sor­tium learned that they or their fam­i­ly mem­bers had been suc­cess­ful­ly attacked with Pega­sus spy­ware.

Beyond the per­son­al intru­sions made pos­si­ble by smart­phone sur­veil­lance, the wide­spread use of spy­ware has emerged as a lead­ing threat to democ­ra­cies world­wide, crit­ics say. Jour­nal­ists under sur­veil­lance can­not safe­ly gath­er sen­si­tive news with­out endan­ger­ing them­selves and their sources. Oppo­si­tion politi­cians can­not plot their cam­paign strate­gies with­out those in pow­er antic­i­pat­ing their moves. Human rights work­ers can­not work with vul­ner­a­ble peo­ple — some of whom are vic­tims of their own gov­ern­ments — with­out expos­ing them to renewed abuse.

For exam­ple, Amnesty’s foren­sics found evi­dence that Pega­sus was tar­get­ed at the two women clos­est to Sau­di colum­nist Khashog­gi, who wrote for The Post’s Opin­ions sec­tion. The phone of his fiancee, Hat­ice Cen­giz, was suc­cess­ful­ly infect­ed dur­ing the days after his mur­der in Turkey on Oct. 2, 2018, accord­ing to a foren­sic analy­sis by Amnesty’s Secu­ri­ty Lab. Also on the list were the num­bers of two Turk­ish offi­cials involved in inves­ti­gat­ing his dis­mem­ber­ment by a Sau­di hit team. Khashog­gi also had a wife, Hanan Ela­tr, whose phone was tar­get­ed by some­one using Pega­sus in the months before his killing. Amnesty was unable to deter­mine whether the hack was suc­cess­ful.

“This is nasty soft­ware — like elo­quent­ly nasty,” said Tim­o­thy Sum­mers, a for­mer cyber­se­cu­ri­ty engi­neer at a U.S. intel­li­gence agency and now direc­tor of IT at Ari­zona State Uni­ver­si­ty. With it “one could spy on almost the entire world pop­u­la­tion. … There’s not any­thing wrong with build­ing tech­nolo­gies that allows you to col­lect data; it’s nec­es­sary some­times. But human­i­ty is not in a place where we can have that much pow­er just acces­si­ble to any­body.”

In response to detailed ques­tions from the con­sor­tium before pub­li­ca­tion, NSO said in a state­ment that it did not oper­ate the spy­ware it licensed to clients and did not have reg­u­lar access to the data they gath­er. The com­pa­ny also said its tech­nolo­gies have helped pre­vent attacks and bomb­ings and bro­ken up rings that traf­ficked in drugs, sex and chil­dren. “Sim­ply put, NSO Group is on a life-sav­ing mis­sion, and the com­pa­ny will faith­ful­ly exe­cute this mis­sion unde­terred, despite any and all con­tin­ued attempts to dis­cred­it it on false grounds,” NSO said. “Your sources have sup­plied you with infor­ma­tion that has no fac­tu­al basis, as evi­denced by the lack of sup­port­ing doc­u­men­ta­tion for many of the claims.”

The com­pa­ny denied that its tech­nol­o­gy was used against Khashog­gi, or his rel­a­tives or asso­ciates.

...

Thomas Clare, a libel attor­ney hired by NSO, said that the con­sor­tium had “appar­ent­ly mis­in­ter­pret­ed and mis­char­ac­ter­ized cru­cial source data on which it relied” and that its report­ing con­tained flawed assump­tions and fac­tu­al errors.

“NSO Group has good rea­son to believe that this list of ‘thou­sands of phone num­bers’ is not a list of num­bers tar­get­ed by gov­ern­ments using Pega­sus, but instead, may be part of a larg­er list of num­bers that might have been used by NSO Group cus­tomers for oth­er pur­pos­es,” Clare wrote.

In response to fol­low-up ques­tions, NSO called the 50,000 num­ber “exag­ger­at­ed” and said it was far too large to rep­re­sent num­bers tar­get­ed by its clients. Based on the ques­tions it was being asked, NSO said, it had rea­son to believe that the con­sor­tium was bas­ing its find­ings “on mis­lead­ing inter­pre­ta­tion of leaked data from acces­si­ble and overt basic infor­ma­tion, such as HLR Lookup ser­vices, which have no bear­ing on the list of the cus­tomers tar­gets of Pega­sus or any oth­er NSO prod­ucts … we still do not see any cor­re­la­tion of these lists to any­thing relat­ed to use of NSO Group tech­nolo­gies.”

The term HLR, or Home Loca­tion Reg­is­ter, refers to a data­base that is essen­tial to oper­at­ing cel­lu­lar phone net­works. Such reg­is­ters keep records on the net­works of cell­phone users and their gen­er­al loca­tions, along with oth­er iden­ti­fy­ing infor­ma­tion that is used rou­tine­ly in rout­ing calls and texts. HLR lookup ser­vices oper­ate on the SS7 sys­tem that cel­lu­lar car­ri­ers use to com­mu­ni­cate with each oth­er. The ser­vices can be used as a step toward spy­ing on tar­gets.

Telecom­mu­ni­ca­tions secu­ri­ty expert Karsten Nohl, chief sci­en­tist for Secu­ri­ty Research Labs in Berlin, said that he does not have direct knowl­edge of NSO’s sys­tems but that HLR lookups and oth­er SS7 queries are wide­ly and inex­pen­sive­ly used by the sur­veil­lance indus­try — often for just tens of thou­sands of dol­lars a year.

“It’s not dif­fi­cult to get that access. Giv­en the resources of NSO, it’d be crazy to assume that they don’t have SS7 access from at least a dozen coun­tries,” Nohl said. “From a dozen coun­tries, you can spy on the rest of the world.”

Pega­sus was engi­neered a decade ago by Israeli ex-cyber­spies with gov­ern­ment-honed skills. The Israeli Defense Min­istry must approve any license to a gov­ern­ment that wants to buy it, accord­ing to pre­vi­ous NSO state­ments.

“As a mat­ter of pol­i­cy, the State of Israel approves the export of cyber prod­ucts exclu­sive­ly to gov­ern­men­tal enti­ties, for law­ful use, and only for the pur­pose of pre­vent­ing and inves­ti­gat­ing crime and coun­tert­er­ror­ism, under end-use/end user cer­tifi­cates pro­vid­ed by the acquir­ing gov­ern­ment,” a spokesper­son for the Israeli defense estab­lish­ment said Sun­day. “In cas­es where export­ed items are used in vio­la­tion of export licens­es or end-use cer­tifi­cates, appro­pri­ate mea­sures are tak­en.”

The num­bers of about a dozen Amer­i­cans work­ing over­seas were dis­cov­ered on the list, in all but one case while using phones reg­is­tered to for­eign cel­lu­lar net­works. The con­sor­tium could not per­form foren­sic analy­sis on most of these phones. NSO has said for years that its prod­uct can­not be used to sur­veil Amer­i­can phones. The con­sor­tium did not find evi­dence of suc­cess­ful spy­ware pen­e­tra­tion on phones with the U.S. coun­try code.

“We also stand by our pre­vi­ous state­ments that our prod­ucts, sold to vet­ted for­eign gov­ern­ments, can­not be used to con­duct cyber­sur­veil­lance with­in the Unit­ed States, and no cus­tomer has ever been grant­ed tech­nol­o­gy that would enable them to access phones with U.S. num­bers,” the com­pa­ny said in its state­ment. “It is tech­no­log­i­cal­ly impos­si­ble and reaf­firms the fact your sources’ claims have no mer­it.”

...

Some Pega­sus intru­sion tech­niques detailed in a 2016 report were changed in a mat­ter of hours after they were made pub­lic, under­scor­ing NSO’s abil­i­ty to adapt to coun­ter­mea­sures.

Pega­sus is engi­neered to evade defens­es on iPhones and Android devices and to leave few traces of its attack. Famil­iar pri­va­cy mea­sures like strong pass­words and encryp­tion offer lit­tle help against Pega­sus, which can attack phones with­out any warn­ing to users. It can read any­thing on a device that a user can, while also steal­ing pho­tos, record­ings, loca­tion records, com­mu­ni­ca­tions, pass­words, call logs and social media posts. Spy­ware also can acti­vate cam­eras and micro­phones for real-time sur­veil­lance.

“There is just noth­ing from an encryp­tion stand­point to pro­tect against this,” said Clau­dio Guarnieri, a.k.a. “Nex,” the Amnesty Secu­ri­ty Lab’s 33-year-old Ital­ian researcher who devel­oped and per­formed the dig­i­tal foren­sics on 37 smart­phones that showed evi­dence of Pega­sus attacks.

That sense of help­less­ness makes Guarnieri, who often dress­es head-to-toe in black, feel as use­less as a 14th-cen­tu­ry doc­tor con­fronting the Black Plague with­out any use­ful med­ica­tion. “Pri­mar­i­ly I’m here just to keep the death count,” he said.

The attack can begin in dif­fer­ent ways. It can come from a mali­cious link in an SMS text mes­sage or an iMes­sage. In some cas­es, a user must click on the link to start the infec­tion. In recent years, spy­ware com­pa­nies have devel­oped what they call “zero-click” attacks, which deliv­er spy­ware sim­ply by send­ing a mes­sage to a user’s phone that pro­duces no noti­fi­ca­tion. Users do not even need to touch their phones for infec­tions to begin.

Many coun­tries have laws per­tain­ing to tra­di­tion­al wire­tap­ping and inter­cep­tion of com­mu­ni­ca­tions, but few have effec­tive safe­guards against deep­er intru­sions made pos­si­ble by hack­ing into smart­phones. “This is more devi­ous in a sense because it real­ly is no longer about inter­cept­ing com­mu­ni­ca­tions and over­hear­ing con­ver­sa­tion. … This cov­ers all of them and goes way beyond that,” Guarnieri said. “It has raised a lot of ques­tions from not only human rights, but even nation­al con­sti­tu­tion­al laws as to is this even legal?”

Clare, NSO’s attor­ney, attacked the foren­sic exam­i­na­tions as “a com­pi­la­tion of spec­u­la­tive and base­less assump­tions” built on assump­tions based on ear­li­er reports. He also said, “NSO does not have insight into the spe­cif­ic intel­li­gence activ­i­ties of its cus­tomers.”

...

‘What a ques­tion!’

Some expressed out­rage even at the sug­ges­tion of spy­ing on jour­nal­ists.

A reporter for the French dai­ly Le Monde work­ing on the Pega­sus Project recent­ly posed such a ques­tion to Hun­gar­i­an Jus­tice Min­is­ter Judit Var­ga dur­ing an inter­view about the legal require­ments for eaves­drop­ping:

“If some­one asked you to tape a jour­nal­ist or an oppo­nent, you wouldn’t accept this?”

“What a ques­tion!” Var­ga respond­ed. “This is a provo­ca­tion in itself!” A day lat­er, her office request­ed that this ques­tion and her answer to it “be erased” from the inter­view.

In the past, NSO has blamed its client coun­tries for any alleged abus­es. NSO released its first “Trans­paren­cy and Respon­si­bil­i­ty Report” last month, argu­ing that its ser­vices are essen­tial to law enforce­ment and intel­li­gence agen­cies try­ing to keep up with the 21st cen­tu­ry.

“Ter­ror orga­ni­za­tions, drug car­tels, human traf­fick­ers, pedophile rings and oth­er crim­i­nal syn­di­cates today exploit off-the-shelf encryp­tion capa­bil­i­ties offered by mobile mes­sag­ing and com­mu­ni­ca­tions appli­ca­tions.

“These tech­nolo­gies pro­vide crim­i­nals and their net­works a safe haven, allow­ing them to ‘go dark’ and avoid detec­tion, com­mu­ni­cat­ing through impen­e­tra­ble mobile mes­sag­ing sys­tems. Law enforce­ment and coun­tert­er­ror­ism state agen­cies around the world have strug­gled to keep up.”

NSO also said it con­ducts rig­or­ous reviews of poten­tial cus­tomers’ human rights records before con­tract­ing with them and inves­ti­gates reports of abus­es, although it did not cite any spe­cif­ic cas­es. It assert­ed that it has dis­con­tin­ued con­tracts with five clients for doc­u­ment­ed vio­la­tions and that the company’s due dili­gence has cost it $100 mil­lion in lost rev­enue. A per­son famil­iar with NSO oper­a­tions who spoke on the con­di­tion of anonymi­ty to dis­cuss inter­nal com­pa­ny mat­ters not­ed that in the last year alone NSO had ter­mi­nat­ed con­tracts with Sau­di Ara­bia and Dubai in the Unit­ed Arab Emi­rates over human rights con­cerns.

“Pega­sus is very use­ful for fight­ing orga­nized crime,” said Guiller­mo Valdes Castel­lanos, head of Mexico’s domes­tic intel­li­gence agency CISEN from 2006 to 2011. “But the total lack of checks and bal­ances [in Mex­i­can agen­cies] means it eas­i­ly ends up in pri­vate hands and is used for polit­i­cal and per­son­al gain.”

Mex­i­co was NSO’s first over­seas client in 2011, less than a year after the firm was found­ed in Israel’s Sil­i­con Val­ley, in north­ern Tel Aviv.

In 2016 and 2017, more than 15,000 Mex­i­cans appeared on the list exam­ined by the media con­sor­tium, among them at least 25 reporters work­ing for the country’s major media out­lets, accord­ing to the records and inter­views.

One of them was Car­men Aris­tegui, one of the most promi­nent inves­tiga­tive jour­nal­ists in the coun­try and a reg­u­lar con­trib­u­tor to CNN. Aris­tegui, who is rou­tine­ly threat­ened for expos­ing the cor­rup­tion of Mex­i­can politi­cians and car­tels, was pre­vi­ous­ly revealed as a Pega­sus tar­get in sev­er­al media reports. At the time, she said in a recent inter­view, her pro­duc­er was also tar­get­ed. The new records and foren­sics show that Pega­sus links were detect­ed on the phone of her per­son­al assis­tant.

“Pega­sus is some­thing that comes to your office, your home, your bed, every cor­ner of your exis­tence,” Aris­tegui said. “It is a tool that destroys the essen­tial codes of civ­i­liza­tion.”

Unlike Aris­tegui, free­lance reporter Cecilio Pine­da was unknown out­side his vio­lence-wracked south­ern state of Guer­rero. His num­ber appears twice on the list of 50,000. A month after the sec­ond list­ing, he was gunned down while lying in a ham­mock at a car­wash while wait­ing for his car. It is unclear what role, if any, Pegasus’s abil­i­ty to geolo­cate its tar­gets in real time con­tributed to his mur­der. Mex­i­co is among the dead­liest coun­tries for jour­nal­ists; 11 were killed in 2017, accord­ing to Reporters With­out Bor­ders.

“Even if For­bid­den Sto­ries were cor­rect that an NSO Group client in Mex­i­co tar­get­ed the journalist’s phone num­ber in Feb­ru­ary 2017, that does not mean that the NSO Group client or data col­lect­ed by NSO Group soft­ware were in any way con­nect­ed to the journalist’s mur­der the fol­low­ing month,” Clare, NSO’s lawyer, wrote in his let­ter to For­bid­den Sto­ries. “Cor­re­la­tion does not equal cau­sa­tion, and the gun­men who mur­dered the jour­nal­ist could have learned of his loca­tion at a pub­lic car­wash through any num­ber of means not relat­ed to NSO Group, its tech­nolo­gies, or its clients.”

Mexico’s Pub­lic Secu­ri­ty Min­istry acknowl­edged last year that the domes­tic intel­li­gence agency, CISEN, and the attor­ney general’s office acquired Pega­sus in 2014 and dis­con­tin­ued its use in 2017 when the license expired. Mex­i­can media have also report­ed that the Defense Min­istry used the spy­ware.

Snowden’s lega­cy

Today’s thriv­ing inter­na­tion­al spy­ware indus­try dates back decades but got a boost after the unprece­dent­ed 2013 dis­clo­sure of high­ly clas­si­fied Nation­al Secu­ri­ty Agency doc­u­ments by con­trac­tor Edward Snow­den. They revealed that the NSA could obtain the elec­tron­ic com­mu­ni­ca­tions of almost any­one because it had secret access to the transna­tion­al cables car­ry­ing Inter­net traf­fic world­wide and data from Inter­net com­pa­nies such as Google and giant telecom­mu­ni­ca­tions com­pa­nies such as AT&T.

Even U.S. allies in Europe were shocked by the com­pre­hen­sive scale of the Amer­i­can dig­i­tal spy­ing, and many nation­al intel­li­gence agen­cies set out to improve their own sur­veil­lance abil­i­ties. For-prof­it firms staffed with mid­ca­reer retirees from intel­li­gence agen­cies saw a lucra­tive mar­ket-in-wait­ing free from the gov­ern­ment reg­u­la­tions and over­sight imposed on oth­er indus­tries.

The dra­mat­ic expan­sion of end-to-end encryp­tion by Google, Microsoft, Face­book, Apple and oth­er major tech­nol­o­gy firms also prompt­ed law enforce­ment and intel­li­gence offi­cials to com­plain they had lost access to the com­mu­ni­ca­tions of legit­i­mate crim­i­nal tar­gets. That in turn sparked more invest­ment in tech­nolo­gies, such as Pega­sus, that worked by tar­get­ing indi­vid­ual devices.

“When you build a build­ing, you want to make sure the build­ing holds up, so we fol­low cer­tain pro­to­cols,” said Ido Sivan-Sevil­la, an expert on cyber gov­er­nance at the Uni­ver­si­ty of Mary­land. By pro­mot­ing the sale of unreg­u­lat­ed pri­vate sur­veil­lance tools, “we encour­age build­ing build­ings that can be bro­ken into. We are build­ing a mon­ster. We need an inter­na­tion­al norms treaty that says cer­tain things are not okay.”

With­out inter­na­tion­al stan­dards and rules, there are secret deals between com­pa­nies like NSO and the coun­tries they ser­vice.

The unfet­tered use of a mil­i­tary-grade spy­ware such as Pega­sus can help gov­ern­ments to sup­press civic activism at a time when author­i­tar­i­an­ism is on the rise world­wide. It also gives coun­tries with­out the tech­ni­cal sophis­ti­ca­tion of such lead­ing nations as the Unit­ed States, Israel and Chi­na the abil­i­ty to con­duct far deep­er dig­i­tal cyberes­pi­onage than ever before.

‘Your body stops func­tion­ing’

Azer­bai­jan, a long­time ally of Israel, has been iden­ti­fied as an NSO client by Cit­i­zen Lab and oth­ers. The coun­try is a fam­i­ly-run klep­toc­ra­cy with no free elec­tions, no impar­tial court sys­tem and no inde­pen­dent news media. The for­mer Sovi­et ter­ri­to­ry has been ruled since the Sovi­et Union col­lapsed 30 years ago by the Aliyev fam­i­ly, whose theft of the country’s wealth and mon­ey-laun­der­ing schemes abroad have result­ed in for­eign embar­goes, inter­na­tion­al sanc­tions and crim­i­nal indict­ments.

Despite the dif­fi­cul­ties, rough­ly three dozen Azer­bai­jani reporters con­tin­ue to doc­u­ment the family’s cor­rup­tion. Some are hid­ing inside the coun­try, but most were forced into exile where they are not so easy to cap­ture. Some work for the Prague-based, U.S.-funded Radio Free Europe/Radio Lib­er­ty, which was kicked out of the coun­try in 2015 for its report­ing. The oth­ers work for an inves­tiga­tive report­ing non­prof­it called the Orga­nized Crime and Cor­rup­tion Report­ing Project, which is based in Sara­je­vo, the Bosn­ian cap­i­tal, and is one of the part­ners in the Pega­sus Project.

The fore­most inves­tiga­tive reporter in the region is Khadi­ja Ismay­ilo­va, whom the regime has worked for a decade to silence: It plant­ed a secret cam­era in her apart­ment wall, took videos of her hav­ing sex with her boyfriend and then post­ed them on the Inter­net in 2012; she was arrest­ed in 2014, tried and con­vict­ed on trumped-up tax-eva­sion and oth­er charges, and held in prison cells with hard­ened crim­i­nals. After glob­al out­rage and the high-pro­file inter­ven­tion of human rights attor­ney Amal Clooney, she was released in 2016 and put under a trav­el ban.

“It is impor­tant that peo­ple see exam­ples of jour­nal­ists who do not stop because they were threat­ened,” Ismay­ilo­va said in a recent inter­view. “It’s like a war. You leave your trench, then the attack­er comes in. … You have to keep your posi­tion, oth­er­wise it will be tak­en and then you will have less space, less space, the space will be shrink­ing and then you will find it hard to breathe.”

Last month, her health fail­ing, she was allowed to leave the coun­try. Col­leagues arranged to test her smart­phone imme­di­ate­ly. Foren­sics by Secu­ri­ty Lab deter­mined that Pega­sus had attacked and pen­e­trat­ed her device numer­ous times from March 2019 to as late as May of this year.

She had assumed some kind of sur­veil­lance, Ismay­ilo­va said, but was still sur­prised at the num­ber of attacks. “When you think maybe there’s a cam­era in the toi­let, your body stops func­tion­ing,” she said. “I went through this, and for eight or nine days I could not use the toi­let, any­where, not even in pub­lic places. My body stopped func­tion­ing.”

She stopped com­mu­ni­cat­ing with peo­ple because who­ev­er she spoke with end­ed up harassed by secu­ri­ty ser­vices. “You don’t trust any­one, and then you try not to have any long-term plans with your own life because you don’t want any per­son to have prob­lems because of you.”

Con­fir­ma­tion of the Pega­sus pen­e­tra­tion galled her. “My fam­i­ly mem­bers are also vic­tim­ized. The sources are vic­tim­ized. Peo­ple I’ve been work­ing with, peo­ple who told me their pri­vate secrets are vic­tim­ized,” she said. “It’s despi­ca­ble. … I don’t know who else has been exposed because of me, who else is in dan­ger because of me.”

Is the min­is­ter para­noid or sen­si­ble?

The fear of wide­spread sur­veil­lance impedes the already dif­fi­cult mechan­ics of civic activism.

“Some­times, that fear is the point,” said John Scott-Rail­ton, a senior researcher at Cit­i­zen Lab, who has researched Pega­sus exten­sive­ly. “The psy­cho­log­i­cal hard­ship and the self-cen­sor­ship it caus­es are key tools of mod­ern-day dic­ta­tors and author­i­tar­i­ans.”

When Sid­dharth Varadara­jan, co-founder of the Wire, an inde­pen­dent online out­let in India, learned that Secu­ri­ty Lab’s analy­sis showed that his phone had been tar­get­ed and pen­e­trat­ed by Pega­sus, his mind imme­di­ate­ly ran through his sen­si­tive sources. He thought about a min­is­ter in Prime Min­is­ter Naren­dra Modi’s gov­ern­ment who had dis­played an unusu­al con­cern about sur­veil­lance when they met.

The min­is­ter first moved the meet­ing from one loca­tion to anoth­er at the last moment, then switched off his phone and told Varadara­jan to do the same.

Then “the two phones were put in a room and music was put on in that room … and I thought: ‘Boy, this guy is real­ly para­noid. But maybe he was being sen­si­ble,’ ” Varadara­jan said in a recent inter­view.

When foren­sics showed his phone had been pen­e­trat­ed, he knew the feel­ing him­self. “You feel vio­lat­ed, there’s no doubt about it,” he said. “This is an incred­i­ble intru­sion, and jour­nal­ists should not have to deal with this. Nobody should have to deal with this.”

————-

“Pri­vate Israeli spy­ware used to hack cell­phones of jour­nal­ists, activists world­wide” by Dana Priest, Craig Tim­berg and Souad Mekhen­net; The Wash­ing­ton Post; 07/18/2021

“The tar­get­ing of the 37 smart­phones would appear to con­flict with the stat­ed pur­pose of NSO’s licens­ing of the Pega­sus spy­ware, which the com­pa­ny says is intend­ed only for use in sur­veilling ter­ror­ists and major crim­i­nals. The evi­dence extract­ed from these smart­phones, revealed here for the first time, calls into ques­tion pledges by the Israeli com­pa­ny to police its clients for human rights abus­es.”

It’s long been jus­ti­fi­ably sus­pect­ed that NSO Group does­n’t actu­al­ly have safe­guards in place to ensure its unstop­pable hack­ing soft­ware isn’t being abused by its gov­ern­ment clients. Dozens and dozens of gov­ern­ment clients. But if the analy­sis of the lists of tar­get­ed phones and foren­sic analy­sis of a num­ber of those phones by For­bid­den Sto­ries and Amnesty Inter­na­tion­al is cor­rect, we have that evi­dence. NSO Group’s Pega­sus soft­ware has been wild­ly abused by its gov­ern­ment clients. Because of course it was. You could­n’t give dozens of gov­ern­ments around the world super hack­ing tools and not expect them to tar­get activists, jour­nal­ists, aca­d­e­mics, and oth­er gov­ern­ments.

How much abuse has tak­en place? We don’t know. And if we believe NSO Group, they don’t real­ly know either. They don’t oper­ate the soft­ware for the clients and “has no insight” into their spe­cif­ic intel­li­gence activ­i­ties. That’s what the com­pa­ny itself is claim­ing in its defense. It does­n’t know how its soft­ware is actu­al­ly used. That’s 60 intel­li­gence, mil­i­tary and law enforce­ment agen­cies in 40 coun­tries oper­at­ing under that see-no-evil-because-we-are-blind over­sight from the ven­dor.

And yet the com­pa­ny defends itself by point­ing out how it ter­mi­nat­ed two con­tracts over alle­ga­tions of abus­es in the last 12 months. Note the term “alle­ga­tions”. Not “inves­ti­ga­tion” or “rou­tine audit”. The con­tracts were can­celed after alle­ga­tions. Against Sau­di Ara­bia and Dubai. So NSO defend­ed itself against charges that it was allow­ing its clients to abuse its soft­ware by point­ing out that it can­celed Sau­di Ara­bi­a’s and Dubai’s con­tracts due to human rights con­cerns. Con­cerns obvi­ous­ly tied to the assas­si­na­tion of Jamal Khashog­gi and all of the pub­lic scruti­ny NSO received as a result. It’s not exact­ly proac­tive over­sight:

...
In lengthy respons­es before pub­li­ca­tion, NSO called the investigation’s find­ings exag­ger­at­ed and base­less. It also said it does not oper­ate the spy­ware licensed to its clients and “has no insight” into their spe­cif­ic intel­li­gence activ­i­ties.

After pub­li­ca­tion, NSO chief exec­u­tive Shalev Hulio expressed con­cern in a phone inter­view with The Post about some of the details he had read in Pega­sus Project sto­ries Sun­day, while con­tin­u­ing to dis­pute that the list of more than 50,000 phone num­bers had any­thing to do with NSO or Pega­sus.

“The com­pa­ny cares about jour­nal­ists and activists and civ­il soci­ety in gen­er­al,” Hulio said. “We under­stand that in some cir­cum­stances our cus­tomers might mis­use the sys­tem and, in some cas­es like we report­ed in [NSO’s] Trans­paren­cy and Respon­si­bil­i­ty Report, we have shut down sys­tems for cus­tomers who have mis­used the sys­tem.”

He said that in the past 12 months NSO had ter­mi­nat­ed two con­tracts over alle­ga­tions of human rights abus­es, but he declined to name the coun­tries involved.

“Every alle­ga­tion about mis­use of the sys­tem is con­cern­ing me,” he said. “It vio­lates the trust that we give cus­tomers. We are inves­ti­gat­ing every alle­ga­tion.”

NSO describes its cus­tomers as 60 intel­li­gence, mil­i­tary and law enforce­ment agen­cies in 40 coun­tries, although it will not con­firm the iden­ti­ties of any of them, cit­ing client con­fi­den­tial­i­ty oblig­a­tions. The con­sor­tium found many of the phone num­bers in at least 10 coun­try clus­ters, which were sub­ject­ed to deep­er analy­sis: Azer­bai­jan, Bahrain, Hun­gary, India, Kaza­khstan, Mex­i­co, Moroc­co, Rwan­da, Sau­di Ara­bia and the Unit­ed Arab Emi­rates. Cit­i­zen Lab also has found evi­dence that all 10 have been clients of NSO, accord­ing to Bill Mar­czak, a senior research fel­low.

...

“This is nasty soft­ware — like elo­quent­ly nasty,” said Tim­o­thy Sum­mers, a for­mer cyber­se­cu­ri­ty engi­neer at a U.S. intel­li­gence agency and now direc­tor of IT at Ari­zona State Uni­ver­si­ty. With it “one could spy on almost the entire world pop­u­la­tion. … There’s not any­thing wrong with build­ing tech­nolo­gies that allows you to col­lect data; it’s nec­es­sary some­times. But human­i­ty is not in a place where we can have that much pow­er just acces­si­ble to any­body.”

In response to detailed ques­tions from the con­sor­tium before pub­li­ca­tion, NSO said in a state­ment that it did not oper­ate the spy­ware it licensed to clients and did not have reg­u­lar access to the data they gath­er. The com­pa­ny also said its tech­nolo­gies have helped pre­vent attacks and bomb­ings and bro­ken up rings that traf­ficked in drugs, sex and chil­dren. “Sim­ply put, NSO Group is on a life-sav­ing mis­sion, and the com­pa­ny will faith­ful­ly exe­cute this mis­sion unde­terred, despite any and all con­tin­ued attempts to dis­cred­it it on false grounds,” NSO said. “Your sources have sup­plied you with infor­ma­tion that has no fac­tu­al basis, as evi­denced by the lack of sup­port­ing doc­u­men­ta­tion for many of the claims.”

...

Clare, NSO’s attor­ney, attacked the foren­sic exam­i­na­tions as “a com­pi­la­tion of spec­u­la­tive and base­less assump­tions” built on assump­tions based on ear­li­er reports. He also said, “NSO does not have insight into the spe­cif­ic intel­li­gence activ­i­ties of its cus­tomers.”

...

In the past, NSO has blamed its client coun­tries for any alleged abus­es. NSO released its first “Trans­paren­cy and Respon­si­bil­i­ty Report” last month, argu­ing that its ser­vices are essen­tial to law enforce­ment and intel­li­gence agen­cies try­ing to keep up with the 21st cen­tu­ry.

...

NSO also said it con­ducts rig­or­ous reviews of poten­tial cus­tomers’ human rights records before con­tract­ing with them and inves­ti­gates reports of abus­es, although it did not cite any spe­cif­ic cas­es. It assert­ed that it has dis­con­tin­ued con­tracts with five clients for doc­u­ment­ed vio­la­tions and that the company’s due dili­gence has cost it $100 mil­lion in lost rev­enue. A per­son famil­iar with NSO oper­a­tions who spoke on the con­di­tion of anonymi­ty to dis­cuss inter­nal com­pa­ny mat­ters not­ed that in the last year alone NSO had ter­mi­nat­ed con­tracts with Sau­di Ara­bia and Dubai in the Unit­ed Arab Emi­rates over human rights con­cerns.

...

Mex­i­co was NSO’s first over­seas client in 2011, less than a year after the firm was found­ed in Israel’s Sil­i­con Val­ley, in north­ern Tel Aviv.
...

But then there’s the NSO Group’s more legit­i­mate excuse for sell­ing this kind of pow­er­ful soft­ware to gov­ern­ments known for human rights abus­es: the Israeli Defense Min­istry has to approve of the NSO Group’s con­tracts. Beyond that, NSO Group claims its soft­ware can­not be used on US-based phones, rais­ing ques­tions about whether or not the US gov­ern­ment was also tac­it­ly giv­ing its approval for these con­tracts:

...
Pega­sus was engi­neered a decade ago by Israeli ex-cyber­spies with gov­ern­ment-honed skills. The Israeli Defense Min­istry must approve any license to a gov­ern­ment that wants to buy it, accord­ing to pre­vi­ous NSO state­ments.

“As a mat­ter of pol­i­cy, the State of Israel approves the export of cyber prod­ucts exclu­sive­ly to gov­ern­men­tal enti­ties, for law­ful use, and only for the pur­pose of pre­vent­ing and inves­ti­gat­ing crime and coun­tert­er­ror­ism, under end-use/end user cer­tifi­cates pro­vid­ed by the acquir­ing gov­ern­ment,” a spokesper­son for the Israeli defense estab­lish­ment said Sun­day. “In cas­es where export­ed items are used in vio­la­tion of export licens­es or end-use cer­tifi­cates, appro­pri­ate mea­sures are tak­en.”

The num­bers of about a dozen Amer­i­cans work­ing over­seas were dis­cov­ered on the list, in all but one case while using phones reg­is­tered to for­eign cel­lu­lar net­works. The con­sor­tium could not per­form foren­sic analy­sis on most of these phones. NSO has said for years that its prod­uct can­not be used to sur­veil Amer­i­can phones. The con­sor­tium did not find evi­dence of suc­cess­ful spy­ware pen­e­tra­tion on phones with the U.S. coun­try code.

“We also stand by our pre­vi­ous state­ments that our prod­ucts, sold to vet­ted for­eign gov­ern­ments, can­not be used to con­duct cyber­sur­veil­lance with­in the Unit­ed States, and no cus­tomer has ever been grant­ed tech­nol­o­gy that would enable them to access phones with U.S. num­bers,” the com­pa­ny said in its state­ment. “It is tech­no­log­i­cal­ly impos­si­ble and reaf­firms the fact your sources’ claims have no mer­it.”
...

But by the biggest rev­e­la­tion in this sto­ry is the nature of these NSO Group exploits being sold with the Pega­sus sys­tem: “zero-click” exploits that qui­et­ly deliv­er spy­ware sim­ply by send­ing a mes­sage to the tar­get’s phone. That is effec­tive­ly an unstop­pable attack. So NSO Group was sell­ing unstop­pable exploits that could tar­get any smart­phone in the world — with the pos­si­ble excep­tion of US phones if we believe the com­pa­ny’s assur­ances — to over 40 dif­fer­ent gov­ern­ments around the world, start­ing in 2011 with the con­tract with Mex­i­co. And as this inves­ti­ga­tion revealed, those unstop­pable exploits were wide­ly used by these gov­ern­ments for far more than just law enforce­ment and ter­ror­ism cas­es. That is a mas­sive rel­e­va­tion, in part because it means gov­ern­ments around the world have been empow­ered to secret­ly hack each oth­er for years now. But this was­n’t exact­ly a new rev­e­la­tion. We learned back in May 2019 about NSO Group’s unstop­pable exploit that could infect a phone sim­ply by call­ing them over the What­sApp call­ing fea­ture. The exploit worked when vic­tims did­n’t answer the call. So the exis­tence of ‘zero-click’ exploits isn’t exact­ly a new rev­e­la­tion, but it sounds like that What­sApp exploit was far from the only one. They’ve fig­ured out how to do it with SMS Text mes­sages or iMes­sages too. That cov­ers basi­cal­ly every smart­phone, whether you have What­sApp on it or not:

...
Some Pega­sus intru­sion tech­niques detailed in a 2016 report were changed in a mat­ter of hours after they were made pub­lic, under­scor­ing NSO’s abil­i­ty to adapt to coun­ter­mea­sures.

Pega­sus is engi­neered to evade defens­es on iPhones and Android devices and to leave few traces of its attack. Famil­iar pri­va­cy mea­sures like strong pass­words and encryp­tion offer lit­tle help against Pega­sus, which can attack phones with­out any warn­ing to users. It can read any­thing on a device that a user can, while also steal­ing pho­tos, record­ings, loca­tion records, com­mu­ni­ca­tions, pass­words, call logs and social media posts. Spy­ware also can acti­vate cam­eras and micro­phones for real-time sur­veil­lance.

“There is just noth­ing from an encryp­tion stand­point to pro­tect against this,” said Clau­dio Guarnieri, a.k.a. “Nex,” the Amnesty Secu­ri­ty Lab’s 33-year-old Ital­ian researcher who devel­oped and per­formed the dig­i­tal foren­sics on 37 smart­phones that showed evi­dence of Pega­sus attacks.

That sense of help­less­ness makes Guarnieri, who often dress­es head-to-toe in black, feel as use­less as a 14th-cen­tu­ry doc­tor con­fronting the Black Plague with­out any use­ful med­ica­tion. “Pri­mar­i­ly I’m here just to keep the death count,” he said.

The attack can begin in dif­fer­ent ways. It can come from a mali­cious link in an SMS text mes­sage or an iMes­sage. In some cas­es, a user must click on the link to start the infec­tion. In recent years, spy­ware com­pa­nies have devel­oped what they call “zero-click” attacks, which deliv­er spy­ware sim­ply by send­ing a mes­sage to a user’s phone that pro­duces no noti­fi­ca­tion. Users do not even need to touch their phones for infec­tions to begin.
...

Unstop­pable zero-day attacks and zero over­sight. What could pos­si­bly go wrong?

Forget All Those NSO Group and Candiru Stories: The US and Western Allies Accuse China of the Microsoft Exchange Hack

So how are gov­ern­ments respond­ing to this string of dev­as­tat­ing reports. First Can­diru’s zero-day mal­ware gets exposed being used against activists around the world. Then NSO Group is revealed to be the cyber equiv­a­lent of a nuclear mer­ce­nary. And a diplo­mat­ic tool. It was a rough week of report­ing on the “com­mer­cial sur­veil­lance” cyber indus­try. A lot of tough ques­tions for raised. And we got our answer one day after the Wash­ing­ton Post’s report: The US and West­ern allies were final­ly for­mal­ly accus­ing Chi­na of being behind the Microsoft Exchange hack first dis­closed back in March. It was great tim­ing.

And as we’ll see in the next arti­cle excerpt about the pub­lic accu­sa­tions by the US and its fel­low allies against China’s Min­istry of State Secu­ri­ty (MSS), Chi­na isn’t just accused of tol­er­at­ing smash-and-grab raids. The MSS-backed hack­er groups are also accused of tol­er­at­ing ran­somware attacks for their own per­son­al prof­it. So the hack­er groups accused of car­ry­ing out the Microsoft Exchange hack and oth­er hacks attrib­uted to Chi­na are also groups engag­ing in the kind of cyber-extor­tion and ran­somware schemes for their own prof­it that are tra­di­tion­al asso­ci­at­ed with stan­dard cyber crim­i­nals. That’s the evolv­ing nar­ra­tive in the face of evi­dence that the Microsoft Exchange hack was real­ly many hacks involv­ing mul­ti­ple crim­i­nal groups on a ram­pant spree that also run cyber-extor­tion schemes: They were Chi­nese state-backed hack­ers who also run pri­vate extortive crim­i­nal hacks on their own because Chi­na’s gov­ern­ment has decid­ed to give zero-day exploits to groups that take those zero-day exploits and go on a glob­al hack­ing spree. The Chi­nese gov­ern­ment endorsed or at least tol­er­at­ed that dra­mat­ic esca­la­tion. No longer espi­onage but glob­al smash-and-grab sprees. That’s the new nar­ra­tive. A new nar­ra­tive that’s evolv­ing in the face of the evi­dence that the peo­ple car­ry­ing out these mega-hacks are act­ing like tra­di­tion­al hack­ers and not state-backed espi­onage-focused groups.

Recall how the known time­line of the Exchange hack is that it start­ed on Jan­u­ary 3 (Volex­i­ty’s first detect­ed use of the zero-day exploit by “Hafni­um). It was Jan­u­ary 6, dur­ing the Capi­tol Insur­rec­tion, when Volex­i­ty first observed a large down­load to an unau­tho­rized address. Hafni­um qui­et­ly hit orga­ni­za­tions until Microsoft issued a patch on March 2. At that point, mul­ti­ple groups went on a glob­al race to hit every unpatched serv­er con­nect­ed to the inter­net. So giv­en that time­line, it’s like­ly that the groups that went on the race fol­low­ing the patch are the ones with a crim­i­nal for-prof­it track-record. And we are to assume “Hafni­um”, a state-backed Chi­nese hack­er group, hand­ed this zero-day exploit over to these groups and gave its bless­ing to the glob­al smash-and-grab. Which, if true, real­ly would be a dra­mat­ic esca­la­tion in hacks from Chi­na. It’s the “if true” part that’s the catch. Notice how no one even both­ers to pro­vide a pre­tense of evi­dence for any of these claims.

Amus­ing­ly, the gov­ern­ments mak­ing these accu­sa­tions against Chi­na had­n’t quite got­ten their sto­ries straight. Because as we just saw, much of the osten­si­ble alarm over these accu­sa­tions is that they sig­ni­fy a shift from qui­et espi­onage to in-your-face smash-and-grab raids by Chi­nese state-backed hack­er. And yet as we’ll see, U.K. For­eign Sec­re­tary Dominic Raab describe the attack “a reck­less but famil­iar pat­tern of behav­iour” by Chi­nese state-backed groups. So what is it? New reck­less behav­ior? Or famil­iar reck­less behav­ior? That part of the nar­ra­tive has yet to be decid­ed. But this was what major West­ern gov­ern­ments were talk­ing about a day about that NSO Group report: Chi­na:

Asso­ci­at­ed Press

Microsoft Exchange hack caused by Chi­na, US and allies say

By ERIC TUCKER
July 19, 2021

WASHINGTON (AP) — The Biden admin­is­tra­tion and West­ern allies for­mal­ly blamed Chi­na on Mon­day for a mas­sive hack of Microsoft Exchange email serv­er soft­ware and assert­ed that crim­i­nal hack­ers asso­ci­at­ed with the Chi­nese gov­ern­ment have car­ried out ran­somware and oth­er illic­it cyber oper­a­tions.

The announce­ments, though not accom­pa­nied by sanc­tions against the Chi­nese gov­ern­ment, were intend­ed as a force­ful con­dem­na­tion of activ­i­ties a senior Biden admin­is­tra­tion offi­cial described as part of a “pat­tern of irre­spon­si­ble behav­ior in cyber­space.” They high­light­ed the ongo­ing threat from Chi­nese hack­ers even as the admin­is­tra­tion remains con­sumed with try­ing to curb ran­somware attacks from Rus­sia-based syn­di­cates that have tar­get­ed crit­i­cal infra­struc­ture.

The broad range of cyberthreats from Bei­jing dis­closed on Mon­day includ­ed a ran­somware attack from gov­ern­ment-affil­i­at­ed hack­ers that tar­get­ed vic­tims — includ­ing in the U.S. — with demands for mil­lions of dol­lars. U.S offi­cials also alleged that crim­i­nal con­tract hack­ers asso­ci­at­ed with China’s Min­istry of State Secu­ri­ty have engaged in cyber extor­tion schemes and theft for their own prof­it.

Mean­while, the Jus­tice Depart­ment on Mon­day announced charges against four Chi­nese nation­als who pros­e­cu­tors said were work­ing with the MSS in a hack­ing cam­paign that tar­get­ed dozens of com­put­er sys­tems, includ­ing com­pa­nies, uni­ver­si­ties and gov­ern­ment enti­ties. The defen­dants are accused of tar­get­ing trade secrets and con­fi­den­tial busi­ness infor­ma­tion, includ­ing sci­en­tif­ic tech­nolo­gies and infec­tious-dis­ease research.

Unlike in April, when pub­lic fin­ger-point­ing of Russ­ian hack­ing was paired with a raft of sanc­tions against Moscow, the Biden admin­is­tra­tion did not announce any actions against Bei­jing. Nonethe­less, a senior admin­is­tra­tion offi­cial who briefed reporters said that the U.S. has con­front­ed senior Chi­nese offi­cials and that the White House regards the multi­na­tion sham­ing as send­ing an impor­tant mes­sage, even if no sin­gle action can change behav­ior.

Pres­i­dent Joe Biden told reporters “the investigation’s not fin­ished,” and White House press sec­re­tary Jen Psa­ki did not rule out future con­se­quences for Chi­na, say­ing, “This is not the con­clu­sion of our efforts as it relates to cyber activ­i­ties with Chi­na or Rus­sia.”

Even with­out fresh sanc­tions, Monday’s actions are like­ly to exac­er­bate ten­sions with Chi­na at a del­i­cate time. Just last week, the U.S. issued sep­a­rate stark warn­ings against trans­ac­tions with enti­ties that oper­ate in China’s west­ern Xin­jiang region, where Chi­na is accused of repress­ing Uyghur Mus­lims and oth­er minori­ties.

...

The Euro­pean Union and Britain were among the allies who called out Chi­na. The EU said mali­cious cyber activ­i­ties with “sig­nif­i­cant effects” that tar­get­ed gov­ern­ment insti­tu­tions, polit­i­cal orga­ni­za­tions and key indus­tries in the bloc’s 27 mem­ber states could be linked to Chi­nese hack­ing groups. The U.K.’s Nation­al Cyber Secu­ri­ty Cen­tre said the groups tar­get­ed mar­itime indus­tries and naval defense con­trac­tors in the U.S. and Europe and the Finnish par­lia­ment.

In a state­ment, EU for­eign pol­i­cy chief Josep Bor­rell said the hack­ing was “con­duct­ed from the ter­ri­to­ry of Chi­na for the pur­pose of intel­lec­tu­al prop­er­ty theft and espi­onage.”

The Microsoft Exchange cyber­at­tack “by Chi­nese state-backed groups was a reck­less but famil­iar pat­tern of behav­iour,” U.K. For­eign Sec­re­tary Dominic Raab said.

NATO, in its first pub­lic con­dem­na­tion of Chi­na for hack­ing activ­i­ties, called on Bei­jing to uphold its inter­na­tion­al com­mit­ments and oblig­a­tions “and to act respon­si­bly in the inter­na­tion­al sys­tem, includ­ing in cyber­space.” The alliance said it was deter­mined to “active­ly deter, defend against and counter the full spec­trum of cyber threats.”

That hack­ers affil­i­at­ed with the Min­istry of State Secu­ri­ty were engaged in ran­somware was sur­pris­ing and con­cern­ing to the U.S. gov­ern­ment, the senior admin­is­tra­tion offi­cial said. But the attack, in which an uniden­ti­fied Amer­i­can com­pa­ny received a high-dol­lar ran­som demand, also gave U.S. offi­cials new insight into what the offi­cial said was “the kind of aggres­sive behav­ior that we’re see­ing com­ing out of Chi­na.”

A spokesper­son for the Chi­nese Embassy in Wash­ing­ton, Liu Pengyu, said in a state­ment that the “U.S. has repeat­ed­ly made ground­less attacks and mali­cious smear against Chi­na on cyber­se­cu­ri­ty. Now this is just anoth­er old trick, with noth­ing new in it.” The state­ment called Chi­na “a severe vic­tim of the US cyber theft, eaves­drop­ping and sur­veil­lance.”

The major­i­ty of the most dam­ag­ing and high-pro­file recent ran­somware attacks have involved Russ­ian crim­i­nal gangs. Though the U.S. has some­times seen con­nec­tions between Russ­ian intel­li­gence agen­cies and indi­vid­ual hack­ers, the use of crim­i­nal con­tract hack­ers by the Chi­nese gov­ern­ment “to con­duct unsanc­tioned cyber oper­a­tions glob­al­ly is dis­tinct,” the offi­cial said.

Dmitri Alper­ovitch, the for­mer chief tech­nol­o­gy offi­cer of the cyber­se­cu­ri­ty firm Crowd­strike, said the announce­ment makes clear that MSS con­trac­tors who for years have worked for the gov­ern­ment and con­duct­ed oper­a­tions on its behalf have over time decid­ed — either with the approval or the “blind eye of their boss­es” — to ”start moon­light­ing and engag­ing in oth­er activ­i­ties that could put mon­ey in their pock­ets.”

The Microsoft Exchange hack that months ago com­pro­mised tens of thou­sands of com­put­ers around the world was swift­ly attrib­uted to Chi­nese cyber spies by Microsoft.

An admin­is­tra­tion offi­cial said the government’s attri­bu­tion to hack­ers affil­i­at­ed with the Min­istry of State Secu­ri­ty took until now in part because of the dis­cov­ery of the ran­somware and for-prof­it hack­ing oper­a­tions and because the admin­is­tra­tion want­ed to pair the announce­ment with guid­ance for busi­ness­es about tac­tics that the Chi­nese have been using.

Giv­en the scope of the attack, Alper­ovitch said it was “puz­zling” that the U.S. did not impose sanc­tions.

“They cer­tain­ly deserve it, and at this point, it’s becom­ing a glar­ing stand­out that we have not,” he said.

He added, in a ref­er­ence to a large Russ­ian cyberes­pi­onage oper­a­tion dis­cov­ered late last year, “There’s no ques­tion that the Exchange hacks have been more reck­less, more dan­ger­ous and more dis­rup­tive than any­thing the Rus­sians have done in Solar­Winds.

———-

“Microsoft Exchange hack caused by Chi­na, US and allies say” by ERIC TUCKER; Asso­ci­at­ed Press; 07/19/2021

“The broad range of cyberthreats from Bei­jing dis­closed on Mon­day includ­ed a ran­somware attack from gov­ern­ment-affil­i­at­ed hack­ers that tar­get­ed vic­tims — includ­ing in the U.S. — with demands for mil­lions of dol­lars. U.S offi­cials also alleged that crim­i­nal con­tract hack­ers asso­ci­at­ed with China’s Min­istry of State Secu­ri­ty have engaged in cyber extor­tion schemes and theft for their own prof­it.”

Crim­i­nal con­tract hack­ers. That’s who China’s Min­istry of State Secu­ri­ty is appar­ent­ly hir­ing to car­ry out these mega hacks. That’s the accu­sa­tion com­ing from the US and allies. What evi­dence this asser­tion is based is of course nev­er giv­en, but the par­al­lel charges against four Chi­nese nation­als accuse of work­ing wit the MSS in a hack­ing cam­paign is pre­sum­ably sup­posed to serve as a kind of proxy evi­dence:

...
Mean­while, the Jus­tice Depart­ment on Mon­day announced charges against four Chi­nese nation­als who pros­e­cu­tors said were work­ing with the MSS in a hack­ing cam­paign that tar­get­ed dozens of com­put­er sys­tems, includ­ing com­pa­nies, uni­ver­si­ties and gov­ern­ment enti­ties. The defen­dants are accused of tar­get­ing trade secrets and con­fi­den­tial busi­ness infor­ma­tion, includ­ing sci­en­tif­ic tech­nolo­gies and infec­tious-dis­ease research.
...

But, again, observe how incon­sis­tent the accu­sa­tions are. The EU is refer­ring to hacks that could be linked to Chi­nese hack­ing groups while the UK’s For­eign Sec­re­tary calls it “a reck­less but famil­iar pat­tern of behav­iour”. And look at he US’s expla­na­tion for why it took this long to make the attri­bu­tion when Microsoft seem­ing­ly did it imme­di­ate­ly: the dis­cov­ery of ran­somware and for-prof­it schemes by these same hack­ers delayed the attri­bu­tion. In oth­er words, Microsoft­’s evi­dence-free ini­tial asser­tion that the hack was the respon­si­bil­i­ty of the Chi­nese (and def­i­nite­ly com­plete­ly unre­lat­ed to the Solar­Winds hack!) got com­pli­cat­ed after it was observed that the hack­ers were behav­ing like nor­mal crim­i­nals and engag­ing in ran­somware for-prof­it schemes. So they had to cre­ate a new nar­ra­tive about how the Chi­nese gov­ern­ment is now using con­tract crim­i­nal hack­ers to car­ry out their mega-hacks. Because why car­ry out a mega-hack on your own when you can share it with the crim­i­nal-under­world:

...
Even with­out fresh sanc­tions, Monday’s actions are like­ly to exac­er­bate ten­sions with Chi­na at a del­i­cate time. Just last week, the U.S. issued sep­a­rate stark warn­ings against trans­ac­tions with enti­ties that oper­ate in China’s west­ern Xin­jiang region, where Chi­na is accused of repress­ing Uyghur Mus­lims and oth­er minori­ties.

...

The Euro­pean Union and Britain were among the allies who called out Chi­na. The EU said mali­cious cyber activ­i­ties with “sig­nif­i­cant effects” that tar­get­ed gov­ern­ment insti­tu­tions, polit­i­cal orga­ni­za­tions and key indus­tries in the bloc’s 27 mem­ber states could be linked to Chi­nese hack­ing groups. The U.K.’s Nation­al Cyber Secu­ri­ty Cen­tre said the groups tar­get­ed mar­itime indus­tries and naval defense con­trac­tors in the U.S. and Europe and the Finnish par­lia­ment.

In a state­ment, EU for­eign pol­i­cy chief Josep Bor­rell said the hack­ing was “con­duct­ed from the ter­ri­to­ry of Chi­na for the pur­pose of intel­lec­tu­al prop­er­ty theft and espi­onage.”

The Microsoft Exchange cyber­at­tack “by Chi­nese state-backed groups was a reck­less but famil­iar pat­tern of behav­iour,” U.K. For­eign Sec­re­tary Dominic Raab said.

NATO, in its first pub­lic con­dem­na­tion of Chi­na for hack­ing activ­i­ties, called on Bei­jing to uphold its inter­na­tion­al com­mit­ments and oblig­a­tions “and to act respon­si­bly in the inter­na­tion­al sys­tem, includ­ing in cyber­space.” The alliance said it was deter­mined to “active­ly deter, defend against and counter the full spec­trum of cyber threats.”

That hack­ers affil­i­at­ed with the Min­istry of State Secu­ri­ty were engaged in ran­somware was sur­pris­ing and con­cern­ing to the U.S. gov­ern­ment, the senior admin­is­tra­tion offi­cial said. But the attack, in which an uniden­ti­fied Amer­i­can com­pa­ny received a high-dol­lar ran­som demand, also gave U.S. offi­cials new insight into what the offi­cial said was “the kind of aggres­sive behav­ior that we’re see­ing com­ing out of Chi­na.”

...

The major­i­ty of the most dam­ag­ing and high-pro­file recent ran­somware attacks have involved Russ­ian crim­i­nal gangs. Though the U.S. has some­times seen con­nec­tions between Russ­ian intel­li­gence agen­cies and indi­vid­ual hack­ers, the use of crim­i­nal con­tract hack­ers by the Chi­nese gov­ern­ment “to con­duct unsanc­tioned cyber oper­a­tions glob­al­ly is dis­tinct,” the offi­cial said.

...

The Microsoft Exchange hack that months ago com­pro­mised tens of thou­sands of com­put­ers around the world was swift­ly attrib­uted to Chi­nese cyber spies by Microsoft.

An admin­is­tra­tion offi­cial said the government’s attri­bu­tion to hack­ers affil­i­at­ed with the Min­istry of State Secu­ri­ty took until now in part because of the dis­cov­ery of the ran­somware and for-prof­it hack­ing oper­a­tions and because the admin­is­tra­tion want­ed to pair the announce­ment with guid­ance for busi­ness­es about tac­tics that the Chi­nese have been using.
...

Also keep in mind that the crim­i­nal hack­er groups did­n’t appear in the Exchange hack until March 2 accord­ing to our known time­line, the day Microsoft also issued its report that blamed the hack on state-spon­sored “Hafni­um”. So the crim­i­nal-like behav­ior of the groups with access to this exploit was­n’t nec­es­sar­i­ly appar­ent when Microsoft made its ini­tial “Hafni­um” attri­bu­tion

But note the one con­sis­tent actor here: Dmitri Alper­ovitch — co-founder of Crowd­Strike and the guy who pio­neered the mod­ern approach of mak­ing loud evi­dence-free hack­ing accu­sa­tions against coun­tries as a means of pre­vent­ing future attacks — is giv­ing us exact­ly the response we should expect by ask­ing why these accu­sa­tions haven’t led to new sanc­tions against Chi­na:

...
Dmitri Alper­ovitch, the for­mer chief tech­nol­o­gy offi­cer of the cyber­se­cu­ri­ty firm Crowd­strike, said the announce­ment makes clear that MSS con­trac­tors who for years have worked for the gov­ern­ment and con­duct­ed oper­a­tions on its behalf have over time decid­ed — either with the approval or the “blind eye of their boss­es” — to ”start moon­light­ing and engag­ing in oth­er activ­i­ties that could put mon­ey in their pock­ets.”

Giv­en the scope of the attack, Alper­ovitch said it was “puz­zling” that the U.S. did not impose sanc­tions.

“They cer­tain­ly deserve it, and at this point, it’s becom­ing a glar­ing stand­out that we have not,” he said.

He added, in a ref­er­ence to a large Russ­ian cyberes­pi­onage oper­a­tion dis­cov­ered late last year, “There’s no ques­tion that the Exchange hacks have been more reck­less, more dan­ger­ous and more dis­rup­tive than any­thing the Rus­sians have done in Solar­Winds.
...

Also note that Alper­ovitch is now the for­mer CTO of Crowd­strike, hav­ing left the com­pa­ny in 2020 to start a non-prof­it “pol­i­cy accel­er­a­tor” focused on cyber­se­cu­ri­ty in a geopo­lit­i­cal con­text. In oth­er words, Alper­ovtich start­ed a think-tank and lob­by shop ded­i­cat­ed to push for the kind of hack­ing-based sanc­tions against Russ­ian and Chi­na he’s long advo­cat­ed for any­way.
The BBC has a bit more on the sto­ry that gives us a bet­ter idea of how the West­ern gov­ern­ments of the­o­riz­ing Chi­na decid­ed to car­ry out this glob­al mega-hack using com­mon cyber-crim­i­nals as co-con­spir­a­tors: Hafni­um knew Microsoft planned to deal with the weak­ness and so shared it with oth­er Chi­na-based hack­ers. In oth­er words, the Chi­nese state-backed hack­ers real­ized the jig was up and hand­ed the zero-day exploit (which was no longer a zero-day) to crim­i­nals for some strate­gic rea­son.

Again, recall the time­line: Recall how the known time­line of the Exchange hack is that it start­ed on Jan­u­ary 3 (Volex­i­ty’s first detect­ed use of the zero-day exploit by “Hafni­um). It was Jan­u­ary 6, dur­ing the Capi­tol Insur­rec­tion, when Volex­i­ty first observed a large down­load to an unau­tho­rized address. Hafni­um qui­et­ly hit orga­ni­za­tions until Microsoft issued a patch on March 2, the same day it blamed the hack on Hafni­um, a state-backed Chi­nese hack­er group. That’s the day we are told mul­ti­ple crim­i­nal groups went on a glob­al race to hit every unpatched serv­er con­nect­ed to the inter­net.

So what would be the motive for Hafni­um to hand that zero-day exploit over to crim­i­nal groups and esca­late the hack to the lev­el of worst ever? Max­i­mize dam­age? Cov­er their tracks? It’s unclear what the the­o­rized ratio­nale would be. Microsoft blamed the hack on “Hafni­um” and called them a Chi­nese state-backed group dur­ing the ini­tial secu­ri­ty blog post that announced the Exchange patch to fix the exploit, which is when the crim­i­nal ran­sack­ing report­ed­ly start­ed. So it’s not like there was obvi­ous track cov­er­ing by Hafni­um to be done at that point. But that’s what we’re told by these West­ern gov­ern­ment sources: after get­ting caught with their qui­et tar­get hack, these state-backed hack­ers made a con­scious deci­sion to hand the super exploit over to crim­i­nals and tol­er­ate a glob­al ran­sack­ing:

BBC News

Chi­na says Microsoft hack­ing accu­sa­tions fab­ri­cat­ed by US and allies

Pub­lished
7/20/2021

Chi­na has denied alle­ga­tions that it car­ried out a major cyber-attack against tech giant Microsoft.

The US and oth­er West­ern coun­tries on Mon­day accused Chi­na of hack­ing Microsoft Exchange — a pop­u­lar email plat­form used by com­pa­nies world­wide.

They said it was part of a broad­er pat­tern of “reck­less” behav­iour that threat­ened glob­al secu­ri­ty.

Chi­na says it oppos­es all forms of cyber-crime, and has called the claims “fab­ri­cat­ed”.

Chi­na’s for­eign min­istry spokesman said the US had got its allies to make “unrea­son­able crit­i­cisms” against Chi­na.

The UK, EU, New Zealand, Aus­tralia and oth­ers joined the US to accuse Chi­nese state-spon­sored hack­ers.

...

Microsoft blamed a Chi­nese cyber-espi­onage group for tar­get­ing a weak­ness in Microsoft Exchange, which allowed hack­ers to get into email inbox­es.

It said the group, known as Hafni­um, was state-spon­sored and based in Chi­na.

West­ern secu­ri­ty sources believe Hafni­um knew Microsoft had planned to deal with the weak­ness, and so shared it with oth­er Chi­na-based hack­ers.

The sources say the hack seems to sig­nal a shift from a tar­get­ed espi­onage cam­paign to a smash-and-grab raid, lead­ing to con­cerns that Chi­nese cyber-behav­iour is esca­lat­ing.

The UK For­eign Office said the Chi­nese gov­ern­ment had “ignored repeat­ed calls to end its reck­less cam­paign, instead allow­ing state-backed actors to increase the scale of their attacks”.

US Pres­i­dent Joe Biden said the Chi­nese gov­ern­ment may not have been car­ry­ing out the attacks itself, but was “pro­tect­ing those who are doing it. And maybe even accom­mo­dat­ing them being able to do it”.

...

———–
“Chi­na says Microsoft hack­ing accu­sa­tions fab­ri­cat­ed by US and allies”; BBC News; 7/20/2021

“West­ern secu­ri­ty sources believe Hafni­um knew Microsoft had planned to deal with the weak­ness, and so shared it with oth­er Chi­na-based hack­ers.”

It’s quite a sce­nario described by the West­ern secu­ri­ty source for this arti­cle: Hafni­um found out Microsoft planned on clos­ing some vul­ner­a­bil­i­ties, prompt­ing Hafni­um to share the vul­ner­a­bil­i­ty with oth­er Chi­na-based hack­ers. Recall how, as we saw above, Volex­i­ty wit­nessed what was a qui­et infil­tra­tion of some sys­tems — using the zero-day exploits — on Jan­u­ary 6 dur­ing the Capi­tol insur­rec­tion. It was in the fol­low­ing days that the hack because much more wide­spread and open and aggres­sive. So we are prob­a­bly being asked to assume that the sec­ond noisy phase of the hack was after Hafni­um gave their incred­i­ble zero-day exploit to oth­er crim­i­nal hack­ers around Chi­na. And this was all qui­et­ly sanc­tioned by the Chi­nese gov­ern­ment. That’s the nar­ra­tive we are being asked to believe, this time with West­ern gov­ern­ments mak­ing the asser­tions, not Microsoft. And as always, we have no idea what evi­dence this belief is based on. The one thing we can state with con­fi­dence is that a large num­ber of the actors who used this exploit dur­ing that glob­al ran­sack­ing phase appear to be crim­i­nal.

But if we take the state-backed crim­i­nal-super-hack nar­ra­tive seri­ous­ly, we have to treat this as a major esca­la­tion by the Chi­nese gov­ern­ment. Which it very much would be if true. An insane esca­la­tion that could enrage the glob­al busi­ness com­mu­ni­ty. Not just gov­ern­ments:

...
The sources say the hack seems to sig­nal a shift from a tar­get­ed espi­onage cam­paign to a smash-and-grab raid, lead­ing to con­cerns that Chi­nese cyber-behav­iour is esca­lat­ing.
...

But, again, keep in mind that this entire dis­cus­sion about Hafni­um and crim­i­nal hack­ing groups was due to the US and its allies issue a big coor­di­nat­ed pub­lic rebuke of Chi­na’s involve­ment in the Exchange hack one day after the pair of NSO Group mega-scan­dal sto­ries. Sto­ries that raised enor­mous ques­tions about the hack­ing attri­bu­tions of the last decade, at a min­i­mum.

Macron to the World: New Phone, Who Dis?

And a few days after that coor­di­nat­ed pub­lic rebuke of Chi­na over “Hafni­um”, we get an update on the fall­out from the NSO Group sto­ry: Emmanuel Macron changed his phone. As a pre­cau­tion. His num­ber was on Moroc­co’s tar­get list. Awk­ward!

We also get an update from NSO Group on how its over­sight sys­tem works: while it does­n’t know the iden­ti­ties of the peo­ple tar­get­ed by Pega­sus, the com­pa­ny can retroac­tive­ly acquire the tar­get lists in the event of a com­plaint and uni­lat­er­al­ly shut down the offend­ing gov­ern­men­t’s sub­scrip­tion fol­low­ing an inves­ti­ga­tion. In oth­er words, NSO Group could in the­o­ry do ret­ro­spec­tive audits. But won’t unless there’s a com­plaint. A com­plaint about the super secret spy­ware you can’t find and don’t know about:

Reuters

France’s Macron changes phone in light of Pega­sus case

Michel Rose and Dan Williams
July 22, 2021 3:25 PM CDT Updat­ed

PARIS, July 22 (Reuters) — French Pres­i­dent Emmanuel Macron has changed his mobile phone and phone num­ber in light of the Pega­sus spy­ware case, a pres­i­den­cy offi­cial said on Thurs­day, in one of the first con­crete actions announced in rela­tion to the scan­dal.

“He’s got sev­er­al phone num­bers. This does not mean he has been spied on. It’s just addi­tion­al secu­ri­ty,” the offi­cial told Reuters. Gov­ern­ment spokesman Gabriel Attal said the pres­i­den­t’s secu­ri­ty pro­to­cols were being adapt­ed in light of the inci­dent.

A glob­al out­cry was trig­gered when sev­er­al inter­na­tion­al media organ­i­sa­tions report­ed that the Pega­sus spy­ware was used in hack­ing smart­phones belong­ing to jour­nal­ists, human rights activists and gov­ern­ment offi­cials in sev­er­al coun­tries.

In Israel, home of Pega­sus devel­op­er NSO Group, a senior law­mak­er said a par­lia­men­tary pan­el may look into spy­ware export restric­tions. NSO says its soft­ware is used to fight crime and ter­ror­ism and has denied any wrong­do­ing.

“Obvi­ous­ly we’re tak­ing (this) very seri­ous­ly,” Attal told reporters hours after an emer­gency cab­i­net meet­ing focused on the Pega­sus alle­ga­tions.

Le Monde news­pa­per and Radio France broad­cast­er report­ed on Tues­day that Macron’s phone was on a list of poten­tial tar­gets for sur­veil­lance by Moroc­co. The two media said that they did not have access to Macron’s phone and could not ver­i­fy if his phone had indeed been spied on.

Moroc­co has reject­ed these alle­ga­tions.

A French lawyer for Moroc­co, Olivi­er Baratel­li, said the gov­ern­ment planned to lodge defama­tion law­suits in Paris against non­govern­men­tal organ­i­sa­tions Amnesty Inter­na­tion­al and For­bid­den Sto­ries, accord­ing to French news out­let fran­ce­in­fo on Thurs­day. The two groups par­tic­i­pat­ed in the Pega­sus probe and alleged Moroc­co had tar­get­ed French offi­cials for sur­veil­lance with the spy­ware.

Amid mount­ing EU con­cern, Ger­man Chan­cel­lor Angela Merkel told reporters in Berlin that spy­ware should be denied to coun­tries where there is no judi­cial over­sight.

Hun­gar­i­an pros­e­cu­tors on Thurs­day launched an inves­ti­ga­tion into mul­ti­ple com­plaints received in the wake of the reports.

Israel has appoint­ed an inter-min­is­te­r­i­al team to assess reports based on an inves­ti­ga­tion by 17 media organ­i­sa­tions that said Pega­sus had been used in attempt­ed or suc­cess­ful hacks of smart­phones using mal­ware that enables the extrac­tion of mes­sages, records calls and secret­ly acti­vates micro­phones.

...

“We cer­tain­ly have to look anew at this whole sub­ject of licences grant­ed by DECA,” Ram Ben-Barak, head of the Knes­set For­eign Affairs and Defence Com­mit­tee, told Israel’s Army Radio, refer­ring to the gov­ern­ment-run Defence Export Con­trols Agency.

The Israeli gov­ern­ment team “will con­duct its checks, and we will be sure to look into the find­ings and see if we need to fix things here”, said Ben-Barak. A for­mer deputy chief of Mossad, he said prop­er use of Pega­sus had “helped a great many peo­ple”.

DECA is with­in Israel’s Defence Min­istry and over­sees NSO exports. Both the min­istry and the firm have said that Pega­sus is meant to be used to track only ter­ror­ists or crim­i­nals, and that all for­eign clients are vet­ted gov­ern­ments.

NSO says it does not know the spe­cif­ic iden­ti­ties of peo­ple against whom clients use Pega­sus. If it receives a com­plaint of Pega­sus hav­ing been mis­used by a client, NSO can retroac­tive­ly acquire the tar­get lists and, should the com­plaint prove true, uni­lat­er­al­ly shut down that clien­t’s soft­ware, the com­pa­ny says.

Oth­er world lead­ers among those whose phone num­bers the news organ­i­sa­tions said were on a list of pos­si­ble tar­gets include Pak­istani Prime Min­is­ter Imram Khan and Moroc­co’s King Mohammed VI.

———-

”
France’s Macron changes phone in light of Pega­sus case” by Michel Rose and Dan Williams; Reuters; 07/22/2021

“NSO says it does not know the spe­cif­ic iden­ti­ties of peo­ple against whom clients use Pega­sus. If it receives a com­plaint of Pega­sus hav­ing been mis­used by a client, NSO can retroac­tive­ly acquire the tar­get lists and, should the com­plaint prove true, uni­lat­er­al­ly shut down that clien­t’s soft­ware, the com­pa­ny says.”

NSO Group can retroac­tive­ly acquire the tar­get lists to inves­ti­gate com­plaints. It’s the kind of descrip­tion that sounds like NSO Group would need to go to the clients to retrieve the list of tar­get phone num­bers or emails. That’s the kind of over­sight regime that rais­es ques­tions about whether or not these clients have the capa­bil­i­ty to scrub those tar­get lists before return­ing them to NSO Group. It’s also the kind of over­sight regime that rais­es ques­tions about how any sort of over­sight could ever hap­pen out­side of instances when there’s a news report about NSO Group mal­ware being dis­cov­ered and a ‘ret­ro­spec­tive inves­ti­ga­tion’ is con­duct­ed. Either an insid­er needs to leak about it or vic­tims need to dis­cov­er the mal­ware. Those are the only viable sce­nar­ios that could real­is­ti­cal­ly trig­ger an inves­ti­ga­tion and this is super-secret mal­ware that oper­at­ed with­out being detect­ed for years. Almost noth­ing oth­er than the inves­tiga­tive report­ing done by Amnesty Inter­na­tion­al and For­bid­den Sto­ries could real­is­ti­cal­ly cause a client to have their sub­scrip­tion revoked.

And as we saw in the case of Sau­di Ara­bia and the fall­out from the Jamal Khashog­gi assas­si­na­tion, the fall­out — in the form of NSO Group can­cel­ing Sau­di Ara­bi­a’s sub­scrip­tion, a move opposed by the Israeli gov­ern­ment — was ulti­mate­ly reversed after NSO Group was sud­den­ly sold to new investors. That’s part of the con­text of Israel’s assur­ances that it will be look anew at the licens­es grant­ed for these sub­scrip­tion. It can’t look anew. It would be a diplo­mat­ic night­mare for Israel. And per­haps not some­thing Israel can rea­son­ably uni­lat­er­al­ly decide on its own. If what we are look­ing at here is a broad­er West­ern-sanc­tioned glob­al sys­tem for dis­trib­ut­ing lim­it­ed super-hack­er capa­bil­i­ties, the fate of NSO Group and the entire Israeli “com­mer­cial sur­veil­lance” sec­tor sud­den­ly becomes a much more mul­ti­lat­er­al affair:

...
“We cer­tain­ly have to look anew at this whole sub­ject of licences grant­ed by DECA,” Ram Ben-Barak, head of the Knes­set For­eign Affairs and Defence Com­mit­tee, told Israel’s Army Radio, refer­ring to the gov­ern­ment-run Defence Export Con­trols Agency.

The Israeli gov­ern­ment team “will con­duct its checks, and we will be sure to look into the find­ings and see if we need to fix things here”, said Ben-Barak. A for­mer deputy chief of Mossad, he said prop­er use of Pega­sus had “helped a great many peo­ple”.

DECA is with­in Israel’s Defence Min­istry and over­sees NSO exports. Both the min­istry and the firm have said that Pega­sus is meant to be used to track only ter­ror­ists or crim­i­nals, and that all for­eign clients are vet­ted gov­ern­ments.
...

Will the Israeli gov­ern­ment con­duct a mean­ing­ful audit of its cyber mer­ce­nary export sec­tor? The sto­ry of the NSO Group and Jamal Khashog­gi’s mur­der sug­gests oth­er­wise.

NSO Group and Candiru: Joined at the Founding Financial Hip

We’re now at the end of our arti­cle marathon. This one isn’t from Decem­ber 2020-July 2021. It’s from Octo­ber 2019. So it was­n’t old news as all of this as has been play­ing out. One mega-hack sto­ry after anoth­er. One Microsoft exploit after anoth­er. As the world turned to Microsoft to lead the inves­ti­ga­tion into this parade of Microsoft vul­ner­a­bil­i­ties (some might con­sid­er that a con­flict of inter­est), the fol­low­ing sto­ry for Octo­ber 2019 was sys­tem­at­i­cal­ly ignore: An intro­duc­tion to Can­diru, its pow­er­ful suite of Microsoft exploits, and the fact that its founders over­lap with the NSO Group’s founders.

Yep, in the fol­low­ing Forbes piece we learn how Can­diru has clients like Uzbek­istan, Sau­di Ara­bia, and the UAE. The main Can­diru finan­cial backer was Founders Group, which was co-found­ed by one of the three men who set up NSO Group, Omri Lavie. Addi­tion­al­ly, one of the lead investors is Founders Group man­ag­ing part­ner Isaac Zack. We’re also told that the indus­try is increas­ing­ly close to its finan­cial back­ers because, well, it’s become so con­tro­ver­sial there aren’t that many finan­cial back­ers avail­able. A hyper-secre­tive inces­tu­ous indus­try increas­ing­ly behold­en to the shrink­ing num­ber of peo­ple will­ing to go into some­thing this explo­sive­ly pow­er­ful:

Forbes

Meet Can­diru — The Mys­te­ri­ous Mer­ce­nar­ies Hack­ing Apple And Microsoft PCs For Prof­it

Thomas Brew­ster Forbes Staff
Cyber­se­cu­ri­ty
Asso­ciate edi­tor at Forbes, cov­er­ing cyber­crime, pri­va­cy, secu­ri­ty and sur­veil­lance.
Oct 3, 2019,06:06am EDT

Israel is home to scores of hack­er-for-hire busi­ness­es, but one of the most clan­des­tine has been Can­diru. With no web­site and few records avail­able, it’s oper­at­ed large­ly under the radar.

But now a researcher is claim­ing the elite Tel Aviv-based firm sold cyber weapons to the gov­ern­ment of Uzbek­istan, while indus­try sources tell Forbes the com­pa­ny is hack­ing both Microsoft Win­dows and Apple Macs for var­i­ous nation states.

In doing so it calls into ques­tion the company’s ethics for part­ner­ing with a gov­ern­ment brand­ed as an abuser of sur­veil­lance tools, just like the morals of its com­pa­tri­ot dig­i­tal arms deal­ers have come under scruti­ny over the last half decade.

Smash­ing Win­dows

Candiru’s spe­cial­i­ty, hack­ing Microsoft Win­dows for nation-state intel­li­gence agen­cies, is one key rev­enue stream. And one of those Can­diru cus­tomers is almost cer­tain­ly Uzbek­istan, accord­ing to Bri­an Bartholomew, a researcher at Russ­ian cyber­se­cu­ri­ty com­pa­ny Kasper­sky Lab. He claimed that a lapse in an Uzbek­istan intel­li­gence agency’s oper­a­tional secu­ri­ty allowed him to link mul­ti­ple Win­dows vul­ner­a­bil­i­ties used in Uzbek attacks back to Can­diru and two oth­er cus­tomers: Sau­di Ara­bia and the U.A.E.

Bartholomew detailed just how Uzbek­istan was slop­py to Forbes ahead of the pub­lic release of his research at London’s Virus Bul­letin con­fer­ence on Thurs­day, though he couldn’t pro­vide clear links between the leaked tools and the Israeli com­pa­ny.

Per­haps Uzbek­istan’s biggest mis­take was to set up a test com­put­er, exposed on the inter­net, that test­ed its hack­ing tools against var­i­ous antivirus sys­tems like Kasper­sky. Bartholomew’s team found that com­put­er online and not­ed that it reg­u­lar­ly con­nect­ed to a sin­gle Web address. And here’s where the Uzbek­istan gov­ern­ment exposed itself: Not only was that address reg­is­tered in Uzbek­istan, but the reg­is­trant was the appar­ent leader of “Mil­i­tary Unit 02616.” Though there was lit­tle infor­ma­tion on that divi­sion, Bart­hole­mew soon dis­cov­ered it was part of Uzbekistan’s sur­veil­lance agency, the Nation­al Secu­ri­ty Ser­vice (NSS).

Accord­ing to Bartholomew, the NSS is essen­tial­ly the suc­ces­sor to the Sovi­et KGB con­tin­gent, which trans­ferred pow­er in the ear­ly 1990s. “They have loads of pow­er. They can pret­ty much do what they want,” Bart­hole­mew said. The NSS also has a his­to­ry of buy­ing mal­ware from for­eign deal­ers, as revealed in the leaked 2015 emails of Ital­ian provider Hack­ing Team. Host­ed on Wik­ileaks, the emails con­tain fre­quent mes­sages about deals between Hack­ing Team and the unit; Bartholomew believes Uzbek­istan spent near­ly $1 mil­lion on the Ital­ian company’s ser­vices, look­ing at all the invoic­es in the leak.

But because the agency exposed its Win­dows exploits on the web, Kasper­sky researchers were able to link them to oth­er mali­cious soft­ware Bartholomew says were cre­at­ed by Can­diru, name­ly those that appeared to be con­trolled by Sau­di Ara­bia and the U.A.E. “Slop­py cus­tomers are bad cus­tomers,” the researcher said.

Human rights experts have now raised the alarm about Candiru’s cus­tomer base and the poten­tial for abuse. Bartholomew and anoth­er source with knowl­edge of the attacks said he dis­cov­ered Can­diru sur­veil­lance soft­ware was used in pre­vi­ous­ly report­ed hacks on Uzbek human rights activists and inde­pen­dent media.

“Each of these gov­ern­ments is a ser­i­al spy­ware abuser, and it is painful­ly pre­dictable that civ­il soci­ety got tar­get­ed again,” said John Scott-Rail­ton, a sur­veil­lance mar­ket researcher at the Uni­ver­si­ty of Toronto’s Cit­i­zen Lab. “For an indus­try that is try­ing to tell investors and reg­u­la­tors that it is work­ing to clean up its act, pro­vid­ing spy­ware to these auto­crat­ic regimes is a guar­an­teed way to get it abused.”

Rain­ing down on Macs

Can­diru spe­cial­izes in hack­ing Win­dows, but it’s also work­ing on tools to crack Apple’s MacOS oper­at­ing sys­tem, accord­ing to Tal Dil­ian, who claims to have part­nered with Can­diru as part of his work with his own sur­veil­lance start­up, Intellex­er. Though not sure, he also said Can­diru may also have a focus on iOS too.

Scott-Rail­ton said he was also con­vinced that Can­diru was devel­op­ing exploits for both Apple and Microsoft tech­nol­o­gy.

Israel’s dig­i­tal mer­ce­nar­ies unite

Out­side of Candiru’s appar­ent rela­tion­ship with Dilian’s spy­ware enterprises—WiSpear and Intellexa—it has at least one tie to the most con­tro­ver­sial of Israel’s sur­veil­lance providers: NSO Group. That’s because two indus­try sources said the main Can­diru finan­cial backer was Founders Group, cofound­ed by one of the three men who set up NSO, Omri Lavie.

As sur­veil­lance indus­try sources also told Forbes, one of the lead investors is Founders Group man­ag­ing part­ner Isaac Zack.. Accord­ing to Pitch­book, Zack is also a board mem­ber at wire­less charg­ing start­up Humavox and at Sepio Sys­tems. The lat­ter is a cyber­se­cu­ri­ty com­pa­ny, focused on doing the exact oppo­site of Can­diru: pro­tect­ing hard­ware from being turned into silent sur­veil­lance devices. Its board also includes Tamir Par­do, the for­mer head of the Mossad, Israel’s intel­li­gence agency.

Com­pa­nies like Can­diru are being forced to go to investors with whom they’re already on friend­ly terms because of an increas­ing antipa­thy towards the indus­try from typ­i­cal ven­ture cap­i­tal firms. “YL Ven­tures has not and will not invest in offen­sive cyber tech­nol­o­gy ven­dors,” said Yoav Leit­ers­dorf, man­ag­ing part­ner at YL Ven­tures. “The pri­ma­ry rea­son for this is eth­i­cal, since often­times the cus­tomers of these ven­dors end up using the tech­nol­o­gy in a way that vio­lates human rights, with or with­out the ven­dors’ knowl­edge. Such usage goes direct­ly against our val­ues and the val­ues of our lim­it­ed part­ners.”

Israeli firms have found them­selves at the cen­ter of an inter­na­tion­al con­tro­ver­sy over the sale of spy­ware to repres­sive gov­ern­ments. Can­diru has avoid­ed the spot­light up until now, but its rival NSO Group has become embroiled in sev­er­al con­tro­ver­sies. In Mex­i­co, the use of alleged NSO mal­ware Pega­sus by the gov­ern­ment to mon­i­tor jour­nal­ists, activists and lawyers work­ing on the 2014 killing of 43 stu­dents caused a major polit­i­cal scan­dal. And in Jan­u­ary, NSO chief Shalev Hulio had to state on the record that his firm had not worked with the Sau­di gov­ern­ment to mon­i­tor jour­nal­ist Jamal Khashog­gi in the months before his mur­der by Sau­di agents.

...

————

“Meet Can­diru — The Mys­te­ri­ous Mer­ce­nar­ies Hack­ing Apple And Microsoft PCs For Prof­it” by Thomas Brew­ster; Forbes; 10/03/2019

“Candiru’s spe­cial­i­ty, hack­ing Microsoft Win­dows for nation-state intel­li­gence agen­cies, is one key rev­enue stream. And one of those Can­diru cus­tomers is almost cer­tain­ly Uzbek­istan, accord­ing to Bri­an Bartholomew, a researcher at Russ­ian cyber­se­cu­ri­ty com­pa­ny Kasper­sky Lab. He claimed that a lapse in an Uzbek­istan intel­li­gence agency’s oper­a­tional secu­ri­ty allowed him to link mul­ti­ple Win­dows vul­ner­a­bil­i­ties used in Uzbek attacks back to Can­diru and two oth­er cus­tomers: Sau­di Ara­bia and the U.A.E.”

Uzbek­istan, Sau­di Ara­bia, and the UAE. Those were three of Can­diru’s clients iden­ti­fied back in late 2019 when the com­pa­ny first received media expo­sure and it’s obvi­ous­ly a very incom­plete client list. The kind of client list where we can be con­fi­dent all sorts of oth­er ter­ri­fy­ing cus­tomers are being qui­et­ly ser­viced.

Also keep in mind that Uzbek­istan’s hack­ers would­n’t have any trou­ble leav­ing Russ­ian ‘cul­tur­al arti­fact’ clues. They all speak Russ­ian. Of course, as we saw with the Shad­ow­Bro­kers sto­ry, the CIA’s hack­ing toolk­it fea­tured tools to inject Russ­ian or Man­darin into the code to leave leave kinds of clues so it’s not like a hack­er nec­es­sar­i­ly needs to know Russ­ian or Man­darin to leave these kinds of ‘clues’. But still, since such ‘clues’ are giv­en so much weight when it comes to cyber­at­tri­bu­tion, it behooves us to note that the hack­ers work­ing for the many for­mer Sovi­et Republics are going to know Russ­ian. At least enough to stick it in their code or on forums or wher­ev­er to make sure every­one knows it was the ‘Rus­sians’. We now know all dozens of gov­ern­ments have been sub­scrib­ing to these mal­ware ser­vices over the last decade. What are the odds they haven’t been doing pre­cise­ly what the CIA’s toolk­its do and inject­ing their own ‘cul­tur­al arti­facts’? What are the odds these sub­scrip­tion toolk­its don’t already offer those exact fea­tures? Sau­di Ara­bia and the UAE, for exam­ple, would prob­a­bly real­ly enjoy those fea­tures:

...
Accord­ing to Bartholomew, the NSS is essen­tial­ly the suc­ces­sor to the Sovi­et KGB con­tin­gent, which trans­ferred pow­er in the ear­ly 1990s. “They have loads of pow­er. They can pret­ty much do what they want,” Bart­hole­mew said. The NSS also has a his­to­ry of buy­ing mal­ware from for­eign deal­ers, as revealed in the leaked 2015 emails of Ital­ian provider Hack­ing Team. Host­ed on Wik­ileaks, the emails con­tain fre­quent mes­sages about deals between Hack­ing Team and the unit; Bartholomew believes Uzbek­istan spent near­ly $1 mil­lion on the Ital­ian company’s ser­vices, look­ing at all the invoic­es in the leak.

But because the agency exposed its Win­dows exploits on the web, Kasper­sky researchers were able to link them to oth­er mali­cious soft­ware Bartholomew says were cre­at­ed by Can­diru, name­ly those that appeared to be con­trolled by Sau­di Ara­bia and the U.A.E. “Slop­py cus­tomers are bad cus­tomers,” the researcher said.

Human rights experts have now raised the alarm about Candiru’s cus­tomer base and the poten­tial for abuse. Bartholomew and anoth­er source with knowl­edge of the attacks said he dis­cov­ered Can­diru sur­veil­lance soft­ware was used in pre­vi­ous­ly report­ed hacks on Uzbek human rights activists and inde­pen­dent media.

“Each of these gov­ern­ments is a ser­i­al spy­ware abuser, and it is painful­ly pre­dictable that civ­il soci­ety got tar­get­ed again,” said John Scott-Rail­ton, a sur­veil­lance mar­ket researcher at the Uni­ver­si­ty of Toronto’s Cit­i­zen Lab. “For an indus­try that is try­ing to tell investors and reg­u­la­tors that it is work­ing to clean up its act, pro­vid­ing spy­ware to these auto­crat­ic regimes is a guar­an­teed way to get it abused.”
...

And look at the remark­able rela­tion­ship between NSO Group and Can­diru: the main Can­diru finan­cial backer was Founders Group, co-found­ed by one of the three men who set up NSO, Omri Lavie, and one of the lead investors is Founders Group man­ag­ing part­ner Isaac Zack:

...
Out­side of Candiru’s appar­ent rela­tion­ship with Dilian’s spy­ware enterprises—WiSpear and Intellexa—it has at least one tie to the most con­tro­ver­sial of Israel’s sur­veil­lance providers: NSO Group. That’s because two indus­try sources said the main Can­diru finan­cial backer was Founders Group, cofound­ed by one of the three men who set up NSO, Omri Lavie.

As sur­veil­lance indus­try sources also told Forbes, one of the lead investors is Founders Group man­ag­ing part­ner Isaac Zack.. Accord­ing to Pitch­book, Zack is also a board mem­ber at wire­less charg­ing start­up Humavox and at Sepio Sys­tems. The lat­ter is a cyber­se­cu­ri­ty com­pa­ny, focused on doing the exact oppo­site of Can­diru: pro­tect­ing hard­ware from being turned into silent sur­veil­lance devices. Its board also includes Tamir Par­do, the for­mer head of the Mossad, Israel’s intel­li­gence agency.
...

So when we read about NSO Group and Can­diru both being licensed out to coun­tries like Sau­di Ara­bia, it’s seems like kind of a pack­age deal. You get Can­diru for the Microsoft exploits and NSO Group for the oth­er things.

********************************

Ok, we’re almost done with our excerpt marathon. A marathon that was almost all from just a sev­en month peri­od start­ing in Decem­ber 2020. Fire­Eye deliv­ers what felt like a night­mare at the time. And was and is a night­mare. Just not our worst night­mare. Not even close. Our night­mare sce­nario kept get­ting worse. Keeps going. It nev­er ends.

And sure, it’s nev­er going to end by def­i­n­i­tion. As long as there are com­put­er there are going to be hack sto­ries and some of them major hacks. But as we’ve seen, this is been an unusu­al sev­en month peri­od. One mega-hack after anoth­er. It’s like cyber-cli­mate change just start­ed to become notice­able.

And through­out this wave of Microsoft mega-hacks, we’ve had Microsoft lead­ing the way in attri­bu­tions. It’s always a state-backed actor. Known with­in 24 to 48 hours. Con­clu­sive­ly. Rus­sia or Chi­na. Don’t ask why. Just accept the con­clu­sion. The high­ly self-serv­ing easy con­clu­sion that is far less ter­ri­fy­ing than the idea of crim­i­nals car­ry­ing out these mega-hacks. Yes, the US gov­ern­ment backs Microsoft on these attri­bu­tions. Also with­out pro­vid­ing any hint of the evi­dence it’s based on. Just accept what­ev­er attri­bu­tion peo­ple come up with uncrit­i­cal­ly because, hey, they’re experts. They must know, right? That’s the cli­mate of con­tem­po­rary cyber­at­tri­bu­tion: Watch­ing peo­ple engage it what appears to be read­ing the dig­i­tal tea leaves to come up with the cul­prit, who then pro­claim their find­ings like a foren­sic exam­i­na­tion deci­sive­ly con­clud­ed it. And for the most part this is absolute­ly unques­tioned.

Now, it’s impor­tant to keep one thing in mind in terms of this cyber­at­tri­bu­tion regime: part of the rea­son Microsoft and gov­ern­ments make these attri­bu­tion pro­nounce­ments with­out both­er­ing to give any evi­dence and act as if we should just trust them is because we more or less have to do exact­ly that. We have to just trust Microsoft and gov­ern­ments and who­ev­er else has access to the com­put­er sys­tems to study these hacks. Much of the evi­dence is pri­vate and some­one has to go in and the foren­sic cyber-inves­ti­ga­tions exam­in­ing mal­ware, look­ing for ‘cul­tur­al arti­facts’ or what­ev­er. That’s all well and good and part of how a tech­no­log­i­cal­ly com­plex soci­ety oper­ates. It’s heav­i­ly trust-based.

But that’s pre­cise­ly why the high­ly con­ve­nient and log­i­cal­ly sus­pect nar­ra­tives that con­tin­u­al­ly pop up around these mega-hacks — where the cul­prit is always Russ­ian or Chi­nese hack­ers, declared with­in days — is so prob­lem­at­ic. We’re forced to trust the inves­ti­ga­tors because no evi­dence is ever giv­en. And yet the con­clu­sions always seem like they were con­ve­nient­ly made up and vir­tu­al­ly nev­er acknowl­edge the exis­tence of a glob­al indus­try of com­pa­nies like NSO Group and Can­diru. If activists are tar­get­ed, sure, a gov­ern­ment run­ning “com­mer­cial sur­veil­lance ven­dor” soft­ware might be sus­pect­ed, as was the case with Can­diru’s mal­ware get­ting caught being used against activists. But that’s basi­cal­ly the only time we see this legal offen­sive cyber-for-hire indus­try come up in the attri­bu­tions. It’s near­ly always oth­er­wise attrib­uted to Rus­sia, Chi­na, North Korea or Iran. Maybe crim­i­nals if no gov­ern­ment net­works got it. But that’s basi­cal­ly it. That’s con­tem­po­rary cyber­at­tri­bu­tion regime. Those are the accept­able choic­es. Rus­sia, Chi­na, North Korea Iran, maybe crim­i­nals. While at least 40 gov­ern­ments around the world have NSO Group sub­scrip­tions. And sto­ries like the Vault7 hack­ing tools that plant­ed for­eign ‘cul­tur­al arti­facts’ are less than a decade all. Each indi­vid­ual hack might by hard to assess, but tak­en togeth­er it’s just implau­si­ble.

To get a sense of how implau­si­ble, here’s our final quick excerpt. It’s from Octo­ber 2020, about the find­ing in Microsoft Dig­i­tal Defence Report, which you can down­load here. The report includes a dia­gram (page 42) show­ing the per­cent break­down of the dif­fer­ent coun­tries for the state-backed attri­bu­tions made by Microsoft­’s Microsoft­’s Threat Intel­li­gence Cen­ter (MSTC) study between July 2019 and June 2020. So this is Microsoft telling us what it’s own secu­ri­ty experts found. There were just four coun­tries on the entire chart. Guess which four: 52 per­cent of hacked attrib­uted to state-backed actors were attrib­uted to Rus­sia, 25 per­cent to Iran, 12 to Chi­na, and 11 to North Korea. Now, take a moment to digest those num­bers. 52 + 25 + 12+ 11 = 100. 100 per­cent of the state-backed attri­bu­tions made between July 2019 and June 2020 by Microsoft were Rus­sia, Iran, Chi­na, or North Korea. All of them. That’s why the ‘trust us’ attri­bu­tion par­a­digm is slow prob­lem­at­ic. It’s hard to trust an implau­si­ble nar­ra­tive:

The Inde­pen­dent

Rus­sia respon­si­ble for over half of all state-spon­sored hack­ing, Microsoft says

Attacks focused on polit­i­cal groups, rather than nation­al infra­struc­ture, in an attempt to affect oth­er gov­ern­ments’ pol­i­cy

Adam Smith
Fri­day 02 Octo­ber 2020 14:57

Rus­sia is respon­si­ble for over half of all state-spon­sored hack­ing, vast­ly more than any oth­er state, accord­ing to a new report from Microsoft.

Russ­ian activ­i­ty made up 52 per cent of all attacks between July 2019 and June 2020, the soft­ware giant’s Dig­i­tal Defence Report states.

It is fol­lowed by Iran, which makes up 25 per cent of the attacks mon­i­tored.

Chi­na is respon­si­ble for 12 per cent of attacks, while North Korea and oth­er states make up the final 11 per cent.

The major­i­ty of their tar­gets have been in the Unit­ed States, which is tar­get­ed 69 per cent of the time. The Unit­ed King­dom is the next most pop­u­lar vic­tim, receiv­ing 19 per cent of attacks, fol­lowed by Cana­da, South Kora, and Sau­di Ara­bia.

While there has been much con­cern over recent years that coun­tries’ crit­i­cial nation­al infas­truc­ture – such as the nation­al grid of finan­cial ser­vices – could be tar­get­ed by hack­ers, Microsoft says that is not the most com­mon tar­get.

Accord­ing to the soft­ware giant, 90 per cent of attacks from nation-states have been focused on “non­govern­men­tal organ­i­sa­tions (NGOs), advo­ca­cy groups, human rights orga­ni­za­tions and think tanks focused on pub­lic pol­i­cy, inter­na­tion­al affairs or secu­ri­ty.”

The com­pa­ny sug­gests that nation-states are hop­ing to influ­ence gov­ern­ment pol­i­cy through sub­tler means, rather than tar­get­ing infra­struc­ture direct­ly.

...

————

“Rus­sia respon­si­ble for over half of all state-spon­sored hack­ing, Microsoft says” by Adam Smith; The Inde­pen­dent; 10/02/2020

Again, 52 + 25 + 12+ 11 = 100. Microsoft­’s threat assess­ment team can appar­ent­ly only deter­mine hacks came from those four coun­tries. Even at a time when dozens of gov­ern­ments have sub­scrip­tions soft­ware from com­pa­nies like NSO Group and Can­diru and none of this is real­ly a secret. It’s shame­less. No states decid­ed to abuse their super spy­ware? None at all? Just Russ­ian, Iran, Chi­na, and North Korea? Yes, that’s what we are being it’s to believe by Microsoft and Microsoft is the lead­ing fig­ure shap­ing this nar­ra­tive. A nar­ra­tive most­ly about Microsoft vul­ner­a­bil­i­ties of late. Lots of Microsoft vul­ner­a­bil­i­ties and yet almost no men­tions by Microsoft­’s threat assess­ment teams of Can­diru’s exis­tence. The com­pa­ny exists to sell super Microsoft exploits to gov­ern­ments around the world and yet, in this entire col­lec­tion of sto­ries we looked it, it was only after Cit­i­zen­Lab pub­licly iden­ti­fied new Microsoft zero-day exploits Can­diru’s clients were using against activists that we saw Microsoft even acknowl­edge the exis­tence of Can­diru.

But to real­ly appre­ci­ate why this prob­lem­at­ic cyber­at­tri­bu­tion nar­ra­tive — where it’s always Rus­sia, Iran, Chi­na, and North Korea — is so wild­ly dan­ger­ous to civ­i­liza­tion, we have to appre­ci­ate how the Solar­Winds hack and Microsoft Exchange mega-hacks relate to these seem­ing­ly sooth­ing words from Microsoft back in Octo­ber when it was assuag­ing con­cerns about attacks on crit­i­cal infra­struc­ture: nation-states are hop­ing to influ­ence gov­ern­ment pol­i­cy through sub­tler means, rather than tar­get­ing infra­struc­ture direct­ly:

...
While there has been much con­cern over recent years that coun­tries’ crit­i­cial nation­al infas­truc­ture – such as the nation­al grid of finan­cial ser­vices – could be tar­get­ed by hack­ers, Microsoft says that is not the most com­mon tar­get.

Accord­ing to the soft­ware giant, 90 per cent of attacks from nation-states have been focused on “non­govern­men­tal organ­i­sa­tions (NGOs), advo­ca­cy groups, human rights orga­ni­za­tions and think tanks focused on pub­lic pol­i­cy, inter­na­tion­al affairs or secu­ri­ty.”

The com­pa­ny sug­gests that nation-states are hop­ing to influ­ence gov­ern­ment pol­i­cy through sub­tler means, rather than tar­get­ing infra­struc­ture direct­ly.
...

Microsoft was telling us this as the Solar­Winds hack was ongo­ing and two months before it was revealed. And as we’ve seen, both the Solar­Winds and Microsoft Exchange mega-hacks could arguably be con­sid­ered attacks on crit­i­cal infra­struc­ture. They were a very big deal. Espe­cial­ly the Microsoft Exchange hacks that could be auto­mat­ed and were car­ried out by seem­ing­ly for-prof­it crim­i­nal actors. That’s an infra­struc­ture attack. Who­ev­er car­ried this out was con­duct­ing a kind of dig­i­tal infra­struc­ture attack. It was that vast and aggres­sive.

But beyond the imme­di­ate dam­age by these mega-hacks, it’s the poten­tial for seeds to have been sown for future even more dev­as­tat­ing hacks that make these sto­ries absolute­ly dev­as­tat­ing from a secu­ri­ty stand­point. Basi­cal­ly every major orga­ni­za­tion’s com­put­er net­works got hit by sophis­ti­cat­ed actors with a demon­strat­ed capac­i­ty to deploy mul­ti­ple zero-day exploits. We have every rea­son to believe the retained access to a large num­ber of these net­works. Remem­ber what Bill Whitak­er of Bold­en told us: it would have been triv­ial for the Solar­Winds hack­ers to have turned that mal­ware into the kind of stuff that caus­es the com­put­ers on those net­works to effec­tive­ly self-destruct. A few dozen more lines of code. That’s how eas­i­ly these kinds of mega-hacks can become major crises. Lethal crises. Imag­ine the dig­i­tal infra­struc­ture of most of the world get­ting crip­pled with ran­somware simul­ta­ne­ous­ly. A few dozen lines of code could have turned Solar­Winds or the Exchange hack into the kind of hack that crip­ples phys­i­cal infra­struc­ture.

Now imag­ine a glob­al strike like that that crip­ples every coun­ty’s dig­i­tal infra­struc­ture except, say, Rus­si­a’s. Or Chi­na’s. It would be treat­ed as an act of war. And we could be pret­ty con­fi­dent Microsoft and plen­ty of oth­er actors in the secu­ri­ty sec­tor would be more than hap­py to pro­vide those defin­i­tive attri­bu­tions that, yes, it was Rus­sia. Or Chi­na. Or Iran or North Korea or who­ev­er is most con­ve­nient. Hack­ing has become the per­fect crime in mul­ti­ple sens­es. Not only can a hack be exe­cut­ed in a man­ner where no one can deter­mine the iden­ti­ty of the cul­prit but, by virtue of that com­pli­ca­tion, any­one can become the cul­prit. True con­clu­sive attri­bu­tion is so dif­fi­cult, and yet increas­ing­ly impor­tant and urgent, that civ­i­liza­tion has col­lec­tive just turned to the dig­i­tal secu­ri­ty indus­try and gov­ern­ments and asked them to give us their best edu­cat­ed guess­es and then we treat those best edu­cat­ed guess­es as con­clu­sive find­ings. It real­ly is a faith-based attri­bu­tion sys­tem. Increas­ing­ly faith in Microsoft being hon­est about Microsoft mega-hacks. There’s bad faith. And blind faith. And then there’s that kind of faith. Blind dumb faith in Microsoft­’s hon­esty and integri­ty. It’s clear­ly very pop­u­lar these days. Enjoy it while you still can.

Discussion

31 comments for “Cyber Attribution, the Mega-Hacks of 2021, and the Existential Threat of Blind Faith in Bad-Faith”

  1. Wel­come to your new secu­ri­ty night­mare. Brought to you by Microsoft: The recent­ly com­pa­ny issued an update on a rel­a­tive new zero-day exploit. “Print­Night­mare”. The appro­pri­ate­ly named exploit real­ly is a secu­ri­ty night­mare. The vul­ner­a­bil­i­ty in Microsoft­’s print spool­ing soft­ware — the soft­ware that man­ages which doc­u­ments get print­ed next from the print­er — poten­tial­ly allowed hack­ers to install pro­grams, change data and cre­ate new accounts with full user rights, among oth­er actions. In oth­er words, your entire com­put­er net­work could be tak­en over.

    Microsoft­’s recent update on the vul­ner­a­bil­i­ties includes a new vul­ner­a­bil­i­ty that allows for the remote exe­cu­tion of any code on the sys­tem. It’s the kind of update that let’s us know this vul­ner­a­bil­i­ty was even big­ger than pre­vi­ous­ly acknowl­edged, which is pret­ty amaz­ing giv­en the scope of the ini­tial warn­ing. It’s like learn­ing you can be hacked even more thor­ough­ly.

    So what is Microsoft rec­om­mend­ing in response to this lat­est hyper-sys­temic vul­ner­a­bil­i­ty? Dis­able the print­er spool­ing ser­vices, for starters. Patch your servers. And final­ly, migrate to Microsoft­’s Cloud ser­vices. And that appears to be what the ulti­mate ‘fix’ is going to be as this era of mega-hacks accel­er­ates: flee to the safe­ty of the cloud. Of course, as we’re going to see, the cloud may not be as safe as adver­tised. Sur­prise!

    Ok, first, here’s a report from ear­ly July, when the world woke up to a newest Microsoft secu­ri­ty night­mare: the gen­uine­ly ter­ri­fy­ing ‘Print­Night­mare’:

    CRN

    Microsoft Patch­es ‘Print­Night­mare’ Vul­ner­a­bil­i­ty In Win­dows, Urges Imme­di­ate Install

    The vul­ner­a­bil­i­ty — offi­cial­ly dubbed CVE-2021–34527 — is found in how Print Spool­er improp­er­ly per­forms priv­i­leged file oper­a­tions, accord­ing to a Microsoft post.

    By Wade Tyler Mill­ward
    July 07, 2021, 03:48 PM EDT

    Microsoft has released secu­ri­ty updates to address a vul­ner­a­bil­i­ty in Win­dows print spool­er dubbed “Print­Night­mare,” rec­om­mend­ing that users “install these updates imme­di­ate­ly.”

    The vul­ner­a­bil­i­ty — offi­cial­ly dubbed “CVE-2021–34527” — is found in how print spool­er improp­er­ly per­forms priv­i­leged file oper­a­tions, accord­ing to a Microsoft post. An attack­er could use the vul­ner­a­bil­i­ty to install pro­grams, change data and cre­ate new accounts with full user rights, among oth­er actions.

    The vul­ner­a­bil­i­ty exist­ed before the June 8 secu­ri­ty update, accord­ing to Microsoft. Print spool­er is an exe­cutable file that man­ages the print­ing process.

    All ver­sions of Win­dows are vul­ner­a­ble and domain con­trollers are affect­ed if print spool­er ser­vice is enabled. Point and Print can be exploit­ed through the vul­ner­a­bil­i­ty as well. Sup­port­ed ver­sions of Win­dows with­out a secu­ri­ty update made avail­able Tues­day will “be updat­ed short­ly after July 6.” Secu­ri­ty updates are now avail­able for Win­dows ver­sions includ­ing Serv­er 2019, Serv­er 2016, Serv­er 2012 and ver­sions of Win­dows 7 and Win­dows 10.

    The updates also solve a sep­a­rate vul­ner­a­bil­i­ty dubbed CVE-2021–1675 iden­ti­fied in June. Microsoft described this vul­ner­a­bil­i­ty — iden­ti­fied on June 30 by the CERT Coor­di­na­tion Cen­ter non­prof­it — as “sim­i­lar but dis­tinct” from Print­Night­mare.

    ...

    Mul­ti­ple print spool­er vul­ner­a­bil­i­ties have been iden­ti­fied over the years.

    The past year, in par­tic­u­lar, has seen Microsoft get far more vocal and aggres­sive around the need for increas­ing secu­ri­ty, includ­ing an empha­sis on urg­ing busi­ness­es to shift to the cloud from on-premis­es infra­struc­ture.

    On Tues­day, CRN report­ed that hack­ers attempt­ed to use IT dis­trib­u­tor Syn­nex to gain access to cus­tomer appli­ca­tions with­in the Microsoft cloud envi­ron­ment in an attack pos­si­bly tied to the Kaseya ran­somware cam­paign.

    Mike Wil­son, chief tech­nol­o­gy offi­cer and a part­ner at Inter­link Cloud Advi­sors, a Mason, Ohio-based Microsoft Gold part­ner, said that Microsoft act­ed quick­ly on the patch–which was impor­tant because the vul­ner­a­bil­i­ty affect­ed all ver­sions of Win­dows and could lead to mal­ware embed­ding and a ran­somware attack.

    ...

    ———–

    “Microsoft Patch­es ‘Print­Night­mare’ Vul­ner­a­bil­i­ty In Win­dows, Urges Imme­di­ate Install” by Wade Tyler Mill­ward; CRN; 07/07/2021

    “The vul­ner­a­bil­i­ty — offi­cial­ly dubbed “CVE-2021–34527” — is found in how print spool­er improp­er­ly per­forms priv­i­leged file oper­a­tions, accord­ing to a Microsoft post. An attack­er could use the vul­ner­a­bil­i­ty to install pro­grams, change data and cre­ate new accounts with full user rights, among oth­er actions.”

    Who knows why Microsoft allows print spool­ers to cre­ate new accounts with full user rights, but they did. And any­one who knew about this vul­ner­a­bil­i­ty could have poten­tial­ly tak­en over the entire con­nect­ed net­work.

    And CVE-2021–34527 is just one of the vul­ner­a­bil­i­ties of this nature recent­ly dis­cov­ered. There was also CVE-2021–1675 found in June that is appar­ent­ly sim­i­lar but dis­tinct:

    ...
    The updates also solve a sep­a­rate vul­ner­a­bil­i­ty dubbed CVE-2021–1675 iden­ti­fied in June. Microsoft described this vul­ner­a­bil­i­ty — iden­ti­fied on June 30 by the CERT Coor­di­na­tion Cen­ter non­prof­it — as “sim­i­lar but dis­tinct” from Print­Night­mare.
    ...

    It’s the kind of update that hints at more “sim­i­lar but dis­tinct” super exploits sit­ting there wait­ing to be found. And that’s exact­ly the warn­ing we appeared to get from Kel­ly Yeh, pres­i­dent of Chan­til­ly, Va.-based Microsoft part­ner Pha­lanx Tech­nol­o­gy Group last week after Microsoft dis­closed a new Win­dows Print Spool­er vul­ner­a­bil­i­ty. The new vul­ner­a­bil­i­ty allowed for remote code exe­cu­tion that would sim­i­lar­ly enable hack­ers to install pro­grams, cre­ate new accounts with full user rights and even view, change or delete data. As Yeh warns us, “This is going to be the first of many exploits that prob­a­bly come out.” And since this print spool­er exploit was the sec­ond vul­ner­a­bil­i­ty of this nature recent­ly dis­closed (the first one, CVE-2021–1675, came out in June), Yeh is already tech­ni­cal­ly cor­rect.

    What should orga­ni­za­tions do in response to one super-Microsoft vul­ner­a­bil­i­ty after anoth­er? Migrate to the cloud. That’s Yeh’s advice. Stop try­ing to local­ly man­age things and let Microsoft do the man­age­ment for you:

    CRN

    Microsoft Dis­clos­es Anoth­er Win­dows Print Vul­ner­a­bil­i­ty, Under­scor­ing Cloud Push For MSPs

    ‘We as MSPs were scram­bling to turn all the print ser­vices off,’ said Kel­ly Yeh, pres­i­dent of Chan­til­ly, Va.-based Microsoft part­ner Pha­lanx Tech­nol­o­gy Group. ‘It was kind of chaot­ic.’

    By Wade Tyler Mill­ward
    August 12, 2021, 06:36 PM EDT

    A day after Microsoft released more updates for the Win­dows vul­ner­a­bil­i­ties known as “Print­Night­mare,” the tech giant has issued anoth­er report on a Win­dows Print Spool­er vul­ner­a­bil­i­ty.

    Kel­ly Yeh, pres­i­dent of Chan­til­ly, Va.-based Microsoft part­ner Pha­lanx Tech­nol­o­gy Group, told CRN in an inter­view that the ongo­ing strug­gle to patch Win­dows Print Spool­er is a real-world exam­ple of why many Microsoft cus­tomers should move more process­es to the cloud.

    “This is going to be the first of many exploits that prob­a­bly come out,” Yeh said. “That exploit [Print­Night­mare] is actu­al­ly a pret­ty big exploit, from what we were read­ing it can do.”

    The lat­est dis­cov­ery is a remote code exe­cu­tion vul­ner­a­bil­i­ty when Win­dows Print Spool­er improp­er­ly per­forms priv­i­leged file oper­a­tions. Hack­ers could exploit the vul­ner­a­bil­i­ty to install pro­grams, cre­ate new accounts with full user rights and even view, change or delete data.

    “The workaround for this vul­ner­a­bil­i­ty is stop­ping and dis­abling the Print Spool­er ser­vice,” accord­ing to the Microsoft dis­clo­sure Wednes­day.

    The dis­clo­sure con­tin­ued: “We are devel­op­ing a secu­ri­ty update. Solu­tions to ver­i­fied secu­ri­ty issues are nor­mal­ly released via our month­ly Update Tues­day cadence.”

    In response to CRN ques­tions about this lat­est vul­ner­a­bil­i­ty, a Microsoft spokesper­son said in an email: “We are aware of the report and are inves­ti­gat­ing. An inter­im workaround is described here.”

    Yeh said that the vul­ner­a­bil­i­ty comes at a time when busi­ness­es are try­ing to return to the office and on-premis­es servers haven’t been patched and reboot­ed in some time. While he wish­es Microsoft had patched all ver­sions of the serv­er imme­di­ate­ly to avoid mul­ti­ple secu­ri­ty updates, Yeh has been turn­ing off vul­ner­a­ble servers to avoid the vul­ner­a­bil­i­ty.

    “We as MSPs were scram­bling to turn all the print ser­vices off,” Yeh said. “We then had to remap every­body direct­ly to the print­ers, so that we didn’t have to have print servers. And even then, hav­ing that ser­vice run­ning on the work­sta­tions also made the work­sta­tions vul­ner­a­ble. So it was kind of chaot­ic.”

    The inci­dent has led to more con­ver­sa­tions around why clients need to adopt more cloud prod­ucts and ser­vices. Microsoft’s Share­Point in Microsoft 365, for exam­ple, have ver­sion con­trol, auto­mat­ic pro­tec­tion from ran­somware, mul­ti-fac­tor imple­men­ta­tion and data-loss pre­ven­tion, Yeh said. Azure has secu­ri­ty fea­tures to pro­tect lega­cy sys­tems.

    ...

    ———–

    “Microsoft Dis­clos­es Anoth­er Win­dows Print Vul­ner­a­bil­i­ty, Under­scor­ing Cloud Push For MSPs” by Wade Tyler Mill­ward; CRN; 08/12/2021

    ““This is going to be the first of many exploits that prob­a­bly come out,” Yeh said. “That exploit [Print­Night­mare] is actu­al­ly a pret­ty big exploit, from what we were read­ing it can do.””

    The first [actu­al­ly sec­ond] of many exploits to come. Prob­a­bly. Just wait. And in the mean time, we get to learn more about the known super-vul­ner­a­bil­i­ties. Like the abil­i­ty to remote­ly exe­cute code via the Print Spool­er. It’s like total orga­ni­za­tion­al access was built Microsoft­’s Print­er Spool­ing soft­ware:

    ...
    The lat­est dis­cov­ery is a remote code exe­cu­tion vul­ner­a­bil­i­ty when Win­dows Print Spool­er improp­er­ly per­forms priv­i­leged file oper­a­tions. Hack­ers could exploit the vul­ner­a­bil­i­ty to install pro­grams, cre­ate new accounts with full user rights and even view, change or delete data.

    “The workaround for this vul­ner­a­bil­i­ty is stop­ping and dis­abling the Print Spool­er ser­vice,” accord­ing to the Microsoft dis­clo­sure Wednes­day.

    The dis­clo­sure con­tin­ued: “We are devel­op­ing a secu­ri­ty update. Solu­tions to ver­i­fied secu­ri­ty issues are nor­mal­ly released via our month­ly Update Tues­day cadence.”
    ...

    And, again, this is just the lat­est Microsoft secu­ri­ty night­mare on top of all the rest. With more to come. What are cyber secu­ri­ty pro­fes­sion­als to do? Run to the sweet embrace of Microsoft­’s cloud ser­vices:

    ...
    Kel­ly Yeh, pres­i­dent of Chan­til­ly, Va.-based Microsoft part­ner Pha­lanx Tech­nol­o­gy Group, told CRN in an inter­view that the ongo­ing strug­gle to patch Win­dows Print Spool­er is a real-world exam­ple of why many Microsoft cus­tomers should move more process­es to the cloud.

    ...

    The inci­dent has led to more con­ver­sa­tions around why clients need to adopt more cloud prod­ucts and ser­vices. Microsoft’s Share­Point in Microsoft 365, for exam­ple, have ver­sion con­trol, auto­mat­ic pro­tec­tion from ran­somware, mul­ti-fac­tor imple­men­ta­tion and data-loss pre­ven­tion, Yeh said. Azure has secu­ri­ty fea­tures to pro­tect lega­cy sys­tems.
    ...

    Keep in mind that there isn’t any mag­i­cal about cloud envi­ron­ments. They can still be hacked but, ide­al­ly, there’s just a lot more resources focused on their secu­ri­ty. At the same time, gain­ing access to a cloud envi­ron­ment would be the ulti­mate hack­ing prize. Many peo­ple have to be work­ing on that chal­lenge and it’s hard to imag­ine they aren’t going to suc­ceed some day. And if we lis­ten to Crowd­Strike CEO George Kurtz in the fol­low­ing recent inter­view, that suc­cess has already been achieved. As Kurtz told the US Sen­ate back in Feb­ru­ary in response to the Solar­Winds hack, short­com­ings in how Microsoft authen­ti­cates cre­den­tials have been repli­cat­ed in the cloud. And don’t for­get what we already saw in reports days after the Solar­Winds hack was ini­tial­ly dis­closed in Decem­ber: the Solar­Winds hack­ers demon­strat­ed an abil­i­ty to cre­ate pass­word cre­den­tials for legit­i­mate process­es enabling, them to read emails from Microsoft’s Exchange Online cloud-based email ser­vice. So we’re already see­ing hints of some sort of future cloud-based mega-hack. As Kurtz put it in the inter­view, “In oth­er tech­nolo­gies, you can’t nec­es­sar­i­ly just steal pass­words and use those encrypt­ed pass­words to authen­ti­cate to some­thing...“But in the Microsoft world, you lit­er­al­ly can steal an encrypt­ed pass­word, with­out even decrypt­ing it, and pass that hash to anoth­er Microsoft sys­tem and access the sys­tem as if you knew what the pass­word was.”:

    CRN

    Strike First, Strike Hard: How George Kurtz Has Built Crowd­Strike Into A Cyber­se­cu­ri­ty Pow­er­house

    Crowd­Strike CEO George Kurtz is fired up as his elite end­point pro­tec­tion plat­form con­tin­ues to win over cus­tomers, and he’s pulling no punch­es when it comes to tak­ing on his rivals.

    By Michael Novin­son
    August 09, 2021, 09:30 AM EDT

    Black­Lake Secu­ri­ty was about to ini­ti­ate a three-year Crowd­Strike sub­scrip­tion renew­al for an oil-and-gas cus­tomer when it received shock­ing news: The cus­tomer had been wooed by low­er pric­ing and was switch­ing to Microsoft.

    But Black­Lake founder and CEO Mark Jones knew the cus­tomer didn’t ful­ly under­stand how much func­tion­al­i­ty and per­for­mance it would be giv­ing up if it made the change, so he con­vinced the cus­tomer, which Jones declined to name, to take a call with Black­Lake and Crowd­Strike to let them lay out all the ways CrowdStrike’s tech­nol­o­gy beats Microsoft’s.

    CrowdStrike’s engi­neer didn’t even make it halfway through the pre­sen­ta­tion before the cus­tomer changed its mind and decid­ed to renew, Jones said.

    “Microsoft will come in and give you a price that makes you go, ‘Wow, is Crowd­Strike real­ly that much bet­ter?’ Well, yeah, it actu­al­ly is,” Jones told CRN. “You get what you pay for.”

    With wins like that under his belt, it’s no won­der Crowd­Strike co-founder, Pres­i­dent and CEO George Kurtz is con­fi­dent in the company’s tech­nol­o­gy, pulling no punch­es whether he’s fight­ing off hack­ers with his company’s elite end­point pro­tec­tion plat­form or tak­ing on rivals like Microsoft and Sen­tinelOne by call­ing out where he says they fall short.

    “When you look at our suc­cess, we’ve got the finan­cial suc­cess and the per­for­mance, but that starts with hav­ing the best tech­nol­o­gy and the best plat­form, not just the best AV [anti-virus] prod­uct,” said Kurtz, who’s ranked as the ninth most influ­en­tial leader on CRN’s 2021 Top 100 Exec­u­tives list.

    CrowdStrike’s tech­nol­o­gy earns kudos from indus­try ana­lysts as well. The Sun­ny­vale, Calif.-based company’s Fal­con plat­form beat out 11 com­peti­tors to take the crown as Forrester’s top end­point secu­ri­ty SaaS prod­uct this year. And in Gartner’s 2021 Mag­ic Quad­rant for End­point Pro­tec­tion Plat­forms, Crowd­Strike, along with Microsoft, earned the high­est rat­ings by a sig­nif­i­cant mar­gin.

    Kurtz’s con­fi­dence also comes in part from CrowdStrike’s abil­i­ty to out­last many of its ear­ly foes. A slew of star­tups, includ­ing Crowd­Strike, emerged in the 2000s and ear­ly 2010s to take on weak­ness­es in Symantec’s and McAfee’s anti-virus prod­ucts with a mod­ern approach that’s pre­dic­tive, sig­na­ture-less and goes beyond pre­ven­tion. But most of those chal­lengers cashed in their chips in 2019, with Car­bon Black, Cylance and Endgame get­ting bought by VMware, Black­Ber­ry and Elas­tic, respec­tive­ly, for a com­bined $3.7 bil­lion.

    “They didn’t build a plat­form. They were one-trick ponies that built a slight­ly bet­ter AV prod­uct than the lega­cy play­ers that were out there,” Kurtz told CRN in an exclu­sive inter­view in July. “But for me, it was all about, ‘Let’s build the plat­form the right way. And let’s have investors that under­stand this is a long play.’ We saw the big play of being the Sales­force of secu­ri­ty.”

    Elas­tic told CRN that Endgame’s prod­uct com­bined anti-virus with end­point detec­tion and response. Black­Ber­ry and VMware Car­bon Black did not respond to a request for com­ment.

    Crowd­Strike went pub­lic in June 2019 at a then-indus­try record $6.6 bil­lion val­u­a­tion. It was the fastest-grow­ing pub­lic com­pa­ny in all of cyber­se­cu­ri­ty in 2020, with sales surg­ing 82 per­cent to $874.4 mil­lion. And the cus­tomer wins keep on rolling in this year, with rev­enue expect­ed to jump 56 per­cent to $1.36 bil­lion. Sev­en­ty-five per­cent of its sales come through the chan­nel.

    Crowd­Strike sub­stan­tial­ly increased its mar­ket share in 2020 to become the world’s sec­ond-largest cor­po­rate end­point secu­ri­ty ven­dor, cap­tur­ing 9.2 per­cent of the $8.2 bil­lion mar­ket. That trails only Trend Micro, accord­ing to research firm IDC. And as of press time, Crowd­Strike is worth $59.43 bil­lion, mak­ing it the most high­ly val­ued pure-play ven­dor in all of cyber­se­cu­ri­ty.

    ‘A Cri­sis In Trust Around Microsoft Tech­nolo­gies’

    Crowd­Strike has become one of Microsoft’s most vocal secu­ri­ty crit­ics, with Kurtz blast­ing “sys­temic weak­ness­es in the Win­dows authen­ti­ca­tion archi­tec­ture” for exac­er­bat­ing the impact of the Solar­Winds hack dur­ing writ­ten and oral tes­ti­mo­ny before the U.S. Sen­ate in Feb­ru­ary. Short­com­ings in how Microsoft authen­ti­cates cre­den­tials have been repli­cat­ed in the cloud, fur­ther­ing cus­tomer pain, he said.

    “In oth­er tech­nolo­gies, you can’t nec­es­sar­i­ly just steal pass­words and use those encrypt­ed pass­words to authen­ti­cate to some­thing,” Kurtz told CRN. “But in the Microsoft world, you lit­er­al­ly can steal an encrypt­ed pass­word, with­out even decrypt­ing it, and pass that hash to anoth­er Microsoft sys­tem and access the sys­tem as if you knew what the pass­word was.”

    Kurtz is far from the only Crowd­Strike employ­ee crit­i­ciz­ing Microsoft, with Vice Pres­i­dent of Pub­lic Sec­tor James Yea­ger putting the com­pa­ny on notice in late June after the Russ­ian for­eign intel­li­gence ser­vice breached a Microsoft sup­port agent’s machine and used the account infor­ma­tion it obtained to launch high­ly tar­get­ed attacks against cus­tomers.

    “[Microsoft] con­tin­ues to get exposed as a com­pa­ny [that] is com­plete­ly inca­pable of pro­vid­ing the most basic lev­el of pro­tec­tion for them­selves and their cus­tomers,” Yea­ger wrote on LinkedIn. “If you can­not secure your own infra­struc­ture, then why should any­one trust you to secure their crit­i­cal infra­struc­ture and data?”

    Frank Shaw, Microsoft’s head of com­mu­ni­ca­tions, fired back at Yea­ger, say­ing it’s irre­spon­si­ble to sug­gest that any com­pa­ny or per­son is immune to attacks in today’s threat land­scape. “It’s unfor­tu­nate to see some ven­dors attempt to fur­ther their posi­tion via innu­en­do and inac­cu­rate accu­sa­tions rather than seek­ing ways to con­tribute col­lab­o­ra­tive­ly,” Shaw wrote in a LinkedIn response to Yeager’s post.

    The com­pa­ny declined to respond to Kurtz’s spe­cif­ic alle­ga­tions, telling CRN only, “Microsoft is the world’s largest cyber­se­cu­ri­ty provider, secur­ing cus­tomers from the chip to the cloud, backed by more than 3,500 defend­ers at Microsoft and the more than 8 tril­lion secu­ri­ty sig­nals we process every day.”

    But from Kurtz’s per­spec­tive, com­pa­nies that use Microsoft secu­ri­ty prod­ucts to safe­guard Microsoft tech­nol­o­gy are expos­ing them­selves to “sys­temic risk” and would ben­e­fit from hav­ing prod­ucts and authen­ti­ca­tion stan­dards in place that weren’t built by just one com­pa­ny.

    “We’re see­ing a cri­sis in trust around Microsoft tech­nolo­gies,” Kurtz said. “Com­pa­nies are tak­ing a sec­ond look, say­ing, ‘Do I real­ly want my secu­ri­ty to be from the same ven­dor that is pro­vid­ing my oper­at­ing sys­tem?’ Look­ing at the his­to­ry of vul­ner­a­bil­i­ties that are out there and how they’ve been exploit­ed, they’re basi­cal­ly say­ing, ‘Maybe we should reduce the risk by going with anoth­er ven­dor.’”

    Microsoft’s biggest com­peti­tors in the end­point, email, iden­ti­ty and cloud secu­ri­ty spaces — Crowd­Strike, Proof­point, Okta and Net­skope, respec­tive­ly — came togeth­er in June 2020 to form the Spec­tra Alliance, which is focused on secur­ing remote work at scale and estab­lish­ing a zero trust secu­ri­ty pos­ture. Kurtz said Spec­tra Alliance cus­tomers ben­e­fit from the breadth of capa­bil­i­ties and ded­i­cat­ed secu­ri­ty focus.

    “If you look at Crowd­Strike, every day all we do is think about secu­ri­ty,” Kurtz said. “If you look at Microsoft, they’re think­ing about their cloud and office pro­duc­tiv­i­ty and gam­ing sys­tems. It isn’t their sole focus. Secu­ri­ty is a very broad land­scape. There’s not one secu­ri­ty com­pa­ny that does every­thing. It’s just very com­pli­cat­ed and broad. And I think hav­ing a ded­i­cat­ed focus … goes a long way.”

    Kurtz said Crowd­Strike cus­tomers also ben­e­fit from new fea­tures being pushed out via an agent rather than requir­ing an update of the entire oper­at­ing sys­tem like Microsoft, which adds some laten­cy.

    “Ours is a full plat­form approach that cov­ers mul­ti­ple oper­at­ing sys­tems with great capa­bil­i­ty. When you look at our Mac [plat­form], when you look at our Lin­ux [plat­form], our tech­nol­o­gy is far supe­ri­or to Microsoft,” Kurtz said. “It’s not a bolt-on to an oper­at­ing sys­tem. When you look at Microsoft’s tech­nol­o­gy, it is based on a 2004 acqui­si­tion they did. It still uses sig­na­tures. And it’s cov­er­ing a small slice of the over­all ecosys­tem.”

    Both the Spec­tra Alliance and Microsoft have cap­i­tal­ized on grow­ing demand for advanced secu­ri­ty capa­bil­i­ties, with cus­tomers opt­ing for a best-of-breed approach that includes Crowd­Strike when they have the exper­tise inter­nal­ly to tie togeth­er secu­ri­ty prod­ucts from dif­fer­ent ven­dors, accord­ing to a secu­ri­ty solu­tion provider exec­u­tive, who asked not to be named. The solu­tion provider works with both Crowd­Strike and Microsoft.

    But where Microsoft Defend­er for End­point tends to be most pop­u­lar is with enter­pris­es that val­ue sim­plic­i­ty and have already adopt­ed oth­er ele­ments of the company’s secu­ri­ty stack, accord­ing to the exec­u­tive, who said his com­pa­ny is see­ing Microsoft “more and more.”

    “If you’re already a Microsoft shop, some­times peo­ple say, ‘I might as well just extend my cur­rent archi­tec­ture and use Microsoft. I’m already Microsoft-heavy,’” the exec­u­tive said. “It is a solu­tion that works. It may not be best-of-breed, but it doesn’t nec­es­sar­i­ly require extra effort to cre­ate that inte­gra­tion.”

    ...

    ————-

    “Strike First, Strike Hard: How George Kurtz Has Built Crowd­Strike Into A Cyber­se­cu­ri­ty Pow­er­house” by Michael Novin­son; CRN; 08/09/2021

    “Crowd­Strike has become one of Microsoft’s most vocal secu­ri­ty crit­ics, with Kurtz blast­ing “sys­temic weak­ness­es in the Win­dows authen­ti­ca­tion archi­tec­ture” for exac­er­bat­ing the impact of the Solar­Winds hack dur­ing writ­ten and oral tes­ti­mo­ny before the U.S. Sen­ate in Feb­ru­ary. Short­com­ings in how Microsoft authen­ti­cates cre­den­tials have been repli­cat­ed in the cloud, fur­ther­ing cus­tomer pain, he said.”

    It’s pret­ty omi­nous. At the same time experts are encour­ag­ing a mass migra­tion to the cloud, we’re con­tin­u­ing to learn about new cloud-based vul­ner­a­bil­i­ties. Or not even cloud-spe­cif­ic vul­ner­a­bil­i­ties. That’s part of Kurtz’s cri­tique of Microsoft­’s secu­ri­ty ecosys­tem: pass­word hash­es can be passed around from Microsoft-tool-to-Microsoft-tool with­out even decrypt­ing them. Every­one is being asked to migrate their data and oper­a­tions to a giant fan­cy vault filled with secret entrances:

    ...
    “In oth­er tech­nolo­gies, you can’t nec­es­sar­i­ly just steal pass­words and use those encrypt­ed pass­words to authen­ti­cate to some­thing,” Kurtz told CRN. “But in the Microsoft world, you lit­er­al­ly can steal an encrypt­ed pass­word, with­out even decrypt­ing it, and pass that hash to anoth­er Microsoft sys­tem and access the sys­tem as if you knew what the pass­word was.”

    Kurtz is far from the only Crowd­Strike employ­ee crit­i­ciz­ing Microsoft, with Vice Pres­i­dent of Pub­lic Sec­tor James Yea­ger putting the com­pa­ny on notice in late June after the Russ­ian for­eign intel­li­gence ser­vice breached a Microsoft sup­port agent’s machine and used the account infor­ma­tion it obtained to launch high­ly tar­get­ed attacks against cus­tomers.

    “[Microsoft] con­tin­ues to get exposed as a com­pa­ny [that] is com­plete­ly inca­pable of pro­vid­ing the most basic lev­el of pro­tec­tion for them­selves and their cus­tomers,” Yea­ger wrote on LinkedIn. “If you can­not secure your own infra­struc­ture, then why should any­one trust you to secure their crit­i­cal infra­struc­ture and data?”

    ...

    But from Kurtz’s per­spec­tive, com­pa­nies that use Microsoft secu­ri­ty prod­ucts to safe­guard Microsoft tech­nol­o­gy are expos­ing them­selves to “sys­temic risk” and would ben­e­fit from hav­ing prod­ucts and authen­ti­ca­tion stan­dards in place that weren’t built by just one com­pa­ny.

    “We’re see­ing a cri­sis in trust around Microsoft tech­nolo­gies,” Kurtz said. “Com­pa­nies are tak­ing a sec­ond look, say­ing, ‘Do I real­ly want my secu­ri­ty to be from the same ven­dor that is pro­vid­ing my oper­at­ing sys­tem?’ Look­ing at the his­to­ry of vul­ner­a­bil­i­ties that are out there and how they’ve been exploit­ed, they’re basi­cal­ly say­ing, ‘Maybe we should reduce the risk by going with anoth­er ven­dor.’”
    ...

    Microsoft rep­re­sents a “sys­temic risk”. That’s how Crowd­Strike sees it, and its a risk that extend to the cloud. And yes, Crowd­Strike is Microsoft­’s direct com­peti­tor in the secu­ri­ty are­na so we should­n’t be sur­prised by the crit­i­cisms. But these aren’t just ran­dom crit­i­cisms. The secu­ri­ty issues with Microsoft are an empir­i­cal fact at this point. Crowd­Strike is only warn­ing about what our lying eyes and ears are already telling us.

    So that’s the lat­est Miicrosoft cyber­se­cu­ri­ty night­mare update. ‘Print­Night­mare’ is upon us and if you think there’s an easy solu­tion your head is in the clouds. Well, ok, you can dis­con­nect the print­er. It’s the rest of the sys­temic risk you’ll still need to wor­ry about.

    Posted by Pterrafractyl | August 17, 2021, 4:54 pm

  2. Here’s an update on the Solar­Winds mega-hack. Or rather, an update on Solar­Winds-relat­ed major soft­ware vul­ner­a­bil­i­ties. As we’re going to see, there have been two major addi­tion­al vul­ner­a­bil­i­ties dis­cov­ered in Solar­Winds soft­ware since the ini­tial dis­clo­sure of the Solar­Winds hack back in mid-Decem­ber 2020.

    Days after the first dis­clo­sure, there were reports of a sec­ond hack­ing team tar­get­ing Solar­Winds cus­tomers. Not much was dis­closed about the attack. We were told that this sec­ond piece of mal­ware, dubbed “Super­no­va”, also tar­get­ed the Solar­Winds Ori­on updat­ing soft­ware. But unlike with the first Solar­Winds hack­’s mal­ware (dubbed “Sun­burst”), this new mal­ware was­n’t “dig­i­tal­ly signed”. Recall how part of what made the first Solar­Winds hack so dis­turb­ing was how the hack­ers man­aged to sneak their mal­ware into the soft­ware devel­op­ment process at the very last pos­si­ble point, bypass­ing stan­dard secu­ri­ty mea­sures designed to catch unwant­ed soft­ware. That’s what made the mal­ware “dig­i­tal­ly signed”. So Super­no­va does­n’t appear to have been incor­po­rat­ed into the Solar­Winds Ori­on soft­ware in the same man­ner. That tech­ni­cal dif­fer­ence between the first and sec­ond Solar­Winds hack appears to be part of the rea­son secu­ri­ty researchers are assum­ing the two hacks were car­ried out by sep­a­rate groups. As we’re going to see, it’s not actu­al­ly a great rea­son for such an assump­tion.

    Anoth­er relat­ed tech­ni­cal dif­fer­ence between the first ‘Russ­ian’ Solar­Winds hack and this sec­ond hack is the need for access to the tar­get net­works. As we’ve see, part of what made the first Solar­Winds hack so poten­tial­ly dev­as­tat­ing is the fact that back­doors onto client net­works were deliv­ered by the mal­ware. The hack itself was what pro­vid­ed access to client net­works. But with this sec­ond hack, some sort of pre­vi­ous net­work access that allows the hack­ers to inter­act with the Ori­on soft­ware on the tar­get net­work is required.

    Impor­tant­ly, the first and sec­ond Solar­Winds hacks serve two dif­fer­ent pur­pos­es. The first hack was a hack of the Ori­on soft­ware itself that deployed the “Sun­burst” back­doors on all of Solar­Winds 18,000 client net­works. The sec­ond “Super­no­va” hack is a hack that exploits a bug in Ori­on soft­ware to help spread the hack­ers across net­works they had already com­pro­mised. So you could imag­ine the same hack­er want­i­ng to use both hacks on the same net­work. This is impor­tant to keep in mind because we are told that the fact that one hack requires net­work access while the oth­er sug­gests it was car­ried out by two dif­fer­ent hack­ing groups.

    Also note anoth­er impor­tant detail about the Super­no­va mal­ware deployed in this sec­ond Solar­Winds hack: it exploits weak­ness­es in the .NET soft­ware devel­op­ment frame­work. That’s one of Microsoft­’s pro­pri­etary plat­forms.

    So who is believed to be behind this sec­ond Solar­Winds hack? Well, at the time it was first announced, researchers could­n’t say. But by Feb­ru­ary of this year, they were ready to name names: Chi­na did it! Because if it was­n’t Rus­sia, it has to be Chi­na. Or Iran or North Korea. One of those four.

    What’s the basis for this attri­bu­tion to a Chi­na-based group? Very lit­tle. Anony­mous sources first sug­gest­ing it was Chi­na back in Feb­ru­ary tell us the hack shared com­put­er infra­struc­ture and hack­ing tools with hacks pre­vi­ous­ly attrib­uted to Chi­nese hack­ers. That vague. The one some­what detailed clue we are giv­en is by secu­ri­ty researchers at Secure­works. The com­pa­ny found con­nec­tions between a Novem­ber 2020 Super­no­va attack on one of its clients and an August 2020 attack that did­n’t involve Super­no­va. That August 2020 attack was some­what mirac­u­lous­ly tied back to Chi­na when the hack­ers appar­ent­ly made the acci­dent of steal­ing Secure­work­s’s own end­point secu­ri­ty soft­ware from their hacked client and installed it on one of their own com­put­ers. The end­point soft­ware pre­dictably pinged Secure­work­s’s net­works. That appears to be the stole piece of evi­dence con­nect­ing this sec­ond hack back to Chi­na. So both ‘Russ­ian’ and ‘Chi­na’ were hack­ing the sh*t out of Solar­Winds in par­al­lel. That was the nar­ra­tive that had emerged by Feb­ru­ary of this year.

    Then, in July, we got reports of the oth­er new Solar­Winds hack. The new new hack. A third Solar­Winds hack that focus­es on exploit­ing vul­ner­a­bil­i­ties in the Serv‑U soft­ware made by Solar­Winds. Like the sec­ond Solar­Winds hack, the hack­ers need pri­or access to the vic­tim net­work. The hack revolves around send­ing com­mands to the Serv‑U soft­ware with out­put that can be read remote­ly and used to grab infor­ma­tion like pass­words or mod­i­fy files. It sounds like an incred­i­bly pow­er­ful exploit.

    And who is behind this third Solar­Winds hack? Chi­na did it! Again! But a dif­fer­ent group of Chi­nese hack­ers. We are told the vul­ner­a­bil­i­ty exists in the then-lat­est Serv‑U ver­sion 15.2.3 HF1, released on May 5, and all pri­or ver­sions. So this super-exploit, that could poten­tial­ly grant pow­er­ful access on the vic­tim net­works, had exist­ed ever since Serv‑U was first deployed.

    Now, why is this new hack attrib­uted to Chi­na? We have no idea and are nev­er told. Microsoft­’s threat assess­ment report on the hack sim­ply states twice that the group is based in Chi­na. That’s it. No oth­er details on why this is a Chi­na-based group.

    Oh, and there’s anoth­er impor­tant detail also left out of Microsoft­’s report: the Serv‑U vul­ner­a­bil­i­ty only exists if the Serv‑U is being run on Win­dows-based oper­at­ing sys­tems. Lin­ux-based sys­tems aren’t impact­ed. In oth­er words, this Serv‑U hack kind of sounds like a Microsoft hack. Kind of like how the Super­no­va hack was a hack of Microsoft­’s .NET frame­work. Some­how, the hack­ers were able to use the Serv‑U soft­ware to exploit under­ly­ing vul­ner­a­bil­i­ties in Win­dows. That’s the sto­ry we appear to be look­ing at. There is no men­tion of the fact that only Win­dows sys­tems were vul­ner­a­ble in the Microsoft threat assess­ment report. We have to look at the Solar­Winds report on the hack to learn about this. Yes, Microsoft left out of its threat assess­ment report the fact that they deployed Super­no­va and the fact that only Win­dows sys­tems were hit. Imag­ine that.

    So what’s the com­mon thread here? The same thread we’ve seen all along: the hack­ing attri­bu­tion indus­try is just kind of mak­ing it up. Weaponized attri­bu­tions, for prof­it. And in Microsoft­’s case, a nar­ra­tive nec­es­sar­i­ly shaped to defend itself from accu­sa­tions of shod­dy secu­ri­ty. Some­times appro­pri­ate skep­ti­cism is deployed and often it’s tossed out the win­dow. What stays the same is the con­ve­nience of the nar­ra­tives.

    Ok, first, here’s a Decem­ber 19, 2020, report that gives us the first glimpse of this sec­ond hack. Not much is known at this point oth­er than the fact that “Super­no­va” mal­ware imi­tate Solar­Wind­s’s Ori­on soft­ware, which is tech­ni­cal­ly very dif­fer­ent from the first hack where the mal­ware was embed­ded inside the Ori­on soft­ware. So this sec­ond hack required pri­or access to the vic­tim net­works:

    Reuters

    Sec­ond hack­ing team was tar­get­ing Solar­Winds at time of big breach

    By Christo­pher Bing
    Decem­ber 19, 2020 12:34 PM Updat­ed

    (Reuters) — A sec­ond hack­ing group, dif­fer­ent from the sus­pect­ed Russ­ian team now asso­ci­at­ed with the major Solar­Winds data breach, also tar­get­ed the company’s prod­ucts ear­li­er this year, accord­ing to a secu­ri­ty research blog by Microsoft.

    “The inves­ti­ga­tion of the whole Solar­Winds com­pro­mise led to the dis­cov­ery of an addi­tion­al mal­ware that also affects the Solar­Winds Ori­on prod­uct but has been deter­mined to be like­ly unre­lat­ed to this com­pro­mise and used by a dif­fer­ent threat actor,” the blog said.

    Secu­ri­ty experts told Reuters this sec­ond effort is known as “SUPERNOVA.” It is a piece of mal­ware that imi­tates Solar­Winds’ Ori­on prod­uct but it is not “dig­i­tal­ly signed” like the oth­er attack, sug­gest­ing this sec­ond group of hack­ers did not share access to the net­work man­age­ment company’s inter­nal sys­tems.

    It is unclear whether SUPERNOVA has been deployed against any tar­gets, such as cus­tomers of Solar­Winds. The mal­ware appears to have been cre­at­ed in late March, based on a review of the file’s com­pile times.

    The new find­ing shows how more than one sophis­ti­cat­ed hack­ing group viewed Solar­Winds, an Austin, Texas-based com­pa­ny that was not a house­hold name until this month, as an impor­tant gate­way to pen­e­trate oth­er tar­gets.

    ...

    ————–

    “Sec­ond hack­ing team was tar­get­ing Solar­Winds at time of big breach” by Christo­pher Bing; Reuters; 12/19/2020

    “Secu­ri­ty experts told Reuters this sec­ond effort is known as “SUPERNOVA.” It is a piece of mal­ware that imi­tates Solar­Winds’ Ori­on prod­uct but it is not “dig­i­tal­ly signed” like the oth­er attack, sug­gest­ing this sec­ond group of hack­ers did not share access to the net­work man­age­ment company’s inter­nal sys­tems.”

    Note the exam­ple of attri­bu­tion log­ic being used here. The fact that this sec­ond hack did­n’t share the “dig­i­tal sig­na­ture” of the first hack is seen as a sug­ges­tion that this sec­ond group of hack­ers did not share access to the “net­work man­age­ment company’s inter­nal sys­tems”, which is a ref­er­ence to the first hack orig­i­nat­ed with a hack of the Solar­Winds Ori­on soft­ware devel­op­er’s com­put­er, allow­ing the embed­ding of the back­door mal­ware.

    Now, on the one hand, it’s a use­ful obser­va­tion to note that one hack required access to Solar­Wind­s’s own devel­op­er net­works, which end­ed up giv­ing access to client net­works, while this new­ly dis­cov­ered hack instead just requires access to the client net­works, keep in mind that it’s mere­ly a sug­ges­tion these are dif­fer­ent hack­ers. But it’s also impor­tant to keep in mind that there are sce­nar­ios where the same hack­ers could end up plant­i­ng both this Super­no­va mal­ware and the Ori­on back­door from the first hack on the same sys­tem.

    For exam­ple, we are told the first Solar­Winds hack start­ed in Feb­ru­ary of 2020, when the first com­pro­mised Ori­on updates went out to Solar­Wind­s’s 18,000 clients. But as we’re going to see, it’s sus­pect­ed that the ‘Chi­nese’ hack­ers behind this sec­ond Solar­Winds hack, which required pri­or access to vic­tim net­works, relied on a sep­a­rate Man­ageEngine Ser­viceDesk vul­ner­a­bil­i­ty to gain access to the net­works that was being exploit­ed as far back as 2018. And as we’re also going to see, this new­ly dis­cov­ered hack appears to allow the hack­ers to move lat­er­al­ly across vic­tim net­works, which serves a dif­fer­ent and very com­pat­i­ble pur­pose with the back­door cre­at­ed by the first Solar­Winds hack. But the nar­ra­tive right out of the gate with this sto­ry was that it was com­plete­ly uncon­nect­ed to the mega-hack dis­closed days ear­li­er based on the assump­tion that both exploits would­n’t be need­ed by the same actor.

    Next, here’s a Feb­ru­ary 2, 2021, Reuters piece where we get the first hint of an offi­cial attri­bu­tion for the hack. Chi­na did it. Of course. That’s the word from anony­mous sources involved with the inves­ti­ga­tion. We also learn from these anony­mous sources that the hack­ers used com­put­er infra­struc­ture and hack­ing tools pre­vi­ous­ly deployed by state-backed Chi­nese cyber-spies. That’s the extent of the details we are giv­en. A vague ref­er­ence to vague ‘pat­tern-recog­ni­tion’ based on some spoofa­ble tech­ni­cal indi­ca­tors. Solar­Winds, on the oth­er hand, that it had “not found any­thing con­clu­sive” to show who was respon­si­ble.

    And we also learn that this sec­ond hack served a dif­fer­ent pur­pose from the first Solar­Winds hack: it exploit­ed a bug in Ori­on that helped the hack­ers spread across vic­tim net­works. So this sec­ond hack sounds like a poten­tial­ly use­ful sec­ondary attack that could have been exploit­ed after the first Solar­Winds hack cre­ates the back­door grant­i­ng that ini­tial access:

    Reuters

    Exclu­sive: Sus­pect­ed Chi­nese hack­ers used Solar­Winds bug to spy on U.S. pay­roll agency – sources

    By Christo­pher Bing, Jack Stubbs, Raphael Sat­ter, Joseph Menn
    Feb­ru­ary 2, 2021 12:43 PM Updat­ed

    WASHINGTON (Reuters) — Sus­pect­ed Chi­nese hack­ers exploit­ed a flaw in soft­ware made by Solar­Winds Corp to help break into U.S. gov­ern­ment com­put­ers last year, five peo­ple famil­iar with the mat­ter told Reuters, mark­ing a new twist in a sprawl­ing cyber­se­cu­ri­ty breach that U.S. law­mak­ers have labeled a nation­al secu­ri­ty emer­gency.

    Two peo­ple briefed on the case said FBI inves­ti­ga­tors recent­ly found that the Nation­al Finance Cen­ter, a fed­er­al pay­roll agency inside the U.S. Depart­ment of Agri­cul­ture, was among the affect­ed orga­ni­za­tions, rais­ing fears that data on thou­sands of gov­ern­ment employ­ees may have been com­pro­mised.

    The soft­ware flaw exploit­ed by the sus­pect­ed Chi­nese group is sep­a­rate from the one the Unit­ed States has accused Russ­ian gov­ern­ment oper­a­tives of using to com­pro­mise up to 18,000 Solar­Winds cus­tomers, includ­ing sen­si­tive fed­er­al agen­cies, by hijack­ing the company’s Ori­on net­work mon­i­tor­ing soft­ware.

    Secu­ri­ty researchers have pre­vi­ous­ly said a sec­ond group of hack­ers was abus­ing Solar­Winds’ soft­ware at the same time as the alleged Russ­ian hack, but the sus­pect­ed con­nec­tion to Chi­na and ensu­ing U.S. gov­ern­ment breach have not been pre­vi­ous­ly report­ed.

    Reuters was not able to estab­lish how many orga­ni­za­tions were com­pro­mised by the sus­pect­ed Chi­nese oper­a­tion. The sources, who spoke on con­di­tion of anonymi­ty to dis­cuss ongo­ing inves­ti­ga­tions, said the attack­ers used com­put­er infra­struc­ture and hack­ing tools pre­vi­ous­ly deployed by state-backed Chi­nese cyber­spies.

    A USDA spokesman said in an email “USDA has noti­fied all cus­tomers (includ­ing indi­vid­u­als and orga­ni­za­tions) whose data has been affect­ed by the Solar­Winds Ori­on Code Com­pro­mise.”

    In a fol­low-up state­ment after the sto­ry was pub­lished, a dif­fer­ent USDA spokesman said the NFC was not hacked and that “there was no data breach relat­ed to Solar Winds” at the agency. He did not pro­vide fur­ther expla­na­tion.

    The Chi­nese for­eign min­istry said attribut­ing cyber­at­tacks was a “com­plex tech­ni­cal issue” and any alle­ga­tions should be sup­port­ed with evi­dence. “Chi­na res­olute­ly oppos­es and com­bats any form of cyber­at­tacks and cyber theft,” it said in a state­ment.

    Solar­Winds said it was aware of a sin­gle cus­tomer that was com­pro­mised by the sec­ond set of hack­ers but that it had “not found any­thing con­clu­sive” to show who was respon­si­ble. The com­pa­ny added that the attack­ers did not gain access to its own inter­nal sys­tems and that it had released an update to fix the bug in Decem­ber.

    In the case of the sole client it knew about, Solar­Winds said the hack­ers only abused its soft­ware once inside the client’s net­work. Solar­Winds did not say how the hack­ers first got in, except to say it was “in a way that was unre­lat­ed to Solar­Winds.”

    ...

    Although the two espi­onage efforts over­lap and both tar­get­ed the U.S. gov­ern­ment, they were sep­a­rate and dis­tinct­ly dif­fer­ent oper­a­tions, accord­ing to four peo­ple who have inves­ti­gat­ed the attacks and out­side experts who reviewed the code used by both sets of hack­ers.

    While the alleged Russ­ian hack­ers pen­e­trat­ed deep into Solar­Winds net­work and hid a “back door” in Ori­on soft­ware updates which were then sent to cus­tomers, the sus­pect­ed Chi­nese group exploit­ed a sep­a­rate bug in Orion’s code to help spread across net­works they had already com­pro­mised, the sources said.

    ‘EXTREMELY SERIOUS BREACH’

    The side-by-side mis­sions show how hack­ers are focus­ing on weak­ness­es in obscure but essen­tial soft­ware prod­ucts that are wide­ly used by major cor­po­ra­tions and gov­ern­ment agen­cies.

    “Appar­ent­ly Solar­Winds was a high val­ue tar­get for more than one group,” said Jen Miller-Osborn, the deputy direc­tor of threat intel­li­gence at Palo Alto Net­works’ Unit42.

    For­mer U.S. chief infor­ma­tion secu­ri­ty offi­cer Gre­go­ry Touhill said sep­a­rate groups of hack­ers tar­get­ing the same soft­ware prod­uct was not unusu­al. “It wouldn’t be the first time we’ve seen a nation-state actor surf­ing in behind some­one else, it’s like ‘draft­ing’ in NASCAR,” he said, where one rac­ing car gets an advan­tage by close­ly fol­low­ing another’s lead.

    The con­nec­tion between the sec­ond set of attacks on Solar­Winds cus­tomers and sus­pect­ed Chi­nese hack­ers was only dis­cov­ered in recent weeks, accord­ing to secu­ri­ty ana­lysts inves­ti­gat­ing along­side the U.S. gov­ern­ment.

    Reuters could not deter­mine what infor­ma­tion the attack­ers were able to steal from the Nation­al Finance Cen­ter (NFC) or how deep they bur­rowed into its sys­tems. But the poten­tial impact could be “mas­sive,” for­mer U.S. gov­ern­ment offi­cials told Reuters.

    The NFC is respon­si­ble for han­dling the pay­roll of mul­ti­ple gov­ern­ment agen­cies, includ­ing sev­er­al involved in nation­al secu­ri­ty, such as the FBI, State Depart­ment, Home­land Secu­ri­ty Depart­ment and Trea­sury Depart­ment, the for­mer offi­cials said.

    Records held by the NFC include fed­er­al employ­ee social secu­ri­ty num­bers, phone num­bers and per­son­al email address­es as well as bank­ing infor­ma­tion. On its web­site, the NFC says it “ser­vices more than 160 diverse agen­cies, pro­vid­ing pay­roll ser­vices to more than 600,000 Fed­er­al employ­ees.”

    “Depend­ing on what data were com­pro­mised, this could be an extreme­ly seri­ous breach of secu­ri­ty,” said Tom War­rick, a for­mer senior offi­cial at the U.S Depart­ment of Home­land Secu­ri­ty. “It could allow adver­saries to know more about U.S. offi­cials, improv­ing their abil­i­ty to col­lect intel­li­gence.”

    ————-

    “Exclu­sive: Sus­pect­ed Chi­nese hack­ers used Solar­Winds bug to spy on U.S. pay­roll agency – sources” By Christo­pher Bing, Jack Stubbs, Raphael Sat­ter, Joseph Menn; Reuters; 02/02/2021

    “Secu­ri­ty researchers have pre­vi­ous­ly said a sec­ond group of hack­ers was abus­ing Solar­Winds’ soft­ware at the same time as the alleged Russ­ian hack, but the sus­pect­ed con­nec­tion to Chi­na and ensu­ing U.S. gov­ern­ment breach have not been pre­vi­ous­ly report­ed.”

    It took a lit­tle over two months before ‘anony­mous sources’ start­ed point­ing the fin­ger at Chi­na. Which is actu­al­ly a lot more time than the mere days it took for the first Solar­Winds hack to get blamed on Rus­sia. So what evi­dence were these sources point­ing at? The hack­ers “used com­put­er infra­struc­ture and hack­ing tools.” No details or exam­ples of shared infra­struc­ture or tools. That’s it. It tells us noth­ing oth­er than the fact that shod­dy ‘pat­tern recog­ni­tion’ tech­niques were being relied on:

    ...
    Reuters was not able to estab­lish how many orga­ni­za­tions were com­pro­mised by the sus­pect­ed Chi­nese oper­a­tion. The sources, who spoke on con­di­tion of anonymi­ty to dis­cuss ongo­ing inves­ti­ga­tions, said the attack­ers used com­put­er infra­struc­ture and hack­ing tools pre­vi­ous­ly deployed by state-backed Chi­nese cyber­spies.

    ...

    Solar­Winds said it was aware of a sin­gle cus­tomer that was com­pro­mised by the sec­ond set of hack­ers but that it had “not found any­thing con­clu­sive” to show who was respon­si­ble. The com­pa­ny added that the attack­ers did not gain access to its own inter­nal sys­tems and that it had released an update to fix the bug in Decem­ber.

    ...

    Although the two espi­onage efforts over­lap and both tar­get­ed the U.S. gov­ern­ment, they were sep­a­rate and dis­tinct­ly dif­fer­ent oper­a­tions, accord­ing to four peo­ple who have inves­ti­gat­ed the attacks and out­side experts who reviewed the code used by both sets of hack­ers.
    ...

    But here’s where we learn some very impor­tant details about the nature of this hack: it was used to help spread across already-com­pro­mised net­works. Which make this the kind of exploit that sounds like a great part­ner with the first Solar­Winds hack that com­pro­mised 18,000 client net­works with back­doors:

    ...
    In the case of the sole client it knew about, Solar­Winds said the hack­ers only abused its soft­ware once inside the client’s net­work. Solar­Winds did not say how the hack­ers first got in, except to say it was “in a way that was unre­lat­ed to Solar­Winds.”

    ...

    While the alleged Russ­ian hack­ers pen­e­trat­ed deep into Solar­Winds net­work and hid a “back door” in Ori­on soft­ware updates which were then sent to cus­tomers, the sus­pect­ed Chi­nese group exploit­ed a sep­a­rate bug in Orion’s code to help spread across net­works they had already com­pro­mised, the sources said.

    ...

    For­mer U.S. chief infor­ma­tion secu­ri­ty offi­cer Gre­go­ry Touhill said sep­a­rate groups of hack­ers tar­get­ing the same soft­ware prod­uct was not unusu­al. “It wouldn’t be the first time we’ve seen a nation-state actor surf­ing in behind some­one else, it’s like ‘draft­ing’ in NASCAR,” he said, where one rac­ing car gets an advan­tage by close­ly fol­low­ing another’s lead.

    The con­nec­tion between the sec­ond set of attacks on Solar­Winds cus­tomers and sus­pect­ed Chi­nese hack­ers was only dis­cov­ered in recent weeks, accord­ing to secu­ri­ty ana­lysts inves­ti­gat­ing along­side the U.S. gov­ern­ment.
    ...

    A month lat­er, in ear­ly March, we get anoth­er update. An update that would appear to tie the hack to Chi­na. It came from the research team at Secure­work­s’s Counter Threat Unit (CTU), who informed us that they first encoun­tered the Super­no­va mal­ware in Novem­ber of 2020. Upon clos­er exam­i­na­tion, they found sim­i­lar­i­ties to a hack in August 2020 that was found to have been enable by a vul­ner­a­bil­i­ty in the Man­ageEngine Ser­viceDesk soft­ware that the hack­ers like­ly exploit­ed in ear­ly 2018. That Man­ageEngine Ser­viceDesk exploit is pre­vi­ous­ly known to have been used by Chi­nese hack­ers. And it was dur­ing the inves­ti­ga­tion of this August 2020 hack that the hack­ers decid­ed to install Secure­work­s’s own end­point soft­ware on one of their com­put­ers and con­nect it to the inter­net. The end­point soft­ware on the hack­ers’ com­put­er pre­dictably pinged Secure­work­s’s servers and the com­pa­ny had the infor­ma­tion it need­ed to con­nect that hack to Chi­na (which ignores the obvi­ous pos­si­bil­i­ty of remote­ly using a com­put­er from any­where). This appears to be the extent of the evi­dence that Super­no­va Solar­Winds hack is being car­ried out by Chi­nese hack­ers. Vague dig­i­tal spoofa­ble clues:

    Ars Tech­ni­ca

    Chi­nese hack­ers tar­get­ed Solar­Winds cus­tomers in par­al­lel with Russ­ian op
    New data sug­gests that Rus­sia was­n’t the only nation-state hack­ing cus­tomers.

    Dan Good­in — 3/8/2021, 6:36 PM

    By now, most peo­ple know that hack­ers tied to the Russ­ian gov­ern­ment com­pro­mised the Solar­Winds soft­ware build sys­tem and used it to push a mali­cious update to some 18,000 of the company’s cus­tomers. On Mon­day, researchers pub­lished evi­dence that hack­ers from Chi­na also tar­get­ed Solar­Winds cus­tomers in what secu­ri­ty ana­lysts have said was a dis­tinct­ly dif­fer­ent oper­a­tion.

    The par­al­lel hack cam­paigns have been pub­lic knowl­edge since Decem­ber, when researchers revealed that, in addi­tion to the sup­ply chain attack, hack­ers exploit­ed a vul­ner­a­bil­i­ty in Solar­Winds soft­ware called Ori­on. Hack­ers in the lat­ter cam­paign used the exploit to install a mali­cious web shell dubbed Super­no­va on the net­work of a cus­tomer who used the net­work man­age­ment tool. Researchers, how­ev­er, had few if any clues as to who car­ried out that attack.

    On Mon­day, researchers said the attack was like­ly car­ried out by a Chi­na-based hack­ing group they’ve dubbed “Spi­ral.” The find­ing, laid out in a report pub­lished on Mon­day by Secure­works’ Counter Threat Unit, is based on tech­niques, tac­tics, and pro­ce­dures in the hack that were either iden­ti­cal or very sim­i­lar to an ear­li­er com­pro­mise the researchers dis­cov­ered in the same net­work.

    Pum­meled on more than one front

    The find­ing comes on the heels of word that Chi­na-based hack­ers dubbed Hafni­um are one of at least five clus­ters of hack­ers behind attacks that installed mali­cious web shells on tens of thou­sands of Microsoft Exchange servers. Monday’s report shows that there’s no short­age of APTs—shorthand for advanced per­sis­tent threat hackers—determined to tar­get a wide swath of US-based orga­ni­za­tions.

    ...

    Counter Threat Unit researchers said they encoun­tered Super­no­va in Novem­ber as they respond­ed to the hack of a customer’s net­work. Like oth­er mali­cious web shells, Super­no­va got installed after the attack­ers had suc­cess­ful­ly gained the abil­i­ty to exe­cute mali­cious code on the target’s sys­tems. The attack­ers then used Super­no­va to send com­mands that stole pass­words and oth­er data that gave access to oth­er parts of the net­work.

    Secure­works CTU researchers already believed that the speed and sur­gi­cal pre­ci­sion of the move­ment inside the target’s net­work sug­gest­ed that Spi­ral had pri­or expe­ri­ence inside it. Then, the researchers noticed sim­i­lar­i­ties between the Novem­ber hack and one the researchers had uncov­ered in August 2020. The attack­ers in the ear­li­er hack like­ly gained ini­tial access as ear­ly as 2018 by exploit­ing a vul­ner­a­bil­i­ty in a prod­uct known as the Man­ageEngine Ser­viceDesk, the researchers said.

    “CTU researchers were ini­tial­ly unable to attribute the August activ­i­ty to any known threat groups,” the researchers wrote. “How­ev­er, the fol­low­ing sim­i­lar­i­ties to the SPIRAL intru­sion in late 2020 sug­gest that the SPIRAL threat group was respon­si­ble for both intru­sions:”

    * The threat actors used iden­ti­cal com­mands to dump the LSASS process via comsvcs.dll and used the same out­put file path (see Fig­ure 6).

    Enlarge / LSASS process dump from August 2020 using an iden­ti­cal com­mand to the Novem­ber 2020 inci­dent.

    * The same two servers were accessed: a domain con­troller and a serv­er that could pro­vide access to sen­si­tive busi­ness data.
    * The same ‘c:userspublic’ path (all low­er­case) was used as a work­ing direc­to­ry.
    * Three com­pro­mised admin­is­tra­tor accounts were used in both intru­sions.

    The CTU researchers already knew that Chi­nese hack­ers had been exploit­ing MangeEngine servers to gain long-term access to net­works of inter­est. But that alone wasn’t enough to deter­mine Spi­ral had its ori­gins in Chi­na. The researchers became more con­fi­dent in the con­nec­tion after notic­ing that the hack­ers in the August inci­dent acci­den­tal­ly exposed one of their IP address­es. It was geolo­cat­ed to Chi­na.

    The hack­ers exposed their IP address when they stole the end­point detec­tion soft­ware Ser­cure­works had sold to the hacked cus­tomer. For rea­sons that aren’t clear, the hack­ers then ran the secu­ri­ty prod­uct on one of their com­put­ers, at which point it exposed its IP address as it reached out to a Secure­works serv­er.

    The nam­ing con­ven­tion of the hack­ers’ com­put­er was the same as a dif­fer­ent com­put­er that the hack­ers had used when con­nect­ing to the net­work through a VPN. Tak­en togeth­er, the evi­dence col­lect­ed by CTU researchers gave them the con­fi­dence that both hacks were done by the same group and that the group was based in Chi­na.

    “Sim­i­lar­i­ties between SUPER­NO­VA-relat­ed activ­i­ty in Novem­ber and activ­i­ty that CTU researchers ana­lyzed in August sug­gest that the SPIRAL threat group was respon­si­ble for both intru­sions,” CTU researchers wrote. “Char­ac­ter­is­tics of these intru­sions indi­cate a pos­si­ble con­nec­tion to Chi­na.”

    ————-

    “Chi­nese hack­ers tar­get­ed Solar­Winds cus­tomers in par­al­lel with Russ­ian op” by Dan Good­in; Ars Tech­ni­ca; 03/08/2021

    “On Mon­day, researchers said the attack was like­ly car­ried out by a Chi­na-based hack­ing group they’ve dubbed “Spi­ral.” The find­ing, laid out in a report pub­lished on Mon­day by Secure­works’ Counter Threat Unit, is based on tech­niques, tac­tics, and pro­ce­dures in the hack that were either iden­ti­cal or very sim­i­lar to an ear­li­er com­pro­mise the researchers dis­cov­ered in the same net­work.”

    Meet “Spi­ral”, who is def­i­nite­ly not “Hafni­um” and def­i­nite­ly not respon­si­ble for the first Solar­Winds hack. And not the Serv‑U Solar­Winds hack we’re going to learn about in July. Only this sec­ond Solar­Winds hack. And def­i­nite­ly from Chi­na.

    That’s what Secure­work­s’s CTU con­clud­ed based on tech­niques, tac­tics, and pro­ce­dures in the hack that were either iden­ti­cal or very sim­i­lar to an ear­li­er com­pro­mise of the same client: The August 2020 hack of the Secure­works client where the hack­ers stole Secur­work­s’s end­point soft­ware from the clien­t’s net­work, installed it on their own com­put­er in Chi­na, and allowed it to ping Secure­work­s’s servers. And the August 2020 hack­ers shared cer­tain traits like using the same com­mands and name like “c:userspublic” as a work­ing direc­to­ry name. So some tech­ni­cal pat­tern recog­ni­tion com­bined with reduc­tive rea­son­ing and/or wild guess­ing and/or con­ve­nient sto­ry-telling. This is the sausage-mak­ing of con­tem­po­rary cyber­at­tri­bu­tions:

    ...
    Counter Threat Unit researchers said they encoun­tered Super­no­va in Novem­ber as they respond­ed to the hack of a customer’s net­work. Like oth­er mali­cious web shells, Super­no­va got installed after the attack­ers had suc­cess­ful­ly gained the abil­i­ty to exe­cute mali­cious code on the target’s sys­tems. The attack­ers then used Super­no­va to send com­mands that stole pass­words and oth­er data that gave access to oth­er parts of the net­work.

    Secure­works CTU researchers already believed that the speed and sur­gi­cal pre­ci­sion of the move­ment inside the target’s net­work sug­gest­ed that Spi­ral had pri­or expe­ri­ence inside it. Then, the researchers noticed sim­i­lar­i­ties between the Novem­ber hack and one the researchers had uncov­ered in August 2020. The attack­ers in the ear­li­er hack like­ly gained ini­tial access as ear­ly as 2018 by exploit­ing a vul­ner­a­bil­i­ty in a prod­uct known as the Man­ageEngine Ser­viceDesk, the researchers said.

    “CTU researchers were ini­tial­ly unable to attribute the August activ­i­ty to any known threat groups,” the researchers wrote. “How­ev­er, the fol­low­ing sim­i­lar­i­ties to the SPIRAL intru­sion in late 2020 sug­gest that the SPIRAL threat group was respon­si­ble for both intru­sions:”

    * The threat actors used iden­ti­cal com­mands to dump the LSASS process via comsvcs.dll and used the same out­put file path (see Fig­ure 6).

    Enlarge / LSASS process dump from August 2020 using an iden­ti­cal com­mand to the Novem­ber 2020 inci­dent.

    * The same two servers were accessed: a domain con­troller and a serv­er that could pro­vide access to sen­si­tive busi­ness data.
    * The same ‘c:userspublic’ path (all low­er­case) was used as a work­ing direc­to­ry.
    * Three com­pro­mised admin­is­tra­tor accounts were used in both intru­sions.

    ...

    Also note the lan­guage in the Secure­works CTU report: “Char­ac­ter­is­tics of these intru­sions indi­cate a pos­si­ble con­nec­tion to Chi­na.” A pos­si­ble con­nec­tion to Chi­na. Which is real­ly all it is:

    ...
    The CTU researchers already knew that Chi­nese hack­ers had been exploit­ing MangeEngine servers to gain long-term access to net­works of inter­est. But that alone wasn’t enough to deter­mine Spi­ral had its ori­gins in Chi­na. The researchers became more con­fi­dent in the con­nec­tion after notic­ing that the hack­ers in the August inci­dent acci­den­tal­ly exposed one of their IP address­es. It was geolo­cat­ed to Chi­na.

    The hack­ers exposed their IP address when they stole the end­point detec­tion soft­ware Ser­cure­works had sold to the hacked cus­tomer. For rea­sons that aren’t clear, the hack­ers then ran the secu­ri­ty prod­uct on one of their com­put­ers, at which point it exposed its IP address as it reached out to a Secure­works serv­er.

    The nam­ing con­ven­tion of the hack­ers’ com­put­er was the same as a dif­fer­ent com­put­er that the hack­ers had used when con­nect­ing to the net­work through a VPN. Tak­en togeth­er, the evi­dence col­lect­ed by CTU researchers gave them the con­fi­dence that both hacks were done by the same group and that the group was based in Chi­na.

    “Sim­i­lar­i­ties between SUPER­NO­VA-relat­ed activ­i­ty in Novem­ber and activ­i­ty that CTU researchers ana­lyzed in August sug­gest that the SPIRAL threat group was respon­si­ble for both intru­sions,” CTU researchers wrote. “Char­ac­ter­is­tics of these intru­sions indi­cate a pos­si­ble con­nec­tion to Chi­na.”
    ...

    Now, jump for­ward to mid-July, and we learn about the third Solar­Winds hack. This one by a dif­fer­ent Chi­nese hack­ing crew. And this one sounds pret­ty seri­ous in terms of the con­trol it gives to the attack­ers. The Serv‑U attack allows hack­ers to install pro­grams, and change or delete infor­ma­tion. And every pre­vi­ous ver­sion of Serv‑U was vul­ner­a­ble (but as we’ll see, only on Win­dows servers):

    Ars Tech­ni­ca

    Microsoft dis­cov­ers crit­i­cal Solar­Winds zero-day under active attack
    Flaws allow attack­ers to run mali­cious code on machines host­ing Serv‑U prod­ucts.

    Dan Good­in — 7/12/2021, 2:25 PM

    Solar­Winds, the com­pa­ny at the cen­ter of a sup­ply chain attack that com­pro­mised nine US agen­cies and 100 pri­vate com­pa­nies, is scram­bling to con­tain a new secu­ri­ty threat: a crit­i­cal zero-day vul­ner­a­bil­i­ty in its Serv‑U prod­uct line.

    Microsoft dis­cov­ered the exploits and pri­vate­ly report­ed them to Solar­Winds, the lat­ter com­pa­ny said in an advi­so­ry pub­lished on Fri­day. Solar­Winds said the attacks are entire­ly unre­lat­ed to the sup­ply chain attack dis­cov­ered in Decem­ber.

    ...

    Only Solar­Winds Serv‑U Man­aged File Trans­fer and Serv‑U Secure FTP—and by exten­sion, the Serv‑U Gate­way, a com­po­nent of those two products—are affect­ed by this vul­ner­a­bil­i­ty, which allows attack­ers to remote­ly exe­cute mali­cious code on vul­ner­a­ble sys­tems.

    An attack­er can gain priv­i­leged access to exploit­ed machines host­ing Serv‑U prod­ucts and could then install pro­grams; view, change, or delete data; or run pro­grams on the affect­ed sys­tem. The vul­ner­a­bil­i­ty exists in the lat­est Serv‑U ver­sion 15.2.3 HF1, released on May 5, and all pri­or ver­sions.

    Solar­Winds has issued a hot­fix to mit­i­gate the attacks while the com­pa­ny works on a per­ma­nent solu­tion. Peo­ple run­ning Serv‑U ver­sion 15.2.3 HF1 should apply hot­fix (HF) 2; those using Serv‑U 15.2.3 should apply Serv‑U 15.2.3 HF1 and then apply Serv‑U 15.2.3 HF2; and those run­ning Serv‑U ver­sions pri­or to 15.2.3 should upgrade to Serv‑U 15.2.3, apply Serv‑U 15.2.3 HF1, and then apply Serv‑U 15.2.3 HF2. The com­pa­ny says cus­tomers should install the fix­es imme­di­ate­ly.

    The hot­fix­es are avail­able here. Dis­abling SSH access also pre­vents exploita­tion.

    The fed­er­al gov­ern­ment has attrib­uted last year’s sup­ply chain attack to hack­ers work­ing for Russia’s For­eign Intel­li­gence Ser­vice, abbre­vi­at­ed as the SVR, which for more than a decade has con­duct­ed mal­ware cam­paigns tar­get­ing gov­ern­ments, polit­i­cal think tanks, and oth­er orga­ni­za­tions in coun­tries includ­ing Ger­many, Uzbek­istan, South Korea, and the US. Tar­gets have includ­ed the US State Depart­ment and the White House in 2014.

    The hack­ers used that access to push a mali­cious soft­ware update to about 18,000 cus­tomers of Solar­Winds’ Ori­on net­work man­age­ment prod­uct. Of those cus­tomers, rough­ly 110 received a fol­low-on attack that installed a lat­er-stage pay­load that exfil­trat­ed pro­pri­etary data. The mal­ware installed in the attack cam­paign is known as Sun­burst. Again, Solar­Winds said the exploits under­way now have no con­nec­tion.

    Late last year, zero-day vul­ner­a­bil­i­ties in Solar­Winds’ Ori­on prod­uct came under exploit by a dif­fer­ent set of attack­ers that researchers have tied to China’s gov­ern­ment. Those attack­ers installed mal­ware that researchers call Super­No­va. Threat actors linked to Chi­na have also tar­get­ed Solar­Winds. At least one US gov­ern­ment agency was tar­get­ed in this oper­a­tion.

    —————-

    “Microsoft dis­cov­ers crit­i­cal Solar­Winds zero-day under active attack” by Dan Good­in; Ars Tech­ni­ca; 07/12/2021

    “Microsoft dis­cov­ered the exploits and pri­vate­ly report­ed them to Solar­Winds, the lat­ter com­pa­ny said in an advi­so­ry pub­lished on Fri­day. Solar­Winds said the attacks are entire­ly unre­lat­ed to the sup­ply chain attack dis­cov­ered in Decem­ber.”

    It’s def­i­nite­ly entire­ly unre­lat­ed to the Solar­Winds hacks from Decem­ber. Both. They don’t know much but they know that. Some­how. And it’s a vul­ner­a­bil­i­ty that’s exist­ed in all pre­vi­ous ver­sions of Serv‑U, so any­one who knew about it had plen­ty of oppor­tu­ni­ty. And plen­ty of poten­tial for dam­age. The hack appears to give the attack­er admin con­trol over the com­put­er. They can install pro­grams, and add or delete infor­ma­tion. That’s mas­sive. Again, this is only going to be a vul­ner­a­bil­i­ty for Win­dows sys­tems run­ning Serv‑U:

    ...
    Only Solar­Winds Serv‑U Man­aged File Trans­fer and Serv‑U Secure FTP—and by exten­sion, the Serv‑U Gate­way, a com­po­nent of those two products—are affect­ed by this vul­ner­a­bil­i­ty, which allows attack­ers to remote­ly exe­cute mali­cious code on vul­ner­a­ble sys­tems.

    An attack­er can gain priv­i­leged access to exploit­ed machines host­ing Serv‑U prod­ucts and could then install pro­grams; view, change, or delete data; or run pro­grams on the affect­ed sys­tem. The vul­ner­a­bil­i­ty exists in the lat­est Serv‑U ver­sion 15.2.3 HF1, released on May 5, and all pri­or ver­sions.

    ...

    Late last year, zero-day vul­ner­a­bil­i­ties in Solar­Winds’ Ori­on prod­uct came under exploit by a dif­fer­ent set of attack­ers that researchers have tied to China’s gov­ern­ment. Those attack­ers installed mal­ware that researchers call Super­No­va. Threat actors linked to Chi­na have also tar­get­ed Solar­Winds. At least one US gov­ern­ment agency was tar­get­ed in this oper­a­tion.
    ...

    Now let’s take a quick look at one of the fun facts found in the Solar­Winds report on the Serv‑U hack: it only affects Win­dows com­put­ers. Lin­ux sys­tems aren’t impact­ed. In oth­er words, the Serv‑U hack has anoth­er Microsoft Win­dows vul­ner­a­bil­i­ty at its core:

    SolarWinds.com

    Serv‑U Remote Mem­o­ry Escape Vul­ner­a­bil­i­ty

    CVE-2021–35211

    Secu­ri­ty Vul­ner­a­bil­i­ty

    Released: July 9, 2021 Last updat­ed: July 15, 2021
    Assign­ing CNA: Solar­Winds

    ...

    Updat­ed July 13, 2021

    What prod­ucts are affect­ed?

    Only Solar­Winds Serv‑U Man­aged File Trans­fer and Serv‑U Secure FTP for Win­dows are affect­ed by this vul­ner­a­bil­i­ty. Please note the Serv‑U Gate­way is a com­po­nent of these two prod­ucts and is not a sep­a­rate prod­uct.

    The Lin­ux ver­sions of these prod­ucts are not vul­ner­a­ble to a RCE exploit of this secu­ri­ty vul­ner­a­bil­i­ty. The Lin­ux ver­sion of the Serv‑U prod­uct crash­es when the exploit is attempt­ed by a threat actor.

    ...

    ————-

    “Serv‑U Remote Mem­o­ry Escape Vul­ner­a­bil­i­ty”; SolarWinds.com; 07/15/2021

    “Only Solar­Winds Serv‑U Man­aged File Trans­fer and Serv‑U Secure FTP for Win­dows are affect­ed by this vul­ner­a­bil­i­ty. Please note the Serv‑U Gate­way is a com­po­nent of these two prod­ucts and is not a sep­a­rate prod­uct.”

    Only Win­dows sys­tems are vul­ner­a­ble. Weird how Microsoft failed to men­tion that in its threat assess­ment report on this very same vul­ner­a­bil­i­ty.

    So we have not one but two addi­tion Solar­Winds hacks: one dis­closed days after the ini­tial hack and one sev­en months lat­er. Both unre­lat­ed to the ini­tial hack. Both from Chi­na. And both unre­lat­ed to each oth­er. That’s what we’ve been told. With basi­cal­ly no evi­dence. What evi­dence we do have — like Secure­works tying the Super­no­va hack back to an August 2020 hack that pinged from Chi­na — sug­gests the evi­dence behind these attri­bu­tions are ten­u­ous guess­work at best. But at least Secure­works even both­ers to vague­ly describe its evi­dence. That’s more than we get from most.

    And note how both of these new Solar­Winds hacks appear to be, at their core, Microsoft hacks. The Super­no­va hack exploits a Microsoft .NET frame­work vul­ner­a­bil­i­ty and the Serv‑U hack only impacts Win­dows sys­tems. And Microsoft is the com­pa­ny gen­er­al­ly lead­ing the glob­al secu­ri­ty respons­es to major hacks and defin­ing our nar­ra­tives. Again we have to ask, that’s a con­flict of inter­est, right? Blind faith in Microsoft is hard enough as is. We don’t need bla­tant con­flicts of inter­est with extra­or­di­nary stakes.
    All sorts of extra­or­di­nary stakes. Long-stand­ing stakes.

    Posted by Pterrafractyl | August 22, 2021, 11:30 pm

  3. When we learned that Mex­i­co was the first gov­ern­ment to get a sub­scrip­tion to NSO Group’s mal­ware back in 2011, one of the default ques­tions raised by the rev­e­la­tion was why Mex­i­co? Of course, there’s a pret­ty obvi­ous answer. Sad­ly a default answer for Mex­i­co: Orga­nized crime, in par­tic­u­lar in rela­tion to the drug war. It’s the kind of use case that would fit square­ly under the NSO Group’s list of offi­cial valid rea­sons for using its soft­ware. Ter­ror and orga­nized crime are pre­cise­ly what the com­mer­cial sur­veil­lance indus­try touts as why it should be allowed to exist. Mex­i­co cer­tain­ly had no short­age of drug relat­ed orga­nized crime in 2011.

    So with that osten­si­ble rea­son for Mex­i­co’s ear­ly access to the NSO Group’s soft­ware in mind, here’s a piece last month by Daniel Hop­sick­er with some pret­ty wild his­to­ry relat­ed to NSO Group, Mex­i­co’s use of com­mer­cial spy­ware, and the drug trade. And Car­los Slim:

    Before NSO Group’s rela­tion­ship with Mex­i­co, there was Verint, anoth­er Israeli spy­ware-for-hire com­pa­ny. Ver­in­t’s rela­tion­ship with Mex­i­co appears to have start­ed in 2003. That’s based on a press release issued in 2006 by Car­los Slim’s Telmex in response to anoth­er press release tout­ing the Bush State Depart­men­t’s spon­sor­ship of Ver­in­t’s pro­gram to mon­i­tor Telmex’s entire net­work. And since Telmex is Mex­i­co’s monop­oly tele­com provider, that was basi­cal­ly every phone in Mex­i­co get­ting spied on by Verint. This was, again, paid for by the US State Depart­ment.

    And then there’s the giant twist in Ver­in­t’s back­ground: It turns out it was Verint in 2003 — back was it was called ECI Tele­com — that leased the space for the head­quar­ters of Sky­Way Air­craft. As Daniel Hop­sick­er has cov­ered in a num­ber of arti­cles and shows, Sky­Way is like col­lage of intel­li­gence-pro­tect­ed illic­it activ­i­ty, with ties to every­thing from the April 2006 bust of 5.5 tons of cocaine on a Sky­Way Air­craft to the 9/11 hijack­ers in Flori­da. As the Intro­duc­tion of FTR#554 — and inter­view with Daniel Hop­sick­er — reminds us about the net­work of fig­ures and com­pa­nies sur­round­ing Sky­Way (own­ers of ‘Roy­al Sons’):

    Intro­duc­tion: Doc­u­ment­ing the career of Makram Chams, this pro­gram sets forth some facets of a man who must be the most remark­able con­ve­nience store own­er of all time. In addi­tion to being an inti­mate asso­ciate of, and appar­ent col­lab­o­ra­tor of, 9/11 hijack­ers Mohamed Atta and Mar­wan Al-She­hhi, Chams has appar­ent­ly worked as a “con­sul­tant” for Titan Cor­po­ra­tion, a major defense con­trac­tor. Chams also was part own­er of a casi­no boat, anoth­er of whose partners—Max Burge—owned the planes that oper­at­ed out of Huff­man Avi­a­tion. (Huff­man was the flight school through which Atta and oth­er 9/11 hijack­ers infil­trat­ed. For more about Huff­man Avi­a­tion and Hopsicker’s work, see—among oth­er programs—FTR#‘s 477, 482, 483, 484.) Burge had worked with Fred­er­ick Gef­fon, whose ‘Roy­al Sons’ com­pa­ny owned a DC9 that was bust­ed in Mex­i­co with 5.5 tons of cocaine on board. Trac­ing the own­er­ship of the DC9, the broad­cast notes that the plane has belonged to a series of intel­li­gence fronts asso­ci­at­ed with the CIA and Iran-Con­tra drug smug­gling. Among the pre­vi­ous own­ers of the plane was Adnan Khashog­gi, an Iran-Con­tra scan­dal play­er, financier of Al Qae­da and part­ner of John Gray, the New Age guru who has financed the 9/11-dis­in­for­ma­tion move­ment.Some con­ve­nience store own­er!

    Recall how “Roy­al Sons”, owned by Sky­Way, had an address that traced back to Huff­man Avi­a­tion’s hang­er at Venice Air­port. Sky­Way is a remark­ably shady com­pa­ny. As we’ll see, a sec­ond Sky­Way plane bust­ed for a mas­sive cocaine haul had pre­vi­ous­ly been used in CIA ren­di­tion flights. So Sky­Way has all the hall­marks of run­ning an intel­li­gence-con­nect­ed drug traf­fick­ing oper­a­tion and it was Verint that leased Sky­Way its office space in 2003, the same year Telmex tells us Ver­in­t’s mass spy­ing on Mex­i­can phones start­ed, paid for by the US State Depart­ment.

    And as we’ll also see, it appears that when Ver­in­t’s spy­ware was being used by the Mex­i­can gov­ern­ment dur­ing this peri­od to fight against the drug car­tels, there was one car­tel left out: the Sinaloa car­tel. In oth­er words, the spy­ware was being used to allow the gov­ern­ment of Mex­i­co to fight and win a drug war on behalf the chief car­tel in bed with the gov­ern­ment. With Slim in on the cut. Accord­ing to Hop­sick­er, that’s what hap­pened. Slim and the gov­ern­ment of Felipe Calderone used Verint, and the force of the Mex­i­can mil­i­tary and fed­er­al police, to fight a drug war the Sinaloa car­tel was sup­posed to win.

    There’s also a more direct con­nec­tion to NSO Group: In May of 2018, it was report­ed that NSO Group and Verint were merg­ing, although the talks were appar­ent­ly end­ed a cou­ple months lat­er. So Verint is alive and well it would seem, which is anoth­er aspect of this sto­ry:

    Mad­Cow­Prod

    Pega­sus Project’s “Mod­i­fied Lim­it­ed Hang­out”

    By Daniel Hop­sick­er -
    July 27, 2021

    “It’s dif­fi­cult to get a man to under­stand some­thing when his salary depends on his not under­stand­ing it.”—Upton Sin­clair

    “Nev­er argue with any­one whose job depends on not being convinced.”—H. L. Menck­en

    The drum­beat of dai­ly break­ing news about Pega­sus hack­ing soft­ware from Israeli spy­ware ven­dor NSO to some of the world’s most repres­sive regimes con­tains shock­ing dis­clo­sures. But, also, equal­ly shock­ing omis­sions.

    The Israeli mil­i­tary-grade spy­ware is being used, said the Pega­sus Project, against “Politi­cians, jour­nal­ists and human rights activists.”

    It’s a frothy and fre­quent­ly-repeat­ed equa­tion.

    The Wash­ing­ton Post’s head­line: “Pri­vate Israeli spy­ware used to hack cell phone of jour­nal­ists, activists world­wide.”

    And with­out ques­tion these groups have been tar­get­ed, often with trag­ic results. But they left some­thing out. Call it “com­pet­i­tive advan­tage.

    The coun­try with the largest num­ber of tar­get­ed names is Mex­i­co.

    “The great­est num­ber (of smart­phone num­bers) in the data dump were in Mex­i­co,” the Post report­ed, “more than 15,000 num­bers.”

    Mex­i­co is using the spy­ware to tar­get drug traf­fick­ers. Why? Because they’re not just “drug traf­fick­ers.” They’re rival drug traf­fick­ers.

    Plus, the Pega­sus Project doesn’t even men­tion Car­los Slim. He’s been using Israeli spy­ware in Mex­i­co since 2003.

    “Politi­cians, jour­nal­ists and human rights activists”

    When Mex­i­can Pres­i­dent Felipe Calderon sent thou­sands of troops and fed­er­al police to occu­py Ciu­dad Juarez, today known as “Mur­der City,” it wasn’t just to intim­i­date jour­nal­ists and human rights activists.

    The army of occu­pa­tion came to Ciu­dad Juarez to throw it’s mas­sive weight behind one side—the Sinaloa Cartel’s side—in the mur­der­ous drug war that had been rag­ing for con­trol of the Mex­i­can economy’s biggest industry—and largest source of income—the drug trade.

    “The gov­ern­ment declared war on us,” a Juarez Car­tel leader tells a reporter in “To Die in Mex­i­co,” a book by Mex­i­co City jour­nal­ist John Gibler.

    “Many of our mem­bers have been dis­ap­peared,” he con­tin­ued. “We know that it was sol­diers who took them out. They are cov­er­ing for the oth­er gang; they are pro­tect­ing them.”

    “If the Unit­ed States came in, maybe they’d lock us up,” he mus­es. “But here, no, they’re grab­bing up and they’re killing us. That is what is hap­pen­ing; it’s an exter­mi­na­tion.”

    The bat­tle even­tu­al­ly result­ed in defeat for the Juarez Car­tel, at the cost of an esti­mat­ed 20,000 lives.

    That’s how the Israeli spy­ware was used.

    Incon­ve­nient facts are ignored

    But the Pega­sus Project’s most egre­gious omis­sion con­cerns Mexico’s Car­los Slim—perhaps under­stand­ably, giv­en his recent role as the sav­ior of the New York Times.

    In some shocking—and con­ve­nient­ly ignored—recent his­to­ry, Car­los Slim, Mexico’s rich­est oli­garch, between 2003 and 2007 was doing busi­ness with these same Israeli spy­ware ven­dors, which are all spin-offs from the intel­li­gence unit of the Israeli Defense Forces, Unit 8200.

    Israeli spy­ware ven­dors have a rich his­to­ry of wrong­do­ing before 2012, includ­ing com­pa­nies with Unit 8200 intel­li­gence con­nec­tions every bit as strong as NSO’s. Both of NSO’s prin­ci­pals began their careers as part of the unit. The names of Israeli spy­ware ven­dors fre­quent­ly change. But who the play­ers ulti­mate­ly worked for did not. Pega­sus Project jour­nal­ists appear to know noth­ing about this.

    It’s the same ruse often used by Amer­i­can intel­li­gence. Erik Prince’s Black­wa­ter seemed to change it’s name with each new atroc­i­ty. When Claire Chennault’s Fly­ing Tigers from World War II trans­formed into Civ­il Air Trans­port and then trans­mo­gri­fied into Air Amer­i­ca, the names change, but the mis­sion remained the same.

    Today the NSO Group still oper­ates under var­i­ous monikers.

    The Wash­ing­ton Post back in 2017 report­ed trai­tor-for-hire Mike Fly­nn had been paid “rough­ly $100,000” as a “con­sul­tant” for OSY Tech­nolo­gies, as well as the pri­vate equi­ty firm Fran­cis­co Part­ners, which are, respec­tive­ly, NSO Group’s par­ent com­pa­ny and pre­vi­ous own­er. But these ties to the for­mer Defense Intel­li­gence Agency chief escaped close scruti­ny and embar­rass­ing ques­tions until just a few days ago.

    “A mod­i­fied, extreme­ly-lim­it­ed hang­out”

    By ignor­ing the NSO Group’s his­to­ry and pre­vi­ous iter­a­tions, The Pega­sus Project does the West­ern world a grave dis­ser­vice.

    The omis­sions expose a glob­al drug car­tel com­posed of gov­ern­ments and gang­sters.

    Mex­i­can oli­garch and the country’s wealth­i­est man Car­los Slim had a part­ner­ship with Israeli intel­li­gence-con­nect­ed VERINT, which signed a con­tract to wire­tap any phone in Mex­i­co. Slim’s Telmex con­trolled almost all of Mexico’s land­lines. Slim was also vir­tu­al­ly the only cell phone provider.

    The infor­ma­tion Israeli spy­ware from VERINT allowed Mex­i­can Pres­i­dents, Vicente Fox and Felipe Calderon to ren­der crit­i­cal aid to the Sinaloa Car­tel, then at war at the time with every oth­er car­tel in Mex­i­co.

    Who picked up the tab for VERINT’s con­tract in Mex­i­co? The Admin­is­tra­tion of Pres­i­dent George W. Bush.

    What does VERINT have to do with the sub­ject of Project Pega­sus, Israeli spy­ware com­pa­ny NSO Group? Just three years ago, in 2018, VERINT announced it was pur­chas­ing NSO for $1 bil­lion dol­lars. The buy-out was called off at the last minute, for undis­closed rea­sons, which only now become obvi­ous.

    But it was any­thing but a hos­tile takeover.

    ...

    “Dude, amaz­ing busi­ness syn­er­gy. Real­ly.”

    But there’s an even-more shock­ing rev­e­la­tion con­nect­ing Car­los Slim and Israeli intelligence’s spy­ware spin-off VERINT, sit­ting right out in the open.

    VERINT owned the cor­po­rate head­quar­ters in Clear­wa­ter leased by Sky­Way Air­craft, soo to be the proud own­ers of a DC‑9 (N900SA) bust­ed in the Yucatan on April 11, 2006 car­ry­ing a record—even for Mexico—seizure on an air­plane, 5.5 tons of cocaine.

    So VERINT (in it’s ear­li­er iter­a­tion as ECI Tele­com), had leased a huge 78,000 square foot complex—large enough to lat­er become a local college’s cam­pus— to a com­pa­ny Sky­Way in April 2003, which the com­pa­ny used to smug­gle cocaine.

    And it did this while tap­ping every cell phone in Mex­i­co.

    Sky­Way had report­ing zero earn­ings dur­ing the pre­vi­ous quar­ter, accord­ing to SEC fil­ings, and had exact­ly one employ­ee.

    With that kind of cred­it score, it would be hard to qual­i­fy for a one-bed­room apart­ment in a shab­by part of town. What gives? Maybe this:

    Short­ly there­after, Sky­Way bought twin DC‑9’s, one of which had been recent­ly “owned” by Ramy El-Batrawi, a Sau­di lieu­tenant of Adnan Khashoggi’s. The two men’s Jet­bourne Air­lines flew mis­siles to Iran for Lt. Colonel Oliv­er North dur­ing the Iran Con­tra scan­dal.

    “Not quite fair play, was it?”

    A num­ber of “anom­alies” sur­round­ed the mas­sive seizure.

    One was that Skyway’s bust­ed DC‑9 was impres­sive­ly tricked out to imper­son­ate air­craft from the U.S. Dept. of Home­land Secu­ri­ty, com­plete with an offi­cial-look­ing Seal depict­ing an Amer­i­can eagle clutch­ing a claw filled of arrows.

    What makes this fact even more curi­ous is that the plane was based at Clear­wa­ter-St Peters­burg Inter­na­tion­al Air­port, which also housed a fleet of planes which belonged to U.S. Cus­toms, and which were tasked with drug inter­dic­tion across the entire Caribbean Basin.

    They didn’t have to look far.

    Dur­ing that same year (2006), as SkyWay’s DC‑9 was busy fly­ing back and forth to South Amer­i­ca, the George W. Bush Admin­is­tra­tion picked SkyWay’s land­lord in Clear­wa­ter, VERINT, to install a $3 mil­lion tele­phone and Inter­net wire­tap­ping cen­ter in Mex­i­co, allow­ing author­i­ties there to eaves­drop on every land­line and cell phone call made in the coun­try.

    But SkyWay’s DC9 (N900SA) was just the first of two drug planes over an 18-month peri­od from St-Peters­burg-Clear­wa­ter Inter­na­tion­al Air­port caught car­ry­ing mul­ti-ton loads of cocaine in Mex­i­co with clear ties to the U.S. Gov­ern­ment

    The sec­ond drug plane, a Gulf­stream II busi­ness jet (N987SA), had been cit­ed by Euro­pean author­i­ties for fly­ing extra­or­di­nary ren­di­tions mis­sions for the CIA.

    As author and inves­tiga­tive jour­nal­ist James Bam­ford, who has bro­ken many sto­ries on the NSA, report­ed:

    “In 2006 the Bush Admin­is­tra­tion entered into a qui­et agree­ment with the Mex­i­can Gov­ern­ment to fund and build an enor­mous $3 mil­lion tele­phone and Inter­net eaves­drop­ping ven­dor that would reach into every town and vil­lage in the coun­try.”

    A press release herald­ing the con­tract read:

    “Com­verse (which soon changed its name to VERINT) Select­ed by Tele­fonos de Mex­i­co to Imple­ment a Wide­spread Expan­sion of Voice­mail Ser­vices.”

    Car­los Slim’s Telmex also issued a press release, which oblique­ly sug­gest­ed the pro­gram had actu­al­ly began in 2003.

    “The pur­pose is to cre­ate swift inves­tiga­tive mea­sures against orga­nized crime,” said Mex­i­can pres­i­dent Felipe Calderon at the time the deal was announced.”

    And in a May 2007 sto­ry in the Los Ange­les Times, Sam Enriquez report­ed:

    “Although the pro­pos­al stems from the president’s noble inten­tion of effi­cient­ly fight­ing orga­nized crime, the rem­e­dy seems worse than the prob­lem.”

    “The sys­tem the Bush Admin­is­tra­tion chose for Mex­i­co is sim­i­lar to the war­rant-less eaves­drop­ping oper­a­tion in the U.S., and used the same ven­dor, the Israeli com­pa­ny VERINT, found­ed by vet­er­ans of that country’s NSA, the hyper-secret Unit 9200.”

    “Paid for by the U.S. State Depart­ment, it was installed by a polit­i­cal­ly well-con­nect­ed firm based in Melville, N.Y., that spe­cial­izes in elec­tron­ic sur­veil­lance.”

    The real SLIM’s Shady

    When Ama­do Car­ril­lo Fuentes—known as Mexico’s “Lord of the Skies” for his vast arma­da of drug planes—died in 1997 while under­go­ing plas­tic surgery, he was worth $25 bil­lion, accord­ing to the AP. In oth­er words, dur­ing the time he large­ly ran the drug trade in Mex­i­co, Fuentes was able to salt away $10 bil­lion a decade.

    Con­trast his per­for­mance with that of Car­los Slim’s, it’s easy to see why Mexico’s rich­est oli­garch links to the drug trade have been the sub­ject of rumors for years.

    Accord­ing to numer­ous pub­lished reports, at the turn of the mil­len­ni­um, Car­los Slim was worth between $6 and $7 bil­lion dol­lars. Mex­i­co City’s May 7, 1999 La Jor­na­da, for exam­ple, report­ed Slim’s for­tune at “some­thing like $6 bil­lion.”

    Latin Trade mag­a­zine pegged Slim as being worth $7.2 bil­lion.

    In oth­er words, after work­ing hard for more than 40 years, Car­los Slim was worth the hefty sum of $7 bil­lion dol­lars.

    Yet less than nine years lat­er, when Slim made what became a high­ly-con­tro­ver­sial invest­ment in the New York Times in 2009, news accounts of the deal report­ed his net worth as being between 57 bil­lion and $60 bil­lion dol­lars.

    It took Car­los Slim 40 years to make his first $7 bil­lion. Less than ten years lat­er he’d amassed an addi­tion­al $50 bil­lion.

    What kind of busi­ness offers prof­it mar­gins of more than $5 bil­lon a year? Cer­tain­ly not cell phones. The con­clu­sion is inescapable. Mexico’s rich­est man—who owned a chunk of The New York Times—is dirty.

    Incon­ve­nient knowl­edge

    Dur­ing the glob­al finan­cial cri­sis between 2008 and 2012, as Car­los Slim was express­ing his touch­ing com­mit­ment to a free press with a $250 mil­lion dol­lar invest­ment in the New York Times, one per­son spoke out.

    Anto­nio Maria Cos­ta, head of the Unit­ed Nations’ watch­dog Office on Drugs and Crime, was impolitic enough to blurt out an incon­ve­nient fact:

    “In the midst of the cur­rent world finan­cial cri­sis, drug mon­ey is, in many instances, cur­rent­ly the only liq­uid invest­ment cap­i­tal,” Maria Cos­ta told Reuters.

    “Mon­ey made in the illic­it drug trade is being used to keep banks afloat in the glob­al finan­cial cri­sis The drug trade at this time could be the world’s only growth indus­try.”

    Right about then, in the midst of a glob­al depres­sion, Unit­ed Nations Drug Czar Anto­nio Maria Cos­ta told reporters that the only thing keep­ing many major banks sol­vent was drug mon­ey, which pro­vid­ed the West­ern world’s only liq­uid­i­ty at the time.

    Divulging the inner work­ings of the drug trade –where the mon­ey goes— remains one of West­ern journalism’s major taboos.

    Typ­i­cal news cov­er­age today reports whose car­tel is up, and which down, as if the drug trade were some kind of horse race report­ed by a sup­pos­ed­ly-dis­in­ter­est­ed track announc­er.

    The pro­ceeds of the drug indus­try con­sti­tutes the largest slush fund in the his­to­ry of the world. Pur­su­ing where that mon­ey ends up may be beyond the purview of jour­nal­is­tic efforts like The Pega­sus Project.

    But it shouldn’t be.

    ———-

    “Pega­sus Project’s “Mod­i­fied Lim­it­ed Hang­out”” by Daniel Hop­sick­er; Mad­Cow­Prod; 07/27/2021

    “In some shocking—and con­ve­nient­ly ignored—recent his­to­ry, Car­los Slim, Mexico’s rich­est oli­garch, between 2003 and 2007 was doing busi­ness with these same Israeli spy­ware ven­dors, which are all spin-offs from the intel­li­gence unit of the Israeli Defense Forces, Unit 8200.”

    It is indeed remark­ably con­ve­nient for the pre-NSO Group his­to­ry of Car­los Slim, Verint, and Mex­i­co’s use of Israeli spy­ware. Because as we saw, it’s a his­to­ry involv­ing the gov­ern­ments of Mex­i­co, Israeli, and the US. A whole bunch of very con­ve­nient­ly timed arrange­ments took place in the 2003–2007 Bush era-peri­od. First, we learn that Car­los Slims tele­com monop­oly in Mex­i­co signed a con­tract with Israeli spy­ware firm Verint to spy on Slim’s net­work. This effec­tive­ly meant Verint was spy­ing on every phone in Mex­i­co. Verint remains active to this day. In May 2018, Verint was report­ed­ly in talks to merge with NSO Group. Those talks were announced called off two months lat­er (sev­er­al months before Jamal Khashog­gi’s assas­si­na­tion made NSO Group a prob­lem­at­ic merg­er part­ner). That the two firms got that far along in merg­er talks is a sign of how close they are:

    ...
    Mex­i­can oli­garch and the country’s wealth­i­est man Car­los Slim had a part­ner­ship with Israeli intel­li­gence-con­nect­ed VERINT, which signed a con­tract to wire­tap any phone in Mex­i­co. Slim’s Telmex con­trolled almost all of Mexico’s land­lines. Slim was also vir­tu­al­ly the only cell phone provider.

    ...

    Who picked up the tab for VERINT’s con­tract in Mex­i­co? The Admin­is­tra­tion of Pres­i­dent George W. Bush.

    What does VERINT have to do with the sub­ject of Project Pega­sus, Israeli spy­ware com­pa­ny NSO Group? Just three years ago, in 2018, VERINT announced it was pur­chas­ing NSO for $1 bil­lion dol­lars. The buy-out was called off at the last minute, for undis­closed rea­sons, which only now become obvi­ous.

    But it was any­thing but a hos­tile takeover.
    ...

    And Ver­in­t’s 2006 con­tract (then Com­verse) to spy on Slim’s entire net­work was paid for by the Bush State Depart­ment. The fact that Tele­fonos de Mex­i­co (Telmex) select­ed a com­pa­ny with roots in Israel’s Unit 9200 was tout­ed in a press release. And then Telmex issues a press release indi­cat­ing the eaves­drop­ping pro­gram actu­al­ly began in 2003. So Ver­in­t’s con­tract to spy on every phone in Mex­i­co was paid for by the US State Depart­ment and start­ed in 2003. This was the kind of stuff that was get­ting qui­et­ly under­way in those ear­ly War on Ter­ror years:

    ...
    As author and inves­tiga­tive jour­nal­ist James Bam­ford, who has bro­ken many sto­ries on the NSA, report­ed:

    “In 2006 the Bush Admin­is­tra­tion entered into a qui­et agree­ment with the Mex­i­can Gov­ern­ment to fund and build an enor­mous $3 mil­lion tele­phone and Inter­net eaves­drop­ping ven­dor that would reach into every town and vil­lage in the coun­try.”

    A press release herald­ing the con­tract read:

    “Com­verse (which soon changed its name to VERINT) Select­ed by Tele­fonos de Mex­i­co to Imple­ment a Wide­spread Expan­sion of Voice­mail Ser­vices.”

    Car­los Slim’s Telmex also issued a press release, which oblique­ly sug­gest­ed the pro­gram had actu­al­ly began in 2003.

    “The pur­pose is to cre­ate swift inves­tiga­tive mea­sures against orga­nized crime,” said Mex­i­can pres­i­dent Felipe Calderon at the time the deal was announced.”

    And in a May 2007 sto­ry in the Los Ange­les Times, Sam Enriquez report­ed:

    “Although the pro­pos­al stems from the president’s noble inten­tion of effi­cient­ly fight­ing orga­nized crime, the rem­e­dy seems worse than the prob­lem.”

    “The sys­tem the Bush Admin­is­tra­tion chose for Mex­i­co is sim­i­lar to the war­rant-less eaves­drop­ping oper­a­tion in the U.S., and used the same ven­dor, the Israeli com­pa­ny VERINT, found­ed by vet­er­ans of that country’s NSA, the hyper-secret Unit 9200.”

    “Paid for by the U.S. State Depart­ment, it was installed by a polit­i­cal­ly well-con­nect­ed firm based in Melville, N.Y., that spe­cial­izes in elec­tron­ic sur­veil­lance.”
    ...

    But wire­tap­ping Mex­i­co on the US State Depart­ments tab is only part of what makes Verint such a fas­ci­nat­ing com­pa­ny. As Hop­sick­er reminds us, it was none oth­er than Verint who leased the land to Sky­Way Air­craft. That was in 2003, when Verint — then called ECI Tele­com — leased the land to Sky­Way. It was April 2006 when Sky­Way’s DC‑9 (N900SA) bust­ed in the Yucatan on April 11, 2006 car­ry­ing a record—even for Mexico—seizure on an air­plane, 5.5 tons of cocaine. And as Hop­sick­er has dis­cussed many, many times, that plane is like the phys­i­cal embod­i­ment of the dark his­to­ry of intel­li­gence-pro­tect­ed drug-traf­fick­ing, going back to Oliv­er North’s Iran Con­tra oper­a­tions:

    ...
    VERINT owned the cor­po­rate head­quar­ters in Clear­wa­ter leased by Sky­Way Air­craft, soo to be the proud own­ers of a DC‑9 (N900SA) bust­ed in the Yucatan on April 11, 2006 car­ry­ing a record—even for Mexico—seizure on an air­plane, 5.5 tons of cocaine.

    So VERINT (in it’s ear­li­er iter­a­tion as ECI Tele­com), had leased a huge 78,000 square foot complex—large enough to lat­er become a local college’s cam­pus— to a com­pa­ny Sky­Way in April 2003, which the com­pa­ny used to smug­gle cocaine.

    And it did this while tap­ping every cell phone in Mex­i­co.

    Sky­Way had report­ing zero earn­ings dur­ing the pre­vi­ous quar­ter, accord­ing to SEC fil­ings, and had exact­ly one employ­ee.

    With that kind of cred­it score, it would be hard to qual­i­fy for a one-bed­room apart­ment in a shab­by part of town. What gives? Maybe this:

    Short­ly there­after, Sky­Way bought twin DC‑9’s, one of which had been recent­ly “owned” by Ramy El-Batrawi, a Sau­di lieu­tenant of Adnan Khashoggi’s. The two men’s Jet­bourne Air­lines flew mis­siles to Iran for Lt. Colonel Oliv­er North dur­ing the Iran Con­tra scan­dal.
    ...

    Adding to the evi­dence that Sky­Way Air­craft was an intel­li­gence pro­tect­ed oper­a­tion, the DC‑9 (N900SA), was designed to imper­son­ate offi­cial US DHS air­craft. And yet the plane was based at Clear­wa­ter-St Peters­burg Inter­na­tion­al Air­port, which also housed a fleet of planes which belonged to U.S. Cus­toms:

    ...
    A num­ber of “anom­alies” sur­round­ed the mas­sive seizure.

    One was that Skyway’s bust­ed DC‑9 was impres­sive­ly tricked out to imper­son­ate air­craft from the U.S. Dept. of Home­land Secu­ri­ty, com­plete with an offi­cial-look­ing Seal depict­ing an Amer­i­can eagle clutch­ing a claw filled of arrows.

    What makes this fact even more curi­ous is that the plane was based at Clear­wa­ter-St Peters­burg Inter­na­tion­al Air­port, which also housed a fleet of planes which belonged to U.S. Cus­toms, and which were tasked with drug inter­dic­tion across the entire Caribbean Basin.

    They didn’t have to look far.

    Dur­ing that same year (2006), as SkyWay’s DC‑9 was busy fly­ing back and forth to South Amer­i­ca, the George W. Bush Admin­is­tra­tion picked SkyWay’s land­lord in Clear­wa­ter, VERINT, to install a $3 mil­lion tele­phone and Inter­net wire­tap­ping cen­ter in Mex­i­co, allow­ing author­i­ties there to eaves­drop on every land­line and cell phone call made in the coun­try.
    ...

    Oh, and then oth­er Sky­Way drug plane bust­ed in a mul­ti-ton cocaine bust dur­ing this peri­od was pre­vi­ous­ly used in CIA ren­di­tion mis­sions. Keep in mind this was around 2006. Those were recent ren­di­tions:

    ...
    But SkyWay’s DC9 (N900SA) was just the first of two drug planes over an 18-month peri­od from St-Peters­burg-Clear­wa­ter Inter­na­tion­al Air­port caught car­ry­ing mul­ti-ton loads of cocaine in Mex­i­co with clear ties to the U.S. Gov­ern­ment

    The sec­ond drug plane, a Gulf­stream II busi­ness jet (N987SA), had been cit­ed by Euro­pean author­i­ties for fly­ing extra­or­di­nary ren­di­tions mis­sions for the CIA.
    ...

    And that’s all the con­text for how Verint was used in 2006 when Mex­i­co’s Pres­i­dent Felipe Calderon unleashed Ver­in­t’s spy­ware dur­ing Mex­i­co’s bat­tle with the car­tels. It was a bat­tle on the side of one car­tel. The Sinaloa Car­tel. Tak­ing down Sinaloa’s car­tel ene­mies was how Ver­in­t’s spy­ware was used. Paid for by the State Depart­ment:

    ...
    When Mex­i­can Pres­i­dent Felipe Calderon sent thou­sands of troops and fed­er­al police to occu­py Ciu­dad Juarez, today known as “Mur­der City,” it wasn’t just to intim­i­date jour­nal­ists and human rights activists.

    The army of occu­pa­tion came to Ciu­dad Juarez to throw it’s mas­sive weight behind one side—the Sinaloa Cartel’s side—in the mur­der­ous drug war that had been rag­ing for con­trol of the Mex­i­can economy’s biggest industry—and largest source of income—the drug trade.

    “The gov­ern­ment declared war on us,” a Juarez Car­tel leader tells a reporter in “To Die in Mex­i­co,” a book by Mex­i­co City jour­nal­ist John Gibler.

    “Many of our mem­bers have been dis­ap­peared,” he con­tin­ued. “We know that it was sol­diers who took them out. They are cov­er­ing for the oth­er gang; they are pro­tect­ing them.”

    “If the Unit­ed States came in, maybe they’d lock us up,” he mus­es. “But here, no, they’re grab­bing up and they’re killing us. That is what is hap­pen­ing; it’s an exter­mi­na­tion.”

    The bat­tle even­tu­al­ly result­ed in defeat for the Juarez Car­tel, at the cost of an esti­mat­ed 20,000 lives.

    That’s how the Israeli spy­ware was used.

    ...

    The infor­ma­tion Israeli spy­ware from VERINT allowed Mex­i­can Pres­i­dents, Vicente Fox and Felipe Calderon to ren­der crit­i­cal aid to the Sinaloa Car­tel, then at war at the time with every oth­er car­tel in Mex­i­co.
    ...

    These kinds of tools aren’t just per­fect for qui­et gov­ern­ment abuse. They’re also per­fect for the those net­works and agen­das were orga­nized crime, intel­li­gence, and pow­er pol­i­tics coin­cide. And while the orga­nized crime/intelligence/power pol­i­tics nexus isn’t exclu­sive­ly occu­pied by fas­cists, it’s con­cen­trat­ed with them. And that’s all part of the con­text of the con­tem­po­rary sto­ry of NSO Group, Can­diru, and the rest of the glob­al spy­ware indus­try. These tools real­ly are the per­fect tool for crim­i­nals. So, you know, maybe gov­ern­ments are actu­al­ly using these per­fect crim­i­nal tools to help their elite crim­i­nal friends. Maybe exten­sive­ly. Maybe espe­cial­ly when the State Depart­ment is pay­ing for it.

    Posted by Pterrafractyl | August 27, 2021, 1:45 am

  4. Here’s a recent sto­ry about anoth­er Israeli “com­mer­cial sur­veil­lance” com­pa­ny com­ing under inter­na­tion­al scruti­ny. This time it’s Cellebrite, the mak­er of spe­cial UFED devices used by law enforce­ment agen­cies around the world to break into smart­phones, includ­ing US law enforce­ment. Alarm­ing­ly, these devices have even been found for sale on eBay. And now Cellebrites investors are hop­ing to cash in on their cut­ting edge tech­nol­o­gy by issu­ing a pub­lic offer­ing. You too can own a slice of this cut­ting-edge spy­ware firm. The com­pa­ny is esti­mat­ed to be worth $2.4 bil­lion.

    But with the announced pub­lic offer­ing comes a com­pli­ca­tion: peo­ple are start­ing to take note of who Cellebrite’s clients are and how they’ve been using these devices. Clients like Belarus, Indone­sia, Sau­di Ara­bia, and Bangladesh. Inter­est­ing­ly, Rus­sia and Chi­na are also for­mer Cellebrite client, which is notable giv­en all of the indi­ca­tions that the US is, at a min­i­mum, qui­et­ly con­don­ing Israel’s glob­al sales of these tools, or out­right pay­ing for it, as was the case with the US State Depart­ment pay­ing for Ver­in­t’s wire­tap­ping of every phone in Mex­i­co. But it’s the sale of Cellebrite’s tools to Bangladesh that have become a par­tic­u­lar­ly sore point for the com­pa­ny’s pub­lic image. As the fol­low­ing piece by Richard Sil­ver­stein notes, Bangladesh’s Rapid Action Bat­tal­ion of elite secu­ri­ty forces have been known to engage in the tor­ture and sum­ma­ry exe­cu­tions of gays, athe­ists, and polit­i­cal dis­si­dents in a cam­paign that killed 465 peo­ple in 2018 alone. So Bangladesh has been unleash­ing what amounts to a state-sanc­tioned domes­tic ter­ror cam­paign dur­ing the time Cellebrite has been sell­ing the coun­try exact­ly the kinds of tools that would facil­i­tate that kind of domes­tic ter­ror.

    As we should expect, with Cellebrite get­ting ready to go pub­lic, the com­pa­ny is now tout­ing to the world how it refus­es to sell its tools to coun­tries with track human rights abuse track record, releas­ing the state­ment cit­ing Bangladesh, Belarus, Chi­na, Hong Kong, Macau, Rus­sia and Venezuela as exam­ples of coun­tries it refus­es to sells to. As Sil­ver­stein points out, part of the rea­son Cellebrite list­ed all those coun­tries is because they’re all for­mer clients:

    “Cellebrite does not sell to coun­tries sanc­tioned by the U.S., EU, UK or Israeli gov­ern­ments or that are on the Finan­cial Action Task Force (FATF) black­list,” Cellebrite said in its SEC fil­ing.

    “We pur­sue only those cus­tomers who we believe will act law­ful­ly and not in a man­ner incom­pat­i­ble with pri­va­cy rights or human rights. For exam­ple, we have cho­sen not to do busi­ness in Bangladesh, Belarus, Chi­na, Hong Kong, Macau, Rus­sia and Venezuela par­tial­ly due to con­cerns regard­ing human rights and data secu­ri­ty, and we may in the future decide not to oper­ate in oth­er coun­tries or with oth­er poten­tial cus­tomers for sim­i­lar rea­sons,” the doc­u­ment said. The August fil­ing includ­ed an update about the for­ma­tion of an “Ethics and Integri­ty Com­mit­tee,” whose mis­sion “is expect­ed to include advis­ing on eth­i­cal con­sid­er­a­tions relat­ed to the use of our tech­nolo­gies.”

    Notice how Sau­di Ara­bia was­n’t on that list. Giv­en what we know about the direct actions the Israeli gov­ern­ment took to ensure Sau­di Ara­bia main­tained a sub­scrip­tion to the NSO Group’s Pega­sus super-spy­ware even after NSO Group dropped the Saud­is in the wake of the glob­al out­rage over the killing of Jamal Khashog­gi, it’s not absurd to assume that Cellebrite’s sales to Bangladesh are an impor­tant diplo­mat­ic tool. As Sil­ver­stein notes, in May of this year Israel was urg­ing Bangladesh to nor­mal­ized its rela­tions with Israel. Those kinds of over­tures become much more dif­fi­cult when com­pa­nies like Cellebrite are forced to cut off access in the face of pub­lic out­rage. That’s all part of what makes this sto­ry of Cellebrite’s con­tro­ver­sial pub­lic offer­ing some­thing to watch going for­ward. It’s the kind of trans­ac­tion that could end up reveal­ing aspects of these shad­ow rela­tion­ships that meant to kept in the shad­ows:

    Tikun Olam

    As Cellebrite Pre­pares for Pub­lic Offer­ing, It’s Dirty Deeds Come Back to Haunt
    From Spy­ing on Putin and Lukashenko’s Ene­mies to Sum­ma­ry Exe­cu­tions in Bangladesh, the Israeli Spy­ware Com­pa­ny Has Blood on Its Hands

    by Richard Sil­ver­stein
    August 17, 2021

    The Israeli spy­ware com­pa­ny, Cellebrite is, along with its blood cousin, NSO Group, known in the cyber-sur­veil­lance sec­tor for pro­duc­ing the most advanced and intru­sive tech­nol­o­gy on the world mar­ket. They’re also among the prof­itable with mar­ket val­u­a­tions in the bil­lions. I’ve reg­u­lar­ly pro­filed the lat­ter com­pa­ny. But Cellebrite has evad­ed some of the more dam­ag­ing media expo­sure afflict­ing its dirty-ops cousin.

    As it pre­pares for a pub­lic offer­ing, the com­pa­ny is clean­ing up its act. Among the dirt­i­est of its clients have been Chi­na, Belarus, Indone­sia, Sau­di Ara­bia, and Bangladesh. Both Israeli com­pa­nies claim their prod­ucts are sold only to police agen­cies for the pur­pose of pre­vent­ing crime and cap­tur­ing crim­i­nals. But if that were ever the case, it is no longer. Cus­tomers are large­ly the secu­ri­ty ser­vices of repres­sive regimes seek­ing to iden­ti­fy and elim­i­nate legit­i­mate polit­i­cal dis­sent. Oh, and Cellebrite’s UFED device has even been list­ed for sale on eBay! So if you’re a ter­ror­ist or crim­i­nal seek­ing cyber-intel­li­gence on rivals or even your local police force, you know where to turn.

    86 Bangladeshi dis­si­dents have been dis­ap­peared by the Rapid Action Bat­tal­ion, a gov­ern­ment death squad

    The company’s flag­ship prod­uct is UFED, a device which, when con­nect­ed to a cell phone, can bypass its pass­word pro­tec­tion and encryp­tion to extract all its data and make it acces­si­ble to the client. US police depart­ments have spent mil­lions on it to gath­er evi­dence in crim­i­nal inves­ti­ga­tions. Even pub­lic schools have pur­chased the sys­tem to spy on their stu­dents. In Texas, a police offi­cer con­fis­cat­ed a student’s phone and used UFED to retrieve mes­sages between the lat­ter and a teacher which exposed a roman­tic rela­tion­ship and led to the teacher’s arrest.

    Bangladesh is a par­tic­u­lar­ly bru­tal exam­ple of Cellebrite’s clients. Since 2004, the country’s Rapid Action Bat­tal­ion has tar­get­ed gays, athe­ists, and polit­i­cal dis­si­dents in a cam­paign of sum­ma­ry exe­cu­tions, tor­ture, and dis­ap­pear­ances which killed 465 peo­ple in 2018 alone. A 2005 Human Rights Watch report said that it had killed 350 peo­ple in first year of its exis­tence. The Dha­ka Tri­bune attrib­uted near­ly 1,100 mur­ders to it from 2004–2008.

    An Israeli legal fil­ing protest­ing sale of the tech­nol­o­gy to Bangladesh not­ed:

    “Accord­ing to…human rights groups in Bangladesh…the Bangladesh secu­ri­ty forces have been accused of using drills to tor­ture their vic­tims, beat­ings, long deten­tions in sub­hu­man con­di­tions and even hang­ing peo­ple upside down,” Mack wrote, not­ing that there were also reports of vic­tims being shot in their knees; hav­ing their tes­ti­cles beat­en; their fin­ger­nails pulled out; their heads held under­wa­ter; along­side sex­u­al vio­lence, threats of rape and rape itself. “Mock and real exe­cu­tions,” the doc­u­ment also not­ed.

    As a Mus­lim coun­try, it does not offi­cial­ly do busi­ness with Israel. But the Israeli com­pa­ny eas­i­ly over­came that hur­dle by estab­lish­ing a Sin­ga­pore sub­sidiary which ful­filled the $350,000 con­tract, accord­ing to Al Jazeera. Nine secu­ri­ty agents were sent to Sin­ga­pore to train in the use of UFED. Nor is this an unusu­al com­mer­cial arrange­ment. Israeli spy mer­chants from Mat­ti Kochavi to NSO Group main­tain mul­ti­ple such cut-outs which per­mit them do bil­lions in busi­ness with Arab and Mus­lim coun­tries bypass­ing the boy­cott.

    Israeli human rights attor­ney, Eitay Mack, has cam­paigned for years to end the export of such dead­ly Israeli tech­nol­o­gy. The defense min­istry, which nom­i­nal­ly reviews and approves sales of advanced secu­ri­ty-mil­i­tary tech­nol­o­gy to for­eign nations, nev­er rejects such trade. After all, it is a huge mon­ey-mak­er for the Israeli econ­o­my. It also strength­ens rela­tion­ships between Israel and its client states (when you’re a pari­ah state, you need all the friends you can get).

    In fact, Cellebrite had done such a good job in assist­ing Bangladeshi death squads with their dirty work that the for­eign min­istry urged the coun­try to become the lat­est Mus­lim coun­try to nor­mal­ize rela­tions. Mack told me:

    On May 22, Gilad Cohen, Israel For­eign Ministry’s deputy direc­tor gen­er­al for Asia and the Pacif­ic, urged the Bangladesh gov­ern­ment to estab­lish diplo­mat­ic ties for the “ben­e­fit and pros­per­i­ty” of the peo­ple of the two coun­tries. [So] Celleberite’s announce­ment that it will stop sell­ing its hack­ing sys­tem to Bangladesh proves that the MOD [Min­istry of Defense] and these kinds of com­pa­nies only under­stand pub­lic and media pres­sure.

    When the min­istry refused to con­sid­er the moral ram­i­fi­ca­tions of sale of these prod­ucts, Mack turned to the Supreme Court. It too not only refused to act, it clamped a veil of secre­cy over all the pro­ceed­ings, includ­ing its deci­sions. Recent­ly, the Court has elim­i­nat­ed Mack’s recourse to it by rul­ing that it has no juris­dic­tion over mat­ters con­cern­ing the defense min­istry. That means he may no more bring such claims before it at all.

    ...

    While use of the spy­ware brings with it a trail of human suf­fer­ing, the cre­ators of the tech­nol­o­gy, like any ven­ture cap­i­tal­ist, have only one thing in mind: prof­it. The quick­est path to a big pay­day is tak­ing your com­pa­ny pub­lic. It per­mits ear­ly investors and com­pa­ny founders to turn their com­pa­ny shares into cash or oth­er types of liq­uid assets. In the case of Cellebrite, the SPAC will val­ue the com­pa­ny at $2.4‑billion. NSO, which has been treat­ed bru­tal­ly in the media after a recent expose of spy­ing on 50,000 cell phone num­bers belong­ing to pres­i­dents, prime min­is­ters and princes, hopes that a SPAC will enable it to avoid the process of find­ing a buy­er will­ing to ignore all that ter­ri­ble pub­lic­i­ty.

    In prepa­ra­tion for the big day, Cellebrite is wip­ing all the blood off its hands and face. In its fil­ings with the SEC it offers these sooth­ing pas­sages:

    “Cellebrite does not sell to coun­tries sanc­tioned by the U.S., EU, UK or Israeli gov­ern­ments or that are on the Finan­cial Action Task Force (FATF) black­list,” Cellebrite said in its SEC fil­ing.

    “We pur­sue only those cus­tomers who we believe will act law­ful­ly and not in a man­ner incom­pat­i­ble with pri­va­cy rights or human rights. For exam­ple, we have cho­sen not to do busi­ness in Bangladesh, Belarus, Chi­na, Hong Kong, Macau, Rus­sia and Venezuela par­tial­ly due to con­cerns regard­ing human rights and data secu­ri­ty, and we may in the future decide not to oper­ate in oth­er coun­tries or with oth­er poten­tial cus­tomers for sim­i­lar rea­sons,” the doc­u­ment said. The August fil­ing includ­ed an update about the for­ma­tion of an “Ethics and Integri­ty Com­mit­tee,” whose mis­sion “is expect­ed to include advis­ing on eth­i­cal con­sid­er­a­tions relat­ed to the use of our tech­nolo­gies.”

    That might sound good to an unin­formed indi­vid­ual. But the rea­son the list of coun­tries it refus­es to do busi­ness with for eth­i­cal rea­sons is so long and impres­sive, is that these are many of its most dead­ly for­mer clients. Cellebrite had ditched many of these coun­tries ear­li­er, after Mack’s research exposed its sor­did con­nec­tion to them. But Bangladesh was one of the last domi­noes to fall.

    Cellebrite, like NSO, can write a sooth­ing, reas­sur­ing bit of prose for a pub­lic dubi­ous of the heinous acts of which it’s accused. This is what it told Haaretz:

    …The com­pa­ny “is com­mit­ted to ethics as part of its core val­ues and prac­tice of work and has devel­oped a very strong com­pli­ance frame­work. Cellebrite has strict licens­ing poli­cies and restric­tions that gov­ern how cus­tomers may uti­lize our tech­nol­o­gy. Our sales deci­sions are also guid­ed by inter­nal para­me­ters, which con­sid­er a poten­tial customer’s human rights record and anti-cor­rup­tion poli­cies.”

    The com­pa­ny is also fol­low­ing in NSO’s foot­steps in telling the SEC it will cre­ate an ethics com­mit­tee to guide its busi­ness deci­sions. In truth, the smooth talk and the pablum about ethics are a fig leaf for its ugly deeds. It hopes they will fool reg­u­la­tors and put them into a deep sleep.

    Yet anoth­er rea­son why Con­gress must act against this vile, blood­thirsty indus­try. As Sen. Ron Wyden and six House mem­bers have declared: there must be fed­er­al penal­ties imposed on the mis­use of this tech­nol­o­gy. The penal­ties must also apply to the banks and pri­vate investors whose cap­i­tal enables the spy­ware busi­ness to be so lucra­tive.

    ———-

    “As Cellebrite Pre­pares for Pub­lic Offer­ing, It’s Dirty Deeds Come Back to Haunt” by Richard Sil­ver­stein; Tikun Olam; 08/17/2021

    “That might sound good to an unin­formed indi­vid­ual. But the rea­son the list of coun­tries it refus­es to do busi­ness with for eth­i­cal rea­sons is so long and impres­sive, is that these are many of its most dead­ly for­mer clients. Cellebrite had ditched many of these coun­tries ear­li­er, after Mack’s research exposed its sor­did con­nec­tion to them. But Bangladesh was one of the last domi­noes to fall.”

    It’s a lot more com­pli­cat­ed sell­ing your mul­ti-bil­lion dol­lar spy­ware firm when every­one knows about the human rights abus­es with are going to be com­mit­ted with your spy­ware. But it gets even more com­pli­cat­ed with that pow­er­ful spy­ware dou­bles as a pow­er­ful diplo­mat­ic tool. it’s one rea­son we prob­a­bly should­n’t be sur­prised Bangladesh was the last of Cellebrites’s ‘prob­lem’ clients to get dropped. Ongo­ing diplo­mat­ic over­tures are get­ting in the way:

    ...
    The company’s flag­ship prod­uct is UFED, a device which, when con­nect­ed to a cell phone, can bypass its pass­word pro­tec­tion and encryp­tion to extract all its data and make it acces­si­ble to the client. US police depart­ments have spent mil­lions on it to gath­er evi­dence in crim­i­nal inves­ti­ga­tions. Even pub­lic schools have pur­chased the sys­tem to spy on their stu­dents. In Texas, a police offi­cer con­fis­cat­ed a student’s phone and used UFED to retrieve mes­sages between the lat­ter and a teacher which exposed a roman­tic rela­tion­ship and led to the teacher’s arrest.

    Bangladesh is a par­tic­u­lar­ly bru­tal exam­ple of Cellebrite’s clients. Since 2004, the country’s Rapid Action Bat­tal­ion has tar­get­ed gays, athe­ists, and polit­i­cal dis­si­dents in a cam­paign of sum­ma­ry exe­cu­tions, tor­ture, and dis­ap­pear­ances which killed 465 peo­ple in 2018 alone. A 2005 Human Rights Watch report said that it had killed 350 peo­ple in first year of its exis­tence. The Dha­ka Tri­bune attrib­uted near­ly 1,100 mur­ders to it from 2004–2008.

    ...

    In fact, Cellebrite had done such a good job in assist­ing Bangladeshi death squads with their dirty work that the for­eign min­istry urged the coun­try to become the lat­est Mus­lim coun­try to nor­mal­ize rela­tions. Mack told me:

    On May 22, Gilad Cohen, Israel For­eign Ministry’s deputy direc­tor gen­er­al for Asia and the Pacif­ic, urged the Bangladesh gov­ern­ment to estab­lish diplo­mat­ic ties for the “ben­e­fit and pros­per­i­ty” of the peo­ple of the two coun­tries. [So] Celleberite’s announce­ment that it will stop sell­ing its hack­ing sys­tem to Bangladesh proves that the MOD [Min­istry of Defense] and these kinds of com­pa­nies only under­stand pub­lic and media pres­sure.

    ...

    And note how the US gov­ern­ment could impose some sort of pun­ish­ment to the banks and pri­vate investors in these com­pa­nies. It could hap­pen, but does­n’t hap­pen. A kind of silent con­sent:

    ...
    Yet anoth­er rea­son why Con­gress must act against this vile, blood­thirsty indus­try. As Sen. Ron Wyden and six House mem­bers have declared: there must be fed­er­al penal­ties imposed on the mis­use of this tech­nol­o­gy. The penal­ties must also apply to the banks and pri­vate investors whose cap­i­tal enables the spy­ware busi­ness to be so lucra­tive.
    ...

    Again, don’t for­get that when NSO Group belat­ed­ly dropped Sau­di Ara­bia as a client fol­low­ing the glob­al out­rage over the assas­si­na­tion of Jamal Khashog­gi, it was­n’t just the Israeli gov­ern­ment that pres­sured NSO Group to keep its Sau­di clients. The Trump admin­is­tra­tion also report­ed­ly want­ed the Saud­is to main­tain access to the com­pa­ny’s spy­ware. And that’s why it’s hard to take Cellebrite’s pledges of being bet­ter seri­ous­ly. The com­pa­ny isn’t real­ly in a posi­tion to make these deci­sions on its own.

    Plus, the fact that this indus­try has a habit of set­ting up shad­ow sub­sidiaries in order to get around export restric­tions does­n’t exact­ly lend con­fi­dence to the idea that Cellebrite has sud­den­ly turned over a new leaf:

    ...
    As a Mus­lim coun­try, it does not offi­cial­ly do busi­ness with Israel. But the Israeli com­pa­ny eas­i­ly over­came that hur­dle by estab­lish­ing a Sin­ga­pore sub­sidiary which ful­filled the $350,000 con­tract, accord­ing to Al Jazeera. Nine secu­ri­ty agents were sent to Sin­ga­pore to train in the use of UFED. Nor is this an unusu­al com­mer­cial arrange­ment. Israeli spy mer­chants from Mat­ti Kochavi to NSO Group main­tain mul­ti­ple such cut-outs which per­mit them do bil­lions in busi­ness with Arab and Mus­lim coun­tries bypass­ing the boy­cott.
    ...

    You can build a secre­tive spy­ware firm, and you can take your com­pa­ny pub­lic, but tak­ing a super secret spy­ware firm pub­lic is obvi­ous­ly a lot eas­i­er said than done. And yet, as Cellebrite is poised to demon­strate, it’s appar­ent­ly doable.

    Posted by Pterrafractyl | August 29, 2021, 6:33 pm

  5. Here’s one of those sto­ries that should imme­di­ate­ly prompt a ‘wait­ing for the oth­er shoe to drop’ feel­ing:

    The US Air Force’s first chief soft­ware office just announced his res­ig­na­tion. But that was­n’t the only announce­ment in Nico­las Chail­lan’s res­ig­na­tion let­ter. Beyond the expect­ed charges of insti­tu­tion­al iner­tia, Chail­lan accused the Air Force of bor­der­line crim­i­nal neg­li­gence when it comes to basic IT secu­ri­ty prac­tices, start­ing with the habit of putting mid-rank­ing gen­er­al­ist offi­cers in charge of spe­cial­ist projects. But it’s his com­plaint on fis­cal-relat­ed issues that is per­haps the most shock­ing: The Air Force appar­ent­ly could­n’t come up with the $20 mil­lion for 2022 for the main project Chail­lan has been work­ing on. Yep, the US mil­i­tary just could­n’t find the mon­ey. After being repeat­ed­ly told that the project he was work­ing on was crit­i­cal and being asked to devel­op a “min­i­mum viable project” (MVP) — a scaled down basic ver­sion of a new soft­ware tool designed to be released with basic fea­tures in order to get user feed­back — in just four months, and after a mas­sive under­tak­ing and invest­ment in the project, the Air Force told Chail­lan that actu­al­ly the $20 mil­lion won’t be there after all.

    That painful dis­ap­point was clear­ly a big dri­ver in Chail­lan’s deci­sion to resign. But note that this project was­n’t exclu­sive­ly an Air Force project. It was a Joint All-Domain Com­mand and Con­trol (JADC2) Depart­ment of Defense-wide project focused on mak­ing sure data can be seam­less­ly shared across plat­forms. Which is was obvi­ous­ly a wild­ly impor­tant project impact­ing the entire US mil­i­tary. That’s the project the Air Force could­n’t find $20 mil­lion for next year. So on top of all the expect­ed rea­sons for Pen­ta­gon chal­lenges with IT secu­ri­ty — some under­stand­able and some less so — we can add a rea­son that has no fath­omable jus­ti­fi­ca­tion: that the US mil­i­tary some­how could­n’t find the mon­ey:

    The Reg­is­ter

    US Air Force chief soft­ware offi­cer quits after launch­ing Hell­fire mis­sile of a LinkedIn post at his for­mer boss­es
    Too many inex­pe­ri­enced project man­agers and not enough DevSec­Ops

    Gareth Cor­field
    Fri 3 Sep 2021 // 18:14 UTC

    The US Air Force’s first ever chief soft­ware offi­cer has quit the job after brand­ing it “prob­a­bly the most chal­leng­ing and infu­ri­at­ing of my entire career” in a remark­ably can­did blog post.

    Nico­las Chail­lan’s impres­sive­ly blunt leav­ing note, which he post­ed to his LinkedIn pro­file, cas­ti­gat­ed USAF senior hier­ar­chy for fail­ing to pri­ori­tise basic IT issues, say­ing: “A lack of response and align­ment is cer­tain­ly a con­trib­u­tor to my accel­er­at­ed exit.”

    Chail­lan took on his chief soft­ware offi­cer role in May 2019, hav­ing pre­vi­ous­ly worked at the US Depart­ment of Defense rolling out DevSec­Ops prac­tices to the Amer­i­can mil­i­tary. Before that he found­ed two com­pa­nies.

    In his mis­sive, Chail­lan also sin­gled out a part of mil­i­tary cul­ture that fea­tures in both the US and the UK: the prac­tice of appoint­ing mid-rank­ing gen­er­al­ist offi­cers to run spe­cial­ist projects.

    “Please,” he implored, “stop putting a Major or Lt Col (despite their devo­tion, excep­tion­al atti­tude, and cul­ture) in charge of ICAM, Zero Trust or Cloud for 1 to 4 mil­lion users when they have no pre­vi­ous expe­ri­ence in that field – we are set­ting up crit­i­cal infra­struc­ture to fail.”

    The for­mer chief soft­ware offi­cer con­tin­ued:

    We would not put a pilot in the cock­pit with­out exten­sive flight train­ing; why would we expect some­one with no IT expe­ri­ence to be close to suc­cess­ful? They do not know what to exe­cute on or what to pri­or­i­tize which leads to end­less risk reduc­tion efforts and dilut­ed focus. IT is a high­ly skilled and trained job; staff it as such.

    In the British armed forces mid-rank­ing offi­cers are post­ed, regard­less of qual­i­fi­ca­tions or pro­fes­sion­al expe­ri­ence, to man­age equip­ment-pur­chas­ing projects for the Min­istry of Defence. These post­ings are of fixed length and last for two years, mean­ing any project that takes more than two years has the poten­tial to end up turn­ing into a huge­ly expen­sive and unpro­duc­tive mess. The ori­gin of this pol­i­cy was a 1980s cor­rup­tion scan­dal where a civ­il ser­vant over­see­ing a long-term MoD con­tract was caught accept­ing bribes; to pre­vent it hap­pen­ing again, senior per­son­nel decid­ed to imple­ment the two-year-post­ing pol­i­cy.

    Chail­lan went on to com­plain that while he had man­aged to roll out DevSec­Ops prac­tices with­in his cor­ner of US DoD, his abil­i­ty to achieve larg­er scale projects was being ham­pered by insti­tu­tion­al iner­tia.

    “I told my lead­er­ship that I could have fixed Enter­prise IT in 6 months if empow­ered,” he wrote.

    Among the USAF’s sins-accord­ing-to-Chail­lan? The ser­vice is still using “out­dat­ed water-agile-fall acqui­si­tion prin­ci­ples to pro­cure ser­vices and tal­ent”, while he lament­ed the fail­ure of the Joint All-Domain Com­mand and Con­trol (JADC2) to secure its required $20m fund­ing in the USAF’s FY22 bud­get.

    He was also quite scathing about the USAF’s adop­tion – or lack there­of – of DevSec­Ops, the trendy name for efforts to make devel­op­ers include secu­ri­ty-relat­ed deci­sions at the same time as prod­uct-relat­ed deci­sions when writ­ing new soft­ware. It appears the ser­vice was­n’t quite as open-mind­ed as its over­seers in the wider DoD.

    “There is absolute­ly no valid rea­son not to use and man­date DevSec­Ops in 2021 for cus­tom soft­ware,” wrote Chail­lan. “It is bor­der­line crim­i­nal not to do so. It is effec­tive­ly guar­an­tee­ing a tremen­dous waste of tax­pay­er mon­ey and cre­ates mas­sive cyber­se­cu­ri­ty threats but also pre­vents us from deliv­er­ing capa­bil­i­ties at the pace of rel­e­vance, putting lives at risk, and poten­tial­ly pre­vent­ing capa­bil­i­ties to be made avail­able when need­ed when­ev­er world events demand, many times overnight.”

    Doubt­less his full post will chime with any­one else in a senior post at a tech com­pa­ny who even­tu­al­ly becomes fed-up enough not only to quit but also to tell the wider world exact­ly why.

    ...

    ———–

    “US Air Force chief soft­ware offi­cer quits after launch­ing Hell­fire mis­sile of a LinkedIn post at his for­mer boss­es” by Gareth Cor­field; The Reg­is­ter; 09/03/2021

    “Please,” he implored, “stop putting a Major or Lt Col (despite their devo­tion, excep­tion­al atti­tude, and cul­ture) in charge of ICAM, Zero Trust or Cloud for 1 to 4 mil­lion users when they have no pre­vi­ous expe­ri­ence in that field – we are set­ting up crit­i­cal infra­struc­ture to fail.”

    Are peo­ple with no IT secu­ri­ty being put in charge of major IT projects for the mil­i­tary and set­ting up future mil­i­tary IT dis­as­ters? That’s what Chail­lan is accus­ing the Air Force of doing. Which might also par­tial­ly explain the oppo­si­tion to DevSec­Ops prac­tices that avoid the kind of secu­ri­ty night­mares Chail­lan is warn­ing us about:

    ...
    Chail­lan went on to com­plain that while he had man­aged to roll out DevSec­Ops prac­tices with­in his cor­ner of US DoD, his abil­i­ty to achieve larg­er scale projects was being ham­pered by insti­tu­tion­al iner­tia.

    “I told my lead­er­ship that I could have fixed Enter­prise IT in 6 months if empow­ered,” he wrote.

    ...

    He was also quite scathing about the USAF’s adop­tion – or lack there­of – of DevSec­Ops, the trendy name for efforts to make devel­op­ers include secu­ri­ty-relat­ed deci­sions at the same time as prod­uct-relat­ed deci­sions when writ­ing new soft­ware. It appears the ser­vice was­n’t quite as open-mind­ed as its over­seers in the wider DoD.

    “There is absolute­ly no valid rea­son not to use and man­date DevSec­Ops in 2021 for cus­tom soft­ware,” wrote Chail­lan. “It is bor­der­line crim­i­nal not to do so. It is effec­tive­ly guar­an­tee­ing a tremen­dous waste of tax­pay­er mon­ey and cre­ates mas­sive cyber­se­cu­ri­ty threats but also pre­vents us from deliv­er­ing capa­bil­i­ties at the pace of rel­e­vance, putting lives at risk, and poten­tial­ly pre­vent­ing capa­bil­i­ties to be made avail­able when need­ed when­ev­er world events demand, many times overnight.”
    ...

    But of all of Chail­lan’s com­plaints, the fact that the Air Force could­n’t find the mon­ey to fund a project its first chief soft­ware offi­cer is per­haps the most shock­ing. One does­n’t asso­ciate the US Air Force with being short on cash:

    ...
    Among the USAF’s sins-accord­ing-to-Chail­lan? The ser­vice is still using “out­dat­ed water-agile-fall acqui­si­tion prin­ci­ples to pro­cure ser­vices and tal­ent”, while he lament­ed the fail­ure of the Joint All-Domain Com­mand and Con­trol (JADC2) to secure its required $20m fund­ing in the USAF’s FY22 bud­get.
    ...

    And as the fol­low­ing arti­cle describes, that Joint All-Domain Com­mand and Con­trol (JADC2) project the Air Force could­n’t find the mon­ey for in 2022 was­n’t just a ran­dom project. It was the project the Air Force has been telling Chail­lan was absolute­ly crit­i­cal and they made a huge invest­ment in cre­at­ing a min­i­mum viable prod­uct (MVP) ver­sion of the project in a mat­ter of months to meet those needs. After all that, Chail­lan was told the mon­ey was­n’t going to be there. The Air Force can’t find the mon­ey. It’s like the DoD was trolling him. The kind of trolling that might trig­ger an angry pub­lic res­ig­na­tion:

    FCW

    Air Force chief soft­ware offi­cer to resign

    By Lau­ren C. Williams
    Sep 02, 2021

    The Air Force’s first chief soft­ware offi­cer, Nico­las Chail­lan, will step down from his role in Octo­ber, FCW has learned. His last day is planned for Oct. 2.

    “We are the largest soft­ware orga­ni­za­tion on the plan­et, and we have almost no shared repos­i­to­ries and lit­tle to no col­lab­o­ra­tion across DOD Ser­vices,” Chail­lan wrote in a res­ig­na­tion memo obtained by FCW.

    “At this point, I am just tired of con­tin­u­ous­ly chas­ing sup­port and mon­ey to do my job. My office still has no bil­let and no fund­ing, this year and the next.”

    Chail­lan start­ed his posi­tion in 2018 with the mis­sion of mak­ing DevSec­Ops the stan­dard busi­ness prac­tice and expand­ing the Kessel Run soft­ware fac­to­ry mod­el across the Air Force. He not­ed that the job was “prob­a­bly the most chal­leng­ing and infu­ri­at­ing of my entire career” but also “impact­ful” and “reward­ing.”

    Since join­ing the Air Force tech lead­er­ship, Chail­lan’s team has most notably helped stand up Plat­form One, which aims to make it eas­i­er for orga­ni­za­tions to cre­ate soft­ware fac­to­ries and deploy­ing trust­ed code to warfight­ers eas­i­er with cer­ti­fied tools. Chail­lan’s team was also behind migrat­ing Kuber­netes to the F‑16 fight­er jet. (Chail­lan was named a Fed100 award win­ner in 2021 for his work with Plat­form One.)

    Before becom­ing the Air Force CSO, he served as a lead on DOD’s enter­prise DevSec­Ops ini­tia­tive and cloud secu­ri­ty advi­sor to the under­sec­re­tary of defense for acqui­si­tion and sus­tain­ment in the Office of the Sec­re­tary of Defense.

    In the memo, Chail­lan not­ed that lack of fund­ing along with DOD bureau­cra­cy left his office and its mis­sion “unem­pow­ered to fix basic IT issues.” Specif­i­cal­ly, the soft­ware chief named his recent task of help­ing the Joint Chiefs of Staff with its efforts on Joint All Domain Com­mand and Con­trol, a DOD-wide effort to make sure data can be seam­less­ly shared across plat­forms.

    “They want­ed me to help deliv­er a min­i­mum viable prod­uct (MVP) with­in four months so that we would final­ly have a tan­gi­ble deliv­er­able to show for JADC2,” Chail­lan wrote.

    “After a mas­sive under­tak­ing and devel­op­ment of a scope of work, based on demands from our warfight­ers and [com­bat­ant com­mands], I had just start­ed the work and built-up excite­ment with teams and our mis­sion part­ners, when I was told by the Joint Staff that there was no [fis­cal year 2022] fund­ing to sup­port the MVP after all. After all the talk and con­tin­ued asser­tions that this was crit­i­cal work, DOD could not even find $20 [mil­lion] to build tremen­dous­ly ben­e­fi­cial warfight­er capa­bil­i­ties.”

    Chail­lan has been vocal about DOD lead­ers mak­ing good on their rhetoric. In an Air Force Mag­a­zine inter­view ear­li­er this month, he said “the lead­er­ship in the depart­ment always says the right things,” but “it’s a lit­tle bit hard­er to walk the walk.”

    ...

    ————

    “Air Force chief soft­ware offi­cer to resign” by Lau­ren C. Williams; FCW; 09/02/2021

    “In the memo, Chail­lan not­ed that lack of fund­ing along with DOD bureau­cra­cy left his office and its mis­sion “unem­pow­ered to fix basic IT issues.” Specif­i­cal­ly, the soft­ware chief named his recent task of help­ing the Joint Chiefs of Staff with its efforts on Joint All Domain Com­mand and Con­trol, a DOD-wide effort to make sure data can be seam­less­ly shared across plat­forms.”

    One would think a DOD-wide effort to make sure data can be seam­less­ly shared across plat­forms would be the kind of project that gets bud­get pri­or­i­ty. Nope. The DoD could­n’t find the $20 mil­lion. This is after they ask Chail­lan, the Air Force’s first ever chief soft­ware offi­cer, to help with the project. And then they told him they could­n’t find the $20 mil­lion. Non-seam­less com­mu­ni­ca­tion it is then:

    ...
    “They want­ed me to help deliv­er a min­i­mum viable prod­uct (MVP) with­in four months so that we would final­ly have a tan­gi­ble deliv­er­able to show for JADC2,” Chail­lan wrote.

    “After a mas­sive under­tak­ing and devel­op­ment of a scope of work, based on demands from our warfight­ers and [com­bat­ant com­mands], I had just start­ed the work and built-up excite­ment with teams and our mis­sion part­ners, when I was told by the Joint Staff that there was no [fis­cal year 2022] fund­ing to sup­port the MVP after all. After all the talk and con­tin­ued asser­tions that this was crit­i­cal work, DOD could not even find $20 [mil­lion] to build tremen­dous­ly ben­e­fi­cial warfight­er capa­bil­i­ties.”
    ...

    Keep in mind that when the DoD said it could­n’t find $20 mil­lion for 2022 to sup­port this project, it sounds like that mon­ey was just for the build­ing the scaled down MVP. The full project would obvi­ous­ly cost much more. But that’s pos­si­bly part of what enraged Chail­lan. If the DoD can’t even come up with the mon­ey for a pilot project what are the odds it’s going be able to com­mit itself to the full project.

    But there’s anoth­er obvi­ous pos­si­bil­i­ty in terms of what drove the Air Force to pull the plug on Chail­lan’s JADC2 pilot project: some­one wants to redi­rect that project towards some­where else. It could be an intra-bureau­crat­ic turf war. Or per­haps some­one has a pri­vate con­trac­tor in mind?

    And that brings us to the oth­er major sto­ry that can’t be ignored in the con­text of the Air Force’s inabil­i­ty to com­mit to the JADC2 project: the Pen­tagon’s announce­ment in July that it was can­cel­ing Microsoft­’s giant $10 bil­lion JEDI con­tract that would accom­plish mush of what JADC2 would do in cre­at­ing inter­op­er­abil­i­ty across the DoD’s IT sys­tems. As we’ll see, when the DoD announced they were can­cel­ing the JEDI con­tract, JADC2’s over­lap­ping capa­bil­i­ties were cit­ed in the first para­graph of the press release giv­ing the rea­son­ing for the deci­sion.

    Instead of Microsoft hav­ing the JEDI con­tract, it sounds like it’s going to be divid­ed up between mul­ti­ple ven­dors, mean­ing com­peti­tors like Ama­zon and Palan­tir sud­den­ly got a new oppor­tu­ni­ty to com­pete for slides of that JEDI con­tract.

    So when we’re forced to inter­pret Chail­lan’s pub­lic warn­ing about the state of the mil­i­tary’s IT defi­cien­cies, keep in mind the the pulling of the plug of Chail­lan’s JADC2 project may have been one of the casu­al­ties in a giant con­trac­tor term war that opened up after Microsoft lost the JEDI con­tract:

    The New York Times

    Pen­ta­gon Can­cels a Dis­put­ed $10 Bil­lion Tech­nol­o­gy Con­tract

    The deci­sion puts an end to years of legal wran­gling over the con­tract, for 10 years of cloud-com­put­ing ser­vices.

    By Kate Con­ger and David E. Sanger
    July 6, 2021

    The Defense Depart­ment said on Tues­day that it would not go for­ward with a lucra­tive cloud-com­put­ing con­tract that had become the sub­ject of a con­tentious legal bat­tle amid claims of inter­fer­ence by the Trump admin­is­tra­tion.

    The Pen­ta­gon had warned Con­gress in Jan­u­ary that it might walk away from the con­tract if a fed­er­al court agreed to con­sid­er whether for­mer Pres­i­dent Don­ald J. Trump inter­fered in a process that award­ed the $10 bil­lion con­tract to Microsoft over its tech rival Ama­zon, say­ing that the ques­tion would result in lengthy lit­i­ga­tion and unten­able delays.

    The Defense Depart­ment said in a news release on Tues­day that the con­tract for the Joint Enter­prise Defense Infra­struc­ture, known as JEDI, “no longer meets its needs,” but it said it would solic­it bids from Ama­zon and Microsoft on future cloud-com­put­ing con­tracts.

    The Pen­ta­gon state­ment made for a qui­et end to years of legal wran­gling and duel­ing tech­nol­o­gy claims over what many con­sid­ered to be the mar­quee con­tract for pro­vid­ing cloud-com­put­ing ser­vices to the fed­er­al gov­ern­ment.

    A senior admin­is­tra­tion offi­cial said that soon after the Biden admin­is­tra­tion took office, it began a review that quick­ly con­clud­ed that the cost­ly argu­ments over JEDI had been so lengthy that the sys­tem would be out­dat­ed as soon as it was deployed.

    “With the shift­ing tech­nol­o­gy envi­ron­ment, it has become clear that the JEDI cloud con­tract, which has been long delayed, no longer meets the require­ments to fill the D.O.D.’s capa­bil­i­ty gaps,’’ the Pen­ta­gon said in an announce­ment.

    Instead, the Pen­ta­gon pro­posed a new cloud archi­tec­ture called the Joint Warfight­er Cloud Capa­bil­i­ty. And the Pen­ta­gon made clear that only Microsoft and Ama­zon Web Ser­vices had the capac­i­ty to build it. The Pentagon’s announce­ment sug­gest­ed that it would buy tech­nol­o­gy from both com­pa­nies, rather than award­ing one large con­tract to a sin­gle provider, as it had for JEDI.

    Secu­ri­ty con­cerns also played a role in the deci­sion to seek cloud ser­vices from mul­ti­ple com­pa­nies, offi­cials say. Recent breach­es of cloud ser­vices have made it clear that there are vul­ner­a­bil­i­ties, and the Pen­ta­gon did not want to be depen­dent on one com­pa­ny for its tech­nol­o­gy.

    The Defense Department’s deci­sion rep­re­sents a Pyrrhic vic­to­ry for Ama­zon, which is the lead­ing provider of com­mer­cial cloud-com­put­ing ser­vices and already has pro­vid­ed ser­vices to oth­er parts of the fed­er­al gov­ern­ment, such as the Cen­tral Intel­li­gence Agency.

    The deci­sion also comes days after Andy Jassy, the for­mer head of Amazon’s cloud busi­ness, took over as chief exec­u­tive from Amazon’s founder, Jeff Bezos. The appoint­ment of Mr. Jassy accen­tu­at­ed the impor­tance of cloud com­put­ing to big tech com­pa­nies, which have built giant data cen­ters all over the world to accom­mo­date new busi­ness and gov­ern­ment cus­tomers.

    The 10-year JEDI con­tract was award­ed to Microsoft in 2019 after a fight among Ama­zon and oth­er tech giants for the deal to mod­ern­ize the military’s cloud-com­put­ing sys­tems. Much of the mil­i­tary oper­ates on out­dat­ed com­put­er sys­tems, and the Defense Depart­ment has spent bil­lions of dol­lars try­ing to mod­ern­ize those sys­tems while pro­tect­ing clas­si­fied mate­r­i­al.

    Although some com­pa­nies, includ­ing the busi­ness soft­ware com­pa­ny Ora­cle, lob­bied for the Pen­ta­gon break the con­tract into pieces and award them to mul­ti­ple sup­pli­ers, the Defense Depart­ment pressed for­ward with its plan to use a sin­gle cloud provider, believ­ing that would be the most seam­less and secure approach.

    Because of the size and secu­ri­ty require­ments of the JEDI con­tract, Ama­zon was wide­ly con­sid­ered the front-run­ner. When the award fell to Microsoft, Ama­zon sued to block the con­tract, argu­ing that Microsoft did not have the tech­ni­cal capa­bil­i­ties to ful­fill the military’s needs and that the process had been biased against Ama­zon because of Mr. Trump’s repeat­ed crit­i­cisms of Mr. Bezos, who also owns The Wash­ing­ton Post.

    “For Microsoft, this went from a lot­tery deal to a court night­mare,” said Daniel Ives, the man­ag­ing direc­tor of equi­ty research at Wed­bush Secu­ri­ties. Microsoft said that Amazon’s claims of bias lacked evi­dence and that it was pre­pared to pro­vide the nec­es­sary tech­nol­o­gy to the mil­i­tary, while the Defense Depart­ment said Mr. Trump had not played a role in the deci­sion.

    The Wash­ing­ton Post aggres­sive­ly cov­ered the Trump admin­is­tra­tion, and Mr. Trump often referred to the news­pa­per as the “Ama­zon Wash­ing­ton Post” and accused it of spread­ing “fake news.” He also said com­pa­nies besides Ama­zon should be con­sid­ered for the JEDI con­tract, and Ama­zon argued he had used “improp­er pres­sure” to sway the Pen­ta­gon as it select­ed a tech­nol­o­gy ven­dor.

    In April, a fed­er­al court said it could not dis­miss the pos­si­bil­i­ty the Mr. Trump had med­dled in the process. The court’s rul­ing set the stage for the Pen­ta­gon, which had argued that the exten­sive delays sur­round­ing the con­tract caused nation­al secu­ri­ty con­cerns, to walk away from the con­tract.

    “We under­stand and agree with the D.O.D.’s deci­sion. Unfor­tu­nate­ly, the con­tract award was not based on the mer­its of the pro­pos­als and instead was the result of out­side influ­ence that has no place in gov­ern­ment pro­cure­ment,” said Drew Her­den­er, a spokesman for Ama­zon. “We look for­ward to con­tin­u­ing to sup­port the D.O.D.’s mod­ern­iza­tion efforts and build­ing solu­tions that help accom­plish their crit­i­cal mis­sions.”

    As the Biden admin­is­tra­tion exam­ined the years­long effort to build a com­put­ing cloud, offi­cials said they came to two con­clu­sions: The legal chal­lenges to JEDI could stretch on for years, and the tech­no­log­i­cal con­cept was already out­dat­ed. Agen­cies that pre­vi­ous­ly were using a sin­gle cloud provider — includ­ing the C.I.A. — were now look­ing for mul­ti­ple providers. Even inside the mil­i­tary, the Army, Navy, Air Force and oth­er ser­vices were already look­ing at build­ing their own clouds.

    ...

    Nor did the Pen­ta­gon refer to the grow­ing con­cerns about the secu­ri­ty of cloud ser­vices. While such ser­vices are gen­er­al­ly con­sid­ered safer than stor­ing data on indi­vid­ual com­put­er servers, some major breach­es over the past year have raised new wor­ries about vul­ner­a­bil­i­ties of soft­ware used by both the Pen­ta­gon and by defense con­trac­tors.

    ...

    ———-

    “Pen­ta­gon Can­cels a Dis­put­ed $10 Bil­lion Tech­nol­o­gy Con­tract” by Kate Con­ger and David E. Sanger; The New York Times; 06/06/2021

    “The 10-year JEDI con­tract was award­ed to Microsoft in 2019 after a fight among Ama­zon and oth­er tech giants for the deal to mod­ern­ize the military’s cloud-com­put­ing sys­tems. Much of the mil­i­tary oper­ates on out­dat­ed com­put­er sys­tems, and the Defense Depart­ment has spent bil­lions of dol­lars try­ing to mod­ern­ize those sys­tems while pro­tect­ing clas­si­fied mate­r­i­al.”

    Microsoft won the big JEDI con­tract in 2019 to build the US mil­i­tary’s uni­fied cloud. But the Biden admin­is­tra­tion put the JEDI pro­gram on ice, allow­ing the Pen­ta­gon to reimag­ine the mil­i­tary’s shared cloud under a mul­ti-ser­vice-provider mod­el. Microsoft and Ama­zon are both going to build the Joint Warfight­er Cloud Capa­bil­i­ty (JWCC) next-gen­er­a­tion mil­i­tary cloud. And while con­cerns about the Trump admin­is­tra­tion’s skew­ing of the bid­ding process against Ama­zon may have play a role in this deci­sion, con­cerns about the inher­ent secu­ri­ty risks of using a sole cloud provider also played a role...along with the fact that there have been so many mega secu­ri­ty scares of late. If no cloud can tru­ly be relied on, the next best option is to rely on a many dif­fer­ent clouds to min­i­mize the inevitable dam­age:

    ...
    Instead, the Pen­ta­gon pro­posed a new cloud archi­tec­ture called the Joint Warfight­er Cloud Capa­bil­i­ty. And the Pen­ta­gon made clear that only Microsoft and Ama­zon Web Ser­vices had the capac­i­ty to build it. The Pentagon’s announce­ment sug­gest­ed that it would buy tech­nol­o­gy from both com­pa­nies, rather than award­ing one large con­tract to a sin­gle provider, as it had for JEDI.

    Secu­ri­ty con­cerns also played a role in the deci­sion to seek cloud ser­vices from mul­ti­ple com­pa­nies, offi­cials say. Recent breach­es of cloud ser­vices have made it clear that there are vul­ner­a­bil­i­ties, and the Pen­ta­gon did not want to be depen­dent on one com­pa­ny for its tech­nol­o­gy.

    ...

    Nor did the Pen­ta­gon refer to the grow­ing con­cerns about the secu­ri­ty of cloud ser­vices. While such ser­vices are gen­er­al­ly con­sid­ered safer than stor­ing data on indi­vid­ual com­put­er servers, some major breach­es over the past year have raised new wor­ries about vul­ner­a­bil­i­ties of soft­ware used by both the Pen­ta­gon and by defense con­trac­tors.
    ...

    But even com­part­men­tal­ized clouds pro­vid­ed by sep­a­rate con­trac­tors are still going to all have to inter­op­er­ate if the JEDI vision of seam­less inter­op­er­abil­i­ty is going to be real­ized. Com­part­men­tal­ized, seam­less inter­op­er­abil­i­ty. In oth­er words, you’re still going to need the kind of func­tion­al­i­ty Nico­las Chail­lan’s team was work­ing on for the Pen­tagon’s JADC2 project.

    And as the fol­low­ing Seek Alpha invest­ment arti­cle remind­ed us short­ly after the Pen­ta­gon can­celed the JEDI con­tract, if there’s one com­pa­ny out there in the com­mer­cial sec­tor that poised to fuse togeth­er the dif­fer­ent com­po­nents of the mil­i­tary’s cloud it’s Palan­tir. And yes, it’s a Palan­tir cheer­leader piece by some­one who wants Palan­tir’s stock to rise. But you can’t argue with them when they point out that Palan­tir is already a top favored soft­ware provider for the US mil­i­tary and has been build­ing and inte­grat­ing soft­ware across dif­fer­ent branch­es of the mil­i­tary and intel­li­gence com­mu­ni­ty for years. Through a series of bad deci­sions made with increas­ing fre­quen­cy over the years, Palan­tir has become one of the key soft­ware providers for the US nation­al secu­ri­ty state and con­nect­ing larg­er num­bers of data­bas­es into a sin­gle ana­lyt­i­cal plat­form is one of the com­pa­ny’s spe­cial­ties. In oth­er words, if it turns out that the rea­son the Air Force sud­den­ly ‘could­n’t find’ the $20 mil­lion need­ed for Chail­lan’s JADC2 pilot project was because some­one at the Pen­ta­gon has an alter­na­tive com­mer­cial provider for those kinds of ser­vices in mind, there’s a very good chance the provider they have in mind in Palan­tir:

    Seek­ing Alpha

    JEDI Can­ce­la­tion By The Pen­ta­gon Could Become Palan­tir’s Biggest Gain

    Steven Fio­r­il­lo
    Jul. 13, 2021 9:00 AM ET

    Sum­ma­ry

    * The $10 bil­lion JEDI Con­tract has been can­celed and will be recon­struct­ed by uti­liz­ing mul­ti­ple ven­dors instead of one enti­ty.
    * Joint All-Domain Com­mand and Con­trol and AI and Data Accel­er­a­tion are new ini­tia­tives respon­si­ble for the Pen­tagon’s deci­sion to can­cel JEDI and they fall into Palan­tir’s wheel­house.
    * In Q2 2021, Palan­tir has signed 16 new con­tracts with Uncle Sam with the poten­tial of being worth over $200 mil­lion.
    * Palan­tir is my largest con­vic­tion posi­tion for the 2020s and I am more bull­ish than ever for their future.

    Palan­tir (NYSE:PLTR) has become a bat­tle­ground stock on Seek­ing Alpha. Since my last PLTR arti­cle on 5/27/21, thir­ty-four have been pub­lished. Both the bear­ish and bull­ish view­points are filled with con­vic­tion, and only time will tell which camp is cor­rect. Among Seek­ing Alpha con­trib­u­tors, there is an over­all neu­tral rat­ing with a score of 3.42, and the sen­ti­ment is mutu­al on Wall Street as the aver­age score is 2.77 putting PLTR on neu­tral ground there as well. I believe the bears are incor­rect, and going into Q2 earn­ings, I am more bull­ish than ever on PLTR. Since my ini­tial block of shares I pur­chased as the direct offer­ing hit the Street, my cost basis has increased as I con­tin­u­ous­ly add to my posi­tion in PLTR. This is my largest con­vic­tion invest­ment for future cap­i­tal appre­ci­a­tion.

    I have read all the bear­ish arti­cles on Seek­ing Alpha because I like to chal­lenge my invest­ment the­sis. There is always a pos­si­bil­i­ty that I am incor­rect so read­ing oppos­ing views is crit­i­cal to indi­cate if I am miss­ing vital infor­ma­tion that could impact my bull­ish sen­ti­ment. After doing the home­work, I am more bull­ish than ever on PLTR and will con­tin­ue to add shares at more than dou­ble the price I ini­tial­ly paid when the Direct List­ing occurred. In my opin­ion, the bears are lack­ing vision and aren’t con­nect­ing the dots. Huge news just broke about the Pen­ta­gon can­cel­ing the JEDI Con­tract, leav­ing the door wide open for PLTR. Entire indus­tries are being con­nect­ed and mod­ern­ized through PLTR’s soft­ware, and some­times tak­ing a step back to con­nect the dots can reveal a rev­o­lu­tion­ary pic­ture. PLTR is a vision­ary com­pa­ny mak­ing the soft­ware of tomor­row. I believe we’re in the ear­ly innings, and through­out the 2020s, PLTR will evolve into one of the most impor­tant soft­ware com­pa­nies.

    The JEDI Con­tract can­cel­la­tion is leav­ing the door wide open for Palan­tir as its new ini­tia­tives fall right in Palan­tir’s wheel­house

    The Joint Enter­prise Defense Infra­struc­ture (JEDI) con­tract was a $10 bil­lion cloud com­put­ing con­tract through the Unit­ed States Depart­ment of Defense (DoD). On 9/4/2020, the DOD reaf­firmed the JEDI Con­tract award to Microsoft (NASDAQ:MSFT) after being sued by Ama­zon (NASDAQ:AMZN). The JEDI Cloud con­tract is a firm-fixed-price, indef­i­nite-deliv­ery/in­def­i­nite-quan­ti­ty con­tract that would have made a full range of cloud com­put­ing ser­vices avail­able to the DoD. JEDI was intend­ed to mod­ern­ize the Pen­tagon’s IT oper­a­tions through an attempt to bring thou­sands of DoD sys­tems under one umbrel­la. The over­all goal of this mas­sive under­tak­ing was to pro­vide real-time data ana­lyt­ics across the board to giv­ing the Pen­ta­gon every advan­tage through mod­ern tech­nol­o­gy.

    The Pen­ta­gon recent­ly can­celed the JEDI con­tract award to MSFT and will be launch­ing a mul­ti­ven­dor cloud com­put­ing con­tract. On 7/6/21, the DoD released a state­ment con­firm­ing the can­ce­la­tion of JEDI, which includ­ed this quote from John Sher­man, act­ing DoD Chief Infor­ma­tion Offi­cer:

    “JEDI was devel­oped at a time when the Depart­men­t’s needs were dif­fer­ent and both the CSPs tech­nol­o­gy and our cloud con­ver­san­cy was less mature. In light of new ini­tia­tives like JADC2 and AI and Data Accel­er­a­tion (ADA), the evo­lu­tion of the cloud ecosys­tem with­in DoD, and changes in user require­ments to lever­age mul­ti­ple cloud envi­ron­ments to exe­cute mis­sion, our land­scape has advanced and a new way-ahead is war­rant­ed to achieve dom­i­nance in both tra­di­tion­al and non-tra­di­tion­al warfight­ing domains.”

    While the DoD was can­cel­ing the JEDI Con­tract, IBM (NYSE:IBM) had a Palan­tir for Cloud Pak Event with an exclu­sive demo. This round­table event includ­ed key employ­ees from IBM and PLTR and dis­cussed trans­form­ing busi­ness with AI. The pre­sen­ta­tion includ­ed a sup­ply chain demo, use case dis­cus­sions, and a Q&A ses­sion with rep­re­sen­ta­tives from both IBM and PLTR.

    After research­ing every­thing that has occurred and learn­ing that the DoD will launch a mul­ti­ven­dor cloud com­put­ing con­tract, I can’t help but envi­sion PLTR pick­ing up addi­tion­al con­tracts. The DoD was explic­it­ly clear that their new ini­tia­tives includ­ed JADC2 (Joint All-Domain Com­mand and Con­trol) and AI and Data Accel­er­a­tion (ADA). In an offi­cial doc­u­ment from the Con­gres­sion­al Research Ser­vice, it states:

    “Joint All-Domain Com­mand and Con­trol (JADC2) is the Depart­ment of Defense’s (DOD’s) con­cept to con­nect sen­sors from all of the mil­i­tary ser­vices-Air Force, Army, Marine Corps, Navy, and Space Force-into a sin­gle net­work.”

    With the JEDI con­tract being dis­man­tled and the DoD tak­ing a mul­ti-ven­dor approach to accom­plish its pre­vi­ous goals and tack­le its new ini­tia­tives, it looks like sev­er­al roads will lead to PLTR. We know for cer­tain that JADC2 and ADA are top pri­or­i­ties and the main rea­sons why the JEDI Con­tract was can­celed. PLTR is already the main provider of soft­ware to the DoD. It has direct rela­tion­ships and con­tracts with the Unit­ed States Air Force, Depart­ment of Defense, Unit­ed States Army, Unit­ed States Navy, Unit­ed States Spe­cial Oper­a­tions Forces, and the Unit­ed States Coast Guard. Over the years, PLTR has become one of the lead­ing, if not the lead­ing, soft­ware ven­dor to the Pen­ta­gon and its indi­vid­ual branch­es. The descrip­tion of JADC2 and ADA sound like the DoD went to PLTR’s Q1 2021 pre­sen­ta­tion and used slide 19 for their descrip­tions:

    “In Q1 2021, Palan­tir’s soft­ware was lever­aged in the Glob­al Infor­ma-on Dom­i­nance Exper­i­ment, enabling all 11 DoD Com­bat­ant Com­mands to gen­er­ate glob­al­ly inte­grat­ed, strate­gic deci­sion advan­tage from intel­li­gence, oper­a­tions, logis­tics, and sup­ply data advanced by AI / ML.”

    In addi­tion to direct con­tracts through­out the DoD, PLTR also signed a major con­tract with the Depart­ment of Ener­gy on 3/31/21 with an ini­tial con­tract oblig­a­tion of $7 mil­lion. The Nation­al Nuclear Secu­ri­ty Admin­is­tra­tion (NNSA), which is a depart­ment with­in the Depart­ment of Ener­gy, select­ed PLTR to pro­vide their Office of Safe­ty, Infra­struc­ture, and Oper­a­tions with a soft­ware plat­form for NNSA’s Safe­ty Ana­lyt­ics, Fore­cast­ing, and Eval­u­a­tion Report­ing project named SAFER. The SAFER pro­gram will advance NNSA’s mis­sion of man­ag­ing nuclear secu­ri­ty.

    PLTR was select­ed to safe­guard the Unit­ed States nuclear stock­pile and has been select­ed to devel­op and inte­grate soft­ware through­out the Unit­ed States mil­i­tary branch­es. The can­ce­la­tion of the JEDI con­tract seems like a sig­nif­i­cant oppor­tu­ni­ty for PLTR, in my opin­ion. PLTR has been putting all of the pieces togeth­er to con­nect every aspect of our gov­ern­ment defense capa­bil­i­ties. The new ini­tia­tives from the Pen­ta­gon seem like an open invi­ta­tion for PLTR. I do not know what the gov­ern­ment will do, but when you look at what has recent­ly occurred and PLTR’s pre­vi­ous con­tracts with the gov­ern­ment, it’s not far-fetched that these new ini­tia­tives play right into PLTR’s wheel­house. The JEDI con­tract was worth $10 bil­lion, and with it being scrapped and becom­ing a mul­ti­ven­dor oppor­tu­ni­ty, I believe PLTR will get a por­tion of that pie.

    ...

    ———-

    “JEDI Can­ce­la­tion By The Pen­ta­gon Could Become Palan­tir’s Biggest Gain” by Steven Fio­r­il­lo; Seek­ing Alpha; 07/13/2021

    “PLTR was select­ed to safe­guard the Unit­ed States nuclear stock­pile and has been select­ed to devel­op and inte­grate soft­ware through­out the Unit­ed States mil­i­tary branch­es. The can­ce­la­tion of the JEDI con­tract seems like a sig­nif­i­cant oppor­tu­ni­ty for PLTR, in my opin­ion. PLTR has been putting all of the pieces togeth­er to con­nect every aspect of our gov­ern­ment defense capa­bil­i­ties. The new ini­tia­tives from the Pen­ta­gon seem like an open invi­ta­tion for PLTR. I do not know what the gov­ern­ment will do, but when you look at what has recent­ly occurred and PLTR’s pre­vi­ous con­tracts with the gov­ern­ment, it’s not far-fetched that these new ini­tia­tives play right into PLTR’s wheel­house. The JEDI con­tract was worth $10 bil­lion, and with it being scrapped and becom­ing a mul­ti­ven­dor oppor­tu­ni­ty, I believe PLTR will get a por­tion of that pie.”

    Again, it was nev­er a good idea to allow a fas­cist-found­ed com­pa­ny like Palan­tir to devel­op such a cen­tral role in the US nation­al secu­ri­ty state’s dig­i­tal infra­struc­ture. But that hap­pened. Palan­tir was even just select­ed to play a nuclear stock­pile secu­ri­ty role. Those awful deci­sions were made and now it’s hard to argue with the core argu­ment behind this Palan­tir stock fan piece. The can­cel­la­tion of Microsoft­’s JEDI con­tract real­ly was fab­u­lous news for Palan­tir’s bot­tom line.

    And that’s also why the angry pub­lic res­ig­na­tion of Nico­las Chail­lan was also such good news for Palan­tir. If the DoD is los­ing inter­est in back­ing Chail­lan’s JADC2 pilot project, that’s just more room for a com­pa­ny like Palan­tir to swoop in and pro­vide those ser­vices under the new post-JEDI vision for the US mil­i­tary’s cloud. A vision that has yet to be final­ized:

    ...
    After research­ing every­thing that has occurred and learn­ing that the DoD will launch a mul­ti­ven­dor cloud com­put­ing con­tract, I can’t help but envi­sion PLTR pick­ing up addi­tion­al con­tracts. The DoD was explic­it­ly clear that their new ini­tia­tives includ­ed JADC2 (Joint All-Domain Com­mand and Con­trol) and AI and Data Accel­er­a­tion (ADA). In an offi­cial doc­u­ment from the Con­gres­sion­al Research Ser­vice, it states:

    “Joint All-Domain Com­mand and Con­trol (JADC2) is the Depart­ment of Defense’s (DOD’s) con­cept to con­nect sen­sors from all of the mil­i­tary ser­vices-Air Force, Army, Marine Corps, Navy, and Space Force-into a sin­gle net­work.”

    With the JEDI con­tract being dis­man­tled and the DoD tak­ing a mul­ti-ven­dor approach to accom­plish its pre­vi­ous goals and tack­le its new ini­tia­tives, it looks like sev­er­al roads will lead to PLTR. We know for cer­tain that JADC2 and ADA are top pri­or­i­ties and the main rea­sons why the JEDI Con­tract was can­celed. PLTR is already the main provider of soft­ware to the DoD. It has direct rela­tion­ships and con­tracts with the Unit­ed States Air Force, Depart­ment of Defense, Unit­ed States Army, Unit­ed States Navy, Unit­ed States Spe­cial Oper­a­tions Forces, and the Unit­ed States Coast Guard. Over the years, PLTR has become one of the lead­ing, if not the lead­ing, soft­ware ven­dor to the Pen­ta­gon and its indi­vid­ual branch­es. The descrip­tion of JADC2 and ADA sound like the DoD went to PLTR’s Q1 2021 pre­sen­ta­tion and used slide 19 for their descrip­tions:

    “In Q1 2021, Palan­tir’s soft­ware was lever­aged in the Glob­al Infor­ma-on Dom­i­nance Exper­i­ment, enabling all 11 DoD Com­bat­ant Com­mands to gen­er­ate glob­al­ly inte­grat­ed, strate­gic deci­sion advan­tage from intel­li­gence, oper­a­tions, logis­tics, and sup­ply data advanced by AI / ML.”

    In addi­tion to direct con­tracts through­out the DoD, PLTR also signed a major con­tract with the Depart­ment of Ener­gy on 3/31/21 with an ini­tial con­tract oblig­a­tion of $7 mil­lion. The Nation­al Nuclear Secu­ri­ty Admin­is­tra­tion (NNSA), which is a depart­ment with­in the Depart­ment of Ener­gy, select­ed PLTR to pro­vide their Office of Safe­ty, Infra­struc­ture, and Oper­a­tions with a soft­ware plat­form for NNSA’s Safe­ty Ana­lyt­ics, Fore­cast­ing, and Eval­u­a­tion Report­ing project named SAFER. The SAFER pro­gram will advance NNSA’s mis­sion of man­ag­ing nuclear secu­ri­ty.
    ...

    That’s all part of the con­text of Nico­las Chail­lan’s pub­lic res­ig­na­tion involv­ing the cut­ting of the JADC2 pilot project. It came two months after the can­cel­la­tion of the Microsoft JEDI con­tract that opened up a new world of pri­vate con­trac­tor pos­si­bil­i­ties. And it sounds like those pri­vate con­trac­tor pos­si­bil­i­ties in this post-JEDI mil­i­tary cloud vision of the future include pro­vid­ing exact­ly the kind of JADC2 Chail­lan was work­ing on. And ser­vices Palan­tir appears well posi­tions to fill, putting the com­pa­ny at the cen­ter of the US mil­i­tary’s dig­i­tal net­works.

    So should we expect the immi­nent announce­ment of Palan­tir step­ping in to pro­vide the JADC2 inter­op­er­abil­i­ty ser­vice in the US mil­i­tary’s DoD-wide cloud of tomor­row? Putting Palan­tir at the very core of the US mil­i­tary’s abil­i­ty to com­mu­ni­cate with itself? It would obvi­ous­ly be a giant leap of faith by the US mil­i­tary about the com­pa­ny’s integri­ty, a leap the US nation­al secu­ri­ty state took a long time ago. This is prob­a­bly a good time to recall that Avril Haines, the cur­rent head of the ODNI, was a Palan­tir employ­ee before join­ing the Biden cam­paign in 2020. The com­pa­ny has all the con­nec­tions it needs to become the dig­i­tal fab­ric that holds the US mil­i­tary togeth­er. Includ­ing the nuclear stock­piles. It’s part of why the Palan­tir stock boost­ers aren’t just puff­ing smoke. It real­ly is a com­pa­ny with spec­tac­u­lar­ly ter­ri­fy­ing pos­si­bil­i­ties and those ter­ri­fy­ing pos­si­bil­i­ties keep becom­ing more and more real every day.

    Posted by Pterrafractyl | September 7, 2021, 12:11 am

  6. Remem­ber Ptech, the threat assess­ment soft­ware firm that became embroiled in post‑9/11 anti-ter­ror inves­ti­ga­tions involv­ing the Mus­lim Broth­er­hood’s net­work of front orga­ni­za­tions? And remem­ber how Ptech had a stun­ning list of gov­ern­ment agen­cies for clients, includ­ing the US Air Force, mak­ing this a sto­ry about a pos­si­ble Mus­lim Broth­er­hood-con­nect­ed firm con­duct­ing threat assess­ments for the US gov­ern­ment? It’s a com­pa­ny worth recall when­ev­er we hear about mas­sive sys­temic mega-hacks involv­ing sophis­ti­cat­ed spy­ware that can tra­verse an orga­ni­za­tion’s IT net­works. Ptech’s ser­vices would prob­a­bly be in extreme­ly high demand these days.

    And since the 20 year anniver­sary of 9/11 is upon us, here’s a look back a Jan­u­ary 2003 arti­cle in Com­put­er­world about the Ptech inves­ti­ga­tion for the pur­pose of ask­ing an intrigu­ing ques­tion that real­ly has­n’t been asked: Was Palan­tir start­ed as a kind of replace­ment for Ptech?

    It’s hard to ignore the par­al­lels. High­ly sen­si­tive US nation­al-secu­ri­ty-relat­ed con­tracts were at the core of the busi­ness mod­el for both Ptech and Palan­tir. Both com­pa­nies make threat assess­ment-relat­ed soft­ware, although it sounds like Ptech’s threat assess­ment capa­bil­i­ties were more focused on IT net­work archi­tec­ture, which is far less gener­ic than Palan­tir’s machine-learn­ing-based threat assess­ment capa­bil­i­ties. But who knows what Ptech would be offer­ing today if it had main­tained its posi­tion as the US nation­al secu­ri­ty dig­i­tal threat assess­ment con­trac­tor or choice. And it turns out Palan­tir was start­ed in 2003, mean­ing it got start­ed after Ptech sud­den­ly became a prob­lem­at­ic post‑9/11 nation­al secu­ri­ty con­trac­tor. So it’s worth ask­ing: was Palan­tir formed as a replace­ment for Ptech? Because as the fol­low­ing 2003 arti­cle about Ptech’s inves­tiga­tive trou­bles make clear, the com­pa­ny real­ly was a high­ly respect­ed firm with a large num­ber of impor­tant clients beyond the US gov­ern­ment agen­cies. IBM even put Ptech’s flag­ship enter­prise mod­el­ing prod­uct, Frame­Work, at the cen­ter of IBM’s Enter­prise Archi­tec­ture Method­ol­o­gy. And this was still the case after all of the ter­ror-relat­ed bad press for the com­pa­ny. In oth­er words, Ptech was pro­vid­ing a prod­uct with a heavy demand. Then, all of sud­den, Ptech becomes the kind of com­pa­ny oth­er com­pa­nies don’t want to do busi­ness with, hence the even­tu­al name change to GoAg­ile. And that’s all why we have to ask: was Palan­tir start­ed with the intent of replac­ing Ptech?

    Com­put­er­world

    Ter­ror­ist probe hob­bles Ptech

    By Dan Ver­ton
    Jan 17, 2003 12:00 am PST

    The White House has giv­en Ptech Inc.‘s soft­ware a clean bill of health, and most of its cus­tomers and strate­gic busi­ness part­ners remain com­mit­ted to its tech­nol­o­gy. But the com­pa­ny, inves­ti­gat­ed for hav­ing an al-Qae­da con­nec­tion, has still become a casu­al­ty of the war on ter­ror­ism.

    In an exclu­sive series of inter­views with Com­put­er­world, Ptech CEO Ous­sama Ziade and sev­er­al for­mer employ­ees said the gov­ern­men­t’s inves­ti­ga­tion of a for­mer investor who is alleged to have ties to ter­ror­ism has dealt a near­ly fatal blow to the Quin­cy, Mass., soft­ware com­pa­ny ((see sto­ry)). And they fear that the same thing could hap­pen to oth­er com­pa­nies.

    Ptech’s cri­sis stems from a Dec. 5 con­sen­su­al search by fed­er­al agents, which was broad­ly char­ac­ter­ized by the media as an ear­ly-morn­ing “raid” ((see sto­ry)). The search was part of an inves­ti­ga­tion of the com­pa­ny’s rela­tion­ship with Yassin al-Qadi, a wealthy Sau­di busi­ness­man and one of two “angel” investors who helped get Ptech on its feet in 1994. Al-Qadi, who was nev­er a share­hold­er of record in Ptech and who lat­er twice turned down Ptech requests for addi­tion­al fund­ing, is believed by the U.S. intel­li­gence com­mu­ni­ty to have finan­cial ties to inter­na­tion­al ter­ror­ism.

    Since that search, Ptech, once a 65-employ­ee com­pa­ny that rarely lost a com­pet­i­tive con­tract bid, has been reduced to 10 peo­ple and has almost no new busi­ness on the hori­zon.

    “Almost imme­di­ate­ly we lost our rev­enue for Decem­ber and Jan­u­ary,” said Ziade. “Cus­tomers who know us and know our prod­uct have not walked away. They know there is noth­ing here relat­ed to ter­ror­ism.”

    But soon after the inves­ti­ga­tion broke, Ziade said, some large cus­tomers turned their backs on Ptech, refus­ing to com­ment pub­licly on their trust and con­fi­dence in the com­pa­ny and its enter­prise soft­ware, which enables its cus­tomers in the For­tune 1,000 and gov­ern­ment ranks to visu­al­ize and ana­lyze their tech­nol­o­gy infra­struc­ture and build mod­els to con­duct strate­gic busi­ness plan­ning. That sit­u­a­tion was con­firmed by Com­put­er­world in inter­views with those com­pa­nies.

    “When you sell to the For­tune 1,000, you are in the busi­ness of trust,” said Ziade. “But there were direc­tives com­ing out of the legal depart­ments in those com­pa­nies that said Ptech is a risk com­pa­ny.”

    For exam­ple, a sys­tems archi­tect at a major forestry prod­ucts firm that relies on Ptech soft­ware to con­duct strate­gic data min­ing and busi­ness plan­ning con­firmed the exis­tence of a cor­po­rate gag order. Yet noth­ing has changed in the com­pa­ny’s rela­tion­ship with Ptech, said the source, who request­ed anonymi­ty. “The com­pa­ny is fine, and the soft­ware is won­der­ful,” the source said. “There was nev­er any con­cern about the integri­ty of the soft­ware.”

    The same holds true for IBM Glob­al Ser­vices, which counts Ptech among its strate­gic busi­ness part­ners. Although Ziade said IBM ini­tial­ly tried to dis­tance itself from what looked like a major scan­dal in the mak­ing, Jeff Gluck, a spokesman for IBM, said the rela­tion­ship between the two com­pa­nies is “unchanged.”

    IBM placed Ptech’s flag­ship enter­prise mod­el­ing prod­uct, called Frame­Work, at the cen­ter of its Enter­prise Archi­tec­ture Method­ol­o­gy. In a white paper obtained by Com­put­er­world, IBM called the Ptech prod­uct “a pow­er­ful tool to rapid­ly col­lect, ana­lyze, orga­nize and present” infor­ma­tion. “Client accep­tance of the dynam­ic live deliv­er­able has been out­stand­ing,” the white paper con­clud­ed.

    “The fact that they’re a part­ner of ours speaks for itself as far as the qual­i­ty of the tech­nol­o­gy is con­cerned,” said Gluck.

    The CIO at a large ener­gy com­pa­ny, who also request­ed that he and his com­pa­ny not be named, said there was strong con­cern among senior man­age­ment when the sto­ry first broke. His IT team was charged with doc­u­ment­ing the com­pa­ny’s rela­tion­ship with Ptech, includ­ing when and where Ptech employ­ees may have been on-site.

    “I polled sev­er­al [user] con­tacts, includ­ing gov­ern­ment users, to assess their reac­tions and plans [and] also obtained the gov­ern­ment posi­tion on the soft­ware,” the CIO added. “This infor­ma­tion led us to decide to con­tin­ue lever­ag­ing our invest­ment in the Ptech prod­uct.”

    The CIO added that Ptech’s ser­vice and sup­port have remained “time­ly and thor­ough.”

    Yet none of that seems to mat­ter now, cur­rent and for­mer Ptech employ­ees said. They and secu­ri­ty experts warn that what hap­pened to Ptech can hap­pen to any com­pa­ny with an employ­ee or investor whose name shows up on a ter­ror­ist watch list.

    “Any com­pa­ny doing busi­ness in the clas­si­fied are­na must take steps to ensure its employ­ees are ful­ly vet­ted and mon­i­tored over time,” said Lar­ry John­son, a secu­ri­ty con­sul­tant and for­mer CIA offi­cer.

    For Ziade and com­pa­ny, the future is any­thing but cer­tain. Ptech’s tech­nol­o­gy is mature enough to remain unchanged for about a year, he said. The com­pa­ny has an unre­leased prod­uct that will also help buy Ziade, now one of Ptech’s prin­ci­pal coders as well as the CEO, addi­tion­al time.

    Hay­den Shulz, a for­mer prin­ci­pal engi­neer at Ptech, said the com­pa­ny will like­ly face unprece­dent­ed pres­sure to keep the soft­ware updat­ed in a rea­son­able time frame. “If the remain­ing 10 peo­ple sat down and cod­ed for a year, they could do it,” said Shulz. “But there’s going to be a con­stant give and pull between who’s going to go out to cus­tomers and who’s going to write code.”

    Ziade said he’s still assess­ing whether it makes sense to con­tin­ue releas­ing prod­ucts under the Ptech name. “We would love to keep it Ptech, but we don’t know what it will be a year from now,” he said.

    ...

    ———–

    “Ter­ror­ist probe hob­bles Ptech” by Dan Ver­ton; Com­put­er­world; 01/17/2003

    “Ptech’s cri­sis stems from a Dec. 5 con­sen­su­al search by fed­er­al agents, which was broad­ly char­ac­ter­ized by the media as an ear­ly-morn­ing “raid” ((see sto­ry)). The search was part of an inves­ti­ga­tion of the com­pa­ny’s rela­tion­ship with Yassin al-Qadi, a wealthy Sau­di busi­ness­man and one of two “angel” investors who helped get Ptech on its feet in 1994. Al-Qadi, who was nev­er a share­hold­er of record in Ptech and who lat­er twice turned down Ptech requests for addi­tion­al fund­ing, is believed by the U.S. intel­li­gence com­mu­ni­ty to have finan­cial ties to inter­na­tion­al ter­ror­ism.”

    There’s bad PR and then there’s major ter­ror­ism-relat­ed bad PR. And in Jan­u­ary of 2003, Ptech was suf­fer­ing from a major case of the lat­ter. The kind of ter­ror­ism-relat­ed bad PR that had its many gov­ern­ment and For­tune 1000 clients tak­ing a sec­ond look at whether or not that want­ed to do busi­ness with the com­pa­ny. This was a com­pa­ny that rarely lost a com­pet­i­tive bid. And yet, even in the fact of this awful PR, we had com­pa­nies like IBM more or less stick­ing with Ptech. Their net­work threat assess­ment soft­ware was just too impor­tant to give up, even in the face of an inves­ti­ga­tion into a pos­si­ble con­nec­tion to 9/11. Ptech was clear­ly devel­op­ing some­thing extreme­ly impor­tant to a lot of peo­ple:

    ...
    Since that search, Ptech, once a 65-employ­ee com­pa­ny that rarely lost a com­pet­i­tive con­tract bid, has been reduced to 10 peo­ple and has almost no new busi­ness on the hori­zon.

    “Almost imme­di­ate­ly we lost our rev­enue for Decem­ber and Jan­u­ary,” said Ziade. “Cus­tomers who know us and know our prod­uct have not walked away. They know there is noth­ing here relat­ed to ter­ror­ism.”

    But soon after the inves­ti­ga­tion broke, Ziade said, some large cus­tomers turned their backs on Ptech, refus­ing to com­ment pub­licly on their trust and con­fi­dence in the com­pa­ny and its enter­prise soft­ware, which enables its cus­tomers in the For­tune 1,000 and gov­ern­ment ranks to visu­al­ize and ana­lyze their tech­nol­o­gy infra­struc­ture and build mod­els to con­duct strate­gic busi­ness plan­ning. That sit­u­a­tion was con­firmed by Com­put­er­world in inter­views with those com­pa­nies.

    “When you sell to the For­tune 1,000, you are in the busi­ness of trust,” said Ziade. “But there were direc­tives com­ing out of the legal depart­ments in those com­pa­nies that said Ptech is a risk com­pa­ny.”

    For exam­ple, a sys­tems archi­tect at a major forestry prod­ucts firm that relies on Ptech soft­ware to con­duct strate­gic data min­ing and busi­ness plan­ning con­firmed the exis­tence of a cor­po­rate gag order. Yet noth­ing has changed in the com­pa­ny’s rela­tion­ship with Ptech, said the source, who request­ed anonymi­ty. “The com­pa­ny is fine, and the soft­ware is won­der­ful,” the source said. “There was nev­er any con­cern about the integri­ty of the soft­ware.”

    The same holds true for IBM Glob­al Ser­vices, which counts Ptech among its strate­gic busi­ness part­ners. Although Ziade said IBM ini­tial­ly tried to dis­tance itself from what looked like a major scan­dal in the mak­ing, Jeff Gluck, a spokesman for IBM, said the rela­tion­ship between the two com­pa­nies is “unchanged.”

    IBM placed Ptech’s flag­ship enter­prise mod­el­ing prod­uct, called Frame­Work, at the cen­ter of its Enter­prise Archi­tec­ture Method­ol­o­gy. In a white paper obtained by Com­put­er­world, IBM called the Ptech prod­uct “a pow­er­ful tool to rapid­ly col­lect, ana­lyze, orga­nize and present” infor­ma­tion. “Client accep­tance of the dynam­ic live deliv­er­able has been out­stand­ing,” the white paper con­clud­ed.

    “The fact that they’re a part­ner of ours speaks for itself as far as the qual­i­ty of the tech­nol­o­gy is con­cerned,” said Gluck.
    ...

    Lat­er that year, Palan­tir was start­ed by Peter Thiel with the help of the CIA’s In-Q-Tel seed mon­ey. And yes, Palan­tir prod­ucts don’t do exact­ly the same thing Ptech did. But we would­n’t nec­es­sar­i­ly expect that to be the case. The big ques­tion is whether or not Palan­tir was found­ed with the intent of fill­ing the gap cre­at­ed by Ptech’s post‑9/11 pari­ah sta­tus. Not that it would change much of any­thing if this was the case. It’s more just an inter­est­ing his­tor­i­cal ques­tion at this point. So in the spir­it of ‘bet­ter late than nev­er’ it’s worth ask­ing: To what extent does Palan­tir owe its cur­rent sta­tus as the US nation­al secu­ri­ty state’s go-to big data threat assess­ment ser­vice provider to Ptech post‑9/11 demise? And, depend­ing on the answer, maybe some fol­low up ques­tions. Pos­si­bly a lot of fol­low up ques­tions.

    Posted by Pterrafractyl | September 11, 2021, 8:46 pm

  7. Here’s an NSO Group-relat­ed sto­ry where the big sto­ry is real­ly all the ques­tions it rais­es about what else is going on:

    It turns out the NSO Group’s cus­tomer list includes Ger­many’s fed­er­al police, the Bun­deskrim­i­nalamt (BKA). An inabil­i­ty to devel­op their own com­pa­ra­ble hack­ing tools is report­ed­ly part of the rea­son­ing behind the pur­chase, which, if true, is an exam­ple of how cut­ting edge these toolk­its real­ly are.

    Here’s the part that rais­es all sort of ques­tion about what else the Ger­man nation­al secu­ri­ty com­plex has been up to: The 2019 pur­chase of NSO Group’s Pega­sus soft­ware was made despite ini­tial con­cerns inside the BKA that use of the tools would vio­late the Ger­man con­sti­tu­tion, which blocks wire­tap­ping in all but the most extreme cas­es.

    How seri­ous were these con­cerns? It’s unclear from the report, but the fact that talks with NSO Group start­ed in 2017 and the con­tract was inked in 2019 sug­gests those inter­nal delib­er­a­tions took a while. But in the end those con­cerns were some­how alle­vi­at­ed. Was this due to exten­sive safe­guards being put in place to ensure the spy­ware was only used when absolute­ly nec­es­sary and pro­tect­ed by the Ger­man con­sti­tu­tion? We have no idea.

    It also sounds like the BKA’s con­tract with NSO Group is still in effect. The BKA first got access to Pega­sus in late 2020 and report­ed­ly used the tool in selec­tion oper­a­tions con­cern­ing ter­ror­ism and orga­nized crime since March of this year.

    There’s anoth­er angle to this sto­ry that’s worth keep­ing in mind: As we’ll see in the sec­ond arti­cle except below, it was only in 2020 when Ger­man courts rules that Ger­many’s con­sti­tu­tion­al rights to pri­va­cy extend­ed to the cit­i­zens of oth­er coun­tries liv­ing abroad. The rul­ing was in response to a 2016 Ger­man law that grant­ed Ger­many’s BND the right to spy non non-Ger­mans abroad.

    So in 2016, Ger­many pass­es a law giv­ing the BND per­mis­sion to spy abroad. And in 2017, nego­ti­a­tions between the NSO Group and the BKA are start­ed com­plet­ed by 2019. Then in May 2020, Ger­many’s courts rules the 2016 law was uncon­sti­tu­tion­al but the con­tract with NSO Group remained in place and the BKA first received the soft­ware lat­er that year. We’re told the tools have been put to use since March of this year. So we have to ask, giv­en how use­ful Pega­sus would be to the BND, espe­cial­ly dur­ing the 2016–2020 win­dow when the BND was giv­en the pow­ers to spy on the world, was the BND going to end up being one of the end users of Pega­sus too? Per­haps infor­mal­ly? Yes, NSO Group report­ed­ly places geo­re­stric­tions on where its spy­ware can be used so that would the­o­ret­i­cal­ly pre­vent the BND from going wild glob­al­ly with it, but who knows what kind of rela­tion­ship Ger­many would be able to work out with NSO Group giv­en the impor­tance of the Ger­man-Israeli diplo­mat­ic rela­tion­ship. Those nego­ti­a­tions with the BKA took quite a while to work out. That’s all part of what makes the sto­ry of the BKA get­ting its hands on Pega­sus real­ly part of a much larg­er sto­ry of Ger­many’s sig­nif­i­cant invest­ment in dig­i­tal spy­ing capa­bil­i­ties:

    Haaretz

    Germany’s ‘FBI’ Bought Israeli NSO’s Spy­ware Despite Knowl­edge of Rights Abus­es, Report Says
    Sources tell Die Zeit that after Ger­many’s Fed­er­al Crim­i­nal Police Office failed to devel­op their own spy­ware pro­gram, they turned to Israeli cyber-espi­onage firm

    Omer Ben­jakob
    Sep. 7, 2021

    Germany’s fed­er­al inves­tiga­tive police force held talks with Israeli cyber-espi­onage firm NSO Group and even pur­chased its infa­mous Pega­sus spy­ware, the Ger­man news­pa­per Die Zeit revealed Mon­day, cit­ing sources with­in the local defense estab­lish­ment.

    Accord­ing to the report by Hol­ger Stark, the Fed­er­al Crim­i­nal Police Office — known in Ger­many as the Bun­deskrim­i­nalamt, or BKA — first held talks with NSO in 2017. At the time, the report said, a del­e­ga­tion from NSO even trav­eled to Wies­baden, where the BKA is head­quar­tered, to show­case the capa­bil­i­ties of the Pega­sus spy­ware.

    Despite ini­tial legal con­cerns from with­in the BKA about the spy­ware, which allows its oper­a­tors to take full con­trol of any smart­phones infect­ed with Pega­sus, a deal was inked with NSO in 2019.

    The report also notes that the deci­sion to pur­chase the Israeli-made spy­ware was made after the BKA failed to devel­op its own spy­ware. If suc­cess­ful­ly installed, Pega­sus allows its oper­a­tors full access to the data of the infect­ed phone, and they can even remote­ly oper­ate its micro­phone and cam­era — unbe­knownst to the phone own­er.

    BREAKING: Ger­many’s Fed­er­al Police #BKA secret­ly bought noto­ri­ous #Pega­sus mer­ce­nary spy­ware.

    They’d have been aware of the grow­ing list of abus­es. Clear­ly they chose to ignore them.

    Embar­rass­ing retreat from cyber­space lead­er­ship by Ger­many.

    LINK (DE)https://t.co/jyaao0Ky4o

    — John Scott-Rail­ton (@jsrailton) Sep­tem­ber 7, 2021

    The BKA is under the over­sight of Ger­many’s Inte­ri­or Min­istry and legal offi­cials were con­cerned the spy­ware could not meet legal require­ments in Ger­many, which per­mits such snoop­ing only in very spe­cif­ic and extreme cas­es.

    Accord­ing to an expert who spoke to Die Zeit, none of the crim­i­nal cas­es pur­sued by the BKA dur­ing this time peri­od attempt­ed to make use of evi­dence col­lect­ed through Pega­sus. How­ev­er, accord­ing to sources that spoke with the Ger­man paper, offi­cials were adamant that any use of the spy­ware should be done only in cas­es it is autho­rized by Ger­man law. It is unclear, how­ev­er, what over­sight was done on the actu­al usage and in what con­text the pro­gram was used, if at all.

    ...

    The news comes two months after Project Pega­sus — a glob­al inves­ti­ga­tion led by For­bid­den Sto­ries and Amnesty Inter­na­tion­al into a leaked data­base of poten­tial tar­gets select­ed by NSO’s clients. The inves­ti­ga­tion was con­duct­ed togeth­er with a con­sor­tium of news out­lets across the globe, includ­ing Die Zeit and Haaretz, and has helped spark a debate about spy­ware and its mis­use by gov­ern­ments.

    At the time, the inves­ti­ga­tion revealed a long list of jour­nal­ists and human rights activists, as well as world lead­ers, select­ed for pos­si­ble snoop­ing by clients of NSO across the world. NSO denied the reports and labeled them an orches­trat­ed attempt to smear the com­pa­ny; it fur­ther said the list at the core of the inves­ti­ga­tion was arbi­trary and had no con­nec­tion to them or their clients. Since the inves­ti­ga­tion was pub­lished, dig­i­tal foren­sics in France and in the U.K. have con­firmed that a small hand­ful of those phone num­bers select­ed as poten­tial tar­gets actu­al­ly had their phones infect­ed.

    At the time of the Project Pega­sus pub­li­ca­tions, after it was revealed that a phone num­ber asso­ci­at­ed with French Pres­i­dent Macron was also select­ed for poten­tial tar­get­ing (most like­ly by the Moroc­can intel­li­gence ser­vice), oth­er Euro­pean lead­ers voiced their con­cern at NSO and its cyber wares. It is impor­tant that hack­ing soft­ware does not get into the wrong hands, Ger­man Chan­cel­lor Angela Merkel was quot­ed by Reuters as say­ing when asked about the Pega­sus spy­ware case at that time. She also told reporters that coun­tries with­out any judi­cial over­sight of how spy­ing soft­ware is used should not have access to it.

    ———–

    “Germany’s ‘FBI’ Bought Israeli NSO’s Spy­ware Despite Knowl­edge of Rights Abus­es, Report Says” by Omer Ben­jakob; Haaretz; 09/07/2021

    “Despite ini­tial legal con­cerns from with­in the BKA about the spy­ware, which allows its oper­a­tors to take full con­trol of any smart­phones infect­ed with Pega­sus, a deal was inked with NSO in 2019.”

    There were con­cerns, but those con­cerns were some­how addressed. We don’t know how, but the fact that deal was reached in 2019 tells how they were addressed one way or anoth­er. The unset­tling part is that we know so lit­tle about the actu­al terms of the con­tact and how the Pega­sus soft­ware was ulti­mate­ly used that it’s entire­ly plau­si­ble these con­cerns were addressed by sim­ply drop­ping them:

    ...
    Accord­ing to the report by Hol­ger Stark, the Fed­er­al Crim­i­nal Police Office — known in Ger­many as the Bun­deskrim­i­nalamt, or BKA — first held talks with NSO in 2017. At the time, the report said, a del­e­ga­tion from NSO even trav­eled to Wies­baden, where the BKA is head­quar­tered, to show­case the capa­bil­i­ties of the Pega­sus spy­ware.

    ...

    The report also notes that the deci­sion to pur­chase the Israeli-made spy­ware was made after the BKA failed to devel­op its own spy­ware. If suc­cess­ful­ly installed, Pega­sus allows its oper­a­tors full access to the data of the infect­ed phone, and they can even remote­ly oper­ate its micro­phone and cam­era — unbe­knownst to the phone own­er.

    ...

    The BKA is under the over­sight of Ger­many’s Inte­ri­or Min­istry and legal offi­cials were con­cerned the spy­ware could not meet legal require­ments in Ger­many, which per­mits such snoop­ing only in very spe­cif­ic and extreme cas­es.

    Accord­ing to an expert who spoke to Die Zeit, none of the crim­i­nal cas­es pur­sued by the BKA dur­ing this time peri­od attempt­ed to make use of evi­dence col­lect­ed through Pega­sus. How­ev­er, accord­ing to sources that spoke with the Ger­man paper, offi­cials were adamant that any use of the spy­ware should be done only in cas­es it is autho­rized by Ger­man law. It is unclear, how­ev­er, what over­sight was done on the actu­al usage and in what con­text the pro­gram was used, if at all.
    ...

    We know there were con­cerns, and we know those con­cerns were some­how addressed, but we know hard­ly any­thing about how the spy­ware was actu­al­ly used and what sort of over­sight was deployed.

    But that does­n’t mean we can’t wager a rea­son­able guess as to how the Pega­sus spy­ware would have been used. Because as as the fol­low­ing arti­cle from May of 2020 describes, it was only in 2016 when the Ger­man par­lia­ment passed a law allow­ing its intel­li­gence ser­vices to spy on non-Ger­mans abroad, some­thing for which Pega­sus would be an ide­al fit. So while we don’t know if the 2017 NSO Group nego­ti­a­tions were direct­ly tied to the pas­sage of the 2016 spy­ing law, it’s not too hard to con­nect these dots:

    The New York Times

    Right to Pri­va­cy Extends to For­eign Inter­net Users, Ger­man Court Rules

    The intel­li­gence ser­vices can­not ran­dom­ly search the dig­i­tal data of cit­i­zens of oth­er coun­tries liv­ing abroad, judges said, in a deci­sion wel­comed by civ­il rights activists.

    By Melis­sa Eddy
    May 19, 2020

    BERLIN — Pri­va­cy rights enshrined in Germany’s Con­sti­tu­tion extend to for­eign­ers liv­ing abroad and cov­er their online data, the country’s high­est court ruled on Tues­day, order­ing Chan­cel­lor Angela Merkel’s gov­ern­ment to over­haul a law gov­ern­ing the for­eign intel­li­gence agency.

    The deci­sion by the Con­sti­tu­tion­al Court found that parts of a 2016 law gov­ern­ing the country’s for­eign intel­li­gence agency, known by its Ger­man abbre­vi­a­tion BND, in part vio­lat­ed the uni­ver­sal right to pri­va­cy in com­mu­ni­ca­tion. The rul­ing ordered the law to be rewrit­ten to clar­i­fy the moti­va­tion for spy­ing on indi­vid­u­als abroad, but it stopped short of ban­ning the prac­tice out­right.

    In its cur­rent form, the law per­mits the BND to gath­er, eval­u­ate and even share data gen­er­at­ed by com­mu­ni­ca­tion between non-Ger­mans out­side the coun­try to counter poten­tial attacks or threats. Pas­sage of the law fueled an intense debate over secu­ri­ty and civ­il lib­er­ties in a coun­try where the lessons of dis­re­gard for indi­vid­ual pri­va­cy under the Nazi and Com­mu­nist regimes still res­onate strong­ly.

    The court found that the pre-emp­tive mea­sures stip­u­lat­ed in the law were not clear enough grounds for vio­lat­ing an individual’s pri­va­cy.

    “In par­tic­u­lar, the mon­i­tor­ing is not based on suf­fi­cient objec­tives and struc­tured in such a way that they are con­trol­lable; there is also a lack of var­i­ous safe­guards, for exam­ple to pro­tect jour­nal­ists or lawyers,” the court said. It added that the law lacked “a guar­an­tee of suf­fi­cient­ly weighty pro­tec­tion of legal inter­ests and suf­fi­cient thresh­olds for inter­ven­tion.”

    A group of jour­nal­ist and civ­il lib­er­ties orga­ni­za­tions brought the case before the Con­sti­tu­tion­al Court, argu­ing that the 2016 law hand­ed too much pow­er to the state and failed to uphold uni­ver­sal human rights to pri­va­cy guar­an­teed by Arti­cle 10 of the Con­sti­tu­tion. The rul­ing is the first time that the court has extend­ed rights guar­an­teed in the Con­sti­tu­tion to non-Ger­mans abroad.

    “The rul­ing sets new stan­dards in inter­na­tion­al human rights pro­tec­tion and for the free­dom of the press,” said the Soci­ety for Civ­il Rights, a Berlin-based non­prof­it orga­ni­za­tion that filed the suit along with sev­er­al jour­nal­ists’ orga­ni­za­tions.

    Out­rage about sur­veil­lance in Ger­many was prompt­ed by the exten­sive pri­va­cy breach­es by intel­li­gence ser­vices that were revealed by Edward J. Snow­den, a for­mer con­trac­tor for the U.S. Nation­al Secu­ri­ty Agency, and, short­ly after, by the dis­clo­sure that the N.S.A. had tapped the chancellor’s cell­phone.

    Around the same time, Ms. Merkel’s gov­ern­ment was strug­gling to respond to a series of Islamist ter­ror­ist attacks in the coun­try and seek­ing to expand Germany’s abil­i­ty to defend itself with­out rely­ing on the U.S. secu­ri­ty appa­ra­tus. The 2016 law was an attempt to bal­ance the con­sid­er­a­tions of pri­va­cy and secu­ri­ty, but the court decid­ed on Tues­day that the BND had been afford­ed too much pow­er.

    The rul­ing demand­ed that parts of the 2016 law be rewrit­ten by the end of 2021, stip­u­lat­ing that the indi­vid­ual right to pri­va­cy in com­mu­ni­ca­tion, whether by let­ter, tele­phone or online, be estab­lished as a uni­ver­sal right of any indi­vid­ual, any­where. The court also called for more con­trols over the BND and for lim­i­ta­tions on the abil­i­ty of the ser­vice to share infor­ma­tion with inter­na­tion­al part­ners.

    Nor­bert Röttgen, a mem­ber of Ms. Merkel’s con­ser­v­a­tive gov­ern­ing par­ty and a con­tender to suc­ceed her, crit­i­cized the rul­ing in a post on Twit­ter as “dif­fi­cult to explain abroad” because it “rais­es con­sid­er­able ques­tions about our strate­gic oper­a­tions and abil­i­ty to coop­er­ate in a time when out­side aggres­sion is increas­ing­ly com­plex.”

    ...

    ————

    ”
    Right to Pri­va­cy Extends to For­eign Inter­net Users, Ger­man Court Rules” by Melis­sa Eddy; The New York Times; 05/19/2020

    “The deci­sion by the Con­sti­tu­tion­al Court found that parts of a 2016 law gov­ern­ing the country’s for­eign intel­li­gence agency, known by its Ger­man abbre­vi­a­tion BND, in part vio­lat­ed the uni­ver­sal right to pri­va­cy in com­mu­ni­ca­tion. The rul­ing ordered the law to be rewrit­ten to clar­i­fy the moti­va­tion for spy­ing on indi­vid­u­als abroad, but it stopped short of ban­ning the prac­tice out­right.”

    Yes, it was 2016, the year before the BKA’s secret nego­ti­a­tions with the NSO Group start­ed, when Ger­many passed a law allow­ing the BND to gath­er data on non-Ger­man’s out­side Ger­many. This is the key con­text of the out­reach to NSO Group the fol­low­ing year. Con­text that sud­den­ly changed with that 2020 court rul­ing:

    ...
    In its cur­rent form, the law per­mits the BND to gath­er, eval­u­ate and even share data gen­er­at­ed by com­mu­ni­ca­tion between non-Ger­mans out­side the coun­try to counter poten­tial attacks or threats. Pas­sage of the law fueled an intense debate over secu­ri­ty and civ­il lib­er­ties in a coun­try where the lessons of dis­re­gard for indi­vid­ual pri­va­cy under the Nazi and Com­mu­nist regimes still res­onate strong­ly.

    The court found that the pre-emp­tive mea­sures stip­u­lat­ed in the law were not clear enough grounds for vio­lat­ing an individual’s pri­va­cy.

    “In par­tic­u­lar, the mon­i­tor­ing is not based on suf­fi­cient objec­tives and struc­tured in such a way that they are con­trol­lable; there is also a lack of var­i­ous safe­guards, for exam­ple to pro­tect jour­nal­ists or lawyers,” the court said. It added that the law lacked “a guar­an­tee of suf­fi­cient­ly weighty pro­tec­tion of legal inter­ests and suf­fi­cient thresh­olds for inter­ven­tion.”

    A group of jour­nal­ist and civ­il lib­er­ties orga­ni­za­tions brought the case before the Con­sti­tu­tion­al Court, argu­ing that the 2016 law hand­ed too much pow­er to the state and failed to uphold uni­ver­sal human rights to pri­va­cy guar­an­teed by Arti­cle 10 of the Con­sti­tu­tion. The rul­ing is the first time that the court has extend­ed rights guar­an­teed in the Con­sti­tu­tion to non-Ger­mans abroad.
    ...

    But how about after that 2020 court rul­ing? Are Ger­man intel­li­gence ser­vices still using Pega­sus? Yep. In fact, the BKA did­n’t even receive deliv­ery of Pega­sus until late 2020 and only start­ed using it in March of this year. So the BKA did­n’t start using Pega­sus until after Ger­man courts end­ed the his­to­ry expan­sion of Ger­many’s legal wire­tap­ping pow­ers, which is either a good sign or a very bad sign in terms of the like­li­hood the spy­ware has already being abused:

    Deutsche Welle

    Ger­man police secret­ly bought NSO Pega­sus spy­ware

    Sources have con­firmed media reports that fed­er­al crim­i­nal police pur­chased and used the con­tro­ver­sial Israeli sur­veil­lance spy­ware despite lawyers’ objec­tions.

    Date Sep.09.2021

    The Ger­man Fed­er­al Crim­i­nal Police Office (BKA) bought noto­ri­ous Pega­sus spy­ware from the Israeli firm NSO in 2019, it was revealed Tues­day.

    The fed­er­al gov­ern­ment informed the Inte­ri­or Com­mit­tee of the Bun­destag of the pur­chase in a closed-doors ses­sion, par­lia­ment sources said. That con­firmed ear­li­er reports pub­lished in Ger­man news­pa­per Die Zeit.

    The soft­ware was pro­cured under “the utmost secre­cy,” accord­ing to Die Zeit, despite the hes­i­ta­tions of lawyers as the sur­veil­lance tool can do much more than Ger­man pri­va­cy laws per­mit.

    How­ev­er, the ver­sion pur­chased by the BKA had cer­tain func­tions blocked to pre­vent abuse, secu­ri­ty cir­cles told the paper ­— although it is unclear how that works on a prac­ti­cal lev­el.

    The rev­e­la­tions were a result of joint research by Die Zeit as well as dai­ly Süd­deutsche Zeitung and pub­lic broad­cast­ers NDR and WDR.

    What has the Ger­man gov­ern­ment said?

    Accord­ing to the Süd­deutsche Zeitung, BKA Vice Pres­i­dent Mar­ti­na Link con­firmed to law­mak­ers that her orga­ni­za­tion had pur­chased the soft­ware. In late 2020, the BKA acquired a ver­sion of the Pega­sus Tro­jan virus soft­ware. It has been used in select oper­a­tions con­cern­ing ter­ror­ism and orga­nized crime since March of this year.

    Ger­many’s Fed­er­al Con­sti­tu­tion­al Court has ruled that secu­ri­ty ser­vices are only per­mit­ted to use spy­ware on the cell­phones and com­put­ers of sur­veil­lance tar­gets in spe­cial cas­es, and can only ini­ti­ate cer­tain types of oper­a­tions.

    While the rule of law has placed lim­its, the tech­nol­o­gy avail­able has grown seem­ing­ly lim­it­less.

    The Ger­man gov­ern­ment has been asked specif­i­cal­ly about the use of NSO spy­ware three times in recent years and has large­ly refused to account for its use or sub­ject itself to scruti­ny for it.

    In a writ­ten state­ment to an offi­cial inquiry, Left Par­ty law­mak­er Mar­ti­na Ren­ner was told the par­lia­men­t’s right to infor­ma­tion con­flict­ed with the “con­fi­den­tial­i­ty inter­ests jus­ti­fied by the wel­fare of the state in excep­tion­al cas­es.”

    Nun ist es raus: #BKA nutzt Spy­ware #Pega­sus #NSO. Liest man meine Schriftliche Frage aus 5/19 erneut, heißt das wom­öglich, dass alle genan­nten Behör­den die Spi­onage­soft­ware nutzen, obwohl diese offenkundig grun­drechtswidrig ist. ?@zeitonline? ?@holger_stark? 1/2 pic.twitter.com/fuE0n2BXYi— Mar­ti­na Ren­ner (@MartinaRenner) Sep­tem­ber 7, 2021

    ...

    How has Ger­many react­ed?

    Green Par­ty mem­ber of par­lia­ment Kon­stan­tin von Notz called it a “night­mare for the rule of law.” He demand­ing “full clar­i­fi­ca­tion” from the fed­er­al gov­ern­ment as to who “specif­i­cal­ly bears respon­si­bil­i­ty for the pur­chase and use of the spy soft­ware.”

    Frank Über­all, the chair­man of the Ger­man Jour­nal­ists’ Asso­ci­a­tion, said the union want­ed to know “whether jour­nal­ists were spied on with­out their knowl­edge, whether their sources are still safe.”

    Über­all called the BKA’s action “incom­pre­hen­si­ble” and added Inte­ri­or Min­is­ter Horst See­hofer should “lay his cards on the table.”

    ———

    “Ger­man police secret­ly bought NSO Pega­sus spy­ware”; Deutsche Welle; 09/07/2021

    “Accord­ing to the Süd­deutsche Zeitung, BKA Vice Pres­i­dent Mar­ti­na Link con­firmed to law­mak­ers that her orga­ni­za­tion had pur­chased the soft­ware. In late 2020, the BKA acquired a ver­sion of the Pega­sus Tro­jan virus soft­ware. It has been used in select oper­a­tions con­cern­ing ter­ror­ism and orga­nized crime since March of this year.”

    As we can see, Ger­many’s fed­er­al police appar­ent­ly received the Pega­sus soft­ware in late 2020, months after the Ger­man court rul­ing find­ing the 2016 law per­mit­ting the spy­ing on non-Ger­man cit­i­zens is uncon­sti­tu­tion­al. And we’re told it has­n’t been actu­al­ly used until March of this year. So on the one hand, if we believe this time­line, it sug­gests the BKA has­n’t had a lot of time to abuse the Pega­sus soft­ware yet. But it also high­lights how Ger­many’s intel­li­gence ser­vices were still will­ing to go ahead with the acqui­si­tion of Pega­sus after a Ger­man court shot down the 2016 law grant­i­ng those ser­vices the right to spy on the world. And when asked how NSO Group’s tools are being use, the gov­ern­ment has repeat­ed­ly refused to say. Tak­en togeth­er, it’s the kind of con­stel­la­tion of data points all sug­gest­ing that Ger­many’s approach to address­ing the poten­tial con­sti­tu­tion abus­es of these spy­ware tools is to min­i­mize the over­sight so those abus­es don’t come to light:

    ...
    Ger­many’s Fed­er­al Con­sti­tu­tion­al Court has ruled that secu­ri­ty ser­vices are only per­mit­ted to use spy­ware on the cell­phones and com­put­ers of sur­veil­lance tar­gets in spe­cial cas­es, and can only ini­ti­ate cer­tain types of oper­a­tions.

    While the rule of law has placed lim­its, the tech­nol­o­gy avail­able has grown seem­ing­ly lim­it­less.

    The Ger­man gov­ern­ment has been asked specif­i­cal­ly about the use of NSO spy­ware three times in recent years and has large­ly refused to account for its use or sub­ject itself to scruti­ny for it.
    ...

    So the over­ar­ch­ing sto­ry here is a sto­ry of one part of the Ger­man gov­ern­ment assert­ing greater spy­ing pow­ers and tak­ing steps to obtain those pow­ers, while anoth­er side of the Ger­man gov­ern­ment has ruled this is uncon­sti­tu­tion­al. And the way this bureau­crat­ic impasse has been addressed is appar­ent­ly for the BKA to just pro­ceed with the Pega­sus acqui­si­tion and for every­one else to just kind of pre­tend it’s not being used uncon­sti­tu­tion­al­ly while ques­tions are deflect­ed or ignored.

    And, again, this is mere­ly the sto­ry of how Ger­many’s gov­ern­ment is han­dling the temp­ta­tion of some­thing like Pega­sus. Answer­ing the ques­tion of how many oth­er Ger­man con­sti­tu­tion­al vio­la­tions are casu­al­ly being swept under the rug in a sim­i­lar man­ner is the much big­ger sto­ry here.

    Posted by Pterrafractyl | September 19, 2021, 7:53 pm

  8. It seems like every oth­er week these days there’s an announce­ment about new hack­er-for-hire zero-day exploit that’s just been dis­cov­ered. That was the case again last week when Cit­i­zen­Lab announced the dis­cov­ery of a new zero-day exploit on the phone of a Sau­di activist in March of 2021.

    But there was a notable new detail with this lat­est dis­cov­ery: the attri­bu­tion was made to NSO Group based on tech­ni­cal sim­i­lar­i­ties to pre­vi­ous NSO Group hacks. In oth­er words, the “pat­tern recog­ni­tion” method­ol­o­gy for mak­ing cyber­at­tri­bu­tions. Instead of the tra­di­tion­al “pat­tern recog­ni­tion” con­clu­sion (Russ­ian, Chi­nese, or Iran­ian hack­ers), the “pat­tern recog­ni­tion” tech­nique is now being deployed against NSO Group.

    What’s the tech­ni­cal pat­tern? There were two tech­ni­cal details in the Cit­i­zen Lab report they cite in mak­ing the NSO Group attri­bu­tion:

    1. The new­ly dis­cov­ered mal­ware, dubbed FORCEDENTRY, exploit­ed anoth­er tech­nique dubbed CASCADEFAIL, that is sup­posed to delete evi­dence of the mal­ware’s manip­u­la­tion from the vic­tim phone’s sqlite data­base. There’s a sin­gle data­base entry of evi­dence left over. Cit­i­zen Lab’s researchers have only ever seen mal­ware that leaves this last piece of left­over evi­dence in oth­er NSO Group Pega­sus mal­ware.

    2. The FORCEDENTRY mal­ware gen­er­ates mul­ti­ple process­es on the vic­tim phone, assign­ing names to those process­es. One of those process names, “set­framed”, was the name of a process name used in anoth­er NSO Group mal­ware Cit­i­zen­Lab dis­cov­ered tar­get­ing an Al Jazeera jour­nal­ist in July 2020. The Cit­i­zen Lab report adds, “Notably, we did not pub­lish that detail at the time.”

    So based on those two tech­ni­cal details, Cit­i­zen­Lab made a “high con­fi­dence” attri­bu­tion of this mal­ware to NSO Group. And part of that high con­fi­dence was root­ed in the fact that Cit­i­zen­Lab nev­er pre­vi­ous­ly pub­lished that it found the same “set­name” process name used in an ear­li­er NSO Group attack.

    Now, on the one hand, that sounds like a pret­ty rea­son­able con­clu­sion to arrive at giv­en the cir­cum­stances. Those cir­cum­stances being that this appears to be the ini­tial pub­li­ca­tion of any details on these tech­ni­cal details and those details appear to be rea­son­ably spe­cif­ic. But this is also turn­ing int a won­der­ful exam­ple of how vul­ner­a­ble tech­ni­cal “pat­tern recog­ni­tion” real­ly is to spoof­ing and erro­neous con­clu­sions. Because think about it: going for­ward, if mal­ware if found to con­tain either of these two ‘fea­tures’, there’s this built-in bias that this is NSO Group mal­ware. And it very well might be NSO Group mal­ware mak­ing the same mis­takes, but the fact that those two tech­ni­cal details are some­thing a mal­ware cod­ing to eas­i­ly incor­po­rate into their mal­ware design is an exam­ple of why the “pat­tern recog­ni­tion” method­ol­o­gy is ripe for abuse.

    It’s long been a fun­da­men­tal chal­lenge with the cyber­at­tri­bu­tion indus­try: Once the pat­tern is shared, that pat­tern is now shared knowl­edge that can be used to spoof future pat­tern recog­ni­tion analy­ses. That’s why Cit­i­zen­Lab felt it rel­e­vant to empha­size that it had­n’t pre­vi­ous­ly pub­lished the “set­framed” process name. If it had pre­vi­ous­ly pub­lished that process name, any mal­ware design­er could have eas­i­ly inten­tion­al­ly had their mal­ware use the “set­framed” name to con­fuse cyber­se­cu­ri­ty ana­lysts, which is now the case going for­ward.

    Also keep in mind that the fact Cit­i­zen Lab nev­er pub­lished the “set­framed” process name from that pre­vi­ous NSO Group hack does­n’t mean the infor­ma­tion was­n’t qui­et­ly shared with oth­er enti­ties. Trust­ed enti­ties that end up pass­ing it along to less trust-wor­thy enti­ties that might end up abus­ing it and using it to cov­er their own hack­ing tracks. It’s not like there’s an impen­e­tra­ble wall between the cyber­se­cu­ri­ty indus­try and the hack­er-for-hire indus­try.

    So that’s real­ly the inter­est­ing to this sto­ry. In many ways, it’s just the lat­est in a seem­ing­ly end­less string of hack­er-for-hire exploits sold to anoth­er foul gov­ern­ment and used against an activist. But the fact that this got attrib­uted to NSO Group based on tech­ni­cal pat­tern recog­ni­tion makes this the kind of sto­ry that could be a har­bin­ger of many more NSO Group pat­tern recog­ni­tion sto­ries to come. Some of them might be real NSO Group sto­ries and some where NSO Group was set up. Either way, it should be fun to watch. Except not so much fun for all the new vic­tims.

    And that brings us to anoth­er grim­ly inter­est­ing aspect of pat­tern recog­ni­tion being used to attribute the high­ly sophis­ti­cat­ed and tar­get mal­ware of this nature: A key issue with the pre­vail­ing “pat­tern recog­ni­tion” attri­bu­tion regime that seemed to always find a pat­tern from Rus­sia, Iran­ian, Chin, or North Korea was how it was almost designed to encour­age out­side actors to join in on the fun. Just put your stu­pid ‘Russ­ian’ pat­terns like Cyril­lic char­ac­ters and let Russ­sia take the blame. It encour­ages hack­ing that fit ‘the pat­tern’. And what’s the pat­tern in this case? High­ly tar­get­ed hacks of promi­nent vic­tims and activists using pow­er­ful zero-click exploits. Do folks want more of those?

    So while it looks like Cit­i­zen Lab prob­a­bly made the right call on this par­tic­u­lar case of NSO Group “pat­tern recog­ni­tion”, it’s going to be impor­tant to keep in mind that if we end up see­ing a flood of copy­cat NSO Group mal­ware sto­ries based on sim­i­lar pat­terns that may not just be an NSO Group group sto­ry. There’s a lot of com­pe­ti­tion in the glob­al cyber­merce­nary indus­try. Some might say too much com­pe­ti­tion:

    The Guardian

    Israeli spy­ware firm tar­get­ed Apple devices via iMes­sage, researchers say

    Dis­cov­ery was shared with Apple, which on Mon­day released a patch to fix the vul­ner­a­bil­i­ty

    Stephanie Kirch­gaess­ner in Wash­ing­ton
    Mon 13 Sep 2021 22.51 EDT

    First pub­lished on Mon 13 Sep 2021 16.48 EDT

    Secu­ri­ty researchers at Cit­i­zen Lab have dis­cov­ered an exploit that they believe has been used by gov­ern­ment clients of NSO Group, the Israeli spy­ware com­pa­ny, to silent­ly hack into iPhones and oth­er Apple devices since Feb­ru­ary 2021.

    The dis­cov­ery, which was made as the researchers were exam­in­ing the mobile phone of a Sau­di activist, was shared with Apple, which on Mon­day released a patch to fix the vul­ner­a­bil­i­ty.

    ...

    When it is suc­cess­ful­ly deployed against a tar­get, NSO Group’s spy­ware, called Pega­sus, can silent­ly hack into a phone, col­lect a user’s per­son­al and pri­vate infor­ma­tion, inter­cept calls and mes­sages, and even turn a mobile phone into a remote lis­ten­ing device.

    NSO Group has said that its spy­ware is only meant to be used by licensed law enforce­ment agen­cies to tar­get crim­i­nals and ter­ror­ists. But inves­ti­ga­tions – includ­ing the recent pub­li­ca­tion of the Pega­sus Project by the Guardian and oth­er out­lets – have revealed ways in which the spy­ware has been used by gov­ern­ment clients to tar­get jour­nal­ists and human rights activists around the world.

    Asked for com­ment, NSO Group issued a state­ment say­ing: “NSO Group will con­tin­ue to pro­vide intel­li­gence and law enforce­ment agen­cies around the world with life-sav­ing tech­nolo­gies to fight ter­ror and crime.”

    Cit­i­zen Lab said it was able to make a “high-con­fi­dence attri­bu­tion” that the exploit had been cre­at­ed by NSO Group because they observed “mul­ti­ple dis­tinc­tive ele­ments” in the spy­ware. An exploit is a tech­ni­cal vul­ner­a­bil­i­ty that allows spy­ware to infect a phone, and the code of the exploit dis­cov­ered by Cit­i­zen Lab con­tained a spe­cif­ic bug that the researchers had only ever asso­ci­at­ed with NSO Group’s Pega­sus in the past.

    “We believe that the bug is dis­tinc­tive enough to point back to NSO,” Cit­i­zen Lab said in a blog­post.

    The researchers also found that the spy­ware, which they have called FORCEDENTRY, used mul­ti­ple process names – iden­ti­fy­ing fea­tures of the mal­ware code – includ­ing one that was used in a pre­vi­ous attack that used NSO Group spy­ware on an Al Jazeera jour­nal­ist in July 2020.

    NSO Group has said it can­not reveal the iden­ti­ty of its clients. But the Guardian has pre­vi­ous­ly report­ed that NSO Group dropped Sau­di Ara­bia as a client in the wake of Cit­i­zen Lab’s report that the king­dom was the like­ly cul­prit behind dozens of attacks against Al Jazeera jour­nal­ists in 2020.

    The devel­op­ment marks more bad news for Apple. Foren­sic exam­i­na­tions of mobile phones con­duct­ed both by Cit­i­zen Lab and Amnesty International’s secu­ri­ty lab have found that even the most up-to-date iPhones, using the most up to date oper­at­ing sys­tem, have been vul­ner­a­ble to attacks by Pega­sus.

    Ivan Krstic, head of Apple secu­ri­ty engi­neer­ing and archi­tec­ture, said in a state­ment to the Guardian: “After iden­ti­fy­ing the vul­ner­a­bil­i­ty used by this exploit for iMes­sage, Apple rapid­ly devel­oped and deployed a fix in iOS 14.8 to pro­tect our users. We’d like to com­mend Cit­i­zen Lab for suc­cess­ful­ly com­plet­ing the very dif­fi­cult work of obtain­ing a sam­ple of this exploit so we could devel­op this fix quick­ly.”

    He added: “Attacks like the ones described are high­ly sophis­ti­cat­ed, cost mil­lions of dol­lars to devel­op, often have a short shelf life, and are used to tar­get spe­cif­ic indi­vid­u­als. While that means they are not a threat to the over­whelm­ing major­i­ty of our users, we con­tin­ue to work tire­less­ly to defend all our cus­tomers, and we are con­stant­ly adding new pro­tec­tions for their devices and data.”

    Cit­i­zen Lab said in its state­ment that the com­pa­ny was releas­ing a fix for the exploit on Mon­day, and urged all Apple users to update devices as soon as pos­si­ble, includ­ing all Apple devices that use iOS ver­sions pri­or to 14.8.

    The exploit dis­cov­ered by Cit­i­zen Lab is known as a “zero-day” vul­ner­a­bil­i­ty, which allows users of the spy­ware to infect a phone with­out the user hav­ing any idea that their mobile phones have been hacked. In this case, the FORCEDENTRY exploit used a weak­ness in Apple’s iMes­sage func­tion to silent­ly send cor­rupt files to a phone that appeared to be GIF exten­sions, but were actu­al­ly Adobe PDF files con­tain­ing mali­cious code.

    “Our lat­est dis­cov­ery of yet anoth­er Apple zero-day employed as part of NSO Group’s arse­nal fur­ther illus­trates that com­pa­nies like NSO Group are facil­i­tat­ing ‘despo­tism-as-a-ser­vice’ for unac­count­able gov­ern­ment secu­ri­ty agen­cies,” researchers said.

    Bill Mar­czak, who first dis­cov­ered the exploit at Cit­i­zen Lab, said the find­ings also high­light­ed the impor­tance of secur­ing pop­u­lar mes­sag­ing apps, which were increas­ing­ly being used as a tar­get by sophis­ti­cat­ed threat actors.

    “As present­ly engi­neered, many chat apps have become an irre­sistible soft tar­get. With­out intense engi­neer­ing focus, we believe that they will con­tin­ue to be heav­i­ly tar­get­ed, and suc­cess­ful­ly exploit­ed,” Cit­i­zen Lab said.

    ———–

    “Israeli spy­ware firm tar­get­ed Apple devices via iMes­sage, researchers say” by Stephanie Kirch­gaess­ner; The Guardian; 09/13/2021

    “Cit­i­zen Lab said it was able to make a “high-con­fi­dence attri­bu­tion” that the exploit had been cre­at­ed by NSO Group because they observed “mul­ti­ple dis­tinc­tive ele­ments” in the spy­ware. An exploit is a tech­ni­cal vul­ner­a­bil­i­ty that allows spy­ware to infect a phone, and the code of the exploit dis­cov­ered by Cit­i­zen Lab con­tained a spe­cif­ic bug that the researchers had only ever asso­ci­at­ed with NSO Group’s Pega­sus in the past.”

    We’re get­ting a peek at how the sausage is made. This was a high-con­fi­dence attri­bu­tion made based on tech­ni­cal details tied back to pre­vi­ous hacks asso­ci­at­ed with Pega­sus. The key ter­ri­fy­ing fea­ture this mal­ware shares with a num­ber of hacks asso­ci­at­ed with this mer­ce­nary hack­ing indus­try is the fact that it’s a zero-click hack that infects your phone whether you real­ize it or not. If it was­n’t NSO Group, it was anoth­er group with cut­ting-edge capabilities...willing to sell to Sau­di Ara­bia:

    ...
    “We believe that the bug is dis­tinc­tive enough to point back to NSO,” Cit­i­zen Lab said in a blog­post.

    The researchers also found that the spy­ware, which they have called FORCEDENTRY, used mul­ti­ple process names – iden­ti­fy­ing fea­tures of the mal­ware code – includ­ing one that was used in a pre­vi­ous attack that used NSO Group spy­ware on an Al Jazeera jour­nal­ist in July 2020.

    ...

    The exploit dis­cov­ered by Cit­i­zen Lab is known as a “zero-day” vul­ner­a­bil­i­ty, which allows users of the spy­ware to infect a phone with­out the user hav­ing any idea that their mobile phones have been hacked. In this case, the FORCEDENTRY exploit used a weak­ness in Apple’s iMes­sage func­tion to silent­ly send cor­rupt files to a phone that appeared to be GIF exten­sions, but were actu­al­ly Adobe PDF files con­tain­ing mali­cious code.
    ...

    And note that when we read about NSO Group drop­ping Sau­di Ara­bia as a client in the wake of the Jamal Khashog­gi killing, recall how NSO Group then changed own­er­ship and once again took Sau­di Ara­bia as a client. So that would actu­al­ly be anoth­er data point point­ing towards NSO Group: it’s like forced to sup­ply the Saud­is super spy­ware:

    ...
    NSO Group has said it can­not reveal the iden­ti­ty of its clients. But the Guardian has pre­vi­ous­ly report­ed that NSO Group dropped Sau­di Ara­bia as a client in the wake of Cit­i­zen Lab’s report that the king­dom was the like­ly cul­prit behind dozens of attacks against Al Jazeera jour­nal­ists in 2020.
    ...

    And NSO Group prob­a­bly isn’t the only ‘com­mer­cial sur­veil­lance ven­dor’ the Saud­is are get­ting their zero-click super-spy­ware from. Again, NSO Group has com­peti­tors.

    Now here’s the Cit­i­zen Lab report itself giv­ing us more details on what the mal­ware does and how they made the attri­bu­tion. The attack­er sends a pdf dis­guised as a gif that caus­es an inte­ger over­flow vul­ner­a­bil­i­ty in Apple’s image ren­der­ing library, allow­ing for arbi­trary code exe­cu­tion. A night­mare bug. And they’re high­ly con­fi­dent this was NSO Group behind this night­mare bug based on the shared piece of non-delet­ed data­base evi­dence and the shared “set­framed” process name. NSO Group got slight­ly slop­py:

    Cit­i­zen Lab

    FORCEDENTRY NSO Group iMes­sage Zero-Click Exploit Cap­tured in the Wild

    By Bill Mar­czak, John Scott-Rail­ton, Bahr Abdul Raz­zak, Noura Al-Jiza­wi, Siena Anstis, Kristin Berdan, and Ron Deib­ert

    Sep­tem­ber 13, 2021

    Sum­ma­ry

    * While ana­lyz­ing the phone of a Sau­di activist infect­ed with NSO Group’s Pega­sus spy­ware, we dis­cov­ered a zero-day zero-click exploit against iMes­sage. The exploit, which we call FORCEDENTRY, tar­gets Apple’s image ren­der­ing library, and was effec­tive against Apple iOS, MacOS and WatchOS devices.
    * We deter­mined that the mer­ce­nary spy­ware com­pa­ny NSO Group used the vul­ner­a­bil­i­ty to remote­ly exploit and infect the lat­est Apple devices with the Pega­sus spy­ware. We believe that FORCEDENTRY has been in use since at least Feb­ru­ary 2021.
    * The Cit­i­zen Lab dis­closed the vul­ner­a­bil­i­ty and code to Apple, which has assigned the FORCEDENTRY vul­ner­a­bil­i­ty CVE-2021–30860 and describes the vul­ner­a­bil­i­ty as “pro­cess­ing a mali­cious­ly craft­ed PDF may lead to arbi­trary code exe­cu­tion.”
    * Today, Sep­tem­ber 13th, Apple is releas­ing an update that patch­es CVE-2021–30860. We urge read­ers to imme­di­ate­ly update all Apple devices.

    ...

    Dis­cov­ery

    In March 2021, we exam­ined the phone of a Sau­di activist who has cho­sen to remain anony­mous, and deter­mined that they had been hacked with NSO Group’s Pega­sus spy­ware. Dur­ing the course of the analy­sis we obtained an iTunes back­up of the device.

    Recent re-analy­sis of the back­up yield­ed sev­er­al files with the “.gif” exten­sion in Library/SMS/Attachments that we deter­mined were sent to the phone imme­di­ate­ly before it was hacked with NSO Group’s Pega­sus spy­ware.

    Pay­load

    The files were:

    * 27 copies of an iden­ti­cal file with the “.gif” exten­sion. Despite the exten­sion, the file was actu­al­ly a 748-byte Adobe PSD file. Each copy of this file caused an IMTranscoder­A­gent crash on the device. These files each had ran­dom-look­ing ten-char­ac­ter file­names.
    * Four dif­fer­ent files with the “.gif” exten­sion that were actu­al­ly Adobe PDF files con­tain­ing a JBIG2-encod­ed stream. Two of these files had 34-char­ac­ter names, and two had 97-char­ac­ter names.
    * The out­put of the pdfid tool on these four “.gif” files was (NB: the stream had vary­ing length):

    ...

    Dis­cov­ery and Dis­clo­sure

    Because the for­mat of the files matched two types of crash­es we had observed on anoth­er phone when it was hacked with Pega­sus, we sus­pect­ed that the “.gif” files might con­tain parts of what we are call­ing the FORCEDENTRY exploit chain.

    Cit­i­zen Lab for­ward­ed the arti­facts to Apple on Tues­day, Sep­tem­ber 7. On Mon­day, Sep­tem­ber 13, Apple con­firmed that the files includ­ed a zero-day exploit against iOS and MacOS. They des­ig­nat­ed the FORCEDENTRY exploit CVE-2021–30860, and describe it as “pro­cess­ing a mali­cious­ly craft­ed PDF may lead to arbi­trary code exe­cu­tion.”

    The exploit works by exploit­ing an inte­ger over­flow vul­ner­a­bil­i­ty in Apple’s image ren­der­ing library (Core­Graph­ics). We are pub­lish­ing lim­it­ed tech­ni­cal infor­ma­tion about CVE-2021–30860 at this time.

    Attri­bu­tion to NSO Group

    We observed mul­ti­ple dis­tinc­tive ele­ments that allowed us to make a high-con­fi­dence attri­bu­tion to NSO Group:

    * The spy­ware installed by the FORCEDENTRY exploit exhib­it­ed a foren­sic arti­fact that we call CASCADEFAIL, which is a bug where­by evi­dence is incom­plete­ly delet­ed from the phone’s DataUsage.sqlite file. In CASCADEFAIL, an entry from the file’s ZPROCESS table is delet­ed, but not entries in the ZLIVEUSAGE table that refer to the delet­ed ZPROCESS entry. We have only ever seen this type of incom­plete dele­tion asso­ci­at­ed with NSO Group’s Pega­sus spy­ware, and we believe that the bug is dis­tinc­tive enough to point back to NSO. The spe­cif­ic CASCADEFAIL arti­fact can be detect­ed by

    SELECT “CASCADEFAIL” FROM ZLIVEUSAGE WHERE ZLIVEUSAGE.ZHASPROCESS NOT IN (SELECT Z_PK FROM ZPROCESS);

    * The spy­ware installed by the FORCEDENTRY exploit used mul­ti­ple process names, includ­ing the name “set­framed”. That process name was used in an attack with NSO Group’s Pega­sus spy­ware on an Al Jazeera jour­nal­ist in July 2020. Notably, we did not pub­lish that detail at the time.

    ...

    ———–

    “FORCEDENTRY NSO Group iMes­sage Zero-Click Exploit Cap­tured in the Wild” by Bill Mar­czak, John Scott-Rail­ton, Bahr Abdul Raz­zak, Noura Al-Jiza­wi, Siena Anstis, Kristin Berdan, and Ron Deib­ert; Cit­i­zen Lab; 09/13/2021

    “Cit­i­zen Lab for­ward­ed the arti­facts to Apple on Tues­day, Sep­tem­ber 7. On Mon­day, Sep­tem­ber 13, Apple con­firmed that the files includ­ed a zero-day exploit against iOS and MacOS. They des­ig­nat­ed the FORCEDENTRY exploit CVE-2021–30860, and describe it as “pro­cess­ing a mali­cious­ly craft­ed PDF may lead to arbi­trary code exe­cu­tion.””

    Bet­ter watch out for the .gifs that are actu­al­ly pdfs. Arbi­trary code exe­cu­tion could be the result. Yikes! It’s cer­tain­ly the kind of exploit that sounds like some­thing NSO Group would be behind. And when it comes to this spe­cif­ic attri­bu­tion, the pat­tern recog­ni­tion based on two key pieces of tech­ni­cal evi­dence tying it back to NSO Group real­ly do seem to be pret­ty sol­id evi­dence. The prob­lem will be if the same clues are used in the future to tie hacks back to NSO Group. Any­one can make their mal­ware leave behind these pieces of evi­dence. In oth­er words, done right, the pat­tern recog­ni­tion approach is kind of a one-off for a giv­en pat­tern. Or at least until you share the pat­tern:

    ...
    We observed mul­ti­ple dis­tinc­tive ele­ments that allowed us to make a high-con­fi­dence attri­bu­tion to NSO Group:

    * The spy­ware installed by the FORCEDENTRY exploit exhib­it­ed a foren­sic arti­fact that we call CASCADEFAIL, which is a bug where­by evi­dence is incom­plete­ly delet­ed from the phone’s DataUsage.sqlite file. In CASCADEFAIL, an entry from the file’s ZPROCESS table is delet­ed, but not entries in the ZLIVEUSAGE table that refer to the delet­ed ZPROCESS entry. We have only ever seen this type of incom­plete dele­tion asso­ci­at­ed with NSO Group’s Pega­sus spy­ware, and we believe that the bug is dis­tinc­tive enough to point back to NSO. The spe­cif­ic CASCADEFAIL arti­fact can be detect­ed by

    SELECT “CASCADEFAIL” FROM ZLIVEUSAGE WHERE ZLIVEUSAGE.ZHASPROCESS NOT IN (SELECT Z_PK FROM ZPROCESS);

    * The spy­ware installed by the FORCEDENTRY exploit used mul­ti­ple process names, includ­ing the name “set­framed”. That process name was used in an attack with NSO Group’s Pega­sus spy­ware on an Al Jazeera jour­nal­ist in July 2020. Notably, we did not pub­lish that detail at the time.
    ...

    So we’ll see if there are more types of super-mal­ware dis­cov­ered with these tech­ni­cal details, and whether or not they’ll con­tain these tech­ni­cal details and get attrib­uted back to NSO Group. But while it’s hard to have much sym­pa­thy for the com­pa­ny being set up to take the blame for oth­er hack­ers, the fact that every hack mis­at­trib­uted to NSO Group is the cov­er sto­ry for anoth­er hack­er is actu­al­ly worth keep­ing in mind, quite pos­si­bly one of NSO Group’s com­peti­tors. Com­peti­tors with client gov­ern­ments feel­ing extra embold­ened too.

    Posted by Pterrafractyl | September 21, 2021, 10:55 pm

  9. The del­uge of NSO Group-relat­ed sto­ries does not appear to be let­ting up any time soon. We just got a report on anoth­er instance of a rogue unde­mo­c­ra­t­ic gov­ern­ment using the spy­ware on jour­nal­ists. This time, it’s Vik­tor Orban’s rogue unde­mo­c­ra­t­ic of Hun­gary, mak­ing this just the lat­est EU-relat­ed NSO Group sto­ry. Recall the recent reports on Ger­many’s fed­er­al police also obtain­ing NSO Group tools.

    But while the sto­ry out of Ger­many was about the acqui­si­tion of spy­ware tools that are ripe for abuse, the sto­ry out of Hun­gary is about actu­al iden­ti­fied abus­es. Specif­i­cal­ly, an inves­ti­ga­tion by Direkt36 — an inves­tiga­tive media out­let and mem­ber of the Pega­gus Project con­sor­tium — dis­cov­ered signs of the Pega­sus spy­ware on the phone of Budapest-based pho­to­jour­nal­ist Dániel Németh. The hacks took place at some point in July 2021, while Németh was report­ing on the where­abouts of Lor­inc Mészáros, a for­mer gas fit­ter who has become one of Hungary’s rich­est men in the past few years. Mészáros also hap­pens to be a child­hood friend of Oban and once attrib­uted his suc­cess to “God, luck and Vik­tor Orbán”.

    And it’s that twist — that a jour­nal­ist who was track­ing a close per­son­al friend of Orban got hacked — rais­es one of the obvi­ous ques­tions about this entire busi­ness mod­el of sell­ing super sophis­ti­cat­ed spy­ware to gov­ern­ments around the world: giv­en that most gov­ern­ments are run by peo­ple who are per­son­al friends or busi­ness part­ners with the most pow­er­ful pri­vate inter­ests in the nation (or the world), what’s to pre­vent those asso­ciates from ask­ing the gov­ern­ment to tar­get a par­tic­u­lar indi­vid­ual on their behalf? As we’ve seen, NSO Group’s go-to defense when faced with accu­sa­tions about the abuse of its spy­ware is to point out that the com­pa­ny itself has no infor­ma­tion on how its spy­ware is used. In oth­er words, there’s basi­cal­ly no safe­guard against a gov­ern­ment run­ning hacks on behalf of pow­er­ful friends of the gov­ern­ment. It’s up to the integri­ty of the gov­ern­ment itself. And as we’ll see, in the case of Hun­gary, the intel­li­gence ser­vices can order sur­veil­lance with no judi­cial over­sight, only the sig­na­ture of the min­is­ter of jus­tice, in cas­es where ‘nation­al secu­ri­ty is at stake’.

    Let’s also keep in mind that there’s noth­ing ensur­ing gov­ern­ments are only run­ing spe­cial favor hacks for the pow­er­ful peo­ple in that coun­try. Any­one around the world with con­nec­tions to the gov­ern­ment could poten­tial­ly ask for such a favor. So with Vik­tor Orban hav­ing suc­cess­ful­ly trans­formed Hun­gary into a kind of glob­al far right net­work­ing hub, the ques­tion of who may be ask­ing Orban for spe­cial hack­ing favors is far from obvi­ous. Heck, Tuck­er Carl­son prob­a­bly pos­si­bly in a favor with Orban at this point. That’s the big­ger sto­ry here. It’s a facet of the NSO Group sto­ry that the globe has yet to even rec­og­nize, let alone address:

    The Guardian

    Phones of jour­nal­ist who tracked Vik­tor Orban’s child­hood friend infect­ed with spy­ware

    Dániel Németh’s phones infect­ed with Pega­sus soft­ware while report­ing on one of Hungary’s rich­est men

    Stephanie Kirch­gaess­ner
    Tue 21 Sep 2021 11.26 EDT
    Last mod­i­fied on Wed 22 Sep 2021 04.16 EDT

    Dániel Németh, a Budapest-based pho­to­jour­nal­ist, has tried to keep a low pro­file in his ground­break­ing work inves­ti­gat­ing and doc­u­ment­ing the lux­u­ry lifestyle of Hungary’s rul­ing elite.

    While his name is not well known, the 46-year-old has man­aged to use his drone, and pub­lic flight and ship track­ing data, to find and pho­to­graph politi­cians and pro-gov­ern­ment busi­ness fig­ures, expos­ing their hid­den lux­u­ries such as yachts in exot­ic loca­tions.

    Now, it has emerged, some­one was watch­ing him, too.

    An inves­ti­ga­tion by Direkt36, an inves­tiga­tive media out­let and mem­ber of the Pega­sus Project con­sor­tium, which has inves­ti­gat­ed NSO Group, has revealed that two of Németh’s phones were recent­ly hacked by a gov­ern­ment client of the Israeli spy­ware com­pa­ny.

    Foren­sic analy­sis of Németh’s phones, con­duct­ed by researchers at Cit­i­zen Lab at the Uni­ver­si­ty of Toron­to and con­firmed by researchers at Amnesty International’s secu­ri­ty lab, found that the phones were infect­ed with NSO Group’s Pega­sus sur­veil­lance soft­ware, which enables users to mon­i­tor a victim’s phone con­ver­sa­tions, text mes­sages, pic­tures and phys­i­cal loca­tion. The spy­ware can also turn a mobile phone into a remote­ly oper­at­ed lis­ten­ing device.

    The hacks occurred in July 2021 while Németh was report­ing on the where­abouts of one of the prime min­is­ter, Vik­tor Orbán’s, child­hood friends, Lor­inc Mészáros, a for­mer gas fit­ter who has become one of Hungary’s rich­est men in the past few years.

    Mészáros has built a busi­ness empire that sprawls across mul­ti­ple sec­tors since Orbán came to pow­er in 2010, and his com­pa­nies often win lucra­tive gov­ern­ment ten­ders. In 2019, Forbes named him the rich­est per­son in Hun­gary.

    Orbán has repeat­ed­ly declined to com­ment on Mészáros’s mete­oric rise in for­tunes, say­ing pol­i­tics and busi­ness should be kept sep­a­rate. Mészáros shuns media atten­tion, but in a 2014 inter­view with a Hun­gar­i­an out­let attrib­uted his suc­cess to “God, luck and Vik­tor Orbán”.

    A spokesper­son for Mészáros’s com­pa­ny said in a state­ment: “Mr Mészáros does not pay atten­tion to nei­ther Dániel Németh, nor any oth­er paparazzi’s activ­i­ties, where­abouts or inci­dents relat­ed to them.”

    While it can­not be foren­si­cal­ly proven which of NSO’s clients tar­get­ed Németh, because such analy­sis exam­ines only whether a phone has been infect­ed, the new rev­e­la­tion comes as Orbán’s far-right gov­ern­ment is fac­ing scruti­ny in Brus­sels for its alleged use of the Pega­sus spy­ing tool against jour­nal­ists, media own­ers, and polit­i­cal oppo­si­tion fig­ures.

    Didi­er Reyn­ders, the Euro­pean Commission’s jus­tice com­mis­sion­er, recent­ly told MEPs that the bloc “total­ly con­demned” alleged attempts by nation­al secu­ri­ty ser­vices to ille­gal­ly access infor­ma­tion on polit­i­cal oppo­nents through their phones. Reyn­ders said that the EU’s exec­u­tive branch was close­ly fol­low­ing an inves­ti­ga­tion by Hungary’s data pro­tec­tion author­i­ty into claims that Orbán’s gov­ern­ment was using the spy tool improp­er­ly.

    A con­sor­tium of 17 media out­lets, which includ­ed the Guardian and was coor­di­nat­ed by the French media non-prof­it For­bid­den Sto­ries, revealed in July that glob­al clients of NSO had used hack­ing soft­ware to tar­get human rights activists, jour­nal­ists and lawyers. Among those hacked using Pega­sus were two Direkt36 jour­nal­ists, András Szabó and Szabolcs Panyi.

    Hun­gar­i­an law pro­vides that in cas­es where nation­al secu­ri­ty is at stake, the intel­li­gence ser­vices can order sur­veil­lance with no judi­cial over­sight, only the sig­na­ture of the min­is­ter of jus­tice. Hungary’s jus­tice min­is­ter, Judit Var­ga, has declined to com­ment, but said: “Every coun­try needs such tools”.

    ...

    NSO has said its spy­ware is intend­ed to be used only by licensed law enforce­ment agen­cies against sus­pect­ed ter­ror­ists and crim­i­nals. The com­pa­ny has said that it does not have access to data of its cus­tomers’ tar­gets and that it inves­ti­gates all cred­i­ble claims of mis­use.

    ...

    After the Pega­sus Project was pub­lished in July, doc­u­ment­ing cas­es of abuse of NSO tech­nol­o­gy by gov­ern­ment clients, Németh approached Cit­i­zen Lab through an acquain­tance and asked the researchers to analyse his phones. The researchers found traces of the spy­ware on the devices, prompt­ing Németh to alert Direkt36. The media out­let then asked experts at Amnesty Tech, the secu­ri­ty lab of AI, to con­duct a sec­ond analy­sis of the phones. Amnesty’s foren­sic analy­sis showed that Németh’s two phones were suc­cess­ful­ly hacked with Pega­sus spy­ware, one from 1–9 July 2021 and the oth­er from 5–9 July.

    Dur­ing this peri­od, Németh was in Hun­gary after return­ing from a report­ing trip in south­ern Italy, where he was track­ing the move­ments of Mészáros.

    “Amnesty Tech’s con­fir­ma­tion of a Pega­sus infec­tion on Dániel Németh’s device is yet anoth­er out­ra­geous exam­ple of how NSO Group’s spy­ware is being used as a tool to silence jour­nal­ists,” said Likhi­ta Baner­ji, a researcher at Amnesty Tech.

    A secu­ri­ty offi­cer for­mer­ly with one of Hungary’s intel­li­gence ser­vices told Direkt36 that, accord­ing to his knowl­edge, Hun­gar­i­an ser­vices start­ed using Pega­sus in 2018. The Hun­gar­i­an gov­ern­ment has not denied that it uses Pega­sus, nor did it deny the sur­veil­lance of the peo­ple Direkt36 has report­ed about.

    John Scott-Rail­ton, a senior researcher at Cit­i­zen Lab, said the case showed the way in which the Hun­gar­i­an gov­ern­ment was seek­ing to tar­get “polit­i­cal­ly incon­ve­nient” peo­ple who were report­ing on indi­vid­u­als close to the gov­ern­ment.

    “Yet again, this is tar­get­ing a jour­nal­ist. There is no excuse for it and no rea­son to believe that Hun­gary is using it for legit­i­mate pur­pos­es. It seems pret­ty clear what is going on,” Scott-Rail­ton said.

    On Németh’s most recent mis­sion – which involved two trips to Naples, Italy – he had decid­ed to leave his usu­al iPhone at home, and relied instead on an old­er device with a pre­paid sim card. The phone had not been active in so long that he was forced to reac­ti­vate the sim. The very next day, foren­sic analy­sis shows, that phone was also hacked.

    ———

    “Phones of jour­nal­ist who tracked Vik­tor Orban’s child­hood friend infect­ed with spy­ware” by Stephanie Kirch­gaess­ner; The Guardian; 09/21/2021

    “A secu­ri­ty offi­cer for­mer­ly with one of Hungary’s intel­li­gence ser­vices told Direkt36 that, accord­ing to his knowl­edge, Hun­gar­i­an ser­vices start­ed using Pega­sus in 2018. The Hun­gar­i­an gov­ern­ment has not denied that it uses Pega­sus, nor did it deny the sur­veil­lance of the peo­ple Direkt36 has report­ed about.”

    Hun­gary isn’t even deny­ing it. Nor are they cit­ing a ‘nation­al secu­ri­ty’ inter­est. You have to won­der if that’s part of a tac­tic to intim­i­date jour­nal­ists and let them know they can expect to be hacked, or if its just a reflec­tion of Orban’s sense of impuni­ty. Either way, it’s pret­ty clear Orban’s gov­ern­ment intends to keep extreme­ly close tabs on Németh’s where­abouts and com­mu­ni­ca­tions. They lit­er­al­ly hacked an old­er phone the day after it was acti­vat­ed:

    ...
    After the Pega­sus Project was pub­lished in July, doc­u­ment­ing cas­es of abuse of NSO tech­nol­o­gy by gov­ern­ment clients, Németh approached Cit­i­zen Lab through an acquain­tance and asked the researchers to analyse his phones. The researchers found traces of the spy­ware on the devices, prompt­ing Németh to alert Direkt36. The media out­let then asked experts at Amnesty Tech, the secu­ri­ty lab of AI, to con­duct a sec­ond analy­sis of the phones. Amnesty’s foren­sic analy­sis showed that Németh’s two phones were suc­cess­ful­ly hacked with Pega­sus spy­ware, one from 1–9 July 2021 and the oth­er from 5–9 July.

    Dur­ing this peri­od, Németh was in Hun­gary after return­ing from a report­ing trip in south­ern Italy, where he was track­ing the move­ments of Mészáros.

    ...

    On Németh’s most recent mis­sion – which involved two trips to Naples, Italy – he had decid­ed to leave his usu­al iPhone at home, and relied instead on an old­er device with a pre­paid sim card. The phone had not been active in so long that he was forced to reac­ti­vate the sim. The very next day, foren­sic analy­sis shows, that phone was also hacked.
    ...

    And note how the gov­ern­ment does­n’t even both­er to explain why Németh was hacked, despite not deny­ing it hap­pened. That’s all part of why it’s hard to avoid sus­pi­cions that that was any­thing oth­er than a favor by Vik­tor Orban for a wealthy and pow­er­ful friend who hap­pened to be the tar­get of Németh’s inves­ti­ga­tion:

    ...
    The hacks occurred in July 2021 while Németh was report­ing on the where­abouts of one of the prime min­is­ter, Vik­tor Orbán’s, child­hood friends, Lor­inc Mészáros, a for­mer gas fit­ter who has become one of Hungary’s rich­est men in the past few years.

    Mészáros has built a busi­ness empire that sprawls across mul­ti­ple sec­tors since Orbán came to pow­er in 2010, and his com­pa­nies often win lucra­tive gov­ern­ment ten­ders. In 2019, Forbes named him the rich­est per­son in Hun­gary.

    Orbán has repeat­ed­ly declined to com­ment on Mészáros’s mete­oric rise in for­tunes, say­ing pol­i­tics and busi­ness should be kept sep­a­rate. Mészáros shuns media atten­tion, but in a 2014 inter­view with a Hun­gar­i­an out­let attrib­uted his suc­cess to “God, luck and Vik­tor Orbán”.

    A spokesper­son for Mészáros’s com­pa­ny said in a state­ment: “Mr Mészáros does not pay atten­tion to nei­ther Dániel Németh, nor any oth­er paparazzi’s activ­i­ties, where­abouts or inci­dents relat­ed to them.”
    ...

    Keep in mind it’s pos­si­ble Orban ordered the sur­veil­lance on his own, with­out Mészáros request­ing it. After all, if Mészáros made his for­tune due to Orban’s will, odds are there’s some incred­i­ble graft that goes along with that sto­ry. Orban prob­a­bly has a lot of Mészáros-relat­ed activ­i­ties he’d pre­fer remain out of site. But, again, while we have no idea who actu­al­ly ordered the hacks and why, what we do know is that the sys­tem is per­fect­ly set up to enable pri­vate ‘favor’ abus­es. Because we know there’s vir­tu­al­ly no over­sight of how these tools are used. NSO Group makes that clear in its pub­lic ‘defens­es’ every time one of these abuse sto­ries hit the wires. It’s sole­ly up to the gov­ern­ment client on whether or not abus­es take place and whether or not those abus­es are done for gov­ern­ment inter­ests or pri­vate inter­ests:

    ...
    Hun­gar­i­an law pro­vides that in cas­es where nation­al secu­ri­ty is at stake, the intel­li­gence ser­vices can order sur­veil­lance with no judi­cial over­sight, only the sig­na­ture of the min­is­ter of jus­tice. Hungary’s jus­tice min­is­ter, Judit Var­ga, has declined to com­ment, but said: “Every coun­try needs such tools”.

    ...

    NSO has said its spy­ware is intend­ed to be used only by licensed law enforce­ment agen­cies against sus­pect­ed ter­ror­ists and crim­i­nals. The com­pa­ny has said that it does not have access to data of its cus­tomers’ tar­gets and that it inves­ti­gates all cred­i­ble claims of mis­use.
    ...

    How many of Orban’s friends around the globe have qui­et­ly asked for hack­ing ‘favors’ of this nature? That prob­a­bly depends to some extent on what types of geolo­ca­tion restric­tions NSO Group imposed on Hun­gary’s con­tract. Recall how NSO Group will grant per­mis­sions to hack phones from par­tic­u­lar coun­tries for a client, but while we’ve been told that phones from a few coun­tries like the US are off lim­its, we’ve nev­er real­ly heard about oth­er geolo­ca­tion restric­tions. In oth­er words, we don’t have a good sense of how much of the rest of the world for which Vik­tor Orban’s gov­ern­ment could be grant­ed hack­ing per­mis­sions. Can he only hack inside Hun­gary? How about neigh­bor­ing coun­tries? How about dis­tant coun­tries half way across the world? We have no idea.

    But what we do know is that dozens of gov­ern­ments around the world are NSO Group clients, so if some­one wants to hack you, odds are there are mul­ti­ple gov­ern­ments out there with per­mis­sions from NSO Group to do exact­ly that. And while we don’t know if gov­ern­ments around the world are car­ry­ing out hack­ing ‘favors’ for pow­er­ful pri­vate inter­ests using NSO Group’s tools, we can be con­fi­dent the com­pa­ny is doing absolute­ly noth­ing to pre­vent it because it’s doing absolute­ly noth­ing to pre­vent any client abus­es, whether or not that gov­ern­ment client is con­duct­ing the hack for its own pur­pos­es or on behalf of some pow­er­ful pri­vate friends. We can be con­fi­dent of all this because the com­pa­ny keep remind­ing us of how it does noth­ing to pre­vent abus­es every time there’s anoth­er abuse sto­ry. It’s the kind of cor­po­rate ali­bi that could only leave NSO Group’s guilty clients feel­ing extra embold­ened to get­ting guilti­er.

    Posted by Pterrafractyl | September 24, 2021, 8:09 pm

  10. Here’s a sto­ry relat­ed to the Microsoft Exchange mega-hack that could end up becom­ing part of the Jan­u­ary 6 Capi­tol insur­rec­tion sto­ry. Or per­haps become part of just anoth­er GOP cor­rup­tion scan­dal. We’ll see, but it’s the kind of hack­ing sto­ry that has immense poten­tial to go in a lot of dif­fer­ent due to the fact the that vic­tim in this sto­ry hap­pens to be the GOP. And when an noto­ri­ous­ly cor­rupt enti­ty gets hacked, it’s safe to assume the hack­ers are in pos­ses­sion of at least some evi­dence of that cor­rup­tion. Noth­ing tells the tale of wrong­do­ing quite like an emails trail.

    Specif­i­cal­ly, the Repub­li­can Gov­er­nors Asso­ci­a­tion (RGA) announced that it was a vic­tim of the Exchange serv­er hack first announced in March of this year. The RGA said it was hit at some point between Feb­ru­ary and March of 2021.

    It’s unclear about the extent of what was stolen. The group appeared to be min­i­miz­ing the poten­tial impact by imply­ing only a small por­tion of its email: “RGA deter­mined that the threat actors accessed a small por­tion of RGA’s email envi­ron­ment between Feb­ru­ary 2021 and March 2021, and that per­son­al infor­ma­tion may have been acces­si­ble to the threat actor(s) as a result.”

    It’s the kind of vague assur­ance that could mean almost any­thing. After all, by what met­ric are they mea­sur­ing a “small por­tion of the RGA’s email envi­ron­ment”? Keep in mind that nature of the Exchange hack, where hack­ers have the poten­tial to not just steal the emails stored in the Exchange serv­er but take con­trol of the com­put­er host­ing the Exchange serv­er itself and spread across the vic­tim’s net­work. The scale of the poten­tial dam­age is so vast that there’s no mean­ing­ful way to inter­pret what “a small por­tion of RGA’s email envi­ron­ment” actu­al­ly means in a tech­ni­cal sense. For all we know it’s just the RGA’s way of sug­ar­coat­ing the dam­age by vague­ly point­ing out that only the emails were stolen and the rest of their net­work was­n’t ran­sacked. We’re left to guess, but we know at least some infor­ma­tion was stolen.

    Beyond that, we can be pret­ty con­fi­dent about the con­tent of any stolen emails. At least some of them. This was Feb­ru­ary, after all, when the ‘stolen elec­tion’ and state elec­tion audits would have been front and cen­ter for entire Repub­li­can Par­ty, more so than even today. So what did the hack­ers actu­al­ly get their hands on? We’re told some peo­ple had sen­si­tive per­son­al infor­ma­tion like Social Secu­ri­ty num­bers stolen, but what would sen­si­tive embar­rass­ing emails reveal­ing the intra-par­ty strug­gle over how to pro­ceed with the ‘stolen elec­tion’ nar­ra­tive tak­ing place inside the RGA at the time. There’s no indi­ca­tion such emails were obtained but we would­n’t expect an indi­ca­tion if they were. At least not from the RGA. If we’re going to receive any indi­ca­tion the hack­ers stole embar­rass­ing or sen­si­tive emails it’s the hack­ers who are going to reveal it.

    Adding to the polit­i­cal dynam­ic here is the fact that Microsoft and the US gov­ern­ment have already attrib­uted the Exchange hack to a state-backed Chi­nese hack­er group, Hafni­um. At least the ini­tial Exchange hack that report­ed­ly start­ed on or around Jan­u­ary 6. Recall how we are told that “Hafni­um” was qui­et­ly exploit­ed the vul­ner­a­bil­i­ty from ear­ly Jan­u­ary up until March, when the vul­ner­a­bil­i­ty was announced by Microsoft and crim­i­nal hack­er groups appar­ent­ly then went on a glob­al spree hit­ting vir­tu­al­ly every­one remain­ing vul­ner­a­ble Exchange serv­er con­nect­ed to the inter­net. So based on that time­line and the fact that the RGA hack took place in Feb­ru­ary, it would sug­gest that the RGA was hit by the ini­tial Hafni­um hack­er group.

    So while the attri­bu­tion of the orig­i­nal hack to a state-backed Chi­nese hack­ing crew nev­er appeared to be based on any evi­dence and instead appeared to be the lat­est instance of a cyber­at­tri­bu­tion being con­ve­nient­ly made out of thin air, the fact that it was offi­cial­ly attrib­uted to Chi­na is the kind of fun fact that poten­tial­ly plays into the GOP’s whole ‘Chi­nese hack­ers stole the elec­tion from Trump’ nar­ra­tive. A nar­ra­tive the RGA was prob­a­bly still ham­mer­ing out dur­ing the time those emails were stolen.

    How will the attri­bu­tion to Chi­nese hack­ers play into how this hack­er sto­ry plays out? That pre­sum­ably depends a lot on whether or not this becomes a big­ger sto­ry which, in turn, like­ly depends on whether or not the hack­ers end up expos­ing some of those stolen emails and whether nor not the emails hap­pen to be scan­dalous­ly embar­rass­ing:

    Bleep­ing Com­put­er

    Repub­li­can Gov­er­nors Asso­ci­a­tion email serv­er breached by state hack­ers

    By Sergiu Gat­lan
    Sep­tem­ber 20, 2021

    The Repub­li­can Gov­er­nors Asso­ci­a­tion (RGA) revealed in data breach noti­fi­ca­tion let­ters sent last week that its servers were breached dur­ing an exten­sive Microsoft Exchange hack­ing cam­paign that hit orga­ni­za­tions world­wide in March 2021.

    RGA is a US polit­i­cal orga­ni­za­tion and a tax-exempt 527 group that pro­vides Repub­li­can can­di­dates with the cam­paign resources need­ed to get elect­ed as gov­er­nors across the coun­try.

    SSNs and pay­ment infor­ma­tion exposed

    Fol­low­ing an inves­ti­ga­tion start­ed after March 10, “RGA deter­mined that the threat actors accessed a small por­tion of RGA’s email envi­ron­ment between Feb­ru­ary 2021 and March 2021, and that per­son­al infor­ma­tion may have been acces­si­ble to the threat actor(s) as a result.”

    Even though the RGA said that, at first, it was­n’t able to dis­cov­er if any per­son­al infor­ma­tion was impact­ed, a sub­se­quent “thor­ough data min­ing effort to iden­ti­fy poten­tial­ly impact­ed indi­vid­u­als” revealed that names, Social Secu­ri­ty num­bers, and pay­ment card infor­ma­tion were exposed in the attack.

    RGA dis­cov­ered that indi­vid­u­als affect­ed by this data breach had their per­son­al infor­ma­tion exposed on June 24 and com­plet­ed its “data min­ing” efforts on Sep­tem­ber 1.

    “Once poten­tial­ly impact­ed indi­vid­u­als were iden­ti­fied, RGA worked to iden­ti­fy address­es and engage a ven­dor to pro­vide call cen­ter, noti­fi­ca­tion, and cred­it mon­i­tor­ing ser­vices,” RGA told impact­ed indi­vid­u­als in a breach let­ter sent on Sep­tem­ber 15.

    “RGA is also offer­ing you two (2) years of com­pli­men­ta­ry cred­it mon­i­tor­ing and iden­ti­ty restora­tion ser­vices with Exper­ian. RGA has also noti­fied the Fed­er­al Bureau of Inves­ti­ga­tion, cer­tain state reg­u­la­tors, and the con­sumer report­ing agen­cies of this inci­dent as required.”

    ...

    Abused for data theft, to deploy ran­somware and cryp­tomin­ers

    The mas­sive scale hack­ing cam­paign RGA refers to in its data breach noti­fi­ca­tion let­ter tar­get­ed more than a quar­ter of a mil­lion Microsoft Exchange servers, owned by tens of thou­sands of orga­ni­za­tions around the world.

    The attack­ers exploit­ed four zero-days (col­lec­tive­ly known as Prox­y­L­o­gon) in attacks tar­get­ing on-premis­es Microsoft Exchange servers in indis­crim­i­nate attacks against orgs from mul­ti­ple indus­try sec­tors world­wide, with the end goal of steal­ing sen­si­tive infor­ma­tion.

    Threat actors behind Prox­y­L­o­gon attacks have also been observed deploy­ing web shells, cryp­to­min­ing mal­ware, as well as DearCry and Black King­dom ran­somware pay­loads on hacked Exchange servers.

    After Microsoft dis­closed the attacks in ear­ly March, Slo­vak inter­net secu­ri­ty firm ESET spot­ted at least ten APT groups attack­ing vul­ner­a­ble Exchange servers.

    Microsoft said at the time that the Chi­nese state-spon­sored hack­ing group known as Hafni­um was behind some of these attacks.

    “His­tor­i­cal­ly, Hafni­um pri­mar­i­ly tar­gets enti­ties in the Unit­ed States for the pur­pose of exfil­trat­ing infor­ma­tion from a num­ber of indus­try sec­tors, includ­ing infec­tious dis­ease researchers, law firms, high­er edu­ca­tion insti­tu­tions, defense con­trac­tors, pol­i­cy think tanks and NGOs,” Microsoft said.

    In July, the com­pa­ny’s attri­bu­tion was con­firmed when the US and allies, includ­ing the Euro­pean Union, the Unit­ed King­dom, and NATO, offi­cial­ly blamed Chi­na for this wide­spread Exchange hack­ing cam­paign.

    The Biden admin­is­tra­tion attrib­uted “with a high degree of con­fi­dence that mali­cious cyber actors affil­i­at­ed with PRC’s MSS con­duct­ed cyber espi­onage oper­a­tions uti­liz­ing the zero-day vul­ner­a­bil­i­ties in Microsoft Exchange Serv­er dis­closed in ear­ly March 2021.”

    ————

    “Repub­li­can Gov­er­nors Asso­ci­a­tion email serv­er breached by state hack­ers” by Sergiu Gat­lan; Bleep­ing Com­put­er; 09/20/2021

    “Fol­low­ing an inves­ti­ga­tion start­ed after March 10, “RGA deter­mined that the threat actors accessed a small por­tion of RGA’s email envi­ron­ment between Feb­ru­ary 2021 and March 2021, and that per­son­al infor­ma­tion may have been acces­si­ble to the threat actor(s) as a result.””

    The hack­ers just accessed a small por­tion of the RGA’s email envi­ron­ment, and maybe some per­son­al infor­ma­tion was stolen. It’s a remark­ably down­played state­ment. Noth­ing to wor­ry out­side of con­cerns about stolen Social Secu­ri­ty or cred­it card infor­ma­tion. But, of course, for an orga­ni­za­tion like the RGA, cred­it card and social secu­ri­ty infor­ma­tion isn’t the kind of sen­si­tive infor­ma­tion they have to wor­ry about.

    It’s also rather notable that the RGA isn’t yet mak­ing hay about the alleged Chi­nese ori­gin of the hack. Isn’t this kind of free pro­pa­gan­da? Why isn’t more being made of it? Instead, we get this vague, terse state­ment about some pos­si­ble stolen per­son­al infor­ma­tion from a small por­tion of the Exchange envi­ron­ment.

    It rais­es the ques­tion of how we might expect the RGA to react if it did indeed deter­mine that high­ly embar­rass­ing emails were stolen. Would we expect them to pre­emp­tive­ly go on the offen­sive and make a huge sto­ry about Chi­nese black­mail in or to mit­i­gate the pos­si­ble future dam­age? Or would we expect the kind of down­played response we actu­al­ly got? That’s the big ques­tion raised by this sto­ry. When the GOP pass­es up an oppor­tu­ni­ty for bom­bast and blus­ter we have to ask why.

    Posted by Pterrafractyl | September 26, 2021, 6:27 pm

  11. Here’s a pair of arti­cles about anoth­er emerg­ing NSO Group-relat­ed scan­dal. It’s the kind of scan­dal that under­scores what is per­haps the great­est dan­ger of the explo­sion this glob­al mar­ket­place for cut­ting-edge spy­ware sold to gov­ern­ment: beyond the fact that there’s not guar­an­tee the spy­ware is going to be exclu­sive­ly used for legit­i­mate gov­ern­ment inter­ests, there’s also no guar­an­tee the spy­ware is nec­es­sar­i­ly going to be used by the gov­ern­ments them­selves. As NSO Group reit­er­ates every time there’s a new scan­dal about a client abus­es its toolk­its, the com­pa­ny isn’t track­ing who its clients tar­get. And that means there’s noth­ing to pre­vent those gov­ern­ment clients from lend­ing these tools out to pri­vate inter­ests. As we saw with the sto­ry of a Hun­gar­i­an jour­nal­ist who had his phone hacked with Pega­sus in what appeared to be retal­i­a­tion for his report­ing on one of Vik­tor Orban’s close friends, there real­ly does­n’t appear to be any con­trol over not just how these tools are actu­al­ly used but on whose behalf.

    And that brings us to the fol­low reports of a let­ter sent by Mex­i­co’s pres­i­dent to the Israeli gov­ern­ment ask­ing for the extra­di­tion of a for­mer top Mex­i­can secu­ri­ty offi­cial, Tomás Zerón, who fled to Israel in August 2019. It’s sus­pect­ed Zerón has con­nec­tions to NSO Group. Recall how Mex­i­co was NSO Group’s first for­eign client start­ing back in 2011.

    Yes, NSO Group’s first for­eign client is ask­ing Israel to extra­dite Mex­i­co’s Why the inter­est for­mer top Mex­i­can secu­ri­ty offi­cial, who also hap­pens to have ties to NSO Group. It rais­es the obvi­ous ques­tion of whether or not Zerón fled Mex­i­co for rea­sons hav­ing to do with Mex­i­co’s pur­chase of NSO Group’s Pega­sus spy­ware.

    So what are the charges against Zerón? It appears to be focused on the role Zerón played in over­see­ing the crim­i­nal inves­ti­ga­tion agency of the Attor­ney General’s Office. In par­tic­u­lar, Zerón over­sight of the foren­sic work done on the inves­ti­ga­tion of the 2014 dis­ap­pear­ance and mur­der of 43 Mex­i­can col­lege stu­dents. The stu­dents all hailed from a train­ing col­lege with a his­to­ry of left-wing activism and the stu­dents report­ed­ly reg­u­lar­ly took part in protests. The stu­dents were trav­el­ing back to their col­lege when they were con­front­ed by munic­i­pal police who opened fire on the bus­es. 43 stu­dents van­ished after the clash and are sus­pect of hav­ing been hand­ed over to local drug car­tels by the police offi­cers. Zerón’s inves­ti­ga­tion had long been crit­i­cized by the fam­i­lies of the stu­dent. Two inde­pen­dent teams of experts have cast doubt on the insis­tence of Mex­i­can offi­cials that the stu­dents bod­ies were incin­er­at­ed in a huge fire at a trash dump. Addi­tion­al­ly, many of the sus­pects arrest­ed in the case were lat­er released, but claimed they had been tor­tured by police or the mil­i­tary. So the over­all inves­ti­ga­tion into Zerón focus­es on what is now believed to be an inten­tion­al­ly botched inves­ti­ga­tion that lit­er­al­ly tor­tured wit­ness­es as part of the cor­rupt cov­er up.

    It’s a gen­uine­ly hor­rif­ic case point to the depths of the cor­rup­tion inside the Mex­i­can gov­ern­ment. But it also demon­strates the depths of the ties between the Mex­i­can gov­ern­ment and the drug car­tels that Mex­i­co was osten­si­bly allowed to by NSO Group’s Pega­sus soft­ware to com­bat. That’s why we have to ask: is the gov­ern­ment of Mex­i­co shar­ing Pega­sus with the car­tels its in bed with? And why aren’t sim­i­lar ques­tions valid for every oth­er cor­rupt gov­ern­ment with access to these tools?

    But as we’re going to see in the sec­ond arti­cle except below from the Dai­ly Beast, there sus­pi­cions that NSO Group’s tools could have been shared with drug car­tels aren’t just cir­cum­stan­tial. Because it turns out there’s a Mex­i­co drug car­tel con­nec­tion with the sto­ry of how NSO Group first got Mex­i­co as a client back in 2011. Yep!

    And there’s a rather wild twist to this sto­ry. The kind of twist that, at this point, should­n’t real­ly be all that sur­pris­ing: one of the fig­ures who played a key role in con­nect­ing the Mex­i­can gov­ern­ment to NSO Group was none oth­er than Elliot Broidy. It’s a name that’s become increas­ing­ly famil­iar as the guy has man­aged to pop up in con­nec­tion with almost every Trump-relat­ed scan­dal over the past four years. For exam­ple, recall how Broidy, the for­mer finance chair for the RNC, has simul­ta­ne­ous­ly been oper­at­ing as a for­eign agent. For exam­ple, Broidy worked close­ly with George Nad­er as for­eign agents for the UAE and Sau­di Ara­bia and was deeply enmeshed in many of the under-inves­ti­gat­ed aspects of the 2016 Trump cam­paign shenani­gans involv­ing. Also recall how Nad­er, Erik Prince, and Psy­Group’s Joel Zamel were involved in a secret Saudi/UAE-fund­ed effort to help get Don­ald Trump elect­ed in 2016 via tac­tics like social media manip­u­la­tion cam­paigns. Broidy, like his part­ner Nad­er, real­ly is an inter­na­tion­al man of mys­tery. The kind of sor­did scan­dalous mys­tery fit­ting for a sto­ry about cor­rupt Mex­i­can spy­ware deals.

    And as we’re going to see, Broidy’s his­to­ry of sor­did mys­ter­ies includes the mys­tery of the role in played in facil­i­tat­ing Mex­i­co’s first NSO Group con­tract back in 2011. Broidy con­tin­ues to deny he played any role at all and that any such talk is libelous. He wants not part of it. Per­haps because, in the end, it sounds like he was ulti­mate­ly robbed of being part of the final deal after his part­ner in the deal dis­cov­ered Broidy was plan­ning on going behind his back and cre­at­ing a sep­a­rate deal. It was a tri-mid­dle-man deal: Broidy, his for­mer employ­ee Matn Caspi — whose Israeli tech­nol­o­gy export com­pa­ny had already signed up to help export NSO Group’s tech­nol­o­gy when he reached out to Broidy about Mex­i­co — and “Mr Lam­bo” Jose Susumo Azano Mat­sura. Azano is the mid­dle-man on the Mex­i­can side. He owned the tech­nol­o­gy com­pa­ny that end­ed up get­ting the NSO Group license for Pega­sus. It was Azano’s com­pa­ny that licensed Pega­sus to the Mex­i­can mil­i­tary.

    Azano also hap­pens to have appar­ent ties to Mex­i­can drug traf­fick­ers and was under FBI inves­ti­ga­tion in rela­tion to that less than a decade before they were putting togeth­er this deal. And while Broidy was ulti­mate­ly cut out of this tri-mid­dle-man arrange­ment, Azano was­n’t. His com­pa­ny got the pow­er to issue Pega­sus licens­es in Mex­i­co, which rais­es basic ques­tions like whether or not his com­pa­ny had access to the soft­ware itself. Was Azano’s com­pa­ny effec­tive­ly act­ing as a proxy over­seer of how Pega­sus was being used? We have no idea, and NSO Group isn’t say­ing whether or not it has sim­i­lar mid­dle-man deals with oth­er client states. But whether or not Azano’s com­pa­ny some­how played a role in mak­ing Pega­sus avail­able to Mex­i­co’s drug car­tels, it isn’t real­ly nec­es­sary. Mex­i­co’s gov­ern­ment is clear­ly in bed deeply enough with the car­tels that it’s prob­a­bly ready and will­ing to just oper­ate Pega­sus on the car­tels’ behalf. They’re part­ners. So as we watch to see how the Mex­i­can extra­di­tion request of Tomás Zerón plays out and whether or not new insights are learned about the slaugh­ter of those stu­dents, it’s going to be worth keep­ing in mind that this might be an NSO-relat­ed sto­ry for more rea­sons than just the fact that Zerón fled to Israel and hap­pens to know the NSO Group founders. It’s a sto­ry about the Mex­i­can gov­ern­ment being deeply in bed with the drug car­tels at the same time NSO Group was sell­ing Mex­i­co the kind of super spy­ware car­tels would most def­i­nite­ly kill for:

    Asso­ci­at­ed Press

    Mex­i­can Pres­i­dent Asks Ben­nett to Extra­dite Ex-offi­cial With Links to Israeli NSO Spy­ware

    Oct. 1, 2021 7:47:37 PM

    MEXICO CITY (AP) — Mexico’s pres­i­dent has revealed he sent a let­ter to the Israeli gov­ern­ment ask­ing for the extra­di­tion of a for­mer top secu­ri­ty offi­cial, Tomás Zerón.

    Zerón was the head of the fed­er­al inves­ti­ga­tion agency at the time of the abduc­tion of 43 stu­dents in south­ern Mex­i­co in 2014. He is being sought on charges of tor­ture and cov­er­ing up those dis­ap­pear­ances.

    Zerón fled to Israel in August 2019, where he may have con­nec­tions to an Israeli firm that sold the Mex­i­can gov­ern­ment spy­ware dur­ing his time in office.

    The stu­dents from a rad­i­cal teach­ers’ col­lege were abduct­ed by local police in south­ern Guer­rero state who pre­sum­ably killed them and burned their bod­ies.

    Pres­i­dent Andrés Manuel López Obrador showed a copy of a let­ter he sent in Sep­tem­ber to Israeli Prime Min­is­ter Naf­tali Ben­nett, ask­ing him for help.

    ...

    Despite reports that Israel had expressed dis­in­ter­est in extra­dit­ing Zerón, Israel’s Ambas­sador to Mex­i­co, Zvi Tal, wrote in July that the process was mov­ing for­ward.

    “Israel does not take polit­i­cal con­sid­er­a­tions into account in extra­di­tion pro­ceed­ings,” Tal wrote. “The goal of the dia­logue between the respec­tive Israeli and Mex­i­can author­i­ties is to ensure that the extra­di­tion request is prop­er­ly sub­mit­ted and con­sid­ered. There has been no delay on the part of Israel.”

    Zerón over­saw the crim­i­nal inves­ti­ga­tion agency of the Attor­ney General’s Office and also its foren­sic work in the 2014 case. Most of the stu­dents’ bod­ies have nev­er been found, though burned bone frag­ments have been matched to three stu­dents.

    Zerón’s inves­ti­ga­tion had long been crit­i­cized by the fam­i­lies of the 43 stu­dents who dis­ap­peared in Sep­tem­ber 2014 after they were detained by local police in Iguala, in the south­ern state of Guer­rero. They were alleged­ly hand­ed over to a drug gang and slain, and have not been heard from since.

    Zerón was at the cen­ter of the government’s wide­ly crit­i­cized inves­ti­ga­tion, which has failed to defin­i­tive­ly deter­mine what hap­pened to the stu­dents. Two inde­pen­dent teams of experts have cast doubt on the insis­tence of Mex­i­can offi­cials that the stu­dents bod­ies were incin­er­at­ed in a huge fire at a trash dump.

    Many of the sus­pects arrest­ed in the case were lat­er released, and many claimed they had been tor­tured by police or the mil­i­tary.

    The sup­po­si­tion is that Zerón and oth­ers tor­tured wit­ness­es, ille­gal­ly detained sus­pects and mis­han­dled evi­dence to try to bring the inves­ti­ga­tion to a quick con­clu­sion or cov­er up what real­ly hap­pened.

    ————-

    “Mex­i­can Pres­i­dent Asks Ben­nett to Extra­dite Ex-offi­cial With Links to Israeli NSO Spy­ware”; Asso­ci­at­ed Press; 10/01/2021

    “The sup­po­si­tion is that Zerón and oth­ers tor­tured wit­ness­es, ille­gal­ly detained sus­pects and mis­han­dled evi­dence to try to bring the inves­ti­ga­tion to a quick con­clu­sion or cov­er up what real­ly hap­pened.”

    It’s not hard to see why Zerón is a prime sus­pect here. Not only were the stu­dents ini­tial attacked by the police but the wit­ness­es were alleged­ly tor­tured. It was the worst kind of cov­er up. And then he fled the coun­try. As the say­ing goes, it’s the cov­er up, not the crime. But when the cov­er up is this open­ly vio­lent and cor­rupt, it’s also still very much the crime. Some­thing hor­rid remains hid­den. A rela­tion­ship between the Mex­i­can gov­ern­ment and drug car­tels that’s prob­a­bly even worse than sus­pect­ed:

    ...
    Zerón’s inves­ti­ga­tion had long been crit­i­cized by the fam­i­lies of the 43 stu­dents who dis­ap­peared in Sep­tem­ber 2014 after they were detained by local police in Iguala, in the south­ern state of Guer­rero. They were alleged­ly hand­ed over to a drug gang and slain, and have not been heard from since.
    ...

    And while there’s not yet any direct con­nec­tion between the 2014 slay­ings of those 43 stu­dents and Mex­i­co’s NSO Group con­tract, it’s hard to ignore the fact that Zerón had the kind of job that would have like­ly giv­en him access to Pega­sus, is known to have ties to the founders of NSO Group, and end­ed up flee­ing to Israel. It’s the kind of con­stel­la­tion of facts demand­ing that we ask what the NSO Group angle is to the slay­ings of those 43 stu­dents.

    And that brings us to the fol­low­ing Dai­ly Beast sto­ry from a cou­ple months ago describ­ing the pre­vi­ous­ly unknown role played by Elliot Broidy in bro­ker­ing the ini­tial NSO Group con­tract with Mex­i­co. One of three mid­dle-men between NSO Group and the Mex­i­can gov­ern­ment. Broidy’s for­mer employ­ee Matan Caspi reached out to him in 2010 on behalf of Caspi’s Israeli tech­nol­o­gy export com­pa­ny hop­ing to use Broidy’s con­tacts in Mex­i­co to export Pega­sus. Broidy points him towards “Mr. Lam­bo” Jose Susumo Azano Mat­sura, whose com­pa­ny Secu­ri­ty Track­ing Devices SA de CV, end­ed up get­ting the exclu­sive right to sell NSO Group licens­es in Mex­i­co. Azano then licens­es it to the Mex­i­can mil­i­tary for a high­er price. That’s the orig­i­nal tri-mid­dle-man rela­tion­ship. The fact that Azano had been under US inves­ti­ga­tions in asso­ci­a­tion with Mex­i­can drug traf­fick­ers less than a decade ear­li­er was­n’t a deal­break­er.

    But Broidy appar­ent­ly nev­er got his cut, after he tried to cut Caspi out of the deal and Caspi cut him out first. At least that’s what var­i­ous par­ties claimed in a law­suit that erupt­ed over the kick­backs in 2015. Broidy claims he knows absolute­ly noth­ing about NSO Group or any of this and it’s all lies:

    The Dai­ly Beast

    Scan­dal, Spy­ware, and 69 Pounds of Weed

    Affi­davits, con­tracts, and inter­nal emails reveal the insane back­sto­ry of the con­tro­ver­sy-rid­den NSO Group’s first big over­seas deal.

    Seth Het­te­na
    Updat­ed Aug. 05, 2021 12:07PM ET / Pub­lished Aug. 03, 2021 4:12AM ET

    Ten years ago, long before it found itself at the cen­ter of a glob­al scan­dal, Israeli spy­ware mak­er NSO Group was just a small, ambi­tious start­up with no name recog­ni­tion, and no clients out­side of Israel.

    It wasn’t long before NSO caught a huge break. In 2011, a year after it was found­ed, NSO land­ed its first over­seas client: Mex­i­co. That deal would gen­er­ate tens of mil­lions of dol­lars in rev­enue and open the door for the com­pa­ny to sell its soft­ware, known as Pega­sus, to the Unit­ed Arab Emi­rates, Sau­di Ara­bia, India, and Rwan­da, among oth­ers. NSO soon faced alle­ga­tions that Pega­sus was being used as a tool of repres­sion against jour­nal­ists, human-rights activists, and politi­cians.

    Amid the furor over the abuse of NSO’s pow­er­ful spy­ware, the sto­ry of how the com­pa­ny land­ed its first con­tract with Mex­i­co has large­ly escaped atten­tion. It’s a deal that might nev­er have come togeth­er were it not for the behind-the-scenes efforts of an influ­en­tial, twice-con­vict­ed Repub­li­can power­bro­ker: Elliott Broidy.

    A top GOP fundrais­er who received a par­don from Pres­i­dent Don­ald Trump for his role in a con­spir­a­cy to vio­late for­eign lob­by­ing laws, Broidy played an impor­tant ear­ly role in NSO’s deal with Mex­i­co. Through Broidy, NSO found a crit­i­cal inter­me­di­ary in Mex­i­co, a well-con­nect­ed, wealthy busi­ness­man who would bring Pega­sus to the atten­tion of the very top of the country’s lead­er­ship, accord­ing to doc­u­ments filed in an Israeli court.

    An attor­ney for Broidy warned, pri­or to pub­li­ca­tion, that The Dai­ly Beast was pur­su­ing a “false and poten­tial­ly defam­a­to­ry” arti­cle. “Mr. Broidy has nev­er done busi­ness with NSO Group, nor has he ever been com­pen­sat­ed by them,” attor­ney David Camel wrote. He called The Dai­ly Beast’s descrip­tion of events, as laid out in an affi­davit filed by one of Broidy’s for­mer employ­ees, “false.”

    Affi­davits, NSO con­tracts and emails from com­pa­ny offi­cials and out­side sales­men that were filed in a law­suit in Tel Aviv and reviewed by The Dai­ly Beast lay bare the Israeli spy­ware maker’s deal with Mex­i­co, some details of which remain a state secret in Israel, and open a rare win­dow into NSO’s opaque busi­ness prac­tices. Broidy was nei­ther a par­ty nor a wit­ness to the Israeli law­suit, Camel said.

    The doc­u­ments do, how­ev­er, raise trou­bling ques­tions about the Israeli spy­ware maker’s recent claim that its prod­ucts are intend­ed for “the sole use of thor­ough­ly vet­ted and approved gov­ern­men­tal agen­cies charged with main­tain­ing pub­lic safe­ty and secu­ri­ty.” Broidy’s con­tact in Mexico—a man nick­named “Mr. Lam­bo” for his love of Ital­ian sports cars—later served time in a U.S. fed­er­al prison for mak­ing ille­gal for­eign con­tri­bu­tions in an Amer­i­can elec­tion. A doc­u­ment filed by fed­er­al pros­e­cu­tors in San Diego revealed that “Mr. Lam­bo” was inves­ti­gat­ed by U.S. author­i­ties for a host of oth­er crimes for which he wasn’t charged, includ­ing drug smug­gling.

    ...

    Accord­ing to an affi­davit filed in court in Tel Aviv, Broidy first learned of NSO and Pega­sus in 2010, when he was con­tact­ed by one of his for­mer employ­ees who had joined the NSO sales team. Matan Caspi had spent sev­er­al years work­ing at Broidy Cap­i­tal Man­age­ment in Los Ange­les. Part of his work involved sell­ing tech­nol­o­gy to Mex­i­co. Caspi returned to Israel where he co-found­ed Ray­zone Group, an Israeli cyber­se­cu­ri­ty firm that offers “bou­tique intel­li­gence-based solu­tions for nation­al agen­cies,” accord­ing to its web­site. Caspi did not reply to mes­sages sent to Ray­zone and his per­son­al email address­es for this arti­cle.

    In Octo­ber 2010, Caspi flew to Los Ange­les to meet Broidy and dis­cuss Pega­sus. “The meet­ing with Broidy was suc­cess­ful. Mr. Broidy expressed real inter­est in NSO’s prod­ucts and in the chances of suc­cess of sell­ing them to the Mex­i­can Army. It was con­clud­ed that he would try to use his con­nec­tions in order to pro­mote such a deal,” Caspi wrote in an affi­davit filed in the Tel Aviv law­suit.

    In its approach to Broidy’s Mex­i­can busi­ness asso­ciate and gov­ern­ment offi­cials in Mex­i­co, NSO relied almost entire­ly on out­side sales­men like Caspi, his part­ner, Eric Banoun, and, for a time, Broidy. NSO’s con­tract with Banoun, a copy of which is includ­ed in the court file, offered a 10 per­cent com­mis­sion on the sale of Pega­sus to Mex­i­co. A dis­pute over that sev­en-fig­ure com­mis­sion led to the fil­ing of the 2015 law­suit in Tel Aviv.

    At the time he met with NSO’s mar­keters, Broidy had admit­ted that he skirt­ed the law to advance his oth­er busi­ness inter­ests. He was await­ing sen­tenc­ing in a “pay-to-play” pen­sion scan­dal after plead­ing guilty in 2009 to a felony charge of reward­ing offi­cial mis­con­duct. He admit­ted show­er­ing New York state pen­sion offi­cials with more than $1 mil­lion in gifts in exchange for a $250 mil­lion invest­ment in his pri­vate equi­ty firm, Mark­stone Cap­i­tal Part­ners, which invest­ed heav­i­ly in Israel. (Broidy ulti­mate­ly received no jail time after a judge reduced the charge to attempt­ing to receive a reward for offi­cial mis­con­duct, a mis­de­meanor.)

    Despite his bag­gage, Broidy had con­nec­tions in the secu­ri­ty world that would prove invalu­able to NSO. His firm, Broidy Cap­i­tal Man­age­ment, invest­ed in, among oth­er things, pri­vate­ly held defense con­tract­ing com­pa­nies involved in sen­si­tive coun­tert­er­ror­ism and intel­li­gence ini­tia­tives, accord­ing to a dec­la­ra­tion Broidy filed in an unre­lat­ed U.S. law­suit. Accord­ing to Caspi’s court-filed affi­davit, Broidy did a good deal of busi­ness in Cen­tral and South Amer­i­ca and had a close con­nec­tion to a Mex­i­can busi­ness­man who sold equip­ment to Mexico’s intel­li­gence ser­vices.

    In response to a peti­tion from the Israeli busi­ness news­pa­per Cal­cal­ist, a judge in Tel Aviv ruled that Broidy’s name could be dis­closed, but the Mex­i­can businessman’s name and the coun­try he rep­re­sent­ed could not. The Israeli gov­ern­ment asked that the infor­ma­tion be kept secret for rea­sons of state secu­ri­ty and to pre­vent harm to Israel’s for­eign rela­tions.

    How­ev­er, affi­davits, emails, and NSO con­tracts filed by defen­dants in the Tel Aviv law­suit that were obtained by The Dai­ly Beast iden­ti­fy the busi­ness­man as Jose Susumo Azano Mat­sura, a reput­ed Mex­i­can bil­lion­aire of Japan­ese ori­gin, also known as “Mr. Lam­bo.” Azano sold eaves­drop­ping tech­nol­o­gy to Mex­i­co and oth­er for­eign gov­ern­ments. His com­pa­ny, Secu­ri­ty Track­ing Devices SA de CV, based in Jalis­co, Mex­i­co claimed to have 2,000 employ­ees in Mex­i­co and Sin­ga­pore. Azano did not respond to an email seek­ing com­ment.

    With Broidy’s “bless­ing,” Caspi wrote in his court-filed affi­davit, he con­tact­ed Azano and flew to Mex­i­co City in Decem­ber 2010 for the first of sev­er­al meet­ings with the Mex­i­can busi­ness­man.

    “Mr. Broidy has nev­er heard such an alle­ga­tion and has no rea­son to believe that it might be true,” Broidy’s attor­ney wrote in response to ques­tions from The Dai­ly Beast regard­ing his client’s rela­tion­ship with Azano.

    Azano would be the key for NSO that unlocked Mex­i­co, “which is known in the cyber indus­try as a big buy­er of defen­sive and offen­sive cyber prod­ucts,” Caspi wrote in an affi­davit. But it was no secret that the country’s drug car­tels had cor­rupt­ed the Mex­i­can gov­ern­ment, and tech­nol­o­gy like Pega­sus could just as eas­i­ly end up being used by a drug traf­fick­er as opposed to being used against one.

    Whether NSO knew it or not, the com­pa­ny had tak­en an extreme risk with Azano, its Mex­i­can part­ner. NSO was mar­ket­ing Pega­sus as a tool to help Mex­i­co win its bru­tal war against the country’s drug car­tels, but Azano had been under inves­ti­ga­tion by U.S. author­i­ties for years. Pros­e­cu­tors in San Diego filed doc­u­ments that reveal that a car stopped at the U.S.-Mexico bor­der in 1996 with 69 pounds of mar­i­jua­na was reg­is­tered to a known res­i­dence of Azano’s then wife. In 2004 and 2005, those same doc­u­ments reveal, FBI sur­veil­lance units observed Azano meet­ing with a known drug smug­gler; on one occa­sion, Azano drove to the meet­ing with the known drug smug­gler in a car with no license plates. (Pros­e­cu­tors in San Diego declined to bring charges relat­ed to drug smug­gling.)

    In 2014, FBI agents arrest­ed Azano at his water­front home in Coro­n­a­do, Cal­i­for­nia, for fun­nel­ing near­ly $600,000 in ille­gal polit­i­cal con­tri­bu­tions to buy influ­ence with San Diego’s next may­or. Azano was found guilty at tri­al in San Diego and was sen­tenced to three years in a U.S. fed­er­al prison.

    “Is this a guy who could be trust­ed with mil­i­tary secrets? I wouldn’t trust him to do my laun­dry,” said Phil Halpern, a for­mer Assis­tant U.S. Attor­ney in San Diego who pros­e­cut­ed Azano. “This is a sophis­ti­cat­ed busi­ness­man, adept at find­ing ways to cir­cum­vent the law.”

    Nev­er­the­less, NSO relied on Azano to sell its prod­ucts to the Mex­i­can gov­ern­ment. Includ­ed in the Tel Aviv court file was an unsigned, undat­ed copy of NSO’s con­tract with Azano’s com­pa­ny, Secu­ri­ty Track­ing Devices. In it, STD was grant­ed the exclu­sive right to dis­trib­ute NSO’s prod­ucts and ser­vices in Mex­i­co through the end of 2012 in exchange for $500,000. An NSO spokesper­son did not answer ques­tions about why the com­pa­ny did not sell direct­ly to the Mex­i­can gov­ern­ment or whether the com­pa­ny had sim­i­lar arrange­ments in oth­er coun­tries.

    “Due to con­trac­tu­al and nation­al secu­ri­ty con­sid­er­a­tions, NSO can­not con­firm or deny the iden­ti­ty of our gov­ern­ment cus­tomers, as well as the iden­ti­ty of cus­tomers of which we have shut down sys­tems,” the spokesper­son said in a state­ment pro­vid­ed by Mer­cury Pub­lic Affairs.

    After sev­er­al meet­ings with Caspi, Azano pre­pared a demon­stra­tion of Pega­sus in the spring of 2011 for “the sec­re­tary of defense and pres­i­dent,” accord­ing to an email from anoth­er of NSO’s sales­men that was sub­mit­ted to the Israeli court. Mexico’s pres­i­dent at the time was Felipe Calderon.

    Court doc­u­ments don’t spec­i­fy how NSO showed Mexico’s lead­er­ship what its soft­ware could do. A few years lat­er, NSO would report­ed­ly record a phone con­ver­sa­tion of the edi­tor of a Lon­don-based Arab news­pa­per to impress a client, the Unit­ed Arab Emi­rates. What­ev­er NSO showed Mexico’s lead­ers, it worked. Azano’s com­pa­ny quick­ly reached a deal to buy NSO’s Pega­sus for $15 mil­lion, accord­ing to court doc­u­ments. Azano then resold Pega­sus to the Mex­i­can mil­i­tary at an even high­er price, earn­ing him­self mil­lions of dol­lars in com­mis­sions, accord­ing to a 2012 report by Cal­cal­ist.

    From 2011 to 2018, Mex­i­co spent more than $60 mil­lion on NSO’s Pega­sus spy­ware, Mexico’s top secu­ri­ty offi­cial said Wednes­day. Pub­lic Safe­ty Sec­re­tary Rosa Icela Rodríguez said many of the con­tracts were signed with front com­pa­nies, which are often used in Mex­i­co to pay kick­backs or avoid tax­es. Last week, Mex­i­can offi­cials report­ed that bills for pro­grams like Pega­sus appeared to have includ­ed excess pay­ments that may have been fun­neled back to gov­ern­ment offi­cials as kick­backs.

    While NSO has nev­er pub­licly iden­ti­fied Mex­i­co as a client, com­pa­ny offi­cials have pri­vate­ly hint­ed that their soft­ware was used in the cap­ture of car­tel leader Joaquin Guz­man, bet­ter known as “El Chapo,” a claim some cyber­se­cu­ri­ty experts said was exag­ger­at­ed.

    In an overview pre­pared for Azano, NSO tout­ed the abil­i­ty of its Pega­sus soft­ware to crack the BlackBerry—the favorite phone of Mexico’s drug lords, includ­ing El Chapo. The Pega­sus tech­nol­o­gy in 2011 was referred to in emails filed with the Israeli court as BB and BBM—the acronym for BlackBerry’s instant-mes­sag­ing appli­ca­tion. Pen­e­trat­ing BlackBerry’s encrypt­ed mes­sag­ing sys­tem “was con­sid­ered the ‘wet dream’ of the intel­li­gence world,” Caspi wrote in an affi­davit.

    Under­scor­ing the broad­er prob­lems with NSO, Pega­sus proved to be too great a temp­ta­tion to be used only for track­ing down elu­sive car­tel lead­ers. Cit­i­zen Lab, the Cana­di­an research group, pub­lished a series of reports begin­ning in 2017 that found Pega­sus was used to tar­get Mex­i­can human rights lawyers, jour­nal­ists and anti-cor­rup­tion activists.

    “It’s no acci­dent that some com­pa­nies grav­i­tate toward big tick­et cus­tomers like Mex­i­co but it’s clear to every­one in that mar­ket that if you sell to Mex­i­co, you can almost guar­an­tee mis­use,” John Scott-Rail­ton, a senior researcher at Cit­i­zen Lab, told The Dai­ly Beast. “Clear­ly, NSO isn’t both­ered by the harm they inflict. But why are they so con­fi­dent that they can go into a mar­ket where there is such high risk of some­thing going wrong and not wor­ry about suf­fer­ing any con­se­quences?”

    More recent­ly, the Guardian report­ed that Mex­i­can Pres­i­dent Andres Manuel Lopez Obrador’s inner cir­cle was a poten­tial tar­get for sur­veil­lance by a gov­ern­ment client of NSO—a report the Israeli spy­ware mak­er strong­ly denied. Obrador took office in 2018 and vowed to nev­er use spy­ware.

    As for Elliott Broidy, his alleged efforts in help­ing NSO land its deal with Mex­i­co would come to naught.

    In April 2011, he host­ed a meet­ing in Los Ange­les with NSO’s founders Shulev Hulio and Omri Lavie, accord­ing to Caspi’s court-filed affi­davit. Caspi sub­se­quent­ly got wind that his for­mer boss was try­ing to go behind his back and cre­ate a direct con­nec­tion to NSO. Caspi said he took steps to “neu­tral­ize” him and the deal was ulti­mate­ly signed with­out Broidy’s par­tic­i­pa­tion.

    Broidy went on to serve as the Repub­li­can Party’s deputy finance chair­man in 2017 until reports of a hushed-up affair forced his res­ig­na­tion. The Wall Street Jour­nal revealed that Broidy paid a for­mer Play­boy mod­el $1.6 mil­lion after he had got­ten her preg­nant. The deal was nego­ti­at­ed by Trump’s then attor­ney Michael Cohen.

    In 2020, Broidy admit­ted that, in exchange for mil­lions of dol­lars, he agreed to do the bid­ding of a for­eign gov­ern­ment and for­eign indi­vid­ual and lob­by Pres­i­dent Trump and oth­ers for the removal of a Chi­nese dis­si­dent, Guo Wen­gui, and to drop a case relat­ed to an embez­zle­ment scheme from a Malaysian gov­ern­ment bank. Pres­i­dent Trump par­doned Broidy in his final hours in the White House.

    Broidy would him­self be the vic­tim of what he claimed was a gov­ern­ment-spon­sored hack­ing attempt. Broidy sued Qatar and its agents in 2018 for alleged­ly hack­ing into his com­put­er servers, steal­ing his con­fi­den­tial infor­ma­tion, and leak­ing it to the media in an effort to neu­tral­ize Broidy’s crit­i­cism of the coun­try. A fed­er­al judge dis­missed the case. The les­son is an impor­tant one in a world of spy­ware for sale: The hunters can become the hunt­ed.

    ———–

    “Scan­dal, Spy­ware, and 69 Pounds of Weed” by Seth Het­te­na; The Dai­ly Beast; 08/03/2021

    “The doc­u­ments do, how­ev­er, raise trou­bling ques­tions about the Israeli spy­ware maker’s recent claim that its prod­ucts are intend­ed for “the sole use of thor­ough­ly vet­ted and approved gov­ern­men­tal agen­cies charged with main­tain­ing pub­lic safe­ty and secu­ri­ty.” Broidy’s con­tact in Mexico—a man nick­named “Mr. Lam­bo” for his love of Ital­ian sports cars—later served time in a U.S. fed­er­al prison for mak­ing ille­gal for­eign con­tri­bu­tions in an Amer­i­can elec­tion. A doc­u­ment filed by fed­er­al pros­e­cu­tors in San Diego revealed that “Mr. Lam­bo” was inves­ti­gat­ed by U.S. author­i­ties for a host of oth­er crimes for which he wasn’t charged, includ­ing drug smug­gling.”

    Elliot Broidy sure knows a lot of inter­est­ing peo­ple. Peo­ple like “Mr. Lam­bo”, his con­tact in Mex­i­co. This is how Broidy was play­ing the mid­dle-man role: Broidy had the con­tacts in Mex­i­co and NSO Group. And play­ing such a mid­dle-man role in inter­na­tion­al busi­ness isn’t nec­es­sar­i­ly scan­dalous. But when you’re in the mid­dle of a ped­dler of super spy­ware like NSO Group on one side and a busi­ness­man bil­lion­aire, Jose Susumo Azano Mat­sura, with a his­to­ry of being under US Mex­i­can drug-traf­fick­ing-relat­ed inves­ti­ga­tions on the oth­er side, that’s when being a com­mer­cial mid­dle man becomes much more scan­dalous. Broidy was the match­mak­er that set up a par­tic­u­lar­ly dan­ger­ous rela­tion­ship. Espe­cial­ly dan­ger­ous to the peo­ple of Mex­i­co if Azano’s sus­pect­ed drug car­tel asso­ciates ever got access to some­thing like Pega­sus:

    ...
    How­ev­er, affi­davits, emails, and NSO con­tracts filed by defen­dants in the Tel Aviv law­suit that were obtained by The Dai­ly Beast iden­ti­fy the busi­ness­man as Jose Susumo Azano Mat­sura, a reput­ed Mex­i­can bil­lion­aire of Japan­ese ori­gin, also known as “Mr. Lam­bo.” Azano sold eaves­drop­ping tech­nol­o­gy to Mex­i­co and oth­er for­eign gov­ern­ments. His com­pa­ny, Secu­ri­ty Track­ing Devices SA de CV, based in Jalis­co, Mex­i­co claimed to have 2,000 employ­ees in Mex­i­co and Sin­ga­pore. Azano did not respond to an email seek­ing com­ment.

    ...

    Azano would be the key for NSO that unlocked Mex­i­co, “which is known in the cyber indus­try as a big buy­er of defen­sive and offen­sive cyber prod­ucts,” Caspi wrote in an affi­davit. But it was no secret that the country’s drug car­tels had cor­rupt­ed the Mex­i­can gov­ern­ment, and tech­nol­o­gy like Pega­sus could just as eas­i­ly end up being used by a drug traf­fick­er as opposed to being used against one.

    Whether NSO knew it or not, the com­pa­ny had tak­en an extreme risk with Azano, its Mex­i­can part­ner. NSO was mar­ket­ing Pega­sus as a tool to help Mex­i­co win its bru­tal war against the country’s drug car­tels, but Azano had been under inves­ti­ga­tion by U.S. author­i­ties for years. Pros­e­cu­tors in San Diego filed doc­u­ments that reveal that a car stopped at the U.S.-Mexico bor­der in 1996 with 69 pounds of mar­i­jua­na was reg­is­tered to a known res­i­dence of Azano’s then wife. In 2004 and 2005, those same doc­u­ments reveal, FBI sur­veil­lance units observed Azano meet­ing with a known drug smug­gler; on one occa­sion, Azano drove to the meet­ing with the known drug smug­gler in a car with no license plates. (Pros­e­cu­tors in San Diego declined to bring charges relat­ed to drug smug­gling.)
    ...

    What should have added to every­one’s con­cern at the time is the fact that NSO Group was­n’t even direct­ly licens­ing Pega­sus to the Mex­i­can gov­ern­ment. It was licens­ing it to Azano’s com­pa­ny, when pro­ceed­ed to re-license it to the Mex­i­can mil­i­tary for a high­er price. A great arrange­ment for arrang­ing every­one’s kick­backs. And who knows what kind of free­dom this arrange­ment gave to Azano to qui­et­ly dis­trib­ute Pega­sus to oth­er par­ties. It’s a high­ly sus­pi­cious arrange­ment for a lot or rea­sons:

    ...
    Nev­er­the­less, NSO relied on Azano to sell its prod­ucts to the Mex­i­can gov­ern­ment. Includ­ed in the Tel Aviv court file was an unsigned, undat­ed copy of NSO’s con­tract with Azano’s com­pa­ny, Secu­ri­ty Track­ing Devices. In it, STD was grant­ed the exclu­sive right to dis­trib­ute NSO’s prod­ucts and ser­vices in Mex­i­co through the end of 2012 in exchange for $500,000. An NSO spokesper­son did not answer ques­tions about why the com­pa­ny did not sell direct­ly to the Mex­i­can gov­ern­ment or whether the com­pa­ny had sim­i­lar arrange­ments in oth­er coun­tries.

    ...

    Court doc­u­ments don’t spec­i­fy how NSO showed Mexico’s lead­er­ship what its soft­ware could do. A few years lat­er, NSO would report­ed­ly record a phone con­ver­sa­tion of the edi­tor of a Lon­don-based Arab news­pa­per to impress a client, the Unit­ed Arab Emi­rates. What­ev­er NSO showed Mexico’s lead­ers, it worked. Azano’s com­pa­ny quick­ly reached a deal to buy NSO’s Pega­sus for $15 mil­lion, accord­ing to court doc­u­ments. Azano then resold Pega­sus to the Mex­i­can mil­i­tary at an even high­er price, earn­ing him­self mil­lions of dol­lars in com­mis­sions, accord­ing to a 2012 report by Cal­cal­ist.
    ...

    Anoth­er rea­son Elliott Broidy has to deny any asso­ci­a­tion with NSO Group is that it did­n’t sound like he was sim­ply a Mid­dle-Man look­ing for a find­ers fee com­mis­sion. He was oper­at­ing as an NSO Group rep­re­sen­ta­tive, along with Matan Caspi — Broidy’s for­mer employ­ee who returned to Israel to co-found Ray­zone Group, an Israeli cyber­se­cu­ri­ty firm that offers “bou­tique intel­li­gence-based solu­tions for nation­al agen­cies” — and Caspi’s part­ner. Broidy was like­ly set up to get a seri­ous com­mis­sion. Those are Caspi’s alle­ga­tions in the law­suit that broke out between the dif­fer­ent peo­ple involved with this sale. Again, Broidy has a lot of rea­son to deny know­ing any­thing about this:

    ...
    Accord­ing to an affi­davit filed in court in Tel Aviv, Broidy first learned of NSO and Pega­sus in 2010, when he was con­tact­ed by one of his for­mer employ­ees who had joined the NSO sales team. Matan Caspi had spent sev­er­al years work­ing at Broidy Cap­i­tal Man­age­ment in Los Ange­les. Part of his work involved sell­ing tech­nol­o­gy to Mex­i­co. Caspi returned to Israel where he co-found­ed Ray­zone Group, an Israeli cyber­se­cu­ri­ty firm that offers “bou­tique intel­li­gence-based solu­tions for nation­al agen­cies,” accord­ing to its web­site. Caspi did not reply to mes­sages sent to Ray­zone and his per­son­al email address­es for this arti­cle.

    In Octo­ber 2010, Caspi flew to Los Ange­les to meet Broidy and dis­cuss Pega­sus. “The meet­ing with Broidy was suc­cess­ful. Mr. Broidy expressed real inter­est in NSO’s prod­ucts and in the chances of suc­cess of sell­ing them to the Mex­i­can Army. It was con­clud­ed that he would try to use his con­nec­tions in order to pro­mote such a deal,” Caspi wrote in an affi­davit filed in the Tel Aviv law­suit.

    In its approach to Broidy’s Mex­i­can busi­ness asso­ciate and gov­ern­ment offi­cials in Mex­i­co, NSO relied almost entire­ly on out­side sales­men like Caspi, his part­ner, Eric Banoun, and, for a time, Broidy. NSO’s con­tract with Banoun, a copy of which is includ­ed in the court file, offered a 10 per­cent com­mis­sion on the sale of Pega­sus to Mex­i­co. A dis­pute over that sev­en-fig­ure com­mis­sion led to the fil­ing of the 2015 law­suit in Tel Aviv.*

    ...

    With Broidy’s “bless­ing,” Caspi wrote in his court-filed affi­davit, he con­tact­ed Azano and flew to Mex­i­co City in Decem­ber 2010 for the first of sev­er­al meet­ings with the Mex­i­can busi­ness­man.
    ...

    But, in the end, Broidy was locked out. After he appar­ent­ly got greedy and tried to cre­ate a direct rela­tion­ship with NSO Group. In oth­er words, Caspi was play­ing a mid­dle-man role too. Broidy and Casp were each oth­er’s mid­dle-men, with Azano play­ing a third mid­dle-man role of sorts. Quite a deal. And Broidy tried to cut out one of the three mid­dle-men but the mid­dle-man found out cut Broidy out first instead. It’s hard to have much sym­pa­thy based on the avail­able facts. Recall that we are told Caspi was the one who approached Broidy this whole thing:

    ...
    As for Elliott Broidy, his alleged efforts in help­ing NSO land its deal with Mex­i­co would come to naught.

    In April 2011, he host­ed a meet­ing in Los Ange­les with NSO’s founders Shulev Hulio and Omri Lavie, accord­ing to Caspi’s court-filed affi­davit. Caspi sub­se­quent­ly got wind that his for­mer boss was try­ing to go behind his back and cre­ate a direct con­nec­tion to NSO. Caspi said he took steps to “neu­tral­ize” him and the deal was ulti­mate­ly signed with­out Broidy’s par­tic­i­pa­tion.
    ...

    Giv­en that his­to­ry of how Mex­i­co’s noto­ri­ous­ly cor­rupt gov­ern­ment became NSO Group’s first for­eign client, and giv­en the sto­ry of the Mex­i­can gov­ern­men­t’s extra­di­tion request for Tomás Zerón, who was known to be close to the founders of NSO Group, it’s worth ask­ing what the odds are that the sto­ry of Zerón’s cov­er up inves­ti­ga­tion of the slaugh­ter of those stu­dents hap­pens to include an angle involv­ing the cor­rup­tion use of Pega­sus on those stu­dents. Don’t for­get, these were activists stu­dents who were slaugh­tered. For the munic­i­pal police to attack those bus­es and hand the kids over to drug car­tels to be slaugh­tered, they pre­sum­ably had a rea­son to want at least soem of those kids very dead. Pega­sus spy­ware on the phones of these activist stu­dents would have been a very con­ve­nient way for cor­rupt par­ties to acquire a rea­son to want to see some of them very dead. It rais­es the grim ques­tion of whether or not those stu­dents were about to break a big sto­ry on some sort of deep cor­rup­tion between the police and car­tels. Were these stu­dents Pega­sus tar­gets before the slaugh­ter? We don’t know, but based on the Cit­i­zen­Lab Pega­sus inves­ti­ga­tion we know Pega­sus was used against top Mex­i­can lawyers, jour­nal­ists and anti-cor­rup­tion activists. Maybe by cor­rupt police? Maybe by car­tels that got their hands on the super-spy­ware from those cor­rupt police? Or maybe they got it through their con­nec­tions to Azano’s mid­dle-man Pega­sus dis­tri­b­u­tion com­pa­ny? Who knows. We just know we have every rea­son to sus­pect, yes, Pega­sus could have been used on these stu­dents. It’s been that kind of sit­u­a­tion in Mex­i­co since 2011:

    ...
    Under­scor­ing the broad­er prob­lems with NSO, Pega­sus proved to be too great a temp­ta­tion to be used only for track­ing down elu­sive car­tel lead­ers. Cit­i­zen Lab, the Cana­di­an research group, pub­lished a series of reports begin­ning in 2017 that found Pega­sus was used to tar­get Mex­i­can human rights lawyers, jour­nal­ists and anti-cor­rup­tion activists.
    ...

    So that’s all part of what makes the sto­ry of the Tomás Zerón extra­di­tion request some­thing to watch. Zerón is clear­ly deeply impli­cat­ed in the wild­ly scan­dalous sham inves­ti­ga­tion of the 2014 activist stu­dent slaugh­ter. And, cir­cum­stan­tial­ly speak­ing, those stu­dents appear to fit the pro­file of the kind of peo­ple known to be tar­get­ed by Pega­sus. They cer­tain­ly sound like anti-cor­rup­tion activists. The whole sequence of events that led up to the attack on the stu­dent con­vey involved the tra­di­tion­al stu­dent tem­po­rary com­man­deer­ing of bus­es from Iguala, intend­ed to be dri­ven back to the rur­al col­lege to take the stu­dent to a march in Mex­i­co City comem­morat­ing the 1968 Tlatelol­co stu­dent mas­sacre.

    Is there a Pega­sus abuse angle to the sto­ry of the 2014 stu­dent slaugh­ter? We’ll see if the extra­di­tion requests of Tomás Zerón and Zerón’s ties to NSO Group ends up lead­ing to the ask­ing of that ques­tion. It’s pos­si­ble there’s no Pega­sus angle at all with the slaugh­ter of those stu­dents. One the­o­ry is that the stu­dents inad­ver­tent­ly com­man­deered a bus con­tain­ing police-pro­tect hero­in intend­ed to be shipped to Chica­go. Under that sce­nario, it would just be bad luck that trig­gered the events. Hope­ful­ly one day we get some clar­i­ty on what actu­al­ly hap­pened. But regard­less of what actu­al­ly hap­pened in that case, the fact of the mat­ter is the slaugh­ter of those stu­dents hap­pened dur­ing a peri­od when the Mex­i­can gov­ern­ment had access to near­ly unstop­pable spy­ware while it was in bed with drug car­tels.

    And that’s just Mex­i­co. A sim­i­lar sit­u­a­tion prob­a­bly exists between the rest of the NSO Group’s gov­ern­ment clients of those clients’ shadi­est and most pow­er­ful crim­i­nal friends. In coun­tries where you can’t sep­a­rate the under­world from the over­world there’s no real­is­tic way to keep some­thing like Pega­sus out of the wrong hands. Mex­i­co is just an ear­ly exam­ple of what must be going on all over the world thanks to the explo­sion of the super-spy­ware glob­al mar­ket­place over the last decade.

    Oh, and it’s worth point­ing out that Elliott Broidy has a close work­ing rela­tion­ship with A LOT of oth­er known NSO Group clients. Mex­i­co was NSO Group’s first for­eign client. So the guy that got iced out at the last minute of the Mex­i­co deal under what appears to be shady cir­cum­stances (ini­ti­at­ed by Broidy’s greed to cut out Caspi), also hap­pens to have spent much of the last decade work­ing as a for­eign agent for a whole bunch of oth­er very eager NSO Group clients. Did Elliott Broidy get to play mid­dle-man for any of those oth­er coun­tries? Let’s hope inves­ti­ga­tors some­where end up inves­ti­gat­ing that ques­tion. Elliott Broidy doth protest waaay too much on this one.

    Posted by Pterrafractyl | October 6, 2021, 12:56 am

  12. Oh look, anoth­er mega-hack. Yep, an obscure com­pa­ny few have ever heard of just qui­et­ly let the world know that poten­tial­ly bil­lions of peo­ple had their pri­vate infor­ma­tion stolen. A LOT of pri­vate infor­ma­tion poten­tial­ly. So much so, one pri­va­cy expert sug­gest­ed the hack­ers could know more about you than your doc­tor. The hack­ers could have accessed meta­da­ta such as length and cost, caller and receiver’s num­bers, the loca­tion of the par­ties in the call, as well as the con­tent of SMS text mes­sages. Infor­ma­tion who you called, when you called, where you called, how long you called. Plus text mes­sage con­tent. It’s a remark­able data pro­file on almost any indi­vid­ual.

    And thanks to that text mes­sage access, the hack­ers can poten­tial­ly inter­fere with 2‑factor authen­ti­ca­tion schemes. That means they could have had indi­rect access to inter­net accounts pro­tect­ed with SMS 2‑factor authen­ti­ca­tion like Google, Microsoft, Face­book, Twit­ter, and Ama­zon. That’s why this is poten­tial­ly such a mas­sive hack.

    That’s the news from Syni­verse, a com­pa­ny that han­dles bil­lions of text mes­sages for telecom­mu­ni­ca­tions com­pa­nies across the world. Nine­ty-five of the top 100 mobile car­ri­ers in the world, includ­ing the big three U.S. ones (AT&T, Ver­i­zon, T‑Mobile), are Syni­verse cus­tomers. The com­pa­ny informed the world of the hack in doc­u­ments it filed with the SEC back in August in antic­i­pa­tion of IPO.

    So when did this occur? May of 2016. Who who­ev­er did this has had access to this trea­sure trove of infor­ma­tion for over 5 years. And, again, we only learned about this from the com­pa­ny’s SEC fil­ings in antic­i­pa­tion of going pub­lic. In oth­er words, the com­pa­ny was put in a posi­tion where it kind of had to dis­close to the pub­lic the exis­tence of this hack. It would be pret­ty scan­dalous to con­duct an IPO with­out reveal­ing that. Who knows how long this would have remained under wraps had the com­pa­ny not been forced to dis­close it to the SEC.

    It also all rais­es the ques­tion of who the pri­vate own­ers are that are tak­ing this com­pa­ny pub­lic: Car­lyle Group. The pri­vate equi­ty firm pur­chased Syni­verse in 2011 for $2.6 bil­lion. As we’ll see in the sec­ond excerpt below, Car­lyle intends to remain a minor­i­ty share­hold­er fol­low­ing the IPO.

    So one of the largest hacks ever took place in 2016. We have no idea when Syni­verse actu­al­ly dis­cov­ered the hack, are are only learn­ing about it now, five years lat­er, in a qui­et SEC fil­ing the com­pa­ny issued back in August in antic­i­pa­tion of going pub­lic. Brought to you by the Car­lyle Group:

    Vice

    Com­pa­ny That Routes Bil­lions of Text Mes­sages Qui­et­ly Says It Was Hacked

    Syni­verse han­dles bil­lions of text mes­sages a year, and hack­ers had unau­tho­rized access to its sys­tem for years.

    by Loren­zo Franceschi-Bic­chierai
    Octo­ber 4, 2021, 10:59am

    A com­pa­ny that is a crit­i­cal part of the glob­al telecom­mu­ni­ca­tions infra­struc­ture used by AT&T, T‑Mobile, Ver­i­zon and sev­er­al oth­ers around the world such as Voda­fone and Chi­na Mobile, qui­et­ly dis­closed that hack­ers were inside its sys­tems for years, impact­ing more than 200 of its clients and poten­tial­ly mil­lions of cell­phone users world­wide.

    The com­pa­ny, Syni­verse, revealed in a fil­ing dat­ed Sep­tem­ber 27 with the U.S. Secu­ri­ty and Exchange Com­mis­sion that an unknown “indi­vid­ual or orga­ni­za­tion gained unau­tho­rized access to data­bas­es with­in its net­work on sev­er­al occa­sions, and that login infor­ma­tion allow­ing access to or from its Elec­tron­ic Data Trans­fer (EDT) envi­ron­ment was com­pro­mised for approx­i­mate­ly 235 of its cus­tomers.”

    A for­mer Syni­verse employ­ee who worked on the EDT sys­tems told Moth­er­board that those sys­tems have infor­ma­tion on all types of call records.

    Syni­verse repeat­ed­ly declined to answer spe­cif­ic ques­tions from Moth­er­board about the scale of the breach and what spe­cif­ic data was affect­ed, but accord­ing to a per­son who works at a tele­phone car­ri­er, who­ev­er hacked Syni­verse could have had access to meta­da­ta such as length and cost, caller and receiver’s num­bers, the loca­tion of the par­ties in the call, as well as the con­tent of SMS text mes­sages.

    “Syni­verse is a com­mon exchange hub for car­ri­ers around the world pass­ing billing info back and forth to each oth­er,” the source, who asked to remain anony­mous as they were not autho­rized to talk to the press, told Moth­er­board. “So it inevitably car­ries sen­si­tive info like call records, data usage records, text mes­sages, etc. [...] The thing is—I don’t know exact­ly what was being exchanged in that envi­ron­ment. One would have to imag­ine though it eas­i­ly could be cus­tomer records and [per­son­al iden­ti­fy­ing infor­ma­tion] giv­en that Syni­verse exchanges call records and oth­er billing details between car­ri­ers.”

    The com­pa­ny wrote that it dis­cov­ered the breach in May 2021, but that the hack began in May of 2016.

    Syni­verse pro­vides back­bone ser­vices to wire­less car­ri­ers like AT&T, Ver­i­zon, T‑Mobile, and sev­er­al oth­ers around the world. The com­pa­ny process­es more than 740 bil­lion text mes­sages every year and has “direct con­nec­tions” to more than 300 mobile oper­a­tors around the world, accord­ing to its offi­cial web­site. Nine­ty-five of the top 100 mobile car­ri­ers in the world, includ­ing the big three U.S. ones, and major inter­na­tion­al ones such as Tele­fon­i­ca, and Amer­i­ca Movil, are Syni­verse cus­tomers, accord­ing to the fil­ing.

    To give per­spec­tive as to Syniverse’s impor­tance, due to a main­te­nance update in 2019, Syni­verse lost tens of thou­sands of text mes­sages on Valen­tine’s Day, which meant that the text mes­sages were lost in tran­sit and only deliv­ered months lat­er. Syni­verse routes text mes­sages between dif­fer­ent car­ri­ers both in the U.S. and abroad, allow­ing peo­ple who are on Verizon’s net­work to com­mu­ni­cate with cus­tomers who use anoth­er car­ri­er. It also man­ages rout­ing and inter­na­tion­al roam­ing between net­works, using the noto­ri­ous­ly inse­cure SS7 and Diam­e­ter pro­to­cols, accord­ing to the com­pa­ny’s site.

    “The world’s largest com­pa­nies and near­ly all mobile car­ri­ers rely on Syniverse’s glob­al net­work to seam­less­ly bridge mobile ecosys­tems and secure­ly trans­mit data, enabling bil­lions of trans­ac­tions, con­ver­sa­tions and con­nec­tions [dai­ly],” Syni­verse wrote in a recent press release.

    “Syni­verse has access to the com­mu­ni­ca­tion of hun­dreds of mil­lions, if not bil­lions, of peo­ple around the world. A five-year breach of one of Syni­verse’s main sys­tems is a glob­al pri­va­cy dis­as­ter,” Karsten Nohl, a secu­ri­ty researcher who has stud­ied glob­al cell­phone net­works for a decade, told Moth­er­board in an email. “Syni­verse sys­tems have direct access to phone call records and text mes­sag­ing, and indi­rect access to a large range of Inter­net accounts pro­tect­ed with SMS 2‑factor authen­ti­ca­tion. Hack­ing Syni­verse will ease access to Google, Microsoft, Face­book, Twit­ter, Ama­zon and all kinds of oth­er accounts, all at once.”

    That means the recent­ly dis­cov­ered and years-long data breach could poten­tial­ly affect millions—if not billions—of cell­phone users, depend­ing on what car­ri­ers were affect­ed, accord­ing to an indus­try insid­er who asked to remain anony­mous as he was not autho­rized to speak to the press.

    “With all that infor­ma­tion, I could build a pro­file on you. I’ll know exact­ly what you’re doing, who you’re call­ing, what’s going on. I’ll know when you get a voice­mail noti­fi­ca­tion. I’ll know who left the voice­mail. I’ll know how long that voice­mail was left for. When you make a phone call, I’ll know exact­ly where you made that phone call from,” a tele­com indus­try insid­er, who asked to remain anony­mous as he was not autho­rized to speak to the press, told Moth­er­board in a call. “I’ll know more about you than your doc­tor.”

    But the for­mer Syni­verse employ­ee said that the dam­age could be much more lim­it­ed.

    “I feel it is extreme­ly embar­rass­ing but like­ly not the cause of sig­nif­i­cant dam­age. It strikes me as a result of some lazi­ness, as I have seen secu­ri­ty breach­es hap­pen like this a few times,” the for­mer employ­ee said. “Because we have not seen any­thing come out of this over five years. Not say­ing noth­ing bad hap­pened but it sounds like noth­ing did hap­pen.”

    “Seems like a state-spon­sored wet dream,” Adri­an Sanabria, a cyber­se­cu­ri­ty expert and founder of Secu­ri­ty Week­ly Labs, told Moth­er­board in an online chat. “Can’t imag­ine [Syni­verse] being a tar­get for any­one else at that scale.”

    The hack is already rais­ing the alarm in Wash­ing­ton.

    “The infor­ma­tion flow­ing through Syniverse’s sys­tems is espi­onage gold,” Sen. Ron Wyden told Moth­er­board in an emailed state­ment. “That this breach went undis­cov­ered for five years rais­es seri­ous ques­tions about Syniverse’s cyber­se­cu­ri­ty prac­tices. The FCC needs to get to the bot­tom of what hap­pened, deter­mine whether Syni­verse’s cyber­se­cu­ri­ty prac­tices were neg­li­gent, iden­ti­fy whether Syni­verse’s com­peti­tors have expe­ri­enced sim­i­lar breach­es, and then set manda­to­ry cyber­se­cu­ri­ty stan­dards for this indus­try.”

    In par­tic­u­lar, Moth­er­board asked Syni­verse whether the hack­ers accessed or stole per­son­al data or cell­phone users. Syni­verse declined to answer that ques­tion.

    Instead, the com­pa­ny sent a state­ment that echoed what it wrote in the fil­ing.

    “As soon as we learned of the unau­tho­rized activ­i­ty, we imple­ment­ed our secu­ri­ty inci­dent response plan and engaged a top-tier foren­sics firm to assist with our inter­nal inves­ti­ga­tion. We also noti­fied and are coop­er­at­ing with law enforce­ment. Syni­verse has com­plet­ed a thor­ough inves­ti­ga­tion of the inci­dent which revealed that the indi­vid­ual or orga­ni­za­tion gained unau­tho­rized access to data­bas­es with­in its net­work on sev­er­al occa­sions and that login infor­ma­tion allow­ing access to or from its EDT envi­ron­ment was com­pro­mised for cer­tain cus­tomers,” the state­ment read. “All EDT cus­tomers have had their cre­den­tials reset or inac­ti­vat­ed, even if their cre­den­tials were not impact­ed by the inci­dent. We have com­mu­ni­cat­ed direct­ly with our cus­tomers regard­ing this mat­ter and have con­clud­ed that no addi­tion­al action is required. In addi­tion to reset­ting cus­tomer cre­den­tials, we have imple­ment­ed sub­stan­tial addi­tion­al mea­sures to pro­vide increased pro­tec­tion to our sys­tems and cus­tomers.”

    Syni­verse dis­closed the breach in an August SEC fil­ing as the com­pa­ny gear­ing to go pub­lic at a val­u­a­tion of $2.85 bil­lion via a merg­er with M3-Brigade Acqui­si­tion II Corp., a spe­cial pur­pose acqui­si­tion com­pa­ny (SPAC). In the doc­u­ment, the com­pa­ny wrote that it “did not observe any evi­dence of intent to dis­rupt its oper­a­tions or those of its cus­tomers and there was no attempt to mon­e­tize the unau­tho­rized activ­i­ty. Syni­verse did not expe­ri­ence and does not antic­i­pate that these events will have any mate­r­i­al impact on its day-to-day oper­a­tions or ser­vices or its abil­i­ty to access or process data. Syni­verse has main­tained, and cur­rent­ly main­tains, cyber insur­ance that it antic­i­pates will cov­er a sub­stan­tial por­tion of its expen­di­tures in inves­ti­gat­ing and respond­ing to this inci­dent.”

    It’s not a house­hold name among cus­tomers, but Syni­verse is one of the largest com­pa­nies in the world when it comes to the cell­phone infra­struc­ture that helps more well-known com­pa­nies like Ver­i­zon or AT&T to run on a day-to-day basis.

    “It is actu­al­ly sur­pris­ing that more stuff like this has not hap­pened, con­sid­er­ing what a mess Syni­verse has become in recent years,” the for­mer Syni­verse employ­ee told Moth­er­board in 2019, refer­ring to the Valen­tine’s Day text mes­sag­ing inci­dent.

    ...

    ————

    “Com­pa­ny That Routes Bil­lions of Text Mes­sages Qui­et­ly Says It Was Hacked” by Loren­zo Franceschi-Bic­chierai; Vice; 10/04/2021

    ““With all that infor­ma­tion, I could build a pro­file on you. I’ll know exact­ly what you’re doing, who you’re call­ing, what’s going on. I’ll know when you get a voice­mail noti­fi­ca­tion. I’ll know who left the voice­mail. I’ll know how long that voice­mail was left for. When you make a phone call, I’ll know exact­ly where you made that phone call from,” a tele­com indus­try insid­er, who asked to remain anony­mous as he was not autho­rized to speak to the press, told Moth­er­board in a call. “i’ll know more about you than your doc­tor.””

    Syni­verse knows more about you than your doc­tor. Nine­ty-five of the top 100 mobile car­ri­ers in the world, includ­ing the big three U.S. ones, use Syni­verse. And now who­ev­er hacked Syni­verse poten­tial­ly know all that infor­ma­tion too. On poten­tial­ly bil­lions of peo­ple. Since May 2016. Beyond that, the hack poten­tial­ly allowed for the inter­cep­tion of the tex­ting-based 2‑factor authen­ti­ca­tion sys­tems (where a web ser­vice sends your phone a one-time pass key to log in). It’s the kind of hack that could be per­fect for gain­ing access to major inter­net ser­vices like Google, Microsoft, Face­book, Twit­ter, Ama­zon. That’s why scale of this hack is so stun­ning. It’s poten­tial­ly a mega-hack. Anoth­er mega-hack:

    ...
    “Syni­verse is a com­mon exchange hub for car­ri­ers around the world pass­ing billing info back and forth to each oth­er,” the source, who asked to remain anony­mous as they were not autho­rized to talk to the press, told Moth­er­board. “So it inevitably car­ries sen­si­tive info like call records, data usage records, text mes­sages, etc. [...] The thing is—I don’t know exact­ly what was being exchanged in that envi­ron­ment. One would have to imag­ine though it eas­i­ly could be cus­tomer records and [per­son­al iden­ti­fy­ing infor­ma­tion] giv­en that Syni­verse exchanges call records and oth­er billing details between car­ri­ers.”

    The com­pa­ny wrote that it dis­cov­ered the breach in May 2021, but that the hack began in May of 2016.

    Syni­verse pro­vides back­bone ser­vices to wire­less car­ri­ers like AT&T, Ver­i­zon, T‑Mobile, and sev­er­al oth­ers around the world. The com­pa­ny process­es more than 740 bil­lion text mes­sages every year and has “direct con­nec­tions” to more than 300 mobile oper­a­tors around the world, accord­ing to its offi­cial web­site. Nine­ty-five of the top 100 mobile car­ri­ers in the world, includ­ing the big three U.S. ones, and major inter­na­tion­al ones such as Tele­fon­i­ca, and Amer­i­ca Movil, are Syni­verse cus­tomers, accord­ing to the fil­ing.

    ...

    “Syni­verse has access to the com­mu­ni­ca­tion of hun­dreds of mil­lions, if not bil­lions, of peo­ple around the world. A five-year breach of one of Syni­verse’s main sys­tems is a glob­al pri­va­cy dis­as­ter,” Karsten Nohl, a secu­ri­ty researcher who has stud­ied glob­al cell­phone net­works for a decade, told Moth­er­board in an email. “Syni­verse sys­tems have direct access to phone call records and text mes­sag­ing, and indi­rect access to a large range of Inter­net accounts pro­tect­ed with SMS 2‑factor authen­ti­ca­tion. Hack­ing Syni­verse will ease access to Google, Microsoft, Face­book, Twit­ter, Ama­zon and all kinds of oth­er accounts, all at once.”

    That means the recent­ly dis­cov­ered and years-long data breach could poten­tial­ly affect millions—if not billions—of cell­phone users, depend­ing on what car­ri­ers were affect­ed, accord­ing to an indus­try insid­er who asked to remain anony­mous as he was not autho­rized to speak to the press.
    ...

    The hack is also obvi­ous­ly “espi­onage gold” as Sen­a­tor Wyden put it, which already has fin­gers point­ing toward a state-spon­sored actor. And while it’s cer­tain­ly pos­si­ble a state actor was behind this, let’s not pre­tend that the com­mer­cial val­ue of a hack like this isn’t immense. Also note how there are zero clues about the per­pe­tra­tor so far:

    ...
    “Seems like a state-spon­sored wet dream,” Adri­an Sanabria, a cyber­se­cu­ri­ty expert and founder of Secu­ri­ty Week­ly Labs, told Moth­er­board in an online chat. “Can’t imag­ine [Syni­verse] being a tar­get for any­one else at that scale.”

    The hack is already rais­ing the alarm in Wash­ing­ton.

    “The infor­ma­tion flow­ing through Syniverse’s sys­tems is espi­onage gold,” Sen. Ron Wyden told Moth­er­board in an emailed state­ment. “That this breach went undis­cov­ered for five years rais­es seri­ous ques­tions about Syniverse’s cyber­se­cu­ri­ty prac­tices. The FCC needs to get to the bot­tom of what hap­pened, deter­mine whether Syni­verse’s cyber­se­cu­ri­ty prac­tices were neg­li­gent, iden­ti­fy whether Syni­verse’s com­peti­tors have expe­ri­enced sim­i­lar breach­es, and then set manda­to­ry cyber­se­cu­ri­ty stan­dards for this indus­try.”
    ...

    Nest, note the assur­ances for Syni­verse: don’t wor­ry too much because no dam­age has actu­al­ly been detect­ed. It’s not exact­ly reas­sur­ing. But also keep in mind the nature of this hack: it allowed hack­ers to col­lect mobile-phone meta­da­ta on peo­ple and poten­tial­ly com­pro­mise web site cre­den­tials, allow­ing the hack­ers to access ser­vices like Google or Ama­zon. That’s not nec­es­sar­i­ly the kind of dam­age that’s going to leave an obvi­ous evi­den­tiary trail lead­ing back to this hack. In oth­er words, giv­en the nature of this hack, we should­n’t real­ly expect Syni­verse to be in pos­ses­sion of evi­dence of how the hack was actu­al­ly used:

    ...

    But the for­mer Syni­verse employ­ee said that the dam­age could be much more lim­it­ed.

    “I feel it is extreme­ly embar­rass­ing but like­ly not the cause of sig­nif­i­cant dam­age. It strikes me as a result of some lazi­ness, as I have seen secu­ri­ty breach­es hap­pen like this a few times,” the for­mer employ­ee said. “Because we have not seen any­thing come out of this over five years. Not say­ing noth­ing bad hap­pened but it sounds like noth­ing did hap­pen.”
    ...

    Now here’s a quick reminder tha the cur­rent own­ers of Syni­verse who brought the world this mega-hack, the Car­lyle Group, are going to remain minor­i­ty own­ers once they’re done tak­ing Syni­verse pub­lic again:

    The Tam­pa Bay Times

    Tam­pa com­pa­ny Syni­verse going pub­lic in $2.8 bil­lion merg­er
    The tele­com firm was once one of Tam­pa Bay’s biggest pub­lic com­pa­nies before being sold in 2011.

    By Jay Cridlin
    Pub­lished Aug. 17, 2021
    Updat­ed Aug. 17, 2021

    One of Tam­pa Bay’s largest pri­vate com­pa­nies is return­ing to the pub­lic mar­ket in a merg­er that val­ues the com­bined firm at more than $2.8 bil­lion.

    Syni­verse, a telecom­mu­ni­ca­tions com­pa­ny that spe­cial­izes in mobile and cloud con­nec­tiv­i­ty, will merge with pub­licly trad­ed New York acqui­si­tion com­pa­ny M3-Brigade Acqui­si­tion II Corp. that will infuse the firm with up to $1.2 bil­lion in cash, accord­ing to a press release.

    Upon com­ple­tion of the deal, the Tam­pa com­pa­ny will return to the New York Stock Exchange under the name Syni­verse Tech­nolo­gies Cor­po­ra­tion and tick­er sym­bol SYNV. It’s famil­iar ter­ri­to­ry for Syni­verse, which was once one of Tam­pa Bay’s largest pub­lic com­pa­nies until it was sold to pri­vate equi­ty firm the Car­lyle Group in 2011 for $2.6 bil­lion in cash.

    Syni­verse CEO Andrew Davies said the infu­sion of cap­i­tal will allow the com­pa­ny grow and expand to cap­i­tal­ize on the poten­tial of the world’s grow­ing 5G wire­less net­work. The com­pa­ny han­dles near­ly 3.5 exabytes of data annu­al­ly, he said, which is equal to 3.5 bil­lion giga­bytes, or 10,000 times the amount of data stored in the Library of Con­gress.

    “Syni­verse may be the most impor­tant com­pa­ny you’ve nev­er heard of,” Davies said on a con­fer­ence call Tues­day. “If you’ve ever sent a mes­sage to some­one with anoth­er car­ri­er, that’s Syni­verse. If you’ve trav­eled over­seas and made a phone call there, That’s also Syni­verse. And if you’ve receeved a text mes­sage with any two-fac­tor authen­ti­ca­tion code, an air­port gate change noti­fi­ca­tion, or a deliv­ery resched­ule, that’s Syni­verse, too.”

    The deal includes an invest­ment from cloud com­mu­ni­ca­tions firm Twilio, which announced in March it was invest­ing between $500 mil­lion and $750 mil­lion into Syni­verse. As a result, Twilio will own a minor­i­ty stake in the com­pa­ny.

    The Car­lyle Group will also stay on as a minor­i­ty own­er. Two oth­er firms, Oak Hill Advi­sors and Brigade Cap­i­tal Man­age­ment, will invest $265 mil­lion through the pur­chase of stock at below mar­ket val­ue.

    Call­ing Syni­verse “inte­gral in the mobile-cen­tric 5G world,” Mohsin Meghji, CEO and chair­per­son of M3-Brigade Acqui­si­tion II Corp., said the Twilio part­ner­ship and cap­i­tal would give the com­pa­ny plen­ty of flex­i­bil­i­ty to grow, with lots of poten­tial for inter­na­tion­al growth.

    Syni­verse report­ed rev­enues of $646 mil­lion in 2020, accord­ing to a merg­er prospec­tus filed with the U.S. Secu­ri­ties and Stock Exchange, and is fore­cast­ing $678 mil­lion this year. It projects annu­al rev­enues could grow to more than $1.2 bil­lion by 2025, per the prospec­tus.

    Syni­verse start­ed as an arm of GTE, then spun off in 2001 when that cor­po­ra­tion merged with Bell Atlantic to cre­ate Ver­i­zon. When Syni­verse went pub­lic in 2005, the $282 mil­lion raised in its ini­tial pub­lic offer­ing was at the time the most ever by a Tam­pa Bay pub­lic com­pa­ny.

    ...

    ————-

    “Tam­pa com­pa­ny Syni­verse going pub­lic in $2.8 bil­lion merg­er” By Jay Cridlin; The Tam­pa Bay Times; 08/17/2021

    “The Car­lyle Group will also stay on as a minor­i­ty own­er. Two oth­er firms, Oak Hill Advi­sors and Brigade Cap­i­tal Man­age­ment, will invest $265 mil­lion through the pur­chase of stock at below mar­ket val­ue.”

    Let’s hope the pub­lic own­er­ship of Syni­verse some­how leads to more effec­tive man­age­ment now that the Car­lyle Group is poised to par­tial­ly cash out. But who­ev­er ends up own­ing Syni­verse after this IPO is all over has already learned a pow­er­ful and impor­tant les­son: one of the largest hacks ever can take place on your watch for years, it may have been cov­ered up, and there’s basi­cal­ly no con­se­quence to the own­ers. That may not be the les­son we want Syni­verse’s new own­ers to take from this whole thing, but it’s hard to see how that’s not the les­son they’re learn­ing right now.

    Posted by Pterrafractyl | October 7, 2021, 7:04 pm

  13. Here’s a pair of arti­cles about NSO Group’s mys­te­ri­ous com­peti­tor, Can­diru, and their mutu­al rela­tion­ship with each oth­er as com­peti­tors but also pos­si­ble part­ners. The first arti­cle excerpt also direct­ly relates to the fas­ci­nat­ing sto­ry of inter­na­tion man of mys­tery Elliott Broidy and the 2011 role he played in secur­ing NSO Group’s first for­eign client, Mex­i­co:

    First, recall how NSO Group and Can­diru both spe­cial­ized in mutu­al­ly com­pat­i­ble hack­ing prod­ucts, with NSO Group focus­ing on smart­phone hacks (iPhones and Android devices) while Can­diru appears to have a spe­cial­ty in hack­ing Microsoft prod­ucts. Also recall how one of Can­diru’s finan­cial back­ers is NSO Group co-founder Isaac Zack. So it already looked like the two firms are sis­ter-mer­ce­nary hack­ing com­pa­nies.

    Well, accord­ing to the fol­low Haaretz arti­cle from Sep­tem­ber of 2020 about a law­suit between Can­diru and a vice pres­i­dent of sales for the com­pa­ny from 2015–2018 who is referred to as “S” in the arti­cle. S makes a num­ber of con­flict-of-alle­ga­tions against Zack, who is not just the chair­man of the com­pa­ny but also the chair of the agent com­mit­tee that over­seas the “agent” inter­me­di­aries in client coun­tries who facil­i­tate the trans­ac­tions. Agents who receive 15% com­mis­sions, accord­ing to doc­u­ments filed in the case. Recall how the NSO Group sale to Mex­i­co in 2011 that Elliott Broidy was involved with includ­ed the “Mr. Lam­bo” Mex­i­can busi­ness­man who was basi­cal­ly act­ing as an inter­me­di­ary along with Broidy. It real­ly does sound like S was play­ing a Broidy-like role for Can­diru, hook­ing the com­pa­ny up with gov­ern­ments. And for sig­nif­i­cant com­mis­sions. 15% is poten­tial­ly tens of mil­lions of dol­lars for S based on the rev­enues also cit­ed in those doc­u­ments.

    The law­suit appears to cen­ter around com­mis­sions S feels they are stilled owed. The anony­mous “S” claims Can­diru had no clients and was only in two nego­ti­a­tions when he joined at the end of 2015. By the begin­ning of 2016, Can­diru had “a large num­ber deals in the advanced stage with clients in Europe, the for­mer Sovi­et Union, the Per­sian Gulf, Asia and Latin Amer­i­ca.” In oth­er words, “S” is claim­ing they showed up and brought in a large num­ber of deals that were rapid­ly moved to advanced stages in a mat­ter of months. And this fig­ured stayed on until 2018. So “S” is pre­sum­ably some­one involved with a large num­ber of Can­diru’s client deals.

    You have to won­der about the iden­ti­ty of “S”. How con­nect­ed are they? That’s like Elliott Broidy-league shady con­nec­tions, but “S” does­n’t appear to be Broidy. Who was able to show up at Can­diru and gen­er­ate high-end offen­sive cyber-sales to coun­tries around the globe? We don’t know, but who­ev­er they are they are pissed about how they were treat­ed for their stel­lar cyber­sales per­for­mance. So if what “S” is claim­ing is true, it’s pos­si­ble for a new super-spy­ware com­pa­ny to go from zero clients to clients around the world almost overnight. S did it. Yikes.

    S points to Zack­’s obvi­ous con­flict of inter­est in over­see­ing sales of Can­diru’s prod­ucts giv­en Zack­’s own­er­ship of shares in NSO Group at the time. Recall how NSO Group’s own­er­ship changed hands in 2019 fol­low­ing the Jamaal Khashog­gi assas­si­na­tion, sug­gest­ing Zack­’s own­er­ship in NSO Group may have end­ed at that point.

    But S’s con­flict-of-inter­est accu­sa­tions against Zack go much deep­er and point at the syn­er­gis­tic nature of Can­diru’s and NSO Group’s strengths: NSO Group spe­cial­izes in hack­ing smart­phones and Can­diru spe­cial­izes in Microsoft prod­ucts. Gov­ern­ments have a strong incen­tive to hire both firms. But as we’ve seen, Can­diru has also been mov­ing into non-Microsoft hacks, like Chrome hacks. S claims Can­diru decid­ed in 2017 to devel­op non-Microsoft hacks for smart­phones — NSO Group’s ter­ri­to­ry — but Zack sud­den­ly blocked and sales of mar­ket­ing of those new exploits in ear­ly 2018. Was Zack pro­tect­ing NSO Group? That’s the obvi­ous impli­ca­tion of S’s com­plaint, with the oth­er impli­ca­tion that this ban on non-Microsoft exploits crimped S’s com­mis­sions.

    Can­diru coun­ters that S broke the agent rules pro­tect­ing against bribery and cor­rup­tion. This is one of those times where it’s worth not­ing that both Can­diru’s and S’s claims to be true. They aren’t mutu­al­ly exclu­sive. Zack may real­ly have tak­en con­flict­ed steps to pro­tect NSO Group’s exploit dom­i­nance in the mar­ket­place. And S may have bro­ken the bribery and cor­rup­tion rules. These aren’t mutu­al­ly exclu­sive sce­nar­ios:

    Haaretz

    Cell­phone Hack­ing and Mil­lions in Gulf Deals: Inner Work­ings of Top Secret Israeli Cyber­at­tack Firm Revealed
    Leaked doc­u­ments con­firm that Can­diru does not just oper­ate spy­ware for com­put­ers but also has oper­a­tional mobile spytech. Here’s what we know about the cyber­at­tack firm offer­ing ‘untrace­able’ mic and cam­era manip­u­la­tion

    Ami­tai Ziv
    Sep. 7, 2020

    It has no web­site, its work­ers must sign strin­gent nondis­clo­sure agree­ments and they do not even update their LinkedIn pro­files with their place of employ­ment. That’s how Can­diru, one of Israel’s most mys­te­ri­ous cyber war­fare com­pa­nies, oper­ates. But leaked doc­u­ments obtained by The­Mark­er, Haaretz’s sis­ter pub­li­ca­tion, and court fil­ings made as part of a labor dis­pute between the com­pa­ny and a for­mer senior employ­ee reveal some details about it and pro­vide a rare glimpse into their secret oper­a­tions.

    Offen­sive cyber is a big busi­ness in Israel, with indus­try sources say­ing it gen­er­ates about $1 bil­lion in sales a year. The biggest and most con­tro­ver­sial of the play­ers is NSO, which has been cit­ed repeat­ed­ly for sell­ing its equip­ment to coun­tries like Sau­di Ara­bia and Mex­i­co that have used them to spy and crack down on dis­si­dents.

    NSO’s spe­cial­ty is hack­ing smart­phones. Up till now, lit­tle was known about Can­diru. The­Mark­er has revealed that the firm offers hack­ing tools used to break into com­put­ers and servers, and now, for the first time, has con­firmed it also has tech­nol­o­gy for break­ing into mobile devices.

    Accord­ing to a doc­u­ment signed by an unnamed vice pres­i­dent for Can­diru, they also offer a “high-end cyber intel­li­gence plat­form ded­i­cat­ed to infil­trate PC com­put­ers, net­works, mobile hand­sets, by using explo­sions and dis­sem­i­na­tions oper­a­tions.”

    The sys­tem, the doc­u­ment explains, enables “effec­tive and scal­able cyber intel­li­gence oper­a­tions covert­ly with­in indi­vid­ual [mobile devices]. Pro­pri­etary inflig­ta­tion agents are silent­ly deployed into tar­get PCs or mobile hand­sets with min­i­mal require­ments of tar­get inter­ac­tion.”

    “Once deployed”, the com­pa­ny boasts, “the untrace­able agents imme­di­ate­ly iden­ti­fy and map net­works the tar­get is con­nect­ed to.” In tan­dem, the sys­tem “initiate[s] unde­tect­ed data exfil­tra­tion tasks, through­out manip­u­la­tion and con­trol of device har­ward and local pro­grams” — these include social media accounts, com­mu­ni­ca­tion pro­grams or apps and the phone or com­put­er’s micro­phone or cam­era.

    For the full leaked doc­u­ment, click here

    Boast­ing three dif­fer­ent modes – PC/Windows, iOX (iPhone) and Android – the doc­u­ment says that, “Due to the sen­si­tive and strate­gic nature of cyber intel­li­gence oper­a­tions the sys­tem is designed as an off-the-shelf prod­uct, deploy­able as a stand-alone plat­form.” Can­diru claims the ser­vice can oper­ate around the globe, but notes that it can­not be deployed in the U.S., Israel, Rus­sia and Chi­na. NSO – which offers a sim­i­lar ser­vice – includes a sim­i­lar caveat.

    The doc­u­ment is the first con­fir­ma­tion that much like its com­peti­tor NSO, the spy­ware com­pa­ny has not only fin­ished devel­op­ing spytech focused on mobile phones, but also that this tech­nol­o­gy is now oper­a­tional and already up for sale.

    Inside Can­diru

    Can­diru was found­ed in 2015 by Eran Shorer and Yaakov Weiz­man. The largest share­hold­er in Isaac Zack, who has been its chair­man since the begin­ning and was also a found­ing fun­der of NSO. The com­pa­ny has moved offices fre­quent­ly and is now locat­ed on Ha’arba’a Street in Tel Aviv. It has also changed names sev­er­al times. It start­ed out as Can­diru, then became D.F. Asso­ciates, then mor­phed into Green­wick Solu­tions. Over the past year it’s also been called Tabatha Ltd., and now it’s known as Saito Tech, Ltd. But every­one in the indus­try still refers to it as Can­diru.

    The com­pa­ny helps law enforce­ment and intel­li­gence agen­cies in var­i­ous coun­tries hack into com­put­er sys­tems with­out per­mis­sion, to con­duct sur­veil­lance, steal infor­ma­tion and even cause dam­age. But what the com­pa­ny actu­al­ly does remains large­ly a rid­dle. How­ev­er, a law­suit filed by a for­mer employ­ee sheds light on some of their oper­a­tions, which it seems the firm would pre­fer be kept in the dark.

    The name of the senior employ­ee can be found online, but we will call him S. He was vice pres­i­dent of sales for Can­diru between Novem­ber 2015 and Decem­ber 2018. The law­suit, which he filed through attor­ney Tomer Hadas and Maayan Weiss Levi from the Holin-Hadas law firm, cen­ters on finan­cial com­pen­sa­tion he feels are com­ing to him, as well dam­ages for aggra­va­tion caused to him by what he claims is humil­i­at­ing treat­ment and a dis­missal process that he says was improp­er­ly con­duct­ed.

    The lit­tle evi­dence there is indi­cates that Candiru’s spe­cial­ty is hack­ing com­put­ers, but the court doc­u­ments reveal Can­diru began devel­op­ing a solu­tion for cel­lu­lar attacks as an alter­na­tive to its reg­u­lar ser­vices.

    “In 2017, the defendant’s senior man­age­ment decid­ed to devel­op a line of new prod­ucts, include cyber capa­bil­i­ties in the world of cel­lu­lar phones. Until then, the defen­dant had dealt with the cyber field and com­put­ers alone.,” S.’s attor­neys wrote. “How­ev­er, for some rea­son, in ear­ly 2018, Zack, for rea­sons known only to him, ordered a halt to the sale and mar­ket­ing of these prod­ucts.”

    Candiru’s attor­neys, how­ev­er, describe the com­pa­ny as sole­ly com­put­er-focused: “The com­pa­ny has a prod­uct that col­lects intel­li­gence from com­put­er net­works, which it has start­ed to mar­ket to gov­ern­ment agen­cies.”

    Code name Sphinx

    Accord­ing to the law­suit, when S. joined the com­pa­ny at the end of 2015, the com­pa­ny had only 12 employ­ees. It then states that by “the end of 2018,” it had 70 employ­ees. How many does it have now? One of the announce­ments doc­u­ment­ed in the law­suit speaks of “a com­pa­ny of 150 employ­ees.”

    Accord­ing to the suit, dur­ing its first year of exis­tence Can­diru had no clients but was in the midst of two dif­fer­ent nego­ti­a­tions. How­ev­er, S. claims that, “By the begin­ning of 2016 the defen­dant has a large num­ber of deals in the advanced stage with clients in Europe, the for­mer Sovi­et Union, the Per­sian Gulf, Asia and Latin Amer­i­ca. The results showed impres­sive sales of $10 mil­lion in 2016.”

    Lat­er on, S. argues, “In 2017 the defen­dant had sales of near­ly $30 mil­lion through­out the world, to clients in the Per­sian Gulf, West­ern Europe, the Far East and more.”

    One of the lines of defense offered by offen­sive cyber com­pa­nies is that they sell their ser­vices only to demo­c­ra­t­ic regimes. Accord­ing to this law­suit, this is not the case with Can­diru, since there are no demo­c­ra­t­ic coun­tries in the Per­sian Gulf, nor are most of the for­mer Sovi­et coun­tries demo­c­ra­t­ic.

    These quotes also reveal infor­ma­tion on Candiru’s rev­enues: agree­ments worth $30 mil­lion as of 2017. But it’s rea­son­able to assume that these were mul­ti­year agree­ments, as one can dis­cern from anoth­er part of the law­suit, in which S. demands the bonus com­ing to him as vice pres­i­dent of sales – 1 per­cent of the company’s rev­enues. Based on his cal­cu­la­tion, com­pa­ny rev­enues in 2018 were 65 mil­lion shekels (around $20 mil­lion).

    But S. is also insist­ing on his share of deals, “For which pay­ment was not yet received by the defen­dant as of the date of ter­mi­na­tion.” He attach­es a fas­ci­nat­ing appen­dix that osten­si­bly details the company’s entire stream of future trans­ac­tions. The projects are giv­en code names – Sphinx, Tiger, Ukulele, Otron1, Oltron2, Pointer1, Pointer2 and so on – a total of $367 mil­lion in deals (appar­ent­ly over sev­er­al years). The scope of the projects range from half a mil­lion dol­lars to $20 mil­lion. The law­suit also reveals that Can­diru con­ducts nego­ti­a­tions at var­i­ous lev­els in dozens of coun­tries. “The extent of the sales activ­i­ty includ­ed all the world’s con­ti­nents [that is, includ­ing Africa] and oppor­tu­ni­ties in more than 60 coun­tries,” it states.

    15% com­mis­sion

    The legal dis­pute sheds light on anoth­er sig­nif­i­cant com­po­nent of the offen­sive cyber mar­ket – the innards of the indus­try – the use of “agents” in the tar­get coun­tries. These are inter­me­di­aries who live in the tar­get coun­tries who help com­plete the deals and get com­mis­sions.

    The legal action reveals that the com­mis­sion paid to such agents is 15 per­cent, at least that’s what Can­diru pays. It’s no small sum when tak­ing into account the size of their dif­fer­ent deals, at times worth mil­lions of dol­lars.

    Accord­ing to Can­diru, “To uphold the strict reg­u­la­tions that apply to it with regard to every­thing con­nect­ed to engag­ing agents, the com­pa­ny set up an agents com­mit­tee whose job is to approve all agents in advance before they are engaged, and to set the com­mis­sion to be paid to him. Zack serves as chair­man of the company’s agents com­mit­tee and sign­ing an agree­ment with an agent who hasn’t been approved in advance by the com­mit­tee is for­bid­den.” The law­suit argues that S. signed up agents “and engaged them with­out their being approved as required.”

    Can­diru argues that S. under­mined these rules, set up to pre­vent bribery and cor­rup­tion, an espe­cial­ly sen­si­tive issue for weapons and cyber­at­tack firms that are also sub­ject to inter­na­tion­al con­ven­tions, and which has led to trou­ble for oth­er big firms in the past.

    Can­diru, through its attor­neys, com­plained that S. has revealed secret secu­ri­ty infor­ma­tion in his law­suit, which is why it’s demand­ing the court con­duct its hear­ings behind closed doors, “And order the secret infor­ma­tion be stored in the court’s safe in a closed enve­lope, and that all secret infor­ma­tion be removed the court system’s [pub­lic online sys­tem].”

    A merg­er with NSO?

    In addi­tion to “prob­lems with the prod­uct and its lack of tech­no­log­i­cal readi­ness for the mar­ket,” as plaintiff’s attor­neys put it, S. also claims a prob­lem of con­flict of inter­ests at Can­diru. “Even in 2017, [...] sub­stan­tial dif­fi­cul­ties stemmed from the inter­ven­tion of the con­trol­ling share­hold­er, Zack, inter­ven­tion that bor­dered on a seri­ous con­flict of inter­est that went against the finan­cial inter­est of the [com­pa­ny].”

    What con­flict of inter­est might this be? It’s pos­si­ble that the plain­tiff is argu­ing that Zack has a con­flict of inter­est because he holds a cyber offense com­pa­ny on the one hand (Can­diru), while on the oth­er hand is invest­ed in sev­er­al cyber defense firms.

    In the past, Zack (through the Founders Invest­ment Fund) held shares in NSO, and coin­ci­den­tal­ly, the law firm that rep­re­sents NSO, Erdi­nast, Ben Nathen Toledano, & Co., also rep­re­sents Can­diru.

    In July we revealed that in Decem­ber 2019, sev­er­al com­pa­nies had invest­ed in Can­diru, fore­most among them Uni­ver­sal Motors. Uni­ver­sal invest­ed $9 mil­lion in Can­diru in exchange for 10 per­cent of the com­pa­ny. The importer thus replaced anoth­er share­hold­er who want­ed to get out of the com­pa­ny – ven­ture cap­i­tal­ist Eli Wart­man. The deal sets Candiru’s val­ue at $90 mil­lion – not a high val­ue for a high-tech com­pa­ny, let alone one that deals in cyber offense.

    Candiru’s future is unclear but based on cau­tious mar­ket esti­mates, at a cer­tain point it will like­ly merge with NSO, either through a direct pur­chase by NSO or through Novalpina Cap­i­tal, a pri­vate equi­ty firm that con­trols NSO. These two cyber firms have com­ple­men­tary capa­bil­i­ties – one spe­cial­izes in mobile phones (NSO) while the oth­er in com­put­ers, so there would be log­ic to such a merg­er. In any case, if such a deal should go through, we will pre­sum­ably see it through UMI’s pub­lic hold­ings in Can­diru shares.

    ...

    ———–

    “Cell­phone Hack­ing and Mil­lions in Gulf Deals: Inner Work­ings of Top Secret Israeli Cyber­at­tack Firm Revealed” by Ami­tai Ziv; Haaretz; 09/07/2020

    “The com­pa­ny helps law enforce­ment and intel­li­gence agen­cies in var­i­ous coun­tries hack into com­put­er sys­tems with­out per­mis­sion, to con­duct sur­veil­lance, steal infor­ma­tion and even cause dam­age. But what the com­pa­ny actu­al­ly does remains large­ly a rid­dle. How­ev­er, a law­suit filed by a for­mer employ­ee sheds light on some of their oper­a­tions, which it seems the firm would pre­fer be kept in the dark.”

    If you want to learn about a super-secre­tive indus­try, fol­low the legal dis­putes. That’s one of the lessons in this sto­ry. Because as was the case with Elliott Broidy and the 2011 role he played in NSO Group secur­ing its first for­eign client in Mex­i­co, where con­tract dis­putes between the mul­ti­ple-mid­dle-men sales team became a key source of knowl­edge of how the indus­try oper­ates, we’re see­ing the same sce­nario play out with Can­diru. We know noth­ing about how the com­pa­ny oper­ates out­side of what we’re learn­ing in this sales agent con­tract dis­pute law­suit. These com­pa­nies oper­ate like black box­es. That’s why these law­suits are so impor­tant for our gen­er­al under­stand­ing of this rel­a­tive­ly new indus­try that secret­ly explod­ed over the last decade.

    And observe how explo­sive that growth appeared to be for Can­diru. It’s what the law­suit is all about. S claims to be the source of much of that ini­tial growth and was work­ing there from Novem­ber 2015 to Decem­ber 2018. So it’s prob­a­bly unfin­ished 2018 deals that the suit revolves around:

    ...
    The name of the senior employ­ee can be found online, but we will call him S. He was vice pres­i­dent of sales for Can­diru between Novem­ber 2015 and Decem­ber 2018. The law­suit, which he filed through attor­ney Tomer Hadas and Maayan Weiss Levi from the Holin-Hadas law firm, cen­ters on finan­cial com­pen­sa­tion he feels are com­ing to him, as well dam­ages for aggra­va­tion caused to him by what he claims is humil­i­at­ing treat­ment and a dis­missal process that he says was improp­er­ly con­duct­ed.
    ...

    Accord­ing to the law­suit, when S. joined the com­pa­ny at the end of 2015, the com­pa­ny had only 12 employ­ees. It then states that by “the end of 2018,” it had 70 employ­ees. How many does it have now? One of the announce­ments doc­u­ment­ed in the law­suit speaks of “a com­pa­ny of 150 employ­ees.”

    Accord­ing to the suit, dur­ing its first year of exis­tence Can­diru had no clients but was in the midst of two dif­fer­ent nego­ti­a­tions. How­ev­er, S. claims that, “By the begin­ning of 2016 the defen­dant has a large num­ber of deals in the advanced stage with clients in Europe, the for­mer Sovi­et Union, the Per­sian Gulf, Asia and Latin Amer­i­ca. The results showed impres­sive sales of $10 mil­lion in 2016.”

    Lat­er on, S. argues, “In 2017 the defen­dant had sales of near­ly $30 mil­lion through­out the world, to clients in the Per­sian Gulf, West­ern Europe, the Far East and more.”
    ...

    But it’s the accu­sa­tions involv­ing Can­diru’s largest share­hold­er, Isaac Zack, that are the most inter­est­ing in terms of estab­lish­ing what the rela­tion­ship real­ly is between Can­diru and NSO Group. Again, NSO Group’s own­er­ship changed hands in 2019 fol­low­ing the Jamaal Khashog­gi assas­si­na­tion, sug­gest­ing Zack­’s own­er­ship in NSO Group may have end­ed at that point. And “S” was at Can­diru from 2015 to 2018. So dur­ing S’s time at Can­diru, Zack was the largest share­hold­er and sat on the agents com­mit­tee, but was also a share­hold­er at NSO Group. Plus, Can­diru and NSO Group lit­er­al­ly share law firms. And indus­try observers expect Can­diru and NSO Group to even­tu­al­ly merge, due, in part, to their syn­er­gis­tic toolk­its. That’s all part of the con­flict of inter­est charge S is alleg­ing in the law­suit. The guy over­see­ing the Can­diru sales team had large invest­ments in one of Can­diru’s main com­peti­tors. Those are the claims of “S”, who also claims to have brought in enor­mous num­bers of new gov­ern­ment clients almost overnight after join­ing at the end of 2015 and who clear­ly does­n’t feel like they were ade­quate­ly com­pen­sat­ed:

    ...
    15% com­mis­sion

    The legal dis­pute sheds light on anoth­er sig­nif­i­cant com­po­nent of the offen­sive cyber mar­ket – the innards of the indus­try – the use of “agents” in the tar­get coun­tries. These are inter­me­di­aries who live in the tar­get coun­tries who help com­plete the deals and get com­mis­sions.

    The legal action reveals that the com­mis­sion paid to such agents is 15 per­cent, at least that’s what Can­diru pays. It’s no small sum when tak­ing into account the size of their dif­fer­ent deals, at times worth mil­lions of dol­lars.

    Accord­ing to Can­diru, “To uphold the strict reg­u­la­tions that apply to it with regard to every­thing con­nect­ed to engag­ing agents, the com­pa­ny set up an agents com­mit­tee whose job is to approve all agents in advance before they are engaged, and to set the com­mis­sion to be paid to him. Zack serves as chair­man of the company’s agents com­mit­tee and sign­ing an agree­ment with an agent who hasn’t been approved in advance by the com­mit­tee is for­bid­den.” The law­suit argues that S. signed up agents “and engaged them with­out their being approved as required.”

    ...

    In addi­tion to “prob­lems with the prod­uct and its lack of tech­no­log­i­cal readi­ness for the mar­ket,” as plaintiff’s attor­neys put it, S. also claims a prob­lem of con­flict of inter­ests at Can­diru. “Even in 2017, [...] sub­stan­tial dif­fi­cul­ties stemmed from the inter­ven­tion of the con­trol­ling share­hold­er, Zack, inter­ven­tion that bor­dered on a seri­ous con­flict of inter­est that went against the finan­cial inter­est of the [com­pa­ny].”

    What con­flict of inter­est might this be? It’s pos­si­ble that the plain­tiff is argu­ing that Zack has a con­flict of inter­est because he holds a cyber offense com­pa­ny on the one hand (Can­diru), while on the oth­er hand is invest­ed in sev­er­al cyber defense firms.

    In the past, Zack (through the Founders Invest­ment Fund) held shares in NSO, and coin­ci­den­tal­ly, the law firm that rep­re­sents NSO, Erdi­nast, Ben Nathen Toledano, & Co., also rep­re­sents Can­diru.

    ...

    Candiru’s future is unclear but based on cau­tious mar­ket esti­mates, at a cer­tain point it will like­ly merge with NSO, either through a direct pur­chase by NSO or through Novalpina Cap­i­tal, a pri­vate equi­ty firm that con­trols NSO. These two cyber firms have com­ple­men­tary capa­bil­i­ties – one spe­cial­izes in mobile phones (NSO) while the oth­er in com­put­ers, so there would be log­ic to such a merg­er. In any case, if such a deal should go through, we will pre­sum­ably see it through UMI’s pub­lic hold­ings in Can­diru shares.
    ...

    But it’s S’s claims about Zack­’s nix­ing of the sales of Can­diru’s smart­phone-tar­get­ing mal­ware in ear­ly 2018 that are par­tic­u­lar­ly inter­est­ing in terms of what’s in store for the future of Can­diru and NSO Group. That’s when S alleges the sale and mar­ket­ing of new­ly devel­oped line of “cel­lu­lar attacks” (smart­phone hacks) that Can­diru decid­ed to devel­op in 2017 were halt­ed by Zack. Hacks that more or less over­lap with what NSO Group spe­cial­izes in. Keep in mind that we’ve seen non-Microsoft exploits attrib­uted to Can­diru in 2021, so Can­diru appears to have gone ahead with the sale of non-Microsoft exploits in the end. But it still points towards the obvi­ous poten­tial syn­er­gy of merg­ing these two com­pa­nies:

    ...
    Can­diru was found­ed in 2015 by Eran Shorer and Yaakov Weiz­man. The largest share­hold­er in Isaac Zack, who has been its chair­man since the begin­ning and was also a found­ing fun­der of NSO. The com­pa­ny has moved offices fre­quent­ly and is now locat­ed on Ha’arba’a Street in Tel Aviv. It has also changed names sev­er­al times. It start­ed out as Can­diru, then became D.F. Asso­ciates, then mor­phed into Green­wick Solu­tions. Over the past year it’s also been called Tabatha Ltd., and now it’s known as Saito Tech, Ltd. But every­one in the indus­try still refers to it as Can­diru.

    ...

    The lit­tle evi­dence there is indi­cates that Candiru’s spe­cial­ty is hack­ing com­put­ers, but the court doc­u­ments reveal Can­diru began devel­op­ing a solu­tion for cel­lu­lar attacks as an alter­na­tive to its reg­u­lar ser­vices.

    “In 2017, the defendant’s senior man­age­ment decid­ed to devel­op a line of new prod­ucts, include cyber capa­bil­i­ties in the world of cel­lu­lar phones. Until then, the defen­dant had dealt with the cyber field and com­put­ers alone.,” S.’s attor­neys wrote. “How­ev­er, for some rea­son, in ear­ly 2018, Zack, for rea­sons known only to him, ordered a halt to the sale and mar­ket­ing of these prod­ucts.”

    Candiru’s attor­neys, how­ev­er, describe the com­pa­ny as sole­ly com­put­er-focused: “The com­pa­ny has a prod­uct that col­lects intel­li­gence from com­put­er net­works, which it has start­ed to mar­ket to gov­ern­ment agen­cies.”
    ...

    It’s worth keep­ing in mind that, while it’s entire­ly pos­si­ble plans for a future NSO Group/Candiru merg­er were behind Zack­’s deci­sion to halt the sales and mar­ket­ing of Can­diru’s smart­phone attacks, it’s also pos­si­ble there’s an active desire to com­part­men­tal­ize the indus­try by the types of attack. An oli­gop­oly of monop­o­lies. Like it might be bet­ter for one com­pa­ny to spe­cial­ize in attack Microsoft prod­ucts while anoth­er spe­cial­izes in iPhones, etc. There’s the obvi­ous monop­oly log­ic just in terms of com­pet­ing for pre­cious elite hack­er tal­ent. But beyond that there’s the sim­ple fact that the more com­pe­ti­tion there is in the cre­ation of these elite hack­ing tools, the greater the rate the indus­try is going to burn through zero-day exploits. There are only so many pos­si­ble zero-day exploits at any giv­en point, many with redun­dant pur­pos­es, which is why you don’t nec­es­sar­i­ly want to deploy redun­dant zero-day’s at the same time, run­ning the risk that more of your bag if tricks will get dis­cov­ered unnec­es­sar­i­ly. This is an indus­try where col­lu­sion between the com­pe­ti­tion can cre­ate pow­er­ful win-win sit­u­a­tions

    Inter­est­ing­ly, giv­en the rapid num­ber of deals “S” claims to have devel­oped almost imme­di­ate­ly for Can­diru in late 2015/early 2016, Can­diru respond­ed to the law­suit by argu­ing that “S” was break­ing the agent com­mit­tee rules set up to pre­vent bribery and cor­rup­tion. So we have duel­ing, but not mutu­al­ly exclu­sive, pic­tures. It’s the kind of duel­ing accu­sa­tions that raise obvi­ous ques­tions about what sorts of bribery and cor­rup­tion was S engaged in to secure all those deals? Unfor­tu­nate­ly, Can­diru does­n’t want to share that pub­licly and pushed for the tri­al to be con­duct­ed behind closed doors:

    ...
    Can­diru argues that S. under­mined these rules, set up to pre­vent bribery and cor­rup­tion, an espe­cial­ly sen­si­tive issue for weapons and cyber­at­tack firms that are also sub­ject to inter­na­tion­al con­ven­tions, and which has led to trou­ble for oth­er big firms in the past.

    Can­diru, through its attor­neys, com­plained that S. has revealed secret secu­ri­ty infor­ma­tion in his law­suit, which is why it’s demand­ing the court con­duct its hear­ings behind closed doors, “And order the secret infor­ma­tion be stored in the court’s safe in a closed enve­lope, and that all secret infor­ma­tion be removed the court system’s [pub­lic online sys­tem].”
    ...

    Final­ly, regard­ing the claims by both Can­diru and NSO Group that the mal­ware can’t be deployed in the US, Israel, Rus­sia and Chi­na, take a look at the next arti­cle from last week about a new report on where Can­diru’s mal­ware just showed up:

    ...
    Boast­ing three dif­fer­ent modes – PC/Windows, iOX (iPhone) and Android – the doc­u­ment says that, “Due to the sen­si­tive and strate­gic nature of cyber intel­li­gence oper­a­tions the sys­tem is designed as an off-the-shelf prod­uct, deploy­able as a stand-alone plat­form.” Can­diru claims the ser­vice can oper­ate around the globe, but notes that it can­not be deployed in the U.S., Israel, Rus­sia and Chi­na. NSO – which offers a sim­i­lar ser­vice – includes a sim­i­lar caveat.
    ...

    Four coun­tries are on the do-no-deploy black­list. But as the fol­low­ing arti­cle sug­gests, it might be more of a greylist. Because Can­diru’s mal­ware was just found on com­put­ers in Rus­sia and Israel accord­ing to the Sep­tem­ber report by cyber­se­cu­ri­ty com­pa­ny ESET. They’re described as infect­ed “com­put­ers” in the report, sug­gest­ing these aren’t smart­phones. They might be lap­tops, which rais­es the dis­tinct pos­si­bil­i­ty they were hacked out­side of these coun­tries. We don’t know. But it’s a reminder that even cit­i­zens and res­i­dents of declared do-not-hack coun­tries can’t real­ly expect to be pro­tect­ed once they leave their do-not-hack coun­tries:

    Haaretz

    Advanced Spy­ware From Israel’s Can­diru Dis­cov­ered on Russ­ian, Turk­ish, Pales­tin­ian Com­put­ers
    The high­ly-tar­get­ed mal­ware is sold by the Israeli firm to clients who use it to spy on jour­nal­ists, dis­si­dents and oth­ers, cyber­se­cu­ri­ty com­pa­ny ESET says in new report

    Ami­tai Ziv
    Oct. 3, 2021

    Spy­ware made by the Tel Aviv-based hack­ing tool com­pa­ny Can­diru has been found on sev­er­al com­put­ers in Europe and the Mid­dle East, the cyber­se­cu­ri­ty com­pa­ny ESET report­ed.

    In their Sep­tem­ber report, ESET wrote that accord­ing to research pub­lished by Cit­i­zen Lab and the Microsoft Threat Intel­li­gence Cen­ter in July about Can­diru’s Dev­il­sTongue mal­ware, it is “sold to third par­ties, which can abuse it to spy on var­i­ous vic­tims, includ­ing human rights defend­ers, dis­si­dents, jour­nal­ists, activists and politi­cians.”

    ESET researchers, the report says, “Dis­cov­ered indi­ca­tions of Dev­il­sTongue mal­ware in our teleme­try data, affect­ing about 10 com­put­ers” in Alba­nia, Rus­sia and the Mid­dle East. The mal­ware was found in Israel, the Pales­tin­ian ter­ri­to­ries, Turkey and oth­er parts of the region.

    It also states that “The mal­ware is high­ly tar­get­ed: each Dev­il­sTongue vic­tim we iden­ti­fied had a cus­tom sam­ple with PE resources unique to that vic­tim.” The men­tion of the “murky Israeli mer­ce­nary spy­firm,” as Can­diru is dubbed in the report, is like­ly to per­turb Israelis.

    In July, Microsoft and Google report­ed a num­ber of zero-day vul­ner­a­bil­i­ties found in the Win­dows oper­at­ing sys­tem and the pop­u­lar Chrome web brows­er. Can­diru had exploit­ed these vul­ner­a­bil­i­ties in order to attack tar­gets in about 100 coun­tries, from Iran and Lebanon to Spain and the Unit­ed King­dom.

    Accord­ing to Cit­i­zen Lab, in that attack, Can­diru’s clients used a num­ber of domains, includ­ing ones linked to gen­der and human rights, in order to implant mal­ware into users’ web browsers, such as blacklivesmatter.info and genderconference.org. Their goal was social engi­neer­ing – exploit­ing human vul­ner­a­bil­i­ties to get peo­ple to click links and to affect­ed web­sites.

    The intend­ed vic­tims are still not defin­i­tive­ly known. The Cit­i­zen Lab report said that human rights activists, polit­i­cal dis­si­dents, jour­nal­ists, human rights work­ers and politi­cians were among the tar­gets.

    Sim­i­lar dis­cov­er­ies have been made regard­ing anoth­er Israeli com­pa­ny, NSO, who shares some of its clients with Can­diru. Coun­tries like Qatar, Uzbek­istan, Sau­di Ara­bia and the Unit­ed Arab Emi­rates appear to have patron­ized NSO along­side Can­diru, using the lat­ter’s tech­nol­o­gy for PC com­put­ers.

    ...

    Microsoft fixed the dis­cov­ered flaws through a soft­ware update soon after they were found. The com­pa­ny did not direct­ly attribute the exploits to Can­diru, instead refer­ring to it as an “Israel-based pri­vate sec­tor offen­sive actor” under the code name Sour­gum.

    ————-

    “Advanced Spy­ware From Israel’s Can­diru Dis­cov­ered on Russ­ian, Turk­ish, Pales­tin­ian Com­put­ers” by Ami­tai Ziv; Haaretz; 10/03/2021

    “ESET researchers, the report says, “Dis­cov­ered indi­ca­tions of Dev­il­sTongue mal­ware in our teleme­try data, affect­ing about 10 com­put­ers” in Alba­nia, Rus­sia and the Mid­dle East. The mal­ware was found in Israel, the Pales­tin­ian ter­ri­to­ries, Turkey and oth­er parts of the region.”

    Of the 10 com­put­ers ESET found with Can­diru’s mal­ware, 2 of them came from the do-not-hack coun­tries Can­diru claims its mal­ware can’t hack. Maybe these 2 com­put­ers were hacked in dif­fer­ent coun­tries. We don’t know. We we do know is that any new mean­ing­ful insights into how com­pa­nies like Can­diru or NSO Group actu­al­ly oper­ate — from how they sign up clients to the over­sight or lack there­of of those clients after they’re giv­en the super-mal­ware — will like­ly only be learned from more “agent” law­suits.

    Posted by Pterrafractyl | October 12, 2021, 1:17 am

  14. We’ve long been told that the NSO Group’s spy­ware can’t tar­get US and UK-based phones. But how true is that real­ly? Is this like a built-in safe­guard, where the Pega­sus spy­ware auto­mat­i­cal­ly pre­vents the tar­get­ing of phones with num­bers that start with a ‘+1′ or ‘+44’ (the US and UK coun­try codes)? Or is it a ban pure­ly root­ed in pol­i­cy, where NSO Group mere­ly asks clients not to hack US or UK phones but clients could do so if they chose to? We may be get­ting an indi­rect answer to those basic ques­tions about what the NSO Group’s 40+ state-clients are capa­ble of doing with this super-spy­ware.

    Can US and UK gov­ern­ment offi­cials get hacked by any of those 40+ NSO Group clients or not? It’s kind of a huge ques­tion. After all, think about how the 2016 hack of the DNC and all of the events sur­round­ing that can be rein­ter­pret­ed when we fac­tor in the pos­si­bil­i­ty that dozens of nation states had the capac­i­ty to hack the sh$t out of US polit­i­cal and gov­ern­ment fig­ures. We can’t for­get that the crown princes of Sau­di Ara­bia and the UAE were lit­er­al­ly offer­ing secret polit­i­cal manip­u­la­tion cam­paigns to assist Trump cam­paign. Polit­i­cal manip­u­la­tion cam­paigns that would use the ser­vices of elite Israeli IT mer­ce­nary firms like Psy­Group. So if that’s what we know they were direct­ly offer­ing the Trump cam­paign, what about tools like NSO Group’s Pega­sus that both the Saud­is and UAE had access to? Was that offered to the Trump cam­paign too in 2016? It’s a ques­tion that’s rarely asked in the con­text of the NSO Group sto­ry, and yet if we learn that Pega­sus could indeed hack US and UK-based phones it’s hard to see why the pos­si­ble use of NSO Group spy­ware in 2016 should­n’t imme­di­ate­ly become a major ques­tion.

    That all part of what makes the unfold­ing sto­ry about the ruler of Dubai’s hack of his estranged ex-wife poten­tial­ly such a big sto­ry. Because we’re now learn­ing that, yes, UK phones are hack­able. The ruler of Dubai — Sheikh Mohammed bin Rashid al-Mak­toum, who is also the vice pres­i­dent and prime min­is­ter of the UAE — ordered the hack­ing of his ex-wife’s phone. Along with the phones of her lawyer and secu­ri­ty team. The hack­ing appar­ent­ly took place dur­ing the cou­ple’s ongo­ing cus­tody bat­tle in Lon­don over their chil­dren. So it sounds like the hack­ing took place in the UK. And it turns out Princess Haya bint al-Hus­sein’s lawyer just hap­pens to be Fiona Shack­le­ton, a law­mak­er in Britain’s House of Lords. So a mem­ber of the UK par­lia­ment was hacked in Lon­don using Pega­sus. The ruler of Dubai was capa­ble of order­ing this last year.

    The hack was report­ed­ly dis­cov­ered when a cybert expert study­ing the pos­si­ble use of Pega­sus against a UAE activist real­ized the phones were being hacked and passed on the infor­ma­tion (pre­sum­ably to Cit­i­zen­Lab or a sim­i­lar group). Inter­est­ing­ly, NSO Group claims it also learned about the hack more or less at the same time from a whistle­blow­er who informed the com­pa­ny that Pega­sus was being mis­used against the princess and her legal team. NSO Group informed Cherie Blair (Tony Blair’s wife), who was hired by NSO Group to work as an exter­nal advis­er on human rights, and asked her to get a warn­ing to the princess. It’s a rather con­ve­nient sto­ry for NSO Group. We aren’t told any­thing more about this alleged whistle­blow­er. NSO Group informs us it then cut the UAE’s con­tract. The move pre­sum­ably made al-Mak­toum a lot less pop­u­lar with all the UAE’s oth­er rulers try­ing to hack their own ex-wifes’ phones.

    But then there’s still the ques­tion: did these phones have UK (or US) phone num­bers, which we are told Pega­sus can’t tar­get? That would be kind of a huge con­tra­dic­tion of NSO Group’s repeat­ed assur­ances, after all. And to get that answer we can look back at some ear­ly report­ing on this princess hack­ing sto­ry from back in ear­ly August, when we were learn­ing about a group of oth­er fig­ures close to the princess who were also hacked, includ­ing British human right’s lawyer and David Haigh. Haigh is the for­mer man­ag­ing direc­tor of Leeds Unit­ed Foot­ball Club and cur­rent Chair­man of Leeds Unit­ed Ladies Foot­ball Club. Haigh also hap­pens to be an out­spo­ken crit­ic of Dubai and spent time in prison there over charges of embez­zle­ment. He claims to have been tor­tured while in prison. So Haigh is a fig­ure the gov­ern­ment of Dubai would have all sorts of rea­son to want to hack. But, in the­o­ry, he should have been pro­tect­ed as a UK cit­i­zen. Instead, Haigh’s hacked phone hap­pened to have a ‘+44’ UK num­ber. That’s our answer. UK phones are hack­able. And there­fore pre­sum­ably US phones too.

    And politi­cians are hack­able in in these coun­tries. That’s what we are learn­ing from this sto­ry. It’s quite an update to the NSO Group sto­ry. And poten­tial­ly a major update to quite a few oth­er hack­ing-relat­ed sto­ries. For a decade now, dozens of coun­tries around the world have been gain­ing the abil­i­ty to exe­cute super secret hacks, and politi­cians and world lead­ers are all poten­tial tar­gets. Even the US and UK politi­cians who are sup­posed to be safe. That’s the pic­ture that’s emerg­ing. And yet, as we’ve seen, this is all more or less direct­ly tol­er­at­ed by the Israeli gov­ern­ment and indi­rect­ly tol­er­at­ed by the US gov­ern­ment. It’s a wild sto­ry that keeps get­ting wilder.

    Ok, first, here’s an arti­cle from ear­li­er this month about the can­cel­la­tion of the UAE’s NSO Group con­tracts over the hack­ing of Princess Haya and her legal team. A legal team that includes her lawyer Fiona Shack­le­ton, a law­mak­er in Britain’s House of Lords:

    Reuters

    NSO end­ed Pega­sus con­tract with UAE over Dubai lead­er’s hack­ing

    By Michael Hold­en
    Octo­ber 6, 2021 1:55 PM CDT Updat­ed

    LONDON, Oct 6 (Reuters) — The Israeli-based NSO Group end­ed its con­tract with the Unit­ed Arab Emi­rates to use its pow­er­ful “Pega­sus” state spy­ware tool because Dubai’s ruler was using it to hack the phones of his ex-wife and some close to her, her lawyers told Eng­land’s High Court.

    Sheikh Mohammed bin Rashid al-Mak­toum, vice pres­i­dent and prime min­is­ter of the UAE, instruct­ed the hack­ing of six phones belong­ing to Princess Haya bint al-Hus­sein, her lawyers and secu­ri­ty team, Eng­land’s High Court ruled in a judg­ment which was made pub­lic on Wednes­day. read more

    The hack­ing took place last year dur­ing the cou­ple’s ongo­ing mul­ti-mil­lion dol­lar cus­tody bat­tle in Lon­don over their two chil­dren.

    Dur­ing the hear­ings, the court heard that NSO had can­celled its con­tract with the UAE for breach­ing its rules on using Pega­sus, a sophis­ti­cat­ed “wire­tap” sys­tem used to har­vest data from the mobile devices of spe­cif­ic sus­pect­ed major crim­i­nals or ter­ror­ists.

    “When­ev­er a sus­pi­cion of a mis­use aris­es, NSO inves­ti­gates, NSO alerts, NSO ter­mi­nates,” NSO, which only licens­es its soft­ware to gov­ern­ment intel­li­gence and law enforce­ment agen­cies, said in a state­ment after the rul­ings were pub­lished.

    It said it had shut down six sys­tems of past cus­tomers, con­tracts worth more than $300 mil­lion. NSO did not go into specifics.

    The sheikh reject­ed the court’s con­clu­sions, say­ing they were based on an incom­plete pic­ture.

    “I have always denied the alle­ga­tions made against me and I con­tin­ue to do so,” he said in a state­ment.

    The hack­ing of Haya and those con­nect­ed to her, includ­ing her lawyer Fiona Shack­le­ton, a law­mak­er in Britain’s House of Lords, came to light at the start of August last year.

    A cyber expert study­ing the pos­si­ble use of Pega­sus against a UAE activist realised the phones were being hacked and passed on the infor­ma­tion, accord­ing to doc­u­ments and evi­dence giv­en to the court.

    At the same time, NSO were alert­ed by a whistle­blow­er that the soft­ware was being mis­used to tar­get Haya and her legal team, a source famil­iar with the com­pa­ny told Reuters.

    It imme­di­ate­ly informed Cherie Blair, a high-pro­file British lawyer hired by NSO to work as an exter­nal advis­er on human rights, to get a warn­ing to the princess.

    With­in two hours, the com­pa­ny shut down the cus­tomer’s sys­tem and then pre­vent­ed any oth­er client from being able to use Pega­sus to tar­get British num­bers, a mea­sure still in place today, the source said.

    PROBLEM

    Blair, wife of for­mer British Prime Min­is­ter Tony Blair, said in a state­ment to the court: “Dur­ing a con­ver­sa­tion with the NSO senior man­ag­er, I recall ask­ing him whether their client was the big state or the lit­tle state, the man­ag­er clar­i­fied it was the lit­tle state which I took to be the state of Dubai.”

    She told Shack­le­ton that NSO had imme­di­ate­ly stopped the coun­try involved using Pega­sus, and had demand­ed answers.

    “Cherie Blair said if they weren’t using the soft­ware to find gen­uine ter­ror­ists, they had a prob­lem,” Haya’s lawyer Charles Geekie told the court. “Her client did not want to be con­nect­ed to this type of behav­iour and want­ed to help.”

    In a let­ter to the court on Dec. 14 last year, NSO said it had can­celled its con­tract with its client, who the com­pa­ny declined to iden­ti­fy.

    “As the NSO let­ter of Decem­ber 2020 makes plain, after its inves­ti­ga­tion NSO has adopt­ed the extreme rem­e­dy of ter­mi­nat­ing its cus­tomer’s use of the Pega­sus soft­ware,” Judge Andrew McFar­lane, Pres­i­dent of the Fam­i­ly Divi­sion in Eng­land and Wales, said in his rul­ing.

    “In com­mer­cial terms, this step is to be under­stood as hav­ing great sig­nif­i­cance.”

    ...

    In Octo­ber 2019, What­sApp sued NSO, accus­ing it of help­ing gov­ern­ment spies break into the phones of rough­ly 1,400 users across four con­ti­nents with tar­gets includ­ing diplo­mats, polit­i­cal dis­si­dents and senior gov­ern­ment offi­cials.

    The firm had about 45 coun­tries as cus­tomers, but had refused to do busi­ness with 90 oth­ers because they could­n’t trust them over human rights issues, the source said.

    ———–

    “NSO end­ed Pega­sus con­tract with UAE over Dubai lead­er’s hack­ing” by Michael Hold­en; Reuters; 10/06/2021

    “Sheikh Mohammed bin Rashid al-Mak­toum, vice pres­i­dent and prime min­is­ter of the UAE, instruct­ed the hack­ing of six phones belong­ing to Princess Haya bint al-Hus­sein, her lawyers and secu­ri­ty team, Eng­land’s High Court ruled in a judg­ment which was made pub­lic on Wednes­day. read more”

    The ruler of Dubai, who also hap­pened to the the UAE’s prime min­is­ter, instruct­ed the hack­ing. That’s what the court in Lon­don con­clud­ed as part of the legal fight between Sheikh Mohammed bin Rashid al-Mak­toum and Princess Haya bint al-Hus­sein in their cus­tody bat­tle. A hack­ing that took place dur­ing the cus­tody bat­tle last year in Lon­don. It’s a damn­ing detail for NSO Group if Haya was in Lon­don dur­ing the time of the hack. And espe­cial­ly damn­ing if she had a UK-based phone num­ber:

    ...
    The hack­ing took place last year dur­ing the cou­ple’s ongo­ing mul­ti-mil­lion dol­lar cus­tody bat­tle in Lon­don over their two chil­dren.

    Dur­ing the hear­ings, the court heard that NSO had can­celled its con­tract with the UAE for breach­ing its rules on using Pega­sus, a sophis­ti­cat­ed “wire­tap” sys­tem used to har­vest data from the mobile devices of spe­cif­ic sus­pect­ed major crim­i­nals or ter­ror­ists.

    “When­ev­er a sus­pi­cion of a mis­use aris­es, NSO inves­ti­gates, NSO alerts, NSO ter­mi­nates,” NSO, which only licens­es its soft­ware to gov­ern­ment intel­li­gence and law enforce­ment agen­cies, said in a state­ment after the rul­ings were pub­lished.
    ...

    But it’s the hack­ing of Haya’s lawyer, Fiona Shack­le­ton that is utter­ly damn­ing for NSO Group’s claims that the UK is pro­tect­ed from its spy­ware. A mem­ber of the House of Lords got hacked with Pega­sus:

    ...
    The hack­ing of Haya and those con­nect­ed to her, includ­ing her lawyer Fiona Shack­le­ton, a law­mak­er in Britain’s House of Lords, came to light at the start of August last year.

    A cyber expert study­ing the pos­si­ble use of Pega­sus against a UAE activist realised the phones were being hacked and passed on the infor­ma­tion, accord­ing to doc­u­ments and evi­dence giv­en to the court.

    At the same time, NSO were alert­ed by a whistle­blow­er that the soft­ware was being mis­used to tar­get Haya and her legal team, a source famil­iar with the com­pa­ny told Reuters.

    It imme­di­ate­ly informed Cherie Blair, a high-pro­file British lawyer hired by NSO to work as an exter­nal advis­er on human rights, to get a warn­ing to the princess.

    With­in two hours, the com­pa­ny shut down the cus­tomer’s sys­tem and then pre­vent­ed any oth­er client from being able to use Pega­sus to tar­get British num­bers, a mea­sure still in place today, the source said.
    ...

    And now here’s a WaPo report from ear­ly August about the rev­e­la­tion that fig­ures close to Princess Haya in the UK were hacked last August. Fig­ures like David Haigh, who had been secret­ly exchang­ing videos and text mes­sages with the princess for more than a year and half from a phone smug­gled into the Dubai vil­la where she was being held. She stopped respond­ing on July 21, 2020. Haigh’s phone was hacked two weeks lat­er. It’s the kind of anec­dote that shows what must be the irre­sistible allure of the pow­er of this spy­ware. Once Sheikh Mak­toum found her phone and knew who to hack, they could hack them. Two weeks lat­er Haigh was hacked and there was basi­cal­ly noth­ing he could do about it. It’s incred­i­ble pow­er. Ever more so when it can be wield­ed in the UK. Or the US. Based on what we can infer from the avail­able data, UK phones, and log­i­cal­ly US phones too, were viable tar­gets as long as clients were will­ing to break the rules. Just imag­ine how many enti­ties out there with access to these tools may have want­ed to hack the Democ­rats in 2015 or 2016. They all could have done it:

    The Wash­ing­ton Post

    Human rights activist and close ally of detained Dubai princess had phone hacked by NSO spy­ware, foren­sic test finds

    A new Pega­sus Project exam­i­na­tion adds to the con­firmed tar­gets of the sur­veil­lance firm’s gov­ern­ment clients around the world. The activist David Haigh said he was ‘hor­ri­fied’ by this ‘attack on human rights by a despot­ic regime.’

    By Drew Har­well and Dan Sab­bagh
    August 2, 2021 at 12:01 p.m. EDT

    A phone belong­ing to a promi­nent sup­port­er of two princess­es who fled Dubai was infect­ed with Pega­sus spy­ware last year, a new foren­sic exam­i­na­tion shows, offer­ing more evi­dence that gov­ern­ment clients of the Israeli sur­veil­lance giant NSO Group have used its phone-hack­ing tool to tar­get human rights activists.

    The rev­e­la­tion that David Haigh’s iPhone 11 was hacked last August comes as evi­dence also grows that Pega­sus also was used to tar­get jour­nal­ists. Amnesty Inter­na­tion­al researchers iden­ti­fied four more phones from a list of 50,000 that were either infect­ed or tar­get­ed with Pega­sus spy­ware; two of those belonged to jour­nal­ists.

    Addi­tion­al­ly, the French gov­ern­ment told a French news out­let that its inves­ti­ga­tors had con­firmed Amnesty’s ear­li­er find­ings that two of its jour­nal­ists had been hacked. It was the first cor­rob­o­ra­tion by a gov­ern­ment of Amnesty’s find­ings.

    Haigh said that at the time of the infec­tion, he was secret­ly com­mu­ni­cat­ing with Princess Lat­i­fa bint Mohammed al-Mak­toum, the daugh­ter of Dubai’s ruler, Sheikh Mohammed bin Rashid al-Mak­toum. The princess had been detained by Dubai oper­a­tives in 2018 after she attempt­ed a dar­ing escape across the Ara­bi­an Sea.

    Haigh said he had been exchang­ing videos and text mes­sages for more than a year and a half with Princess Lat­i­fa through a phone that had been smug­gled into the Dubai vil­la where she was being held. She stopped respond­ing on July 21, 2020, accord­ing to a screen­shot of the mes­sages Haigh shared. The analy­sis shows that Haigh’s phone was hacked two weeks lat­er.

    The princess’s sto­ry was high­light­ed in reports by The Wash­ing­ton Post and a con­sor­tium of news orga­ni­za­tions coor­di­nat­ed by the French jour­nal­ism non­prof­it For­bid­den Sto­ries and oper­at­ing as the Pega­sus Project.

    The jour­nal­ists ana­lyzed the list of more than 50,000 phone num­bers in an effort to iden­ti­fy to whom they belonged, and with the help of researchers at Amnesty International’s Secu­ri­ty Lab, exam­ined some of the phones for evi­dence of attempt­ed or suc­cess­ful hacks.

    Before pub­li­ca­tion of a series of arti­cles last month, the Amnesty researchers exam­ined data from 67 smart­phones on the list: Twen­ty-three showed suc­cess­ful infec­tions, while 14 oth­ers showed signs of an attempt. Thir­ty of the tests were incon­clu­sive.

    In the days since, the jour­nal­ists have con­tin­ued to ask whether peo­ple who had sus­pi­cions that they were tar­get­ed would con­sent to have their phones exam­ined. Fol­low­ing those tests, the researchers said they found traces of Pega­sus on five oth­er phones. Four of those num­bers were on the list. NSO offi­cials have reject­ed sug­ges­tions that the list is relat­ed to the sur­veil­lance activ­i­ties of its clients.

    Haigh’s num­ber does not appear on the list, which includ­ed phone records only up to 2019, the year before Haigh’s phone was hacked. But jour­nal­ists nev­er­the­less asked if he would con­sent to his phone being test­ed as part of the ongo­ing inves­ti­ga­tion.

    Of the four new­ly exam­ined phones that were on the list and showed traces of Pega­sus in foren­sic exams, three had been infect­ed and the fourth showed signs of hav­ing been tar­get­ed with mali­cious text mes­sages that includ­ed links to web­sites known to be used in Pega­sus hacks.

    The infect­ed phones belonged to Anas Altikri­ti, a Mus­lim activist in the Unit­ed King­dom; Brigit­ta Csikász, a jour­nal­ist in Hun­gary; and Ragip Soy­lu, a jour­nal­ist in Turkey for the news orga­ni­za­tion Mid­dle East Eye, whose phone was infect­ed sev­er­al times between Feb­ru­ary and July of this year, the foren­sic analy­ses showed. The fourth phone had been used by a legal offi­cer in India.

    Amnesty researchers said their foren­sic exam­i­na­tion showed that Haigh’s iPhone had been com­pro­mised by Pega­sus through a vul­ner­a­bil­i­ty in the iMes­sage app. That com­pro­mise took place Aug. 3, 2020, the researchers said. The analy­sis also found that there had been an “exe­cu­tion of a Pega­sus process” on both Aug. 3 and 4.

    The researchers’ test detects indi­ca­tors that are spe­cif­ic to Pega­sus, such as web­site domains, iCloud accounts and snip­pets of code. When phones have been replaced, the researchers are able to detect intru­sions from data that users gen­er­al­ly move from their old phone to their new.

    The analy­sis could not say what, if any, files had been tak­en from the device. Haigh said the phone held a con­sid­er­able amount of mes­sages and sen­si­tive infor­ma­tion per­tain­ing to Latifa’s life.

    Mean­while, the French news orga­ni­za­tion Medi­a­part report­ed that French gov­ern­ment inves­ti­ga­tors had con­firmed Amnesty’s find­ings that phones belong­ing to two of its jour­nal­ists had been infect­ed by Pega­sus. Medi­a­part said For­bid­den Sto­ries had noti­fied it in April that the jour­nal­ists’ phones had been found on the list and that the jour­nal­ists had con­sent­ed to Amnesty con­duct­ing a foren­sic exam­i­na­tion.

    In response to a judi­cial com­plaint lodged by the jour­nal­ists, French inves­ti­ga­tors also con­duct­ed an exam­i­na­tion of the phones and con­firmed the infec­tions, Medi­a­part report­ed.

    ...

    NSO mar­ket­ing doc­u­ments and inde­pen­dent analy­ses from the Uni­ver­si­ty of Toronto’s Cit­i­zen Lab say Pega­sus can infil­trate a phone in sec­onds, even with­out the own­er click­ing a link. Once infect­ed, hack­ers have access to vir­tu­al­ly every­thing on the phone, includ­ing pho­tos, videos, call logs, emails, saved pass­words, text mes­sages and loca­tion data. The mal­ware can also be used to acti­vate the phone’s cam­eras and micro­phones.

    The foren­sic analy­sis of Haigh’s phone could not deter­mine which NSO client insti­gat­ed the hack. But two peo­ple famil­iar with NSO oper­a­tions, who spoke to The Post on the con­di­tion of anonymi­ty to dis­cuss inter­nal affairs, say NSO ter­mi­nat­ed its con­tract with Dubai with­in the last year after it learned of the princess­es’ sur­veil­lance and oth­er human rights con­cerns.

    NSO offi­cials respond­ed to a request for com­ment for this arti­cle by point­ing to a state­ment last month say­ing the com­pa­ny would no longer answer jour­nal­ists’ ques­tions. Pre­vi­ous­ly, NSO has said its spy­ware tool is sup­posed to be used by its gov­ern­ment clients only to track crim­i­nals and ter­ror­ists. The com­pa­ny has said it inves­ti­gates claims of mis­use and intends to review the alleged abus­es revealed in the Pega­sus Project inves­ti­ga­tion and take appro­pri­ate action.

    The com­pa­ny said in a June “trans­paren­cy report” that it had sev­ered deals with gov­ern­ment clients in cas­es where the sys­tem has been used improp­er­ly, includ­ing to tar­get “pro­tect­ed” indi­vid­u­als.

    The hack of Haigh’s phone marked the first time that Amnesty’s researchers had iden­ti­fied a suc­cess­ful Pega­sus attack on a U.K. phone num­ber. A per­son famil­iar with NSO oper­a­tions said that phone num­bers with the U.K. coun­try code of +44, such as Haigh’s phone, were blocked from search­es rough­ly six months ago but offered no fur­ther detail. NSO has said that num­bers with the Unit­ed States’ +1 coun­try code also can­not be hacked.

    After Amnesty shared the evi­dence with Haigh show­ing his phone had been hacked, the British activist said in a state­ment that he was “hor­ri­fied” by this “state-spon­sored harass­ment” and called on the U.K. gov­ern­ment to inves­ti­gate this “attack on human rights by a despot­ic regime.”

    Haigh report­ed the hack to the Devon and Corn­wall police force, which cov­ers the stretch of south­ern Eng­land where he lives. Police offi­cials have con­tact­ed Amnesty about poten­tial­ly inves­ti­gat­ing the hack, the researchers said.

    Offi­cials in Dubai, one of the Unit­ed Arab Emi­rates’ wealth­i­est enclaves, did not respond to requests for com­ment. The UAE’s For­eign Min­istry said in a state­ment last month: “The alle­ga­tions made by recent press reports claim­ing that the UAE is amongst a num­ber of coun­tries accused of alleged sur­veil­lance tar­get­ting of jour­nal­ists and indi­vid­u­als have no evi­den­tiary basis and are cat­e­gor­i­cal­ly false.”

    Per­son­al attor­neys for Sheikh Mohammed, Latifa’s father and the emi­rates’ prime min­is­ter, vice pres­i­dent and min­is­ter of defense, declined to com­ment. They have pre­vi­ous­ly denied his involve­ment in any hacks and said the episode — includ­ing the com­man­do assault on his daughter’s escape yacht, which the sheikh has called a res­cue — is a pri­vate fam­i­ly mat­ter.

    Haigh was pho­tographed in Novem­ber 2019 along­side Tiina Jauhi­ainen, one of Latifa’s clos­est friends and a col­lab­o­ra­tor in her failed escape, out­side the U.K. High Court pro­ceed­ings for Sheikh Mohammed’s ex-wife, Princess Haya bint Hus­sein, who is fight­ing a cus­tody bat­tle after flee­ing Dubai with her two young chil­dren.

    In March 2020, the High Court released a fact-find­ing judg­ment rul­ing that Sheikh Mohammed had ordered Latifa’s abduc­tion and orches­trat­ed an intim­i­da­tion cam­paign against Haya.

    Phone num­bers for Lat­i­fa and Haya, Latifa’s clos­est friends, and eight of Haya’s asso­ciates, includ­ing mem­bers of her legal and secu­ri­ty teams, appeared on the list. Their phones have not been made avail­able for foren­sic analy­sis.

    ...

    Haigh is a vocal oppo­nent of Dubai. A for­mer man­ag­ing direc­tor of the pro­fes­sion­al soc­cer team Leeds Unit­ed, he was arrest­ed in 2014 and con­vict­ed by a Dubai court in 2015 on charges he that had fraud­u­lent­ly stolen more than $5 mil­lion from his for­mer employ­er, the Dubai pri­vate-equi­ty firm GFH Cap­i­tal.

    Haigh has main­tained his inno­cence and said he was abused and tor­tured dur­ing near­ly two years in prison. He was released in 2016 and declared bank­rupt last year after GFH Cap­i­tal won a British court order forc­ing him to repay the mon­ey.

    The secret phone Lat­i­fa used to com­mu­ni­cate while detained in her guard­ed vil­la, Haigh said, was also used to record the videos released by the BBC this year in which she said that guards had told her she “would nev­er see the sun again” and that “every day I am wor­ried about my safe­ty and my life.” Haigh said she record­ed the mes­sages in her bath­room, the only room where she could lock the door.

    ...

    A top White House advis­er raised con­cerns over NSO’s Pega­sus soft­ware to an Israeli senior offi­cial in the White House last month, and mem­bers of Con­gress have urged the Biden admin­is­tra­tion to more strong­ly rein in the “hack­ing for hire indus­try.”

    ————-

    “Human rights activist and close ally of detained Dubai princess had phone hacked by NSO spy­ware, foren­sic test finds” by Drew Har­well and Dan Sab­bagh; The Wash­ing­ton Post; 08/02/2021

    “Haigh said he had been exchang­ing videos and text mes­sages for more than a year and a half with Princess Lat­i­fa through a phone that had been smug­gled into the Dubai vil­la where she was being held. She stopped respond­ing on July 21, 2020, accord­ing to a screen­shot of the mes­sages Haigh shared. The analy­sis shows that Haigh’s phone was hacked two weeks lat­er.”

    It must have been very clear who to hack once they got their hands on Princess Haya’s phone. David Haigh had been secret­ly swap­ping videos and texts with her for years. And it took the gov­ern­ment of Dubai basi­cal­ly no time to hack Haigh and learn what­ev­er he knew. The pow­er that comes from abus­ing these tools is incred­i­ble:

    ...
    Haigh is a vocal oppo­nent of Dubai. A for­mer man­ag­ing direc­tor of the pro­fes­sion­al soc­cer team Leeds Unit­ed, he was arrest­ed in 2014 and con­vict­ed by a Dubai court in 2015 on charges he that had fraud­u­lent­ly stolen more than $5 mil­lion from his for­mer employ­er, the Dubai pri­vate-equi­ty firm GFH Cap­i­tal.

    Haigh has main­tained his inno­cence and said he was abused and tor­tured dur­ing near­ly two years in prison. He was released in 2016 and declared bank­rupt last year after GFH Cap­i­tal won a British court order forc­ing him to repay the mon­ey.
    ...

    The fact that Haigh’s num­ber does­n’t appear on the leaked list of 50,000 pub­lished Pega­sus sus­pect­ed tar­gets because the hack­ing hap­pened after 2019 is worth not­ing in part because it’s a reminder that the num­ber of tar­gets glob­al is actu­al­ly like­ly far high­er than that leaked list. But the fact that Haigh’s num­ber is the first time Amnesty’s researchers had iden­ti­fied ad suc­cess­ful Pega­sus attack on a UK phone num­ber answers once and for all if UK-based phones can even be tar­get­ed by rogue clients. Yes they can:

    ...
    Haigh’s num­ber does not appear on the list, which includ­ed phone records only up to 2019, the year before Haigh’s phone was hacked. But jour­nal­ists nev­er­the­less asked if he would con­sent to his phone being test­ed as part of the ongo­ing inves­ti­ga­tion.

    ...

    The hack of Haigh’s phone marked the first time that Amnesty’s researchers had iden­ti­fied a suc­cess­ful Pega­sus attack on a U.K. phone num­ber. A per­son famil­iar with NSO oper­a­tions said that phone num­bers with the U.K. coun­try code of +44, such as Haigh’s phone, were blocked from search­es rough­ly six months ago but offered no fur­ther detail. NSO has said that num­bers with the Unit­ed States’ +1 coun­try code also can­not be hacked.
    ...

    But the rev­e­la­tion about the first UK phone tar­get­ed by Pega­sus then rais­es the major ques­tion that looms over this sto­ry: was this the first instance of a NSO Group break­ing the rules and tar­get­ing UK-based phones? Or is this abuse rou­tine? There aren’t any UK or US phone num­bers that show up in 50k list of num­bers in the leaked For­bid­den Stories/Amnesty Inter­na­tion­al report on Pega­sus. So is that pri­or lack of UK or US num­bers of reflec­tion of no abuse of this nature? Or a reflec­tion of the fact that these kinds of abus­es were hid­den even from the source where the leak came from?

    Keep in mind the Pega­sus leak pre­sum­ably came from some­one at NSO Group or in con­tact with some there. Or maybe some­one who hacked the com­pa­ny, iron­i­cal­ly. But it did­n’t come from all the clients sep­a­rate­ly. And that means if the clients were able to hide their tar­get­ing of US‑, UK‑, or any oth­er black­list coun­tries-phones from NSO Group, then we should­n’t nec­es­sar­i­ly expect the leaked list of Pega­sus tar­gets to include any US or UK tar­gets. The clients all self-fil­tered that so they would­n’t get their sub­scrip­tions cut off like the UAE. And there­fore a lack of and UK or US num­bers on that last should­n’t nec­es­sar­i­ly be seen as an indi­ca­tion that these kinds of abus­es weren’t tak­ing place pre-2020.

    All in all, this sto­ry about the hack­ing of Princess Haya could end up being the most con­se­quen­tial NSO Group sto­ry so far. There’s no short­age of ques­tions raised by all this. Like whether or not Can­diru cut the UAE off too after all this was dis­cov­ered or just raised the rates and offered more prod­ucts.

    Posted by Pterrafractyl | October 25, 2021, 10:43 pm

  15. Here’s a pair of arti­cles about one of the biggest ques­tions fac­ing the entire top­ic of the glob­al offen­sive cyber-mer­ce­nary indus­try: the ques­tion of whether or not the Five Eyes coun­tries are vul­ner­a­ble to this super-spy­ware too. Just how much hack­ing of the US and UK gov­ern­ments has been qui­et­ly tak­ing place over the last decade? Recall the recent reports about NSO Group cut­ting off the UAE’s access to Pega­sus after it was dis­cov­ered the head of Dubai was using the soft­ware to spy on his ex-wife, Princess Haya, along with a num­ber of oth­er mem­bers of her secu­ri­ty and legal team based in the UK. Includ­ing her lawyer Fiona Shack­le­ton, who hap­pens to be a mem­ber of the House of Lords. Beyond that, their hacked phones at +44 UK phone num­bers, some­thing that should­n’t be pos­si­ble.

    And as we’re going to see in the first excerpt below from sev­er­al weeks ago, just days after the sto­ry of the NSO Group drop­ping the UAE as a client was first report­ed, NSO Group made a remark­able admis­sion: fol­low­ing the appar­ent dis­cov­ery inside NSO Group about the abuse of Pega­sus, NSO Group imme­di­ate­ly imple­ment­ed a change to the Pega­sus soft­ware that banned the tar­get­ing of +44 phone num­bers. It’s the kind of admis­sion that con­firms the obvi­ous: NSO Group clients have been able to tar­get +44 num­bers all along.

    But it gets worse. Because as we’re going to see in the sec­ond excerpt below, from back in July when the sto­ry of the 50,000+ tar­get num­bers was first break­ing, there were reports about a remark­able obser­va­tion in that list of num­bers: 400+ of them were +44 UK num­bers, going back to 2017. And while most of the +44 num­bers are believed to have been entered by the UAE, the Saud­is are also respon­si­ble for some of them. Which means the UAE was ram­pant­ly tar­get UK phone num­bers for years.

    So what are the odds NSO Group did­n’t know about this? Well, that’s where the sus­pi­cious coin­ci­den­tal tim­ing of the twin and alleged­ly inde­pen­dent dis­cov­er­ies of the UAE tar­get­ing of UK phones should serve as a hint. Recall how NSO Group claims it inde­pen­dent­ly learned about the tar­get­ing of Princess Haya at the same time an inde­pen­dent researcher dis­cov­ered evi­dence of Pega­sus tar­get­ing mem­bers of Shack­le­ton’s law firm. As we’ll see in the fol­low­ing report, an anony­mous source close to the com­pa­ny assures us “It is a coin­ci­dence” that both of these dis­cov­er­ies were made on the exact same date. We’re also told that the code mod­i­fi­ca­tions that stopped the tar­get­ing of +44 num­bers were imple­ment­ed with­in hours of NSO Group learn­ing about the abus­es. It’s a rather dubi­ous claim. NSO Group and this inde­pen­dent researcher just hap­pened to learn about it all simul­ta­ne­ous­ly and inde­pen­dent­ly. You have to won­der if the researcher’s prod­ding on the infect­ed phone was lit­er­al­ly what tipped off NSO Group that he found the evi­dence. Keep in mind that the hack­ing of Princess Haya had already been alleged weeks ear­li­er, as we’ll see in the excerpt from July. It’s not like NSO Group could claim it had­n’t already heard about this. So NSO Group’s sto­ry of how it first con­firmed the hack­ing of the +44 num­bers does­n’t real­ly log­i­cal­ly check out. Yet that’s the sto­ry being pushed by the anony­mous source close to the com­pa­ny. So it’s note­wor­thy that this same anony­mous source also assures us that this vul­ner­a­bil­i­ty for +44 does­n’t apply to +1 (US) or any oth­er Five Eyes num­bers.

    Yes, the anony­mous source giv­ing us a high­ly dubi­ous assur­ance about about NSO Group also claims there’s noth­ing to wor­ry about when it comes to the hack­ing of the rest of the Five Eyes. It’s not exact­ly reas­sur­ing. And, more to the point, it’s the kind of sce­nario that sug­gests NSO Group knew all along the tar­get­ing of +44 num­bers was hap­pen­ing and was fine with it. Beyond that, it’s hard not to notice that the UK gov­ern­ment itself does­n’t seem very per­turbed by this sto­ry. Or of the oth­er Five Eyes gov­ern­ments who real­ly should view this as one of the great­est secu­ri­ty threats in his­to­ry. It’s the kind of sit­u­a­tion that sug­gests a major part of this scan­dal is the fact that the Five Eyes gov­ern­ments may have been fine with this. What kind of arrange­ments are being qui­et­ly worked out between the client stages giv­en access to these tools and the Five Eyes net­work that appears to be a kind of tac­it spon­sor of this cyber indus­try? It’s a fas­ci­nat­ing ques­tion at the heart of this sto­ry.

    Ok, here’s the Octo­ber 8 report that came out just days after we first learned about the UAE los­ing its hack­ing priv­i­leges over the Haya hacks, with NSO Group assur­ing every­one that it fixed the prob­lem. A prob­lem with Pega­sus seem­ing­ly hav­ing no prob­lem at all hack­ing +44 num­bers. The fix was appar­ent­ly so easy to do, NSO Group imple­ment­ed it with­in hours of learn­ing about the abus­es. And it’s appar­ent­ly just a coin­ci­dence that NSO Group did­n’t decide to make this easy remote fix until the com­pa­ny ‘coin­ci­den­tal­ly’ con­firmed the abus­es on the exact same date as an inde­pen­dent researcher with access to Shack­le­ton’s phone. It’s not exact­ly a com­pelling cov­er sto­ry:

    The Guardian

    NSO Pega­sus spy­ware can no longer tar­get UK phone num­bers

    Israeli mak­er of sur­veil­lance soft­ware blocked +44 code after detect­ing hack against Princess Haya, source says

    Dan Sab­bagh Defence and secu­ri­ty edi­tor
    Fri 8 Oct 2021 13.53 EDT
    Last mod­i­fied on Fri 8 Oct 2021 14.40 EDT

    The pow­er­ful spy­ware used to hack into mobile phones belong­ing to Princess Haya and her divorce lawyer Fiona Shack­le­ton is no longer effec­tive against UK num­bers, sources famil­iar with the software’s devel­op­er have said.

    NSO Group, the Israeli mak­er of the Pega­sus sur­veil­lance tool, imple­ment­ed a change pre­vent­ing client coun­tries from tar­get­ing +44 num­bers, the sources said, after it became aware of the British hack­ing scan­dal on 5 August last year.

    “We shut down com­plete­ly, hard-cod­ed into the sys­tem [Pega­sus], to all of our cus­tomers. We released a quick update in the mid­dle of the night that none of our cus­tomers can work on UK num­bers,” the source close to the com­pa­ny added.

    The action was tak­en with­in hours after NSO dis­cov­ered that Pega­sus had prob­a­bly been used by Dubai, whose ruler Sheikh Mohammed bin Rashid al-Mak­toum was locked in a child pro­tec­tion bat­tle with Haya, his for­mer wife, to hack into her phone and that of Shack­le­ton and anoth­er of her lawyers.

    Ear­li­er this week British civ­il courts con­clud­ed on the bal­ance of prob­a­bil­i­ties that Haya’s phone and those of her advis­ers and allies had been tar­get­ed with sur­veil­lance that “occurred with the express or implied author­i­ty of the [children’s] father” in what amount­ed to “a total abuse of trust, and indeed an abuse of pow­er”.

    Court rul­ings indi­cate that NSO blew the whis­tle on the hack­ing late in the evening on 5 August 2020, alert­ing her prin­ci­pal lawyer, Shack­le­ton, via the company’s ethics advis­er, Cherie Blair, at an intense point dur­ing the legal bat­tle between the princess and Sheikh Mohammed.

    Notably, the company’s alarm came on the exact date an inde­pen­dent com­put­er foren­sics researcher had spot­ted that Pega­sus was being used against num­bers linked to Shackleton’s law firm, Payne Hicks Beach. But the source said the sim­i­lar­i­ty in tim­ing was just chance: “It is a coin­ci­dence.”

    It is not pos­si­ble to imme­di­ate­ly ver­i­fy whether NSO’s soft­ware has been mod­i­fied, although those who have stud­ied the mis­use of the soft­ware said there was no evi­dence yet of a Pega­sus hack­ing attempt involv­ing a UK num­ber after 5 August last year.

    The same source famil­iar with the com­pa­ny said that Pega­sus was also not effec­tive against US num­bers – which is believed to have been the case for some time – as well as phones from NSO’s home mar­ket, Israel, and “all of the Five Eyes” mem­bers, Cana­da, Aus­tralia and New Zealand as well as the UK and the US.

    That sug­gests that Pega­sus may still be effec­tive against num­bers in oth­er Nato coun­tries in Europe, such as France, which pressed Israel to mount an inquiry into the use of the sur­veil­lance soft­ware, after it emerged that phone num­bers belong­ing to Pres­i­dent Macron and over half his cab­i­net were on a leaked list of peo­ple who were believed to be poten­tial tar­gets of inter­est to NSO’s gov­ern­ment clients since 2016.

    ...

    An inves­ti­ga­tion by the Guardian ear­li­er this year dis­cov­ered that 50,000 phone num­bers had appeared on the leaked list. At least 10 coun­tries – includ­ing the UAE, of which Dubai is part – were believed to have entered num­bers list­ed.

    But there have been repeat­ed crit­i­cisms that activists, jour­nal­ists and lawyers were also being tar­get­ed using the tech­nol­o­gy, with 400 UK num­bers appear­ing in the leaked list hav­ing been select­ed by the UAE.

    NSO Group is not under­stood to have come under direct pres­sure from the UK to recode its soft­ware, although the source famil­iar with the company’s oper­a­tions added: “I believe some of the enti­ties know about it” – an appar­ent ref­er­ence to British intel­li­gence.

    That could explain some of the UK’s mut­ed response to the hack­ing con­clu­sions reached by the civ­il courts. A sub­tle warn­ing about the “legal, respon­si­ble and pro­por­tion­ate” use of cyber-sur­veil­lance on the part of the For­eign Office has been accom­pa­nied by an empha­sis on the impor­tance of the UAE as an ally.

    ...

    ———-

    “NSO Pega­sus spy­ware can no longer tar­get UK phone num­bers” by Dan Sab­bagh; The Guardian; 10/08/2021

    “NSO Group, the Israeli mak­er of the Pega­sus sur­veil­lance tool, imple­ment­ed a change pre­vent­ing client coun­tries from tar­get­ing +44 num­bers, the sources said, after it became aware of the British hack­ing scan­dal on 5 August last year.”

    It’s con­firmed. NSO Group clients did indeed have the tech­ni­cal capac­i­ty to tar­get +44 UK num­bers up until August 5 of 2020. This was, of course, after over 400 UK num­bers showed up in the giant inves­tiga­tive leak of 50,000+ sus­pect­ed tar­get num­bers. But we’re also get­ting anoth­er con­fir­ma­tion: NSO Group had the tech­ni­cal capac­i­ty to eas­i­ly make it impos­si­ble for clients to tar­get +44 num­bers but did­n’t use that capac­i­ty until the Princess Haya scan­dal. NSO Group could have eas­i­ly pre­vent­ed this entire scan­dal but did­n’t do so. Why is that?

    ...
    “We shut down com­plete­ly, hard-cod­ed into the sys­tem [Pega­sus], to all of our cus­tomers. We released a quick update in the mid­dle of the night that none of our cus­tomers can work on UK num­bers,” the source close to the com­pa­ny added.

    The action was tak­en with­in hours after NSO dis­cov­ered that Pega­sus had prob­a­bly been used by Dubai, whose ruler Sheikh Mohammed bin Rashid al-Mak­toum was locked in a child pro­tec­tion bat­tle with Haya, his for­mer wife, to hack into her phone and that of Shack­le­ton and anoth­er of her lawyers.

    Ear­li­er this week British civ­il courts con­clud­ed on the bal­ance of prob­a­bil­i­ties that Haya’s phone and those of her advis­ers and allies had been tar­get­ed with sur­veil­lance that “occurred with the express or implied author­i­ty of the [children’s] father” in what amount­ed to “a total abuse of trust, and indeed an abuse of pow­er”.

    ...

    But there have been repeat­ed crit­i­cisms that activists, jour­nal­ists and lawyers were also being tar­get­ed using the tech­nol­o­gy, with 400 UK num­bers appear­ing in the leaked list hav­ing been select­ed by the UAE.
    ...

    So what about the rest of the Five Eyes nations? We’re these num­bers tar­getable too? We are told by an anony­mous source close to NSO Group that, no, Pega­sus can’t tar­get these oth­er nations. And yet this same anony­mous source also assures us that it’s pure­ly a coin­ci­dence that NSO Group became aware of the tar­get­ing of Princess Haya and oth­ers close to her on the same day an inde­pen­dent com­put­er foren­sics researcher dis­cov­ered the same hacks. So it was on the same day that an inde­pen­dent researcher effec­tive­ly threat­ened to make this scan­dal pub­lic that NSO Group mag­i­cal­ly stum­bled upon the same prob­lem­at­ic behav­ior and final­ly put it to an end. It’s the kind of nar­ra­tive that sug­gests this anony­mous source is basi­cal­ly just push­ing NSO Group’s cov­er sto­ry. Which also means we should prob­a­bly assume that the tar­get­ing of num­bers of the US, Uk, Aus­tralia, Cana­da, and New Zealand was also tech­ni­cal­ly pos­si­ble for NSO Group clients up until August of 2020:

    ...
    Court rul­ings indi­cate that NSO blew the whis­tle on the hack­ing late in the evening on 5 August 2020, alert­ing her prin­ci­pal lawyer, Shack­le­ton, via the company’s ethics advis­er, Cherie Blair, at an intense point dur­ing the legal bat­tle between the princess and Sheikh Mohammed.

    Notably, the company’s alarm came on the exact date an inde­pen­dent com­put­er foren­sics researcher had spot­ted that Pega­sus was being used against num­bers linked to Shackleton’s law firm, Payne Hicks Beach. But the source said the sim­i­lar­i­ty in tim­ing was just chance: “It is a coin­ci­dence.”

    It is not pos­si­ble to imme­di­ate­ly ver­i­fy whether NSO’s soft­ware has been mod­i­fied, although those who have stud­ied the mis­use of the soft­ware said there was no evi­dence yet of a Pega­sus hack­ing attempt involv­ing a UK num­ber after 5 August last year.

    The same source famil­iar with the com­pa­ny said that Pega­sus was also not effec­tive against US num­bers – which is believed to have been the case for some time – as well as phones from NSO’s home mar­ket, Israel, and “all of the Five Eyes” mem­bers, Cana­da, Aus­tralia and New Zealand as well as the UK and the US.

    That sug­gests that Pega­sus may still be effec­tive against num­bers in oth­er Nato coun­tries in Europe, such as France, which pressed Israel to mount an inquiry into the use of the sur­veil­lance soft­ware, after it emerged that phone num­bers belong­ing to Pres­i­dent Macron and over half his cab­i­net were on a leaked list of peo­ple who were believed to be poten­tial tar­gets of inter­est to NSO’s gov­ern­ment clients since 2016.
    ...

    Adding to the cir­cum­stan­tial evi­dence of a major undis­cov­ered scan­dal here is the fact that the list of 50,000+ sus­pect­ed tar­get phone num­bers only came from around 10 of NSO Group’s clients. Which means there’s around 30 more clients that we know noth­ing about...other than the fact that they pre­sum­ably had the same capac­i­ty to tar­get Five Eyes num­bers as the UAE:

    ...
    An inves­ti­ga­tion by the Guardian ear­li­er this year dis­cov­ered that 50,000 phone num­bers had appeared on the leaked list. At least 10 coun­tries – includ­ing the UAE, of which Dubai is part – were believed to have entered num­bers list­ed.
    ...

    Next, here’s a Guardian report from back in July about the 400+ UK phone num­bers dis­cov­ered in the leaked list of 50,000+ tar­get num­bers. As we’ll see, NSO Group did­n’t sim­ply deny that Pega­sus was used to tar­get UK phone num­bers. The com­pa­ny sug­gest­ed it was tech­ni­cal­ly impos­si­ble for Pega­sus soft­ware to do so. That was the mes­sage com­ing out of NSO Group a cou­ple weeks before the August 5 emer­gency change made to Pega­sus’s code fol­low­ing the ‘dis­cov­ery’ by NSO Group that the UAE was indeed tar­get­ing UK phone num­bers. And not just a few UK phone num­bers. Of the 400+ UK phone num­bers in the list, the bulk of them were entered by the UAE. This one client was allowed to seri­al­ly vio­late the nation black­list rules. For years:

    The Guardian

    UAE linked to list­ing of hun­dreds of UK phones in Pega­sus project leak

    Mem­ber of the House of Lords and Briton once detained in UAE among those appear­ing in data­base

    Dan Sab­bagh, David Pegg, Paul Lewis and Stephanie Kirch­gaess­ner
    Wed 21 Jul 2021 12.59 EDT

    A mem­ber of the House of Lords is among more than 400 peo­ple whose UK mobile phone num­bers appear in a leaked list of num­bers iden­ti­fied by NSO Group’s client gov­ern­ments between 2017 and 2019, the Guardian can reveal.

    The prin­ci­pal gov­ern­ment respon­si­ble for select­ing the UK num­bers appears to be the Unit­ed Arab Emi­rates, accord­ing to analy­sis of the data. The UAE is one of 40 coun­tries that had access to the NSO spy­ware that is able to hack into and secret­ly take con­trol of a mobile phone.

    Dubai, the emi­rate city ruled by Sheikh Mohammed bin Rashid al-Mak­toum, is also believed to have been an NSO client.

    ...

    In mul­ti­ple state­ments, NSO said that the fact that a num­ber appeared on the leaked list was in no way indica­tive of whether a num­ber was tar­get­ed for sur­veil­lance using Pega­sus. “The list is not a list of Pega­sus tar­gets or poten­tial tar­gets,” the com­pa­ny said. “The num­bers in the list are not relat­ed to NSO group in any way.”

    But the Guardian and oth­er media part­ners that had access to the data as part of the Pega­sus project, a media con­sor­tium, believe the list indi­cates per­sons of inter­est select­ed by gov­ern­ment clients of NSO. It includes peo­ple across the world whose phones showed traces of NSO’s spy­ware, Pega­sus, accord­ing to foren­sic analy­sis of their devices.

    Those with UK num­bers appear­ing on the list include:

    * Lady Uddin, an inde­pen­dent mem­ber of the House of Lords, whose num­ber appeared on the data in both 2017 and 2018. She said if there was spy­ing on mem­bers of par­lia­ment it would amount to “a great breach of trust” which “con­tra­venes our sov­er­eign­ty”.

    * A lawyer work­ing for a Lon­don law firm advis­ing Princess Haya. Haya is embroiled in a bit­ter cus­tody bat­tle with Sheikh Mohammed in the fam­i­ly divi­sion of the high court of jus­tice.

    * John Gos­den, a lead­ing horse train­er based in New­mar­ket, who is also friend of Princess Haya, her­self an inter­na­tion­al eques­tri­an rid­er. Num­bers for oth­er peo­ple work­ing for Haya’s secu­ri­ty and PR team also appear in the data.

    * John Chip­man, the chief exec­u­tive of the defence think­tank the Inter­na­tion­al Insti­tute for Strate­gic Stud­ies, which runs an annu­al con­fer­ence in Bahrain, one of the UAE’s allies.

    * Matthew Hedges, a Briton detained in the UAE for sev­en months in 2018, whose num­ber first appears in the data while he was in the UK, before embark­ing on his trip. “I want to know what the British gov­ern­ment is doing about it,” he said.

    Oth­er high-pro­file UK names who appear on the list have already been named, such as Roula Kha­laf, the edi­tor of the Finan­cial Times, who was deputy edi­tor when her num­ber appeared in the data in 2018. NSO lat­er said there were no attempt­ed or suc­cess­ful Pega­sus infec­tions of Khalaf’s phone.

    Ear­li­er this week, the Guardian also revealed the list­ing of the num­ber of the human rights lawyer Rod­ney Dixon QC, who has act­ed for both Hedges and the fiancee of the mur­dered Sau­di jour­nal­ist Jamal Khashog­gi, Hat­ice Cen­giz. Analy­sis of the data sug­gests his num­ber was among a small group of UK num­bers that appear to have been select­ed by Sau­di Ara­bia.

    Lawyers for NSO sug­gest­ed it was “tech­ni­cal­ly impos­si­ble” for Dixon’s phone to be tar­get­ed by Sau­di Ara­bia. Foren­sic analy­sis of Dixon’s device con­duct­ed by Amnesty International’s Secu­ri­ty Lab showed Pega­sus-relat­ed activ­i­ty but no suc­cess­ful infec­tion.

    Amnesty exam­ined two oth­er UK phones in the data. One showed the same kind of Pega­sus activ­i­ty dis­cov­ered on Dixon’s iPhone. The sec­ond, an Android phone, showed no evi­dence of an attempt­ed or suc­cess­ful infec­tion.

    Nei­ther the Unit­ed Arab Emi­rates, Dubai nor Sau­di Ara­bia respond­ed to requests for com­ment. Till Dunck­el, a Ger­man lawyer rep­re­sent­ing Sheikh Mohammed, told the news­pa­per Süd­deutsche Zeitung: “Our client emphat­i­cal­ly denies hav­ing attempt­ed to ‘hack’ the phones of the per­sons named in your request, or hav­ing instruct­ed oth­ers to do so.” Rep­re­sen­ta­tives of the sheikh have also pre­vi­ous­ly said he feared Lat­i­fa was a vic­tim of a kid­nap­ping and that he had con­duct­ed “a res­cue mis­sion”.

    NSO Group has always said it does not have access to the data of its cus­tomers. In state­ments issued through its lawyers, NSO said the Pega­sus project report­ing con­sor­tium had made “incor­rect assump­tions” about which clients used the company’s tech­nol­o­gy.

    Exiled dis­si­dents and sup­port­ive activists in the UK also appeared on the leaked list, which is bound to raise ques­tions about the UAE, which is tra­di­tion­al­ly con­sid­ered a British ally, and whose lead­ing fam­i­ly, the rulers of Abu Dhabi, own the Pre­mier League cham­pi­ons, Man­ches­ter City.

    The UAE has become a fast-emerg­ing cyber pow­er, whose pow­er­ful sur­veil­lance capa­bil­i­ty is con­trolled by the fam­i­ly of its ruler, Sheikh Mohamed bin Zayed, and in par­tic­u­lar his broth­er, the nation­al secu­ri­ty advis­er, Sheikh Tah­noon bin Zayed.

    Three sources famil­iar with NSO’s oper­a­tions con­firmed that with­in the past year the com­pa­ny had stripped Dubai of its Pega­sus licence. They said the deci­sion had been informed pri­mar­i­ly by human rights con­cerns, but did not dis­pute that the pos­si­bil­i­ty Sheikh Mohammed was wield­ing the soft­ware against his own fam­i­ly mem­bers had also been a fac­tor.

    It is unclear whether MI5 was aware of any UAE spy­ing activ­i­ty. Gen­er­al­ly if the spy agency becomes aware a Briton is sub­ject to for­eign sur­veil­lance, it will take action to alert the vic­tim if it believes there is a threat to life or oth­er seri­ous dan­ger in the UK.

    But the British gov­ern­ment issued a cod­ed rebuke to the coun­try this week fol­low­ing the rev­e­la­tions of the Pega­sus project.

    A gov­ern­ment spokesper­son said: “It is vital all cyber actors use capa­bil­i­ties in a way that is legal, respon­si­ble and pro­por­tion­ate to ensure cyber­space remains a safe and pros­per­ous place for all.”

    Why cer­tain peo­ple may have been list­ed is hard to deter­mine. Uddin was the first Mus­lim woman to serve in the upper house, but is not con­sid­ered a for­eign pol­i­cy spe­cial­ist. “If espi­onage is tak­ing place against the high­est of sov­er­eign British insti­tu­tions, ques­tions arise regard­ing whether our gov­ern­ment was aware,” she said.

    Matthew Hedges, a Durham Uni­ver­si­ty PhD stu­dent spe­cial­is­ing in secu­ri­ty, was first list­ed on the data­base in March 2018, two months before he was detained and tor­tured for sev­en months, accused of spy­ing for MI6. The ini­tial list­ing of his num­ber in the data took place before Hedges had trav­elled to the UAE for his research.

    MI6 denies he was act­ing as an agent, in a high-pro­file case that strained rela­tions between Lon­don and Abu Dhabi. Hedges was sub­ject to repeat­ed inter­ro­ga­tions that last­ed hours and was inject­ed with a cock­tail of drugs on which he is part­ly depen­dent today, but was only charged after being held for five months.

    It was not pos­si­ble to con­duct foren­sic analy­sis of Hedges’ UK phone from the time because UAE author­i­ties con­fis­cat­ed his device.

    Mohammed Kozbar, the chair of the Fins­bury Park mosque, arguably the best-known mosque in Britain, also appeared on the leaked list. His num­ber appeared in the data in 2018, appar­ent­ly because of the UAE. The mosque was com­pre­hen­sive­ly reformed in 2015 under his lead­er­ship, and is con­sid­ered a mod­el of com­mu­ni­ty rela­tions, act­ing recent­ly as a pub­lic vac­ci­na­tion cen­tre.

    Kozbar said he was baf­fled as to why he might have been of inter­est to the Gulf state, say­ing he had “nev­er been in the UAE” nor had any involve­ment with the coun­try. He said he feared that “British cit­i­zens will be open to abuse from every coun­try in the world” unless the UK spoke out against appar­ent abus­es of NSO spy­ware world­wide.

    Dis­si­dents – some of whom focused on Sau­di Ara­bia or Bahrain – and at least one British activist have also appeared in the list. They include the Emi­rati-born Alaa al-Sid­diq, 33, the exec­u­tive direc­tor of the Sau­di cam­paign group ALQST, who was killed in a car crash in Oxford­shire last month. After talk­ing to the police her organ­i­sa­tion said there was “no sug­ges­tion of foul play”.

    Anoth­er per­son who appears in the data in 2018 was the lead­ing Bahrai­ni dis­si­dent and human rights cam­paign­er Sayed Alwadaei, who has polit­i­cal asy­lum in the UK. He was also select­ed by a cus­tomer under­stood to be the UAE, although he cam­paigns for democ­ra­cy and rights in Bahrain, par­tic­u­lar­ly around the time of the grand prix, held that year in April.

    He called on the UK gov­ern­ment to “speak out and stop defend­ing these abu­sive gov­ern­ments”.

    A num­ber belong­ing to Rori Don­aghy was select­ed by UAE through­out 2017 and 2018, accord­ing to analy­sis. He was pre­vi­ous­ly report­ed to have been a tar­get of a UAE hack­ing cam­paign unre­lat­ed to NSO.

    He worked for three years until 2016 for Mid­dle East Eye, a UK-based news organ­i­sa­tion that reg­u­lar­ly crit­i­cised the UAE regime. But at the time his num­ber appeared in the data he was work­ing for a spe­cial­ist Mid­dle East con­sul­tan­cy, writ­ing reports about Syr­ia and the refugee cri­sis.

    The num­ber of the pres­i­dent of the Mus­lim Asso­ci­a­tion of Britain, Raghad Altikri­ti, the first female head of the organ­i­sa­tion, also appears on the list. She was pre­vi­ous­ly a vice-pres­i­dent and head of media, and her broth­er Anas Altikri­ti, who runs the Cor­do­ba Foun­da­tion think­tank, which pro­motes inter­cul­tur­al dia­logue, was list­ed between 2017 and 2019.

    The num­bers of sev­er­al employ­ees of three Lon­don cor­po­rate intel­li­gence firms also appeared on the list. In one case, it appears the head of the firm was select­ed by the UAE along with two num­bers belong­ing to his wife. All three firms work for Gulf state clients.

    ———–

    “UAE linked to list­ing of hun­dreds of UK phones in Pega­sus project leak” Dan Sab­bagh, David Pegg, Paul Lewis and Stephanie Kirch­gaess­ner; The Guardian; 07/21/2021

    “The prin­ci­pal gov­ern­ment respon­si­ble for select­ing the UK num­bers appears to be the Unit­ed Arab Emi­rates, accord­ing to analy­sis of the data. The UAE is one of 40 coun­tries that had access to the NSO spy­ware that is able to hack into and secret­ly take con­trol of a mobile phone.”

    Yes, it appears the UAE is the prin­ci­ple NSO Group client state respon­si­ble for the 400+ UK phone num­bers that appeared on the list of 50,000+ sus­pect­ed tar­get num­bers released in the For­bid­den Papers leak. And the dates cor­re­spond­ing to the num­bers indi­cates this tar­get­ing of UK-based phones was tak­ing place from 2017–2019. The UAE was allowed to become a ser­i­al offend­er of one of the NSO Group­s’s core rules.

    So just how much more exten­sive was this abuse? It remains a sig­nif­i­cant unan­swered ques­tion in this sto­ry. But don’t for­get that the 50,000+ list of num­bers was appar­ent­ly only based on 10 NSO Group clients and the com­pa­ny has over 40 clients. That list is just a snap­shot of what NSO Group’s clients have been up to. But we don’t have to entire­ly spec­u­late about which oth­er clients have been hack­ing UK phone num­bers. Sau­di Ara­bia had already been caught going it too. But note the inter­est­ing sug­ges­tion made by NSO Group lawyers when the issue of Sau­di tar­get­ing of UK phones was brought up: they sug­gest­ed it was “tech­ni­cal­ly impos­si­ble”. Keep in mind this sug­ges­tion was giv­en back in July, before the admis­sion from NSO Group a few weeks ago that it only retroac­tive­ly mod­i­fied the Pega­sus code to block the tar­get­ing of UK phone num­bers. In oth­er words, past assur­ances about the tech­ni­cal impos­si­bil­i­ty of the tar­get­ing of black­list­ed coun­try phone num­bers are bogus. Which should imme­di­ate­ly raise major ques­tions about the tech­ni­cal pos­si­bil­i­ty for the hack­ing of the rest of the “Five Eyes” nations on that black­list:

    ...
    Those with UK num­bers appear­ing on the list include:

    * Lady Uddin, an inde­pen­dent mem­ber of the House of Lords, whose num­ber appeared on the data in both 2017 and 2018. She said if there was spy­ing on mem­bers of par­lia­ment it would amount to “a great breach of trust” which “con­tra­venes our sov­er­eign­ty”.

    ...

    Ear­li­er this week, the Guardian also revealed the list­ing of the num­ber of the human rights lawyer Rod­ney Dixon QC, who has act­ed for both Hedges and the fiancee of the mur­dered Sau­di jour­nal­ist Jamal Khashog­gi, Hat­ice Cen­giz. Analy­sis of the data sug­gests his num­ber was among a small group of UK num­bers that appear to have been select­ed by Sau­di Ara­bia.

    Lawyers for NSO sug­gest­ed it was “tech­ni­cal­ly impos­si­ble” for Dixon’s phone to be tar­get­ed by Sau­di Ara­bia. Foren­sic analy­sis of Dixon’s device con­duct­ed by Amnesty International’s Secu­ri­ty Lab showed Pega­sus-relat­ed activ­i­ty but no suc­cess­ful infec­tion.
    ...

    But while a sce­nario where NSO Group clients have had the tech­ni­cal capa­bil­i­ty of hack­ing Five Eye phones cer­tain­ly looks like­ly at this point, there’s anoth­er plau­si­ble worth con­sid­er­ing: that the UAE and Sau­di gov­ern­ments were giv­en spe­cial per­mis­sion to hack UK phones...perhaps on behalf of the UK’s own intel­li­gence ser­vices. A domes­tic spy­ing arrange­ment that relies on the out­sourc­ing of the spy­ing to friend­ly allied states out­side of the Five-Eyes. Could we be look­ing at a sit­u­a­tion like that? Because while it’s not hard to imag­ine that the UAE had plen­ty of inter­est in spy­ing on all sort of activists or politi­cians liv­ing in the UK, it’s also not hard to imag­ine the UK’s own intel­li­gence ser­vices hav­ing an inter­est in spy­ing on these same groups. It would at least explain why the UK gov­ern­ment seems almost unin­ter­est­ed in a scan­dal that has the appear­ance of hav­ing sig­nif­i­cant espi­onage impli­ca­tions:

    ...
    Why cer­tain peo­ple may have been list­ed is hard to deter­mine. Uddin was the first Mus­lim woman to serve in the upper house, but is not con­sid­ered a for­eign pol­i­cy spe­cial­ist. “If espi­onage is tak­ing place against the high­est of sov­er­eign British insti­tu­tions, ques­tions arise regard­ing whether our gov­ern­ment was aware,” she said.

    ...

    Mohammed Kozbar, the chair of the Fins­bury Park mosque, arguably the best-known mosque in Britain, also appeared on the leaked list. His num­ber appeared in the data in 2018, appar­ent­ly because of the UAE. The mosque was com­pre­hen­sive­ly reformed in 2015 under his lead­er­ship, and is con­sid­ered a mod­el of com­mu­ni­ty rela­tions, act­ing recent­ly as a pub­lic vac­ci­na­tion cen­tre.

    Kozbar said he was baf­fled as to why he might have been of inter­est to the Gulf state, say­ing he had “nev­er been in the UAE” nor had any involve­ment with the coun­try. He said he feared that “British cit­i­zens will be open to abuse from every coun­try in the world” unless the UK spoke out against appar­ent abus­es of NSO spy­ware world­wide.
    ...

    The more this sto­ry unfolds the more ques­tions it rais­es. Like the grow­ing ques­tion of why there’s been so lit­tle out­cry by the Five Eyes gov­ern­ments over a sto­ry that should, in the­o­ry, be one of the great­est secu­ri­ty threats in his­to­ry. Although that lack of out­cry does, itself, sug­gest some answers. They’re not great answers.

    Posted by Pterrafractyl | October 31, 2021, 8:59 pm

  16. The Biden admin­is­tra­tion took a step that is both some­what expect­ed and also quite sur­pris­ing last week against both NSO Group and Can­diru: they got black­list­ed. The US Depart­ment of Com­merce black­list­ed the two cyber­tool firms. US com­pa­nies can no longer export to them, so if any US-based firms were sell­ing hacks to NSO Group and Can­diru, they had bet­ter relo­cate or stop pro­vid­ing that ser­vice.

    The move is, of course, in the wake of the recent rev­e­la­tions about the tar­get­ing of UK-based phones that raise major ques­tions about the tar­getabil­i­ty of not just UK-phones, but US and Israeli phones. And as we’re going to see, it came days before we got the first con­fir­ma­tion of Pega­sus infect­ing Israeli phones. So this black­list­ing comes amid the con­fir­ma­tion of Pega­sus hit­ting UK and Israeli phones. It’s real­ly just a mat­ter of time before we get our first US-phone con­fir­ma­tion. Who will it be? It’s kind of a huge ques­tion loom­ing over all this.

    So which Israeli phone got hacked and who did the hack­ing? 6 Pales­tin­ian activists’ phones were found with Pega­sus spy­ware so far fol­low­ing the ini­tial dis­cov­ery of two infect­ed phones in mid-Octo­ber. Short­ly after, the Israeli Defense Min­is­ter declared six Pales­tin­ian civ­il soci­ety groups to be ter­ror­ist orga­ni­za­tions. These groups all hap­pen to be affil­i­at­ed with the left-wing Pop­u­lar Front for the Lib­er­a­tion of Pales­tine (PFLP). And it turns out the 6 activists are all left-wing activists, three asso­ci­at­ed with the groups recent­ly labeled ter­ror­ists and three who remain anony­mous but assert they are inde­pen­dent activists. The Israeli gov­ern­ment has pro­vid­ed lit­tle pub­lic evi­dence to jus­ti­fy the ter­ror­ism des­ig­na­tion and at least two of the hack­ing tar­gets say they con­sid­er Israeli gov­ern­ment the main sus­pect in the hack and believe the ter­ror des­ig­na­tion of those groups may have been timed to try to over­shad­ow the hacks’ dis­cov­ery.

    And while the Israeli gov­ern­ment is cer­tain­ly an obvi­ous prime sus­pect here, it’s impor­tant to note that the researchers who dis­cov­ered the Pega­sus hack did not deter­mine who sent it. As we learned in the case of the ruler of Dubai hack­ing his ex-wife’s UK phone along with her lawyer/UK law­mak­er’s phones and numer­ous oth­er UK phones, there’s every rea­son to sus­pect any of NSO Group’s clients could have poten­tial­ly car­ried out the hack. That means rough­ly 40 dif­fer­ent gov­ern­ments are poten­tial sus­pects for the hacks of those Pales­tin­ian activists. It’s an impor­tant detail to keep in mind as the the fin­ger-point­ing around their hacks plays out. On some lev­el, it’s lev­el dam­ag­ing for the Israeli gov­ern­ment itself to implic­it­ly admit to car­ry­ing out the hacks because the impli­ca­tions are far more sig­nif­i­cant if it turns out it was anoth­er gov­ern­ment. And yet, as legal experts point out, the fact that Israel is a client of NSO Group is still a sig­nif­i­cant com­pli­ca­tion for both par­ties because it cre­ates an obvi­ous con­flict of inter­est giv­en that Israel is the gov­ern­ment osten­si­bly over­see­ing these export licens­es. It’s the kind of sit­u­a­tion where the gov­ern­ment of Israel is forced to choose which incon­ve­nient nar­ra­tive to go with. There isn’t a clean ali­bi read­i­ly avail­able here.

    So what was the Israeli gov­ern­men­t’s response to the black­list­ings? As we’re going to see, the ini­tial response from Israel’s For­eign Min­is­ter Yair Lapid was that the Israeli gov­ern­ment has noth­ing to do with the NSO Group, telling reporters, “NSO is a pri­vate com­pa­ny, it is not a gov­ern­men­tal project and there­fore even if it is des­ig­nat­ed, it has noth­ing to do with the poli­cies of the Israeli gov­ern­ment.” Two days lat­er, the New York Times had a report quot­ing unnamed Israeli gov­ern­ment offi­cials who acknowl­edged the Israeli gov­ern­ment will be lob­by­ing the US gov­ern­ment to lift the black­list­ings, in part because NSO Group and Can­diru are both con­sid­ered cru­cial ele­ments of Israels for­eign pol­i­cy. It’s going to be that kind of response. A say any­thing response.

    Final­ly, it’s impor­tant to keep in mind that the fact that NSO Group spy­ware was alleged­ly unable to tar­get the phones of Israeli, UK, and US phones, that strong­ly hints at the US and UK hav­ing qui­et­ly giv­en their tac­it approval of the sales of these tools. The black­list­ing of NSO Group and Can­diru isn’t mutu­al­ly exclu­sive with a sce­nario where the US endorsed the glob­al export of these tools in the first place. That’s part of what makes this black­list­ing sto­ry some­thing to watch going for­ward. It poten­tial­ly dou­bles a cov­er up. In oth­er words, the Israeli gov­ern­ment may not be the only gov­ern­ment doing the ass-cov­er­ing two-step here.

    Ok, first, here’s a report on the dis­cov­ery of NSO Group spy­ware on six Pales­tin­ian activists’ phones. The first report­ed instance of Israeli phones being infect­ed with Pega­sus:

    Asso­ci­at­ed Press

    Report: NSO spy­ware found on 6 Pales­tin­ian activists’ phones

    By FRANK BAJAK and JOSEPH KRAUSS
    Mon­day Novem­ber 8, 2021, 13:37:48 GMT-0600 (Cen­tral Stan­dard Time)

    JERUSALEM (AP) — Secu­ri­ty researchers dis­closed Mon­day that spy­ware from the noto­ri­ous Israeli hack­er-for-hire com­pa­ny NSO Group was detect­ed on the cell­phones of six Pales­tin­ian human rights activists, half affil­i­at­ed with groups that Israel’s defense min­is­ter con­tro­ver­sial­ly claimed were involved in ter­ror­ism.

    The rev­e­la­tion marks the first known instance of Pales­tin­ian activists being tar­get­ed by the mil­i­tary-grade Pega­sus spy­ware. Its use against jour­nal­ists, rights activists and polit­i­cal dis­si­dents from Mex­i­co to Sau­di Ara­bia has been doc­u­ment­ed since 2015.

    A suc­cess­ful Pega­sus infec­tion sur­rep­ti­tious­ly gives intrud­ers access to every­thing a per­son stores and does on their phone, includ­ing real-time com­mu­ni­ca­tions.

    It’s not clear who placed the NSO spy­ware on the activists’ phones, said the researcher who first detect­ed it, Mohammed al-Maskati of the non­prof­it Front­line Defend­ers. The hack­ing began in July 2020, accord­ing to researchers.

    Short­ly after the first two intru­sions were iden­ti­fied in mid-Octo­ber, Israeli Defense Min­is­ter Ben­ny Gantz declared six Pales­tin­ian civ­il soci­ety groups to be ter­ror­ist orga­ni­za­tions. Ire­land-based Front­line Defend­ers and at least two of the vic­tims say they con­sid­er Israel the main sus­pect and believe the des­ig­na­tion may have been timed to try to over­shad­ow the hacks’ dis­cov­ery, though they have pro­vid­ed no evi­dence to sub­stan­ti­ate those asser­tions.

    Israel has pro­vid­ed lit­tle evi­dence pub­licly to sup­port the ter­ror­ism des­ig­na­tion, which the Pales­tin­ian groups say aims to dry up their fund­ing and muz­zle oppo­si­tion to Israeli mil­i­tary rule. Three of the hacked Pales­tini­ans work for the civ­il soci­ety groups. The oth­ers do not, and wish to remain anony­mous, Front­line Defend­ers says.

    The foren­sic find­ings, inde­pen­dent­ly con­firmed by secu­ri­ty researchers from Amnesty Inter­na­tion­al and the Uni­ver­si­ty of Toronto’s Cit­i­zen Lab in a joint tech­ni­cal report, come as NSO Group faces grow­ing con­dem­na­tion over the abuse of its spy­ware and Israel takes heat for lax over­sight of its dig­i­tal sur­veil­lance indus­try.

    Last week, the Biden admin­is­tra­tion black­list­ed the NSO Group and a less­er-known Israeli com­peti­tor, Can­diru, bar­ring them from U.S. tech­nol­o­gy.

    Asked about the alle­ga­tions its soft­ware was used against the Pales­tin­ian activists, NSO Group said in a state­ment that it does not iden­ti­fy its cus­tomers for con­trac­tu­al and nation­al secu­ri­ty rea­sons, is not privy to whom they hack and sells only to gov­ern­ment agen­cies for use against “seri­ous crime and ter­ror.”

    An Israeli defense offi­cial said in a brief state­ment that the des­ig­na­tion of the six orga­ni­za­tions was based on sol­id evi­dence and that any claim it is relat­ed to the use of NSO soft­ware is unfound­ed. The state­ment had no oth­er details, and offi­cials declined requests for fur­ther com­ment. The offi­cial spoke on con­di­tion of anonymi­ty to dis­cuss secu­ri­ty mat­ters.

    Israel’s Defense Min­istry approves the export of spy­ware pro­duced by NSO Group and oth­er pri­vate Israeli com­pa­nies that recruit from the country’s top cyber-capa­ble mil­i­tary units. Crit­ics say the process is opaque.

    It’s not known pre­cise­ly when or how the phones were vio­lat­ed, the secu­ri­ty researchers said. But four of the six hacked iPhones exclu­sive­ly used SIM cards issued by Israeli tele­com com­pa­nies with Israeli +972 area code num­bers, said the Cit­i­zen Lab and Amnesty researchers. That led them to ques­tion claims by NSO Group that export­ed ver­sions of Pega­sus can­not be used to hack Israeli phone num­bers. NSO Group has also said it doesn’t tar­get U.S. num­bers.

    Among those hacked was Ubai Abou­di, a 37-year-old econ­o­mist and U.S. cit­i­zen. He runs the sev­en-per­son Bisan Cen­ter for Research and Devel­op­ment in Ramal­lah, in the Israeli-occu­pied West Bank, one of the six groups Gantz slapped with ter­ror­ist des­ig­na­tions on Oct. 22.

    The oth­er two hacked Pales­tini­ans who agreed to be named are researcher Ghas­san Halai­ka of the Al-Haq rights group and attor­ney Salah Ham­mouri of Addameer, also a human rights orga­ni­za­tion. The oth­er three des­ig­nat­ed groups are Defense for Chil­dren Inter­na­tion­al-Pales­tine, the Union of Pales­tin­ian Women’s Com­mit­tees and the Union of Agri­cul­tur­al Work Com­mit­tees.

    Abou­di said he lost “any sense of safe­ty” through the “dehu­man­iz­ing” hack of a phone that is at his side day and night and holds pho­tos of his three chil­dren. He said his wife, the first three nights after learn­ing of the hack, “didn’t sleep from the idea of hav­ing such deep intru­sions into our pri­va­cy.”

    He was espe­cial­ly con­cerned about eaves­drop­pers being privy to his com­mu­ni­ca­tions with for­eign diplo­mats. The researchers’ exam­i­na­tion of Aboudi’s phone deter­mined it was infect­ed by Pega­sus in Feb­ru­ary.

    Abou­di accused Israel of “stick­ing the ter­ror­ist logo” on the groups after fail­ing to per­suade Euro­pean gov­ern­ments and oth­ers to cut off finan­cial sup­port.

    Israel says the groups are linked to the Pop­u­lar Front for the Lib­er­a­tion of Pales­tine, a left­ist polit­i­cal fac­tion with an armed wing that has killed Israelis. Israel and West­ern gov­ern­ments con­sid­er the PFLP a ter­ror group. Abou­di served a 12-month sen­tence last year after being con­vict­ed of charges of involve­ment in the PFLP but denies ever belong­ing to the group.

    Tehilla Shwartz Alt­shuler, a legal expert at the Israel Democ­ra­cy Insti­tute, called the find­ings “real­ly dis­turb­ing,” espe­cial­ly if it is proven that Israel’s secu­ri­ty agen­cies, who are large­ly exempt from the country’s pri­va­cy laws, have been using NSO Group’s com­mer­cial spy­ware.

    “This actu­al­ly com­pli­cates the rela­tion­ship of the gov­ern­ment with NSO,” said Alt­shuler, if the gov­ern­ment is indeed both a client and reg­u­la­tor in a rela­tion­ship con­duct­ed under secre­cy.

    Abou­di, along with rep­re­sen­ta­tives from Al-Haq and Addameer, held a press con­fer­ence in the occu­pied West Bank on Mon­day in which they con­demned the hacks as an attack on civ­il soci­ety. Addameer direc­tor Sahar Fran­cis called for an inter­na­tion­al inves­ti­ga­tion.

    “Of course we are not going to close our orga­ni­za­tions,” Fran­cis said. “We will con­tin­ue our work, con­tin­ue pro­vid­ing ser­vices.”

    The exec­u­tive direc­tor of Front­line Defend­ers, Andrew Ander­son, said the NSO Group can­not be trust­ed to ensure its spy­ware is not used ille­gal­ly by its cus­tomers and says Israel should face inter­na­tion­al reproach if it does not bring the com­pa­ny to heel.

    “If the Israeli gov­ern­ment refus­es to take action then this should have con­se­quences in terms of the reg­u­la­tion of trade with Israel,” he said via email.

    Al-Maskati, the researcher who dis­cov­ered the hacks, said he was first alert­ed on Oct. 16 by Halai­ka, whose phone was deter­mined to have been hacked in July 2020. Al-Haq engages in sen­si­tive com­mu­ni­ca­tions with the Inter­na­tion­al Crim­i­nal Court, among oth­ers, involv­ing alleged human rights abus­es.

    “As human rights defend­ers liv­ing under occu­pa­tion, we expect it was the (Israeli) occu­pa­tion,” Halai­ka said when asked who he believed was behind the hack.

    The phone of the third named hack­ing vic­tim, Ham­mouri, was appar­ent­ly com­pro­mised in April, the researchers said. A dual French nation­al liv­ing in Jerusalem, Ham­mouri pre­vi­ous­ly served a sev­en-year sen­tence for secu­ri­ty offens­es, and Israel con­sid­ers him a PFLP oper­a­tive, alle­ga­tions he denies.

    Ham­mouri declined to spec­u­late who was behind the hack, say­ing “we have to deter­mine who had the abil­i­ty and who had the motive.”

    After Halai­ka alert­ed him, Al-Maskati said he scanned 75 phones of Pales­tin­ian activists, find­ing the six infec­tions. He could not deter­mine how the phones were hacked, he said, though the time­line of evi­dence encoun­tered indi­cat­ed the use of a so-called “iMes­sage zero-click” exploit NSO Group used on iPhones. The exploit is high­ly effec­tive, requir­ing no user inter­ven­tion, as phish­ing attempts typ­i­cal­ly do.

    Face­book has sued NSO Group over the use of a some­what sim­i­lar exploit that alleged­ly intrud­ed via its glob­al­ly pop­u­lar encrypt­ed What­sApp mes­sag­ing app. A U.S. fed­er­al appeals court issued a rul­ing on Mon­day reject­ing an effort by NSO Group to have the law­suit thrown out.

    ...

    ———–

    “Report: NSO spy­ware found on 6 Pales­tin­ian activists’ phones” by FRANK BAJAK and JOSEPH KRAUSS; Asso­ci­at­ed Press; 11/08/2021

    “The rev­e­la­tion marks the first known instance of Pales­tin­ian activists being tar­get­ed by the mil­i­tary-grade Pega­sus spy­ware. Its use against jour­nal­ists, rights activists and polit­i­cal dis­si­dents from Mex­i­co to Sau­di Ara­bia has been doc­u­ment­ed since 2015.”

    First UK-bases num­bers, and now Israeli num­bers. When will we get our first con­firmed US num­ber? Time will tell. But at this point it seems rather inevitable. It’s part of why the ques­tion of who actu­al­ly exe­cut­ed this hack is such an impor­tant ques­tion. Was is the Israeli gov­ern­ment itself, or one of the NSO Group’s 40+ oth­er clients? The answer to that ques­tion is the like­ly answer to the open ques­tion of which NSO Group clients have the capa­bil­i­ty of hack­ing US-based phones:

    ...
    It’s not clear who placed the NSO spy­ware on the activists’ phones, said the researcher who first detect­ed it, Mohammed al-Maskati of the non­prof­it Front­line Defend­ers. The hack­ing began in July 2020, accord­ing to researchers.

    ...

    It’s not known pre­cise­ly when or how the phones were vio­lat­ed, the secu­ri­ty researchers said. But four of the six hacked iPhones exclu­sive­ly used SIM cards issued by Israeli tele­com com­pa­nies with Israeli +972 area code num­bers, said the Cit­i­zen Lab and Amnesty researchers. That led them to ques­tion claims by NSO Group that export­ed ver­sions of Pega­sus can­not be used to hack Israeli phone num­bers. NSO Group has also said it doesn’t tar­get U.S. num­bers.
    ...

    But giv­en the fact that Israel labeled the groups asso­ci­at­ed with these tar­get­ed Pales­tin­ian activists as ter­ror­ists groups short­ly after the Pega­sus spy­ware was first dis­cov­ered on their phones gives us a clue as to who car­ried out the hack. It was prob­a­bly Israel, a rather com­pli­cat­ed fun fact giv­en that the Israeli gov­ern­ment is also NSO Group’s reg­u­la­tor:

    ...
    Short­ly after the first two intru­sions were iden­ti­fied in mid-Octo­ber, Israeli Defense Min­is­ter Ben­ny Gantz declared six Pales­tin­ian civ­il soci­ety groups to be ter­ror­ist orga­ni­za­tions. Ire­land-based Front­line Defend­ers and at least two of the vic­tims say they con­sid­er Israel the main sus­pect and believe the des­ig­na­tion may have been timed to try to over­shad­ow the hacks’ dis­cov­ery, though they have pro­vid­ed no evi­dence to sub­stan­ti­ate those asser­tions.

    Israel has pro­vid­ed lit­tle evi­dence pub­licly to sup­port the ter­ror­ism des­ig­na­tion, which the Pales­tin­ian groups say aims to dry up their fund­ing and muz­zle oppo­si­tion to Israeli mil­i­tary rule. Three of the hacked Pales­tini­ans work for the civ­il soci­ety groups. The oth­ers do not, and wish to remain anony­mous, Front­line Defend­ers says.
    ...

    An Israeli defense offi­cial said in a brief state­ment that the des­ig­na­tion of the six orga­ni­za­tions was based on sol­id evi­dence and that any claim it is relat­ed to the use of NSO soft­ware is unfound­ed. The state­ment had no oth­er details, and offi­cials declined requests for fur­ther com­ment. The offi­cial spoke on con­di­tion of anonymi­ty to dis­cuss secu­ri­ty mat­ters.

    Israel’s Defense Min­istry approves the export of spy­ware pro­duced by NSO Group and oth­er pri­vate Israeli com­pa­nies that recruit from the country’s top cyber-capa­ble mil­i­tary units. Crit­ics say the process is opaque.

    ...

    Israel says the groups are linked to the Pop­u­lar Front for the Lib­er­a­tion of Pales­tine, a left­ist polit­i­cal fac­tion with an armed wing that has killed Israelis. Israel and West­ern gov­ern­ments con­sid­er the PFLP a ter­ror group. Abou­di served a 12-month sen­tence last year after being con­vict­ed of charges of involve­ment in the PFLP but denies ever belong­ing to the group.

    Tehilla Shwartz Alt­shuler, a legal expert at the Israel Democ­ra­cy Insti­tute, called the find­ings “real­ly dis­turb­ing,” espe­cial­ly if it is proven that Israel’s secu­ri­ty agen­cies, who are large­ly exempt from the country’s pri­va­cy laws, have been using NSO Group’s com­mer­cial spy­ware.

    “This actu­al­ly com­pli­cates the rela­tion­ship of the gov­ern­ment with NSO,” said Alt­shuler, if the gov­ern­ment is indeed both a client and reg­u­la­tor in a rela­tion­ship con­duct­ed under secre­cy.
    ...

    But as much as this sto­ry of the dis­cov­ery of Pega­sus on the Israeli phones of Pales­tin­ian activists cre­ates com­pli­ca­tions for the Israeli gov­ern­ment, it’s the sto­ry of the US deci­sion to black­list NSO Group and Can­diru that cre­ates a much big­ger and more imme­di­ate com­pli­ca­tion. It’s why we should­n’t be sur­prised to see com­plete­ly con­tra­dic­to­ry state­ments from the Israeli gov­ern­ment in the wake of that deci­sion. This black­list­ing real­ly is an enor­mous poten­tial com­pli­ca­tion between the rela­tions between the US and Israel, espe­cial­ly if it turns out US phones were indeed hack­able this entire time. The gov­ern­ment of Israel real­ly might want to cre­ate as much dis­tanced as pos­si­ble depend­ing on how this NSO Group sto­ry plays out in the end:

    Reuters

    Israeli for­eign min­is­ter dis­tances gov­ern­ment from black­list­ed NSO Group

    Novem­ber 6, 2021 3:15 PM CDT
    Updat­ed

    JERUSALEM, Nov 6 (Reuters) — Israel’s For­eign Min­is­ter Yair Lapid on Sat­ur­day dis­tanced the gov­ern­ment from the NSO Group, a firm black­list­ed this week by the Unit­ed States over alleged mis­use of its phone hack­ing spy­ware.

    An inves­ti­ga­tion by 17 media organ­i­sa­tions pub­lished in July said NSO’s Pega­sus soft­ware had tar­get­ed smart­phones of jour­nal­ists, rights activists and gov­ern­ment offi­cials in sev­er­al coun­tries.

    The com­pa­ny sends its prod­ucts abroad under licences from Israel’s Defence Min­istry, which has launched its own probe of the com­pa­ny’s prac­tices after the alleged soft­ware mis­use emerged.

    No results have been announced and Israel has giv­en no indi­ca­tion so far that it was con­sid­er­ing lim­it­ing the scope of NSO’s exports.

    “NSO is a pri­vate com­pa­ny, it is not a gov­ern­men­tal project and there­fore even if it is des­ig­nat­ed, it has noth­ing to do with the poli­cies of the Israeli gov­ern­ment,” Lapid told a news con­fer­ence in Jerusalem. “I don’t think there is anoth­er coun­try in the world which has such strict rules accord­ing to cyber war­fare and that is impos­ing those rules more than Israel and we will con­tin­ue to do so.”

    His com­ments are the first made pub­licly by a senior Israeli min­is­ter since the U.S. Com­merce Depart­ment announced the black­list­ing on Wednes­day. read more

    ...

    ———–

    “Israeli for­eign min­is­ter dis­tances gov­ern­ment from black­list­ed NSO Group”; Reuters; 11/06/2021

    “NSO is a pri­vate com­pa­ny, it is not a gov­ern­men­tal project and there­fore even if it is des­ig­nat­ed, it has noth­ing to do with the poli­cies of the Israeli government...I don’t think there is anoth­er coun­try in the world which has such strict rules accord­ing to cyber war­fare and that is impos­ing those rules more than Israel and we will con­tin­ue to do so.”

    It’s just a ran­dom pri­vate com­pa­ny that the Israeli gov­ern­ment has lit­tle to do with. That was the first response from the Israeli gov­ern­ment in response to the black­list­ing of NSO Group and Can­diru. Just a blan­ket denial and dis­tanc­ing from the whole sit­u­a­tion. But then, two days lat­er as the sto­ry of the hack of the Pales­tin­ian activists played out in par­al­lel, we get a report in the New York Times about how the Israeli gov­ern­ment is not only intent on prov­ing the ter­ror­ism charges against the PFLP-affil­i­at­ed groups but are also plan­ning on qui­et­ly lob­by­ing the US gov­ern­ment to over­turn the black­list­ings, while acknowl­edg­ing that the com­pa­nies play a cru­cial role in Israel’s for­eign pol­i­cy:

    The New York Times

    Despite Abus­es of NSO Spy­ware, Israel Will Lob­by U.S. to Defend It

    As a new accu­sa­tion sur­faces that NSO’s soft­ware may have been used to spy on Pales­tini­ans, Israeli offi­cials say it is cru­cial to nation­al secu­ri­ty.

    By Ronen Bergman and Patrick Kings­ley
    Nov. 8, 2021 Updat­ed 4:55 p.m. ET

    JERUSALEM — Hack­ing soft­ware sold by the NSO Group, an Israeli sur­veil­lance firm, has been used to spy on jour­nal­ists, oppo­si­tion groups and rights activists. There have been so many accu­sa­tions of abuse that the Biden admin­is­tra­tion slapped sanc­tions on the com­pa­ny last week.

    But the company’s biggest backer, the gov­ern­ment of Israel, con­sid­ers the soft­ware a cru­cial ele­ment of its for­eign pol­i­cy and is lob­by­ing Wash­ing­ton to remove the com­pa­ny from the black­list, two senior Israeli offi­cials said Mon­day.

    NSO insists that the soft­ware — which allows gov­ern­ments to remote­ly and secret­ly pen­e­trate a phone, mon­i­tor its loca­tion and extract it con­tents — is intend­ed to help coun­tries com­bat orga­nized crime and ter­ror­ism.

    But there has been a drum­beat of peri­od­ic rev­e­la­tions of abuse, with the company’s Pega­sus soft­ware used to hack the phones of polit­i­cal oppo­nents in dozens of coun­tries.

    The lat­est accu­sa­tion came Mon­day, when inter­na­tion­al com­put­er pri­va­cy experts said that Pega­sus had been deployed against Pales­tin­ian rights activists, rais­ing ques­tions about whether the Israeli gov­ern­ment itself was behind the hack­ing.

    If the new claims are true, the case would be yet anoth­er instance of the soft­ware being used against rights advo­cates and the first known instance of it being used inside Israel and the occu­pied ter­ri­to­ries.

    The Israeli prime minister’s office and the Defense Min­istry denied that Pega­sus had been used to hack the Pales­tini­ans’ phones. An NSO spokes­woman said that the com­pa­ny would not say who used the soft­ware and that it did not have access to infor­ma­tion about whom the pro­gram was used against.

    But the fact that such reports have led to a breach in rela­tions with the Unit­ed States alarmed the Israeli gov­ern­ment, the senior offi­cials said, speak­ing on the con­di­tion of anonymi­ty to dis­cuss issues of nation­al secu­ri­ty and diplo­mat­ic rela­tions.

    In impos­ing the sanc­tions, the U.S. Com­merce Depart­ment said that NSO had act­ed “con­trary to the nation­al secu­ri­ty or for­eign pol­i­cy inter­ests of the Unit­ed States.” If the Unit­ed States is accus­ing NSO of act­ing against its inter­ests, the offi­cials said, then it is implic­it­ly accus­ing Israel, which licens­es the soft­ware, of doing the same.

    Israel insists that it main­tains strict con­trol over the licens­ing, with a review process by the Defense Min­istry that was estab­lished in part to assure that no com­mer­cial deals would jeop­ar­dize Israel’s rela­tion­ship with the Unit­ed States.

    The cam­paign to remove the sanc­tions against NSO and a sec­ond com­pa­ny, Can­diru, will seek to per­suade the Biden admin­is­tra­tion that their activ­i­ties remain of great impor­tance to the nation­al secu­ri­ty of both coun­tries, the offi­cials said.

    They also said that Israel would be will­ing to com­mit to much tighter super­vi­sion on licens­ing the soft­ware.

    Aside from Israel’s Defense Min­istry review process, the glob­al mar­ket for spy­ware is large­ly unreg­u­lat­ed. Those tar­get­ed by the Pega­sus spy­ware in the past include peo­ple close to Jamal Khashog­gi, the Sau­di dis­si­dent and colum­nist mur­dered by Sau­di agents in 2018; inves­tiga­tive jour­nal­ists in Hun­gary; and lawyers in Mex­i­co.

    The inves­ti­ga­tion find­ing that the soft­ware was used against Pales­tin­ian rights activists, first report­ed by The Asso­ci­at­ed Press, did not defin­i­tive­ly iden­ti­fy which gov­ern­ment used Pega­sus in this case.

    “But it rais­es a lot of ques­tions as to the role not only of NSO, but also of Israel,” said Adam Shapiro, a spokesman for Front Line Defend­ers, a Dublin-based rights group that con­duct­ed the inves­ti­ga­tion along with Amnesty Inter­na­tion­al and Cit­i­zen Lab, a cyber-watch­dog affil­i­at­ed with the Uni­ver­si­ty of Toron­to.

    “There are only so many options that could be plau­si­ble here,” Mr. Shapiro said, “and the pre­vi­ous actions of the Israeli gov­ern­ment raise real ques­tions about what’s going on here and seri­ous doubts about any denials that the gov­ern­ment makes.”

    The lat­est accu­sa­tions mark the con­ver­gence of what had pre­vi­ous­ly been two sep­a­rate diplo­mat­ic issues for Israel: its out­law­ing last month of six Pales­tin­ian rights groups it accused of being fronts for a banned mil­i­tant group, which attract­ed wide­spread inter­na­tion­al crit­i­cism, and its long­stand­ing sup­port for NSO, which oper­ates under state-issued licens­es.

    The analy­sis said that four of the six Pales­tini­ans whose phones were hacked were employ­ees of the out­lawed groups.

    Accord­ing to Israeli gov­ern­ment pol­i­cy, Pega­sus can­not be used by a for­eign gov­ern­ment against Israeli phone num­bers, such as those belong­ing to the Pales­tini­ans in the out­lawed groups. An Israeli gov­ern­ment agency, how­ev­er, would have the author­i­ty to use the soft­ware against an Israeli num­ber.

    This pol­i­cy, cou­pled with the accu­sa­tions in the new analy­sis, raised ques­tions about whether the Israeli gov­ern­ment had used the spy­ware against the Pales­tin­ian rights advo­cates.

    ...

    Cit­ing secret evi­dence that it has not released pub­licly, the Israeli Defense Min­istry said that the groups had tak­en dona­tions from Euro­pean coun­tries and insti­tu­tions that were meant to be used for human­i­tar­i­an and rights-relat­ed activ­i­ty, and instead fun­neled that mon­ey to the Pop­u­lar Front. Offi­cials said that the des­ig­na­tion of the six orga­ni­za­tions was based on exten­sive addi­tion­al intel­li­gence, includ­ing clas­si­fied infor­ma­tion that was pre­sent­ed to sev­er­al intel­li­gence ser­vices and law enforce­ment agen­cies in Europe and the Unit­ed States.

    The Shin Bet, Israel’s inter­nal secu­ri­ty ser­vice, declined to answer ques­tions regard­ing the con­tent of this addi­tion­al and clas­si­fied infor­ma­tion, or whether it was obtained with NSO spy­ware.

    “Sol­id and unequiv­o­cal infor­ma­tion was pre­sent­ed, link­ing the activ­i­ties of the rel­e­vant orga­ni­za­tions to the Pop­u­lar Front for the Lib­er­a­tion of Pales­tine,” a Shin Bet spokesman said.

    A Shin Bet doc­u­ment from May sum­ma­riz­ing part of that inves­ti­ga­tion, obtained and ver­i­fied by The New York Times, pro­vid­ed no con­clu­sive evi­dence of a con­spir­a­cy between the groups and the Pop­u­lar Front. How­ev­er, an Israeli offi­cial said that this sum­ma­ry did not detail the main evi­dence against the six groups.

    The Pop­u­lar Front rose to promi­nence in the 1960s, when its mem­bers hijacked sev­er­al pas­sen­ger air­craft, and it went on to claim respon­si­bil­i­ty for attacks dur­ing a Pales­tin­ian upris­ing in the 2000s, includ­ing the assas­si­na­tion of Rehavam Zee­vi, an Israeli cab­i­net min­is­ter.

    Israel said that the Pop­u­lar Front’s mem­bers con­trolled the finances of the six out­lawed groups.

    The six groups — Addameer; Al Haq; Bisan; Defense For Chil­dren Inter­na­tion­al-Pales­tine; the Union of Pales­tin­ian Women’s Com­mit­tees; and the Union of Agri­cul­tur­al Work Com­mit­tees — say they are being tar­get­ed to silence their work report­ing infringe­ments on human rights.

    The six groups are var­i­ous­ly involved in doc­u­ment­ing abus­es by Israel; by the Pales­tin­ian Author­i­ty, which gov­erns the West Bank; and by Hamas, which rules Gaza. They also rep­re­sent Pales­tin­ian pris­on­ers in Israeli jails and pro­mote the rights of chil­dren, women and farm­ers.

    Some of the groups pro­vid­ed evi­dence to pros­e­cu­tors at the Inter­na­tion­al Crim­i­nal Court who are inves­ti­gat­ing Israeli politi­cians and mil­i­tary offi­cials, includ­ing the cur­rent defense min­is­ter, Ben­ny Gantz, for pos­si­ble war crimes. They have often shared mate­r­i­al and tes­ti­mo­ny with lead­ing inter­na­tion­al rights groups, such as Amnesty Inter­na­tion­al and Human Rights Watch, and have fre­quent­ly been cit­ed in the inter­na­tion­al media.

    The doc­u­ment sum­ma­riz­ing parts of the Shin Bet’s inves­ti­ga­tion was orig­i­nal­ly pro­vid­ed by the intel­li­gence agency to the groups’ Euro­pean donors and to Amer­i­can offi­cials in an attempt to per­suade the lat­ter of their investigation’s legit­i­ma­cy. A ver­sion of it was first leaked last week to two Israeli news out­lets, +972 and Local Call, and an Amer­i­can part­ner, The Inter­cept.

    But instead of detail­ing spe­cif­ic evi­dence against the six groups, the doc­u­ment focus­es on alle­ga­tions against a sev­enth orga­ni­za­tion, the Health Work Com­mit­tee. It main­ly con­tains alle­ga­tions, obtained under Israeli inter­ro­ga­tion, by two for­mer accoun­tants of the Health Work Com­mit­tee who were fired from their posts in 2019.

    The two accoun­tants claimed that the oth­er out­lawed orga­ni­za­tions were con­trolled by Pop­u­lar Front mem­bers, but at times con­ced­ed that some of those alle­ga­tions were based on con­jec­ture.

    The Irish and Dutch gov­ern­ments have said that Israel has not yet pro­vid­ed cred­i­ble evi­dence of the links between the six groups and ter­ror­ism.

    But an Israeli offi­cial said that the pur­pose of the leaked dossier was to per­suade Euro­peans and Amer­i­cans of the guilt of the Health Work Com­mit­tee, not the six oth­er groups, and that more con­clu­sive and secre­tive evi­dence about the six orga­ni­za­tions had been pro­vid­ed to Amer­i­can offi­cials in recent weeks.

    “We reject the claim that the mate­r­i­al pre­sent­ed to var­i­ous Amer­i­can enti­ties is cir­cum­stan­tial and unsat­is­fac­to­ry,” a Shin Bet spokes­woman said.

    ————

    “Despite Abus­es of NSO Spy­ware, Israel Will Lob­by U.S. to Defend It” by Ronen Bergman and Patrick Kings­ley; The New York Times; 11/08/2021

    “But the company’s biggest backer, the gov­ern­ment of Israel, con­sid­ers the soft­ware a cru­cial ele­ment of its for­eign pol­i­cy and is lob­by­ing Wash­ing­ton to remove the com­pa­ny from the black­list, two senior Israeli offi­cials said Mon­day.”

    Is NSO Group just a ran­dom pri­vate com­pa­ny that the Israeli gov­ern­ment cares lit­tle about? Or is it a cru­cial ele­ment of Israel’s for­eign pol­i­cy? It depends on who you ask, and what day. But the fact that Israel is specif­i­cal­ly high­ly con­cerned about US con­cerns over these com­pa­nies is an addi­tion­al data point sug­ges­tion that this entire hack­ing tool export sec­tor that’s explod­ed glob­al­ly over the past decade did so with the qui­et bless­ing of the US nation­al secu­ri­ty state. It’s the poten­tial loss of that qui­et bless­ing that makes a sto­ry of the black­list­ing poten­tial­ly so sig­nif­i­cant:

    ...
    But the fact that such reports have led to a breach in rela­tions with the Unit­ed States alarmed the Israeli gov­ern­ment, the senior offi­cials said, speak­ing on the con­di­tion of anonymi­ty to dis­cuss issues of nation­al secu­ri­ty and diplo­mat­ic rela­tions.

    In impos­ing the sanc­tions, the U.S. Com­merce Depart­ment said that NSO had act­ed “con­trary to the nation­al secu­ri­ty or for­eign pol­i­cy inter­ests of the Unit­ed States.” If the Unit­ed States is accus­ing NSO of act­ing against its inter­ests, the offi­cials said, then it is implic­it­ly accus­ing Israel, which licens­es the soft­ware, of doing the same.

    Israel insists that it main­tains strict con­trol over the licens­ing, with a review process by the Defense Min­istry that was estab­lished in part to assure that no com­mer­cial deals would jeop­ar­dize Israel’s rela­tion­ship with the Unit­ed States.

    ...

    Aside from Israel’s Defense Min­istry review process, the glob­al mar­ket for spy­ware is large­ly unreg­u­lat­ed. Those tar­get­ed by the Pega­sus spy­ware in the past include peo­ple close to Jamal Khashog­gi, the Sau­di dis­si­dent and colum­nist mur­dered by Sau­di agents in 2018; inves­tiga­tive jour­nal­ists in Hun­gary; and lawyers in Mex­i­co.
    ...

    But, again, we have no idea how seri­ous this US black­list­ing real­ly was. Is it large­ly the­atrics or was the US gen­uine­ly pissed about NSO Group? And again, the answer to that ques­tion prob­a­bly depends heav­i­ly on whether or not Pega­sus (or Can­diru’s spy­ware) real­ly was tech­ni­cal­ly capa­ble of hack­ing US phones. It would be a legit­i­mate mega-scan­dal if Israel promised the US gov­ern­ment this would­n’t hap­pen and it end­ed up hap­pen­ing any­way, result­ing the the exten­sive hack­ing of US phones. We have no evi­dence that such a sce­nario hap­pened, oth­er than the grow­ing cir­cum­stan­tial evi­dence that it’s very pos­si­ble.

    Posted by Pterrafractyl | November 13, 2021, 8:14 pm

  17. There was a recent report in Har­retz about the ongo­ing saga of the remark­ably scan­dalous Dubai NSO Group scan­dal. Remark­ably scan­dalous not just for NSO Group and the ruler of Dubai — who was abus­ing the soft­ware to spy on his ex-wife and her UK legal team — but poten­tial­ly the UK and the rest of the ‘Five Eyes’ when it was revealed this was like­ly the tip of the ice­berg for a much larg­er pat­tern of abuse by NSO Group clients tar­get UK, Israeli, and poten­tial­ly US, phone num­bers. And the UK and the rest of the Five Eyes seemed bare­ly per­turbed by the whole thing. The has been a bit of a Five Eyes push­back. The Biden admin­is­tra­tion did end up black­list­ing NSO Group and Can­diru.

    But as the fol­low­ing Haaretz report about how two dif­fer­ent princes in the UAE got their own NSO Group con­tracts men­tions anoth­er remark­ably dis­play of a lack of con­cern by a Five Eye gov­ern­ment about all this:. The UK has appar­ent­ly closed its inves­ti­ga­tion into the whole Dubai hack­ing scan­dal. Case closed, appar­ent­ly.

    Now, regard­ing the fact that the UAE had two princes with sep­a­rate NSO Group con­tracts, keep in mind that the num­bers we’ve heard thrown around for the num­ber of dif­fer­ent gov­ern­ment agen­cies that NSO Group sells to is around 60. This is at the same time we’ve heard it has around 40 to 45 gov­ern­ment clients. This implies there’s a lot more gov­ern­ments than the UAE with mul­ti­ple NSO Group clients. In oth­er words, there’s more where this came from. Again. It’s a major theme with this sto­ry.

    And that brings us to the sec­ond arti­cle excerpt below from a Decem­ber 2020 report by the Bureau of Inves­tiga­tive Jour­nal­ism. The report isn’t about the NSO Group’s hack­ing scan­dals and instead arguably some­thing much big­ger. But also some­thing awful­ly sim­i­lar to sound­ing to the NSO Group in many ways. And a sto­ry the UK’s nation­al secu­ri­ty state would be deeply impli­cat­ed in, along with pre­sum­ably the rest of the Five Eyes. It’s a remark­able sto­ry.

    The Bureau report is about an indus­try that has qui­et­ly emerged offer­ing an NSO Group-like hack­ing-toolk­it ser­vice tar­get­ing smart­phones and mobile devices. Ser­vices include the capa­bil­i­ty of track­ing device loca­tion around the world, but poten­tial­ly become far more inva­sive and include the col­lec­tion of very pri­vate data like bank infor­ma­tion, emails, and text mes­sage con­tent. 9 out of 10 text mes­sages sent glob­al­ly are vul­ner­a­ble to the exploits offered as a ser­vice by this indus­try.

    Like NSO Group, this tele­com hack­ing toolk­it ser­vice is osten­si­bly only offered to gov­ern­ment clients and only for offi­cial law enforce­ment and anti-ter­ror pur­pos­es. And as we’ll see, like with NSO Group’s toolk­it, these toolk­its are appar­ent­ly run by these gov­ern­ment clients on their own with­out over­sight, allow­ing for who knows what kind of abuse.

    And like the NSO Group sto­ry, it’s an Israeli firm that appears to be a major play­er in this glob­al mar­ket place. But here’s the part of the sto­ry that makes this a high­ly sen­si­tive sto­ry for the UK: that firm, Ray­zone Group, does­n’t oper­ate in Israel. It oper­ates on the Chan­nel Islands. And for glob­al telecom­mu­ni­ca­tion pur­pos­es. the Chan­nel Islands to treat­ed like the UK. But it’s not. It’s an unreg­u­lat­ed part­ner that shares the UK’s +44 coun­try code while allow­ing for the oper­a­tion of this mar­ket­place where access to the glob­al telecom­mu­ni­ca­tion’s infra­struc­ture is leased to pri­vate firms to sell access and exploits to gov­ern­ment clients. Yes, Ray­zone Group is an Israeli com­pa­ny, but this indus­try is an UK-enabled/­sanc­tioned enter­prise.

    Oh, and like the NSO Group sto­ry, this one also involves the same ruler of Dubai, Prince Bin Rashid al-Makhtoum, from abus­ing it. But this time he was cyber­stalk­ing his daugh­ter instead of his ex-wife. Princess Lat­i­fa was flee­ing his secu­ri­ty ser­vices around the globe after claim­ing to have been drugged and impris­oned for years. Her yacht was even­tu­al­ly locat­ed and she was cap­tured. After an inves­ti­ga­tion it was deter­mined that Princess Lat­i­fa’s loca­tion was sold to her father by Ray­zone Group. That guy was real­ly into spy­ware. And why not? It was served to him on a plat­ter.

    So how does the Chan­nel Islands facil­i­tate this glob­al spy­ing ser­vice? Well, it comes down to vul­ner­a­bil­i­ties in old 2G and 3G tech­nol­o­gy and the neces­si­ty of ensur­ing more secure tech­nolo­gies can still com­mu­ni­cate with those old­er vul­ner­a­ble ser­vices. This decades old Sig­nal­ing Sys­tem 7 (SS7) first devel­oped in 1975 enabled dif­fer­ent phone ser­vices to exchange infor­ma­tion, includ­ing geolo­ca­tion ser­vices involved with func­tions like roam­ing when trav­el­ing in a for­eign coun­try. It’s a key pro­to­col that allows what is in real­i­ty of patch­work of sys­tems work­ing under a patch­work of pro­to­cols to com­mu­ni­cate with each oth­er. But as we might expect with a sys­tem built in 1975, it has vul­ner­a­bil­i­ties. Vul­ner­a­bil­i­ties that effec­tive­ly give a hack­er remote sur­veil­lance pow­ers of the device that the user can­not do any­thing about because the snoop­ing is tak­ing plac­ing deep in the infra­struc­ture of the glob­al telecom­mu­ni­ca­tions indus­try.

    It’s the kind of secu­ri­ty arrange­ment that basi­cal­ly relies on lim­it­ing access to who can use this sys­tem and mak­ing them all promise not to abuse it. It’s that old and inse­cure. That’s why it’s rather scan­dalous to learn that the Chan­nel Islands are allow pri­vate com­pa­nies to lease access to this sys­tem and basi­cal­ly set up an NSO Group-style hack-for-ser­vice indus­try. Are gov­ern­ments real­ly the only enti­ties allowed to sign up for this super-tele­com hack­ing ser­vice? That’s what they claim. Let’s hope so, but either way, we’re talk­ing about a indus­try where pri­vate enti­ties are giv­en incred­i­bly pow­er­ful access to this basic piece of the glob­al mobile com­mu­ni­ca­tions infra­struc­ture and there’s basi­cal­ly no over­sight.

    Except, of course, there is over­sight. As we’ll see, when the Bureau released its report in Decem­ber 2020, it not­ed that the +44 ‘UK’ coun­try code has been the con­sis­tent glob­al leader in hack­ing attacks on this SS7 sys­tem over the pri­or two years, with the Chan­nel Islands being the source of those attack. The UK could kick the Chan­nel Islands off the +44 coun­try code but does­n’t. Because obvi­ous­ly there’s an intel­li­gence shar­ing rela­tion here.

    Keep in mind that, the UK, as a Five Eyes mem­ber, is the kind of nation that we would assume already has access to vir­tu­al­ly all of the infor­ma­tion made avail­able by this Chan­nel Islands SS7industry. That’s all part of what makes the sto­ry of Ray­zone Group and the Chan­nel Islands’ SS7 hack-for-hire indus­try so inter­est­ing: the UK is basi­cal­ly giv­ing license to a secret indus­try that’s pro­vid­ing gov­ern­ments glob­al­ly with access to incred­i­bly pow­er­ful spy­ware under the aus­pices of it only being used for legit­i­mate nation­al secu­ri­ty pur­pos­es but giv­ing all those gov­ern­ments access to some­thing that dou­bles as an incred­i­ble espi­onage tool. It’s not hard to imag­ine why Israel, ever in need of allies, would be will­ing to play a key role in this glob­al indus­try, but the it’s the tac­it approval of the UK and the rest of its Five Eyes part­ners that makes this such a fas­ci­nat­ing sto­ry. The qui­et com­mer­cial­iza­tion of slices of glob­al Total Infor­ma­tion Aware­ness, in this case facil­i­tat­ed by the qui­et exploita­tion of unpatch­able secu­ri­ty holes that haven’t quite yet aged out.

    Final­ly, just note that, unlike the Pega­sus sto­ry, there’s basi­cal­ly noth­ing you can do to defend against the SS7 exploits oth­er than not use a phone. It’s done at that high a lev­el and does­n’t need to inter­act direct­ly with your phone.

    Ok, first, here’s the recent Haaretz sto­ry that asks the sim­ple ask: so how was it that the UAE got two dif­fer­ent NSO Group accounts in the first place? And also points out that British police have already offi­cial­ly closed its inves­ti­ga­tion into the whole mat­ter, despite a judge rul­ing that “the find­ings con­sti­tute a com­plete vio­la­tion of trust and an ille­gal use of force.” Did the fact that this inves­ti­ga­tion involved abus­es by the Ray­zone Group on the Chan­nel Islands play a role in the rapid clos­ing of the case? It’s hard to imag­ine it was’t a fac­tor:

    Haaretz

    Two UAE Princes Each Got Their Own Per­son­al NSO Spy­ware

    Why does UAE — one coun­try with a joint fed­er­al mil­i­tary, police and secu­ri­ty force, need two sep­a­rate NSO spy­ware sys­tems held by two dif­fer­ent lead­ers?

    Eytan Avriel
    Nov. 17, 2021

    The Israeli cyber firm NSO sold its Pega­sus mobile-phone hack­ing soft­ware to two dif­fer­ent lead­ers of the Unit­ed Arab Emi­rates – Abu Dhabi ruler Mohammed Bin Zayed and Dubai ruler Sheikh Mohammed Bin Rashid al-Makhtoum.

    The­Mark­er has learned that the price each of these clients paid in dol­lars is a sev­en- to eight-fig­ure num­ber.

    Why does one coun­try, with a joint fed­er­al mil­i­tary, police and secu­ri­ty force, under the com­mand of Bin Zayed, need two sep­a­rate spy­ware sys­tems held by two dif­fer­ent lead­ers?

    One pos­si­bil­i­ty is that due to the inter­nal pol­i­tics and rival­ries between the sev­en emi­rates that form the UAE, the heads of the two most promi­nent prin­ci­pal­i­ties wished to have their own sys­tem. As far as is cur­rent­ly known, the heads of the oth­er five have not sought to acquire a sys­tem of their own.

    Anoth­er pos­si­bil­i­ty, recent­ly borne out, is that one of the rulers sought to use the sys­tem for per­son­al ends, in vio­la­tion of NSO’s terms of use, which are sup­posed to lim­it the use strict­ly to “com­bat­ting ter­ror­ism and vio­lent crime.” In this case, the one who made per­son­al use of the sys­tem is Bin Rashid al-Makhtoum.

    Accord­ing to a rul­ing last month by the U.K. High Court of Jus­tice, the Dubai poten­tate used the NSO Pega­sus sys­tem to hack into the mobile phones of his estranged wife and five mem­bers of her entourage – while the cou­ple was con­duct­ing a court bat­tle in Lon­don for cus­tody and the future of their two chil­dren. Among those whose phones were hacked are two of the princess’s lawyers. One of these is Fiona Shack­le­ton, a high-pow­ered celebri­ty lawyer and Con­ser­v­a­tive mem­ber of the House of Lords.

    ...

    Accord­ing to NSO find­ings hand­ed to the British gov­ern­ment, as report­ed by The Guardian, Princess Haya’s phone was hacked 11 times under Bin Rashid al-Makhtoum’s direc­tion or knowl­edge, yield­ing 500 images and some 65 MB of data, equiv­a­lent to 24 hours of con­tin­u­ous audio, tak­en from her device. Odd­ly, while the British judge ruled that “the find­ings con­sti­tute a com­plete vio­la­tion of trust and an ille­gal use of force,” British police have closed their inves­ti­ga­tion into the mat­ter.

    The princess’ 2019 escape from Dubai to Lon­don with her chil­dren and the couple’s strug­gle have fas­ci­nat­ed the British pub­lic, but are also a vivid exam­ple of the use NSO’s clients make of its prod­ucts. In some cas­es, includ­ing the sale of two sys­tems to two sep­a­rate rulers in the UAE, the Pega­sus sys­tem was only sold fol­low­ing heavy pres­sure from the Israeli gov­ern­ment, as part of the diplo­mat­ic warm­ing between Israel and the UAE. Yet the system’s irreg­u­lar use embar­rassed NSO and caused the third bout of bad pub­lic­i­ty the com­pa­ny has sus­tained since being black­list­ed by the U.S. last week.

    ———-

    “Two UAE Princes Each Got Their Own Per­son­al NSO Spy­ware” by Eytan Avriel; Haaretz; 11/17/2021

    “Accord­ing to NSO find­ings hand­ed to the British gov­ern­ment, as report­ed by The Guardian, Princess Haya’s phone was hacked 11 times under Bin Rashid al-Makhtoum’s direc­tion or knowl­edge, yield­ing 500 images and some 65 MB of data, equiv­a­lent to 24 hours of con­tin­u­ous audio, tak­en from her device. Odd­ly, while the British judge ruled that “the find­ings con­sti­tute a com­plete vio­la­tion of trust and an ille­gal use of force,” British police have closed their inves­ti­ga­tion into the mat­ter.”

    It’s the kind of sto­ry that has all the appear­ances of the tip of an ice­berg. And ice­berg of hacks of promi­nent UK indi­vid­u­als that weren’t sup­posed to hap­pen. An inves­ti­ga­tion into what should be a huge sto­ry, closed already with basi­cal­ly no real res­o­lu­tion. It’s hard to not assume there’s a whole bunch of awk­ward com­plic­i­ty being cov­ered up by that.

    But what about the fol­low­ing Decem­ber 2020 report by The Bureau Inves­tiga­tive Jour­nal­ism on the Chan­nel Island’s SS7 hack­ing indus­try that describes an NSO Group-style pri­vate indus­try with gov­ern­ment clients run via the UK’s qui­et tol­er­ance? And what about the fact that this NSO Group Dubai hack­ing sto­ry is direct­ly involved with the SS7 sto­ry? How much were sen­si­tiv­i­ties about this play­ing a role in the UK’s deci­sion to close the inves­ti­ga­tion?
    It’s one of the many ques­tions we’re forced to asked. Along with the gen­er­al ques­tion of how many dif­fer­ent gov­ern­ments are track­ing our phones at any giv­en point thanks to this Chan­nel Island’s cot­tage indus­try:

    The Bureau Inves­ti­gates

    Spy com­pa­nies using Chan­nel Islands to track phones around the world

    We tell the sto­ries that mat­ter. To help defend qual­i­ty report­ing and spark change, please sup­port the Bureau

    By Crofton Black
    Pub­lished Decem­ber 16 2020

    Pri­vate intel­li­gence com­pa­nies are using phone net­works based in the Chan­nel Islands to enable sur­veil­lance oper­a­tions to be car­ried out against peo­ple around the world, includ­ing British and US cit­i­zens, the Bureau of Inves­tiga­tive Jour­nal­ism can reveal fol­low­ing a joint report­ing project with the Guardian.

    Leaked data, doc­u­ments and inter­views with indus­try insid­ers who have access to sen­si­tive infor­ma­tion sug­gest that sys­temic weak­ness­es in the glob­al tele­coms infra­struc­ture, and a par­tic­u­lar vul­ner­a­bil­i­ty in Jer­sey and Guernsey, are being exploit­ed by cor­po­rate spy busi­ness­es.

    These busi­ness­es take advan­tage of some of the ways mobile phone net­works across the world inter­act in order to access pri­vate infor­ma­tion on tar­gets, such as loca­tion infor­ma­tion or, in more sophis­ti­cat­ed appli­ca­tions, the con­tent of calls and mes­sages or oth­er high­ly sen­si­tive data.

    The spy com­pa­nies see phone oper­a­tors in the Chan­nel Islands as an espe­cial­ly soft route into the UK, accord­ing to indus­try experts, who say the attacks ema­nat­ing from the islands appear to be tar­get­ed at indi­vid­u­als rather than cas­es of “mass” sur­veil­lance. The Bureau under­stands that the tar­gets of this sur­veil­lance have been spread across the globe, and includ­ed US cit­i­zens as well as peo­ple in Europe and Africa.

    Ron Wyden, the Ore­gon sen­a­tor and pri­va­cy advo­cate, described the use of for­eign tele­com assets to spy on peo­ple in the US as a nation­al secu­ri­ty threat.

    “Access into US tele­phone net­works is a priv­i­lege,” he said in response to the Bureau’s find­ings. “For­eign tele­com reg­u­la­tors need to police their domes­tic indus­try – if they don’t, they risk their coun­try being cut off from US roam­ing agree­ments.”

    Marké­ta Gre­gorová, the Euro­pean Parliament’s chief nego­tia­tor on trade leg­is­la­tion for sur­veil­lance tech­nol­o­gy, called for “imme­di­ate reg­u­la­to­ry, finan­cial and diplo­mat­ic costs on com­pa­nies and rogue juris­dic­tions” that enabled these prac­tices.

    ...

    The inves­ti­ga­tion has found that pri­vate intel­li­gence com­pa­nies are able to rent access from mobile phone oper­a­tors and this can then be exploit­ed to allow the track­ing of the phys­i­cal loca­tion of users across the world. They are also poten­tial­ly able to inter­cept calls and oth­er pri­vate data, includ­ing bank accounts and emails.

    These intru­sions, which are very wide­ly exploit­ed, rely on com­mands designed to help phone oper­a­tors track their cus­tomers’ where­abouts. Such com­mands, known as “sig­nals”, are sent via a kind of glob­al switch­board for the tele­coms indus­try called SS7.

    These are vital to the func­tion­ing of tele­coms net­works, and are a rou­tine part of ensur­ing accu­rate billing when roam­ing over­seas. But they can also be used by sophis­ti­cat­ed state and cor­po­rate secu­ri­ty agen­cies for more ques­tion­able pur­pos­es.

    Con­cerns about SS7 sig­nalling, a com­mu­ni­ca­tions sys­tem dat­ing back to the 1970s, are well estab­lished. But lit­tle progress has been made in resolv­ing the sit­u­a­tion in the past decade.

    A White­hall source described the sys­tem as “tox­ic, hor­ren­dous – yet one the world relies on,” adding that “it can be abused to geolo­cate peo­ple”. How­ev­er, secur­ing the sys­tem is com­plex: “if you get it wrong, you dis­con­nect your­self from the rest of the world.”

    Secu­ri­ty fix­es are being imple­ment­ed in the UK, but up to now there have been con­cerns that Chan­nel Islands oper­a­tors have not done so, the source added.

    The prob­lem can affect phones in the UK and abroad. Telecom­mu­ni­ca­tions queries sent from Chan­nel Islands net­works to phone num­bers in the UK can be treat­ed as domes­tic, and may evade fire­walls put in place to pre­vent for­eign sig­nalling intru­sions.

    But such mes­sages may also evade detec­tion glob­al­ly, because by using a +44 coun­try code they appear to be ema­nat­ing from the UK, gen­er­al­ly a well-trust­ed ter­ri­to­ry. Although Chan­nel Islands net­works share the UK coun­try code they are not cov­ered by UK reg­u­la­tions, open­ing up a weak link which spy com­pa­nies can exploit.

    Senior British offi­cials have expressed con­cerns about the secu­ri­ty of the Chan­nel Islands’ net­works, par­tic­u­lar­ly that some small­er oper­a­tors across the islands have not plugged well-known vul­ner­a­bil­i­ties. Sources told the Guardian and the Bureau that some oper­a­tors, in effect, have leased access to their net­works to sur­veil­lance busi­ness­es, allow­ing people’s mobile phones to be tracked around the world. Shad­ow dig­i­tal min­is­ter Chi Onwu­rah said: “This is a crit­i­cal sit­u­a­tion and it needs fix­ing urgent­ly. A secure and resilient tele­coms net­work can’t mean only wor­ry­ing about Chi­na and Huawei. Our nation­al secu­ri­ty should be the gov­ern­men­t’s pri­or­i­ty and we must act to pro­tect our net­works.”

    Sure Guernsey, one of the Chan­nel Islands tele­coms oper­a­tors iden­ti­fied in this inves­ti­ga­tion as a tran­sit point for mali­cious sig­nals, told the Bureau that it “does not lease access direct­ly or know­ing­ly to organ­i­sa­tions for the pur­pos­es of locat­ing and track­ing indi­vid­u­als or for inter­cept­ing com­mu­ni­ca­tions con­tent”. Sure acknowl­edged that net­work access points could be mis­used, but said its traf­fic goes through “UK oper­a­tors’ fire­walls in the same way as any oth­er inter­na­tion­al oper­a­tors’ traf­fic”.

    Jer­sey Air­tel, anoth­er oper­a­tor whose net­work has been iden­ti­fied as hav­ing been used for these pur­pos­es, said: “We take net­work and cus­tomer secu­ri­ty seri­ous­ly and we do have nec­es­sary con­trol mea­sures in place to address and pre­vent activ­i­ties that could com­pro­mise secu­ri­ty.”

    A new Tele­coms Secu­ri­ty Bill, pre­sent­ed to Par­lia­ment three weeks ago, aims to strength­en UK net­works and safe­guard them from these kinds of attacks, while rais­ing the costs for non-com­pli­ant phone oper­a­tors. The UK gov­ern­ment does not have juris­dic­tion over the Chan­nel Islands or oth­er off­shore British ter­ri­to­ries, how­ev­er.

    A gov­ern­ment spokesper­son said in response to the Bureau’s find­ings that the new bill will mean that “UK net­work oper­a­tors must pro­tect them­selves from mali­cious cyber activ­i­ty, wher­ev­er it orig­i­nates, and there will be tough penal­ties for oper­a­tors which do not com­ply”.

    How­ev­er, British tele­coms reg­u­la­tors and the secu­ri­ty ser­vices have almost no pow­ers to enforce against oper­a­tors in the Chan­nel Islands, beyond what is described as a “nuclear option” to remove their access to the +44 UK coun­try code. Instead they hope that the Chan­nel Islands can be pres­sured or encour­aged to ensure secu­ri­ty mea­sures are increased in line with those planned for the UK.

    The spokesper­son added: “Chan­nel Islands oper­a­tors do not auto­mat­i­cal­ly have the same secu­ri­ty oblig­a­tions as UK oper­a­tors, but the self-gov­ern­ing islands have com­mit­ted to align their forth­com­ing Tele­coms Secu­ri­ty Frame­works to the UK’s bill.”

    Guernsey’s reg­u­la­tor said oper­a­tors are oblig­ed “to take rea­son­able steps to pre­vent their licensed net­works and ser­vices from being used in, or in rela­tion to, the com­mis­sion of offences” and that the island is “devel­op­ing frame­works in line with the UK secu­ri­ty bill”.

    ...

    Experts warn that vul­ner­a­bil­i­ties will remain even after the switch to 5G as long as some net­works rely on old­er 2G and 3G tech­nol­o­gy.

    Com­pa­nies that enable the exploita­tion of the SS7 sys­tem for sur­veil­lance oper­a­tions have typ­i­cal­ly insist­ed that the use of their prod­ucts has been lim­it­ed to nation­al law enforce­ment agen­cies fight­ing seri­ous crime and ter­ror­ism. In fact, as the Bureau’s inves­ti­ga­tion reveals, in some cas­es the net seems to have gone sig­nif­i­cant­ly wider.

    In one exam­ple, dis­closed here for the first time, net­works in the Chan­nel Islands were used in an effort to locate Princess Lat­i­fa al-Mak­toum as she attempt­ed to evade her father, Sheikh Mohammed, the ruler of Dubai.

    Lat­i­fa, who claimed that her father had her held in soli­tary con­fine­ment, in the dark, beat­en and sedat­ed over a peri­od of sev­er­al years when she was in her teens and ear­ly twen­ties (alle­ga­tions which have been denied), fled the Unit­ed Arab Emi­rates on a char­tered yacht, but was recap­tured off the coast of India a week lat­er.

    Data reviewed by the Bureau shows that a series of sig­nals designed to reveal phone loca­tion were sent to a US-reg­is­tered mobile belong­ing to the yacht’s skip­per, Hervé Jaubert, the day before com­man­dos stormed the yacht and seized the princess. The effort appears to have been part of a huge bid by the Emi­ratis – mobil­is­ing boats, a sur­veil­lance plane and elec­tron­ic means – to track down the flee­ing princess. Sig­nals were sent via mobile net­works in Jer­sey, Guernsey, Cameroon, Israel, Laos and the USA.

    It is impos­si­ble to know if SS7 was the key to locat­ing the yacht: Jaubert told the Bureau that he did not have this phone with him at the time, and that even if suc­cess­ful­ly com­pro­mised it could not have revealed his loca­tion.

    But the method of the attack, using a string of mobile net­works around the world to send queries in quick suc­ces­sion, casts a stark light on how wide­spread the pen­e­tra­tion of glob­al tele­coms infra­struc­ture for sur­veil­lance pur­pos­es has become – and on the fact that such sur­veil­lance is not always just direct­ed at crim­i­nal mas­ter­minds.

    The oper­a­tion began around 2:30am local time on 3 March 2018, when Jer­sey Air­tel and Sure Guernsey made a series of SRI (“send rout­ing infor­ma­tion”) requests direct­ed at Jaubert’s US-reg­is­tered phone. These requests can dis­close the sub­scriber iden­ti­fi­ca­tion num­ber used to obtain fur­ther lev­els of access to a phone’s con­fi­den­tial data.

    Sec­onds lat­er, a net­work in Cameroon sent a fur­ther SRI com­mand to the same num­ber, fol­lowed by what tele­coms engi­neers call an ATI – an “any time inter­ro­ga­tion” request. The ATI com­mand can gen­er­ate a “Cell-ID”, which dis­clos­es, with­in a cer­tain radius, the last known loca­tion of a phone. More ATI requests fol­lowed in quick suc­ces­sion, sent via Jer­sey Air­tel and net­works in Israel and Laos.

    On this occa­sion these attempts to use for­eign net­works to locate Jaubert’s phone were blocked by inter­na­tion­al fire­walls. The attack­ers tried a dif­fer­ent tac­tic: they switched to a US net­work, sig­nalling into the phone via a small oper­a­tor in Min­neso­ta, New­Core Wire­less.

    Albert Kan­gas, head of New­Core Wire­less, said that his com­pa­ny had leased the access point used in the oper­a­tion to anoth­er US-based wire­less net­work, which in turn had sub­leased it to a “whole­sale part­ner”. Kan­gas did not iden­ti­fy the net­work which New­Core had rent­ed its access point to, but dis­closed that, the month after the oper­a­tion, “it was dis­con­nect­ed due to some sus­pi­cious activ­i­ty”.

    Informed that reporters were inves­ti­gat­ing how his phone net­work had seem­ing­ly been used as part of a sur­veil­lance oper­a­tion pri­or to a kid­nap­ping, he replied: “That’s not good.”

    The use of Jer­sey and Guernsey for this oper­a­tion was not an iso­lat­ed inci­dent.

    Net­work secu­ri­ty ana­lysts have told the Bureau the British +44 coun­try code has con­sis­tent­ly led the world in the num­ber of ori­gin points for mali­cious traf­fic for the past two years, and the Chan­nel Islands is believed to account for the major­i­ty of this.

    Recent aggre­gat­ed data seen by the Bureau shows a steady stream of sig­nalling intru­sions flow­ing from the Chan­nel Islands into phone net­works world­wide. The data, which is only a small snap­shot, shows hun­dreds of intru­sion attempts were sent via Sure Guernsey and Jer­sey Air­tel into net­works in North Amer­i­ca, Europe and Africa in August of this year.

    In one case shared with the Guardian by Gary Miller, a mobile secu­ri­ty researcher at Exi­gent Media who has stud­ied sen­si­tive mes­sag­ing sig­nals, a US mobile phone user who works for a com­mu­ni­ca­tions com­pa­ny was close­ly tracked using sig­nals that can pin­point a user’s loca­tion and pos­si­bly inter­cept com­mu­ni­ca­tions while on a trip to Bangladesh in August 2020. This was described by Miller as a sur­veil­lance attack ema­nat­ing through Sure Guernsey. Miller said the track­ing mes­sages were high­ly sus­pi­cious and not pos­si­ble under a “nor­mal usage sce­nario”.

    Indus­try insid­ers told the Bureau that some places were believed to rent out net­work access to third par­ties more read­i­ly than oth­ers, mak­ing them poten­tial hotspots for this type of traf­fic.

    “If it’s a small island you’re prob­a­bly going to get access,” an indus­try exec­u­tive with expe­ri­ence of SS7 sig­nalling told the Bureau. “That’s how we look at it any­way. Just go to a small island, not many sub­scribers, they’ve got all this infra­struc­ture.”

    Asked about the Chan­nel Islands, the exec­u­tive replied: “They’re the experts in it.”

    Human rights NGOs have react­ed with con­cern to the rev­e­la­tions.

    “The Chan­nel Islands can­not allow itself to be used as an off­shore glob­al spy cen­tre,” Edin Omanovic, advo­ca­cy direc­tor at Pri­va­cy Inter­na­tion­al, told the Bureau.

    “It is scan­dalous that this has been allowed to hap­pen. It not only threat­ens the secu­ri­ty of any­one in the UK, it under­mines the UK’s own inter­ests in sup­port­ing the work of human rights defend­ers, jour­nal­ists, and demo­c­ra­t­ic move­ments abroad.”

    In a state­ment to the Bureau, Sure Guernsey acknowl­edged that net­work access points “can be mis­used” and said that it takes “a num­ber of actions to mit­i­gate this risk”.

    “Sure works with glob­al telecom­mu­ni­ca­tions com­pa­nies, includ­ing all the UK oper­a­tors, to mon­i­tor sig­nalling traf­fic,” the com­pa­ny stat­ed. Any com­plaint “results in the ser­vice being imme­di­ate­ly ceased and sub­se­quent­ly per­ma­nent­ly ter­mi­nat­ed if mali­cious or inap­pro­pri­ate traf­fic is dis­cov­ered upon inves­ti­ga­tion. Sure has seen a declin­ing trend in such mali­cious activ­i­ty in recent years. Sure works with the UK Nation­al Cyber Secu­ri­ty Cen­tre where we share our approach to min­imis­ing the risk of mis­use.”

    Jer­sey Air­tel told the Bureau that it leased access points to a “wide spec­trum” of third-par­ty agen­cies. The com­pa­ny added: “In case of any such mis­use, we take strict action to block, inves­ti­gate and ini­ti­ate strict mea­sures ... To this end, we have also invest­ed in an SS7 fire­wall solu­tion from a trust­ed and rep­utable ven­dor which helps in block­ing any mis­use ... by third-par­ty part­ners, thus our SS7 secu­ri­ty is more robust than that of aver­age oper­a­tors.”

    In recent years a hub of sur­veil­lance tech com­pa­nies has emerged in Israel, sell­ing a vari­ety of inter­cep­tion and hack­ing tools to gov­ern­ments around the world. They fly large­ly under the radar, although an ongo­ing law­suit in Cal­i­for­nia launched by What­sApp, the pop­u­lar mes­sag­ing ser­vice, against NSO Group, a spy com­pa­ny head­quar­tered near Tel Aviv, has brought the indus­try to greater promi­nence. What­sApp, which is owned by Face­book, has accused NSO of send­ing mal­ware to 1,400 phones in order to break its encryp­tion and access its cus­tomers’ mes­sages. NSO Group denies any wrong­do­ing.

    The Bureau’s inves­ti­ga­tion has con­firmed that anoth­er Israeli com­pa­ny, Ray­zone Group, had leased the Sure Guernsey net­work access point – tech­ni­cal­ly known as a “glob­al title” – used in con­nec­tion with the appar­ent attempt­ed sur­veil­lance of Princess Lat­i­fa at the time of the oper­a­tion.

    Ray­zone Group’s web­site adver­tis­es “bou­tique intel­li­gence-based solu­tions for nation­al agen­cies”, aimed at coun­ter­ing ter­ror­ism and crimes which “pose a direct threat to the secu­ri­ty of cit­i­zens world­wide, and to inter­na­tion­al sta­bil­i­ty and pros­per­i­ty”. The com­pa­ny offers ser­vices to its clients includ­ing inter­cep­tion and loca­tion track­ing.

    Ray­zone Group denied any role in the oper­a­tion to cap­ture Lat­i­fa al-Mak­toum, stat­ing that “any attempt to asso­ciate our com­pa­ny with activ­i­ties that could have been per­formed by oth­ers, is mis­lead­ing and untrue”.

    Vered Ashke­nazi, the company’s chief busi­ness offi­cer, told the Bureau that Rayzone’s “geolo­ca­tion tools are oper­at­ed sole­ly by the cus­tomers (the end users) and not by us”.

    After the Bureau’s inquiry, she said, Ray­zone had “con­duct­ed a thor­ough inter­nal inves­ti­ga­tion into these claims” and “we can con­fi­dent­ly state that, to the best of our knowl­edge, none of our company’s prod­ucts have been (or could have been) asso­ci­at­ed with this case in any way”.

    Ashke­nazi declined to respond to a detailed series of ques­tions about the glob­al titles used in the oper­a­tion. Two indus­try sources have cor­rob­o­rat­ed Ray­zone Group’s rental of the Sure Guernsey glob­al title, +44 7781 001065, that sig­nalled at the yacht captain’s mobile phone.

    Accord­ing to invoic­es seen by the Bureau, Ray­zone rent­ed this access point in Jan­u­ary 2018 for a three-month peri­od, via a sub­sidiary in the British Vir­gin Islands, at a cost of $13,000 per month. The Lat­i­fa oper­a­tion, on March 3 of that year, would fall with­in this peri­od.

    More recent data seen by the Bureau sug­gests that over the past two years Ray­zone Group has been sig­nif­i­cant­ly active in the world­wide phone sur­veil­lance mar­ket.

    A sam­ple of data, believed to cov­er only a part of Rayzone’s oper­a­tions, shows that between August 2019 and April 2020 the com­pa­ny enabled the tar­get­ing of more than 60 coun­tries, with thou­sands of sig­nals being sent into more than 130 dif­fer­ent net­works.

    Spain – where the Guardian and El País revealed in July that a top Cata­lan politi­cian was tar­get­ed in a “pos­si­ble case of domes­tic polit­i­cal espi­onage” – was high on the list of coun­tries mon­i­tored. The data shows thou­sands of mes­sage units request­ing phone infor­ma­tion from mul­ti­ple major mobile net­works.

    Large num­bers of sig­nals were also sent into Ser­bia, the Nether­lands, Bul­gar­ia, Den­mark, Por­tu­gal, Cyprus and Bosnia-Herze­gov­ina. More­over, the Bureau’s inves­ti­ga­tion has con­firmed that Ray­zone Group has also leased access – direct­ly or indi­rect­ly – to glob­al titles in Ice­land, Swe­den and Switzer­land.

    “The rev­e­la­tions of the sheer scale and glob­al dimen­sion of these attacks are a wake-up call,” Marké­ta Gre­gorová, the Euro­pean sur­veil­lance rap­por­teur, said in response to the Bureau’s find­ings. “The del­i­cate bal­ance between law­ful gov­ern­men­tal sur­veil­lance and the sanc­ti­ty of fun­da­men­tal rights has been turned on its head.”

    Over­all, the data shows some lev­el of activ­i­ty in almost every coun­try in Europe, as well as hint­ing at the extent of com­pa­nies like Ray­zone’s reach else­where in the world: net­works were more heav­i­ly tar­get­ed in Israel, Hong Kong, Thai­land, Guatemala, the Domini­can Repub­lic and the USA, with small­er scale intru­sions into – among oth­ers – Moroc­co, Sudan, Libya, Pales­tine, Syr­ia and Iran.

    The data does not show how many devices were tar­get­ed. But it does indi­cate in which months par­tic­u­lar coun­tries were in the crosshairs. In August 2019 the USA and Bosnia were scenes of par­tic­u­lar activ­i­ty; in Octo­ber, the Nether­lands; in Decem­ber, Spain and Por­tu­gal; in March 2020, Ser­bia, Bul­gar­ia, Pak­istan and Israel; and in April, Spain again.

    In March, accord­ing to a sep­a­rate tranche of data seen by the Bureau, Ray­zone Group sent sev­er­al thou­sand intru­sive sig­nals to phones in the UK. Although prin­ci­pal­ly aimed at UK-based mobile num­bers, the tar­gets also appear to have includ­ed peo­ple from 27 oth­er coun­tries, among which were Thai­land, Jor­dan, Egypt, Rus­sia, Spain, Ukraine and Malaysia.

    The data does not indi­cate whether an attack suc­ceed­ed, or what its objec­tive was. But it does show that in some cas­es, dozens of sig­nals were direct­ed at a device, sug­gest­ing a sig­nif­i­cant attempt­ed sur­veil­lance oper­a­tion.

    Ray­zone said: “Our com­pa­ny devel­ops intel­li­gence and cyber­se­cu­ri­ty prod­ucts for use by gov­ern­men­tal author­i­ties only.”

    Pre­sent­ed with a detailed list of the Bureau’s find­ings, Ray­zone declined to com­ment, stat­ing only that all such ques­tions “entail reg­u­la­to­ry and trade secret issues and a risk to our cus­tomers’ ongo­ing oper­a­tions against ter­ror and severe crime, thus we are unable [to] specif­i­cal­ly address the ques­tions in a detailed man­ner and noth­ing here­in shall be con­strued as to con­firm or deny any claims raised in your let­ter”.

    Indus­try insid­ers who spoke to the Bureau said that despite rev­e­la­tions some years ago of how net­work vul­ner­a­bil­i­ties could be used for sur­veil­lance, the sit­u­a­tion now is, if any­thing, worse than before.

    The mobile phone indus­try is evolv­ing at pace, with 5G tech­nol­o­gy now on the hori­zon for many. Despite these advances, how­ev­er, a 2019 sur­vey of secu­ri­ty threats, car­ried out by the mobile oper­a­tors’ asso­ci­a­tion GSMA, found that old­er 2G and 3G net­works still car­ry half of the world’s traf­fic.

    Although new­er gen­er­a­tion net­works may be more secure in some ways, they still need to be able to com­mu­ni­cate with old­er ones – oth­er­wise half of all phones would be unable to con­nect to the oth­er half. This opens new­er net­works up to sig­nalling attacks.

    The GSMA study report­ed that that nine out of ten text mes­sages are vul­ner­a­ble to inter­cep­tion, while two-thirds of the net­works sur­veyed had failed to pro­tect prop­er­ly against mali­cious sig­nalling. There appears to be no quick fix to the morass of the glob­al telecom­mu­ni­ca­tions land­scape.

    “Peo­ple say ‘5G will solve every­thing’,” Sid Rao, a secu­ri­ty researcher at Aal­to Uni­ver­si­ty, Fin­land, told the Bureau. “But this will not be the case until every net­work on earth is 4G or 5G. Until this hap­pens, in say 30 years, vul­ner­a­bil­i­ties in old net­works will still be a risk to all oth­er net­works.”

    Rao’s assess­ment is blunt: “If there’s one 2G net­work left on Earth it’s still a prob­lem.”

    ————

    “Spy com­pa­nies using Chan­nel Islands to track phones around the world” by Crofton Black; The Bureau Inves­ti­gates; 12/16/2020

    “The inves­ti­ga­tion has found that pri­vate intel­li­gence com­pa­nies are able to rent access from mobile phone oper­a­tors and this can then be exploit­ed to allow the track­ing of the phys­i­cal loca­tion of users across the world. They are also poten­tial­ly able to inter­cept calls and oth­er pri­vate data, includ­ing bank accounts and emails.”

    It’s a glob­al vul­ner­a­bil­i­ty in mobile com­mu­ni­ca­tions. Not just mobile phone geolo­ca­tion ser­vices but oth­er poten­tial­ly data pri­vate data includ­ing bank accounts and emails. A glob­al vul­ner­a­bil­i­ty root­ed in the need to patch togeth­er com­mu­ni­ca­tion sys­tems, old and new, around the world if we’re going to have a tru­ly glob­al com­mu­ni­ca­tion sys­tem. At least these tech­ni­cal vul­ner­a­bil­i­ties in the SS7 “sig­nals” glob­al switch­board for the tele­coms indus­try are part of the sto­ry. The oth­er part is the fact that the Chan­nel Islands appears to be the hub of vul­ner­a­bil­i­ty for this glob­al sys­tem, exploit­ing a loop­hole where the world treats the Chan­nel Islands’ tele­com traf­fic like its part of the UK, with a shared +44 coun­try code, while the UK does­n’t actu­al­ly have any pow­er to ensure the Chan­nel Islands lives up to UK reg­u­la­tions. Well the UK does have one option. Kick­ing the Chan­nel Islands out of this shared +44 coun­try code and no longer just trust­ing its traf­fic.

    But as long as its con­sid­ered a “nuclear option” for the UK to kick the Chan­nel Islands out of the +44 clode, this loop­hole that cre­ates a glob­al vul­ner­a­bil­i­ty in mobile com­mu­ni­ca­tions for lease to gov­ern­ments pri­vate intel­li­gence firms alike remains in place. It’s kind of mega-scan­dalous. And the fact that the track­ing of Prince Lat­i­fa by the ruler of Dubai was car­ried out by an Israeli firm that rents out access to this infor­ma­tion to peo­ple like the rule of Dubai sug­gests this mega-scan­dal might be relat­ed to the larg­er sto­ry of the UK’s s

    It’s a poten­tial­ly sig­nif­i­cant aspect of the UK’s deci­sion to close the inves­ti­ga­tion into the illic­it NSO Group hack­ing of not just Princess Haya bint al-Hus­sein but her lawyer/UK law­mak­er Fiona Shack­le­ton, along with a num­ber of oth­er UK num­bers. There have long been strong indi­ca­tions that NSO Group and the rest of the Israeli spy­ware indus­try is oper­at­ing with the tac­it approval of the UK and US nation­al secu­ri­ty states. But the pre­ma­ture clo­sure of that inves­ti­ga­tion is the kind of move that hints at a lot more mega-scan­dal under that rock:

    ...
    These intru­sions, which are very wide­ly exploit­ed, rely on com­mands designed to help phone oper­a­tors track their cus­tomers’ where­abouts. Such com­mands, known as “sig­nals”, are sent via a kind of glob­al switch­board for the tele­coms indus­try called SS7.

    ...

    The prob­lem can affect phones in the UK and abroad. Telecom­mu­ni­ca­tions queries sent from Chan­nel Islands net­works to phone num­bers in the UK can be treat­ed as domes­tic, and may evade fire­walls put in place to pre­vent for­eign sig­nalling intru­sions.

    But such mes­sages may also evade detec­tion glob­al­ly, because by using a +44 coun­try code they appear to be ema­nat­ing from the UK, gen­er­al­ly a well-trust­ed ter­ri­to­ry. Although Chan­nel Islands net­works share the UK coun­try code they are not cov­ered by UK reg­u­la­tions, open­ing up a weak link which spy com­pa­nies can exploit.

    ...

    A new Tele­coms Secu­ri­ty Bill, pre­sent­ed to Par­lia­ment three weeks ago, aims to strength­en UK net­works and safe­guard them from these kinds of attacks, while rais­ing the costs for non-com­pli­ant phone oper­a­tors. The UK gov­ern­ment does not have juris­dic­tion over the Chan­nel Islands or oth­er off­shore British ter­ri­to­ries, how­ev­er.

    A gov­ern­ment spokesper­son said in response to the Bureau’s find­ings that the new bill will mean that “UK net­work oper­a­tors must pro­tect them­selves from mali­cious cyber activ­i­ty, wher­ev­er it orig­i­nates, and there will be tough penal­ties for oper­a­tors which do not com­ply”.

    How­ev­er, British tele­coms reg­u­la­tors and the secu­ri­ty ser­vices have almost no pow­ers to enforce against oper­a­tors in the Chan­nel Islands, beyond what is described as a “nuclear option” to remove their access to the +44 UK coun­try code. Instead they hope that the Chan­nel Islands can be pres­sured or encour­aged to ensure secu­ri­ty mea­sures are increased in line with those planned for the UK.
    ...

    Adding to the poten­tial mega-scan­dal here is the fact that the +44 coun­try code has con­sis­tent­ly led the world in the num­ber of ori­gin points for mali­cious traf­fic for the past two years, and the major­i­ty of that is believed to be from the Chan­nel Islands. So the UK has tol­er­at­ed a bonan­za of attacks like this dur­ing the same peri­od Ray­zone Group was offer­ing these kinds of mali­cious attack ser­vices from leased access to that sys­tem. It’s kind of amaz­ing. The Chan­nel Island had an indus­try of leas­ing access to this sys­tem for obvi­ous exploita­tion to firms like Ray­zone Group who would then play an NSO Group-style role of sell­ing those attacks to gov­ern­ments around the world. Gov­ern­ment clients like the ruler of Dubai so he can geolocate/stalk his flee­ing daugh­ter:

    ...
    Senior British offi­cials have expressed con­cerns about the secu­ri­ty of the Chan­nel Islands’ net­works, par­tic­u­lar­ly that some small­er oper­a­tors across the islands have not plugged well-known vul­ner­a­bil­i­ties. Sources told the Guardian and the Bureau that some oper­a­tors, in effect, have leased access to their net­works to sur­veil­lance busi­ness­es, allow­ing people’s mobile phones to be tracked around the world. Shad­ow dig­i­tal min­is­ter Chi Onwu­rah said: “This is a crit­i­cal sit­u­a­tion and it needs fix­ing urgent­ly. A secure and resilient tele­coms net­work can’t mean only wor­ry­ing about Chi­na and Huawei. Our nation­al secu­ri­ty should be the gov­ern­men­t’s pri­or­i­ty and we must act to pro­tect our net­works.”

    ...

    Com­pa­nies that enable the exploita­tion of the SS7 sys­tem for sur­veil­lance oper­a­tions have typ­i­cal­ly insist­ed that the use of their prod­ucts has been lim­it­ed to nation­al law enforce­ment agen­cies fight­ing seri­ous crime and ter­ror­ism. In fact, as the Bureau’s inves­ti­ga­tion reveals, in some cas­es the net seems to have gone sig­nif­i­cant­ly wider.

    In one exam­ple, dis­closed here for the first time, net­works in the Chan­nel Islands were used in an effort to locate Princess Lat­i­fa al-Mak­toum as she attempt­ed to evade her father, Sheikh Mohammed, the ruler of Dubai.

    ...

    The use of Jer­sey and Guernsey for this oper­a­tion was not an iso­lat­ed inci­dent.

    Net­work secu­ri­ty ana­lysts have told the Bureau the British +44 coun­try code has con­sis­tent­ly led the world in the num­ber of ori­gin points for mali­cious traf­fic for the past two years, and the Chan­nel Islands is believed to account for the major­i­ty of this.
    ...

    Also note how Ray­zone Group’s ali­bi is the exact same ali­bi the NSO Group falls back on: don’t blame us. We have no idea what our clients are doing with our tools. In this case, “geolo­ca­tion tools are oper­at­ed sole­ly by the cus­tomers (the end users) and not by us.” We know what that means. A lot more ‘don’t blame us! Blame our clients!’ ali­bis are on the way:

    ...
    The Bureau’s inves­ti­ga­tion has con­firmed that anoth­er Israeli com­pa­ny, Ray­zone Group, had leased the Sure Guernsey net­work access point – tech­ni­cal­ly known as a “glob­al title” – used in con­nec­tion with the appar­ent attempt­ed sur­veil­lance of Princess Lat­i­fa at the time of the oper­a­tion.

    Ray­zone Group’s web­site adver­tis­es “bou­tique intel­li­gence-based solu­tions for nation­al agen­cies”, aimed at coun­ter­ing ter­ror­ism and crimes which “pose a direct threat to the secu­ri­ty of cit­i­zens world­wide, and to inter­na­tion­al sta­bil­i­ty and pros­per­i­ty”. The com­pa­ny offers ser­vices to its clients includ­ing inter­cep­tion and loca­tion track­ing.

    Ray­zone Group denied any role in the oper­a­tion to cap­ture Lat­i­fa al-Mak­toum, stat­ing that “any attempt to asso­ciate our com­pa­ny with activ­i­ties that could have been per­formed by oth­ers, is mis­lead­ing and untrue”.

    Vered Ashke­nazi, the company’s chief busi­ness offi­cer, told the Bureau that Rayzone’s “geolo­ca­tion tools are oper­at­ed sole­ly by the cus­tomers (the end users) and not by us”.

    ...

    A sam­ple of data, believed to cov­er only a part of Rayzone’s oper­a­tions, shows that between August 2019 and April 2020 the com­pa­ny enabled the tar­get­ing of more than 60 coun­tries, with thou­sands of sig­nals being sent into more than 130 dif­fer­ent net­works.

    Spain – where the Guardian and El País revealed in July that a top Cata­lan politi­cian was tar­get­ed in a “pos­si­ble case of domes­tic polit­i­cal espi­onage” – was high on the list of coun­tries mon­i­tored. The data shows thou­sands of mes­sage units request­ing phone infor­ma­tion from mul­ti­ple major mobile net­works.

    ...

    Ray­zone said: “Our com­pa­ny devel­ops intel­li­gence and cyber­se­cu­ri­ty prod­ucts for use by gov­ern­men­tal author­i­ties only.”

    Pre­sent­ed with a detailed list of the Bureau’s find­ings, Ray­zone declined to com­ment, stat­ing only that all such ques­tions “entail reg­u­la­to­ry and trade secret issues and a risk to our cus­tomers’ ongo­ing oper­a­tions against ter­ror and severe crime, thus we are unable [to] specif­i­cal­ly address the ques­tions in a detailed man­ner and noth­ing here­in shall be con­strued as to con­firm or deny any claims raised in your let­ter”.
    ...

    And this indus­try of leas­ing access to an anti­quat­ed SS7 sys­tem to pri­vate com­pa­nies that sell exploits to its anti­quat­ed vul­ner­a­bil­i­ties to clients around the world will con­tin­ue as long as there are 2G and 3G sys­tems still oper­at­ing. The neces­si­ty of cre­at­ing inter­op­er­abil­i­ty between these old­er net­works and the rest of the world will cre­ate the neces­si­ty for main­tain­ing this SS7 glob­al switch­board sys­tem with all of its known vul­ner­a­bil­i­ties. 9 out of 10 text mes­sages are poten­tial­ly vul­ner­a­ble to this sys­tem and yet it con­tin­ues as the com­mer­cial space grows, sell­ing this pow­er­ful spy­ing capa­bil­i­ty to clients (osten­si­bly just gov­ern­ment clients) for offi­cial law enforce­ment and anti-ter­ror uses. It’s like an NSO Group-like arrange­ment, but one that relies on main­tain­ing this remark­able secu­ri­ty hole in mobile telecom­mu­ni­ca­tions under the pre­tense that it will only be gov­ern­ments ulti­mate­ly doing the exploit­ing:

    ...
    Experts warn that vul­ner­a­bil­i­ties will remain even after the switch to 5G as long as some net­works rely on old­er 2G and 3G tech­nol­o­gy.

    ...

    In one case shared with the Guardian by Gary Miller, a mobile secu­ri­ty researcher at Exi­gent Media who has stud­ied sen­si­tive mes­sag­ing sig­nals, a US mobile phone user who works for a com­mu­ni­ca­tions com­pa­ny was close­ly tracked using sig­nals that can pin­point a user’s loca­tion and pos­si­bly inter­cept com­mu­ni­ca­tions while on a trip to Bangladesh in August 2020. This was described by Miller as a sur­veil­lance attack ema­nat­ing through Sure Guernsey. Miller said the track­ing mes­sages were high­ly sus­pi­cious and not pos­si­ble under a “nor­mal usage sce­nario”.

    Indus­try insid­ers told the Bureau that some places were believed to rent out net­work access to third par­ties more read­i­ly than oth­ers, mak­ing them poten­tial hotspots for this type of traf­fic.

    “If it’s a small island you’re prob­a­bly going to get access,” an indus­try exec­u­tive with expe­ri­ence of SS7 sig­nalling told the Bureau. “That’s how we look at it any­way. Just go to a small island, not many sub­scribers, they’ve got all this infra­struc­ture.”

    ...

    The mobile phone indus­try is evolv­ing at pace, with 5G tech­nol­o­gy now on the hori­zon for many. Despite these advances, how­ev­er, a 2019 sur­vey of secu­ri­ty threats, car­ried out by the mobile oper­a­tors’ asso­ci­a­tion GSMA, found that old­er 2G and 3G net­works still car­ry half of the world’s traf­fic.

    ...

    The GSMA study report­ed that that nine out of ten text mes­sages are vul­ner­a­ble to inter­cep­tion, while two-thirds of the net­works sur­veyed had failed to pro­tect prop­er­ly against mali­cious sig­nalling. There appears to be no quick fix to the morass of the glob­al telecom­mu­ni­ca­tions land­scape.
    ...

    So that’s all some­thing to keep in mind regard­ing the UK inves­ti­ga­tion into the ruler of Dubai’s mul­ti-faceted hack of UK devices and peo­ple. It’s the kind of inves­ti­ga­tion we should have prob­a­bly expect­ed to end pre­ma­ture­ly because it’s inves­ti­gat­ing a sto­ry that clear­ly goes in sen­si­tive direc­tions. Sen­si­tive direc­tions that include core Five Eyes spy­ing capa­bil­i­ties. And sen­si­tive direc­tions that includes the com­mer­cial­iza­tion of that same glob­al spy­ing space.

    Posted by Pterrafractyl | November 25, 2021, 2:05 am

  18. The inevitable has final­ly hap­pened. Sort of: we just got reports of US gov­ern­ment offi­cials get­ting their phones hacked with the NSO Group’s Pega­sus spy­ware. At least 11 US embassy employ­ees in Ugan­da had their iPhones hacked. It’s not known which NSO Group client car­ried out the hacks.

    But while this sto­ry is con­fir­ma­tion that US gov­ern­ment employ­ees are vul­ner­a­ble to the Pega­sus spy­ware, it’s not actu­al­ly a con­fir­ma­tion that US-based phones (with a 1+ num­ber) are vul­ner­a­ble. It appears the hacked phones were reg­is­tered with for­eign tele­phone num­bers.

    So while we’ve seen abun­dant cir­cum­stan­tial evi­dence sug­gest­ing that Pega­sus can tar­get US phones — like the fact that it could hack UK and Israeli phones despite NSO Group’s assur­ances to the con­trary — we still don’t have con­fir­ma­tion that US phones are vul­ner­a­ble. Although the pace these sto­ries are devel­op­ing it should­n’t be long:

    Reuters

    U.S. State Depart­ment phones hacked with Israeli com­pa­ny spy­ware — sources

    By Christo­pher Bing and Joseph Menn
    Decem­ber 3, 2021 10:18 PM CST Updat­ed

    WASHINGTON/SAN FRANCISCO, Dec 3 (Reuters) — Apple Inc iPhones of at least nine U.S. State Depart­ment employ­ees were hacked by an unknown assailant using sophis­ti­cat­ed spy­ware devel­oped by the Israel-based NSO Group, accord­ing to four peo­ple famil­iar with the mat­ter.

    The hacks, which took place in the last sev­er­al months, hit U.S. offi­cials either based in Ugan­da or focused on mat­ters con­cern­ing the East African coun­try, two of the sources said.

    The intru­sions, first report­ed here, rep­re­sent the widest known hacks of U.S. offi­cials through NSO tech­nol­o­gy. Pre­vi­ous­ly, a list of num­bers with poten­tial tar­gets includ­ing some Amer­i­can offi­cials sur­faced in report­ing on NSO, but it was not clear whether intru­sions were always tried or suc­ceed­ed.

    Reuters could not deter­mine who launched the lat­est cyber­at­tacks.

    NSO Group said in a state­ment on Thurs­day that it did not have any indi­ca­tion their tools were used but can­celed access for the rel­e­vant cus­tomers and would inves­ti­gate based on the Reuters inquiry.

    “If our inves­ti­ga­tion shall show these actions indeed hap­pened with NSO’s tools, such cus­tomer will be ter­mi­nat­ed per­ma­nent­ly and legal actions will take place,” said an NSO spokesper­son, who added that NSO will also “coop­er­ate with any rel­e­vant gov­ern­ment author­i­ty and present the full infor­ma­tion we will have.”

    NSO has long said it only sells its prod­ucts to gov­ern­ment law enforce­ment and intel­li­gence clients, help­ing them to mon­i­tor secu­ri­ty threats, and is not direct­ly involved in sur­veil­lance oper­a­tions.

    ...

    NSO Group and anoth­er spy­ware firm were “added to the Enti­ty List based on a deter­mi­na­tion that they devel­oped and sup­plied spy­ware to for­eign gov­ern­ments that used this tool to mali­cious­ly tar­get gov­ern­ment offi­cials, jour­nal­ists, busi­ness­peo­ple, activists, aca­d­e­mics, and embassy work­ers,” the Com­merce Depart­ment said in an announce­ment last month.

    EASILY IDENTIFIABLE

    NSO soft­ware is capa­ble of not only cap­tur­ing encrypt­ed mes­sages, pho­tos and oth­er sen­si­tive infor­ma­tion from infect­ed phones, but also turn­ing them into record­ing devices to mon­i­tor sur­round­ings, based on prod­uct man­u­als reviewed by Reuters.

    Apple’s alert to affect­ed users did not name the cre­ator of the spy­ware used in this hack.

    The vic­tims noti­fied by Apple includ­ed Amer­i­can cit­i­zens and were eas­i­ly iden­ti­fi­able as U.S. gov­ern­ment employ­ees because they asso­ci­at­ed email address­es end­ing in state.gov with their Apple IDs, two of the peo­ple said.

    They and oth­er tar­gets noti­fied by Apple in mul­ti­ple coun­tries were infect­ed through the same graph­ics pro­cess­ing vul­ner­a­bil­i­ty that Apple did not learn about and fix until Sep­tem­ber, the sources said.

    Since at least Feb­ru­ary, this soft­ware flaw allowed some NSO cus­tomers to take con­trol of iPhones sim­ply by send­ing invis­i­ble yet taint­ed iMes­sage requests to the device, researchers who inves­ti­gat­ed the espi­onage cam­paign said.

    The vic­tims would not see or need to inter­act with a prompt for the hack to be suc­cess­ful. Ver­sions of NSO sur­veil­lance soft­ware, com­mon­ly known as Pega­sus, could then be installed.

    Apple’s announce­ment that it would noti­fy vic­tims came on the same day it sued NSO Group last week, accus­ing it of help­ing numer­ous cus­tomers break into Apple’s mobile soft­ware, iOS.

    In a pub­lic response, NSO has said its tech­nol­o­gy helps stop ter­ror­ism and that they’ve installed con­trols to curb spy­ing against inno­cent tar­gets.

    For exam­ple, NSO says its intru­sion sys­tem can­not work on phones with U.S. num­bers begin­ning with the coun­try code +1.

    But in the Ugan­da case, the tar­get­ed State Depart­ment employ­ees were using iPhones reg­is­tered with for­eign tele­phone num­bers, said two of the sources, with­out the U.S. coun­try code.

    Ugan­da has been roiled this year by an elec­tion with report­ed irreg­u­lar­i­ties, protests and a gov­ern­ment crack­down. U.S. offi­cials have tried to meet with oppo­si­tion lead­ers, draw­ing ire from the Ugan­dan gov­ern­ment. read more Reuters has no evi­dence the hacks were relat­ed to cur­rent events in Ugan­da.

    A senior Biden admin­is­tra­tion offi­cial, speak­ing on con­di­tion he not be iden­ti­fied, said the threat to U.S. per­son­nel abroad was one of the rea­sons the admin­is­tra­tion was crack­ing down on com­pa­nies such as NSO and pur­su­ing new glob­al dis­cus­sion about spy­ing lim­its.

    The offi­cial added that the gov­ern­ment has seen “sys­temic abuse” in mul­ti­ple coun­tries involv­ing NSO’s Pega­sus spy­ware.

    Sen. Ron Wyden, who is on the Sen­ate Intel­li­gence Com­mit­tee, said: “Com­pa­nies that enable their cus­tomers to hack U.S. gov­ern­ment employ­ees are a threat to Amer­i­ca’s nation­al secu­ri­ty and should be treat­ed as such.”

    His­tor­i­cal­ly, some of NSO Group’s best-known past clients includ­ed Sau­di Ara­bia, the Unit­ed Arab Emi­rates and Mex­i­co.

    The Israeli Min­istry of Defense must approve export licens­es for NSO, which has close ties to Israel’s defense and intel­li­gence com­mu­ni­ties, to sell its tech­nol­o­gy inter­na­tion­al­ly.

    In a state­ment, the Israeli embassy in Wash­ing­ton said that tar­get­ing Amer­i­can offi­cials would be a seri­ous breach of its rules.

    “Cyber prod­ucts like the one men­tioned are super­vised and licensed to be export­ed to gov­ern­ments only for pur­pos­es relat­ed to counter-ter­ror­ism and severe crimes,” an embassy spokesper­son said. “The licens­ing pro­vi­sions are very clear and if these claims are true, it is a severe vio­la­tion of these pro­vi­sions.”

    ————

    “U.S. State Depart­ment phones hacked with Israeli com­pa­ny spy­ware — sources” by Christo­pher Bing and Joseph Menn; Reuters; 12/03/2021

    “NSO Group said in a state­ment on Thurs­day that it did not have any indi­ca­tion their tools were used but can­celed access for the rel­e­vant cus­tomers and would inves­ti­gate based on the Reuters inquiry.”

    Who hacked the US embassy? NSO Group claims it does­n’t know, but has already can­celed access for “the rel­e­vant cus­tomers”, so there’s clear­ly some prime sus­pects. Which gov­ern­ment will it end up being?

    But then there’s the gen­er­al ques­tion of where else have US employ­ees been hacked? It appears the answer might depend on where US gov­ern­ment offi­cials are using for­eign-reg­is­tered phones:

    ...
    Apple’s announce­ment that it would noti­fy vic­tims came on the same day it sued NSO Group last week, accus­ing it of help­ing numer­ous cus­tomers break into Apple’s mobile soft­ware, iOS.

    In a pub­lic response, NSO has said its tech­nol­o­gy helps stop ter­ror­ism and that they’ve installed con­trols to curb spy­ing against inno­cent tar­gets.

    For exam­ple, NSO says its intru­sion sys­tem can­not work on phones with U.S. num­bers begin­ning with the coun­try code +1.

    But in the Ugan­da case, the tar­get­ed State Depart­ment employ­ees were using iPhones reg­is­tered with for­eign tele­phone num­bers, said two of the sources, with­out the U.S. coun­try code.

    ...

    Then there’s omi­nous hint for a senior Biden admin­is­tra­tion offi­ciaL the US gov­ern­ment has seen “sys­temic abuse” in mul­ti­ple coun­tries involv­ing Pega­sus:

    ...
    A senior Biden admin­is­tra­tion offi­cial, speak­ing on con­di­tion he not be iden­ti­fied, said the threat to U.S. per­son­nel abroad was one of the rea­sons the admin­is­tra­tion was crack­ing down on com­pa­nies such as NSO and pur­su­ing new glob­al dis­cus­sion about spy­ing lim­its.

    The offi­cial added that the gov­ern­ment has seen “sys­temic abuse” in mul­ti­ple coun­tries involv­ing NSO’s Pega­sus spy­ware.
    ...

    Are we going to be get­ting more details on those sys­temic abus­es? It’s quite rev­e­la­tion for a gov­ern­ment offi­cial to just dump out there in the wake of this sto­ry.

    Posted by Pterrafractyl | December 5, 2021, 9:08 pm

  19. So how many NSO Group clients aren’t abus­ing the com­pa­ny’s spy­ware. It’s the ques­tion raised with each new sto­ry of dis­cov­ered abus­es. This time the cul­prit appears to be Poland’s far right gov­ern­ment. We don’t have offi­cial con­fir­ma­tion that the Pol­ish gov­ern­ment was behind the ques­tion­able hacks, but it’s more or less obvi­ous­ly the case. The two oppo­si­tion fig­ures recent­ly dis­cov­ered with Pega­sus spy­ware on their iPhones — lawyer Roman Gier­tych and pros­e­cu­tor Ewa Wrzosek — were both rather big pests for the cur­rent gov­ern­ment.

    Gier­tych was appar­ent­ly such a big pest that he was hacked 18 times in the last four months of 2019. At the time, he was rep­re­sent­ing for­mer Prime Min­is­ter Don­ald Tusk of Civic Plat­form, now head of the largest oppo­si­tion par­ty, and for­mer For­eign Min­is­ter Radek Siko­rs­ki, now a Euro­pean Par­lia­ment mem­ber.

    Last year, Ewa Wrzosek ordered an inves­ti­ga­tion into whether pres­i­den­tial elec­tions should be post­poned over pan­dem­ic con­cerns, but was almost imme­di­ate­ly stripped of the case and trans­ferred to a dis­tant provin­cial city. We’ve now learned that Wrzosek was hacked mul­ti­ple times in 2019.

    So it appears the gov­ern­ment of Poland has some explain­ing to do, along with NSO Group, of course. And that brings us to what is per­haps the most dis­turb­ing aspect of this sto­ry: when pressed about these lat­est sto­ries of Pega­sus being used for ques­tion­able pur­pos­es, NSO Group points out that Poland is a demo­c­ra­t­ic gov­ern­ment, so as long as these hacks fol­lowed due process under Poland’s law, this does­n’t actu­al­ly con­sti­tute an abuse of these jack­ing tools. It’s the kind of answer from NSO Group that sug­gests there’s prob­a­bly A LOT more exam­ples of this kind of ‘legal’ tar­get­ing of oppo­si­tion fig­ures tak­ing place in the the NSO Group client states across the world:

    Asso­ciate Press

    AP Exclu­sive: Pol­ish oppo­si­tion duo hacked with NSO spy­ware

    By FRANK BAJAK and VANESSA GERA
    Tues­day Decem­ber 21, 2021 00:34:26 GMT-600 (Cen­tral Stan­dard Time)

    WARSAW, Poland (AP) — The aggres­sive cell­phone break-ins of a high-pro­file lawyer rep­re­sent­ing top Pol­ish oppo­si­tion fig­ures came in the final weeks of piv­otal 2019 par­lia­men­tary elec­tions. Two years lat­er, a pros­e­cu­tor chal­leng­ing attempts by the pop­ulist right-wing gov­ern­ment to purge the judi­cia­ry had her smart­phone hacked.

    In both instances, the invad­er was mil­i­tary-grade spy­ware from NSO Group, the Israeli hack-for-hire out­fit that the U.S. gov­ern­ment recent­ly black­list­ed, say dig­i­tal sleuths of the Uni­ver­si­ty of Toron­to-based Cit­i­zen Lab inter­net watch­dog.

    Cit­i­zen Lab could not say who ordered the hacks and NSO does not iden­ti­fy its clients, beyond say­ing it works only with legit­i­mate gov­ern­ment agen­cies vet­ted by Israel’s Defense Min­istry. But both vic­tims believe Poland’s increas­ing­ly illib­er­al gov­ern­ment is respon­si­ble.

    A Pol­ish state secu­ri­ty spokesman, Stanis­law Zaryn, would nei­ther con­firm nor deny whether the gov­ern­ment ordered the hacks or is an NSO cus­tomer.

    Lawyer Roman Gier­tych and pros­e­cu­tor Ewa Wrzosek join a list of gov­ern­ment crit­ics world­wide whose phones have been hacked using the company’s Pega­sus prod­uct. The spy­ware turns a phone into an eaves­drop­ping device and lets its oper­a­tors remote­ly siphon off every­thing from mes­sages to con­tacts. Con­firmed vic­tims have includ­ed Mex­i­can and Sau­di jour­nal­ists, British attor­neys, Pales­tin­ian human rights activists, heads of state and Ugan­da-based U.S. diplo­mats..

    But word of the Poland hack­ing is espe­cial­ly notable, com­ing as rights groups are demand­ing an EU-wide ban on the spy­ware. The 27-nation Euro­pean Union has tight­ened export restric­tions on spy­ware, but crit­ics com­plain that abuse of it by EU mem­ber states urgent­ly needs to be addressed.

    Cit­i­zen Lab pre­vi­ous­ly detect­ed mul­ti­ple infec­tions in Poland dat­ing from Novem­ber 2017, though it didn’t iden­ti­fy indi­vid­ual vic­tims then. The Pega­sus spy­ware has also been linked to Hun­gary, which like Poland has been denounced for anti-demo­c­ra­t­ic abus­es. Ger­many and Spain are report­ed­ly among NSO’s cus­tomers, with Cata­lan sep­a­ratists accus­ing Madrid of tar­get­ing them with Pega­sus.

    ...

    The Pol­ish tar­gets see the hack as evi­dence of a per­ilous ero­sion of democ­ra­cy in the very nation where Sovi­et hege­mo­ny began unrav­el­ing four decades ago.

    Just hours before Zaryn answered emailed ques­tions about the hack from The Asso­ci­at­ed Press, a provin­cial pros­e­cu­tor filed a motion seek­ing the arrest of Gier­tych, the lawyer, in a finan­cial crimes inves­ti­ga­tion.

    Zaryn did not com­ment on whether the two mat­ters might be relat­ed. He said Poland con­ducts sur­veil­lance only after obtain­ing court orders.

    “Sug­ges­tions that Pol­ish ser­vices use oper­a­tional meth­ods for polit­i­cal strug­gle are unjus­ti­fied,” Zaryn said.

    An NSO spokesper­son said Mon­day that the com­pa­ny is a “soft­ware provider, the com­pa­ny does not oper­ate the tech­nol­o­gy nor is the com­pa­ny privy to who the tar­gets are and to the data col­lect­ed by the cus­tomers.” Cit­i­zen Lab and Amnesty Inter­na­tion­al researchers say, how­ev­er, that NSO appears to main­tain the infec­tion infra­struc­ture.

    The com­pa­ny spokesper­son also called the alle­ga­tions of Pol­ish mis­use of Pega­sus unclear: “Once a demo­c­ra­t­ic coun­try law­ful­ly, fol­low­ing due process, uses tools to inves­ti­gate a per­son sus­pect­ed in com­mit­ting a crime, this would not be con­sid­ered a mis­use of such tools by any means.”

    In July an inves­ti­ga­tion by a glob­al media con­sor­tium found Pega­sus was used in Hun­gary to hack at least 10 lawyers, an oppo­si­tion politi­cian and sev­er­al jour­nal­ists. Last month, a Hun­gar­i­an gov­ern­ing par­ty offi­cial acknowl­edged that the gov­ern­ment had pur­chased Pega­sus licens­es..

    In 2019, inde­pen­dent Pol­ish broad­cast­er TVN found evi­dence the gov­ern­ment anti-cor­rup­tion agency spent more than $8 mil­lion on phone spy­ware. The agency denied the report but Prime Min­is­ter Mateusz Moraw­iec­ki was more ambigu­ous, say­ing all would “be clar­i­fied in due time.”

    In the last four months of 2019, Gier­tych was hacked at least 18 times, Cit­i­zen Lab found. At the time, he was rep­re­sent­ing for­mer Prime Min­is­ter Don­ald Tusk of Civic Plat­form, now head of the largest oppo­si­tion par­ty, and for­mer For­eign Min­is­ter Radek Siko­rs­ki, now a Euro­pean Par­lia­ment mem­ber.

    The “jaw-drop­ping­ly aggres­sive” tem­po and inten­si­ty of the tar­get­ing — day-by-day, even hour-by-hour — sug­gest­ed “a des­per­ate desire to mon­i­tor his com­mu­ni­ca­tions,” Scott-Rail­ton said. It was so unre­lent­ing that the iPhone became use­less and Gier­tych aban­doned it.

    “This phone was with me in my bed­room and it was with me when I went to con­fes­sion. They scanned my life total­ly,” he said.

    Most of the hacks occurred just ahead of an Oct. 13, 2019, par­lia­men­tary elec­tion that the Law and Jus­tice par­ty of Jaroslaw Kaczyn­s­ki won by a slim mar­gin, lead­ing to a fur­ther ero­sion of judi­cial inde­pen­dence and press free­dom.

    Gier­tych was also involved rep­re­sent­ing an Aus­tri­an devel­op­er at the time who claimed that Kaczyn­s­ki, Poland’s most pow­er­ful politi­cian, stiffed him as a deal to build twin busi­ness tow­ers in War­saw fell apart. Rev­e­la­tions of that deal-gone-sour trig­gered a scan­dal because Pol­ish law bans polit­i­cal par­ties from prof­it — and the tow­ers were to be built on land owned by Kaczynski’s par­ty.

    Gier­tych also rep­re­sent­ed Siko­rs­ki in an ille­gal wire­tap­ping case in which the for­mer for­eign minister’s con­ver­sa­tions were record­ed and pub­lished; Siko­rs­ki alleges the gov­ern­ment failed to inves­ti­gate the pos­si­ble involve­ment of Kaczyn­s­ki allies. Last year, anti-cor­rup­tion offi­cials searched Giertych’s home and office in a man­ner a Pol­ish court deemed ille­gal and the EU called emblem­at­ic of how Poland’s gov­ern­ment treats hos­tile lawyers in polit­i­cal­ly sen­si­tive cas­es.

    When the Lublin region­al pros­e­cu­tor applied for a court order Mon­day seek­ing Giertych’s arrest, it said the lawyer had refused to appear for ques­tion­ing, and seemed to be “delib­er­ate­ly hid­ing from jus­tice.”

    Gier­tych called this absurd and said the finan­cial wrong­do­ing inves­ti­ga­tion was trumped-up, that a Poz­nan court had already dis­missed it for lack of evi­dence. Pros­e­cu­tors say he is sus­pect­ed of mon­ey laun­der­ing for legal fees he received in a War­saw prop­er­ty dis­pute case a decade ago.

    Cit­i­zen Lab was still inves­ti­gat­ing how Giertych’s phone was infect­ed but said it expects a “zero-click” vul­ner­a­bil­i­ty, which wouldn’t involve user inter­ac­tion. They believe Wrzosek was sim­i­lar­ly hacked. Cit­i­zen Lab found six intru­sions on her phone from June 24-Aug. 19.

    Last year, Wrzosek ordered an inves­ti­ga­tion into whether pres­i­den­tial elec­tions should be post­poned over con­cerns they could threat­en the health of vot­ers and elec­tion work­ers. Almost imme­di­ate­ly, she was stripped of the case and trans­ferred to the dis­tant provin­cial city of Srem with two days’ notice.

    “I didn’t even know where the city was and I had nowhere to live there,” said Wrzosek, who was hacked short­ly after return­ing to War­saw and resum­ing media appear­ances crit­i­cal of the gov­ern­ment.

    A vocal mem­ber of an inde­pen­dent pros­e­cu­tors’ asso­ci­a­tion, Wrzosek learned she’d been hacked — and tweet­ed about it — when Apple sent out alerts last month to scores of iPhone users across the globe tar­get­ed by NSO’s Pega­sus, includ­ing 11 U.S. State Depart­ment employ­ees in Ugan­da. In a law­suit it filed the same day, Apple called NSO “amoral 21-cen­tu­ry mer­ce­nar­ies.” In 2019, Face­book sued the Israeli firm for alleged­ly hack­ing its glob­al­ly pop­u­lar What­sApp mes­sen­ger app.

    Wrzosek has filed an offi­cial com­plaint but doesn’t expect prompt account­abil­i­ty, believ­ing “the same ser­vices that tried to break into my phone will now be con­duct­ing the pro­ceed­ings, look­ing for per­pe­tra­tors.”

    ————

    “AP Exclu­sive: Pol­ish oppo­si­tion duo hacked with NSO spy­ware” by FRANK BAJAK and VANESSA GERA; Asso­ciate Press; 12/21/2021

    “A Pol­ish state secu­ri­ty spokesman, Stanis­law Zaryn, would nei­ther con­firm nor deny whether the gov­ern­ment ordered the hacks or is an NSO cus­tomer.”

    Yeah, it’s not exact­ly a mys­tery as to which gov­ern­ment ordered these hacks of indi­vid­u­als cre­at­ing major headaches for the Pol­ish gov­ern­ment. And the fact that a provin­cial pros­e­cu­tor filed a motion seek­ing the arrest of Roman Gier­tych hours before a Pol­ish state secu­ri­ty spokesman answered ques­tions to the AP is like in-your-face trolling of those con­cerned about these abus­es:

    ...
    Just hours before Zaryn answered emailed ques­tions about the hack from The Asso­ci­at­ed Press, a provin­cial pros­e­cu­tor filed a motion seek­ing the arrest of Gier­tych, the lawyer, in a finan­cial crimes inves­ti­ga­tion.

    Zaryn did not com­ment on whether the two mat­ters might be relat­ed. He said Poland con­ducts sur­veil­lance only after obtain­ing court orders.

    ...

    In 2019, inde­pen­dent Pol­ish broad­cast­er TVN found evi­dence the gov­ern­ment anti-cor­rup­tion agency spent more than $8 mil­lion on phone spy­ware. The agency denied the report but Prime Min­is­ter Mateusz Moraw­iec­ki was more ambigu­ous, say­ing all would “be clar­i­fied in due time.”

    ...

    In the last four months of 2019, Gier­tych was hacked at least 18 times, Cit­i­zen Lab found. At the time, he was rep­re­sent­ing for­mer Prime Min­is­ter Don­ald Tusk of Civic Plat­form, now head of the largest oppo­si­tion par­ty, and for­mer For­eign Min­is­ter Radek Siko­rs­ki, now a Euro­pean Par­lia­ment mem­ber.

    ...

    Most of the hacks occurred just ahead of an Oct. 13, 2019, par­lia­men­tary elec­tion that the Law and Jus­tice par­ty of Jaroslaw Kaczyn­s­ki won by a slim mar­gin, lead­ing to a fur­ther ero­sion of judi­cial inde­pen­dence and press free­dom.

    Gier­tych was also involved rep­re­sent­ing an Aus­tri­an devel­op­er at the time who claimed that Kaczyn­s­ki, Poland’s most pow­er­ful politi­cian, stiffed him as a deal to build twin busi­ness tow­ers in War­saw fell apart. Rev­e­la­tions of that deal-gone-sour trig­gered a scan­dal because Pol­ish law bans polit­i­cal par­ties from prof­it — and the tow­ers were to be built on land owned by Kaczynski’s par­ty.

    Gier­tych also rep­re­sent­ed Siko­rs­ki in an ille­gal wire­tap­ping case in which the for­mer for­eign minister’s con­ver­sa­tions were record­ed and pub­lished; Siko­rs­ki alleges the gov­ern­ment failed to inves­ti­gate the pos­si­ble involve­ment of Kaczyn­s­ki allies. Last year, anti-cor­rup­tion offi­cials searched Giertych’s home and office in a man­ner a Pol­ish court deemed ille­gal and the EU called emblem­at­ic of how Poland’s gov­ern­ment treats hos­tile lawyers in polit­i­cal­ly sen­si­tive cas­es.
    ...

    And note how the hack­ing of pros­e­cu­tor Ewa Wrzosek had already tak­en place mul­ti­ple times in 2019, well before Wrzosek had ordered a 2020 inves­ti­ga­tion into whether or not the pres­i­den­tial elec­tions should be post­poned. Short­ly after the open­ing of the inves­ti­ga­tion, Wrzosek was stripped of the case and reas­signed. It’s hard not to sus­pect the gov­ern­ment spies keep­ing tabs on her weren’t track­ing her moves in that inves­ti­ga­tion:

    ...
    Cit­i­zen Lab was still inves­ti­gat­ing how Giertych’s phone was infect­ed but said it expects a “zero-click” vul­ner­a­bil­i­ty, which wouldn’t involve user inter­ac­tion. They believe Wrzosek was sim­i­lar­ly hacked. Cit­i­zen Lab found six intru­sions on her phone from June 24-Aug. 19.

    Last year, Wrzosek ordered an inves­ti­ga­tion into whether pres­i­den­tial elec­tions should be post­poned over con­cerns they could threat­en the health of vot­ers and elec­tion work­ers. Almost imme­di­ate­ly, she was stripped of the case and trans­ferred to the dis­tant provin­cial city of Srem with two days’ notice.
    ...

    It’s also worth not­ing that it’s not entire­ly incon­ceiv­able that it tru­ly was­n’t the Pol­ish gov­ern­ment behind these hacks. After all, with fel­low auto­crat­ic gov­ern­ments in the EU like Hun­gary sport­ing the exact same Pega­sus spy­ware and demon­strat­ing the same will­ing­ness to abuse it, it’s pos­si­ble we could end up see­ing gov­ern­ments do each oth­er ‘favors’ by spy­ing on their respec­tive pesky cit­i­zens. Now, in the case of Gier­tych and Wrzosek it sure looks a lot like the Pol­ish gov­ern­ment was behind these hacks. But we should keep in mind there are oth­er pos­si­bil­i­ties:

    ...
    Cit­i­zen Lab pre­vi­ous­ly detect­ed mul­ti­ple infec­tions in Poland dat­ing from Novem­ber 2017, though it didn’t iden­ti­fy indi­vid­ual vic­tims then. The Pega­sus spy­ware has also been linked to Hun­gary, which like Poland has been denounced for anti-demo­c­ra­t­ic abus­es. Ger­many and Spain are report­ed­ly among NSO’s cus­tomers, with Cata­lan sep­a­ratists accus­ing Madrid of tar­get­ing them with Pega­sus.
    ...

    Final­ly, note the tru­ly dis­turb­ing response from NSO Group to these hack­ing sto­ries: first the com­pa­ny gives its stan­dard excuse about it’s only a soft­ware provider who does­n’t know who its clients tar­get. But then an NSO Group spokesper­son sug­gest­ed that, actu­al­ly, these hacks may have been per­fect­ly legal and fol­low­ing due process, and there­fore not con­sid­ered a mis­use of spy­ware. Think about that: as long as a demo­c­ra­t­ic gov­ern­ment client itself defines an inves­ti­ga­tion as hav­ing been law­ful, NSO Group is cool with it. In oth­er words, demo­c­ra­t­ic author­i­tar­i­an gov­ern­ments like those in Poland and Hun­gary basi­cal­ly get free reign to hack who­ev­er they want...as long as the hacks are processed through the cor­rupt judi­cial sys­tem:

    ...
    An NSO spokesper­son said Mon­day that the com­pa­ny is a “soft­ware provider, the com­pa­ny does not oper­ate the tech­nol­o­gy nor is the com­pa­ny privy to who the tar­gets are and to the data col­lect­ed by the cus­tomers.” Cit­i­zen Lab and Amnesty Inter­na­tion­al researchers say, how­ev­er, that NSO appears to main­tain the infec­tion infra­struc­ture.

    The com­pa­ny spokesper­son also called the alle­ga­tions of Pol­ish mis­use of Pega­sus unclear: “Once a demo­c­ra­t­ic coun­try law­ful­ly, fol­low­ing due process, uses tools to inves­ti­gate a per­son sus­pect­ed in com­mit­ting a crime, this would not be con­sid­ered a mis­use of such tools by any means.”
    ...

    So that’s one more NSO Group client shown to be abus­ing the Pega­sus spy­ware. But in this case, it does­n’t appear that Poland is actu­al­ly going be pun­ished at all because the hacks were poten­tial­ly done under the aus­pices of inves­ti­gat­ing crimes or cor­rup­tion. So if you’re an NSO Group client state with a pesky per­son in need of hack­ing but you don’t want to risk hav­ing your sub­scrip­tion cut off after the hacks are dis­cov­ered, be sure you accuse them with a crime war­rant­i­ng an inves­ti­ga­tion first, which will appar­ent­ly make it all OK.

    Posted by Pterrafractyl | December 21, 2021, 10:39 pm

  20. Here’s a recent NY Times piece on the US gov­ern­men­t’s rela­tion­ship with NSO Group that serves as a reminder that Pega­sus isn’t the only piece of super-spy­ware pro­duced by the com­pa­ny. It’s also a reminder that NSO Group isn’t the only com­pa­ny out there offer­ing these prod­ucts and the US firms have their own share of the super-spy­ware indus­try:

    It turns out the FBI has been secret­ly pur­chas­ing NSO Group soft­ware for years. With plans to use the spy­ware for domes­tic sur­veil­lance. Yep. On one lev­el this is an utter­ly unsur­pris­ing rev­e­la­tion. But on anoth­er lev­el, the sto­ry rais­es all sorts of fas­ci­nat­ing ques­tions regard­ing whether or not NSO Group’s spy­ware tru­ly was capa­ble of hack­ing US phones. Recall how the Pega­sus spy­ware had the capac­i­ty to hack phones with UK and Israeli phone num­bers despite all the assur­ances that the tar­get­ing of such phones was tech­ni­cal­ly impos­si­ble, rais­ing obvi­ous ques­tions about whether or not phones with “+1” US-based phone num­bers are also vul­ner­a­ble. And then we got that sto­ry about US embassy work­ers in Ugan­da hav­ing their phones hacked with Pega­sus, but in that case the num­bers for those phones were NOT +1 US-based num­bers. So whether or not the US gov­ern­ment and cor­po­ra­tions have been hacked by NSO Group clients around the world remains a mys­tery with this sto­ry. But a mys­tery that now includes the FBI seek­ing out NSO Group soft­ware for domes­tic uses.

    It’s also a sto­ry that adds addi­tion­al poten­tial dark con­text to Peter Thiel’s sud­den deci­sion to leave the board of Face­book. Because while there was no short­age of valid rea­sons for Thiel to leave that board, it was hard not to won­der if Thiel’s depar­ture was relat­ed to the recent NY Times report on Thiel-backed US-based spy­ware firm, Bold­end, devel­op­ing hacks for Face­book-owned What­sApp. Espe­cial­ly in the wake of the Biden admin­is­tra­tion’s black­list­ing of NSO Group fol­low­ing the Ugan­da embassy hack. Firms like Bold­end could be posi­tioned for a lot more US gov­ern­ment con­tracts. Con­tracts that pre­sum­ably involve domes­tic sur­veil­lance. Is Peter Thiel’s deep­en­ing invest­ments in the domes­tic spy­ing and sur­veil­lance sec­tor part of the rea­son he left Face­book’s board? Again, it’s hard not to won­der. But as we’ll see in that NY Times report below, the Bold­end hack was a zero-click attack, like Pega­sus, where the vic­tim does­n’t even need to click on a link to become infect­ed. That’s a cut­ting-edge hack. Thiel is now an investor in cut­ting-edge offen­sive hack­ing tech­nol­o­gy.

    But per­haps what we should be won­der­ing about the most fol­low­ing this NY Times piece is whether or not the new NSO Group super-spy­ware tools is on the mar­ket yet? Along with won­der­ing about who exact­ly got the priv­i­leges of pur­chas­ing this next-gen­er­a­tion tool? Because it turns out this new NSO Group tool, “Phan­tom”, is very much able to hack phones with US num­bers. And, yes, the FBI was very inter­est­ed in Phan­tom, report­ed­ly spend­ing two years try­ing to decide whether or not to deploy it:

    The New York Times

    F.B.I. Secret­ly Bought Israeli Spy­ware and Explored Hack­ing U.S. Phones

    Israel used the NSO Group’s soft­ware as a tool of diplo­ma­cy. The F.B.I. want­ed it for domes­tic sur­veil­lance. Then every­thing soured. Here are high­lights of a New York Times Mag­a­zine inves­ti­ga­tion.

    By Michael Lev­en­son
    Jan. 28, 2022

    It is wide­ly regard­ed as the world’s most potent spy­ware, capa­ble of reli­ably crack­ing the encrypt­ed com­mu­ni­ca­tions of iPhone and Android smart­phones.

    The soft­ware, Pega­sus, made by an Israeli com­pa­ny, NSO Group, has been able to track ter­ror­ists and drug car­tels. It has also been used against human rights activists, jour­nal­ists and dis­si­dents.

    Now, an inves­ti­ga­tion pub­lished Fri­day by The New York Times Mag­a­zine has found that Israel, which con­trols the export of the spy­ware, just as it does the export of con­ven­tion­al weapons, has made Pega­sus a key com­po­nent of its nation­al secu­ri­ty strat­e­gy, using it to advance its inter­ests around the world.

    The year­long inves­ti­ga­tion, by Ronen Bergman and Mark Mazzetti, also reports that the F.B.I. bought and test­ed NSO soft­ware for years with plans to use it for domes­tic sur­veil­lance until the agency final­ly decid­ed last year not to deploy the tools.

    The Times found that sales of Pega­sus played a crit­i­cal role in secur­ing the sup­port of Arab nations in Israel’s cam­paign against Iran and nego­ti­at­ing the Abra­ham Accords, the 2020 diplo­mat­ic agree­ments, signed at a Trump White House cer­e­mo­ny, that nor­mal­ized rela­tions between Israel and some of its long­time Arab adver­saries.

    The U.S. sought the cyber­weapon for domes­tic use.

    The U.S. had also moved to acquire Pega­sus, The Times found. The F.B.I., in a deal nev­er pre­vi­ous­ly report­ed, bought the spy­ware in 2019, despite mul­ti­ple reports that it had been used against activists and polit­i­cal oppo­nents in oth­er coun­tries. It also spent two years dis­cussing whether to deploy a new­er prod­uct, called Phan­tom, inside the Unit­ed States.

    The dis­cus­sions at the Jus­tice Depart­ment and the F.B.I. con­tin­ued until last sum­mer, when the F.B.I. ulti­mate­ly decid­ed not to use NSO weapons.

    But Pega­sus equip­ment is still in a New Jer­sey build­ing used by the F.B.I. And the com­pa­ny also gave the agency a demon­stra­tion of Phan­tom, which could hack Amer­i­can phone num­bers.

    A brochure for poten­tial cus­tomers, obtained by The Times, says that Phan­tom allows Amer­i­can law enforce­ment and spy agen­cies to “turn your target’s smart­phone into an intel­li­gence gold mine.”

    ...

    Mex­i­co used the spy­ware to tar­get jour­nal­ists and dis­si­dents. Sau­di Ara­bia used it against women’s rights activists and asso­ciates of Jamal Khashog­gi, the Wash­ing­ton Post colum­nist who was killed and dis­mem­bered by Sau­di oper­a­tives in 2018.

    That year, the C.I.A. bought Pega­sus to help Dji­bouti, an Amer­i­can ally, fight ter­ror­ism, despite long­stand­ing con­cerns about human rights abus­es there, includ­ing the per­se­cu­tion of jour­nal­ists and the tor­ture of dis­si­dents.

    In the U.A.E., Pega­sus was used to hack the phone of an out­spo­ken crit­ic of the gov­ern­ment, Ahmed Man­soor.

    ...

    Through a series of new deals licensed by the Israeli Min­istry of Defense, Pega­sus has been pro­vid­ed to the far-right lead­ers of Poland, Hun­gary, India and oth­er coun­tries.

    Mr. Netanyahu did not order the Pega­sus sys­tem to be cut off, even when the Pol­ish gov­ern­ment enact­ed laws that many Jews inside and out­side of Israel saw as Holo­caust denial, or when Prime Min­is­ter Mateusz Moraw­iec­ki, at a con­fer­ence attend­ed by Mr. Netanyahu him­self, false­ly list­ed “Jew­ish per­pe­tra­tors” among those respon­si­ble for the Holo­caust.

    The black­list­ing of NSO infu­ri­at­ed Israeli offi­cials.

    Amer­i­can com­pa­nies have been try­ing to build their own tools that could hack phones with the ease of NSO’s “zero click” tech­nol­o­gy.

    One of those com­pa­nies, Bold­end, told Raytheon, the defense-indus­try giant, in Jan­u­ary 2021, that it could hack What­sApp, the pop­u­lar mes­sag­ing ser­vice owned by Face­book, but then lost the capa­bil­i­ty after a What­sApp update, accord­ing to a pre­sen­ta­tion obtained by The Times.

    The claim was espe­cial­ly notable because, accord­ing to one of the slides, a major Bold­end investor is Founders Fund — a com­pa­ny run by Peter Thiel, the bil­lion­aire who was one of Facebook’s first investors and remains on its board.

    The recent Amer­i­can black­list­ing of NSO could suf­fo­cate the com­pa­ny by deny­ing it access to the Amer­i­can tech­nol­o­gy it needs to run its oper­a­tions, includ­ing Dell com­put­ers and Ama­zon cloud servers.

    The rebuke has infu­ri­at­ed Israeli offi­cials who have denounced the move as an attack not only on a crown jew­el of the country’s defense indus­try but on the coun­try itself.

    “The peo­ple aim­ing their arrows against NSO,” said Yigal Unna, direc­tor gen­er­al of the Israel Nation­al Cyber Direc­torate until Jan. 5, “are actu­al­ly aim­ing at the blue and white flag hang­ing behind it.”

    ———–

    “F.B.I. Secret­ly Bought Israeli Spy­ware and Explored Hack­ing U.S. Phones” by Michael Lev­en­son; The New York Times; 01/28/2022

    “The year­long inves­ti­ga­tion, by Ronen Bergman and Mark Mazzetti, also reports that the F.B.I. bought and test­ed NSO soft­ware for years with plans to use it for domes­tic sur­veil­lance until the agency final­ly decid­ed last year not to deploy the tools.”

    The FBI bought and test­ed NSO Group tools for years. With domes­tic sur­veil­lance plans. Now, it’s worth keep­ing in mind that it’s pos­si­ble at least some of the FBI’s intend­ed usage was to hack non-US num­ber phones of peo­ple who hap­pened to be in the US. But there’s still the big ques­tion about whether or not the FBI was plan­ning on using NSO Group tools for hack­ing phones with US num­bers. So when we learn the FBI spent two years debat­ing whether or not to deploy Phan­tom, it’s hard to not assume the FBI was inter­est­ed in hack­ing phones with US num­bers:

    ...
    The U.S. had also moved to acquire Pega­sus, The Times found. The F.B.I., in a deal nev­er pre­vi­ous­ly report­ed, bought the spy­ware in 2019, despite mul­ti­ple reports that it had been used against activists and polit­i­cal oppo­nents in oth­er coun­tries. It also spent two years dis­cussing whether to deploy a new­er prod­uct, called Phan­tom, inside the Unit­ed States.

    The dis­cus­sions at the Jus­tice Depart­ment and the F.B.I. con­tin­ued until last sum­mer, when the F.B.I. ulti­mate­ly decid­ed not to use NSO weapons.

    But Pega­sus equip­ment is still in a New Jer­sey build­ing used by the F.B.I. And the com­pa­ny also gave the agency a demon­stra­tion of Phan­tom, which could hack Amer­i­can phone num­bers.

    A brochure for poten­tial cus­tomers, obtained by The Times, says that Phan­tom allows Amer­i­can law enforce­ment and spy agen­cies to “turn your target’s smart­phone into an intel­li­gence gold mine.”
    ...

    And yet, as omi­nous as it is to read about Phan­tom, it’s prob­a­bly not Phan­tom you need to wor­ry about the most giv­en the uncer­tain­ty of NSO Group’s future. Peter Thiel’s Bold­end is poised to fill the space a col­laps­ing NSO Group cre­ates. Bold­end should have plen­ty of access to cash and is back by an indi­vid­ual who just might have deep­er con­nec­tions into the pri­va­tized US nation­al secu­ri­ty state than any­one else on the plan­et. Watch out out for the Bold­end zero-clicks. They’re com­ing:

    ...
    Amer­i­can com­pa­nies have been try­ing to build their own tools that could hack phones with the ease of NSO’s “zero click” tech­nol­o­gy.

    One of those com­pa­nies, Bold­end, told Raytheon, the defense-indus­try giant, in Jan­u­ary 2021, that it could hack What­sApp, the pop­u­lar mes­sag­ing ser­vice owned by Face­book, but then lost the capa­bil­i­ty after a What­sApp update, accord­ing to a pre­sen­ta­tion obtained by The Times.

    The claim was espe­cial­ly notable because, accord­ing to one of the slides, a major Bold­end investor is Founders Fund — a com­pa­ny run by Peter Thiel, the bil­lion­aire who was one of Facebook’s first investors and remains on its board.
    ...

    Will it be the FBI who zero-click hacks you with the next Bold­end inno­va­tion? Some oth­er US gov­ern­ment agency? Any oth­er gov­ern­ments? Pri­vate enti­ties? Thiel’s per­son­al dirty tricks squad? We’ll find out. Although prob­a­bly not actu­al­ly, but it will hap­pen whether you find out or not. And the man who could arguably be called the most dan­ger­ous man alive today, Peter Thiel, is get­ting a lot more dan­ger­ous in the process. Thiel’s in the cus­tom cut­ting-edge offen­sive spy­ing indus­try. For when all the oth­er spy­ing com­pa­nies he’s been run­ning — Face­book, Palan­tir, Clearview — Thiel has always had exten­sive spy­ing options read­i­ly avail­able.

    It’s a grim reminder that, while the NSO Group is obvi­ous­ly a com­pa­ny that has engaged in some pret­ty scan­dalous behav­ior over the past decade with all the egre­gious client states its tak­en on, it’s not as if a Peter Thiel-owned super hack­ing firm isn’t a wild­ly scan­dalous enti­ty on its own. A scan­dal that grows with every addi­tion­al Thiel-owned com­pa­ny giv­en a US gov­ern­ment con­tract to devel­op new tools for con­duct­ing high­ly sen­si­tive secret work. The US gov­ern­ment is pay­ing one of the world’s lead­ing supervil­lains to build his own pri­vate nation­al secu­ri­ty empire. He’s been oper­at­ing a pri­vate CIA-NSA hybrid empire for years. And now Thiel’s pri­vate spy­ing empire has a its own TAO hack­ing team, paid for with clients like the FBI. That’s pret­ty scan­dalous too.

    Posted by Pterrafractyl | February 14, 2022, 9:37 pm

  21. Here’s a pair of arti­cles under­scor­ing the grow­ing risks of the war in Ukraine trig­ger­ing a major cyber event:

    First, here’s a report from sev­er­al weeks ago about warn­ings from the cyber­secruity com­mu­ni­ty that Rus­sia may use Solar­Winds-like hacks as part of the con­flict in Ukraine. In one sense, the warn­ings are exact­ly what we should expect ema­nat­ing from the cyber­se­cu­ri­ty com­mu­ni­ty dur­ing a peri­od of enhanced ten­sion between Rus­sia and the West. But the warn­ings are also an acknowl­edge­ment that, as we’ve seen, who­ev­er car­ried out the Solar­Winds hack like­ly main­tained access to the attacked net­works. The ‘back­doors’ are in place and ready for future exploita­tion.

    Now, as we’ve also seen, the evi­dence that the Solar­Winds hack was a Russ­ian gov­ern­ment oper­a­tion is quite lim­it­ed. In oth­er words, we don’t real­ly know who it was who exe­cut­ed that dev­as­tat­ing hack and poten­tial­ly main­tains access to the com­put­er net­works of thou­sands of com­pa­nies around world. But it’s wide­ly assumed to be Rus­sia who did it, which means if we see a repeat of the Solar­Winds hack it’s going to be blamed on Rus­sia. And if some par­ty wants to see the war in Ukraine expand beyond Ukraine, some sort of dev­as­tat­ing cyber attack blamed on Rus­sia would be a great way to do it:

    Ven­ture­Beat

    Rus­sia may use Solar­Winds-like hacks in cyber­war over Ukraine

    Kyle Alspach
    Feb­ru­ary 27, 2022 11:39 AM

    Stiff sanc­tions against Rus­sia and Vladimir Putin over Ukraine means a wave of cyber­at­tacks may be head­ed for the U.S. and oth­er west­ern nations as retal­i­a­tion, cyber experts say, as part of what could become an esca­lat­ing “cyber­war.”

    Secu­ri­ty teams, of course, are per­pet­u­al­ly on guard for Russ­ian attacks — but the threat this time could be espe­cial­ly dif­fi­cult to see com­ing, experts told Ven­ture­Beat.

    That’s because Rus­sia is believed to have been sav­ing up some of its best options for a moment like this one. Russ­ian threat actors are wide­ly believed to have gained footholds into cor­po­rate and gov­ern­ment sys­tems — via Solar­Winds-like soft­ware sup­ply chain breach­es, the Log4j vul­ner­a­bil­i­ty, or even the Solar­Winds hack itself — which just haven’t come to light yet.

    But they might soon. Cyber experts are warn­ing of an increased risk of cyber­at­tacks from Rus­sia, fol­low­ing sanc­tions that boot­ed major Russ­ian banks from the SWIFT finan­cial sys­tem. The move essen­tial­ly pre­vents the Russ­ian banks from car­ry­ing out inter­na­tion­al trans­ac­tions, and fol­lowed oth­er rounds of sanc­tions over Russia’s inva­sion of Ukraine, includ­ing some that’ve hit Putin him­self.

    Breach­ing sup­ply chains

    The SWIFT sanc­tions had pre­vi­ous­ly been described as the “nuclear option,” and are exact­ly the sort of thing that Putin had vowed to retal­i­ate against. And cyber­at­tacks are his pre­ferred method for hit­ting back against the west.

    In assess­ing the size and scope of Russia’s mil­i­tary cam­paign in Ukraine, “this attack has been in the plan­ning for years,” said Eric Byres, CTO of cyber firm aDo­lus Tech­nol­o­gy. “Efforts to pre­pare their cyber cam­paign will have matched the efforts on the ground, so you know that Rus­sia will have cyber­at­tack resources that match their mil­i­tary ones.”

    Russ­ian threat actors — whether in gov­ern­ment agen­cies such as the GRU and SVR, or in sym­pa­thet­ic groups such as Con­ti — have almost cer­tain­ly com­pro­mised soft­ware sup­ply chains that we don’t know about yet, accord­ing to cyber experts. And in any cyber­war maneu­vers tar­get­ing the west, they might opt to uti­lize this access.

    ...

    Notably, how­ev­er, Solar­Winds was not the first major soft­ware sup­ply chain attack attrib­uted to Rus­sia, or even the most dam­ag­ing.

    The 2017 Not­Petya attack is believed to have orig­i­nat­ed through a com­pro­mise of an account­ing appli­ca­tion, MeDoc, which was made by a Ukrain­ian com­pa­ny and wide­ly used in the coun­try. The mal­ware deliv­ered through updat­ing to the com­pro­mised soft­ware end­ed up spread­ing world­wide. And it remains the costli­est cyber­at­tack to date, with dam­ages of $10 bil­lion.

    Oth­er high-pro­file sup­ply chain breach­es have includ­ed Kaseya and Code­Cov — and accord­ing to data from Aqua Secu­ri­ty, soft­ware sup­ply chain attacks surged by more than 300% over­all in 2021.

    Unknown breach­es

    Russ­ian threat actors have like­ly car­ried out many such breach­es that remain unknown, for now. “Sup­ply chain pen­e­tra­tions don’t show up on satel­lite pho­tos like tanks do, so we don’t real­ly know where the Russ­ian cyber implants are lurk­ing,” Byres said.

    In the wake of Russia’s unpro­voked attack on Ukraine, the coun­try has most like­ly been hold­ing off on using its attack capa­bil­i­ty in the U.S. to see how hard the west would hit back with sanc­tions and sup­port for Ukraine, Byres said.

    Researchers at Cis­co Talos have sim­i­lar­ly been warn­ing about the height­ened risk of Russ­ian attacks orig­i­nat­ing in the soft­ware sup­ply chain in con­nec­tion with Russia’s aggres­sions in Ukraine.

    “We assess that these actors would like­ly abuse ele­ments of com­plex sys­tems to achieve their objec­tives on tar­get­ed envi­ron­ments,” Talos researchers wrote in a blog post. “Past exam­ples of this include the use of Ukrain­ian tax soft­ware to dis­trib­ute Not­Petya mal­ware in 2017 and, more recent­ly, the abuse of Solar­Winds to gain access to high-pri­or­i­ty tar­gets.”

    In all like­li­hood, the Russ­ian threat actors behind the Solar­Winds attack still have access from the breach in many com­pa­nies that has so far gone unused, experts say.

    Priv­i­leged access

    The Solar­Winds attack was “unique in that the threat actor tar­get­ed and gained per­sis­tent, inva­sive access to select orga­ni­za­tions’ enter­prise net­works, their fed­er­at­ed iden­ti­ty solu­tions, and their Active Direc­to­ry and Microsoft 365 envi­ron­ments,” said James Tur­gal, a for­mer 22-year vet­er­an of the FBI, and now a vice pres­i­dent at cyber­se­cu­ri­ty con­sult­ing firm Optiv. “The actor used that priv­i­leged access to col­lect and exfil­trate sen­si­tive data and cre­at­ed back­doors to enable their return.”

    Tur­gal, whose time at the FBI includ­ed serv­ing as exec­u­tive assis­tant direc­tor for the Infor­ma­tion and Tech­nol­o­gy Branch, said the risk is from the threat actor’s “deep pen­e­tra­tion into the com­pro­mised net­works.”

    “Unless each and every serv­er, dri­ve or com­pro­mised device was replaced or re-base­lined, the prob­a­bil­i­ty of com­plete evic­tion of the mali­cious code would be low, due to the high cost and com­plex­i­ty of such a reme­di­a­tion,” he said. “Absent com­plete replace­ment or re-base­line reme­di­a­tion actions, those vic­tims’ enter­prise net­works and cloud envi­ron­ments will be exposed to sub­stan­tial risk for repeat and long-term unde­tect­ed Russ­ian threat actor activ­i­ty, and those com­pro­mised orga­ni­za­tions could be re-vic­tim­ized when the threat actor desires to do so.”

    Ulti­mate­ly — with Solar­Winds, and even Not­Petya — “there may be vic­tims that have been com­pro­mised by those attacks, and they just don’t know it yet,” Tur­gal said.

    Byres agreed, say­ing he’s “cer­tain” Rus­sia has access to vic­tims of the Solar­Winds cam­paign that we aren’t aware of yet.

    “Back in Feb­ru­ary 2021, I lis­tened to a brief­ing by a G7 secu­ri­ty agency where the direc­tor com­ment­ed that crit­i­cal infra­struc­ture com­pa­nies were still report­ing to the agency that they had just dis­cov­ered com­pro­mised Solar­Winds soft­ware in their sys­tems. This was three months after the mal­ware was uncov­ered,” Byres said. “Three months is a life­time in the cyber world and the Rus­sians would have had more than enough time to hide deep inside a sys­tem and cov­er their tracks.”

    Today, Reuters report­ed that U.S. banks are mak­ing prepa­ra­tions for poten­tial cyber­at­tacks in retal­i­a­tion for sanc­tions on Rus­sia such as SWIFT. The report specif­i­cal­ly men­tions that for banks, the Solar­Winds breach “is top of mind.”

    And Solar­Winds is “just one cam­paign that we know about,” Byres said.

    Log4j

    For instance, the Apache Log4j vul­ner­a­bil­i­ty uncov­ered in Decem­ber “was a Christ­mas gift to the Rus­sians,” he said. “The vul­ner­a­ble soft­ware is wide­spread, and the exploit was easy and pow­er­ful.”

    Russ­ian agen­cies almost cer­tain­ly used the vul­ner­a­bil­i­ty, which is believed to have appeared in log­ging soft­ware used by prac­ti­cal­ly every com­pa­ny, to gain footholds into crit­i­cal sys­tems in the U.S. that they haven’t lever­aged yet, Byres said. (Researchers have not­ed that major attacks uti­liz­ing Log4j have been low­er than expect­ed so far.)

    In the cur­rent threat sit­u­a­tion over­all, West­ern com­pa­nies that have com­mer­cial con­nec­tions to Ukraine are at an espe­cial­ly high risk, accord­ing to Byres.

    For instance, Maer­sk report­ed it lost as much as $300 mil­lion in the Not­Petya attack. While the ship­ping firm is based in Den­mark, it report­ed­ly used the MeDoc account­ing soft­ware — “which implied they had busi­ness deal­ings with Ukraine, a fact that was unpop­u­lar in Moscow,” Byres said.

    And notably, while Not­Petya did coin­cide with a Rus­sia-backed sep­a­ratist move­ment in Ukraine, “there wasn’t a full-blown war occur­ring,” he said. “So any­one in the west deal­ing with Ukrain­ian busi­ness­es today is fac­ing a much big­ger risk than Maer­sk did in 2017.”

    Fight­ing fires

    That being said, Rus­sia will like­ly be look­ing to bring cyber­war­fare against com­pa­nies that don’t direct­ly deal with Ukraine as well, Byres said. Putin has made it clear that the entire west­ern world is his ene­my and all options are on the table, he said.

    “Any coun­try and its infra­struc­ture is fair game for a cyber­at­tack” if Putin per­ceives it is inter­fer­ing with his goals, Byres said.

    If the Rus­sians had man­aged to sub­due all of Ukraine in just a few days, they prob­a­bly would’ve kept cyber weapons in the U.S. infra­struc­ture under wraps for a rainy day in the future, he not­ed. But after the sanc­tions of recent days and stiffer resis­tance from Ukraine’s forces than expect­ed, that cal­cu­lus may have changed.

    For cyber defend­ers in the west, “our job is to uncov­er these attacks quick­ly and put them out before they spread and do seri­ous dam­age,” Byres said. “It is a lot like fight­ing for­est fires – the effec­tive response is to spot lit­tle fires quick­ly and extin­guish them before they become big fires.”

    That can only hap­pen when you have vis­i­bil­i­ty of “both the over­all for­est and the trees with­in that for­est,” he said. “Gov­ern­ments and com­pa­ny man­age­ment need to be able to see the for­est and the trees in our soft­ware sup­ply chain.”

    ———–

    “Rus­sia may use Solar­Winds-like hacks in cyber­war over Ukraine” by Kyle Alspach; Ven­ture­Beat; 02/27/2022

    “Russ­ian threat actors — whether in gov­ern­ment agen­cies such as the GRU and SVR, or in sym­pa­thet­ic groups such as Con­ti — have almost cer­tain­ly com­pro­mised soft­ware sup­ply chains that we don’t know about yet, accord­ing to cyber experts. And in any cyber­war maneu­vers tar­get­ing the west, they might opt to uti­lize this access.”

    It’s not a base­less warn­ing. Rus­sia real­ly prob­a­bly could exe­cute a Solar­Winds-style hack that tar­gets the com­put­er net­works of thou­sands of gov­ern­ment agen­cies and com­pa­nies across the West if it chose to do so. The prob­lem is that this abil­i­ty isn’t lim­it­ed to Rus­sia while we’re still oper­at­ing under a cyber­se­cu­ri­ty par­a­digm that views the ‘unusu­al sus­pects’ — Russ­ian, Chi­na, North Korea and Iran — as basi­cal­ly the cul­prits behind all major cyber­at­tacks. It’s that refusal to rec­og­nize the broad­er array of poten­tial cul­prits that makes this such a dan­ger­ous sit­u­a­tion. Because right now, if some groups wants to exec­u­tive a Solar­Winds-style mega-hack, they can do so with the near guar­an­tee that it would be blamed on Rus­sia:

    ...
    The Solar­Winds attack was “unique in that the threat actor tar­get­ed and gained per­sis­tent, inva­sive access to select orga­ni­za­tions’ enter­prise net­works, their fed­er­at­ed iden­ti­ty solu­tions, and their Active Direc­to­ry and Microsoft 365 envi­ron­ments,” said James Tur­gal, a for­mer 22-year vet­er­an of the FBI, and now a vice pres­i­dent at cyber­se­cu­ri­ty con­sult­ing firm Optiv. “The actor used that priv­i­leged access to col­lect and exfil­trate sen­si­tive data and cre­at­ed back­doors to enable their return.”

    Tur­gal, whose time at the FBI includ­ed serv­ing as exec­u­tive assis­tant direc­tor for the Infor­ma­tion and Tech­nol­o­gy Branch, said the risk is from the threat actor’s “deep pen­e­tra­tion into the com­pro­mised net­works.”

    “Unless each and every serv­er, dri­ve or com­pro­mised device was replaced or re-base­lined, the prob­a­bil­i­ty of com­plete evic­tion of the mali­cious code would be low, due to the high cost and com­plex­i­ty of such a reme­di­a­tion,” he said. “Absent com­plete replace­ment or re-base­line reme­di­a­tion actions, those vic­tims’ enter­prise net­works and cloud envi­ron­ments will be exposed to sub­stan­tial risk for repeat and long-term unde­tect­ed Russ­ian threat actor activ­i­ty, and those com­pro­mised orga­ni­za­tions could be re-vic­tim­ized when the threat actor desires to do so.”

    Ulti­mate­ly — with Solar­Winds, and even Not­Petya — “there may be vic­tims that have been com­pro­mised by those attacks, and they just don’t know it yet,” Tur­gal said.

    Byres agreed, say­ing he’s “cer­tain” Rus­sia has access to vic­tims of the Solar­Winds cam­paign that we aren’t aware of yet.

    “Back in Feb­ru­ary 2021, I lis­tened to a brief­ing by a G7 secu­ri­ty agency where the direc­tor com­ment­ed that crit­i­cal infra­struc­ture com­pa­nies were still report­ing to the agency that they had just dis­cov­ered com­pro­mised Solar­Winds soft­ware in their sys­tems. This was three months after the mal­ware was uncov­ered,” Byres said. “Three months is a life­time in the cyber world and the Rus­sians would have had more than enough time to hide deep inside a sys­tem and cov­er their tracks.”
    ...

    And note the warn­ings we’re get­ting about how it’s not just com­pa­nies that are direct­ly oper­at­ing with Ukraine. The view among some cyber experts is that every com­pa­ny in the West is seen as a poten­tial tar­get by Putin, which is basi­cal­ly a descrip­tion of the Solar­Winds hack that indis­crim­i­nate­ly hit almost every major com­pa­ny in the world. So, again, if any­one has ambi­tions to exe­cute a glob­al Solar­Winds-style hack, now its arguably the best time to do it:

    ...
    That being said, Rus­sia will like­ly be look­ing to bring cyber­war­fare against com­pa­nies that don’t direct­ly deal with Ukraine as well, Byres said. Putin has made it clear that the entire west­ern world is his ene­my and all options are on the table, he said.

    “Any coun­try and its infra­struc­ture is fair game for a cyber­at­tack” if Putin per­ceives it is inter­fer­ing with his goals, Byres said.

    If the Rus­sians had man­aged to sub­due all of Ukraine in just a few days, they prob­a­bly would’ve kept cyber weapons in the U.S. infra­struc­ture under wraps for a rainy day in the future, he not­ed. But after the sanc­tions of recent days and stiffer resis­tance from Ukraine’s forces than expect­ed, that cal­cu­lus may have changed.
    ...

    Now would also arguably be the absolute­ly worst time for any­one to exe­cute a Solar­Winds-style hack pre­cise­ly because it would inflame the sit­u­a­tion with Rus­sia so much, poten­tial­ly trig­ger­ing reprisal cyber attacks by the West. Unless, of course, that was goal. It’s a mat­ter of motive.

    And that brings us to an arti­cle from last week about Ukraine’s side in the cyber con­flict. Because if any enti­ty on the plan­et has an incen­tive to foment a cyber counter-attack against Rus­sia it’s the gov­ern­ment of Ukraine. And accord­ing to reports com­ing out of Israel, Ukraine has been active­ly seek­ing out exact­ly the kind of pow­er­ful offen­sive tools that could be used for dev­as­tat­ing cyber attacks. Tools like NSO Group’s Pega­sus spy­ware.

    Now, we’ve seen no indi­ca­tions that NSO Group’s cyber­tools are built to exe­cute a Solar­Winds-style hack that hits almost every com­pa­ny in the world. But as we saw with the inves­ti­ga­tion of the Solar­Winds hack, it essen­tial­ly start­ed with the hack of a sin­gle devel­op­er as Solar­Winds and was prop­a­gat­ed to Solar­Wind­s’s thou­sands of clients from there. So when you have a tool like Pega­sus that can deliv­er unstop­pable ‘zero-click’ spy­ware onto tar­get­ed indi­vid­u­als, and you have the sophis­ti­ca­tion to embed your mal­ware in an unde­tectable way in the man­ner the Solar­Winds hack­ers used, the poten­tial for strate­gi­cal­ly tar­get oth­er firms like Solar­Winds that are trust­ed by thou­sands of com­pa­nies around the world is very real.

    But let’s also not assume that you need to exe­cute a Solar­Winds-style hack to enrage the West. The poten­tial dam­age is immense in the hands of a skilled hack­er.

    But there’s anoth­er inter­est­ing angle to Ukraine’s request Israel spy­ware tools: as we’ve seen, NSO Group and Can­diru claim their mal­ware can’t be deployed in the Rus­sia. Yes, Rus­sia is one of the coun­tries that is sup­pose to be off lim­its for Israel’s cyber­weapons indus­try. And yet as we’ve also seen, phones from oth­er coun­tries on that banned coun­try list — like the UK and Israel — have indeed been hacked with these tools. So when we learn that Ukraine has been seek­ing out Israeli hack­ing tools that can’t tar­get Russ­ian phones, we should­n’t nec­es­sar­i­ly assume they aren’t plan­ning on attempt­ing to hack Russ­ian phones. But there’s the oth­er obvi­ous appli­ca­tion for Pega­sus: hack­ing oth­er coun­tries and leav­ing ‘clues’ that it was Rus­sia behind it. As we saw with the sto­ry of the Ukrain­ian hack­er, ‘The Pro­fex­or’, and his alleged rela­tion­ship with both ‘Russ­ian hack­ers’ involved with hack­ing the DNC and the Ukrain­ian secu­ri­ty ser­vices, the ques­tion of who is ulti­mate­ly behind a high pro­file can be high­ly neb­u­lous.

    Israel flat­ly reject­ed Ukraine’s appeals accord­ing to these reports, cit­ing the neu­tral­i­ty it needs to main­tain as a peace talk nego­tia­tor. So at this point it does­n’t sound like Ukraine actu­al­ly has access to Israel’s elite hack­ing tools. But the ambi­tions are clear. Don’t for­get that Israel isn’t the only provider of these kinds of tools. It’s a glob­al mar­ket­place. Ukraine has options:

    The Times of Israel

    Israel said weigh­ing Ukraine’s requests for hel­mets, flak jack­ets
    Israeli source quot­ed in TV report say­ing Jerusalem turned down Kyiv’s request for cyber weapon­ry to use against Rus­sia

    By TOI staff
    12 March 2022, 4:58 am

    Israel has begun con­sid­er­ing Ukrain­ian requests for some defen­sive equip­ment amid Russia’s inva­sion of the coun­try, Israeli tele­vi­sion report­ed Fri­day.

    Ukraine has been pub­licly plead­ing for Israel to pro­vide it with pro­tec­tive gear, but has so far been rebuffed.

    How­ev­er, cit­ing a senior Israel source, Chan­nel 12 news said Jerusalem is now weigh­ing Kyiv’s requests for equip­ment such as hel­mets and flak jack­ets.

    The source told the net­work that Ukraine also request­ed cyber weapon­ry to use against Rus­sia, includ­ing the NSO Group’s con­tro­ver­sial Pega­sus hack­ing soft­ware, and oth­er weapon­ry.

    Israel imme­di­ate­ly reject­ed the request, accord­ing to the report, which said Jerusalem has reject­ed all of Kyiv’s demands for weapons in recent weeks and months.

    Ear­li­er Fri­day, the Ukrain­ian ambas­sador said Pres­i­dent Volodymyr Zelen­sky “does not” under­stand Israel’s refusal to pro­vide defen­sive equip­ment, as he accused Israeli lead­ers of not doing enough to help Ukraine by pro­vid­ing defen­sive aid, absorb­ing refugees, and tak­ing a clear stance against Rus­sia.

    Israel has pro­vid­ed human­i­tar­i­an aid to Ukraine, includ­ing 100 tons of med­ical and cold-weath­er equip­ment flown out of Ben Guri­on Air­port last week. How­ev­er, it has sought to walk a tightrope to main­tain good rela­tions with both Ukraine and Rus­sia, the lat­ter of which main­tains a mil­i­tary pres­ence in Syr­ia and is nego­ti­at­ing Iran’s return to a nuclear deal.

    Also Fri­day, a pair of Hebrew media reports said Prime Min­is­ter Naf­tali Ben­nett pushed Zelen­sky to accept an offer from Russ­ian Pres­i­dent Vladimir Putin, which would require Kyiv to make sig­nif­i­cant con­ces­sions to end Russia’s inva­sion.

    The prime minister’s office denied the claim.

    “If I were you, I would think about the lives of my peo­ple and take the offer,” Ben­nett told Zelen­sky dur­ing a phone call on Tues­day, accord­ing to a senior Ukrain­ian offi­cial, who spoke to Wal­la and Haaretz on con­di­tion of anonymi­ty.

    The reports did not spec­i­fy the details of Putin’s offer as report­ed­ly con­veyed by Ben­nett, but pre­vi­ous reports from Wal­la said that Putin is demand­ing an inde­pen­dent Don­bas region, but stop­ping short of seek­ing regime change in Ukraine. Oth­er reports have sug­gest­ed that the plan Ben­nett brought to Zelen­sky includes rec­og­niz­ing Russia’s annex­a­tion of Crimea, rec­og­niz­ing Donet­sk and Luhan­sk as sep­a­rate enti­ties, and chang­ing the Ukrain­ian con­sti­tu­tion to excise a com­mit­ment to join­ing NATO.

    Zelen­sky did not take well to Bennett’s pro­pos­al, respond­ing with a brief, “I hear you,” the Ukrain­ian offi­cial report­ed­ly said.

    “Ben­nett has pro­posed that we sur­ren­der,” the senior Ukrain­ian offi­cial told the Israeli news sites. “We have no inten­tion of doing so. We know that Putin’s pro­pos­al is just the begin­ning.”

    Respond­ing to the report, a source in the Prime Minister’s Office said, “It is doubt­ful whether this is a senior offi­cial who is in Ukraine and on [Bennett’s] call [with Zelen­sky], since it took place on a pri­vate line.”

    The PMO source denied that Ben­nett told Zelen­sky to take Putin’s offer, “as Israel does not have such an offer.”

    ...

    Israel has long had good rela­tions with both Ukraine and Rus­sia, and has been seek­ing to use its posi­tion to bro­ker an agree­ment, as it also tries to walk a tightrope main­tain­ing its ties to both coun­tries. But its rela­tion­ship with Kyiv has strained as Ben­nett has avoid­ed direct­ly blam­ing Rus­sia for the war, although For­eign Min­is­ter Yair Lapid has done so.

    The unnamed Ukrain­ian offi­cial was quot­ed in the Hebrew reports soon after Korniychuk’s press con­fer­ence, at which he urged Israel to drop its neu­tral­i­ty and side open­ly with Ukraine, not­ed that Ben­nett is not the only medi­a­tor, and claimed Israel is “afraid” of offend­ing Moscow.

    The unnamed offi­cial also report­ed­ly said Israel has asked that Ukraine cease its requests for mil­i­tary or defense assis­tance, as this could hin­der Jerusalem’s efforts to medi­ate and main­tain neu­tral­i­ty.

    ———–

    “Israel said weigh­ing Ukraine’s requests for hel­mets, flak jack­ets” By TOI staff; The Times of Israel; 03/12/2022

    “Israel has long had good rela­tions with both Ukraine and Rus­sia, and has been seek­ing to use its posi­tion to bro­ker an agree­ment, as it also tries to walk a tightrope main­tain­ing its ties to both coun­tries. But its rela­tion­ship with Kyiv has strained as Ben­nett has avoid­ed direct­ly blam­ing Rus­sia for the war, although For­eign Min­is­ter Yair Lapid has done so.”

    Ukrain­ian requests for weapons are obvi­ous­ly going to be a com­pli­ca­tion with Israel play­ing the role of the peace talks inter­me­di­ary. But we can’t real­ly be sur­prised by the requests. What is far more notable is the request for cyber weapon­ry, includ­ing NSO Group’s Pega­sus hack­ing toolk­it. It rais­es the ques­tion: what kinds of cyber-actions is Ukraine hop­ing to exe­cute? Is it mere­ly the gain­ing of bat­tle­field mil­i­tary intel­li­gence? Or some­thing more in the offen­sive realm, like attack­ing Rus­si­a’s elec­tri­cal grid and oth­er crit­i­cal infra­struc­ture? We don’t know, but we now know Ukraine is active­ly pur­su­ing pow­er­ful cyber­tools with pow­er­ful offen­sive capa­bil­i­ties:

    ...
    The source told the net­work that Ukraine also request­ed cyber weapon­ry to use against Rus­sia, includ­ing the NSO Group’s con­tro­ver­sial Pega­sus hack­ing soft­ware, and oth­er weapon­ry.

    Israel imme­di­ate­ly reject­ed the request, accord­ing to the report, which said Jerusalem has reject­ed all of Kyiv’s demands for weapons in recent weeks and months.

    ...

    The unnamed Ukrain­ian offi­cial was quot­ed in the Hebrew reports soon after Korniychuk’s press con­fer­ence, at which he urged Israel to drop its neu­tral­i­ty and side open­ly with Ukraine, not­ed that Ben­nett is not the only medi­a­tor, and claimed Israel is “afraid” of offend­ing Moscow.

    The unnamed offi­cial also report­ed­ly said Israel has asked that Ukraine cease its requests for mil­i­tary or defense assis­tance, as this could hin­der Jerusalem’s efforts to medi­ate and main­tain neu­tral­i­ty.
    ...

    So where else has Ukraine been inquir­ing about elite hack­ing tools? It’s a ques­tion the Russ­ian gov­ern­ment is no doubt ask­ing fol­low­ing these reports. Let’s hope the rest of the world is ask­ing these kinds of ques­tions too.

    Posted by Pterrafractyl | March 19, 2022, 7:30 pm

  22. Here’s a pair of arti­cles about a rather fas­ci­nat­ing update to the US gov­ern­men­t’s black­list­ing of NSO Group’s spy­ware. It sounds like there’s a pos­si­ble solu­tion to NSO Group’s pari­ah sta­tus: sell­ing the com­pa­ny to US nation­al secu­ri­ty con­trac­tor L3Harris.

    Yes, NSO Group might become a US-owned and oper­at­ed firm. It’s the kind of move that could address the grow­ing evi­dence that NSO Group’s spy­ware tools have been used against US-based phones, con­tra­dict­ing the com­pa­ny’s long-stat­ed claims that its tools were banned from tar­get­ing phones in cer­tain coun­tries includ­ing the US, UK, and Israel. Recall how cas­es of NSO Group’s spy­ware hack­ing UK and Israeli-based phones have already been doc­u­ment­ed. Also recall how we learned in Jan­u­ary of this year that the FBI secret­ly pur­chased and test­ed NSO Group’s spy­ware for years with plans to use it for domes­tic sur­veil­lance until the agency final­ly decid­ed last year not to use the tools. So at the same there’s been well-doc­u­ment­ed fears in the US gov­ern­ment of NSO Group’s glob­al list of client states using that spy­ware against US tar­gets, the FBI was plan­ning on doing the same thing.

    But as we’re going to see, the pro­posed sale is rais­ing major alarms in the US gov­ern­ment. The kind of alarms that raise all sorts of fas­ci­nat­ing ques­tions about how much direct involve­ment the Israeli intel­li­gence ser­vices have had in the oper­a­tions of NSO Group’s spy­ware. It’s also the kind of alarms that might explain why the FBI ulti­mate­ly decid­ed not to use the tools. Days after the pro­posed buy­out sto­ry hit the news, Sen­a­tor Ron Wyden warned that any inter­cepts car­ried out with NSO Group spy­ware by US intel­li­gence ser­vices are just going to end up in Israeli hands too. The warn­ing was based on what appears to be a wide­ly held assump­tion that NSO Group’s spy­ware con­tained back­doors feed cap­tured data back to Israeli intel­li­gence. In oth­er words, all of the claims by the Israeli gov­ern­ment of “we had no idea how clients were using the spy­ware” were like­ly garbage. Israeli and NSO Group deny such back­doors exist, but it sure would help explain the large num­ber of high­ly ques­tion­able clients who received access to these tools. Don’t for­get that the Israeli gov­ern­ment con­trolled which coun­tries could become NSO Group clients. There’s going to be a lot less ret­i­cence about sell­ing tools like that if back­doors are includ­ed.

    It sounds like there’s also ques­tions about where NSO Group would be locat­ed after a sale. The assump­tion in the Israeli cyber indus­try is that the per­son­nel and devel­op­ment of new tools would remain in Israel and that Israel would con­tin­ue to retain access to the tools. But it sounds like US might demand that access to NSO Group’s spy­ware be lim­it­ed to the Five Eyes nations and maybe some NATO allies.

    So if NSO Group’s spy­ware is filled with back­doors send­ing intel­li­gence back to Israeli intel­li­gence, which gov­ern­ment agen­cies are going to feel com­fort­able using these tools? Well, as John Scott-Rail­ton, a senior researcher at Cit­i­zen Lab at the Munk School at the Uni­ver­si­ty of Toron­to, pre­dicts, gov­ern­ments aren’t going to trust NSO tech­nol­o­gy for their most sen­si­tive oper­a­tions. Instead, it’s local author­i­ties like US police depart­ments that are the like­li­est clients. Yep. And who knows, maybe the FBI all things con­sid­ered. We’ll see if this sale actu­al­ly goes through. But if it does hap­pen, it would be a big mis­take to assume that the US pur­chase of NSO Group is going to be done in order to min­i­mize the poten­tial abus­es of NSO Group’s tools against US cit­i­zens. Quite the oppo­site:

    The Guardian

    Key Demo­c­rat warns of major secu­ri­ty risk if US firm acquires NSO hack­ing code

    Ron Wyden says White House right to raise doubts about pos­si­ble deal for con­trac­tor L3Harris to take over sur­veil­lance tech­nol­o­gy

    Stephanie Kirch­gaess­ner in Wash­ing­ton
    Thu 16 Jun 2022 15.12 EDT
    First pub­lished on Thu 16 Jun 2022 15.10 EDT

    An influ­en­tial Demo­c­ra­t­ic law­mak­er has said any deal by a US com­pa­ny to acquire NSO Group’s sur­veil­lance tech­nol­o­gy would pose a seri­ous nation­al secu­ri­ty risk, and sug­gest­ed that any inter­cepts obtained with the soft­ware by US intel­li­gence agen­cies would end up in Israeli hands.

    The remarks by Sen­a­tor Ron Wyden of Ore­gon, who chairs the finance com­mit­tee and is known for being a strong sup­port­er of pri­va­cy rights and a crit­ic of gov­ern­ment-sanc­tioned spy­ing, come after the Guardian and media part­ners report­ed that the US defence con­trac­tor L3Harris was in talks to acquire NSO’s hack­ing tech­nol­o­gy.

    Peo­ple famil­iar with the talks have said that any acqui­si­tion of NSO’s con­tro­ver­sial hack­ing tools – which are alleged to have been used by NSO’s gov­ern­ment clients to com­mit human rights abus­es – would mean that the spy­ing tools would only be per­mit­ted to be used by US agen­cies and close Amer­i­can allies: the UK, New Zealand, Cana­da, Aus­tralia and pos­si­bly some Nato coun­tries.

    Wyden said in a state­ment to the Guardian: “If the US plans on using for­eign-made sur­veil­lance tech­nol­o­gy, it might as well bcc the coun­try that pro­duces it on every inter­cept. It’s a seri­ous nation­al secu­ri­ty risk, sim­i­lar to the con­cerns asso­ci­at­ed with using for­eign com­mu­ni­ca­tions tech­nol­o­gy. The White House is right to raise con­cerns about this deal.”

    NSO was placed on a black­list by the Biden admin­is­tra­tion last Novem­ber, after the com­merce depart­ment found that the company’s activ­i­ties had act­ed con­trary to the inter­est of the US. The Guardian and oth­er media part­ners have report­ed on dozens of cas­es in which NSO’s pow­er­ful hack­ing tools – which can hack into any smart­phone and remote­ly con­trol them – have been used by some gov­ern­ment clients to tar­get activists, jour­nal­ists, lawyers, gov­ern­ment offi­cials and busi­ness­peo­ple. NSO has said clients are only sup­posed to use its tech­nol­o­gy to tar­get seri­ous crim­i­nals, and that it inves­ti­gates cred­i­ble alle­ga­tions of abuse.

    A per­son close to the talks between L3 and NSO has said a num­ber of issues have yet to be resolved in the nego­ti­a­tions, includ­ing the price of the pos­si­ble deal, whether the tech­nol­o­gy would be housed in the US or Israel, and whether Israel would be able to use NSO’s tech­nol­o­gy as a client.

    ...

    Wyden’s com­ments point to a per­sis­tent con­cern among some coun­tries that have weighed using NSO’s hack­ing soft­ware. Cur­rent and for­mer US intel­li­gence offi­cials have said that there was a pre­sump­tion that Israel had some access – via a “back­door” – to intel­li­gence unearthed via such sur­veil­lance tools.

    But NSO has pre­vi­ous­ly strong­ly denied that the com­pa­ny has any spe­cial access to the intel­li­gence.

    In a pre­vi­ous state­ment, NSO has said: “NSO Group is a pri­vate com­pa­ny. It is not a ‘tool of Israeli diplo­ma­cy’; it is not a back­door for Israeli intel­li­gence; and it does not take direc­tion from any gov­ern­ment leader.”

    A senior White House offi­cial expressed grave con­cerns about any pos­si­ble acqui­si­tion of NSO tech­nol­o­gy by a US con­trac­tor, say­ing the deal raised nation­al secu­ri­ty con­cerns.

    NSO is also being sued by What­sApp, the pop­u­lar mes­sag­ing app owned by Face­book, and Apple. Any move to sell the company’s tech­nol­o­gy – or code – to a US com­pa­ny would not auto­mat­i­cal­ly mean that those cas­es would be closed or that the com­pa­ny would be removed from the black­list.

    ———–

    “Key Demo­c­rat warns of major secu­ri­ty risk if US firm acquires NSO hack­ing code” by Stephanie Kirch­gaess­ner; The Guardian; 06/16/2022

    “Wyden said in a state­ment to the Guardian: “If the US plans on using for­eign-made sur­veil­lance tech­nol­o­gy, it might as well bcc the coun­try that pro­duces it on every inter­cept. It’s a seri­ous nation­al secu­ri­ty risk, sim­i­lar to the con­cerns asso­ci­at­ed with using for­eign com­mu­ni­ca­tions tech­nol­o­gy. The White House is right to raise con­cerns about this deal.””

    It’s quite a warn­ing: any intel­li­gence gained using NSO Group spy­ware is auto­mat­i­cal­ly shared with Israeli intel­li­gence. That assump­tion isn’t just held by Sen­a­tor Wyden. It’s appar­ent­ly the US intel­li­gence com­mu­ni­ty’s long-stand­ing assump­tion. An assump­tion that, if true, utter­ly destroys the long-stand­ing claims by the NSO Group and Israeli gov­ern­ment that they weren’t aware of any abus­es. The fruits of those abus­es were like­ly auto­mat­i­cal­ly for­ward­ed to Israeli intel­li­gence the entire time:

    ...
    Wyden’s com­ments point to a per­sis­tent con­cern among some coun­tries that have weighed using NSO’s hack­ing soft­ware. Cur­rent and for­mer US intel­li­gence offi­cials have said that there was a pre­sump­tion that Israel had some access – via a “back­door” – to intel­li­gence unearthed via such sur­veil­lance tools.

    But NSO has pre­vi­ous­ly strong­ly denied that the com­pa­ny has any spe­cial access to the intel­li­gence.
    ...

    Those lin­ger­ing ques­tions about back­doors in NSO Group’s soft­ware is part of the rea­son the major ques­tions sur­round­ing L3’s poten­tial acqui­si­tion of the com­pa­ny include the ques­tion of whether or not it would still be housed in Israel and if the Israel gov­ern­ment would still main­tain access. Will the NSO Group’s pow­er­ful spy­ware just be lim­it­ed to the Five Eyes and some NATO allies? Keep in mind all of the evi­dence that sug­gests Israel has been treat­ing access to NSO Group’s tools as a key diplo­mat­ic tool. So if NSO Group gets sold and a num­ber of exist­ing NSO Group clients lose access to the tools, will Israel per­haps agree to car­ry out attacks on behalf of those clients? These are the kinds of ques­tions reg­u­la­tors are pre­sum­ably wrestling with right now:

    ...
    Peo­ple famil­iar with the talks have said that any acqui­si­tion of NSO’s con­tro­ver­sial hack­ing tools – which are alleged to have been used by NSO’s gov­ern­ment clients to com­mit human rights abus­es – would mean that the spy­ing tools would only be per­mit­ted to be used by US agen­cies and close Amer­i­can allies: the UK, New Zealand, Cana­da, Aus­tralia and pos­si­bly some Nato coun­tries.

    ...

    A per­son close to the talks between L3 and NSO has said a num­ber of issues have yet to be resolved in the nego­ti­a­tions, includ­ing the price of the pos­si­ble deal, whether the tech­nol­o­gy would be housed in the US or Israel, and whether Israel would be able to use NSO’s tech­nol­o­gy as a client.
    ...

    But as the fol­low­ing report describes, there’s anoth­er major ques­tion loom­ing over this poten­tial acqui­si­tion by a US com­pa­ny: what enti­ties are going to feel secure using spy­ware that is sus­pect­ed of con­tain­ing back­doors to Israeli intel­li­gence? Accord­ing to John Scott-Rail­ton, a senior researcher at Cit­i­zen Lab at the Munk School at the Uni­ver­si­ty of Toron­to, US intel­li­gence agen­cies are unlike­ly to use tools with such mas­sive secu­ri­ty risks. And that leaves local law enforce­ment as the like­ly end-users. So it sounds like the sto­ries of abus­es of NSO Group’s tools by gov­ern­ments around the world are going to be replaced with sto­ries of abus­es of NSO Group’s tools by the local author­i­ties in the Five Eyes coun­tries and their lucky NATO allies:

    The Guardian

    US defence con­trac­tor in talks to take over NSO Group’s hack­ing tech­nol­o­gy

    Deal – which would require approval from US and Israel – would give L3Harris con­trol over con­tro­ver­sial Pega­sus tool

    Stephanie Kirch­gaess­ner in Wash­ing­ton
    Tue 14 Jun 2022 16.25 EDT
    First pub­lished on Tue 14 Jun 2022 16.00 EDT

    The US defence con­trac­tor L3Harris is in talks to take over NSO Group’s sur­veil­lance tech­nol­o­gy, in a pos­si­ble deal that would give an Amer­i­can com­pa­ny con­trol over one of the world’s most sophis­ti­cat­ed and con­tro­ver­sial hack­ing tools.

    Mul­ti­ple sources con­firmed that dis­cus­sions were cen­tred on a sale of the Israeli company’s core tech­nol­o­gy – or code – as well as a pos­si­ble trans­fer of NSO per­son­nel to L3Harris. But any agree­ment still faces sig­nif­i­cant hur­dles, includ­ing requir­ing the bless­ing of the US and Israeli gov­ern­ments, which have not yet giv­en the green light to a deal.

    In a state­ment, a senior White House offi­cial said: “Such a trans­ac­tion, if it were to take place, rais­es seri­ous coun­ter­in­tel­li­gence and secu­ri­ty con­cerns for the US gov­ern­ment.”

    ...

    If agreed, the deal would mark an astound­ing turn­around for NSO, less than a year after the Biden admin­is­tra­tion placed the com­pa­ny on a US black­list and accused it of act­ing “con­trary to the for­eign pol­i­cy and nation­al secu­ri­ty inter­ests of the US”.

    NSO’s gov­ern­ment clients are known to have used the sur­veil­lance tech­nol­o­gy to tar­get jour­nal­ists, human rights activists, senior gov­ern­ment offi­cials in US-allied coun­tries, and lawyers around the world.

    The Guardian and oth­er media out­lets have also detailed how NSO’s sur­veil­lance tech­nol­o­gy, Pega­sus, has been used by the company’s gov­ern­ment clients to tar­get Amer­i­can cit­i­zens, includ­ing Carine Kan­im­ba, daugh­ter of the Rwan­dan dis­si­dent Paul Rus­esabag­i­na, as well as jour­nal­ists, activists and US state depart­ment offi­cials work­ing abroad.

    Asked to com­ment on the talks, an L3Harris spokesper­son said: “We are aware of the capa­bil­i­ty and we are con­stant­ly eval­u­at­ing our cus­tomers’ nation­al secu­ri­ty needs. At this point, any­thing beyond that is spec­u­la­tion.”

    ...

    The White House said that it had not been involved in “any way in this report­ed poten­tial trans­ac­tion”.

    The senior White House offi­cial also said the US gov­ern­ment “oppos­es efforts by for­eign com­pa­nies to cir­cum­vent US export con­trol mea­sures or sanc­tions, includ­ing place­ment on the US Depart­ment of Commerce’s Enti­ty List for mali­cious cyber activ­i­ty”.

    The offi­cial said that any US com­pa­ny – par­tic­u­lar­ly a cleared US defence con­trac­tor – should be aware that a trans­ac­tion with a black­list­ed com­pa­ny would “not auto­mat­i­cal­ly remove a des­ig­nat­ed enti­ty from the Enti­ty List, and would spur inten­sive review to exam­ine whether the trans­ac­tion pos­es a coun­ter­in­tel­li­gence threat to the US Gov­ern­ment and its sys­tems and infor­ma­tion, whether oth­er US equi­ties with the defense con­trac­tor may be at risk, to what extent a for­eign enti­ty or gov­ern­ment retains a degree of access or con­trol, and the broad­er human rights impli­ca­tions”.

    One per­son famil­iar with the talks said that if a deal were agreed, it would prob­a­bly involve sell­ing NSO’s capa­bil­i­ties to a dras­ti­cal­ly cur­tailed cus­tomer base that would include the US gov­ern­ment, the UK, Aus­tralia, New Zealand and Cana­da – which com­prise the “five eyes” intel­li­gence alliance – as well as some Nato allies.

    The per­son also said that the deal faced sev­er­al unre­solved issues, includ­ing whether the tech­nol­o­gy would be housed in Israel or the US and whether Israel would be allowed to con­tin­ue to use the tech­nol­o­gy as a cus­tomer.

    The per­son said it was also too soon to con­firm the price of any pos­si­ble deal. The trans­ac­tion would require US gov­ern­ment approval since NSO is on the com­merce department’s so-called enti­ty list. Experts said that any such trans­ac­tion would prob­a­bly require the cre­ation of a new enti­ty in order to get US approval.

    Any deal would also face hur­dles in Israel. One assump­tion in the Israeli cyber indus­try is that it would have to keep over­sight of the Israeli-made tech­nol­o­gy in Israel, and keep all devel­op­ment of Pega­sus and per­son­nel in Israel.

    NSO is reg­u­lat­ed by the Israeli min­istry of defence, which has had ulti­mate say over the company’s gov­ern­ment clients. Israel has faced intense crit­i­cism in the past for agree­ing to sell the sur­veil­lance tech­nol­o­gy to coun­tries with poor human rights records, includ­ing Sau­di Ara­bia and the Unit­ed Arab Emi­rates.

    NSO, which is being sued by Apple and What­sApp in US courts, has in the past said it takes all alle­ga­tions of abuse of its tools seri­ous­ly, and that it inves­ti­gates such claims.

    ...

    Any takeover of NSO’s hack­ing tech­nol­o­gy would add to L3Harris’s cur­rent suite of sur­veil­lance tools, which are already sold to US gov­ern­ment and law enforce­ment clients. The com­pa­ny, which is based in Flori­da and reports about $18bn in annu­al sales, includes the FBI and Nato as clients.

    Any poten­tial deal faces stiff oppo­si­tion from dig­i­tal rights advo­cates and human rights groups.

    John Scott-Rail­ton, a senior researcher at Cit­i­zen Lab at the Munk School at the Uni­ver­si­ty of Toron­to, said he was doubt­ful that US agen­cies, and the agen­cies of the US’s clos­est allies, would trust NSO tech­nol­o­gy for their most sen­si­tive oper­a­tions, and it would there­fore more like­ly be sold to local author­i­ties.

    “So where would the big mar­ket be? I fear the log­i­cal con­sumers would be US police depart­ments. This would be an unprece­dent­ed threat to our civ­il lib­er­ties,” he said.

    The deal would also raise seri­ous ques­tions about the Biden administration’s com­mit­ment to hold­ing “bad actors” account­able, Scott-Rail­ton said.

    “All eyes are on NSO right now. If the White House doesn’t stop this deal, many will con­clude that the admin­is­tra­tion is weak on enforce­ment, or that they’re cyn­i­cal and helped a US com­pa­ny pick up NSO at fire-sale prices because it was sanc­tioned,” he said, adding that any such deal would show that US sanc­tions did not have teeth and would encour­age more invest­ment in the “mer­ce­nary hack­ing space”.

    ————

    “US defence con­trac­tor in talks to take over NSO Group’s hack­ing tech­nol­o­gy” by Stephanie Kirch­gaess­ner; The Guardian; 06/14/2022

    “Any deal would also face hur­dles in Israel. One assump­tion in the Israeli cyber indus­try is that it would have to keep over­sight of the Israeli-made tech­nol­o­gy in Israel, and keep all devel­op­ment of Pega­sus and per­son­nel in Israel.”

    Is NSO Group going to effec­tive­ly remain an Israeli enti­ty, with all devel­op­ment and per­son­nel remain­ing in the coun­try? That’s the remark­able assump­tion that was appar­ent­ly held by the Israeli cyber indus­try when this pro­posed buy­out was first report­ed. We’ll see if it actu­al­ly pans out that way, but if that’s how this deal goes down, it’s hard to argue with the assess­ment of John Scott-Rail­ton: this is going to become a tool of US local law enforce­ment because any enti­ty with a nation­al secu­ri­ty mis­sion is going to know not to touch it:

    ...
    John Scott-Rail­ton, a senior researcher at Cit­i­zen Lab at the Munk School at the Uni­ver­si­ty of Toron­to, said he was doubt­ful that US agen­cies, and the agen­cies of the US’s clos­est allies, would trust NSO tech­nol­o­gy for their most sen­si­tive oper­a­tions, and it would there­fore more like­ly be sold to local author­i­ties.

    “So where would the big mar­ket be? I fear the log­i­cal con­sumers would be US police depart­ments. This would be an unprece­dent­ed threat to our civ­il lib­er­ties,” he said.
    ...

    Keep in mind one of the key fea­tures of NSO Group’s soft­ware: the hacks are extreme­ly dif­fi­cult to detect, in part because of the zero-click capa­bil­i­ties. So any agen­cies that want­ed to engage in sur­veil­lance that does­n’t quite meet con­sti­tu­tion­al muster would the­o­ret­i­cal­ly still have the capac­i­ty to car­ry out unau­tho­rized sur­veil­lance cam­paigns with lit­tle chance of get­ting caught. Will US police depart­ments han­dle the “zero-click” unstop­pable hack­ing capa­bil­i­ties respon­si­bly? How about the FBI? We’ll see. Well, actu­al­ly, we the pub­lic prob­a­bly won’t see. But the agen­cies that ulti­mate­ly gain access to these tools are going to see see if they can han­dle the pow­er respon­si­bly. Them and pre­sum­ably Israeli intel­li­gence. Plen­ty of actors will be aware of abus­es. They may not talk about it, but they’ll be aware of it.

    Posted by Pterrafractyl | July 7, 2022, 8:14 pm

  23. Who watch­es the watch­men? It’s an alarm­ing­ly top­i­cal ques­tion as the inves­ti­ga­tion into the Jan­u­ary 6 Capi­tol insur­rec­tion con­tin­ues to flesh out both what we know and don’t know about the events lead­ing up to that day. In par­tic­u­lar, what we aren’t allowed to know thanks to what appears to be a mas­sive coverup inside the Inspec­tor Gen­er­al’s office at the Depart­ment of Home­land Secu­ri­ty.

    It’s not just that there was some sort of cor­rup­tion inside the office of DHS Inspec­tor Gen­er­al James Cuf­fari. As we’ve seen, it’s Cuf­fari him­self — a 2019 Trump appointee to the office and a for­mer aide of Repub­li­can Ari­zona gov­er­nor Doug Ducey — who appears to be at the heart of it. Which is why con­gres­sion­al inves­ti­ga­tors are now call­ing for Cuf­fari to recuse him­self from his agen­cy’s inves­ti­ga­tions into Jan 6. As we’ve seen, Cuf­fari has been repeat­ed­ly sab­o­tag­ing of his agen­cy’s own inves­ti­ga­tion into Jan 6. An inves­ti­ga­tion that includ­ed the miss­ing texts from 24 Secret Ser­vice agents phones in the month lead­ing up to and on Jan 6. Accord­ing to mul­ti­ple anony­mous whistle­blow­ers, Cuf­fari was prepar­ing to issue a pub­lic alert back in Octo­ber 2021 over the resis­tance he was get­ting from the Secret Ser­vice and oth­er DHS depart­ments in their inves­ti­ga­tion into Jan 6. And then obvi­ous­ly he changed his mind since we nev­er got that alert. Cuf­fari has respond­ed to this out­cry by open­ing a crim­i­nal inves­ti­ga­tion of the Secret Ser­vice over the miss­ing texts and, in turn, is order­ing for the Secret Ser­vice to halt its own ongo­ing foren­sic inves­ti­ga­tion into the miss­ing text in lieu of the crim­i­nal inves­ti­ga­tion. Yes, Cuf­far­i’s crim­i­nal inves­ti­ga­tion in the Secret Ser­vice’s han­dling of the miss­ing texts is itself prob­a­bly crim­i­nal­ly cor­rupt or at least has that appear­ance.

    We received a num­ber of updates to that sor­did mess over the last few days. It sounds like Cuf­fari made more attempts to alert Con­gress about the miss­ing texts. And then can­celed those orders. It’s a pat­tern.

    For starters, in May 2021, the Secret Ser­vice informed Cuf­far­i’s office that the agency tried to con­tact a cel­lu­lar provider to retrieve the texts when they real­ized they were lost. We’re also told that key Secret Ser­vice per­son­nel did­n’t real­ize data was per­ma­nent­ly lost until after the data migra­tion was com­plet­ed, and erro­neous­ly believed the data was backed up. At least that’s what anony­mous sources were telling CNN. So the Secret Ser­vice’s sto­ry at this point is appar­ent­ly that it thought texts were backed up and only belat­ed­ly real­ized they were lost per­ma­nent­ly when they dis­cov­ered that even the cel­lu­lar provider could­n’t retrieve their own copies. As we’re going to see, part of what makes this a poor ali­bi, from a tech­ni­cal stand­point, is that the Secret Ser­vice agents were using gov­ern­ment-issued iPhones. And when one iOS device texts anoth­er one they use the encrypt­ed iMes­sag­ing tex­ting pro­to­col. Cel­lu­lar providers only have access to the encrypt­ed mes­sage. You need the iPhone itself to access the iMes­sages.

    So any mes­sages between the 24 Secret Ser­vice agents them­selves would pre­sum­ably be lost when those gov­ern­ment-issued iPhones were wiped at the end of Jan­u­ary 2021. But that still does­n’t explain the vir­tu­al lack of any tra­di­tion­al text mes­sages. Don’t for­get that it was just a lone mes­sage on Jan 6 from the Chief of the Capi­tol police that was turned in by those 24 agents. That’s it. One mes­sage. Are we to believe that all of the oth­er text mes­sages they receive were iMes­sages sent from or to anoth­er iPhone, because that’s what we would have to believe if we assume there aren’t lost tra­di­tion­al text mes­sages. And yet the Secret Ser­vice told Cuf­far­i’s office last May that the cel­lu­lar provider it con­tact­ed could­n’t find any mes­sages. It’s odd. Could­n’t they at least find the sin­gle mes­sage from the Chief of Police, or was that an iMes­sage? It’s all very odd.

    So what did Cuf­far­i’s office do in response to the May 2021 rev­e­la­tion that the Secret Ser­vice had ‘acci­den­tal­ly’ lost all these mes­sages and con­clud­ed it could­n’t retrieve them after the cel­lu­lar provider said it could­n’t find any? Well, in July of 2021, Cuf­far­i’s office told DHS they were no longer seek­ing those text. Yep. Case closed as far as Cuf­far­i’s office was con­cerned. At least until Decem­ber, when Cuf­far­i’s office reopened the probe.

    Part of the rea­son that May 2021 date for when The Secret Ser­vice informed Cuf­far­i’s office is so notable in the con­text of a coverup is that it was ear­li­er this month when the Secret Ser­vice told con­gres­sion­al inves­ti­ga­tors that Cuf­far­i’s office learned about the miss­ing texts in Decem­ber 2021, the month the probe was reopened. And yet here we learn that the Secret Ser­vice told Cuf­far­i’s office in May of 2021 that it could­n’t find the mes­sages and the Inspec­tor Gen­er­al informed DHS two months lat­er that the probe was over. The Secret Ser­vice and Cuf­far­i’s office have had a lot of over­lap in their omis­sions.

    And then there’s a whole new dimen­sion to all this: recall how Cuf­fari killed the pub­lic alert that was planned in Octo­ber 2021 that includ­ed warn­ings about resis­tance from not just the Secret Ser­vice but oth­er DHS agen­cies too. Well, we’re now learn­ing that text mes­sages for the two top DHS offi­cials at the time: act­ing DHS Sec­re­tary Chad Wolf and act­ing Deputy Sec­re­tary Ken Cuc­cinel­li. The top two offi­cials in DHS lost their texts too. It’s the kind of rev­e­la­tion that should add all sorts of addi­tion­al ques­tions to all the exist­ing ques­tions about was going on with the dif­fer­ent facets of nation­al secu­ri­ty state dur­ing the peri­od around the insur­rec­tion. For exam­ple, recall the reports on how DHS and the FBI knew there might be trou­ble in the lead up to Jan 6 but appar­ent­ly looked the oth­er way. Then-act­ing DHS Sec­re­tary Chad Wolf was out of the coun­try, in the Mid­dle East, dur­ing this tran­si­tion peri­od.

    But there’s anoth­er inter­est­ing aspect to Chad Wolf’s role in this sto­ry that’s worth keep­ing in mind when it comes to miss­ing texts and any oth­er miss­ing dig­i­tal doc­u­ments: Wolf’s emails were the tar­get of an appar­ent suc­cess­ful hack­ing attempt tar­get­ing high-lev­el US gov­ern­ment offi­cials as part of the giant Microsoft Exchange hack. So at least when it comes to any poten­tial­ly incrim­i­nat­ing emails, who­ev­er exe­cut­ed that hack prob­a­bly has at least some of them. Recall how signs of the Microsoft Exchange mega-hack start­ed on Jan 3, 2021. How many incrim­i­nat­ing emails involv­ing the insur­rec­tion and the var­i­ous oth­er crim­i­nal plots to over­turn the elec­tion end­ed up in the hands of those hack­ers? Talk about some juicy black­mail mate­r­i­al.

    Also recall how the Solar­Winds hack start­ed as ear­ly as the Spring of 2020. All sorts of US gov­ern­ment net­works could have been infil­trat­ed through­out the months lead­ing up to the 2020 elec­tion and beyond. It would have been a black­mail trea­sure trove giv­en the ram­pant crim­i­nal­i­ty of the Trump admin­is­tra­tion at that point.

    So while Jan 6 inves­ti­ga­tors may not want to ask the ques­tion of whether or not delet­ed Jan 6 evi­dence is in the hands of the per­pe­tra­tors of these mega hacks, they real­ly do need to ask the ques­tion. It’s rel­e­vant to the inves­ti­ga­tion. Cer­tain­ly rel­e­vant to the poten­tial fall­out from the plot. Again, the black­mail mate­r­i­al that could by used against future Repub­li­can admin­is­tra­tions — which will undoubt­ed­ly be root­ed in Trump­ism — is just immense. It’s part of the dam­age assess­ment. And who knows, maybe a means of recov­er­ing the miss­ing evi­dence.

    But, of course, when we’re talk­ing about miss­ing iMes­sages, there’s anoth­er obvi­ous source of hacked mate­ri­als the inves­ti­ga­tors could poten­tial turn to: all of the NSO Group’s clients. All of those gov­ern­ments. Because as the sto­ry of the Pega­sus super-spy­ware made clear, basi­cal­ly any iPhone in the world was sub­ject to a zero-click super-hack that left vic­tims com­plete­ly unaware. And while NSO Group claimed its spy­ware could­n’t be used against US-based phones, it also made sim­i­lar claims about UK and Israeli phones that were proven to be false. Plus, the FBI spent years inves­ti­gat­ing whether or not to use Pega­sus domes­ti­cal­ly. And as we also saw, NSO Group’s Pega­sus spy­ware was caught hit­ting iPhones and lift­ing iMes­sages in the sum­mer of 2021, so this capa­bil­i­ty was very like­ly avail­able to NSO Group clients through­out the peri­od around the 2020 elec­tion.

    We have every rea­son to believe NSO Group’s spy­ware could have been poten­tial­ly used on US phones. And we know the Secret Ser­vice issued iPhones to its agents. So we have to ask: did any NSO Group clients decide to infect Secret Ser­vice agents? If so, hope­ful­ly it’s a friend­ly client. Black­mail and all that.

    Oh, and it turns out Chad Wolf and Ken Cuc­cinel­li insist that they turned in their phones to DHS with their data ful­ly intact and all the texts there so if any texts are miss­ing that should be tak­en up with DHS. So either they’re both lying, or some­one in DHS is delet­ing texts. That’s the kind of pic­ture that’s emerg­ing here. It’s awful. But it’s yet to be deter­mined what exact fla­vor of awful we’re expe­ri­enc­ing here.

    Ok, first, here’s a CNN piece from over the week­end about the May 2021 noti­fi­ca­tion by the Secret Ser­vice of their failed attempts to find the miss­ing mes­sages and Cuf­far­i’s end­ing of the probe two months lat­er. Before reopen­ing the probe in Decem­ber instead of alert­ing Con­gress and the pub­lic in Octo­ber. It’s the lat­est round of rev­e­la­tions in this sto­ry build­ing upon the under­ly­ing theme of an inspec­tor gen­er­al des­per­ate to find a rea­son not to blow the whis­tle:

    CNN

    Exclu­sive: DHS inspec­tor gen­er­al knew of miss­ing Secret Ser­vice texts months ear­li­er than pre­vi­ous­ly known

    By Whit­ney Wild, Zachary Cohen, Jere­my Herb and Priscil­la Alvarez
    Updat­ed 3:42 PM ET, Sat July 30, 2022

    Wash­ing­ton (CNN)The embat­tled inspec­tor gen­er­al for the Depart­ment of Home­land Secu­ri­ty first learned of miss­ing Secret Ser­vice text mes­sages in May 2021 — months ear­li­er than pre­vi­ous­ly known and more than a year before he alert­ed the House select com­mit­tee inves­ti­gat­ing Jan­u­ary 6, 2021, that poten­tial­ly cru­cial infor­ma­tion may have been erased, accord­ing to mul­ti­ple sources famil­iar with the mat­ter.

    Ear­li­er this month, Secret Ser­vice offi­cials told con­gres­sion­al com­mit­tees that DHS Inspec­tor Gen­er­al Joseph Cuf­fari, the depart­men­t’s inde­pen­dent watch­dog, was aware that texts had been erased in Decem­ber 2021. But sources tell CNN, the Secret Ser­vice had noti­fied Cuf­far­i’s office of miss­ing text mes­sages in May 2021, sev­en months ear­li­er.

    The Secret Ser­vice now says the texts were lost as a result of a pre­vi­ous­ly sched­uled data migra­tion of its agents’ cell phones that began on Jan­u­ary 27, 2021, exact­ly three weeks after the attack on the US Capi­tol. After the data migra­tion was com­plet­ed, in May 2021 the Secret Ser­vice told Cuf­far­i’s office that they tried to con­tact a cel­lu­lar provider to retrieve the texts when they real­ized they were lost, a source told CNN.

    The source added that key Secret Ser­vice per­son­nel did­n’t real­ize data was per­ma­nent­ly lost until after the data migra­tion was com­plet­ed, and erro­neous­ly believed the data was backed up. In July 2021, inspec­tor gen­er­al inves­ti­ga­tors told DHS they were no longer seek­ing Secret Ser­vice text mes­sages, accord­ing to two sources. Cuf­far­i’s office then restart­ed its probe in Decem­ber 2021.

    These new details come as Cuf­fari faces mount­ing pres­sure from key Democ­rats to hand off his inves­ti­ga­tion into the miss­ing mes­sages. They also come amid rev­e­la­tions that text mes­sages for the two top DHS offi­cials under for­mer Pres­i­dent Don­ald Trump — act­ing Sec­re­tary Chad Wolf and act­ing deputy sec­re­tary Ken Cuc­cinel­li — are miss­ing for a key peri­od lead­ing up to the Jan­u­ary 6 attack.

    The Wash­ing­ton Post first report­ed the miss­ing Wolf and Cuc­cinel­li texts, which were lost in a “reset” of their gov­ern­ment phones when they left their jobs in Jan­u­ary 2021 in prepa­ra­tion for the new Biden admin­is­tra­tion, accord­ing to the Post.

    Wolf said in a tweet Thurs­day that he “com­plied with all data reten­tion laws and returned all my equip­ment ful­ly loaded to the Depart­ment. Full stop. DHS has all my texts, emails, phone logs, sched­ules, etc. Any issues with miss­ing data needs to be addressed to DHS. To imply oth­er­wise is lazy report­ing.”

    ...

    House Over­sight Chair­woman Car­olyn Mal­oney in a state­ment Sat­ur­day accused Cuf­fari of “fla­grant­ly mis­han­dling” the inves­ti­ga­tion into the miss­ing text mes­sages and called for him to “imme­di­ate­ly step away” from the inquiry.

    The miss­ing mes­sages explod­ed into pub­lic view ear­li­er this month when Cuf­fari sent a let­ter to con­gres­sion­al com­mit­tees say­ing that Secret Ser­vice texts had been erased, kick­ing off the fran­tic set of events that now has sparked a crim­i­nal inves­ti­ga­tion and point­ed demands for answers from Con­gress.

    Cuf­far­i’s let­ter came after Trump White House aide Cas­sidy Hutchin­son tes­ti­fied to the Jan­u­ary 6 com­mit­tee about an angry con­fronta­tion between Trump and his Secret Ser­vice detail on Jan­u­ary 6, 2021.

    The com­mit­tee and Cuf­fari are both inter­est­ed in the texts because they could shed light on the Secret Ser­vice’s response to Jan­u­ary 6.

    Con­flict­ing requests for infor­ma­tion

    Amid the height­ened scruti­ny, the Secret Ser­vice has cur­tailed its coop­er­a­tion with the Jan­u­ary 6 com­mit­tee relat­ed to the miss­ing texts, two sources tell CNN. Secret Ser­vice lawyers, along with DHS attor­neys, are work­ing to deter­mine how to respond to and pri­or­i­tize three con­flict­ing requests for infor­ma­tion about the miss­ing records from the House select com­mit­tee, the Nation­al Archives and the DHS inspec­tor gen­er­al.

    The Ser­vice told the com­mit­tee last week by phone about the need to pause coop­er­a­tion pri­or to the pan­el’s July 21 prime­time hear­ing, one of the sources said. The com­mit­tee had issued a sub­poe­na on July 15 to the Ser­vice for text mes­sages and oth­er records sur­round­ing Jan­u­ary 6.

    On July 20, Cuf­far­i’s office, which oper­ates inde­pen­dent­ly of DHS, told the Ser­vice to stop inves­ti­gat­ing the miss­ing records, say­ing that it could inter­fere with the inspec­tor gen­er­al’s own probe, which it wrote was an “ongo­ing crim­i­nal inves­ti­ga­tion.”

    In addi­tion to the Jan­u­ary 6 com­mit­tee’s sub­poe­na, the Nation­al Archives sep­a­rate­ly demand­ed that the Secret Ser­vice turn over rel­e­vant records and explain what might have hap­pened to any delet­ed text mes­sages.

    Sources famil­iar with the sit­u­a­tion said they were not sure how long it will take for Secret Ser­vice lawyers to deter­mine whether to share records with the com­mit­tee — and whether this would be resolved with­in a few days or stretch on for weeks.

    A source tells CNN the Secret Ser­vice is con­tin­u­ing to give records from old­er requests to the Com­mit­tee but acknowl­edged the agency has stopped any new inves­tiga­tive work to find the con­tent of text mes­sages that were lost.

    In a state­ment to CNN, a Secret Ser­vice spokesper­son said the agency “will con­tin­ue our unwa­ver­ing coop­er­a­tion with the Select Com­mit­tee and oth­er inquiries.”

    Reps. Zoe Lof­gren of Cal­i­for­nia and Elaine Luria of Vir­ginia, who serve on the Jan­u­ary 6 com­mit­tee, have both said pub­licly the Secret Ser­vice hand­ed over doc­u­ments this week. And the com­mit­tee’s chair­man, Demo­c­ra­t­ic Mis­sis­sip­pi Rep. Ben­nie Thomp­son, said Thurs­day that the pan­el received “sev­er­al hun­dred thou­sand” exhibits from the Secret Ser­vice two days ago. Thomp­son said the pan­el is still review­ing the mate­r­i­al and does­n’t know if it con­tains any new text mes­sages.

    When Cuf­fari met with the com­mit­tee two weeks ago, Thomp­son said, he did not tell the com­mit­tee that the poten­tial dele­tion of Secret Ser­vice text mes­sages from Jan­u­ary 5 and 6, 2021, was under crim­i­nal inves­ti­ga­tion.

    Thomp­son said he is still wait­ing to see how the crim­i­nal inves­ti­ga­tion impacts what infor­ma­tion the com­mit­tee can receive, but he does not believe the crim­i­nal inves­ti­ga­tion is affect­ing the com­mit­tee’s inves­ti­ga­tion at this point.

    “My under­stand­ing of the process is that if you’re involved in a crim­i­nal thing, that cer­tain infor­ma­tion that you’re not able to share,” Thomp­son said. “As to where the breaks are with respect to the crim­i­nal inves­ti­ga­tion, I guess we’ll just have to see at some point.”

    Nei­ther DHS nor the DHS Inspec­tor Gen­er­al’s Office respond­ed to a request for com­ment.

    Con­gres­sion­al calls for recusal

    The poten­tial impasse between the Secret Ser­vice and the Jan­u­ary 6 com­mit­tee comes after Thomp­son called for Cuf­fari to recuse him­self from the probe into the pos­si­ble dele­tion of text mes­sages.

    Thomp­son and Mal­oney sent a let­ter to Cuf­fari on Tues­day say­ing his fail­ure to inform Con­gress that the Secret Ser­vice was­n’t pro­vid­ing records “cast seri­ous doubt on his inde­pen­dence and his abil­i­ty to effec­tive­ly con­duct such an impor­tant inves­ti­ga­tion.”

    Asked Thurs­day if Cuf­fari was mis­lead­ing the com­mit­tee, Thomp­son said, “It appears that the IG is poten­tial­ly at issue with the con­duct of his inves­ti­ga­tion.”

    In a sign of the com­mu­ni­ca­tion break­down between con­gres­sion­al Democ­rats and Cuf­fari, the House Home­land Secu­ri­ty Com­mit­tee, which Thomp­son also chairs, was nev­er informed by the inspec­tor gen­er­al that he was con­duct­ing a crim­i­nal inves­ti­ga­tion into the Secret Ser­vice text mes­sages, accord­ing to a source famil­iar with the mat­ter.

    The miss­ing mes­sages explod­ed into pub­lic view this month when the inspec­tor gen­er­al revealed the issue in a let­ter to Con­gress. The let­ter came after Trump White House aide Cas­sidy Hutchin­son tes­ti­fied to the com­mit­tee about an angry con­fronta­tion Trump and his Secret Ser­vice detail on Jan­u­ary 6.

    Time­line takes shape

    The issue of the poten­tial miss­ing text mes­sages dates to Jan­u­ary 2021, when the Secret Ser­vice began its pre­vi­ous­ly planned phone data migra­tion.

    On Jan­u­ary 16, 2021, before the data migra­tion occurred, the chairs of four House com­mit­tees sent a let­ter to DHS and oth­er rel­e­vant agen­cies instruct­ing them to pre­serve records relat­ed to Jan­u­ary 6. While Secret Ser­vice is part of DHS, it remains unclear whether the agency received the guid­ance, which did not specif­i­cal­ly ref­er­ence them.

    A source famil­iar with the inves­ti­ga­tion told CNN the Secret Ser­vice spent rough­ly eight hours last week search­ing for the notice, but nev­er found it.

    Nine days after the let­ter was sent, the Secret Ser­vice sent a reminder to employ­ees that a data migra­tion would wipe employ­ees’ phones. The Jan­u­ary 25, 2021, notice to employ­ees made clear that employ­ees were respon­si­ble for sav­ing records.

    The Secret Ser­vice began the data migra­tion two days lat­er, on Jan­u­ary 27.

    A source told CNN the Secret Ser­vice real­ized too late that the data was per­ma­nent­ly delet­ed. The agency attempt­ed to retrieve lost text mes­sages from its cell­phone provider, but it was unable to do so, the source said.

    In June 2021, Cuf­fari request­ed records and texts from the 24 Secret Ser­vice employ­ees involved with rel­e­vant actions on Jan­u­ary 6. CNN has pre­vi­ous­ly report­ed that the heads of Trump and Pence’s secu­ri­ty details are among the 24 indi­vid­u­als.

    But then in July 2021, a deputy inspec­tor gen­er­al told the Depart­ment of Home­land Secu­ri­ty the office was no longer seek­ing the text mes­sages from the Secret Ser­vice, accord­ing to two sources.

    Sources told CNN the Secret Ser­vice believed the issue had con­clud­ed at that point. But the inspec­tor gen­er­al reopened his inquiry into the text mes­sages in Decem­ber 2021, one source said.

    Skep­ti­cism ris­ing

    While the Demo­c­ra­t­ic com­mit­tee chairs have ques­tioned whether Cuf­fari, who was appoint­ed by Trump in 2019, could lead the Secret Ser­vice inves­ti­ga­tion, House law­mak­ers on the select com­mit­tee have also raised sus­pi­cions over how the Secret Ser­vice might have allowed for mes­sages to be delet­ed after Jan­u­ary 6 — not­ing that mul­ti­ple con­gres­sion­al com­mit­tee had request­ed agency records before a phone migra­tion led to their pos­si­ble dele­tion.

    “Count me a skep­tic,” said Rep. Jamie Raskin, a Mary­land Demo­c­rat on the pan­el, on CBS’ “Late Show with Stephen Col­bert” on Mon­day. Raskin said that he does not believe “for one minute” that the Secret Ser­vice can­not find the texts the agents made on Jan­u­ary 6.

    CNN report­ed last week that the Secret Ser­vice had iden­ti­fied 10 indi­vid­u­als with meta­da­ta show­ing text mes­sages were sent or received around Jan­u­ary 6, and the agency was try­ing to deter­mine whether the con­tent con­tained rel­e­vant infor­ma­tion that should have been pre­served.

    The inspec­tor gen­er­al’s let­ter last week noti­fy­ing the Secret Ser­vice of the poten­tial crim­i­nal inves­ti­ga­tion halt­ed those efforts.

    The Secret Ser­vice sug­gest­ed in its state­ment acknowl­edg­ing the let­ter that it may not be able to com­ply with both the inspec­tor gen­er­al’s direc­tive and the com­mit­tee’s sub­poe­na. The agency said that it would “con­duct a thor­ough legal review to ensure we are ful­ly coop­er­a­tive with all over­sight efforts and that they do not con­flict with each oth­er.”

    ———-

    “Exclu­sive: DHS inspec­tor gen­er­al knew of miss­ing Secret Ser­vice texts months ear­li­er than pre­vi­ous­ly known” by Whit­ney Wild, Zachary Cohen, Jere­my Herb and Priscil­la Alvarez; CNN; 07/30/2022

    “Ear­li­er this month, Secret Ser­vice offi­cials told con­gres­sion­al com­mit­tees that DHS Inspec­tor Gen­er­al Joseph Cuf­fari, the depart­men­t’s inde­pen­dent watch­dog, was aware that texts had been erased in Decem­ber 2021. But sources tell CNN, the Secret Ser­vice had noti­fied Cuf­far­i’s office of miss­ing text mes­sages in May 2021, sev­en months ear­li­er.”

    Miss­ing doc­u­ment and a sto­ry that full of holes. Yep, we got our­selves a coverup. A coverup seem­ing­ly being car­ried out by the per­son tasked with iden­ti­fy­ing coverups. It’s a not a great look for DHS:

    ...
    The Secret Ser­vice now says the texts were lost as a result of a pre­vi­ous­ly sched­uled data migra­tion of its agents’ cell phones that began on Jan­u­ary 27, 2021, exact­ly three weeks after the attack on the US Capi­tol. After the data migra­tion was com­plet­ed, in May 2021 the Secret Ser­vice told Cuf­far­i’s office that they tried to con­tact a cel­lu­lar provider to retrieve the texts when they real­ized they were lost, a source told CNN.

    The source added that key Secret Ser­vice per­son­nel did­n’t real­ize data was per­ma­nent­ly lost until after the data migra­tion was com­plet­ed, and erro­neous­ly believed the data was backed up. In July 2021, inspec­tor gen­er­al inves­ti­ga­tors told DHS they were no longer seek­ing Secret Ser­vice text mes­sages, accord­ing to two sources. Cuf­far­i’s office then restart­ed its probe in Decem­ber 2021.
    ...

    It’s the kind of awful look that rais­es the obvi­ous ques­tion of how many oth­er coverup DHS are going on, which brings us to the oth­er new coverup scan­dal in this sto­ry: the recent rev­e­la­tion of miss­ing texts for the two top DHS offi­cials under for­mer Pres­i­dent Don­ald Trump — act­ing Sec­re­tary Chad Wolf and act­ing deputy sec­re­tary Ken Cuc­cinel­li — dur­ing the peri­od around Jan 6. Adding to the mys­tery is the fact that both Wolf and Cuc­cinel­li insist that they actu­al­ly pre­served their text mes­sages dur­ing the phone-switchover of Jan 2021. The clear impli­ca­tion from Wolf and Cuc­cinel­li is that some­one else delet­ed their texts after the fact. what is going on here?

    ...
    These new details come as Cuf­fari faces mount­ing pres­sure from key Democ­rats to hand off his inves­ti­ga­tion into the miss­ing mes­sages. They also come amid rev­e­la­tions that text mes­sages for the two top DHS offi­cials under for­mer Pres­i­dent Don­ald Trump — act­ing Sec­re­tary Chad Wolf and act­ing deputy sec­re­tary Ken Cuc­cinel­li — are miss­ing for a key peri­od lead­ing up to the Jan­u­ary 6 attack.

    The Wash­ing­ton Post first report­ed the miss­ing Wolf and Cuc­cinel­li texts, which were lost in a “reset” of their gov­ern­ment phones when they left their jobs in Jan­u­ary 2021 in prepa­ra­tion for the new Biden admin­is­tra­tion, accord­ing to the Post.

    Wolf said in a tweet Thurs­day that he “com­plied with all data reten­tion laws and returned all my equip­ment ful­ly loaded to the Depart­ment. Full stop. DHS has all my texts, emails, phone logs, sched­ules, etc. Any issues with miss­ing data needs to be addressed to DHS. To imply oth­er­wise is lazy report­ing.”
    ...

    And then we get to the utter­ly con­fus­ing and baf­fling time­line we are told about the Cuf­far­i’s 2021 inves­ti­ga­tions into this mat­ter: in June of 2021, Cuf­far­i’s office request­ed records an texts on 24 Secret Ser­vice agents rel­e­vant to Jan 6, but rescind­ed that request the next month, telling DHS the inspec­tor gen­er­al’s office was no longer look­ing into the mat­ter and con­sid­ered it closed. And as CNN report­ed last week, inves­ti­ga­tors had been work­ing to deter­mine whether the con­tent of the text mes­sages sent by the 10 per­son­nel con­tained rel­e­vant infor­ma­tion that should have been pre­served at the time when Cuf­fari issued that order to halt the inves­ti­ga­tion. So Cuf­far­i’s office effec­tive­ly stopped an ongo­ing inves­ti­ga­tion into miss­ing texts after evi­dence of some of those miss­ing texts had already been iden­ti­fied:

    ...
    A source told CNN the Secret Ser­vice real­ized too late that the data was per­ma­nent­ly delet­ed. The agency attempt­ed to retrieve lost text mes­sages from its cell­phone provider, but it was unable to do so, the source said.

    In June 2021, Cuf­fari request­ed records and texts from the 24 Secret Ser­vice employ­ees involved with rel­e­vant actions on Jan­u­ary 6. CNN has pre­vi­ous­ly report­ed that the heads of Trump and Pence’s secu­ri­ty details are among the 24 indi­vid­u­als.

    But then in July 2021, a deputy inspec­tor gen­er­al told the Depart­ment of Home­land Secu­ri­ty the office was no longer seek­ing the text mes­sages from the Secret Ser­vice, accord­ing to two sources.

    Sources told CNN the Secret Ser­vice believed the issue had con­clud­ed at that point. But the inspec­tor gen­er­al reopened his inquiry into the text mes­sages in Decem­ber 2021, one source said.

    ...

    CNN report­ed last week that the Secret Ser­vice had iden­ti­fied 10 indi­vid­u­als with meta­da­ta show­ing text mes­sages were sent or received around Jan­u­ary 6, and the agency was try­ing to deter­mine whether the con­tent con­tained rel­e­vant infor­ma­tion that should have been pre­served.
    ...

    And then there’s the fact that Cuf­far­i’s cur­rent inves­ti­ga­tion into the miss­ing texts is now being used as a pre­text for the Secret Ser­vice no longer coop­er­at­ing with the Jan 6 con­gres­sion­al inves­ti­ga­tors. It’s like inspec­tor gen­er­al gaslight­ing:

    ...
    Amid the height­ened scruti­ny, the Secret Ser­vice has cur­tailed its coop­er­a­tion with the Jan­u­ary 6 com­mit­tee relat­ed to the miss­ing texts, two sources tell CNN. Secret Ser­vice lawyers, along with DHS attor­neys, are work­ing to deter­mine how to respond to and pri­or­i­tize three con­flict­ing requests for infor­ma­tion about the miss­ing records from the House select com­mit­tee, the Nation­al Archives and the DHS inspec­tor gen­er­al.

    The Ser­vice told the com­mit­tee last week by phone about the need to pause coop­er­a­tion pri­or to the pan­el’s July 21 prime­time hear­ing, one of the sources said. The com­mit­tee had issued a sub­poe­na on July 15 to the Ser­vice for text mes­sages and oth­er records sur­round­ing Jan­u­ary 6.

    On July 20, Cuf­far­i’s office, which oper­ates inde­pen­dent­ly of DHS, told the Ser­vice to stop inves­ti­gat­ing the miss­ing records, say­ing that it could inter­fere with the inspec­tor gen­er­al’s own probe, which it wrote was an “ongo­ing crim­i­nal inves­ti­ga­tion.”

    In addi­tion to the Jan­u­ary 6 com­mit­tee’s sub­poe­na, the Nation­al Archives sep­a­rate­ly demand­ed that the Secret Ser­vice turn over rel­e­vant records and explain what might have hap­pened to any delet­ed text mes­sages.

    Sources famil­iar with the sit­u­a­tion said they were not sure how long it will take for Secret Ser­vice lawyers to deter­mine whether to share records with the com­mit­tee — and whether this would be resolved with­in a few days or stretch on for weeks.

    A source tells CNN the Secret Ser­vice is con­tin­u­ing to give records from old­er requests to the Com­mit­tee but acknowl­edged the agency has stopped any new inves­tiga­tive work to find the con­tent of text mes­sages that were lost.
    ...

    And, of course, it gets worse. The squelch­ing of that inves­ti­ga­tion back in July of 2021 was appar­ent­ly just a warm up act. We’re also learn­ing about an offer made in Feb­ru­ary of this year to the entire DHS by Cuf­far­i’s office made of foren­sic help in retriev­ing data lost on devices. An offer rescind­ed lat­er that month.

    And it gets even worse: we’re also learn­ing that the top two offi­cials at DHS dur­ing the peri­od around Jan 6 — Trump’s act­ing home­land secu­ri­ty sec­re­tary Chad Wolf and act­ing deputy sec­re­tary Ken Cuc­cinel­li — have miss­ing texts of their own. Texts they both insist were nev­er delet­ed from their phones. So either Wolf and Cuc­cinel­li are lying, or some­one in DHS delet­ed those mes­sages for them after the fact. Either way, it’s one hel­lu­va coverup:

    The Wash­ing­ton Post

    Home­land Secu­ri­ty watch­dog halt­ed plan to recov­er Secret Ser­vice texts, records show

    By Maria Sac­chet­ti and Car­ol D. Leon­nig
    July 29, 2022 at 9:51 p.m. EDT

    The Depart­ment of Home­land Security’s chief watch­dog scrapped its inves­tiga­tive team’s effort to col­lect agency phones to try to recov­er delet­ed Secret Ser­vice texts this year, accord­ing to four peo­ple with knowl­edge of the deci­sion and inter­nal records reviewed by The Wash­ing­ton Post.

    In ear­ly Feb­ru­ary, after learn­ing that the Secret Service’s text mes­sages had been erased as part of a migra­tion to new devices, staff at Inspec­tor Gen­er­al Joseph V. Cuffari’s office planned to con­tact all DHS agen­cies offer­ing to have data spe­cial­ists help retrieve mes­sages from their phones, accord­ing to two gov­ern­ment whistle­blow­ers who pro­vid­ed reports to Con­gress.

    But lat­er that month, Cuffari’s office decid­ed it would not col­lect or review any agency phones, accord­ing to three peo­ple briefed on the deci­sion.

    The lat­est rev­e­la­tion comes as Demo­c­ra­t­ic law­mak­ers have accused Cuffari’s office of fail­ing to aggres­sive­ly inves­ti­gate the agency’s actions in response to the vio­lent attack on the Capi­tol by sup­port­ers of then-Pres­i­dent Don­ald Trump on Jan. 6, 2021.

    Cuf­fari wrote a let­ter to the House and Sen­ate Home­land Secu­ri­ty com­mit­tees this month say­ing the Secret Service’s text mes­sages from the time of the attack had been “erased.” But he did not imme­di­ate­ly dis­close that his office first dis­cov­ered that dele­tion in Decem­ber and failed to alert law­mak­ers or exam­ine the phones. Nor did he alert Con­gress that oth­er text mes­sages were miss­ing, includ­ing those of the two top Trump appointees run­ning the Depart­ment of Home­land Secu­ri­ty dur­ing the final days of the admin­is­tra­tion.

    ...

    Cuf­fari, a for­mer advis­er to Ari­zona Gov. Doug Ducey ®, has been in his post since July 2019 after being nom­i­nat­ed by Trump.

    ...

    After dis­cov­er­ing that some of the text mes­sages the watch­dog sought had been delet­ed, the Fed­er­al Pro­tec­tive Ser­vice, a DHS agency that guards fed­er­al build­ings, offered their phones to the inspec­tor general’s inves­ti­ga­tors, say­ing they lacked the resources to recov­er lost texts and oth­er records on their own, accord­ing to three peo­ple famil­iar with the plan who spoke on the con­di­tion of anonymi­ty to dis­cuss a sen­si­tive inves­ti­ga­tion.

    A senior foren­sics ana­lyst in the inspec­tor general’s office took steps to col­lect the Fed­er­al Pro­tec­tive Ser­vice phones, the peo­ple said. But late on the night of Fri­day, Feb. 18, one of sev­er­al deputies who report to Cuffari’s man­age­ment team wrote an email to inves­ti­ga­tors instruct­ing them not to take the phones and not to seek any data from them, accord­ing to a copy of an inter­nal record that was shared with The Post.

    Staff inves­ti­ga­tors also draft­ed a let­ter in late Jan­u­ary and ear­ly Feb­ru­ary to all DHS agen­cies offer­ing to help recov­er any text mes­sages or oth­er data that might have been lost. But Cuffari’s man­age­ment team lat­er changed that draft to say that if agen­cies could not retrieve phone mes­sages for the Jan. 6 peri­od, they “should pro­vide a detailed list of unavail­able data and the rea­son the infor­ma­tion is unavail­able,” the three peo­ple said.

    Cuf­fari also learned in late Feb­ru­ary that text mes­sages for the top two offi­cials at DHS under the Trump admin­is­tra­tion on the day of the attack were miss­ing, lost in a “reset” of their gov­ern­ment phones when they left their jobs in Jan­u­ary 2021, accord­ing to an inter­nal record obtained by the Project on Gov­ern­ment Over­sight. But Cuf­fari did not press the department’s lead­er­ship to explain why they did not pre­serve these records, nor try to recov­er them, accord­ing to the four peo­ple briefed on the watchdog’s actions. Cuf­fari also did not alert Con­gress to the miss­ing records.

    These and oth­er dis­crep­an­cies prompt­ed key Democ­rats scru­ti­niz­ing the attack and the Depart­ment of Home­land Secu­ri­ty to issue a sub­poe­na to the Secret Ser­vice and to call for Cuf­fari to recuse him­self from the inves­ti­ga­tion.

    Reps. Ben­nie G. Thomp­son (D‑Miss.), chair of the House Home­land Secu­ri­ty Com­mit­tee and the com­mit­tee inves­ti­gat­ing the Jan. 6 attack, and Car­olyn B. Mal­oney (D‑N.Y.), chair of the com­mit­tee that over­sees inspec­tors gen­er­al, said in a let­ter to Cuf­fari on Tues­day that they “do not have con­fi­dence” that he can con­duct the inves­ti­ga­tion.

    Sen. Richard J. Durbin (D‑Ill.), chair of the Sen­ate Judi­cia­ry Com­mit­tee, issued a state­ment Fri­day call­ing the miss­ing mes­sages “an extreme­ly seri­ous mat­ter” and said he would ask the Jus­tice Depart­ment to inter­vene.

    “Inspec­tor Gen­er­al Cuffari’s fail­ure to take imme­di­ate action upon learn­ing that these text mes­sages had been delet­ed makes clear that he should no longer be entrust­ed with this inves­ti­ga­tion,” Durbin said in a state­ment. “That’s why I’m send­ing a let­ter today to Attor­ney Gen­er­al Gar­land ask­ing him to step in and get to the bot­tom of what hap­pened to these text mes­sages and hold account­able those who are respon­si­ble.”

    Cuf­fari was asked to answer the law­mak­ers by Aug. 9.

    Cuf­fari opened a crim­i­nal inves­ti­ga­tion into the Secret Service’s miss­ing text mes­sages this month, one of dozens of inquiries his office does as part of its work over­see­ing the Depart­ment of Home­land Secu­ri­ty, the nation’s third-largest agency. Many, includ­ing Democ­rats in Con­gress, viewed the tim­ing and motive for the inquiry with sus­pi­cion, as Cuf­fari had not pushed to probe the fact that the records were delet­ed when he first learned of it months ear­li­er. DHS encom­pass­es agen­cies such as the Secret Ser­vice, the Fed­er­al Pro­tec­tive Ser­vice and immi­gra­tion and bor­der pro­tec­tion.

    Three peo­ple briefed on his han­dling of the miss­ing text mes­sages paint­ed a por­trait of an office that fal­tered over how to han­dle the mat­ter, even though they had high­ly skilled offi­cials ready to attack the issue and fed­er­al agen­cies will­ing to coop­er­ate.

    A for­mer senior exec­u­tive at the inspec­tor general’s office who left the agency this year said Cuffari’s office instruct­ed the exec­u­tive to call the agency’s top foren­sic expert on a Sat­ur­day ear­ly this year to tell him to “stand down” on pur­su­ing the foren­sics work for the Secret Service’s phones.

    “That was done at the direc­tion of the inspec­tor general’s front office,” the for­mer senior exec­u­tive said, speak­ing on the con­di­tion of anonymi­ty because they are no longer at the office.

    Cuffari’s office has con­tin­ued to issue reports and, on the day the law­mak­ers called for him to step aside, tweet­ed about awards that they had won for inspec­tions. The awards are from the Coun­cil of the Inspec­tors Gen­er­al on Integri­ty and Effi­cien­cy, an inde­pen­dent exec­u­tive agency that sup­ports inspec­tors gen­er­al.

    In their let­ter, Thomp­son and Mal­oney asked the coun­cil to find a replace­ment for Cuf­fari on the inves­ti­ga­tion into the miss­ing Secret Ser­vice texts.

    The coun­cil said it could only help find a replace­ment if Cuf­fari decid­ed to recuse him­self and asked them for assis­tance find­ing a replace­ment, its exec­u­tive direc­tor, Alan F. Boehm, said in an email.

    Cuf­fari sent a let­ter to the House and Sen­ate Home­land Secu­ri­ty com­mit­tees this month accus­ing the Secret Ser­vice of eras­ing text mes­sages from the time around the assault on the Capi­tol and after he had asked for them for his own inves­ti­ga­tion.

    The Secret Ser­vice denied mali­cious­ly eras­ing text mes­sages and said the dele­tions were part of a pre­planned “sys­tem migra­tion” of its phones. They said none of the texts Cuffari’s office sought had dis­ap­peared.

    The Fed­er­al Records Act and oth­er laws require fed­er­al agen­cies to pre­serve gov­ern­ment records, and it is a crime, pun­ish­able by fines and prison time, to will­ful­ly destroy gov­ern­ment records.

    In addi­tion to the Secret Ser­vice, text mes­sages for Trump act­ing home­land secu­ri­ty sec­re­tary Chad Wolf and act­ing deputy sec­re­tary Ken Cuc­cinel­li are miss­ing for a key peri­od lead­ing up to the Jan. 6 attack, accord­ing to four peo­ple briefed on the mat­ter and inter­nal emails.

    But Cuc­cinel­li and Wolf both said they turned in their phones, as Wolf put it in a tweet, “ful­ly loaded,” and said it was up to DHS to pre­serve their mes­sages.

    On Twit­ter, Wolf wrote: “I com­plied with all data reten­tion laws and returned all my equip­ment ful­ly loaded to the Depart­ment. Full stop. DHS has all my texts, emails, phone logs, sched­ules, etc. Any issues with miss­ing data needs to be addressed to DHS.”

    Cuc­cinel­li, also on Twit­ter, said he hand­ed in his phone before depart­ing DHS and sug­gest­ed that the agency “erased” his phone after he left.

    The Nation­al Archives and Records Admin­is­tra­tion has sought more infor­ma­tion on “the poten­tial unau­tho­rized dele­tion” of Secret Ser­vice text mes­sages, but that inquiry could be delayed by Cuffari’s crim­i­nal inves­ti­ga­tion into the agency. The archives had no imme­di­ate com­ment Fri­day about Wolf and Cuccinelli’s text mes­sages.

    ———–

    “Home­land Secu­ri­ty watch­dog halt­ed plan to recov­er Secret Ser­vice texts, records show” By Maria Sac­chet­ti and Car­ol D. Leon­nig; The Wash­ing­ton Post; 07/29/2022

    “Cuf­fari wrote a let­ter to the House and Sen­ate Home­land Secu­ri­ty com­mit­tees this month say­ing the Secret Service’s text mes­sages from the time of the attack had been “erased.” But he did not imme­di­ate­ly dis­close that his office first dis­cov­ered that dele­tion in Decem­ber and failed to alert law­mak­ers or exam­ine the phones. Nor did he alert Con­gress that oth­er text mes­sages were miss­ing, includ­ing those of the two top Trump appointees run­ning the Depart­ment of Home­land Secu­ri­ty dur­ing the final days of the admin­is­tra­tion.”

    As we can see, the pri­or June 2021 request by Cuf­far­i’s office for miss­ing texts — which was rescind­ed the fol­low­ing month — described in the pre­vi­ous CNN arti­cle was just one of a num­ber of appar­ent episodes where Cuf­far­i’s office was qui­et­ly becom­ing aware of miss­ing texts only to qui­et­ly close the inves­ti­ga­tion lat­er. In ear­ly Feb 2022, plans were made in Cuf­far­i’s office to con­tact ALL DHS agen­cies with an offer to help foren­si­cal­ly retrieve mes­sages from their phone. A plan that was scrapped the next month. It’s like plans to actu­al­ly inves­ti­gate Jan 6 could­n’t sur­vive more than a month in cuf­far­i’s office. We’re even told that it was Cuf­far­i’s office made explic­it orders to the agen­cy’s top foren­sic expert to tell him to “stand down” on pur­su­ing the foren­sics work for the Secret Service’s phones. Cuf­far­i’s office has killed this inves­ti­ga­tion mul­ti­ple times. That’s pret­ty damn guilty behav­ior. So guilty we have to ask: is James Cuf­fari — a for­mer advis­er to Repub­li­can Ari­zona Gov. Doug Ducey who was appoint­ed to the office in 2019 by Don­ald Trump — run­ning par­ti­san polit­i­cal inter­fer­ence for his par­ty? It sure looks exact­ly like that’s what’s hap­pen­ing. The inspec­tor gen­er­al of DHS has been secret­ly run­ning inter­fer­ence for his par­ty. Inter­fer­ence into the inves­ti­ga­tion of his par­ty’s attempt­ed to coup. It’s hard to come up with a more emblem­at­ic exam­ple of the deep rot infect­ing the basic oper­a­tions of the US gov­ern­ment:

    ...
    In ear­ly Feb­ru­ary, after learn­ing that the Secret Service’s text mes­sages had been erased as part of a migra­tion to new devices, staff at Inspec­tor Gen­er­al Joseph V. Cuffari’s office planned to con­tact all DHS agen­cies offer­ing to have data spe­cial­ists help retrieve mes­sages from their phones, accord­ing to two gov­ern­ment whistle­blow­ers who pro­vid­ed reports to Con­gress.

    But lat­er that month, Cuffari’s office decid­ed it would not col­lect or review any agency phones, accord­ing to three peo­ple briefed on the deci­sion.

    The lat­est rev­e­la­tion comes as Demo­c­ra­t­ic law­mak­ers have accused Cuffari’s office of fail­ing to aggres­sive­ly inves­ti­gate the agency’s actions in response to the vio­lent attack on the Capi­tol by sup­port­ers of then-Pres­i­dent Don­ald Trump on Jan. 6, 2021.

    ...

    Cuf­fari, a for­mer advis­er to Ari­zona Gov. Doug Ducey ®, has been in his post since July 2019 after being nom­i­nat­ed by Trump.

    ...

    Cuf­fari opened a crim­i­nal inves­ti­ga­tion into the Secret Service’s miss­ing text mes­sages this month, one of dozens of inquiries his office does as part of its work over­see­ing the Depart­ment of Home­land Secu­ri­ty, the nation’s third-largest agency. Many, includ­ing Democ­rats in Con­gress, viewed the tim­ing and motive for the inquiry with sus­pi­cion, as Cuf­fari had not pushed to probe the fact that the records were delet­ed when he first learned of it months ear­li­er. DHS encom­pass­es agen­cies such as the Secret Ser­vice, the Fed­er­al Pro­tec­tive Ser­vice and immi­gra­tion and bor­der pro­tec­tion.

    ...

    Three peo­ple briefed on his han­dling of the miss­ing text mes­sages paint­ed a por­trait of an office that fal­tered over how to han­dle the mat­ter, even though they had high­ly skilled offi­cials ready to attack the issue and fed­er­al agen­cies will­ing to coop­er­ate.

    A for­mer senior exec­u­tive at the inspec­tor general’s office who left the agency this year said Cuffari’s office instruct­ed the exec­u­tive to call the agency’s top foren­sic expert on a Sat­ur­day ear­ly this year to tell him to “stand down” on pur­su­ing the foren­sics work for the Secret Service’s phones.

    “That was done at the direc­tion of the inspec­tor general’s front office,” the for­mer senior exec­u­tive said, speak­ing on the con­di­tion of anonymi­ty because they are no longer at the office.
    ...

    It also sounds anoth­er DHS agency — the Fed­er­al Pro­tec­tive Ser­vice, which is tasked with pro­tect­ing fed­er­al build­ings — offered to have its phones foren­si­cal­ly exam­ined in Feb­ru­ary, and that foren­sic data recov­ery process was indeed start­ed. Until Cuf­far­i’s office end­ed it on Feb 18 with instruc­tions not to take the phones are seek any data from them. And that was just one exam­ple of how Cuf­far­i’s office was active­ly thwart­ing any foren­sic exam­i­na­tion of these phones:

    ...
    DHS spokes­woman Mar­sha Espinosa said the agency is coop­er­at­ing with inves­ti­ga­tors and “look­ing into every avenue to recov­er text mes­sages and oth­er mate­ri­als for the Jan. 6 inves­ti­ga­tions.”

    After dis­cov­er­ing that some of the text mes­sages the watch­dog sought had been delet­ed, the Fed­er­al Pro­tec­tive Ser­vice, a DHS agency that guards fed­er­al build­ings, offered their phones to the inspec­tor general’s inves­ti­ga­tors, say­ing they lacked the resources to recov­er lost texts and oth­er records on their own, accord­ing to three peo­ple famil­iar with the plan who spoke on the con­di­tion of anonymi­ty to dis­cuss a sen­si­tive inves­ti­ga­tion.

    A senior foren­sics ana­lyst in the inspec­tor general’s office took steps to col­lect the Fed­er­al Pro­tec­tive Ser­vice phones, the peo­ple said. But late on the night of Fri­day, Feb. 18, one of sev­er­al deputies who report to Cuffari’s man­age­ment team wrote an email to inves­ti­ga­tors instruct­ing them not to take the phones and not to seek any data from them, accord­ing to a copy of an inter­nal record that was shared with The Post.

    Staff inves­ti­ga­tors also draft­ed a let­ter in late Jan­u­ary and ear­ly Feb­ru­ary to all DHS agen­cies offer­ing to help recov­er any text mes­sages or oth­er data that might have been lost. But Cuffari’s man­age­ment team lat­er changed that draft to say that if agen­cies could not retrieve phone mes­sages for the Jan. 6 peri­od, they “should pro­vide a detailed list of unavail­able data and the rea­son the infor­ma­tion is unavail­able,” the three peo­ple said.
    ...

    And it was late Feb­ru­ary, not long after Cuf­far­i’s office squashed the DHS-wide offer for foren­sic data recov­ery of lost data, that Cuf­fari report­ed­ly learned that the text mes­sages for Char Wolf and Ken Cuc­cinel­li were miss­ing. And yet both Wolf and Cuc­cinel­li insist that they nev­er delet­ed any mes­sages any returned their phones to DHS with all of the con­tents intact. So either Wolf and Cuc­cinel­li are both lying and decid­ed to deflect blame on some­one involved with inves­ti­ga­tion, or some­one else at DHS delet­ed those mes­sages:

    ...
    Cuf­fari also learned in late Feb­ru­ary that text mes­sages for the top two offi­cials at DHS under the Trump admin­is­tra­tion on the day of the attack were miss­ing, lost in a “reset” of their gov­ern­ment phones when they left their jobs in Jan­u­ary 2021, accord­ing to an inter­nal record obtained by the Project on Gov­ern­ment Over­sight. But Cuf­fari did not press the department’s lead­er­ship to explain why they did not pre­serve these records, nor try to recov­er them, accord­ing to the four peo­ple briefed on the watchdog’s actions. Cuf­fari also did not alert Con­gress to the miss­ing records.

    ...

    In addi­tion to the Secret Ser­vice, text mes­sages for Trump act­ing home­land secu­ri­ty sec­re­tary Chad Wolf and act­ing deputy sec­re­tary Ken Cuc­cinel­li are miss­ing for a key peri­od lead­ing up to the Jan. 6 attack, accord­ing to four peo­ple briefed on the mat­ter and inter­nal emails.

    But Cuc­cinel­li and Wolf both said they turned in their phones, as Wolf put it in a tweet, “ful­ly loaded,” and said it was up to DHS to pre­serve their mes­sages.

    On Twit­ter, Wolf wrote: “I com­plied with all data reten­tion laws and returned all my equip­ment ful­ly loaded to the Depart­ment. Full stop. DHS has all my texts, emails, phone logs, sched­ules, etc. Any issues with miss­ing data needs to be addressed to DHS.”

    Cuc­cinel­li, also on Twit­ter, said he hand­ed in his phone before depart­ing DHS and sug­gest­ed that the agency “erased” his phone after he left.
    ...

    So with Cuf­far­i’s office squash­ing its own offers for a foren­sic recov­ery of lost texts, we have to ask: why can’t these texts be recov­ered by the cell phone ser­vice providers? We got an answer to that ques­tion in a recent report out of Politi­co that adds some impor­tant tech­ni­cal infor­ma­tion about the sit­u­a­tion: while reg­u­lar text mes­sages are indeed recov­er­able via cell phone providers, the iMes­sage texts sent between iPhones are encrypt­ed and only acces­si­ble via the phone itself. And it also hap­pens to be the case that Secret Ser­vice agents are issued iPhones. So it sounds like it’s real­ly just the iMes­sages that should­n’t be recov­er­able. And yet, as we’ve seen, only a sin­gle text was ever turned over by the 24 Secret Ser­vice agents in ques­tion. So with only iMes­sages being the­o­ret­i­cal­ly unre­cov­er­able with­out access to the phone, how is it fea­si­ble that only a sin­gle text was recov­ered? It’s the kind of detail that lends cre­dence to the accu­sa­tions by Wolf and Cuc­cinel­li that some­one else inside DHS has been active­ly delet­ing recov­er­able texts:

    Politi­co

    Secret Ser­vice may dis­able iMes­sages to avoid repeat of Jan. 6 con­tro­ver­sy

    The agency is weigh­ing the trade-offs of restrict­ing how employ­ees can text on their work phones.

    By Eric Geller
    07/29/2022 07:32 PM EDT

    The Secret Ser­vice is con­sid­er­ing turn­ing off employ­ees’ abil­i­ty to send iMes­sages on their work-issued iPhones, hop­ing to head off repeats of the cur­rent con­tro­ver­sy embroil­ing the agency over delet­ed text mes­sages relat­ed to the Jan. 6 insur­rec­tion at the Capi­tol.

    “This is actu­al­ly some­thing we are look­ing at very close­ly,” Secret Ser­vice spokesper­son Antho­ny Gugliel­mi said. “Direc­tor James Mur­ray has ordered a bench­mark­ing study to fur­ther exam­ine the fea­si­bil­i­ty of dis­abling iMes­sage and whether it could have any oper­a­tional impacts.”

    Gugliel­mi said Mur­ray ordered the review “ear­li­er this week.”

    Miss­ing text mes­sages have become a recent flash­point in inves­ti­ga­tions into the Jan. 6, 2021, riot.

    On July 13, the DHS inspec­tor gen­er­al informed Con­gress that the Secret Ser­vice lost texts relat­ed to the attack while eras­ing its employ­ees’ phones as part of a change to how it man­ages those devices. That rev­e­la­tion prompt­ed the House com­mit­tee inves­ti­gat­ing the attack to sub­poe­na the agency for its records. The panel’s lead­ers sug­gest­ed that the agency may have vio­lat­ed fed­er­al records laws laws by fail­ing to pre­serve the mes­sages.

    The phone resets occurred as the Secret Ser­vice was imple­ment­ing a new mobile device man­age­ment plat­form, a tech­nol­o­gy that employ­ers use to cen­tral­ly man­age and pre­serve emails, pho­tos and oth­er data stored on employ­ees’ phones. Apple’s iMes­sages can­not be backed up by this sys­tem, because they are encrypt­ed and stored on users’ devices, unlike reg­u­lar text mes­sages.

    Because of this issue, the Secret Ser­vice couldn’t store iMes­sages in a cen­tral loca­tion the way it man­aged its email sys­tem and oth­er tech­nolo­gies. Thus, when indi­vid­ual agents failed to man­u­al­ly back up their data before their phones were erased and recon­fig­ured for the new man­age­ment sys­tem, the only copies of those iMes­sages were lost.

    Reg­u­lar text mes­sages could also be among those sought by Jan. 6 inves­ti­ga­tors and believed lost, depend­ing on how well the Secret Ser­vice was cen­tral­ly back­ing them up.

    Cyber­se­cu­ri­ty experts have expressed amaze­ment that the Secret Ser­vice, which in addi­tion to its well-known mis­sion of pro­tect­ing the pres­i­dent also leads many com­plex cyber­crime inves­ti­ga­tions, could fail to pre­serve dig­i­tal data cru­cial to under­stand­ing its own role in one of the most stun­ning episodes of polit­i­cal vio­lence in Amer­i­can his­to­ry.

    ...

    When it comes to han­dling iMes­sages, the Secret Ser­vice fol­lows its par­ent department’s pro­to­cols, and accord­ing to for­mer CISA Direc­tor Chris Krebs, DHS has not dis­abled the fea­ture. Krebs said that the White House has dis­abled iMes­sages. DHS and the White House did not respond to requests for com­ment.

    The Secret Ser­vice is con­cerned that dis­abling iMes­sages could ham­per emer­gency com­mu­ni­ca­tions with oth­er agen­cies that rely on text mes­sag­ing. Gugliel­mi not­ed that the Capi­tol Police chief texted a Secret Ser­vice offi­cial ask­ing for help on Jan. 6. It is unclear if this mes­sage — the only one that the agency turned over to House inves­ti­ga­tors — was sent as an iMes­sage.

    “We want to make sure what­ev­er pol­i­cy action we take does not adverse­ly impact our pro­tec­tive or inves­tiga­tive mis­sions,” Gugliel­mi said. He added that the Secret Ser­vice is “look­ing at oth­er tech­no­log­i­cal solu­tions.” He did not pro­vide fur­ther details.

    The firestorm engulf­ing the Secret Ser­vice rep­re­sents the lat­est scan­dal plagu­ing the pro­tec­tive agency fol­low­ing years of secu­ri­ty laps­es. Secret Ser­vice agents have been recalled from over­seas trips for bring­ing sex work­ers to their hotel rooms, and peo­ple have jumped the White House fence and bypassed numer­ous secu­ri­ty mea­sures before being appre­hend­ed, with one per­son mak­ing it into the exec­u­tive man­sion

    ———-

    “Secret Ser­vice may dis­able iMes­sages to avoid repeat of Jan. 6 con­tro­ver­sy” by Eric Geller; Politi­co; 07/29/2022

    “The phone resets occurred as the Secret Ser­vice was imple­ment­ing a new mobile device man­age­ment plat­form, a tech­nol­o­gy that employ­ers use to cen­tral­ly man­age and pre­serve emails, pho­tos and oth­er data stored on employ­ees’ phones. Apple’s iMes­sages can­not be backed up by this sys­tem, because they are encrypt­ed and stored on users’ devices, unlike reg­u­lar text mes­sages”

    Well, at least we have a some­what viable tech­ni­cal expla­na­tion for why the Secret Ser­vice agents’ text mes­sages may be gen­uine­ly lost for­ev­er: if they were using iPhones, those text mes­sages are encrypt­ed and there­fore inac­ces­si­ble to cell-phone providers. And it sounds like Secret Ser­vice agents were indeed giv­en gov­ern­ment-issued iPhones. Now, iMes­sage sys­tem that encrypts mes­sages is only used when com­mu­ni­cat­ing with anoth­er iOS device, e.g. anoth­er iPhone. So it sounds like any text mes­sages sent from oth­er iPhones are pos­si­bly lost for­ev­er, while mes­sages sent to or from non-iPhones should, in the­o­ry, be acces­si­ble through var­i­ous means, includ­ing from the cell-phone ser­vice providers. That’s an impor­tant detail to keep in mind in the con­text Cuf­far­i’s office deci­sion back in Feb­ru­ary to rescind its agency-wide offer of foren­sic exam­i­na­tions of devices. We have every rea­son to sus­pect that at least some of the mes­sages should be tech­ni­cal­ly retriev­able:

    ...
    Because of this issue, the Secret Ser­vice couldn’t store iMes­sages in a cen­tral loca­tion the way it man­aged its email sys­tem and oth­er tech­nolo­gies. Thus, when indi­vid­ual agents failed to man­u­al­ly back up their data before their phones were erased and recon­fig­ured for the new man­age­ment sys­tem, the only copies of those iMes­sages were lost.

    Reg­u­lar text mes­sages could also be among those sought by Jan. 6 inves­ti­ga­tors and believed lost, depend­ing on how well the Secret Ser­vice was cen­tral­ly back­ing them up.

    Cyber­se­cu­ri­ty experts have expressed amaze­ment that the Secret Ser­vice, which in addi­tion to its well-known mis­sion of pro­tect­ing the pres­i­dent also leads many com­plex cyber­crime inves­ti­ga­tions, could fail to pre­serve dig­i­tal data cru­cial to under­stand­ing its own role in one of the most stun­ning episodes of polit­i­cal vio­lence in Amer­i­can his­to­ry.
    ...

    Are the iMes­sages from those wiped Secret Ser­vice phones tru­ly lost for­ev­er? That’s cer­tain­ly what Cuf­far­i’s office would like us to believe. And who knows, maybe it’s true. But as the fol­low­ing pair of arti­cles remind us, it’s not like those Secret Ser­vice agents were nec­es­sar­i­ly the only enti­ties with access to their iPhones. This is the age of the mega-hack, after all, includ­ing the the twin mega-hacks of the Solar­Winds hack that start­ed as ear­ly as the Spring of 2020 and the Microsoft Exchange hack that appar­ent­ly start­ed on Jan­u­ary 3, three days before the insur­rec­tion. And the US gov­ern­ment appears to have been heav­i­ly hit by both of mega-hacks.

    So we have to ask: is it pos­si­ble that any of groups behind the mega-hacks of 2021 man­aged to get their hands on these miss­ing texts? Well, recall how the Solar­Winds hack gave back­door access cor­po­rate net­works — which could poten­tial­ly be use­ful for steal­ing infor­ma­tion like reg­u­lar text mes­sages stored on cell phone provider net­works — while the Microsoft Exchange Hack gave access to mas­sive troves of emails. So those two mega-hacks did­n’t appear to give direct access to some­thing like encrypt­ed iMes­sages text mes­sages stored on iPhones.

    But as we’ve seen, the mega-hack of Solar­Wind­s’s cor­po­rate client net­works was­n’t the only hack attrib­uted to the ‘Nobel­li­um’ hack­ing group last year. There was also the hack tar­get­ing iOS devices using fake LinkedIn email invites dis­cov­ered in March of 2021. When some­one clicked on the fake LinkedIn link, they were tak­en a fake land­ing page that secret­ly down­loaded all sorts mal­ware that enabled the cap­ture of cre­den­tial­ing cook­ies for all sorts of web­sites. In oth­er words, this hack that tar­get­ed iPhones does­n’t appear to allow for the lift­ing of iMes­sages off those phones, but it would allow for the poten­tial hack­ing of all sorts of accounts for sites like GMail, Yahoo Mail, and plen­ty of oth­er poten­tial­ly sen­si­tive accounts. And as the fol­low­ing arti­cle reminds us, this faked LinkedIn hack­ing cam­paign was appar­ent­ly focused on the employ­ees of West­ern gov­ern­ments. So while the Solar­Winds hack­ers may or may not have gained access to any of those miss­ing text mes­saged relat­ed to Jan 6, they could have still accessed plen­ty of oth­er infor­ma­tion relat­ed to that day as long as that infor­ma­tion was acces­si­ble via web ser­vice the agents accessed through a brows­er over their phones:

    Hack­read

    Solar­Winds hack­ers exploit­ed iOS 0‑day to com­pro­mise iPhones

    Accord­ing to Google, Solar­Winds hack­ers exploit­ed an iOS 0‑day vul­ner­a­bil­i­ty to hack iPhones and made mil­lions from tar­get­ing phones world­wide.

    byDee­ba Ahmed
    July 16, 2021

    Google pub­lished a report on Wednes­day to share details of its lat­est find­ings on the Solar­Winds sup­ply chain attack dis­cov­ered in 2020.

    The lat­est rev­e­la­tion is that Solar­Winds hack­ers learned about and exploit­ed an iOS zero-day vul­ner­a­bil­i­ty (tracked as CVE-2021–1879), which resided in the brows­er engine WebKit, to com­pro­mise updat­ed iPhones and made mil­lions from tar­get­ing phones world­wide.

    ...

    West­ern Euro­pean Gov­ern­ments the Key Tar­gets

    This cyber­at­tack was report­ed­ly part of an email cam­paign launched to steal web secu­ri­ty cre­den­tials from West­ern Euro­pean gov­ern­ments. The hack­ers sent mes­sages to gov­ern­ment offi­cials via LinkedIn.

    Google’s Threat Analy­sis Group head, Shane Hunt­ley, con­firmed that there’s indeed a con­nec­tion between USAID attacks and iOS zero-day, despite the two entire­ly dif­fer­ent cam­paigns.

    Both Win­dows and iOS Tar­get­ed

    Microsoft researchers revealed that that Nobeli­um, the name the com­pa­ny uses to refer to Solar­Winds attack­ers, sent mal­ware to Win­dows users as well. They first com­pro­mised a USAID account that belonged to an online mar­ket­ing com­pa­ny called Con­stant Con­tact.

    They, then, sent emails using this account to address­es belong­ing to the US civil­ian for­eign aid and devel­op­ment assis­tance admin­is­ter­ing orga­ni­za­tion.

    On the oth­er hand, the attack­ers tar­get­ed iOS ver­sions 12.4 to 13.7. In this cam­paign, they redi­rect­ed users to domains that deployed mali­cious pay­loads even to updat­ed iPhones.

    These pay­loads were tasked to col­lect authen­ti­ca­tion cook­ies from var­i­ous web­sites, includ­ing Face­book, LinkedIn, Google, and Yahoo. The data was lat­er sent to the hack­er through a Web­Sock­et.

    ———–

    “Solar­Winds hack­ers exploit­ed iOS 0‑day to com­pro­mise iPhones” by Dee­ba Ahmed; Hack­read; 07/16/2021

    “This cyber­at­tack was report­ed­ly part of an email cam­paign launched to steal web secu­ri­ty cre­den­tials from West­ern Euro­pean gov­ern­ments. The hack­ers sent mes­sages to gov­ern­ment offi­cials via LinkedIn.”

    Did the Solar­Winds hack­ers break into any of those Secret Ser­vice iPhones dur­ing the peri­od around Jan 6? Let’s hope inves­ti­ga­tors are final­ly allowed to ask these kinds of ques­tions.

    But, of course, if we’re talk­ing about the hack­ing if iPhones, we can’t just be look­ing at groups like Nobel­li­um of Hafni­um that were attrib­uted with pulling off the Solar­Winds and Microsoft Exchange hacks. Gov­ern­ments around the world have had unstop­pable ‘zero-click’ iPhone super-hacks for years: NSO Group’s Pega­sus spy­ware.

    Of course, as we’ve also seen, there was the osten­si­ble block built into that Spy­ware that was sup­posed to pre­vent it from hack­ing US-based phones with a “+1” phone num­ber. And it seems rea­son­able to assume Secret Ser­vice had iPhones with US-based phone num­bers. So in the­o­ry, the phones of the 24 Secret Ser­vice agents in ques­tion — and any­one else work­ing at DHS — would have been safe from a Pega­sus hack. But, of course, as we’ve seen, those claims of a block against US-based phones appear to be PR garbage. Recall how the Pega­sus spy­ware had the capac­i­ty to hack phones with UK and Israeli phone num­bers despite all the assur­ances that the tar­get­ing of such phones was tech­ni­cal­ly impos­si­ble, rais­ing obvi­ous ques­tions about whether or not phones with “+1” US-based phone num­bers are also vul­ner­a­ble. And then we got that sto­ry about US embassy work­ers in Ugan­da hav­ing their phones hacked with Pega­sus, but in that case the num­bers for those phones were NOT +1 US-based num­bers. And then we got the sto­ry about how the FBI got its own Pega­sus sub­scrip­tion and exper­i­ment­ed with it with the hopes of using it in the US for domes­tic sur­veil­lance pur­pos­es. So while we haven’t yet received clear con­fir­ma­tion that NSO Group’s many gov­ern­ment clients around the world had the abil­i­ty to hack the Secret Ser­vice agents phones, there’s only been grow­ing cir­cum­stan­tial evi­dence point­ing in that direc­tion. And that why this report from Sep­tem­ber of last year — about the zero-click unstop­pable spy­ware NSO Group was sell­ing to gov­ern­ments around the world most gave access to the iMes­sages on those phones — is the kind of sto­ry we should be keep­ing in mind when it comes to the hunt for those Secret Ser­vice agents’ miss­ing iMes­sages. The num­ber of enti­ties that might have copies of those agents’ mes­sages just might include the range of NSO Group clients, depend­ing on whether or not NSO Group real­ly was allow­ing its clients to hack US phones:

    NBC News

    Update your iPhone: Spy­ware com­pa­ny using ‘ter­ri­fy­ing’ hack, researchers say

    A cyber­se­cu­ri­ty lab found a new exploit on a Sau­di dis­si­den­t’s phone from a well-known spy­ware com­pa­ny that has spurred Apple to push an urgent soft­ware update.

    By Kevin Col­lier
    Sept. 13, 2021, 4:31 PM CDT / Updat­ed Sept. 14, 2021, 12:30 PM CDT

    Apple on Mon­day advised all users to update their devices after researchers warned that the Israeli spy­ware com­pa­ny NSO Group had devel­oped a way to take con­trol over near­ly any Apple com­put­er, watch or iPhone.

    “It’s absolute­ly ter­ri­fy­ing,” said John Scott-Rail­ton, a senior researcher at The Cit­i­zen Lab, which recent­ly dis­cov­ered the soft­ware exploit and noti­fied Apple about it. The group pub­lished a report about it Mon­day.

    The mali­cious soft­ware takes con­trol of an Apple device by first send­ing a mes­sage through iMes­sage, the company’s default mes­sag­ing app, and then hack­ing through a flaw in how Apple process­es images. It is what’s known in the cyber­se­cu­ri­ty indus­try as a “zero-click” exploit — a par­tic­u­lar­ly dan­ger­ous and per­ni­cious flaw that doesn’t require a vic­tim click­ing a link or down­load­ing a file to take over.

    Peo­ple whose devices have been exploit­ed are extreme­ly unlike­ly to real­ize they’ve been hacked, Scott-Rail­ton said.

    “The user sees crick­ets while their iPhone is silent­ly exploit­ed,” he said. “Some­one sends you a GIF that isn’t, and then you’re in trou­ble. That’s it. You don’t see a thing.”

    As is often the case with NSO Group hack­ing, the new­ly dis­cov­ered exploit is both tech­no­log­i­cal­ly remark­able but like­ly only used on peo­ple specif­i­cal­ly tar­get­ed by gov­ern­ments who use the company’s soft­ware.

    NSO Group cre­ates sur­veil­lance and hack­ing soft­ware that it leas­es to gov­ern­ments to spy on indi­vid­u­als’ com­put­ers and smart­phones. For years, it has insist­ed that its pri­ma­ry prod­uct, Pega­sus, is a vital tool to stop ter­ror­ists and oth­er crim­i­nals, and that it mere­ly leas­es its tech­nol­o­gy to legit­i­mate gov­ern­ments in accor­dance with their own laws. Ithas also insist­ed it can’t be used to tar­get Amer­i­cans’ phones, and that it revokes usage from coun­tries that mis­use its prod­ucts.

    But Cit­i­zen Lab, a cyber­se­cu­ri­ty research cen­ter at the Uni­ver­si­ty of Toron­to, has repeat­ed­ly found instances of Pega­sus soft­ware used against jour­nal­ists in Mex­i­co who inves­ti­gat­ed car­tels and Sau­di Ara­bi­an dis­si­dents, includ­ing asso­ciates of the slain Wash­ing­ton Post colum­nist Jamal Khashog­gi.

    ...

    Apple pub­lished tech­ni­cal notes with a new soft­ware update avail­able Mon­day that addressed flaws iden­ti­fied by Cit­i­zen Lab. The com­pa­ny not­ed that “this issue may have been active­ly exploit­ed.”

    ...

    ———–

    “Update your iPhone: Spy­ware com­pa­ny using ‘ter­ri­fy­ing’ hack, researchers say” by Kevin Col­lier; NBC News; 09/13/2021

    “The mali­cious soft­ware takes con­trol of an Apple device by first send­ing a mes­sage through iMes­sage, the company’s default mes­sag­ing app, and then hack­ing through a flaw in how Apple process­es images. It is what’s known in the cyber­se­cu­ri­ty indus­try as a “zero-click” exploit — a par­tic­u­lar­ly dan­ger­ous and per­ni­cious flaw that doesn’t require a vic­tim click­ing a link or down­load­ing a file to take over.”

    It was­n’t until Sep­tem­ber of 2021 that the world learned that NSO Group’s spy­ware tar­get­ing iPhones was so pow­er­ful that it could allow the attack­er to effec­tive­ly take com­plete con­trol of the phone. A lot more than iMes­sages are at risk with an exploit like that. So when did NSO Group learn how to do this? And more impor­tant­ly, when did its clients get access to some­thing like that? We don’t know. But as it becomes more and more clear that a coverup now include a large num­ber of Secret Ser­vice agents, the par­ti­san hack Inspec­tor Gen­er­al, and maybe the then-act­ing heads of the DHS, it’s also becom­ing increas­ing­ly clear that US gov­ern­ment inves­ti­ga­tors might need to look else­where for evi­dence relat­ed to the Jan 6 inves­ti­ga­tion. They need to be look­ing into it any­way. It’s not great when gov­ern­ment doc­u­ments are hacked. But far worse when those hacked doc­u­ments are then wiped from gov­ern­men­t’s records. Espe­cial­ly if the hacked doc­u­ments involve the plan­ning and exe­cu­tion of a coup attempt. And most espe­cial­ly if that coup attempt is under inves­ti­ga­tion and could real­ly use those miss­ing doc­u­ments.

    Posted by Pterrafractyl | July 31, 2022, 10:58 pm

  24. Here’s a set of arti­cles about a grow­ing gov­ern­ment spy­ware scan­dal in Greece that one of the rare spy­ware sto­ries these days the NSO Group can smile about. Because it’s not about the NSO Group. No, it’s about a home-grown piece of super-mal­ware that was appar­ent­ly used in the way we kind of expect home-grown super-mal­ware to get used: on domes­tic jour­nal­ists and oppo­si­tion politi­cians.

    In this case, it’s the Preda­tor super-spy­ware — deliv­ered through texted links that, when clicked, take the user to a web­site that qui­et­ly deliv­ers the mal­ware pay­load and allows near com­plete con­trol of the phone — that was used against a finan­cial crimes reporter at CNN Greece and the head of the PASOK oppo­si­tion par­ty. The Preda­tor was devel­oped by Cytrox, a com­pa­ny found­ed in North Mace­do­nia and absorbed by Intellexa, which is thought to be based in Greece. But we can’t be sure where Intellexa is based and that’s a big part of the broad­er sto­ry here: this brew­ing Greek scan­dal is just the lat­est exam­ple of a thriv­ing shad­ow indus­try across the EU. An indus­try oper­at­ing so deeply in the dark that even EU reg­u­la­tors can’t fig­ure out who is oper­at­ing in this space and where they’re locat­ed. The Spy­ware­poca­lypse con­tin­ues.

    As we’re going to see, the Greek jour­nal­ist who had his phone hacked, Thana­sis Koukakis, was texted a link to a finan­cial arti­cle that looked like it was a Greek CNN arti­cle but was actu­al­ly an infect­ed clone ver­sion of the Greece CNN web­site that deliv­ered mal­ware to his phone. Nikos Androulakis, the head of oppo­si­tion par­ty PASOK, was sent a sim­i­lar link but nev­er clicked it. When Koukakis alert­ed the pub­lic to his hack­ing back in April an inves­ti­ga­tion was start­ed by thwart­ed by the par­lia­men­tary com­mit­tee over­see­ing it. Then Androulakis expe­ri­ence a sim­i­lar fake-CNN Greece link text in late July and went pub­lic with the hack­ing attempt, prompt­ing a par­lia­men­tary hear­ing in ear­ly August where the head of the Greek intel­li­gence agency, the EYP, admit­ted to hack­ing both phones. A week lat­er the Pres­i­dent of Greece called for an inves­ti­ga­tion. And the week after that the EU said it want­ed to help inves­ti­gate too. And that’s where we are on the sto­ry.

    The EYP does­n’t give a rea­son for the hacks also insists it had a pros­e­cu­tor’s approval for the hack of Androulakis and every­thing was law­ful. The feel of rev­e­la­tion and dis­cov­ery is in the air. And coverup. Most­ly coverup.

    Ok, first, here’s an arti­cle from last week about the EU par­lia­ment offer­ing its help in the “inex­cus­able” spy­ing now admit­ted by the EYP. Inex­cus­able spy­ing that is hap­pen­ing in sim­i­lar ways by oth­er mem­bers of the EU which is part of why the EU par­lia­ment wants to look into this:

    Reuters

    EU par­lia­ment to help probe ‘inex­cus­able’ spy­ing on Greek mem­ber

    August 17, 2022 3:19 AM CDT
    Updat­ed

    BRUSSELS, Aug 17 (Reuters) — The Euro­pean Par­lia­ment will coop­er­ate with Greek author­i­ties to inves­ti­gate “intol­er­a­ble and inex­cus­able” state spy­ing on a Greek EU law­mak­er, the spokesman for the head of the cham­ber said of the bloc’s lat­est espi­onage scan­dal.

    The Greek pres­i­dent has called for an inves­ti­ga­tion into the tap­ping by the state intel­li­gence of Nikos Androulakis, leader of Greece’s Social­ist PASOK par­ty and a mem­ber of the Euro­pean Par­lia­ment. read more

    “Ille­gal sur­veil­lance of mem­bers’ com­mu­ni­ca­tions is intol­er­a­ble and inex­cus­able,” said Juri Laas, spokesman for Euro­pean Par­lia­ment Pres­i­dent Rober­ta Met­so­la.

    “Such infringe­ments of the prin­ci­ples and val­ues which form the basis of our demo­c­ra­t­ic sys­tem can­not be tol­er­at­ed, irre­spec­tive of the mem­ber state where they occur.”

    The Euro­pean Par­lia­ment, which has 705 mem­bers and shapes EU poli­cies, already has a com­mit­tee inves­ti­gat­ing the use of the Pega­sus spy­ware in the 27-nation bloc. Pega­sus scan­dals last year rocked oth­er EU coun­tries includ­ing France and Poland.

    Met­so­la wants the com­mit­tee to exam­ine the Greek case as well, with an eye to ban­ning such ille­gal prac­tices in the EU, accord­ing to her spokesman.

    ...

    ———–

    “EU par­lia­ment to help probe ‘inex­cus­able’ spy­ing on Greek mem­ber”; Reuters; 08/17/2022

    “The Greek pres­i­dent has called for an inves­ti­ga­tion into the tap­ping by the state intel­li­gence of Nikos Androulakis, leader of Greece’s Social­ist PASOK par­ty and a mem­ber of the Euro­pean Par­lia­ment.”

    The Greek pres­i­dent is call­ing for an inves­ti­ga­tion. It’s seri­ous. At least let’s hope so because it’s an inves­ti­ga­tion of the pres­i­den­t’s own spy agency accused of spy­ing on his own polit­i­cal oppo­nents. That’s part of why it’s so sig­nif­i­cant that the EU par­lia­ment is now sig­nalling that it’s inter­est­ed in this inves­ti­ga­tion too:

    ...
    The Euro­pean Par­lia­ment, which has 705 mem­bers and shapes EU poli­cies, already has a com­mit­tee inves­ti­gat­ing the use of the Pega­sus spy­ware in the 27-nation bloc. Pega­sus scan­dals last year rocked oth­er EU coun­tries includ­ing France and Poland.

    Met­so­la wants the com­mit­tee to exam­ine the Greek case as well, with an eye to ban­ning such ille­gal prac­tices in the EU, accord­ing to her spokesman.
    ...

    And as the fol­low­ing Reuters arti­cle from a cou­ple of weeks ago describes, Greek pres­i­dent Kate­ri­na Sakel­laropoulou was informed the pri­or week by the head of the Greek spy agency, the EYP, that the agency had indeed spied on the oppo­si­tion leader Nikos Androulakis. The head of the EYP was sacked, along with the pres­i­den­t’s chief of staff, fol­lowed by Sakel­laropoulou’s call for an inves­ti­ga­tion. So it sounds like the pres­i­dent did­n’t know their spy agency was spy­ing on one of the main oppo­si­tion lead­ers. At least that’s the sto­ry so far:

    Reuters

    Greek pres­i­dent calls for inves­ti­ga­tion of phone tap­ping scan­dal

    August 11, 2022 3:55 AM CDT
    Updat­ed

    ATHENS, Aug 9 (Reuters) — Greek Pres­i­dent Kate­ri­na Sakel­laropoulou called on Tues­day for an inves­ti­ga­tion into the tap­ping of a polit­i­cal lead­er’s phone by the intel­li­gence ser­vice (EYP).

    The scan­dal broke last week amid grow­ing con­cern in the EU about the use of spy­ware soft­ware and sparked uproar at home, with oppo­si­tion par­ties labelling the rev­e­la­tions Prime Min­is­ter Kyr­i­akos Mit­so­tak­is’s per­son­al Water­gate.

    ...

    The leader of Greece’s Social­ist PASOK par­ty and mem­ber of Euro­pean Par­lia­ment, Nikos Androulakis, said on Fri­day he had learned that EYP was lis­ten­ing to his con­ver­sa­tions last year. read more

    Ear­li­er that day, EYP’s chief and Prime Min­is­ter Kyr­i­akos Mit­so­tak­is’s chief of staff were sacked.

    A gov­ern­ment spokesman said that EYP had tapped Androulak­is’s phone but that the sur­veil­lance, which was approved by a pros­e­cu­tor, was law­ful and the prime min­is­ter was informed about it last week.

    The gov­ern­ment has not said why Androulak­is’s phone was hacked.

    In a pub­lic address on Mon­day, Mit­so­takis said that if he had known he “would have nev­er allowed it”.

    PASOK is Greece’s third-largest polit­i­cal par­ty and was for decades the main polit­i­cal rival of Mit­so­tak­is’s con­ser­v­a­tive par­ty, New Democ­ra­cy. read more

    The gov­ern­ment has said it will back a request by the oppo­si­tion for a par­lia­men­tary inves­ti­gat­ing com­mit­tee on the issue.

    The Euro­pean Com­mis­sion is also mon­i­tor­ing the case. Cypri­ot MEP George Geor­giou, vice-chair of the EU’s PEGA com­mit­tee inves­ti­gat­ing mal­ware sur­veil­lance soft­ware, has also sent a let­ter to the com­mit­tee propos­ing a mis­sion to Greece to inves­ti­gate the alle­ga­tions.

    ———–

    “Greek pres­i­dent calls for inves­ti­ga­tion of phone tap­ping scan­dal”; Reuters; 08/11/2022

    “A gov­ern­ment spokesman said that EYP had tapped Androulak­is’s phone but that the sur­veil­lance, which was approved by a pros­e­cu­tor, was law­ful and the prime min­is­ter was informed about it last week.”

    So, at least up to the point when Greece’s pres­i­dent called for an inves­ti­ga­tion, the gov­ern­ment posi­tion was that, yes, the EYP had spied on the leader of PASOK, but it was entire­ly leader and done with a pros­e­cu­tor’s approval. And we’re also told the pres­i­dent was only informed of all this last week, imply­ing that this was an inde­pen­dent rou­tine crim­i­nal inves­ti­ga­tion. And yet the yet of the EYP and chief of staff were sacked the same day of this state­ment and there’s still no expla­na­tion for why the head of PASOK had their phone hacked:

    ...
    Ear­li­er that day, EYP’s chief and Prime Min­is­ter Kyr­i­akos Mit­so­tak­is’s chief of staff were sacked.

    ...

    The gov­ern­ment has not said why Androulak­is’s phone was hacked.
    ...

    Also note anoth­er impor­tant detail in that gov­ern­ment state­ment: the gov­ern­ment was admit­ting Androulak­is’s phone was indeed suc­cess­ful­ly hacked and did­n’t just expe­ri­ence a hack­ing attempt. That’s going to be impor­tant to keep in mind when read­ing the Wired arti­cle below. Accord­ing to Androulakis, he only expe­ri­enced a hack­ing attempt when some­one sent him a link to an infect­ed web­site that deliv­ers mal­ware. But he was­n’t actu­al­ly hacked because he nev­er clicked on the link. At least that’s how it sound­ed in that arti­cle, but the Greek gov­ern­ment sure sounds like it suc­cess­ful­ly hacked his phone.

    And not just Androulak­is’s phone. As the fol­low­ing Reuters arti­cle from a few weeks ago — when the sto­ry was first erupt­ed in Greece — describes, the sto­ry of the hack of Androulakis phone was pre­ced­ed by the sto­ry of the EYP hack of a Greek jour­nal­ist. Specif­i­cal­ly, Thana­sis Koukakis, a finan­cial reporter for Greek CNN who works on sto­ries about finan­cial crimes. And as before, there’s no good expla­na­tion giv­en for why the hack was done. In oth­er words, it’s a lot hard­er to dis­miss the hack of PASOK’s leader as just a rou­tine law­ful inves­ti­ga­tion when we learn about what sounds like a very non-rou­tine hack of a finan­cial crimes reporter by the same agency:

    Reuters

    Greek intel­li­gence ser­vice admits spy­ing on jour­nal­ist — sources

    By George Geor­giopou­los
    August 3, 2022 12:20 PM UTC
    Updat­ed

    ATHENS, Aug 3 (Reuters) — The head of Greek intel­li­gence told a par­lia­men­tary com­mit­tee his agency had spied on a jour­nal­ist, two sources present said, in a dis­clo­sure that coin­cides with grow­ing pres­sure on the gov­ern­ment to shed light on the use of sur­veil­lance mal­ware.

    The com­mit­tee’s closed-door hear­ing last week was called after the leader of the social­ist oppo­si­tion PASOK par­ty lodged a com­plaint with top court pros­e­cu­tors over an attempt­ed bug­ging of his mobile phone with sur­veil­lance soft­ware. read more

    PASOK leader Nikos Androulakis made his com­plaint amid grow­ing con­cern among Euro­pean Union offi­cials about spy­ware mer­chants and the use of sur­veil­lance soft­ware. read more

    At the July 29 hear­ing, Pana­gi­o­tis Kon­toleon, chief of the EYP intel­li­gence ser­vice, told par­lia­men­t’s insti­tu­tions and trans­paren­cy com­mit­tee that his ser­vice had spied on Thana­sis Koukakis, a finan­cial jour­nal­ist who works for CNN Greece, two law­mak­ers present at the hear­ing told Reuters.

    “He admit­ted the sur­veil­lance, absolute­ly,” one of the law­mak­ers present at the hear­ing told Reuters on Wednes­day, declin­ing to be iden­ti­fied because the meet­ing was pri­vate.

    ...

    Gov­ern­ment spokesman Gian­nis Oikonomou told Reuters that Greek author­i­ties do not use the spy­ware alleged­ly deployed in the hack­ing of Koukakis and do not do busi­ness with com­pa­nies sell­ing it.

    “The gov­ern­ment has noth­ing to hide and has called on the jus­tice sys­tem to inves­ti­gate the cas­es thor­ough­ly,” he said.

    “With­out cross­ing to the extreme of techno­pho­bia, such mal­ware does pose a threat and must be tack­led effi­cient­ly.”

    ...

    In April, a Greek pros­e­cu­tor began an inves­ti­ga­tion into an alle­ga­tion by Koukakis that his smart­phone had been infect­ed by sur­veil­lance soft­ware. read more

    Last year when the alle­ga­tion was report­ed by Greek media, left wing SYRIZA, Greece’s largest oppo­si­tion par­ty, asked for the par­lia­men­tary com­mit­tee to con­vene to look into the mat­ter.

    Its request was turned down by the com­mit­tee chair­man. But after Androulakis sub­mit­ted his com­plaint to pros­e­cu­tors in late July, a request by both SYRIZA and PASOK for the com­mit­tee to con­vene was accept­ed and a hear­ing fol­lowed.

    SYRIZA has for­mal­ly asked the prime min­is­ter to shed light on both cas­es which, it says, involve the use of Preda­tor sur­veil­lance soft­ware, cit­ing major issues for democ­ra­cy and cit­i­zens’ pri­va­cy rights.

    Preda­tor spy­ware can extract pass­words, files, pho­tos and con­tacts and acti­vate a phone’s cam­era and micro­phone, enabling sur­veil­lance of con­ver­sa­tions near­by.

    At the hear­ing, EYP chief Kon­toleon, who reports direct­ly to the prime min­is­ter, not­ed that EYP per­forms its work not only based on its own infor­ma­tion but at times after tips or requests by for­eign intel­li­gence ser­vices, the two sources said.

    The EU con­sid­ers the use of spy­ware against jour­nal­ists unac­cept­able. read more

    Jour­nal­ist Koukakis, whose work has includ­ed inves­tiga­tive report­ing on finan­cial crimes, remains baf­fled why he was bugged: “I am sur­prised that areas that I cov­er as a reporter, eco­nom­ic pol­i­cy and the bank­ing sys­tem, can be a nation­al secu­ri­ty threat,” he told Reuters.

    ———–

    “Greek intel­li­gence ser­vice admits spy­ing on jour­nal­ist — sources” by George Geor­giopou­los; Reuters; 08/03/2022

    “Jour­nal­ist Koukakis, whose work has includ­ed inves­tiga­tive report­ing on finan­cial crimes, remains baf­fled why he was bugged: “I am sur­prised that areas that I cov­er as a reporter, eco­nom­ic pol­i­cy and the bank­ing sys­tem, can be a nation­al secu­ri­ty threat,” he told Reuters.”

    So was this CNN finan­cial crimes reporter hacked because of the crimes they were per­son­al­ly com­mit­ting? Or the crimes they were inves­ti­gat­ing? Hmmm....whatever could it be? Either way, it’s not a great look for the Greek spy agency. But Pana­gi­o­tis Kon­toleon, chief of the EYP intel­li­gence ser­vice, open­ly told the Greek par­lia­ment that the spy­ing hap­pened. No expla­na­tion for why it hap­pened was giv­en. But it def­i­nite­ly hap­pened. And the Greek spokesper­son told Reuters that it did­n’t hap­pen. It was­n’t the most con­vinc­ing spin:

    ...
    At the July 29 hear­ing, Pana­gi­o­tis Kon­toleon, chief of the EYP intel­li­gence ser­vice, told par­lia­men­t’s insti­tu­tions and trans­paren­cy com­mit­tee that his ser­vice had spied on Thana­sis Koukakis, a finan­cial jour­nal­ist who works for CNN Greece, two law­mak­ers present at the hear­ing told Reuters.

    “He admit­ted the sur­veil­lance, absolute­ly,” one of the law­mak­ers present at the hear­ing told Reuters on Wednes­day, declin­ing to be iden­ti­fied because the meet­ing was pri­vate.

    ...

    Gov­ern­ment spokesman Gian­nis Oikonomou told Reuters that Greek author­i­ties do not use the spy­ware alleged­ly deployed in the hack­ing of Koukakis and do not do busi­ness with com­pa­nies sell­ing it.

    “The gov­ern­ment has noth­ing to hide and has called on the jus­tice sys­tem to inves­ti­gate the cas­es thor­ough­ly,” he said.

    “With­out cross­ing to the extreme of techno­pho­bia, such mal­ware does pose a threat and must be tack­led effi­cient­ly.”
    ...

    Part of what made the Greek gov­ern­men­t’s denials ring hol­low is the fact that an ear­li­er attempt to inves­ti­gate the hack­ing of Koukak­is’s phone back in April were denied by the same par­lia­men­tary com­mit­tee. It was only after the claims by Androulakis in late July that this was tak­en seri­ous­ly. Which is the kind of behav­ior by the par­lia­ment that sug­gests Androulakis isn’t the only jour­nal­ist with a gift from the EYP on that their phone:

    ...
    In April, a Greek pros­e­cu­tor began an inves­ti­ga­tion into an alle­ga­tion by Koukakis that his smart­phone had been infect­ed by sur­veil­lance soft­ware. read more

    Last year when the alle­ga­tion was report­ed by Greek media, left wing SYRIZA, Greece’s largest oppo­si­tion par­ty, asked for the par­lia­men­tary com­mit­tee to con­vene to look into the mat­ter.

    Its request was turned down by the com­mit­tee chair­man. But after Androulakis sub­mit­ted his com­plaint to pros­e­cu­tors in late July, a request by both SYRIZA and PASOK for the com­mit­tee to con­vene was accept­ed and a hear­ing fol­lowed.
    ...

    And final­ly, we learn one of the most intrigu­ing details in this whole sto­ry: this was­n’t NSO Group mal­ware. It was some­thing called Preda­tor. But it sounds plen­ty capa­ble:

    ...
    SYRIZA has for­mal­ly asked the prime min­is­ter to shed light on both cas­es which, it says, involve the use of Preda­tor sur­veil­lance soft­ware, cit­ing major issues for democ­ra­cy and cit­i­zens’ pri­va­cy rights.

    Preda­tor spy­ware can extract pass­words, files, pho­tos and con­tacts and acti­vate a phone’s cam­era and micro­phone, enabling sur­veil­lance of con­ver­sa­tions near­by.
    ...

    So where did Preda­tor come from? North Mace­do­nia, home of the obscure cyber-sur­veil­lance firm Cytrox. Although Cytrox was then absorbed by Intellexa, which is believe to be based in Greece. So preda­tor was kind of home grown from Greece. Maybe. Assum­ing Intellexa is actu­al­ly based in Greece now, which we can only spec­u­lat­ed about. And that ambi­gu­i­ty turns out to be one of the biggest parts of this whole sto­ry. Because as the Wired arti­cle describes, a big part of what makes the sto­ry of the Preda­tor hacks of these two Greek cit­i­zens by Greece’s spy agency so sig­nif­i­cant is that it appears to be just one exam­ple of a much large explo­sion of EU-made spy­ware being unleashed across the con­ti­nent by an indus­try so secre­tive even the reg­u­la­tors can’t track them. It’s like a very real ghost indus­try:

    Wired

    Spy­ware Scan­dals Are Rip­ping Through Europe
    The lat­est cri­sis that rocked the Greek gov­ern­ment shows the bloc’s sur­veil­lance prob­lem goes beyond the noto­ri­ous NSO Group.

    Mor­gan Meak­er
    Aug 15, 2022 7:00 AM

    The text mes­sage that dragged Thana­sis Koukakis into what’s being called Europe’s Water­gate scan­dal was so innocu­ous, he can bare­ly remem­ber receiv­ing it. The Athens-based finan­cial jour­nal­ist received the note on his black iPhone 12 Pro on July 12 last year from a Greek num­ber he didn’t have saved. That wasn’t unusu­al for Koukakis, who has spent the past three years inves­ti­gat­ing the changes the gov­ern­ment has been mak­ing to finan­cial crime reg­u­la­tion. He gets a lot of messages—both from num­bers he’s saved and those he hasn’t. This one addressed him direct­ly. “Thana­sis,” it read, “Do you know about this issue?” Koukakis clicked on the link that fol­lowed, which took him to a news sto­ry about a Greek bank­ing scan­dal. He replied with a terse: “No.”

    Koukakis, 44, did not think about the mes­sage until months lat­er. In the days that fol­lowed, he was obliv­i­ous to the fact that the web­site that host­ed the sto­ry he was sent had dis­ap­peared. He also did not know that by click­ing on that link, he had opened an invis­i­ble door inside his phone, allow­ing spy­ware soft­ware called Preda­tor to creep in to silent­ly watch the mes­sages and calls he was send­ing and receiv­ing.

    His phone kept work­ing as if every­thing was nor­mal, he says. Then, in Decem­ber, Koukakis read a report about how Face­book par­ent com­pa­ny Meta had detect­ed com­mer­cial spy­ware being used by cus­tomers in 10 dif­fer­ent coun­tries, includ­ing Greece. One of the links used to trick peo­ple into down­load­ing the spy­ware was designed to look like CNN Greece—where he worked as an edi­tor.

    Sud­den­ly sus­pi­cious, he con­tact­ed Meta, which con­nect­ed him with researchers at Cit­i­zen Lab, a research facil­i­ty at the Uni­ver­si­ty of Toron­to that spe­cial­izes in spy­ware. In March, they told him that he was being spied on. He went pub­lic with that infor­ma­tion the fol­low­ing month, prompt­ing uproar and an inves­ti­ga­tion by a Greek pros­e­cu­tor. But the scan­dal was only get­ting start­ed. On July 26, anoth­er per­son revealed he had also received a link infect­ed with Preda­tor spy­ware: Nikos Androulakis, leader of PASOK, Greece’s third largest polit­i­cal par­ty.

    Androulakis did not click on the infect­ed link. But the fact some­one had attempt­ed to hack the phone of a serv­ing oppo­si­tion leader tipped the Greek gov­ern­ment into cri­sis. Two offi­cials have resigned so far and pres­sure is mount­ing on Prime Min­is­ter, Kyr­i­akos Mit­so­takis, to explain who’s behind the spy­ware.

    The rip­ple effects of the scan­dal are reach­ing the heart of the Euro­pean Union. Over the past 13 months, it has been revealed that spy­ware had tar­get­ed oppo­si­tion lead­ers, jour­nal­ists, lawyers and activists in France, Spain, Hun­gary, Poland and even staff with­in the Euro­pean Com­mis­sion, the EU’s cab­i­net-style gov­ern­ment, between 2019 and 2021. The bloc has already set up an inquiry into its own use of spy­ware, but even as the 38-per­son com­mit­tee works toward pro­duc­ing a report for ear­ly 2023, the num­ber of new scan­dals is quick­ly mount­ing up.

    What sets the scan­dal in Greece apart is the com­pa­ny behind the spy­ware that was used. Until then the sur­veil­lance soft­ware in every EU scan­dal could be traced back to one com­pa­ny, the noto­ri­ous NSO Group. Yet the spy­ware stalk­ing Koukakis’ phone was made by Cytrox, a com­pa­ny found­ed in the small Euro­pean nation of North Mace­do­nia and acquired in 2017 by Tal Dilian—an entre­pre­neur who achieved noto­ri­ety for dri­ving a high-tech sur­veil­lance van around the island of Cyprus and show­ing a Forbes jour­nal­ist how it could hack into pass­ing people’s phones. In that inter­view, Dil­ian said he had acquired Cytrox and absorbed the com­pa­ny into his intel­li­gence com­pa­ny Intellexa, which is now thought to now be based in Greece. The arrival of Cytrox into Europe’s ongo­ing scan­dal shows the prob­lem is big­ger than just the NSO Group. The bloc has a thriv­ing spy­ware indus­try of its own.

    ...

    In June, Google dis­cov­ered the Ital­ian spy­ware ven­dor RCS Lab was tar­get­ing smart­phones in Italy and Kaza­khstan. Alber­to Nobili, RCS’ man­ag­ing direc­tor, told WIRED that the com­pa­ny con­demns the mis­use of its prod­ucts but declined to com­ment on whether the cas­es cit­ed by Google were exam­ples of mis­use. “RCS per­son­nel are not exposed, nor par­tic­i­pate in any activ­i­ties con­duct­ed by the rel­e­vant cus­tomers,” he says.

    More recent­ly, in July, spy­ware made by Austria’s DSIRF was detect­ed by Microsoft hack­ing into law firms, banks, and con­sul­tan­cies in Aus­tria, the UK, and Pana­ma. DSIRF did not reply to WIRED’s request for com­ment.

    “Europe is def­i­nite­ly a nexus,” says Justin Albrecht, secu­ri­ty intel­li­gence researcher at cyber­se­cu­ri­ty com­pa­ny Look­out. This jostling in the spy­ware indus­try echoes what hap­pened in 2015, when the well-known Ital­ian spy­ware mak­er Hack­ing Team was itself hacked and the company’s emails were leaked online, says Albrecht. “After that, we start­ed to see dif­fer­ent play­ers take away some of the busi­ness that was going to Hack­ing Team.”

    ...

    In Greece, for exam­ple, the con­ser­v­a­tive gov­ern­ment con­tin­ues to deny using Preda­tor spy­ware against Koukakis and Androulakis, although the head of Greek intel­li­gence report­ed­ly admit­ted to legal­ly wire­tap­ping Koukakis’ phone using local tele­coms com­pa­nies while the prime min­is­ter said Androulakis had been put under the same type of sur­veil­lance. “What took place was not ille­gal but it was a mis­take,” he said. Res­ig­na­tions there start­ed with those admis­sions. First the head of Greek intel­li­gence, Pana­gi­o­tis Kon­toleon, stepped down. He was short­ly fol­lowed by Grig­oris Dim­i­tri­adis, the prime minister’s chief of staff (and nephew), after local out­let Reporters Unit­ed alleged Dim­i­tri­adis ran in the same cir­cles as peo­ple sell­ing Cytrox spy­ware. Nei­ther the Prime Minister’s office nor the Greek intel­li­gence agency replied to WIRED’s request for com­ment.

    Last year in Hun­gary, six peo­ple dis­cov­ered their phones had been hacked by NSO group’s Pega­sus, after they were tipped off by the Pega­sus Project, an inves­ti­ga­tion by 17 media out­lets in dif­fer­ent coun­tries. There is no direct evi­dence the Hun­gar­i­an gov­ern­ment deployed this spy­ware against local jour­nal­ists and activists, says Ádám Rem­port, legal offi­cer for the Hun­gar­i­an Civ­il Lib­er­ties Union, which is rep­re­sent­ing hack­ing vic­tims in a legal case against the state. Instead it’s a case of con­nect­ing the dots. “We know that Hun­gary bought Pega­sus. We know these peo­ple were in fields that are uncom­fort­able for the gov­ern­ment,” he says, adding the peo­ple tar­get­ed were jour­nal­ists and activists who uncov­ered cor­rup­tion and Hungary’s con­nec­tions with Rus­sia. “I think there are no oth­er pos­si­ble sus­pects who could have car­ried out these acts.”

    Fol­low­ing rev­e­la­tions about the use of NSO spy­ware in Hun­gary and Poland, mem­bers of the Euro­pean Par­lia­ment launched a rare inquiry in April, whose focus on Pega­sus was so marked that it was called the PEGA com­mit­tee.

    Some in Israel believe the focus on the NSO Group is dis­pro­por­tion­ate. “There’s a feel­ing in Israel that a fair part of this is just Israel-bash­ing, and if it were any oth­er coun­try, there wouldn’t have been near­ly as much noise about it,” says Chuck Freilich, a for­mer deputy nation­al secu­ri­ty advis­er in Israel. “There are com­pa­nies and oth­er coun­tries that do the exact same or almost exact same thing. They just don’t do it as well.”

    The NSO group doesn’t deserve less scruti­ny, but oth­er spy­ware com­pa­nies do deserve more, says Lookout’s Albrecht. Although vic­tims of oth­er spy­ware firms are not as well known as Jamal Khashog­gi, the Wash­ing­ton Post colum­nist who was mur­dered after his phone was hacked with Pega­sus, there are signs that oth­er com­pa­nies enable hack­ing that would be con­sid­ered con­tro­ver­sial. “We’ve seen indi­ca­tions that RCS Lab spy­ware is being used with­in Syr­ia, specif­i­cal­ly in what’s known as the Roja­va region, the area where the Kur­dish minor­i­ty pop­u­la­tion pri­mar­i­ly is,” he says.

    For some, the sit­u­a­tion in Greece rein­forces the argu­ment that there needs to be indus­try-wide reg­u­la­tion. “Even if NSO Group clos­es tomor­row because of all the prob­lems they face today, the sit­u­a­tion will be the same if there is no change in the reg­u­la­tion,” says Eti­enne Maynier, a tech­nol­o­gist at Amnesty International’s Secu­ri­ty Lab. “The prob­lem is not one bad com­pa­ny. It’s real­ly the legal struc­ture that makes these com­pa­nies take these deci­sions.”

    Sophie in’t Veld, a Dutch MEP who is the rap­por­teur in charge of the PEGA com­mit­tee, is hop­ing to change that once the EU inquiry is com­plete next year. “This whole sec­tor should be heav­i­ly reg­u­lat­ed,” she says, adding she wants to force the sec­tor to be more trans­par­ent. “If you try to find out who these com­pa­nies are, who the peo­ple are behind them, and where they are based, it’s impos­si­ble.”

    What annoys her the most is that Intellexa—the com­pa­ny that sells Cytrox—says on its web­site that it’s EU reg­u­lat­ed. “What the hell does that mean that you are EU reg­u­lat­ed?” she says. “Reg­u­lat­ed by whom and by what rules?”

    ——–

    “Spy­ware Scan­dals Are Rip­ping Through Europe” by Mor­gan Meak­er; Wired; 08/15/2022

    “What sets the scan­dal in Greece apart is the com­pa­ny behind the spy­ware that was used. Until then the sur­veil­lance soft­ware in every EU scan­dal could be traced back to one com­pa­ny, the noto­ri­ous NSO Group. Yet the spy­ware stalk­ing Koukakis’ phone was made by Cytrox, a com­pa­ny found­ed in the small Euro­pean nation of North Mace­do­nia and acquired in 2017 by Tal Dilian—an entre­pre­neur who achieved noto­ri­ety for dri­ving a high-tech sur­veil­lance van around the island of Cyprus and show­ing a Forbes jour­nal­ist how it could hack into pass­ing people’s phones. In that inter­view, Dil­ian said he had acquired Cytrox and absorbed the com­pa­ny into his intel­li­gence com­pa­ny Intellexa, which is now thought to now be based in Greece. The arrival of Cytrox into Europe’s ongo­ing scan­dal shows the prob­lem is big­ger than just the NSO Group. The bloc has a thriv­ing spy­ware indus­try of its own.”

    The Spy­ware­poca­lype did­n’t just con­tin­ue. And it’s big­ger and bad­der than ever. At least that’s what we have to infer since we can’t actu­al­ly ver­i­fy it. At this point most of what we know about Cytrox, the mak­er of the Preda­tor mal­ware, is that might exist in Greece and that Preda­tor was used to mak­ing hack­ing attempts against at least one jour­nal­ist and one politi­cian. The rest is informed spec­u­la­tion about a grow­ing shad­ow indus­try.

    And note how Koukakis isn’t just a finan­cial crimes reporter for CNN Greece. He’s also and edi­tor, sug­gest­ing he got to see all sorts of finan­cial report­ing before it was pub­lished. It’s not hard to imag­ine the temp­ta­tion to get into his phone.

    Also note how this report makes it sound like Nikos Androulak­is’s phone was nev­er actu­al­ly hacked because he did­n’t click on the link. Keep in mind that NSO Group’s Pega­sus mal­ware did­n’t require you to click on the sent links. They were zero-click, which is a big part of what made them so ter­ri­fy­ing. Also recall above how the Greek gov­ern­ment was­n’t just admit­ting to attempt­ing to hack Androulak­is’s phone. It sound­ed like the EYP admit­ted to hack­ing it. It rais­es the ques­tion as to whether or not Preda­tor is indeed zero-click or if Koukakis fell for a bad link at a lat­er date:

    ...
    Koukakis, 44, did not think about the mes­sage until months lat­er. In the days that fol­lowed, he was obliv­i­ous to the fact that the web­site that host­ed the sto­ry he was sent had dis­ap­peared. He also did not know that by click­ing on that link, he had opened an invis­i­ble door inside his phone, allow­ing spy­ware soft­ware called Preda­tor to creep in to silent­ly watch the mes­sages and calls he was send­ing and receiv­ing.

    His phone kept work­ing as if every­thing was nor­mal, he says. Then, in Decem­ber, Koukakis read a report about how Face­book par­ent com­pa­ny Meta had detect­ed com­mer­cial spy­ware being used by cus­tomers in 10 dif­fer­ent coun­tries, includ­ing Greece. One of the links used to trick peo­ple into down­load­ing the spy­ware was designed to look like CNN Greece—where he worked as an edi­tor.

    Sud­den­ly sus­pi­cious, he con­tact­ed Meta, which con­nect­ed him with researchers at Cit­i­zen Lab, a research facil­i­ty at the Uni­ver­si­ty of Toron­to that spe­cial­izes in spy­ware. In March, they told him that he was being spied on. He went pub­lic with that infor­ma­tion the fol­low­ing month, prompt­ing uproar and an inves­ti­ga­tion by a Greek pros­e­cu­tor. But the scan­dal was only get­ting start­ed. On July 26, anoth­er per­son revealed he had also received a link infect­ed with Preda­tor spy­ware: Nikos Androulakis, leader of PASOK, Greece’s third largest polit­i­cal par­ty.

    Androulakis did not click on the infect­ed link. But the fact some­one had attempt­ed to hack the phone of a serv­ing oppo­si­tion leader tipped the Greek gov­ern­ment into cri­sis. Two offi­cials have resigned so far and pres­sure is mount­ing on Prime Min­is­ter, Kyr­i­akos Mit­so­takis, to explain who’s behind the spy­ware.
    ...

    And the sto­ry of Cytrox is just one facet of a larg­er sto­ry of an out of con­trol spy­ware indus­try thriv­ing across the EU. And being used pri­mar­i­ly against the EU. Secret spy­ware firms pop­ping up all over the place, inevitably fol­lowed up with a spy­ware abuse scan­dal. It hap­pened with Hack­ingTeam almost a decade ago back and just keeps hap­pen­ing in one EU coun­try after anoth­er:

    ...
    The rip­ple effects of the scan­dal are reach­ing the heart of the Euro­pean Union. Over the past 13 months, it has been revealed that spy­ware had tar­get­ed oppo­si­tion lead­ers, jour­nal­ists, lawyers and activists in France, Spain, Hun­gary, Poland and even staff with­in the Euro­pean Com­mis­sion, the EU’s cab­i­net-style gov­ern­ment, between 2019 and 2021. The bloc has already set up an inquiry into its own use of spy­ware, but even as the 38-per­son com­mit­tee works toward pro­duc­ing a report for ear­ly 2023, the num­ber of new scan­dals is quick­ly mount­ing up.

    ...

    In June, Google dis­cov­ered the Ital­ian spy­ware ven­dor RCS Lab was tar­get­ing smart­phones in Italy and Kaza­khstan. Alber­to Nobili, RCS’ man­ag­ing direc­tor, told WIRED that the com­pa­ny con­demns the mis­use of its prod­ucts but declined to com­ment on whether the cas­es cit­ed by Google were exam­ples of mis­use. “RCS per­son­nel are not exposed, nor par­tic­i­pate in any activ­i­ties con­duct­ed by the rel­e­vant cus­tomers,” he says.

    More recent­ly, in July, spy­ware made by Austria’s DSIRF was detect­ed by Microsoft hack­ing into law firms, banks, and con­sul­tan­cies in Aus­tria, the UK, and Pana­ma. DSIRF did not reply to WIRED’s request for com­ment.

    “Europe is def­i­nite­ly a nexus,” says Justin Albrecht, secu­ri­ty intel­li­gence researcher at cyber­se­cu­ri­ty com­pa­ny Look­out. This jostling in the spy­ware indus­try echoes what hap­pened in 2015, when the well-known Ital­ian spy­ware mak­er Hack­ing Team was itself hacked and the company’s emails were leaked online, says Albrecht. “After that, we start­ed to see dif­fer­ent play­ers take away some of the busi­ness that was going to Hack­ing Team.”

    ...

    Some in Israel believe the focus on the NSO Group is dis­pro­por­tion­ate. “There’s a feel­ing in Israel that a fair part of this is just Israel-bash­ing, and if it were any oth­er coun­try, there wouldn’t have been near­ly as much noise about it,” says Chuck Freilich, a for­mer deputy nation­al secu­ri­ty advis­er in Israel. “There are com­pa­nies and oth­er coun­tries that do the exact same or almost exact same thing. They just don’t do it as well.”
    ...

    And as Dutch MEP Sophie in’t Veld admits, even the reg­u­la­tors can’t fig­ure out who is oper­at­ing in this space. It’s a cri­sis of trans­paren­cy. Which is a very san­i­tized way of describ­ing a spy­ware indus­try that even the gov­ern­ment does­n’t know about:

    ...
    For some, the sit­u­a­tion in Greece rein­forces the argu­ment that there needs to be indus­try-wide reg­u­la­tion. “Even if NSO Group clos­es tomor­row because of all the prob­lems they face today, the sit­u­a­tion will be the same if there is no change in the reg­u­la­tion,” says Eti­enne Maynier, a tech­nol­o­gist at Amnesty International’s Secu­ri­ty Lab. “The prob­lem is not one bad com­pa­ny. It’s real­ly the legal struc­ture that makes these com­pa­nies take these deci­sions.”

    Sophie in’t Veld, a Dutch MEP who is the rap­por­teur in charge of the PEGA com­mit­tee, is hop­ing to change that once the EU inquiry is com­plete next year. “This whole sec­tor should be heav­i­ly reg­u­lat­ed,” she says, adding she wants to force the sec­tor to be more trans­par­ent. “If you try to find out who these com­pa­nies are, who the peo­ple are behind them, and where they are based, it’s impos­si­ble.”
    ...

    It’s also worth keep­ing in mind that one of the rea­sons there’s so much secre­cy around this indus­try like­ly has to do with the uncom­fort­able fact that the EU mem­bers are still very like­ly spy­ing on each oth­er all the time and want to keep their home-grown spy­ware firms as safe as pos­si­ble from counter-intel­li­gence oper­a­tions from their fel­low EU-mem­bers. The EU is built on a foun­da­tion of treaties, laws, and shared bor­ders. No one said any­thing about trust.

    And that’s all part of why the EU par­lia­men­tary inter­est in Greece’s home­grown spy­ware-induced demo­c­ra­t­ic cri­sis should prob­a­bly be seen as both an oppor­tu­ni­ty to learn more about how this shad­ow indus­try oper­ates, but also an oppor­tu­ni­ty for indi­vid­ual MEPs to keep their own domes­tic spy­ware firms safe­ly in the shad­ows and away from pry­ing reg­u­la­to­ry eyes. In oth­er words, don’t be sur­prised if the MEPs inter­est­ed in inves­ti­gat­ed Greece’s spy­ing scan­dal end up less inter­est­ed in inves­ti­gat­ing their own domes­tic spy­ing scan­dals.

    Still, hope­ful­ly at least some of the EU par­lia­men­tar­i­ans will be gen­uine­ly inter­est­ed in a vig­or­ous inves­ti­ga­tion. And best of luck to any puta­tive reg­u­la­tors of this shad­ow indus­try. But let’s hope they nev­er click on ran­dom links texted to them. Because this is 2022. We’ve already answered the ques­tion of “Who watch­es the watch­ers?” The per­son who hacks their phone. That’s who. Watch­ers bet­ter watch their links. Espe­cial­ly spy­watch­ers in the EU. It’s a jun­gle in there.

    Posted by Pterrafractyl | August 23, 2022, 12:11 am

  25. We got as rather inter­est­ing NSO Group update. It appears NSO Group has dis­cov­ered a new pub­lic rela­tions oppor­tu­ni­ty: using NSO Group’s tool to track down the loca­tion of the Hamas kid­nap­ping vic­tims. That’s the mes­sage deliv­ered in a new Axios report based on an anony­mous source close to the com­pa­ny. Accord­ing to the source, sev­er­al Israeli intel­li­gence agen­cies are like­ly using the ‘zero-click’ Pega­sus spy­ware to help track the kid­nap vic­tims. Recall how Pega­sus enables for the col­lec­tion the loca­tion records off a phone, allow­ing for a ret­ro­spec­tive analy­sis of where the phone has been. So it sounds plau­si­ble that Pega­sus could indeed be used to gath­er loca­tion infor­ma­tion, although it’s not entire­ly clear how the Pega­sus mal­ware can be even deliv­ered to the phones of the kid­napped vic­tims at this point unless those phones are some­one con­nect­ed to either cell­phone tow­ers or the inter­net.

    Or per­haps they’re using infor­ma­tion that was being gath­ered and fed back to Israeli intel­li­gence from phones that already had the Pega­sus spy­ware installed on them at the time of the Octo­ber 7 attack. Were any of the Hamas fight­ers walk­ing around with spy­ware-infest­ed phones that day? It’s unclear, although it’s notable that this same anony­mous source claims they don’t know whether the Israeli gov­ern­ment has safe­guards in place to ensure the spy­ware tech­nol­o­gy won’t be used for broad sur­veil­lance of the entire Pales­tin­ian pop­u­la­tion.

    What is clear at this point is that NSO Group is hop­ing the use of its tools to locate the kid­nap vic­tims will ‘open a dia­logue’ with coun­tries like the US about the use­ful­ness of these tools. This is a good time to recall how the the Biden admin­is­tra­tion black­list­ed both NSO Group and Can­diru in Novem­ber of 2021. The gov­ern­ment of Israel open­ly admit­ted it was going to begin lob­by­ing the US gov­ern­ment to reverse that deci­sion. Also recall the reports about the FBI secret­ly pur­chas­ing the NSO Group’s tools to explor­ing using it to hack US phones. And then there was the sub­se­quent push to sell NSO Group to US nation­al secu­ri­ty con­trac­tor L3Harris, which result­ed in warn­ings from Sen­a­tor Ron Wyden about the secu­ri­ty risks of allow­ing a US firm to acquire NSO Group. Specif­i­cal­ly, the secu­ri­ty risk that any­thing col­lect­ed by the soft­ware is going to end up in the hands of Israeli intel­li­gence.

    Also note that NSO Group did even­tu­al­ly find new own­ers: the Dufresne Hold­ing Lux­em­bourg-based invest­ment firm, owned by NSO Group founder Omar Lavie. Recall how Lavie also found­ed Can­diru, which was the oth­er spy­ware firm Black­list­ed by the Biden admin­is­tra­tion back in Novem­ber of 2021. It’s the kind of detail that pre­sum­ably com­pli­cates these lob­by­ing efforts.

    That’s a big part of the con­text here. Because NSO Group clear­ly needs some very influ­en­tial lob­by­ing if its going to regain its lost clients. And the best lob­by­ing NSO Group could imag­ine would be brag­ging rights about how its tools saved the hostages. Hence, the inter­est­ing lob­by­ing cam­paign we’re see­ing emerge as a result of this con­flict:

    Axios

    Israel’s NSO unleash­es con­tro­ver­sial spy­ware in Gaza con­flict

    Sam Sabin, author of
    Axios Code­book
    11/14/2023

    The Israeli gov­ern­ment appears to be turn­ing to con­tro­ver­sial spy­ware mak­er NSO Group to help track those kid­napped and mur­dered by Hamas in the last month, accord­ing to a source with direct knowl­edge of NSO’s oper­a­tions.

    Why it mat­ters: NSO has come under fire for pro­vid­ing gov­ern­ments with sur­veil­lance tech­nol­o­gy that they have lat­er used to spy on jour­nal­ists, dis­si­dents and human rights activists.

    ...

    What’s hap­pen­ing: Accord­ing to the NSO-linked source, sev­er­al Israeli agen­cies are like­ly using Pega­sus — a “zero-click” mal­ware that can be snuck onto a tar­get’s device with­out them know­ing — to help track peo­ple kid­napped by Hamas, as well as peo­ple who have gone miss­ing dur­ing Hamas’ attack last month.

    * Pega­sus can be used to tap into cell phone sig­nals to assess who was on the ground dur­ing Hamas’ sur­prise attack on Oct. 7 and move­ment of those cell sig­nals before and after the attack, said the source, who request­ed anonymi­ty to speak freely about sen­si­tive oper­a­tions.

    * NSO has also estab­lished a so-called “war room” with oth­er sim­i­lar com­pa­nies and for­mer NSO employ­ees to track and unlock the phones belong­ing to peo­ple who have been mur­dered or gone miss­ing, as well as those belong­ing to sus­pect­ed ter­ror­ists.

    What they’re say­ing: “It’s not the pur­pose of why we’re doing it, but I think the peo­ple from the gov­ern­ment — both in Israel and out­side of Israel — and the pub­lic... now under­stand much bet­ter the val­ue of these kinds of tools and why they are need­ed,” the source told Axios.

    Yes, but: The source said they don’t know whether the Israeli gov­ern­ment has safe­guards in place to ensure the tech­nol­o­gy won’t be used for broad sur­veil­lance of the entire Pales­tin­ian pop­u­la­tion.

    * Recent reports sug­gest that Pega­sus has been used to spy on Pales­tin­ian human rights activists as recent­ly as 2021. Anoth­er uniden­ti­fied group also used Pega­sus to spy on dozens of Al Jazeera reporters in 2020.

    * Israeli agen­cies can decide for them­selves how they use Pega­sus or oth­er sur­veil­lance tools, the source said. “They have their own means, and I know they have legal coun­sels with them to know who exact­ly they can tar­get or not,” the per­son said.

    The big pic­ture: NSO’s push to help in the war effort comes amid a wide-reach­ing, U.S.-based lob­by­ing cam­paign to loosen restric­tions.

    ...

    * Recent dis­clo­sures filed under the For­eign Agents Reg­is­tra­tion Act, or FARA, also show that NSO met with a hand­ful of Repub­li­can Con­gres­sion­al aides between Feb­ru­ary and July this year, includ­ing staff mem­bers on the Sen­ate and House intel­li­gence com­mit­tees, as well as the House Armed Ser­vices Com­mit­tee.

    * And NSO has hired Stew­art Bak­er, a for­mer NSA gen­er­al coun­sel, and Jeff Weiss, a for­mer Com­merce offi­cial, to lob­by on their behalf, accord­ing to a recent con­gres­sion­al lob­by­ing dis­clo­sure.

    * “I think it’s clear to every­one that now is the time for greater intel­li­gence col­lab­o­ra­tion between allies, like the U.S. and Israel, to keep peo­ple safe from ter­ror­ists like Hamas,” the source said. “I would hope that there is more open­ness for a dia­logue right now.”

    The intrigue: A few Euro­pean gov­ern­ments have also alleged­ly start­ed push­ing the Biden admin­is­tra­tion to revis­it U.S. restric­tions on the com­pa­ny, per the source.

    * These clients claim that those restric­tions have made it dif­fi­cult for them to use Pega­sus to its full abil­i­ties in inves­ti­ga­tions track­ing recent anti-Semit­ic attacks, the source said.

    * How­ev­er, it’s unclear which coun­tries have reached out to the Biden admin­is­tra­tion — or in what ways the U.S. restric­tions have lim­it­ed exist­ing NSO clients’ use of the tech­nol­o­gy.

    ———–

    “Israel’s NSO unleash­es con­tro­ver­sial spy­ware in Gaza con­flict” by Sam Sabin; Axios; 11/14/2023

    “What’s hap­pen­ing: Accord­ing to the NSO-linked source, sev­er­al Israeli agen­cies are like­ly using Pega­sus — a “zero-click” mal­ware that can be snuck onto a tar­get’s device with­out them know­ing — to help track peo­ple kid­napped by Hamas, as well as peo­ple who have gone miss­ing dur­ing Hamas’ attack last month.”

    It’s a fas­ci­nat­ing appli­ca­tion of NSO Group’s pow­er­ful tech­nol­o­gy: use the Pega­sus spy­ware to obtain the loca­tion his­to­ries of the kid­napped peo­ple. Recall how grab­bing the loca­tion records off a phone — all for the retroac­tive exam­i­na­tion of some­one’s where­abouts — was one of the pow­er­ful fea­tures of Pega­sus. So it sounds like the plan is to some­one get the zero-click Pega­sus spy­ware sent to the vic­tims phones in the hopes that they are still charged and oper­at­ing and com­mu­ni­cat­ing with cell­tow­ers.

    Although it’s still a slight­ly con­fus­ing sto­ry, tech­ni­cal­ly speak­ing. Phones don’t nec­es­sar­i­ly need access to the telecom­mu­ni­ca­tion infra­struc­ture or the inter­net to track their loca­tions as long as the phone as a GPS receiv­er. It’s pos­si­ble that the vic­tims’ phones were still record­ing their loca­tion his­to­ry even if the phones were dis­con­nect­ed from the cell net­works and inter­net. But if the kid­napped vic­tims’ phones are still con­nect­ed to telecom­mu­ni­ca­tions infra­struc­ture and capa­ble of receiv­ing the zero-click Pega­sus mal­ware texts, the loca­tions of these phones would already be read­i­ly avail­able via the cell­phone providers. Although it’s also pos­si­ble for phones that are exclu­sive­ly con­nect­ed to the inter­net, with no cel­lu­lar sig­nal, to receive a text.

    So were the vic­tims phones turned off at one point but lat­er turned back on and con­nect­ed to the inter­net? Pos­si­bly by their cap­tors? These are the kinds of details that remain unclear in this sto­ry. Instead, we’re just told that sold the head­line sto­ry about how NSO Group and ‘oth­er sim­i­lar com­pa­nies’ and for­mer NSO employ­ees have set up a “war room” to help find the kid­napped vic­tims. As the anony­mous source for this sto­ry puts it, “It’s not the pur­pose of why we’re doing it, but I think the peo­ple from the gov­ern­ment — both in Israel and out­side of Israel — and the pub­lic... now under­stand much bet­ter the val­ue of these kinds of tools and why they are need­ed”:

    ...
    * Pega­sus can be used to tap into cell phone sig­nals to assess who was on the ground dur­ing Hamas’ sur­prise attack on Oct. 7 and move­ment of those cell sig­nals before and after the attack, said the source, who request­ed anonymi­ty to speak freely about sen­si­tive oper­a­tions.

    * NSO has also estab­lished a so-called “war room” with oth­er sim­i­lar com­pa­nies and for­mer NSO employ­ees to track and unlock the phones belong­ing to peo­ple who have been mur­dered or gone miss­ing, as well as those belong­ing to sus­pect­ed ter­ror­ists.

    What they’re say­ing: “It’s not the pur­pose of why we’re doing it, but I think the peo­ple from the gov­ern­ment — both in Israel and out­side of Israel — and the pub­lic... now under­stand much bet­ter the val­ue of these kinds of tools and why they are need­ed,” the source told Axios.
    ...

    And then we get to these rather inter­est­ing dis­clo­sures by this anony­mous source...a source who is clear­ly very close to NSO Group and on board with the com­pa­ny’s pub­lic rela­tions cam­paign: the source acknowl­edges they they don’t know whether or not the Israeli gov­ern­ment won’t be used for the broad sur­veil­lance of the entire Pales­tin­ian pop­u­la­tion. Which rais­es anoth­er pos­si­bil­i­ty in terms of track­ing the loca­tion of the kid­nap vic­tims: infer­ring their loca­tions by hack­ing the phones of Hamas and oth­er Pales­tini­ans sus­pect­ed of hold­ing the kid­nap vic­tims pris­on­er and using the cap­tors’ loca­tion his­to­ry instead.

    But we also have to ask: is the cur­rent con­flict being used as an excuse for installing this spy­ware on every sin­gle phone in Pales­tine? It sounds like the answer is ‘maybe’, at this point:

    ...
    Yes, but: The source said they don’t know whether the Israeli gov­ern­ment has safe­guards in place to ensure the tech­nol­o­gy won’t be used for broad sur­veil­lance of the entire Pales­tin­ian pop­u­la­tion.

    ...

    * Israeli agen­cies can decide for them­selves how they use Pega­sus or oth­er sur­veil­lance tools, the source said. “They have their own means, and I know they have legal coun­sels with them to know who exact­ly they can tar­get or not,” the per­son said.
    ...

    We should­n’t be sur­prised to learn that unnamed Euro­pean gov­ern­ments are also report­ed­ly lob­by­ing the Biden admin­is­tra­tion to lift the NSO Group Black­list. This is a good time to recall that NSO Group was­n’t the only par­ty pun­ished by the expo­sure and black­list­ing of the com­pa­ny. NSO Group’s clients were indi­rect­ly pun­ished too, through expo­sure and loss of access to their amaz­ing spy toys. Euro­pean gov­ern­ments aren’t above abus­ing these kinds of tools. It’s not hard to imag­ine there are a num­ber of Euro­pean gov­ern­ment — includ­ing local gov­ern­ments — that would love to see a lift­ing of inter­na­tion­al sanc­tions on the NSO Group:

    ...
    The intrigue: A few Euro­pean gov­ern­ments have also alleged­ly start­ed push­ing the Biden admin­is­tra­tion to revis­it U.S. restric­tions on the com­pa­ny, per the source.

    * These clients claim that those restric­tions have made it dif­fi­cult for them to use Pega­sus to its full abil­i­ties in inves­ti­ga­tions track­ing recent anti-Semit­ic attacks, the source said.

    * How­ev­er, it’s unclear which coun­tries have reached out to the Biden admin­is­tra­tion — or in what ways the U.S. restric­tions have lim­it­ed exist­ing NSO clients’ use of the tech­nol­o­gy.
    ...

    And all of this is hap­pen­ing in the con­text of a much larg­er US-based lob­by­ing cam­paign by NSO Group to at least loosen the restric­tions. Or as the anony­mous sources puts it, “I think it’s clear to every­one that now is the time for greater intel­li­gence col­lab­o­ra­tion between allies, like the U.S. and Israel, to keep peo­ple safe from ter­ror­ists like Hamas”:

    ...
    The big pic­ture: NSO’s push to help in the war effort comes amid a wide-reach­ing, U.S.-based lob­by­ing cam­paign to loosen restric­tions.

    ...

    * Recent dis­clo­sures filed under the For­eign Agents Reg­is­tra­tion Act, or FARA, also show that NSO met with a hand­ful of Repub­li­can Con­gres­sion­al aides between Feb­ru­ary and July this year, includ­ing staff mem­bers on the Sen­ate and House intel­li­gence com­mit­tees, as well as the House Armed Ser­vices Com­mit­tee.

    * And NSO has hired Stew­art Bak­er, a for­mer NSA gen­er­al coun­sel, and Jeff Weiss, a for­mer Com­merce offi­cial, to lob­by on their behalf, accord­ing to a recent con­gres­sion­al lob­by­ing dis­clo­sure.

    * “I think it’s clear to every­one that now is the time for greater intel­li­gence col­lab­o­ra­tion between allies, like the U.S. and Israel, to keep peo­ple safe from ter­ror­ists like Hamas,” the source said. “I would hope that there is more open­ness for a dia­logue right now.”
    ...

    And that brings us to the fol­low­ing report describ­ing that ongo­ing lob­by­ing effort. And as the arti­cle men­tions, NSO Group did ulti­mate­ly end up get­ting a new own­er back in March of this year: Omar Lavie. Of course, as we’ve seen, Lavie is one of NSO Group’s co-founders who went on to found Can­diru, which was the oth­er firm black­list­ed by the Biden admin­is­tra­tion back in Novem­ber of 2021. It’s the kind of sit­u­a­tion that sug­gests there’s going to be a lot more pro-NSO Group US lob­by­ing to be done:

    The Record

    NSO Group hires high-pow­ered lob­by­ists to help nav­i­gate US mar­ket

    Suzanne Smal­l­ey
    Octo­ber 31st, 2023

    The NSO Group, pur­vey­or of the noto­ri­ous Pega­sus spy­ware, has retained lob­by­ists with Nation­al Secu­ri­ty Agency and Com­merce Depart­ment expe­ri­ence to rep­re­sent the company’s inter­ests in Wash­ing­ton, accord­ing to a legal fil­ing with Con­gress.

    One of NSO’s new lob­by­ists is Stew­art Bak­er, a for­mer gen­er­al coun­sel at the Nation­al Secu­ri­ty Agency and for­mer senior Depart­ment of Home­land Secu­ri­ty offi­cial. The oth­er, Jeff Weiss, served as deputy direc­tor for pol­i­cy and strate­gic plan­ning at the Com­merce Depart­ment until 2017.

    Bak­er and Weiss have been hired to help NSO man­age nation­al secu­ri­ty and export con­trol issues. Both work for the Wash­ing­ton-based law firm Step­toe & John­son, which has more than $400 mil­lion in annu­al rev­enues.

    The Com­merce Depart­ment black­list­ed NSO Group in 2021 by plac­ing the com­pa­ny, which was found­ed by two for­mer Israeli mil­i­tary offi­cials, on its so-called Enti­ty List. Com­pa­nies on the list must fol­low strict licens­ing require­ments and oth­er rules meant to beef up over­sight of their oper­a­tions. In the case of NSO, the black­list­ing effec­tive­ly barred it from procur­ing mate­ri­als need­ed for its soft­ware from U.S. sell­ers.

    ...

    In March, Pres­i­dent Joe Biden issued an exec­u­tive order lim­it­ing the use of com­mer­cial spy­ware by fed­er­al agen­cies.

    The Pega­sus soft­ware is asso­ci­at­ed with human rights abus­es world­wide, with recent scan­dals involv­ing its covert use against dis­si­dents, politi­cians and jour­nal­ists Poland, Spain, Greece and else­where.

    Most recent­ly, Pega­sus was found on the phone of a promi­nent Russ­ian jour­nal­ist and crit­ic of the Krem­lin, Gali­na Tim­chenko, who owns the inde­pen­dent Russ­ian media out­let Meduza.

    NSO is cur­rent­ly head­quar­tered in the Tel Aviv area and is owned by a Lux­em­bourg-based com­pa­ny, Dufresne Hold­ing, which is con­trolled by Omri Lavie, one of NSO’s co-founders. NSO has had a long and tan­gled cor­po­rate evo­lu­tion as con­tro­ver­sy sur­round­ing its prod­uct has inten­si­fied.

    The new fil­ing with Con­gress comes after the com­pa­ny spent $1.1 mil­lion on lob­by­ing in the U.S. in 2022, accord­ing to non­prof­it OpenSecrets.org.

    In June the White House Nation­al Secu­ri­ty Coun­cil warned that it would close­ly review any Amer­i­can com­pa­ny attempt­ing to take over for­eign com­mer­cial sur­veil­lance soft­ware to deter­mine whether a “coun­ter­in­tel­li­gence threat” to the U.S. gov­ern­ment exists.

    The state­ment was issued after a Guardian reporter revealed that a pro­duc­er of sev­er­al Adam San­dler movies was con­sid­er­ing mak­ing a bid for NSO.

    ———–

    “NSO Group hires high-pow­ered lob­by­ists to help nav­i­gate US mar­ket” by Suzanne Smal­l­ey; The Record; 10/31/2023

    “The new fil­ing with Con­gress comes after the com­pa­ny spent $1.1 mil­lion on lob­by­ing in the U.S. in 2022, accord­ing to non­prof­it OpenSecrets.org.”

    Yes, what we are read­ing about isn’t a new lob­by­ing cam­paign by NSO Group. It’s on top of the $1.1 mil­lion spent on lob­by­ing in the US in 2022. And it’s hap­pen­ing after a March exec­u­tive order by the Biden White House to lim­it the use of com­mer­cial spy­ware by fed­er­al agen­cies as part of a broad­er fed­er­al crack­down on this sec­tor. In oth­er words, NSO Group and its fel­low spy­ware firms have plen­ty of issues to lob­by about:

    ...
    In March, Pres­i­dent Joe Biden issued an exec­u­tive order lim­it­ing the use of com­mer­cial spy­ware by fed­er­al agen­cies.

    ...

    In June the White House Nation­al Secu­ri­ty Coun­cil warned that it would close­ly review any Amer­i­can com­pa­ny attempt­ing to take over for­eign com­mer­cial sur­veil­lance soft­ware to deter­mine whether a “coun­ter­in­tel­li­gence threat” to the U.S. gov­ern­ment exists.

    The state­ment was issued after a Guardian reporter revealed that a pro­duc­er of sev­er­al Adam San­dler movies was con­sid­er­ing mak­ing a bid for NSO.
    ...

    But there’s anoth­er com­pli­ca­tion NSO Group might have to deal with: the new own­er is sort of the old­er own­er. Lux­em­bourg-based Dufresne Hold­ing is con­trolled by NSO Group co-founder Omri Lavie. Again, Lavie went on to found Can­diru. Can­diru was the oth­er firm Black­list­ed by the Biden admin­is­tra­tion in Novem­ber of 2021. That seems like a com­pli­ca­tion:

    ...
    NSO is cur­rent­ly head­quar­tered in the Tel Aviv area and is owned by a Lux­em­bourg-based com­pa­ny, Dufresne Hold­ing, which is con­trolled by Omri Lavie, one of NSO’s co-founders. NSO has had a long and tan­gled cor­po­rate evo­lu­tion as con­tro­ver­sy sur­round­ing its prod­uct has inten­si­fied.
    ...

    Will Omar Lavie’s acqui­si­tion of NSO Group be too much of a com­pli­ca­tion for these lob­by­ing efforts? Time will tell. But, again, there are few lob­by­ing efforts that will be more pow­er­ful than brag­ging rights over sav­ing the hostages.

    Well, maybe. There is one sce­nario were help­ing to free the hostages would­n’t be some­thing to brag about: if the data used was col­lect­ed from phones that already had the Pega­sus spy­ware on their phones before the Octo­ber 7 attack took place. In oth­er words, if the hostages are some­how saved thanks to the exis­tence of a secret spy­ware-based panop­ti­con fueled by NSO Group’s spy­ware, that may not be some­thing they want brag about. Or at least not dis­close all the details about how they saved the day.

    And that’s all why it’s going to be very inter­est­ing to see if the hostage cri­sis ends with the NSO Group tak­ing a bow for a job well done. Because it’s not hard to imag­ine NSO Group enthu­si­as­ti­cal­ly tak­ing cred­it for ‘sav­ing the day’ at this point. But it’s also not hard to imag­ine that the day was saved thanks to far more ram­pant spy­ware abus­es than any­one has pre­vi­ous­ly acknowl­edged.

    Posted by Pterrafractyl | November 15, 2023, 9:24 pm

  26. It’s mega-hack pan­ic time again. This time it’s the health­care sec­tor tak­ing the brunt of it. But don’t assume this is just a health­care hack sto­ry. Health­care is just the biggest known vic­tim so far. This is much big­ger sto­ry. It’s anoth­er mega-hack. Or at least that’s how it appears so far. It’s too new to real­ly know the scope.

    It start­ed a cou­ple of weeks ago with a Feb­ru­ary 19 dis­clo­sure about two vul­ner­a­bil­i­ties new­ly dis­closed by Con­nect­Wise, the com­pa­ny that makes the pop­u­lar Screen­Con­nect remote access soft­ware. The exploit allows for the hack­er to effec­tive­ly take con­trol of a machine remote­ly, allow­ing them to install all sorts of mal­ware, exfil­trate data, and gen­er­al­ly cre­ate a giant night­mare. While a patch was issued, it was­n’t deployed fast enough for Con­nect­Wise’s many cus­tomers and, with­in a week, secu­ri­ty experts were warn­ing that the hack was being mas­sive­ly exploit­ed in the wild.

    One of those cus­tomers hap­pens to be Change Health­care, an insur­ance claims pro­cess­ing giant recent­ly acquired by health­care giant Unit­ed­Health. The hack­ers claim 6 ter­bytes of per­son­al health­care infor­ma­tion was stolen. Fol­low­ing the dis­cov­ery of the hack, Change Health­care sus­pend­ed its ser­vices to the many com­pa­nies across the health­care sec­tor that rely on it, freez­ing up much of the phar­ma­ceu­ti­cal claims pro­cess­ing across the Unit­ed States.

    The cul­prit behind the Change Health­care hack appears to be the noto­ri­ous ran­somware group ALPHV, oth­er­wise known as Black­cat. But don’t assume that’s the cul­prit behind all the peo­ple exploit­ing this vul­ner­a­bil­i­ty. It’s a mass exploita­tion sit­u­a­tion. If your com­put­ers use Con­nect­Wise’s soft­ware, and you haven’t yet patched it while it’s been con­nect­ed to the inter­net for the past week, there’s a rea­son­able chance you’re now hacked by any one of the many groups exploit­ing this right now. Or per­haps more than one. It’s that kind of sit­u­a­tion. One that sounds an awful lot like the Solar­Wind night­mare, where trust­ed third-par­ty soft­ware gets com­pro­mised and turns into a giant back­door on orga­ni­za­tions around the world.

    Except, as we should expect, it’s prob­a­bly been going on a lot longer than just a cou­ple of weeks. In fact, back on Novem­ber 10, near­ly four months ago, we got a report about warn­ings from secu­ri­ty firm Huntress about intru­sions into the net­works of Trans­ac­tion Data Sys­tems (TDS) a a phar­ma­cy sup­ply chain and man­age­ment sys­tems solu­tion provider used in all 50 states. Huntress report­ed see­ing intru­sions from Octo­ber 28 to Novem­ber 8 and that they were like­ly ongo­ing. Screen­Con­nect was the iden­ti­fied cul­prit. Con­nect­Wise blamed it on an unman­aged machine on TDS’s net­works that was run­ning a ver­sion of Screen­Con­nect from 2019, which it described as not “best prac­tices”. Which, if you think about it, is an implic­it admis­sion that Screen­Con­nect has vul­ner­a­bil­ties like this since at least 2019 that it’s been wrestling with. And real­ly, who knows if that ‘old vul­ner­a­ble ver­sion’ was real­ly the expla­na­tion. What are the odds this hap­pened three months ago due to an old fixed Screen­Con­nect bug, in the phar­ma­ceu­ti­cal claims pro­cess­ing sec­tor no less, only to have this new night­mare emerge a few months lat­er?

    But that’s just one of the major hack sto­ries that erupt­ed over the past cou­ple of weeks. There’s anoth­er major hack­ing sto­ry and it could end up play­ing a role in the 2024 US Pres­i­dent elec­tion. Yes, it’s also polit­i­cal-mega-hack pan­ic time again. Maybe. The writ­ing is on the wall.

    The sec­ond hack­ing sto­ry actu­al­ly start­ed off with the good news that, per­haps not coin­ci­den­tal­ly, hap­pened on the same day (Feb 19) Con­nect­Wise dis­close its Screen­Con­nect vul­ner­a­bil­i­ty: an inter­na­tion­al bust of the Lock­Bit Ran­somware group was recent­ly car­ried out, seem­ing­ly shut­ting down the group’s IT infra­struc­ture used to deliv­er ran­somware threats. The UK led the inves­ti­ga­tion but the FBI and a num­ber of oth­er law enforce­ment agen­cies were involved. One of the big, not par­tic­u­lar­ly sur­pris­ing, rev­e­la­tions from the raid is that data from vic­tims who pre­vi­ous­ly paid the ran­som was found on their servers. In oth­er words, just because you pay the ran­som does­n’t mean the ran­somer is ever going to delete the data they stole from you. They’ll just give you the decryp­tion keys and not release it....hopefully. It’s some­thing to keep in mind regard­ing the six ter­abytes of Change Health­care’s sen­si­tive med­ical claims data.

    Days after the raid, Lock­Bit’s web­site was back up on the dark­web list­ing its vic­tims and the timers count­ing down until they run out of time to pay the ran­som. Beyond that, at least two experts report see­ing Lock­Bit exploit­ing the Con­nectScreen vul­ner­a­bil­i­ty. Lock­Bit is back in busi­ness. And this includes a ran­somware list­ing found on their new web­site for a cer­tain Ful­ton Coun­ty Court sys­tem. The same court sys­tem where Fani Willis is pros­e­cut­ing Don­ald Trump over his 2020 Geor­gia elec­tion manip­u­la­tion charges. Lock­Bit’s new web­site claims the group has files relat­ed to the case and even claims the inter­na­tion­al raid was an attempt to pre­vent the release of them. And it does­n’t appear to be blus­ter. Not only did Ful­ton Coun­ty first report back in Jan­u­ary that its court sys­tem was hacked, but Lock­Bit released some exam­ple doc­u­ments, although noth­ing about the Trump case, that experts felt looked authen­tic.

    Inter­est­ing­ly, as part of the inter­na­tion­al raid, the US placed sanc­tions on one of the pre­sumed lead­ers of Lock­Bit, Russ­ian nation­al Ivan Gen­nadievich Kon­dratiev. Thanks to those sanc­tions, US-based vic­tims lf Lock­Bit can’t legal­ly pay Lock­Bit’s ran­som. So we have a Trump elec­tion case ran­somware threat that can’t legal­ly be paid.

    So what hap­pened with the Ful­ton Coun­ty ran­som? Well, the dead­line came and went with­out a pay­ment, but no doc­u­ments were released. This led some experts to sug­gest the law enforce­ment raid made a big­ger impact on the group’s oper­a­tions than they let on. Oth­ers sug­gest­ed there’s a vari­ety of plau­si­ble motives for why the hack­ers may not have want­ed to release the doc­u­ments includ­ing the pos­si­bil­i­ty that the true hack­ers who broke into the cour­t­house­’s net­works may be an affil­i­ate of Lock­Bit using them to car­ry out the ran­som threat. The point being that we don’t actu­al­ly know who took those doc­u­ments or what their motives might be for releas­ing them. We just know at least one group has their dig­i­tal hands on doc­u­ments whose release could throw a major wrench into that case against Trump and some­one has threat­ened to release them.

    So two weeks ago, a new mas­sive vul­ner­a­bil­i­ty impact­ing thou­sands of orga­ni­za­tions was dis­closed, with hack­ers pro­ceed­ing to run wild exploit­ing it, which includ­ed the hack of Change Health­care, a linch­pin of the US health insur­ance claims pro­cess­ing infra­struc­ture, by noto­ri­ous hack­ing group, ALPHV/Blackcat. And on the same day, an inter­na­tion­al raid of anoth­er noto­ri­ous ran­somware group Lock­Bit ends with the take­down of com­put­ing infra­struc­ture and web­sites that were seem­ing­ly replaced with­in days. Lock­Bit pro­ceeds to not just engage in the Screen­Con­nect hack but issues a state­ment declar­ing its bust a polit­i­cal­ly tar­get­ed oper­a­tion intend­ed to pre­vent the release of Trump’s Ful­ton Coun­ty cour­t­house. A ran­som that can’t legal­ly be paid thanks to the US sanc­tions imposed one of the Lock­Bit’s lead­ers. But then that ran­som dead­line pass­es, no doc­u­ments are released, and here we are. It’s a bad sit­u­a­tion that’s only going to get a lot worse.

    Ok, first, here’s a KFF Health New report about how the Change Health­care hack has sin­gle­hand­ed­ly crip­pled the US’s abil­i­ty to process health insur­ance claims, lead­ing care providers to scram­ble for tem­po­rary alter­na­tives while we all wait to see just how many big this hack real­ly is:

    KFF Health News

    Hack­ing at Unit­ed­Health Unit Crip­ples a Swath of the US Health Sys­tem: What to Know

    By Dar­ius Tahir
    Updat­ed March 1, 2024
    Orig­i­nal­ly Pub­lished Feb­ru­ary 29, 2024

    Ear­ly in the morn­ing of Feb. 21, Change Health­care, a com­pa­ny unknown to most Amer­i­cans that plays a huge role in the U.S. health sys­tem, issued a brief state­ment say­ing some of its appli­ca­tions were “cur­rent­ly unavail­able.”

    By the after­noon, the com­pa­ny described the sit­u­a­tion as a “cyber secu­ri­ty” prob­lem.

    Since then, it has rapid­ly blos­somed into a cri­sis.

    The com­pa­ny, recent­ly pur­chased by insur­ance giant Unit­ed­Health Group, report­ed­ly suf­fered a cyber­at­tack. The impact is wide and expect­ed to grow. Change Healthcare’s busi­ness is main­tain­ing health care’s pipelines — pay­ments, requests for insur­ers to autho­rize care, and much more. Those pipes han­dle a big load: Change says on its web­site, “Our cloud-based net­work sup­ports 14 bil­lion clin­i­cal, finan­cial, and oper­a­tional trans­ac­tions annu­al­ly.”

    Ini­tial media reports have focused on the impact on phar­ma­cies, but techies say that’s under­stat­ing the issue. The Amer­i­can Hos­pi­tal Asso­ci­a­tion says many of its mem­bers aren’t get­ting paid and that doc­tors can’t check whether patients have cov­er­age for care.

    But even that’s just a slice of the emer­gency: Com­mon­Well, an insti­tu­tion that helps health providers share med­ical records, infor­ma­tion crit­i­cal to care, also relies on Change tech­nol­o­gy. The sys­tem con­tained records on 208 mil­lion indi­vid­u­als as of July 2023. Court­ney Bak­er, Com­mon­Well mar­ket­ing man­ag­er, said the net­work “has been dis­abled out of an abun­dance of cau­tion.”.

    “It’s small rip­ple pools that will get big­ger and big­ger over time, if it doesn’t get solved,” Saad Chaudhry, chief dig­i­tal and infor­ma­tion offi­cer at Lumin­is Health, a hos­pi­tal sys­tem in Mary­land, told KFF Health News.
    ...

    Who Did It?

    Media reports are fin­ger­ing ALPHV, a noto­ri­ous ran­somware group also known as Black­cat, which has become the tar­get of numer­ous law enforce­ment agen­cies world­wide. While Unit­ed­Health Group has said it is a “sus­pect­ed nation-state asso­ci­at­ed” attack, some out­side ana­lysts dis­pute the link­age. The gang has pre­vi­ous­ly been blamed for hack­ing casi­no com­pa­nies MGM and Cae­sars, among many oth­er tar­gets.

    The Depart­ment of Jus­tice alleged in Decem­ber, before the Change hack, that the group’s vic­tims had already paid it hun­dreds of mil­lions of dol­lars in ran­soms.

    Is This a New Prob­lem?

    Absolute­ly not. A study pub­lished in JAMA Health Forum in Decem­ber 2022 found that the annu­al num­ber of ran­somware attacks against hos­pi­tals and oth­er providers dou­bled from 2016 to 2021.

    “It’s more of the same, man,” said Aaron Miri, the chief dig­i­tal and infor­ma­tion offi­cer at Bap­tist Health in Jack­sonville, Flori­da.

    Because the assaults dis­able the target’s com­put­er sys­tems, providers have to shift to paper, slow­ing them down and mak­ing them vul­ner­a­ble to miss­ing infor­ma­tion.

    Fur­ther, a study pub­lished in May 2023 in JAMA Net­work Open exam­in­ing the effects of an attack on a health sys­tem found that wait­ing times, medi­an length of stay, and inci­dents of patients leav­ing against med­ical advice all increased — at neigh­bor­ing emer­gency depart­ments. The results, the authors wrote, mean cyber­at­tacks “should be con­sid­ered a region­al dis­as­ter.”

    ...

    What Does It Mean for Patients?

    Year after year, more Amer­i­cans’ health data is breached. That expos­es peo­ple to iden­ti­ty theft and med­ical error.

    Care can also suf­fer. For exam­ple, a 2017 attack, dubbed “Not­Petya,” forced a rur­al West Vir­ginia hos­pi­tal to reboot its oper­a­tions and hit phar­ma com­pa­ny Mer­ck so hard it wasn’t able to ful­fill pro­duc­tion tar­gets for an HPV vac­cine.

    Because of the Change Health­care attack, some patients may be rout­ed to new phar­ma­cies less affect­ed by billing prob­lems. Patients’ bills may also be delayed, indus­try exec­u­tives said. At some point, many patients are like­ly to receive notices their data was breached. Depend­ing on the exact data that has been pil­fered, those patients may be at risk for iden­ti­ty theft, Chaudhry said. Com­pa­nies often offer free cred­it mon­i­tor­ing ser­vices in those sit­u­a­tions.

    “Patients are dying because of this,” Miri said. Indeed, an Octo­ber preprint from researchers at the Uni­ver­si­ty of Min­neso­ta found a near­ly 21% increase in mor­tal­i­ty for patients in a ran­somware-strick­en hos­pi­tal.

    How Did It Hap­pen?

    The Health Infor­ma­tion Shar­ing and Analy­sis Cen­ter, an indus­try coor­di­nat­ing group that dis­sem­i­nates intel on attacks, has told its mem­bers that flaws in an appli­ca­tion called Con­nect­Wise Screen­Con­nect are to blame. Exact details couldn’t be con­firmed.

    It’s a tool tech sup­port teams use to remote­ly trou­bleshoot com­put­er prob­lems, and the attack is “appar­ent­ly fair­ly triv­ial to exe­cute,” H‑ISAC warned mem­bers. The group said it expects addi­tion­al vic­tims and advised its mem­bers to update their tech­nol­o­gy.

    How­ev­er, there’s uncer­tain­ty about how the attack hap­pened. Con­nect­Wise said in a state­ment that it is unaware of any con­nec­tion to the breach and that its inter­nal reviews have “yet to iden­ti­fy Change Health­care as a Screen­Con­nect cus­tomer, and none of our exten­sive net­work of man­aged ser­vice providers have come for­ward with any infor­ma­tion regard­ing their asso­ci­a­tion with Change Health­care.”

    When the attack first hit, the AHA rec­om­mend­ed its mem­bers dis­con­nect from sys­tems both at Change and its cor­po­rate par­ent, UnitedHealth’s Optum unit. That would affect ser­vices rang­ing from claims approvals to ref­er­ence tools.

    ...

    Unit­ed­Health has said only Change’s sys­tems are affect­ed and that it’s safe for hos­pi­tals to use oth­er dig­i­tal ser­vices pro­vid­ed by Unit­ed­Health and Optum, which include claims fil­ing and pro­cess­ing sys­tems.

    But not many chief infor­ma­tion offi­cers “are jump­ing to recon­nect,” Chaudhry said. “It’s an uneasy feel­ing.”

    ...

    Where’s the Fed­er­al Gov­ern­ment?

    Nei­ther exec­u­tive was san­guine about the future of cyber­se­cu­ri­ty in health care. “It’s going to get worse,” Chaudhry said.

    “It’s a shame the feds aren’t help­ing more,” Miri said. “You’d think if our nuclear infra­struc­ture were under attack the feds would respond with more gus­to.”

    While the depart­ments of Jus­tice and State have tar­get­ed the ALPHV group, the gov­ern­ment has stayed behind the scenes more in the after­math of this attack. Chaudhry said the FBI and the Depart­ment of Health and Human Ser­vices have been attend­ing calls orga­nized by the AHA to brief mem­bers about the sit­u­a­tion.

    ...

    ———–

    “Hack­ing at Unit­ed­Health Unit Crip­ples a Swath of the US Health Sys­tem: What to Know” By Dar­ius Tahir; KFF Health News; 02/29/2024

    “The com­pa­ny, recent­ly pur­chased by insur­ance giant Unit­ed­Health Group, report­ed­ly suf­fered a cyber­at­tack. The impact is wide and expect­ed to grow. Change Healthcare’s busi­ness is main­tain­ing health care’s pipelines — pay­ments, requests for insur­ers to autho­rize care, and much more. Those pipes han­dle a big load: Change says on its web­site, “Our cloud-based net­work sup­ports 14 bil­lion clin­i­cal, finan­cial, and oper­a­tional trans­ac­tions annu­al­ly.””

    The impact is wide and expect­ed to grow. Not the words one wants to hear when learn­ing about a new hack. But the words we should prob­a­bly expect by now. This is how these kinds of sto­ry almost always play out. It starts off bad and just keeps get­ting worse. And boy did this sto­ry start off bad. Change Health­care isn’t just owned by the Unit­ed­Health health insur­ance giant. It’s a major ser­vice provider for the US health­care sec­tor, han­dling sen­si­tive health­care data on hun­dreds of mil­lions of indi­vid­u­als, who are now poten­tial­ly vul­ner­a­ble to both iden­ti­ty theft and med­ical error:

    ...
    Ini­tial media reports have focused on the impact on phar­ma­cies, but techies say that’s under­stat­ing the issue. The Amer­i­can Hos­pi­tal Asso­ci­a­tion says many of its mem­bers aren’t get­ting paid and that doc­tors can’t check whether patients have cov­er­age for care.

    But even that’s just a slice of the emer­gency: Com­mon­Well, an insti­tu­tion that helps health providers share med­ical records, infor­ma­tion crit­i­cal to care, also relies on Change tech­nol­o­gy. The sys­tem con­tained records on 208 mil­lion indi­vid­u­als as of July 2023. Court­ney Bak­er, Com­mon­Well mar­ket­ing man­ag­er, said the net­work “has been dis­abled out of an abun­dance of cau­tion.”.

    ...

    Year after year, more Amer­i­cans’ health data is breached. That expos­es peo­ple to iden­ti­ty theft and med­ical error.

    Care can also suf­fer. For exam­ple, a 2017 attack, dubbed “Not­Petya,” forced a rur­al West Vir­ginia hos­pi­tal to reboot its oper­a­tions and hit phar­ma com­pa­ny Mer­ck so hard it wasn’t able to ful­fill pro­duc­tion tar­gets for an HPV vac­cine.

    Because of the Change Health­care attack, some patients may be rout­ed to new phar­ma­cies less affect­ed by billing prob­lems. Patients’ bills may also be delayed, indus­try exec­u­tives said. At some point, many patients are like­ly to receive notices their data was breached. Depend­ing on the exact data that has been pil­fered, those patients may be at risk for iden­ti­ty theft, Chaudhry said. Com­pa­nies often offer free cred­it mon­i­tor­ing ser­vices in those sit­u­a­tions.

    “Patients are dying because of this,” Miri said. Indeed, an Octo­ber preprint from researchers at the Uni­ver­si­ty of Min­neso­ta found a near­ly 21% increase in mor­tal­i­ty for patients in a ran­somware-strick­en hos­pi­tal.
    ...

    So how did this hap­pen and who is behind it? This is where the sto­ry gets extra awful. Because based on what we are learn­ing, this was­n’t an issue spe­cif­ic to Change Health­care’s IT prac­tices. Instead, Change Health­care got hit by a vul­ner­a­bil­i­ty impact­ing poten­tial­ly all the users of the Con­nect­Wise Screen­Con­nect remote access soft­ware. A vul­ner­a­bil­i­ty described as “appar­ent­ly fair­ly trival to exe­cute”. In oth­er words, this isn’t just a Change Health­care hack. The com­pa­ny is just the biggest, most news­wor­thy vic­tim that we know about yet:

    ...
    Who Did It?

    Media reports are fin­ger­ing ALPHV, a noto­ri­ous ran­somware group also known as Black­cat, which has become the tar­get of numer­ous law enforce­ment agen­cies world­wide. While Unit­ed­Health Group has said it is a “sus­pect­ed nation-state asso­ci­at­ed” attack, some out­side ana­lysts dis­pute the link­age. The gang has pre­vi­ous­ly been blamed for hack­ing casi­no com­pa­nies MGM and Cae­sars, among many oth­er tar­gets.

    The Depart­ment of Jus­tice alleged in Decem­ber, before the Change hack, that the group’s vic­tims had already paid it hun­dreds of mil­lions of dol­lars in ran­soms.

    ...

    The Health Infor­ma­tion Shar­ing and Analy­sis Cen­ter, an indus­try coor­di­nat­ing group that dis­sem­i­nates intel on attacks, has told its mem­bers that flaws in an appli­ca­tion called Con­nect­Wise Screen­Con­nect are to blame. Exact details couldn’t be con­firmed.

    It’s a tool tech sup­port teams use to remote­ly trou­bleshoot com­put­er prob­lems, and the attack is “appar­ent­ly fair­ly triv­ial to exe­cute,” H‑ISAC warned mem­bers. The group said it expects addi­tion­al vic­tims and advised its mem­bers to update their tech­nol­o­gy.
    ...

    Inter­est­ing­ly, Con­nect­Wise is seem­ing­ly deny­ing any involve­ment at all and claims that its inter­nal reviews have “yet to iden­ti­fy Change Health­care as a Screen­Con­nect cus­tomer, and none of our exten­sive net­work of man­aged ser­vice providers have come for­ward with any infor­ma­tion regard­ing their asso­ci­a­tion with Change Health­care.”:

    ...
    How­ev­er, there’s uncer­tain­ty about how the attack hap­pened. Con­nect­Wise said in a state­ment that it is unaware of any con­nec­tion to the breach and that its inter­nal reviews have “yet to iden­ti­fy Change Health­care as a Screen­Con­nect cus­tomer, and none of our exten­sive net­work of man­aged ser­vice providers have come for­ward with any infor­ma­tion regard­ing their asso­ci­a­tion with Change Health­care.”
    ...

    So is it pos­si­ble the Change Health­care was­n’t due to a vul­ner­a­bil­i­ty in the Con­nect­Wise remote access soft­ware, as Con­nect­Wise appears to claim? Well, sure, it’s pos­si­ble. But if that’s the case it’s a remark­able coin­ci­dence. For starters, it was just back on Novem­ber 10, 2023, over three months ago, when secu­ri­ty firm Huntress went pub­lic with warn­ings that Trans­ac­tion Data Sys­tems (TDS), a phar­ma­cy sup­ply chain and man­age­ment sys­tems solu­tion provider used across the US, was get­ting tar­get­ed by hack­ers using Screen­Con­nect. Huntress observed intru­sions between Octo­ber 28 and Novem­ber 8, and was like­ly still ongo­ing. Con­nect­Wise con­firmed TDS was hacked but appeared to shift the blame for the intru­sions on TDS, claim­ing the hack­er gained access via an unman­aged “on-prem instance” that has­n’t been updat­ed since 2019, going against the rec­om­mend­ed “best prac­tices.” And who knows, maybe TDS real­ly was respon­si­ble for run­ning an old unman­aged instances of Screen­Con­nect that gave these hack­ers back­door access. But, again, a lot of orga­ni­za­tions use Con­nect­Wise, and what are the odds TDS was the only one using this vul­ner­a­ble old ver­sion on one of their machines? And what are the odds this sto­ry about a Screen­Con­nect exploit in the health insur­ance claims sec­tor three months ago is com­plete­ly uncon­nect­ed to the health insur­ance Screen­Con­nect night­mare play­ing out right now:

    Bleep­ing Com­put­er

    Hack­ers breach health­care orgs via Screen­Con­nect remote access

    By Bill Toulas
    Novem­ber 10, 2023 02:57 PM

    Hack­ers breach health­care orgs via Screen­Con­nect remote access

    Secu­ri­ty researchers are warn­ing that hack­ers are tar­get­ing mul­ti­ple health­care orga­ni­za­tions in the U.S. by abus­ing the Screen­Con­nect remote access tool.

    Threat actors are lever­ag­ing local Screen­Con­nect instances used by Trans­ac­tion Data Sys­tems (TDS), a phar­ma­cy sup­ply chain and man­age­ment sys­tems solu­tion provider present in all 50 states.

    Researchers at man­aged secu­ri­ty plat­form Huntress spot­ted the attacks and report see­ing them on end­points from two dis­tinct health­care orga­ni­za­tions and activ­i­ty indi­cat­ing net­work recon­nais­sance in prepa­ra­tion of attack esca­la­tion.

    “The threat actor pro­ceed­ed to take sev­er­al steps, includ­ing installing addi­tion­al remote access tools such as Screen­Con­nect or Any­Desk instances, to ensure per­sis­tent access to the envi­ron­ments” — Huntress

    The observed intru­sions were observed between Octo­ber 28 and Novem­ber 8, 2023, and they are like­ly still hap­pen­ing.

    Attack details

    Huntress reports that the attacks fea­ture sim­i­lar tac­tics, tech­niques, and pro­ce­dures (TTPs). These include down­load­ing of a pay­load named text.xml, indi­cat­ing that the same actor is behind all observed inci­dents.

    The .XML con­tains C# code that loads the Metas­ploit attack pay­load Meter­preter into the sys­tem mem­o­ry, using non-Pow­er­Shell to evade detec­tion.

    ...

    The com­pro­mised end­points oper­ate on a Win­dows Serv­er 2019 sys­tem, belong­ing to two dis­tinct orga­ni­za­tions — one in the phar­ma­ceu­ti­cal sec­tor and the oth­er in health­care, the com­mon link between them being a Screen­Con­nect instance.

    The remote access tool was used to install addi­tion­al pay­loads, to exe­cute com­mands, trans­fer files, and to install Any­Desk. The hack­ers also tried to cre­ate new user account for per­sis­tent access.

    ...

    At this time, it is unclear if TDS suf­fered a breach, if the cre­den­tials to one of their accounts were com­pro­mised, or if the attack­ers exploit a dif­fer­ent mech­a­nism.

    Huntress made mul­ti­ple attempts to noti­fy TDS, now known as ‘Out­comes’, fol­low­ing a a merg­er last sum­mer, but the com­pa­ny did not reply back.

    ——–

    Update 11/14 — Con­nect­Wise, the ven­dor of Screen­Con­nect, has reached out to Bleep­ing­Com­put­er to share an impor­tant detail about the attack.

    Accord­ing to their vis­i­bil­i­ty, the attack­er gained access via an unman­aged on-prem instance that has­n’t been updat­ed since 2019, going against the rec­om­mend­ed “best prac­tices.”

    ———-

    “Hack­ers breach health­care orgs via Screen­Con­nect remote access” by Bill Toulas; Bleep­ing Com­put­er; 11/10/2023

    “Threat actors are lever­ag­ing local Screen­Con­nect instances used by Trans­ac­tion Data Sys­tems (TDS), a phar­ma­cy sup­ply chain and man­age­ment sys­tems solu­tion provider present in all 50 states.”

    It was like a pre­lude to today’s health insur­ance night­mare. Or, more like­ly, an ear­ly warn­ing about what’s like­ly been going on for months in a lot more orga­ni­za­tions than just TDS and Change Health­care. Going on since at least late Octo­ber, despite Screen­Con­nects attempts to defect the blame onto an old ver­sion:

    ...
    The observed intru­sions were observed between Octo­ber 28 and Novem­ber 8, 2023, and they are like­ly still hap­pen­ing.

    ...

    The com­pro­mised end­points oper­ate on a Win­dows Serv­er 2019 sys­tem, belong­ing to two dis­tinct orga­ni­za­tions — one in the phar­ma­ceu­ti­cal sec­tor and the oth­er in health­care, the com­mon link between them being a Screen­Con­nect instance.

    The remote access tool was used to install addi­tion­al pay­loads, to exe­cute com­mands, trans­fer files, and to install Any­Desk. The hack­ers also tried to cre­ate new user account for per­sis­tent access.

    ...

    Update 11/14 — Con­nect­Wise, the ven­dor of Screen­Con­nect, has reached out to Bleep­ing­Com­put­er to share an impor­tant detail about the attack.

    Accord­ing to their vis­i­bil­i­ty, the attack­er gained access via an unman­aged on-prem instance that has­n’t been updat­ed since 2019, going against the rec­om­mend­ed “best prac­tices.”
    ...

    And that ear­ly warn­ing we got back in Novem­ber is why we should­n’t allow this sto­ry about the Change Health­care deba­cle to remain focused on just Change Health­care. This is a much big­ger hack that’s prob­a­bly been going on for a lot longer than two weeks. Because, again, it’s not like Change Health­care was the only enti­ty to recent­ly get hacked as a result of a vul­ner­a­bil­i­ty already iden­ti­fied in the Con­nect­Wise soft­ware. It was just the biggest vic­tim in what experts are describ­ing as a mass attack:

    TechCrunch

    Researchers say easy-to-exploit secu­ri­ty bugs in Con­nect­Wise remote-access soft­ware now under mass attack

    Car­ly Page
    10:06 AM CST•February 26, 2024

    Secu­ri­ty researchers say a pair of easy-to-exploit flaws in a pop­u­lar remote-access tool used by more than a mil­lion com­pa­nies around the world are now being mass exploit­ed, with hack­ers abus­ing the vul­ner­a­bil­i­ties to deploy ran­somware and steal sen­si­tive data.

    Cyber­se­cu­ri­ty giant Man­di­ant said in a post on Fri­day that it has “iden­ti­fied mass exploita­tion” of the two flaws in Con­nect­Wise Screen­Con­nect, a pop­u­lar remote access tool that allows IT and tech­ni­cians to remote­ly pro­vide tech­ni­cal sup­port direct­ly on cus­tomer sys­tems over the inter­net.

    The two vul­ner­a­bil­i­ties com­prise CVE-2024–1709, an authen­ti­ca­tion bypass vul­ner­a­bil­i­ty that researchers deemed “embar­rass­ing­ly easy” for attack­ers to exploit, and CVE-2024–1708, a path-tra­ver­sal vul­ner­a­bil­i­ty that allows hack­ers to remote­ly plant mali­cious code, such as mal­ware, on vul­ner­a­ble Con­nect­Wise cus­tomer instances.

    Con­nect­Wise first dis­closed the flaws on Feb­ru­ary 19 and urged on-premise cus­tomers to install secu­ri­ty patch­es imme­di­ate­ly. How­ev­er, thou­sands of servers remain vul­ner­a­ble, accord­ing to data from the Shad­owserv­er Foun­da­tion, and each of these servers can man­age up to 150,000 cus­tomer devices.

    ...

    Finnish cyber­se­cu­ri­ty firm With­Se­cure said in a blog post Mon­day that its researchers have also observed “en-mass exploita­tion” of the Screen­Con­nect flaws from mul­ti­ple threat actors. With­Se­cure said these hack­ers are exploit­ing the vul­ner­a­bil­i­ties to deploy pass­word steal­ers, back doors, and in some cas­es ran­somware.

    With­Se­cure said it also observed hack­ers exploit­ing the flaws to deploy a Win­dows vari­ant of the Krusty­Loader back door on unpatched Screen­Con­nect sys­tems, the same kind of back door plant­ed by hack­ers recent­ly exploit­ing vul­ner­a­bil­i­ties in Ivanti’s cor­po­rate VPN soft­ware. With­Se­cure said it could not yet attribute the activ­i­ty to a par­tic­u­lar threat group, though oth­ers have linked the past activ­i­ty to a Chi­na-backed hack­ing group focused on espi­onage.

    Secu­ri­ty researchers at Sophos and Huntress both said last week that they had observed the Lock­Bit ran­somware gang launch­ing attacks that exploit the Con­nect­Wise vul­ner­a­bil­i­ties — just days after an inter­na­tion­al law enforce­ment oper­a­tion claimed to dis­rupt the noto­ri­ous Rus­sia-linked cyber­crime gang’s oper­a­tions.

    Huntress said in its analy­sis that it has since observed a “num­ber of adver­saries” lever­age exploits to deploy ran­somware, and a “sig­nif­i­cant num­ber” of adver­saries using exploits deploy cryp­tocur­ren­cy min­ing soft­ware, install addi­tion­al “legit­i­mate” remote access tools to main­tain per­sis­tent access to a victim’s net­work, and cre­ate new users on com­pro­mised machines.

    It’s not yet known how many Con­nect­Wise Screen­Con­nect cus­tomers or end users are affect­ed by these vul­ner­a­bil­i­ties, and Con­nect­Wise spokes­peo­ple did not respond to TechCrunch’s ques­tions. The company’s web­site claims that the orga­ni­za­tion pro­vides its remote access tech­nol­o­gy to more than a mil­lion small- to medi­um-sized busi­ness­es that man­age over 13 mil­lion devices.

    ...

    —–

    “Researchers say easy-to-exploit secu­ri­ty bugs in Con­nect­Wise remote-access soft­ware now under mass attack” by Car­ly Page; TechCrunch; 02/26/2024

    “Con­nect­Wise first dis­closed the flaws on Feb­ru­ary 19 and urged on-premise cus­tomers to install secu­ri­ty patch­es imme­di­ate­ly. How­ev­er, thou­sands of servers remain vul­ner­a­ble, accord­ing to data from the Shad­owserv­er Foun­da­tion, and each of these servers can man­age up to 150,000 cus­tomer devices.”

    ALL of Con­nect­Wise’s clients have been at risk since at least Feb­ru­ary 19, when the vul­ner­a­bil­i­ty was first dis­closed
    . Some have patched the vul­ner­a­bil­i­ty, but not all of them. And the exploita­tion appears to be ram­pant as hack­ing groups take advan­tage of orga­ni­za­tions that did­n’t imme­di­ate­ly fix the issue. And its not one hack­ing group tak­ing advan­tage of the sit­u­a­tion,. Mul­ti­ple threat actors have already been seen using this exploit:

    ...
    Finnish cyber­se­cu­ri­ty firm With­Se­cure said in a blog post Mon­day that its researchers have also observed “en-mass exploita­tion” of the Screen­Con­nect flaws from mul­ti­ple threat actors. With­Se­cure said these hack­ers are exploit­ing the vul­ner­a­bil­i­ties to deploy pass­word steal­ers, back doors, and in some cas­es ran­somware.

    With­Se­cure said it also observed hack­ers exploit­ing the flaws to deploy a Win­dows vari­ant of the Krusty­Loader back door on unpatched Screen­Con­nect sys­tems, the same kind of back door plant­ed by hack­ers recent­ly exploit­ing vul­ner­a­bil­i­ties in Ivanti’s cor­po­rate VPN soft­ware. With­Se­cure said it could not yet attribute the activ­i­ty to a par­tic­u­lar threat group, though oth­ers have linked the past activ­i­ty to a Chi­na-backed hack­ing group focused on espi­onage.

    ...

    Huntress said in its analy­sis that it has since observed a “num­ber of adver­saries” lever­age exploits to deploy ran­somware, and a “sig­nif­i­cant num­ber” of adver­saries using exploits deploy cryp­tocur­ren­cy min­ing soft­ware, install addi­tion­al “legit­i­mate” remote access tools to main­tain per­sis­tent access to a victim’s net­work, and cre­ate new users on com­pro­mised machines.
    ...

    But also note the remark­able tim­ing of this ongo­ing attack: it all start­ed just days after an inter­na­tion­al law enforce­ment oper­a­tion claimed to dis­rupt the Lock­Bit ran­somware gang. And yet secu­ri­ty researchers claim to be wit­ness­ing Lock­Bit exploit­ing this Con­nect­Wise vul­ner­a­bil­i­ty. In oth­er words, either the inter­na­tion­al take­down of Lock­Bit was very incom­plete, or there are mul­ti­ple groups out there researchers are iden­ti­fy­ing as “Lock­Bit”:

    ...
    Secu­ri­ty researchers at Sophos and Huntress both said last week that they had observed the Lock­Bit ran­somware gang launch­ing attacks that exploit the Con­nect­Wise vul­ner­a­bil­i­ties — just days after an inter­na­tion­al law enforce­ment oper­a­tion claimed to dis­rupt the noto­ri­ous Rus­sia-linked cyber­crime gang’s oper­a­tions.
    ...

    The sit­u­a­tion is bad and get­ting worse. And as the fol­low­ing TechCrunch piece warns, the take­down of Lock­Bit also revealed anoth­er grim sur­prise for the vic­tims of the ongo­ing Con­nect­Wise mega-hack: even if you pay hack­ers to delete the infor­ma­tion they stole from you, there’s no guar­an­tee they’re going to do so. That’s what we got to learn from UK author­i­ties fol­low­ing the take­down of Lock­Bit’s tech­ni­cal infra­struc­ture. Data from vic­tims who already paid a ran­som fee was recov­ered. Keep in mind that the group that hit Change Health­care — Blackcat/ALPHV — is claim­ing they stole 6 ter­abytes worth of infor­ma­tion. So while it remains to be seen if Change Health­care ends up pay­ing some sort of ran­som in an effort to resolve this sit­u­a­tion, we can be pret­ty con­fi­dent that stolen infor­ma­tion is going to remain in crim­i­nal hands for­ev­er:

    TechCrunch

    Six things we learned from the Lock­Bit take­down

    Car­ly Page, Zack Whit­tak­er / 4:30 AM CST•February 21, 2024

    A sweep­ing law enforce­ment oper­a­tion led by the U.K.’s Nation­al Crime Agency (NCA) this week took down Lock­Bit, the noto­ri­ous Rus­sia-linked ran­somware gang that for years has wreaked hav­oc on busi­ness­es, hos­pi­tals, and gov­ern­ments around the world.

    The action saw LockBit’s leak site downed, its servers seized, mul­ti­ple arrests made, and U.S. gov­ern­ment sanc­tions applied in what is one of the most sig­nif­i­cant oper­a­tions tak­en against a ran­somware group to date.

    It’s also, undoubt­ed­ly, one of the more nov­el take­downs we’ve seen, with U.K. author­i­ties announc­ing the seizure of LockBit’s infra­struc­ture on the group’s own leak site, now home to a host of details about the gang’s inner work­ings — with the promise of more to come.

    Here’s what we’ve learned so far.

    Lock­Bit didn’t delete vic­tims’ data — even if they paid

    It’s long been sus­pect­ed that pay­ing a hacker’s ran­som demand is a gam­ble and not a guar­an­tee that stolen data will be delet­ed. Some cor­po­rate vic­tims have even said as such, say­ing they “can­not guar­an­tee” that their data would be erased.

    The Lock­Bit take­down has giv­en us con­fir­ma­tion that this is absolute­ly the case. The NCA revealed that some of the data found on LockBit’s seized sys­tems belonged to vic­tims who had paid a ran­som to the threat actors, “evi­denc­ing that even when a ran­som is paid, it does not guar­an­tee that data will be delet­ed, despite what the crim­i­nals have promised,” the NCA said in a state­ment.

    Even ran­somware gangs fail to patch vul­ner­a­bil­i­ties

    Yes, even ran­somware gangs are slow to patch soft­ware bugs. Accord­ing to mal­ware research group vx-under­ground cit­ing Lock­Bit­Supp, the alleged leader of the Lock­Bit oper­a­tion, law enforce­ment hacked into the ran­somware operation’s servers using a known vul­ner­a­bil­i­ty in the pop­u­lar web cod­ing lan­guage PHP.

    The vul­ner­a­bil­i­ty used to com­pro­mise its servers is tracked as CVE-2023–3824, a remote exe­cu­tion flaw patched in August 2023, giv­ing Lock­Bit months to fix the bug.

    ...

    Ran­somware take­downs take a long time

    The Lock­Bit take­down, known offi­cial­ly as “Oper­a­tion Cronos,” was years in the mak­ing, accord­ing to Euro­pean law enforce­ment agency Europol. The agency revealed Tues­day that its inves­ti­ga­tion into the noto­ri­ous ran­somware gang began in April 2022, some two years ago at the request of French author­i­ties

    Since then, Europol said that its Euro­pean Cyber­crime Cen­ter, or EC3, orga­nized more than two dozen oper­a­tional meet­ings and four tech­ni­cal one-week sprints to devel­op the inves­tiga­tive leads ahead of the final phase of the inves­ti­ga­tion: this week’s take­down.

    Lock­Bit has hacked more than 2,000 orga­ni­za­tions

    It has long been known that Lock­Bit, which first entered the com­pet­i­tive cyber­crime scene in 2019, is one of, if not the most pro­lif­ic ran­somware gangs.

    Tuesday’s oper­a­tion all but con­firms that, and now the U.S. Jus­tice Depart­ment has num­bers to back it up. Accord­ing to the DOJ, Lock­Bit has claimed over 2,000 vic­tims in the U.S. and world­wide, and received more than $120 mil­lion in ran­som pay­ments.

    Sanc­tions tar­get­ing a key Lock­Bit mem­ber may affect oth­er ran­somware

    One of the top Lock­Bit mem­bers indict­ed and sanc­tioned on Tues­day is a Russ­ian nation­al, Ivan Gen­nadievich Kon­dratiev, who U.S. offi­cials allege is involved in oth­er ran­somware gangs.

    Accord­ing to the U.S. Trea­sury, Kon­dratiev also has ties to REvil, Ran­somEXX and Avad­don. While Ran­somEXX and Avad­don are less­er-known vari­ants, REvil was anoth­er Rus­sia-based ran­somware vari­ant that gained noto­ri­ety for high-pro­file hacks, mak­ing mil­lions in ran­som pay­ments by hack­ing U.S. net­work mon­i­tor­ing giant Kaseya.

    Kon­dratiev was also named a leader of a new­ly dis­closed Lock­Bit sub­group called the “Nation­al Haz­ard Soci­ety.” Lit­tle else is known about this Lock­Bit affil­i­ate yet, but the NCA promised to divulge more in the com­ing days.

    The sanc­tions effec­tive­ly ban U.S.-based vic­tims of Kondratiev’s ran­somware from pay­ing him the ran­soms he demands. Giv­en Kon­dratiev has hands in at least five dif­fer­ent ran­somware gangs, the sanc­tions are like­ly to make his life five times more dif­fi­cult.

    ...

    ———-

    “Six things we learned from the Lock­Bit take­down”; TechCrunch; 02/21/2024

    “The Lock­Bit take­down has giv­en us con­fir­ma­tion that this is absolute­ly the case. The NCA revealed that some of the data found on LockBit’s seized sys­tems belonged to vic­tims who had paid a ran­som to the threat actors, “evi­denc­ing that even when a ran­som is paid, it does not guar­an­tee that data will be delet­ed, despite what the crim­i­nals have promised,” the NCA said in a state­ment.”

    You might think you’re pay­ing to unlock your ran­somware-infect­ed sys­tem and ‘return to nor­mal’, but don’t suf­fer from the delu­sion that pay­ing the ran­som is going to make the night­mare go away. Stolen data will remain stolen and passed around on the dark­web. That’s the mes­sage from the U.K.’s Nation­al Crime Agency (NCA) fol­low­ing “Oper­a­tion Cronos” and the take­down of Lock­Bit. A take­down the FBI par­tic­i­pat­ed in. Or alleged take­down. The group’s web­site was appar­ent­ly ready back up and run­ning days after this arti­cle was pub­lished:

    ...
    The Lock­Bit take­down, known offi­cial­ly as “Oper­a­tion Cronos,” was years in the mak­ing, accord­ing to Euro­pean law enforce­ment agency Europol. The agency revealed Tues­day that its inves­ti­ga­tion into the noto­ri­ous ran­somware gang began in April 2022, some two years ago at the request of French author­i­ties

    ...

    It has long been known that Lock­Bit, which first entered the com­pet­i­tive cyber­crime scene in 2019, is one of, if not the most pro­lif­ic ran­somware gangs.
    ...

    And then we get to this inter­est­ing detail that could cre­ate it’s not like Lock­Bit’s tech­ni­cal infra­struc­ture was the only part of Lock­Bit’s oper­a­tions that was thwart­ed by Oper­a­tion Cronos. Indi­vid­u­als in the orga­ni­za­tion were named, indict­ed, and sanc­tioned, includ­ing one of Lock­Bit’s alleged top mem­bers, Russ­ian nation­al Ivan Gen­nadievich Kon­dratiev. And it sounds like those sanc­tions might legal­ly pre­vent US vic­tims from pay­ing a Lock­Bit ran­som demand. Which, could be a bit of a com­pli­ca­tion for Lock­bit’s the US-based vic­tims. With Lock­Bit already over 2,000 vic­tims world­wide (and that was before the Con­nect­Wise mega-hack), there’s bound to be quite a few US vic­tims will­ing to pay to unlock their sys­tems, whether the data gets delet­ed or not:

    ...
    Tuesday’s oper­a­tion all but con­firms that, and now the U.S. Jus­tice Depart­ment has num­bers to back it up. Accord­ing to the DOJ, Lock­Bit has claimed over 2,000 vic­tims in the U.S. and world­wide, and received more than $120 mil­lion in ran­som pay­ments.

    ...

    One of the top Lock­Bit mem­bers indict­ed and sanc­tioned on Tues­day is a Russ­ian nation­al, Ivan Gen­nadievich Kon­dratiev, who U.S. offi­cials allege is involved in oth­er ran­somware gangs.

    Accord­ing to the U.S. Trea­sury, Kon­dratiev also has ties to REvil, Ran­somEXX and Avad­don. While Ran­somEXX and Avad­don are less­er-known vari­ants, REvil was anoth­er Rus­sia-based ran­somware vari­ant that gained noto­ri­ety for high-pro­file hacks, mak­ing mil­lions in ran­som pay­ments by hack­ing U.S. net­work mon­i­tor­ing giant Kaseya.

    ...

    The sanc­tions effec­tive­ly ban U.S.-based vic­tims of Kondratiev’s ran­somware from pay­ing him the ran­soms he demands. Giv­en Kon­dratiev has hands in at least five dif­fer­ent ran­somware gangs, the sanc­tions are like­ly to make his life five times more dif­fi­cult.
    ...

    And that legal com­pli­ca­tion for US-based vic­tims in pay­ing their Lock­Bit ran­soms brings us to the fol­low­ing sto­ry that may have just fiz­zled out...or may be build­ing towards some­thing much big­ger. So big it could shape the 2024 US Pres­i­den­tial elec­tion. Yes, it turns out the Ful­ton Coun­ty, Geor­gia, cour­t­house is one of Lock­Bit’s vic­tims. And they are not just demand­ing a ran­som but threat­en­ing to release infor­ma­tion about Fani Willis’s tri­al against Don­ald Trump over Trump’s attempts to intim­i­date his way to a 2020 win in Geor­gia. Mak­ing this the kind of sto­ry that could end up trig­ger­ing the kind of legal tech­ni­cal­i­ties that could get Trump let off the hook.

    That the Ful­ton Coun­ty cour­t­house was hacked isn’t in doubt. Its web­site even men­tions some sort of net­work dis­rup­tion. And one secu­ri­ty researcher reports see­ing Lock­Bit release what appeared to be an authen­tic look­ing sam­ple doc­u­ment.

    Intrigu­ing­ly, the new­ly launched Lock­Bit web­site even asserts that the take­down raid was itself an attempt to block the release of the Trump-relat­ed court doc­u­ments. But then the sto­ry took a sig­nif­i­cant twist: the ran­som dead­line passed with­out any pay­ments but no data was released. Instead, the ran­dom list­ing for Ful­ton Coun­ty was sim­ply removed from the Lock­Bit web­site (the same web­site that was tak­en down by law enforce­ment days ear­li­er until it popped back up). Some secu­ri­ty experts spec­u­late that this could be due to the law enforce­ment actions a week ear­li­er impact­ing the group more than they let on. But oth­ers note that there’s a range of pos­si­ble motives for not releas­ing the files, includ­ing the pos­si­bil­i­ty that the files were ulti­mate­ly obtained by a dif­fer­ent hack­ing group who teamed up with Lock­Bit for exe­cut­ing the ran­som threat. In oth­er words, per­haps a third par­ty affil­i­at­ed hack­er group, which might have very dif­fer­ent moti­va­tions than Lock­Bit, has its own rea­sons for not releas­ing the stolen documents...at least not until the time is right:

    Wired

    The Mys­te­ri­ous Case of the Miss­ing Trump Tri­al Ran­somware Leak

    The noto­ri­ous Lock­Bit gang promised a Geor­gia court leak “that could affect the upcom­ing US elec­tion.” It did­n’t materialize—but the sto­ry may not be over yet.

    ANDY GREENBERG
    SECURITY
    FEB 29, 2024 1:24 PM

    This week, the noto­ri­ous ran­somware gang known as Lock­Bit threat­ened a kind of dis­rup­tion that would have been a first even for a crim­i­nal indus­try that has crip­pled hos­pi­tals and trig­gered the shut­down of a gas pipeline: leak­ing doc­u­ments from the crim­i­nal pros­e­cu­tion of a for­mer pres­i­dent and pres­i­den­tial can­di­date.

    Then, with­out expla­na­tion, that threat evap­o­rat­ed, leav­ing plen­ty of unan­swered ques­tions behind.

    For the past five days, Lock­Bit promised on its dark-web site to pub­lish data stolen from the Ful­ton Coun­ty, Geor­gia, gov­ern­ment, which it list­ed as one of its extor­tion vic­tims, unless the coun­ty paid an unspec­i­fied ran­som. One admin­is­tra­tor for the group went so far as to post the spe­cif­ic threat of releas­ing doc­u­ments relat­ed to Ful­ton Coun­ty’s high-pro­file pros­e­cu­tion of Don­ald Trump: the Supe­ri­or Court of Ful­ton Coun­ty is the venue where Trump, the Repub­li­can pres­i­den­tial front-run­ner, stands accused of a crim­i­nal con­spir­a­cy to inter­fere in the 2020 elec­tion.

    Yet when the hack­er group’s own dead­line for that leak arrived, no doc­u­ments appeared. Instead, Lock­Bit mys­te­ri­ous­ly removed any men­tion of it from its web­site. Ful­ton Coun­ty offi­cials have denied pay­ing a ransom—which leaves unan­swered why the leak dis­ap­peared, and whether Lock­Bit still holds any of the court’s doc­u­ments or ever did in the first place.

    “We’re not aware of any data hav­ing been released today so far,” Ful­ton Coun­ty Com­mis­sion Chair­man Robb Pitts said in a Thurs­day after­noon press con­fer­ence. “Now that being said, that does not mean the threat is over by any means, and they could release what­ev­er data they have at any time, today, tomor­row or any time in the future. We have no con­trol over that.”

    The ran­somware crew’s threat, before it van­ished, had been dra­mat­i­cal­ly timed: It fol­lowed a coor­di­nat­ed law enforce­ment take­down oper­a­tion tar­get­ing Lock­Bit just last week. Known as Oper­a­tion Chronos and led by the UK’s Nation­al Crime Agency, the oper­a­tion took con­trol of much of Lock­Bit’s infra­struc­ture, seized hun­dreds of its cryp­tocur­ren­cy wal­lets, tore down the dark-web sites it uses in its extor­tion cam­paigns, and even claimed to have com­pro­mised some of its mem­bers and part­ners. Just days lat­er, how­ev­er, Lock­Bit man­aged to launch a new dark-web site, where it post­ed a list of vic­tims along with count­down timers for each rep­re­sent­ing their dead­line to pay a ran­som before the hack­ers leaked their stolen data. The dead­line for the Ful­ton Coun­ty doc­u­ments had been set for Feb­ru­ary 29 at 1:49 pm UTC.

    On that relaunched site, one Lock­Bit admin­is­tra­tor also post­ed a lengthy screed accus­ing the FBI of tim­ing the take­down specif­i­cal­ly to pre­vent the release of the Trump-relat­ed Ful­ton Coun­ty court documents—and promis­ing to release them despite the bust if Ful­ton Coun­ty did­n’t pay.

    “The FBI decid­ed to hack now for one rea­son only, because they did­n’t want to leak infor­ma­tion from [the Ful­ton Coun­ty gov­ern­ment web­site],” the Lock­Bit admin­is­tra­tor wrote. “The stolen doc­u­ments con­tain a lot of inter­est­ing things and Don­ald Trump’s court cas­es that could affect the upcom­ing US elec­tion.”

    The hack­ing-relat­ed paral­y­sis of Ful­ton Coun­ty’s gov­ern­ment, at least, seems to be very real: By its own admis­sion, the coun­ty gov­ern­ment is fac­ing a seri­ous and ongo­ing net­work dis­rup­tion that looks very much like a ran­somware attack. The web­site for Ful­ton Coun­ty’s gov­ern­ment has not­ed in an alert on its home­page for near­ly a week that it’s “expe­ri­enc­ing an unex­pect­ed IT out­age cur­rent­ly affect­ing mul­ti­ple sys­tems” and that sys­tems relat­ed to every­thing from phone lines to tax col­lec­tion to courts had been affect­ed. An offi­cial who answered the phone at the coun­ty’s pub­licly list­ed phone line tells WIRED the out­age had begun as ear­ly as late Jan­u­ary. But a coun­ty gov­ern­ment spokesper­son declined WIRED’s request for more infor­ma­tion on the attack.

    The Lock­Bit hack­ers also post­ed some con­vinc­ing sam­ple doc­u­ments that appeared to have been stolen from the Ful­ton Coun­ty court sys­tems pri­or to the take­down last week, accord­ing to Geor­gia-based reporter George Chi­di, who wrote about the inci­dent ear­li­er this month. Chi­di report­ed see­ing doc­u­ments that includ­ed court files and even doc­u­ments under seal in spe­cif­ic cas­es, though none appeared to be relat­ed to Trump’s pros­e­cu­tion.

    Then, on Wednes­day, just hours before Lock­Bit’s dead­line for the coun­ty to pay its ran­som expired, the count­down timer for that leak on Lock­bit’s web­site froze, with an added line of text that read, “Timer stopped.” At the promised time of 1:49 PM UTC Thurs­day, the leak failed to mate­ri­al­ize. Instead, all men­tion of Ful­ton Coun­ty was removed from Lock­Bit’s extor­tion threat site.

    In Thurs­day’s press con­fer­ence, Ful­ton Coun­ty Chair­man Rob Pitts denied that the coun­ty had paid Lock­bit’s extor­tion fee. “We have not paid any ran­som, nor has any ran­som been paid on our behalf,” Pitts said.

    Lock­Bit instead may well be bluffing—either it does­n’t have the goods it claims or isn’t ready to give up on its extor­tion demand. Robert McAr­dle, a researcher who leads a cyber­crime-focused research team at secu­ri­ty firm Trend Micro and was involved in the law enforce­ment oper­a­tion against Lock­Bit, says the group’s thus-far emp­ty threat is a sign that it was like­ly more dis­rupt­ed by the bust than it wants to admit.

    “This appears to be fur­ther evi­dence of the dif­fi­cul­ties fac­ing Lock­Bit ever since Op Chronos took place, and should be con­sid­ered as a sign they are unable to reli­ably fol­low through on their state­ments,” says McAr­dle. He points out that the vic­tims list­ed on the group’s new dark-web site were all com­pro­mised pri­or to Oper­a­tion Chronos and that con­tin­u­ing to threat­en them is the group’s attempt to “appear as if every­thing is nor­mal when most evi­dence points very much to the con­trary.”

    There remain oth­er the­o­ries, how­ev­er, that Lock­bit might still pos­sess the court’s data but is seek­ing to use it in some oth­er way. “They gen­er­al­ly don’t lie about vic­tims, because they’re so wor­ried about their rep­u­ta­tion,” says Jon DiMag­gio, the ran­somware-focused chief secu­ri­ty strate­gist at cyber­se­cu­ri­ty firm Analyst1. He notes that the deci­sion to take down the leak threat may have been the deci­sion of the “affil­i­ate” hack­ers who part­ner with Lock­Bit to pen­e­trate vic­tims like Ful­ton Coun­ty and may have dif­fer­ent moti­va­tions from Lock­Bit itself.

    If Ful­ton Coun­ty doc­u­ments do remain in the hands of hack­ers, and if any of them relate to the Trump case, they could fur­ther com­pli­cate an already deeply messy tri­al. The state’s case has been rocked by alle­ga­tions that the pros­e­cu­tor in the case, Ful­ton Coun­ty dis­trict attor­ney Fan­ni Willis, had an improp­er affair with anoth­er pros­e­cu­tor involved in Trump’s pros­e­cu­tion, which the defense has argued should require Willis’ dis­missal. The com­pro­mise of non-pub­lic doc­u­ments in the case could make the proceedings—and the upcom­ing US pres­i­den­tial election—even more chaot­ic.

    ...

    ———–

    “The Mys­te­ri­ous Case of the Miss­ing Trump Tri­al Ran­somware Leak” by ANDY GREENBERG; Wired; 02/29/2024

    “For the past five days, Lock­Bit promised on its dark-web site to pub­lish data stolen from the Ful­ton Coun­ty, Geor­gia, gov­ern­ment, which it list­ed as one of its extor­tion vic­tims, unless the coun­ty paid an unspec­i­fied ran­som. One admin­is­tra­tor for the group went so far as to post the spe­cif­ic threat of releas­ing doc­u­ments relat­ed to Ful­ton Coun­ty’s high-pro­file pros­e­cu­tion of Don­ald Trump: the Supe­ri­or Court of Ful­ton Coun­ty is the venue where Trump, the Repub­li­can pres­i­den­tial front-run­ner, stands accused of a crim­i­nal con­spir­a­cy to inter­fere in the 2020 elec­tion.”

    It’s a remark­able turn of affairs: bare­ly a week after the Inter­na­tion­al Lock­Bit take­down, the group’s web­site is back up and now threat­en­ing to release doc­u­ments relat­ed to Trump’s Ful­ton Coun­ty tri­al. Or was threat­en­ing, until the dead­line passed. And while the lack of released doc­u­ments has some sus­pect­ing it was a false threat, the group did release what appeared to be real doc­u­ments and there’s no deny­ing the cour­t­house was expe­ri­enc­ing tech­ni­cal dif­fi­cul­ties. There’s no way to reall dis­count the threat of a doc­u­ment leak in Trump’s case:

    ...
    The ran­somware crew’s threat, before it van­ished, had been dra­mat­i­cal­ly timed: It fol­lowed a coor­di­nat­ed law enforce­ment take­down oper­a­tion tar­get­ing Lock­Bit just last week. Known as Oper­a­tion Chronos and led by the UK’s Nation­al Crime Agency, the oper­a­tion took con­trol of much of Lock­Bit’s infra­struc­ture, seized hun­dreds of its cryp­tocur­ren­cy wal­lets, tore down the dark-web sites it uses in its extor­tion cam­paigns, and even claimed to have com­pro­mised some of its mem­bers and part­ners. Just days lat­er, how­ev­er, Lock­Bit man­aged to launch a new dark-web site, where it post­ed a list of vic­tims along with count­down timers for each rep­re­sent­ing their dead­line to pay a ran­som before the hack­ers leaked their stolen data. The dead­line for the Ful­ton Coun­ty doc­u­ments had been set for Feb­ru­ary 29 at 1:49 pm UTC.

    On that relaunched site, one Lock­Bit admin­is­tra­tor also post­ed a lengthy screed accus­ing the FBI of tim­ing the take­down specif­i­cal­ly to pre­vent the release of the Trump-relat­ed Ful­ton Coun­ty court documents—and promis­ing to release them despite the bust if Ful­ton Coun­ty did­n’t pay.

    “The FBI decid­ed to hack now for one rea­son only, because they did­n’t want to leak infor­ma­tion from [the Ful­ton Coun­ty gov­ern­ment web­site],” the Lock­Bit admin­is­tra­tor wrote. “The stolen doc­u­ments con­tain a lot of inter­est­ing things and Don­ald Trump’s court cas­es that could affect the upcom­ing US elec­tion.”

    The hack­ing-relat­ed paral­y­sis of Ful­ton Coun­ty’s gov­ern­ment, at least, seems to be very real: By its own admis­sion, the coun­ty gov­ern­ment is fac­ing a seri­ous and ongo­ing net­work dis­rup­tion that looks very much like a ran­somware attack. The web­site for Ful­ton Coun­ty’s gov­ern­ment has not­ed in an alert on its home­page for near­ly a week that it’s “expe­ri­enc­ing an unex­pect­ed IT out­age cur­rent­ly affect­ing mul­ti­ple sys­tems” and that sys­tems relat­ed to every­thing from phone lines to tax col­lec­tion to courts had been affect­ed. An offi­cial who answered the phone at the coun­ty’s pub­licly list­ed phone line tells WIRED the out­age had begun as ear­ly as late Jan­u­ary. But a coun­ty gov­ern­ment spokesper­son declined WIRED’s request for more infor­ma­tion on the attack.

    The Lock­Bit hack­ers also post­ed some con­vinc­ing sam­ple doc­u­ments that appeared to have been stolen from the Ful­ton Coun­ty court sys­tems pri­or to the take­down last week, accord­ing to Geor­gia-based reporter George Chi­di, who wrote about the inci­dent ear­li­er this month. Chi­di report­ed see­ing doc­u­ments that includ­ed court files and even doc­u­ments under seal in spe­cif­ic cas­es, though none appeared to be relat­ed to Trump’s pros­e­cu­tion.

    ...

    If Ful­ton Coun­ty doc­u­ments do remain in the hands of hack­ers, and if any of them relate to the Trump case, they could fur­ther com­pli­cate an already deeply messy tri­al. The state’s case has been rocked by alle­ga­tions that the pros­e­cu­tor in the case, Ful­ton Coun­ty dis­trict attor­ney Fan­ni Willis, had an improp­er affair with anoth­er pros­e­cu­tor involved in Trump’s pros­e­cu­tion, which the defense has argued should require Willis’ dis­missal. The com­pro­mise of non-pub­lic doc­u­ments in the case could make the proceedings—and the upcom­ing US pres­i­den­tial election—even more chaot­ic.
    ...

    But then the dead­line came and went with­out a leak. What’s the expla­na­tion? We can only spec­u­late. And while that can include spec­u­la­tion about the hack­ers bluff­ing, that should also include spec­u­la­tion that the hack­ers do have the files but have their own motives for not releas­ing them. And also spec­u­la­tion that Lock­Bit may not be the only be the actu­al hack­er group who stole these fines and are putting them up for ran­som. With Lock­Bit oper­at­ing as a kind of hack­er ran­som ser­vice for dif­fer­ent hack­ing groups, we can’t real­ly say who may have these files or why:

    ...
    Then, on Wednes­day, just hours before Lock­Bit’s dead­line for the coun­ty to pay its ran­som expired, the count­down timer for that leak on Lock­bit’s web­site froze, with an added line of text that read, “Timer stopped.” At the promised time of 1:49 PM UTC Thurs­day, the leak failed to mate­ri­al­ize. Instead, all men­tion of Ful­ton Coun­ty was removed from Lock­Bit’s extor­tion threat site.

    In Thurs­day’s press con­fer­ence, Ful­ton Coun­ty Chair­man Rob Pitts denied that the coun­ty had paid Lock­bit’s extor­tion fee. “We have not paid any ran­som, nor has any ran­som been paid on our behalf,” Pitts said.

    Lock­Bit instead may well be bluffing—either it does­n’t have the goods it claims or isn’t ready to give up on its extor­tion demand. Robert McAr­dle, a researcher who leads a cyber­crime-focused research team at secu­ri­ty firm Trend Micro and was involved in the law enforce­ment oper­a­tion against Lock­Bit, says the group’s thus-far emp­ty threat is a sign that it was like­ly more dis­rupt­ed by the bust than it wants to admit.

    ...

    There remain oth­er the­o­ries, how­ev­er, that Lock­bit might still pos­sess the court’s data but is seek­ing to use it in some oth­er way. “They gen­er­al­ly don’t lie about vic­tims, because they’re so wor­ried about their rep­u­ta­tion,” says Jon DiMag­gio, the ran­somware-focused chief secu­ri­ty strate­gist at cyber­se­cu­ri­ty firm Analyst1. He notes that the deci­sion to take down the leak threat may have been the deci­sion of the “affil­i­ate” hack­ers who part­ner with Lock­Bit to pen­e­trate vic­tims like Ful­ton Coun­ty and may have dif­fer­ent moti­va­tions from Lock­Bit itself.
    ...

    Are we going to find out who ulti­mate­ly stole these files? LOL. Sure, if the perp decides to make their iden­ti­ty pub­lic. Oth­er­wise, it’s back to the ‘ol “Fan­cy Bear” hall of mir­rors, where secu­ri­ty experts can read the tea leaves and divine any kind of cul­prit they desire. Let’s not for­get, it was only in 2023, sev­en years after the DNC hacks, that we learned that Roger Stone’s mid­dle-man ti Wik­ileaks in 2016 was none oth­er than Isaac Mol­ho, a shad­owy Israeli attor­ney who is known as one of Ben­jamin Netanyahu’s most trust­ed asso­ciates. Which is anoth­er way of say­ing we should have zero expec­ta­tion we’ll learn any­thing mean­ing­ful about the real iden­ti­ty of the hack­ers respon­si­ble for the Ful­ton Coun­ty hack any time soon. Unless they decide to share that info them­selves. But for now, it could be almost any­one. We’ll see who author­i­ties ulti­mate­ly point the fin­ger at, but giv­en that we’re talk­ing about a mega-hack that we may have been effec­tive­ly warned about four months ago, there’s going to be a lot of blame to go around. Mega hacks are group efforts. Or, rather, a mix of efforts on the hack­ers part and a lack of efforts on a whole bunch of oth­er peo­ples part. An often pro­found lack of efforts.

    Posted by Pterrafractyl | March 4, 2024, 1:54 am

  27. We got an inter­est­ing set of updates on the giant Change Health­care hack, which itself is just the biggest known vic­tim of the much larg­er Con­nect­Wise mega-hack that is still play­ing out. It appears the hack­ers won so big they’ve retired. Yep. The hack­ers known as ALPHV/Blackcat secured a $22 mil­lion ran­som pay­ment and declared the group is shut­ting, although experts expect the group will reform under a new name.

    Did Change Health­care pay the ran­som? They aren’t say­ing one way or anoth­er. Nei­ther con­firm­ing nor deny­ing it when direct­ly pressed. Which is basi­cal­ly a con­fir­ma­tion. And not only is $22 mil­lion the sec­ond largest known ran­som paid in US his­to­ry, but this high pay­out is part of a trend in ran­somware attacks. As one expert describes, ran­soms in the range of tens of thou­sands of dol­lars were com­mon five years ago, hun­dreds of thou­sands of dol­lars two years ago, and mul­ti-mil­lion dol­lar ran­soms today. And as this expert also observes, the ran­soms typ­i­cal­ly only get paid when com­pa­nies don’t have a choice, which can often be the case if there are no back­ups for the encrypt­ed data. So was Change Health­care, one of the largest insur­ance pay­ment ser­vice providers in the US and that was acquired by Unit­ed Health for $13 bil­lion a cou­ple of years ago, not back­ing up its data? If so, it’s a warn­ing about not just the poten­tial con­se­quences of the ongo­ing Con­nect­Wise mega-hack. Because if an enti­ty that large and well resourced was oper­at­ing in a man­ner that left it high­ly vul­ner­a­ble to a ran­somware attack, we can be pret­ty con­fi­dent there are a lot more large orga­ni­za­tions with deep pock­ets that are going to find them­selves forced to pay a ran­som should the ran­somware demands arrive.

    Inter­est­ing­ly, experts also cite one of the tac­tics that law enforce­ment has found to be effec­tive in break­ing the ran­somware busi­ness mod­el: sanc­tion­ing the hack­ers so that pay­ing a ran­som becomes ille­gal. Recall how that’s what appeared to hap­pen after the US sanc­tioned a hack­er asso­ci­at­ed with Lock­Bit, the hack­ing group that claims to have stolen doc­u­ments relat­ed to Don­ald Trump’s pros­e­cu­tion in Geor­gia. But with no sanc­tions against ALPHV/Blackcat, it would seem that Change Health­care got to avoid break­ing the law.

    So with sanc­tions that pre­vent the pay­ment of ran­soms being seen as a tool for com­bat­ing ran­somware at the same time hack­ers are man­ag­ing to score record pay­outs for major com­pa­nies that were pre­sum­ably faced with no oth­er option to keep their busi­ness oper­at­ing, we appear to be head­ing towards a ‘between a rock and and hard place’ kind of sce­nario for ran­somware vic­tims. The kind of sce­nario that, for major cor­po­ra­tions, might make Change Health­care’s $22 mil­lion pay­out seem like a round­ing error:

    The Wash­ing­ton Post

    Hack­ing gang behind phar­ma­cy chaos shuts down again. Will it mat­ter?

    ALPHV has van­ished before, only to come back. Mean­while, the hack con­tin­ues to stymie the pro­vi­sion of med­ical care.

    By Joseph Menn
    March 6, 2024 at 9:00 a.m. EST

    A noto­ri­ous ran­somware gang said Tues­day that it had shut down, but it left Amer­i­can pre­scrip­tion ser­vices in con­tin­ued chaos after two weeks, show­ing the dif­fi­cul­ty in try­ing to counter an enor­mous, shape-shift­ing crim­i­nal econ­o­my.

    ALPHV, the gang blamed for the mas­sive Feb. 21 attack on Unit­ed­Health Group’s Change Health­care unit, took in a ran­somware pay­ment of $22 mil­lion before shut­ting down and will prob­a­bly reemerge under a new name, as its core group has done before, ana­lysts said.

    Change Health­care, which pro­vides a crit­i­cal link between insur­ance com­pa­nies and med­ical providers, did not con­firm or deny mak­ing the pay­ment, while a hack­er who claimed to have breached the com­pa­ny com­plained that ALPHV had not pro­vid­ed a promised share of the pro­ceeds. The per­son post­ed on a crim­i­nal dis­cus­sion forum that he still had the data on con­sumers as well as the decryp­tion key Change would need to unlock the files on its net­work.

    It was a fit­ting­ly unsat­is­fy­ing end to one of the worst ran­somware attacks on essen­tial Amer­i­can infra­struc­ture since the Colo­nial Pipeline hack almost three years ago: Change Health­care is try­ing to recov­er, its busi­ness part­ners and help­less con­sumers are adrift, the crim­i­nals are at large, and the mon­ey that changed hands will prob­a­bly fund more wrong­do­ing.

    The cycli­cal churn of ran­somware gangs frus­trates law enforce­ment agen­cies, cyberde­fense offi­cials and pri­vate researchers who have worked togeth­er for years to bat­tle the many-head­ed Hydra of orga­nized cyber­crime.

    By many mea­sures, the defend­ers are win­ning more fights than ever before. There have been sig­nif­i­cant arrests in some coun­tries, and the author­i­ties have dis­rupt­ed gangs by hack­ing their servers and snoop­ing on their con­ver­sa­tions. They have bro­ken up not just some of the groups but also the under­ground mar­ket­places and elec­tron­ic fund “mix­ers” that obfus­cate the mon­ey trail.

    ...

    And the num­ber of ran­somware pay­ments did drop, said Jacque­line Koven, head of threat intel­li­gence at Chainal­y­sis, which tracks cryp­to trans­ac­tions.

    But the vis­i­ble amount paid to crim­i­nals in 2023 rose in total, top­ping $1 bil­lion for the first time, as hack­ers like those work­ing with ALPHV turned their atten­tion to bet­ter-defend­ed deep pock­ets — “big-game hunt­ing,” Koven called it.

    What has been effec­tive, accord­ing to Koven and oth­ers who have worked with the FBI, is a more sophis­ti­cat­ed, mul­ti­fac­eted approach to defense against hack­ers. Not just tech­ni­cal take­downs of the dark-web sites used for post­ing leaked data and nego­ti­at­ing ran­som pay­ments, not just arrests, but finan­cial sanc­tions that make pay­ing ran­soms to some gangs a crim­i­nal offense.

    Per­haps most impor­tant, researchers say, has been the abil­i­ty of the FBI and oth­ers to sow dis­trust inside the gangs and those who work with them, includ­ing the hack­ers known as “affil­i­ates” who do the dig­i­tal break­ing and enter­ing before installing one or anoth­er brand of encryp­tion soft­ware.

    “These take­downs, with arrests and seizure of data, have all increased the cost of doing busi­ness,” Koven said, not­ing that even some Russ­ian under­ground forums and tech providers now ban ran­somware groups.

    After seiz­ing con­trol last month of the dark-web site used for leaks from Lock­Bit, the most pro­lif­ic ran­somware group, the FBI, Britain’s Nation­al Crime Agency and Europol post­ed their own count­down clocks to leak­ing more infor­ma­tion about Lock­Bit and its affil­i­ates.

    Some Lock­Bit affil­i­ates are ner­vous­ly wait­ing to see whether they will hear from the FBI because of the core gang’s secu­ri­ty laps­es.

    “Pub­licly demon­strat­ing our capa­bil­i­ty, and pub­licly demon­strat­ing to the affil­i­ates in some cas­es the lack of oper­a­tional secu­ri­ty, is impor­tant,” Leather­man said. “We are cer­tain­ly engag­ing some of these actors to col­lect evi­dence as part of our inves­tiga­tive mis­sion.”

    Lock­Bit opened a new leak site and has claimed to be back in busi­ness. But Leather­man said the leaks are from old vic­tims, and it might be a long time, if ever, before the gang can get enough affil­i­ates to become the same force it was.

    As for ALPHV, the FBI said in Decem­ber that it had dis­rupt­ed the group, only to have it resur­face and encour­age its affil­i­ates to go after hos­pi­tals and oth­er crit­i­cal infra­struc­ture they had been avoid­ing.

    That take­down may have back­fired and led to the cur­rent spate of health-care attacks and the cri­sis at phar­ma­cies that can’t tell which cus­tomers are insured for which med­i­cines.

    ...

    ———-

    “Hack­ing gang behind phar­ma­cy chaos shuts down again. Will it mat­ter?” By Joseph Menn; The Wash­ing­ton Post; 03/06/2024

    “It was a fit­ting­ly unsat­is­fy­ing end to one of the worst ran­somware attacks on essen­tial Amer­i­can infra­struc­ture since the Colo­nial Pipeline hack almost three years ago: Change Health­care is try­ing to recov­er, its busi­ness part­ners and help­less con­sumers are adrift, the crim­i­nals are at large, and the mon­ey that changed hands will prob­a­bly fund more wrong­do­ing.”

    Mis­sion accom­plished? It sure sounds like it. A $22 mil­lion pay­day for ALPHV/Blackcat and still no idea of who is behind it. And while Change Health­care isn’t admit­ting it paid the ran­som, it’s not deny­ing it either. It’s quite a rebound for the hack­er group that was sup­pos­ed­ly dis­rupt­ed by the FBI less than three months ago:

    ...
    ALPHV, the gang blamed for the mas­sive Feb. 21 attack on Unit­ed­Health Group’s Change Health­care unit, took in a ran­somware pay­ment of $22 mil­lion before shut­ting down and will prob­a­bly reemerge under a new name, as its core group has done before, ana­lysts said.

    Change Health­care, which pro­vides a crit­i­cal link between insur­ance com­pa­nies and med­ical providers, did not con­firm or deny mak­ing the pay­ment, while a hack­er who claimed to have breached the com­pa­ny com­plained that ALPHV had not pro­vid­ed a promised share of the pro­ceeds. The per­son post­ed on a crim­i­nal dis­cus­sion forum that he still had the data on con­sumers as well as the decryp­tion key Change would need to unlock the files on its net­work.

    ...

    As for ALPHV, the FBI said in Decem­ber that it had dis­rupt­ed the group, only to have it resur­face and encour­age its affil­i­ates to go after hos­pi­tals and oth­er crit­i­cal infra­struc­ture they had been avoid­ing.

    That take­down may have back­fired and led to the cur­rent spate of health-care attacks and the cri­sis at phar­ma­cies that can’t tell which cus­tomers are insured for which med­i­cines.
    ...

    And then we get to this inter­est­ing legal tac­tic for dis­rupt­ing the ran­somware indus­try: finan­cial sanc­tions on the hack­ers that legal­ly bar vic­tims from pay­ing the ran­som. Recall how that’s exact­ly what the US imposed on one of the fig­ures believed to be asso­ci­at­ed with Lock­Bit, the group that threat­ened to release doc­u­ments from the Ful­ton Coun­ty court sys­tem relat­ed to Don­ald Trump’s Geor­gia pros­e­cu­tion unless it was paid a ran­som. It does­n’t appear there were any sanc­tions on ALPHV/Blackcat. Either that, or Change Health­care broke the law:

    ...
    But the vis­i­ble amount paid to crim­i­nals in 2023 rose in total, top­ping $1 bil­lion for the first time, as hack­ers like those work­ing with ALPHV turned their atten­tion to bet­ter-defend­ed deep pock­ets — “big-game hunt­ing,” Koven called it.

    What has been effec­tive, accord­ing to Koven and oth­ers who have worked with the FBI, is a more sophis­ti­cat­ed, mul­ti­fac­eted approach to defense against hack­ers. Not just tech­ni­cal take­downs of the dark-web sites used for post­ing leaked data and nego­ti­at­ing ran­som pay­ments, not just arrests, but finan­cial sanc­tions that make pay­ing ran­soms to some gangs a crim­i­nal offense.

    Per­haps most impor­tant, researchers say, has been the abil­i­ty of the FBI and oth­ers to sow dis­trust inside the gangs and those who work with them, includ­ing the hack­ers known as “affil­i­ates” who do the dig­i­tal break­ing and enter­ing before installing one or anoth­er brand of encryp­tion soft­ware.

    “These take­downs, with arrests and seizure of data, have all increased the cost of doing busi­ness,” Koven said, not­ing that even some Russ­ian under­ground forums and tech providers now ban ran­somware groups.

    After seiz­ing con­trol last month of the dark-web site used for leaks from Lock­Bit, the most pro­lif­ic ran­somware group, the FBI, Britain’s Nation­al Crime Agency and Europol post­ed their own count­down clocks to leak­ing more infor­ma­tion about Lock­Bit and its affil­i­ates.
    ...

    And in case it’s not clear how big of a deal this $22 mil­lion pay­out was, keep in mind that this is the sec­ond-high­est known ran­som pay­ment in US his­to­ry. It’s part of a trend that has seen big­ger and big­ger vic­tims lead­ing to big­ger and big­ger ran­soms. Or as one secu­ri­ty expert describes, “It was com­mon to see ran­somware in the tens of thou­sands of dol­lars five years ago. In the hun­dreds of thou­sands of dol­lars two years ago, and now the mil­lion and mul­ti­mil­lion is becom­ing more and more com­mon”:

    Kare11

    What we know about report­ed health­care hack ran­som pay­ment

    The spec­u­lat­ed $22 mil­lion ran­som pay­ment involv­ing Change Health­care would be the sec­ond-high­est ran­som pay­ment in U.S. his­to­ry if con­firmed.

    Author: Gor­don Sev­er­son
    Pub­lished: 7:13 PM CST March 5, 2024
    Updat­ed: 7:27 PM CST March 5, 2024

    MINNEAPOLIS — Less than two weeks ago, Change Health­care, a sub­sidiary of Unit­ed­Health­care, was hacked.

    The com­pa­ny has con­firmed the hack pub­licly.

    A recent­ly released state­ment says, “We are work­ing on mul­ti­ple approach­es to restore the impact­ed envi­ron­ment and con­tin­ue to be proac­tive and aggres­sive with all our sys­tems, and if we sus­pect any issue with the sys­tem, we will imme­di­ate­ly take action.”

    ...

    And now, Wired, a sci­ence and tech­nol­o­gy media com­pa­ny, reports Unit­ed­Health­care may have paid the hack­ers a $22 mil­lion ran­som pay­ment.

    The arti­cle claims $22 mil­lion worth of Bit­coin was sent to a known hack­er group called AlphV on March 1. The arti­cle cites experts and a hack­er who believe this pay­ment was a ran­som paid by Unit­ed­Health­care.

    KARE 11 reached out to Unit­ed­Health­care to try and con­firm this infor­ma­tion and a com­pa­ny spokesper­son sent this state­ment in reply, “We are focused on the inves­ti­ga­tion and restor­ing oper­a­tions at Change.”

    So, no con­fir­ma­tion, but the com­pa­ny also isn’t dis­put­ing the claims, either.

    If this pay­ment real­ly hap­pened, cyber­se­cu­ri­ty experts say it could be one of the largest pay­outs in his­to­ry.

    Bryce Austin with TCE Strat­e­gy recent­ly sat down with KARE 11 News reporter Gor­don Sev­er­son to talk about the grow­ing prob­lem of ran­somware attacks.

    GORDON SEVERSON: “Where does this pos­si­ble ran­som pay­ment rank among oth­ers? If this $22 mil­lion pay­ment is con­firmed, is it the largest amount a com­pa­ny has paid?”

    BRYCE AUSTIN: “There’s a good pos­si­bil­i­ty we are see­ing the sec­ond-largest known ran­somware pay­out in his­to­ry.”

    GORDON: “What is num­ber one?”

    BRYCE: “Num­ber one was CNA Finan­cial. The com­pa­ny paid $40 mil­lion. To my knowl­edge, that is the largest pay­out that has been pub­licly dis­closed.”

    GORDON: “How often do these com­pa­nies end up pay­ing the ran­som?

    BRYCE: “Get­ting this infor­ma­tion is chal­leng­ing because most com­pa­nies don’t talk about it. We saw a won­der­ful exam­ple of a com­pa­ny pay­ing ver­sus not pay­ing last year in Las Vegas where both Cae­sar’s and MGM got hit by the same group and almost at the same time.

    MGM decid­ed not to pay and kudos to them, but they have open­ly said the dis­rup­tion has cost them over $100 mil­lion in lost rev­enue. Cae­sar’s chose to pay, but they paid $15 mil­lion instead of $100 mil­lion.”

    GORDON: “Why do com­pa­nies pay? When you are in these sit­u­a­tions with your clients, what goes into these deci­sions on whether or not to pay a ran­som?”

    BRYCE: “The key is whether or not a com­pa­ny has offline back­ups of their data. The dif­fi­cul­ty comes in when there isn’t an option oth­er than shut­ting your doors when you have a ran­somware attack.

    My com­pa­ny has worked a ran­somware engage­ment where the ini­tial demand was $8 mil­lion, and regret­tably, the pay­out was more than $1 mil­lion.

    My com­pa­ny has worked instances where we had 800 jobs on the line and as dis­taste­ful as pay­ing a ran­som is, there’s a rea­son­able argu­ment to be made that hav­ing 800 peo­ple out of work is even more dis­taste­ful.”

    GORDON: “Is it pos­si­ble there could be oth­er pay­ments out there that just haven’t been made pub­lic yet?”

    BRYCE: “Oh, absolute­ly. most com­pa­nies do not want to adver­tise that they have fall­en vic­tim to this kind of attack.”

    GORDON: “Do these pay­outs cre­ate a con­cern that it is encour­ag­ing more of this behav­ior?”

    BRYCE: “If every com­pa­ny refused to pay flat­ly, the issue of ran­som would go away. When a cyber­crim­i­nal gets their hooks into your com­pa­ny where the choice is to pay the ran­som or shut your doors, the real­i­ty of the sit­u­a­tion gets a lot more com­pli­cat­ed.”

    GORDON: “Could this just be the tip of the ice­berg that in the years to come those pay­outs could just con­tin­ue to get big­ger?”

    BRYCE: “It was com­mon to see ran­somware in the tens of thou­sands of dol­lars five years ago. In the hun­dreds of thou­sands of dol­lars two years ago, and now the mil­lion and mul­ti­mil­lion is becom­ing more and more com­mon.”

    GORDON: “Anoth­er con­cern is these mil­lions of dol­lars we don’t know where that’s going or what that’s being used for.”

    ...

    ———–

    “What we know about report­ed health­care hack ran­som pay­ment” by Gor­don Sev­er­son; Kare11; 03/05/2024

    “If this pay­ment real­ly hap­pened, cyber­se­cu­ri­ty experts say it could be one of the largest pay­outs in his­to­ry.”

    The Change Health­care hack isn’t just a big deal in terms of the his­to­ry of harm­ful hacks. It led to the sec­ond largest ran­somware pay­out in his­to­ry. Or at least the sec­ond largest pay­ment that has been pub­licly dis­closed. And based on trends, the pay­ments are only going to get larg­er. Espe­cial­ly giv­en all the suc­cess­es in get­ting these pay­outs:

    ...
    KARE 11 reached out to Unit­ed­Health­care to try and con­firm this infor­ma­tion and a com­pa­ny spokesper­son sent this state­ment in reply, “We are focused on the inves­ti­ga­tion and restor­ing oper­a­tions at Change.”

    So, no con­fir­ma­tion, but the com­pa­ny also isn’t dis­put­ing the claims, either.

    ...

    Bryce Austin with TCE Strat­e­gy recent­ly sat down with KARE 11 News reporter Gor­don Sev­er­son to talk about the grow­ing prob­lem of ran­somware attacks.

    GORDON SEVERSON: “Where does this pos­si­ble ran­som pay­ment rank among oth­ers? If this $22 mil­lion pay­ment is con­firmed, is it the largest amount a com­pa­ny has paid?”

    BRYCE AUSTIN: “There’s a good pos­si­bil­i­ty we are see­ing the sec­ond-largest known ran­somware pay­out in his­to­ry.”

    GORDON: “What is num­ber one?”

    BRYCE: “Num­ber one was CNA Finan­cial. The com­pa­ny paid $40 mil­lion. To my knowl­edge, that is the largest pay­out that has been pub­licly dis­closed.”

    ...

    GORDON: “Could this just be the tip of the ice­berg that in the years to come those pay­outs could just con­tin­ue to get big­ger?”

    BRYCE: “It was com­mon to see ran­somware in the tens of thou­sands of dol­lars five years ago. In the hun­dreds of thou­sands of dol­lars two years ago, and now the mil­lion and mul­ti­mil­lion is becom­ing more and more com­mon.”

    GORDON: “Anoth­er con­cern is these mil­lions of dol­lars we don’t know where that’s going or what that’s being used for.”
    ...

    And then we get this inter­est­ing obser­va­tion about the scope of the hack at Change Health­care: the ran­som prob­a­bly isn’t going to be paid unless the hack was so dev­as­tat­ing that it would prob­a­bly shut the com­pa­ny down, with a lack of data back­ups being an com­mon sce­nario where that might hap­pen:

    ...
    GORDON: “Why do com­pa­nies pay? When you are in these sit­u­a­tions with your clients, what goes into these deci­sions on whether or not to pay a ran­som?”

    BRYCE: “The key is whether or not a com­pa­ny has offline back­ups of their data. The dif­fi­cul­ty comes in when there isn’t an option oth­er than shut­ting your doors when you have a ran­somware attack.
    ...

    Did Change Health­care not have its data backed up? That’s kind of amaz­ing for one of the largest insur­ance val­i­da­tion ser­vice providers in the world. Unless the motive for pay­ing was some­thing else, but what could that be? They paid $22 mil­lion, the sec­ond largest ran­somware ran­som in his­to­ry. They would­n’t have paid that casu­al­ly. Which, again, rais­es the ques­tion as to just how screwed would Change Health­care be if sanc­tions pre­vent­ed that ran­som pay­ment?

    And let’s not for­get what else we recent­ly learned from the inter­na­tion­al take­down of Lock­Bit: these ran­somware hack­ers don’t nec­es­sar­i­ly delete the data they stole after you pay them the ran­som. So while Change Health­care may have got­ten its data unen­crypt­ed (hope­ful­ly), there’s still that 6 ter­abytes of stolen sen­si­tive med­ical claims data that is pre­sum­ably still going to be float­ing around the dark web for years to come. Mon­ey can’t buy hap­pi­ness, at least when it comes to ran­somware.

    And in relat­ed news, Andrew Wit­ty, the CEO of Unit­ed Health, Change Health­care’s par­ent com­pa­ny, took in over $20 mil­lion in total com­pen­sa­tion in 2023, a hike from the $18 mil­lion he received in 2022. And his pre­de­ces­sor, David Wich­mann — who left Unit­ed in 2021 — real­ized over $142 mil­lion in com­pen­sa­tion in 2021 after exer­cis­ing his stock options, the biggest ever com­pen­sa­tion pack­age for a Min­neso­ta-based pub­lic com­pa­ny at the time. So while mon­ey may not be able to buy hap­pi­ness for the vic­tims of ran­somware attacks, we can be pret­ty con­fi­dent the exec­u­tive class can afford plen­ty of hap­pi­ness, whether their ran­somware-afflict­ed com­pa­nies implode or not.

    Posted by Pterrafractyl | March 6, 2024, 11:04 pm

  28. It’ll all be over soon. If soon is defined as a cou­ple of weeks. Hope­ful­ly. That was the update we got from Unit­ed­Health on the sta­tus of its response to the hack that took down the US health­care sec­tor’s abil­i­ty process insur­ance claims. “We expect to begin test­ing and reestab­lish con­nec­tiv­i­ty to our claims net­work and soft­ware on March 18, restor­ing ser­vice through that week,” accord­ing to the com­pa­ny. So if you’re one of the many health care providers fac­ing the risk of bank­rupt­cy over the past cou­ple of weeks as the abil­i­ty to col­lect insur­ance claims col­lapsed, hold on for a cou­ple more weeks. If you can.

    That’s the hor­rid state of affairs two weeks after the Con­nect­Wise mega-hack that con­tin­ues to play out in more than the health­care claims pro­cess­ing sec­tor. Thou­sands of orga­ni­za­tions were found to be vul­ner­a­ble fol­low­ing the Con­nect­Wise dis­clo­sure of a severe vul­ner­a­bil­i­ty in its Screen­Con­nect remote access soft­ware and thou­sands remain vul­ner­a­ble. We still don’t know the scale of this event. What we do know is that the biggest play­er in the US health insur­ance claims pro­cess­ing mar­ket­place has been tak­en out of com­mis­sion for at least a month. If not longer. Fin­gers crossed.

    But when it comes to assess­ing the dam­age caused by this hack, it’s impor­tant to keep in mind that we know, and have long known, about one of the oth­er major fac­tors that con­tributed to the scale of dam­age cre­at­ed by this Change Health­care hack: the long­stand­ing fail­ure of the US to mean­ing­ful­ly enforce anti-trust laws. Put sim­ply, Unit­ed­Health cre­at­ed a claims pro­cess­ing monop­oly with its 2021 acqui­si­tion of Change Health­care and that did­n’t have to hap­pen. Monop­o­lies and oli­gop­o­lies are a choice, at least for soci­eties not con­trolled by monop­o­lies and oli­gop­o­lies.

    How was the cre­ation of this claims pro­cess­ing giant allowed in the first place? Well, as we’re going to see, it did­n’t hap­pen with­out a fight. In fact, the US Depart­ment of Jus­tice (DOJ) filed a law­suit block­ing the pur­chase by Change Health­care, which had been owned by pri­vate-equi­ty giant Black­stone since 2015. But as we’re also going to see, that law­suit was shot down by a fed­er­al judge in 2022. The DOJ dropped the suit and the merge was allowed to go through.

    So why did the DOJ’s law­suit ulti­mate­ly fail? Well, for starters, the DOJ argued that allow­ing the merg­er to hap­pen would result in Unit­ed­Health-owned Optum — the enti­ty that actu­al­ly merged with Change Health­care — con­trol­ling 90% of the ‘first-pass claims edit­ing’ part of the claims pro­cess­ing mar­ket. In response, Unit­ed­Health agreed to spin off Change Health­care’s Claim­sX­ten unit, which alone con­trolled 70% of the first-pass claims mar­ket, to pri­vate-equi­ty giant TPG Cap­i­tal. So we have one pri­vate-equi­ty giant, Black­stone, buy­ing Change Health­care in 2015, and then spin­ning off ClaimX­ten to TPG, anoth­er pri­vate-equi­ty giant, as part of the 2021 merg­er. Which is a reminder that pri­vate-equi­ty’s insa­tiable econ­o­my-wide appetite of course includes the health­care sec­tor. And not just in the US. Fun fact: Black­stone pur­chased a major­i­ty stake in 16 hos­pi­tals in India from TPG back in Decem­ber. The whole world is a wealth extrac­tion oppor­tu­ni­ty for pri­vate-equi­ty’s busi­ness mod­el.

    Spin­ning off ClaimX­ten did­n’t end up sat­is­fy­ing the DOJ, which con­tin­ued to argue that ClaimX­ten would see its inno­va­tion ham­pered by the spin-off. But beyond the issues over the poten­tial anti-trust issues with the ‘first-pass’ claims mar­ket, the DOJ argued about a much more fun­da­men­tal risk asso­ci­at­ed with the merg­er: Unit­ed­Health would gain access to all sorts of high­ly sen­si­tive data about its com­peti­tors. Which is obvi­ous­ly true if it has a near monop­oly on the US’s insur­ance claims pro­cess­ing ser­vices mar­ket.

    How did Unit­ed­Health get around those con­cerns about Unit­ed gain­ing access to all sorts of com­peti­tor claims pro­cess­ing data? Well, it turns out the judge in the case, Judge Carl Nichols, found the DOJ’s con­cerns to be high­ly uncon­vinc­ing. What he did find con­vinc­ing was the tes­ti­monies of two Unit­ed­Health senior exec­u­tives — cur­rent CEO Andrew Wit­ty and for­mer CEO David Wich­mann who stepped down in 2021 — who assured the judge that the com­pa­ny would­n’t think about abus­ing this high­ly sen­si­tive infor­ma­tion about its com­peti­tors because that would be a huge rep­u­ta­tion­al risk that it could­n’t pos­si­ble engage in. A kind of ‘we would nev­er think of such of thing’ legal rea­son­ing. That was it. The judge just found the assur­ances Unit­ed­Health’s cur­rent and for­mer CEOs way more con­vinc­ing than the DOJ’s con­cerns. Keep in mind for­get that Andrew Wit­ty took in over $20 mil­lion in total com­pen­sa­tion in 2023, a hike from the $18 mil­lion he received in 2022 and David Wich­mann made over $142 mil­lion in com­pen­sa­tion in 2021 after exer­cis­ing his stock options, the biggest ever com­pen­sa­tion pack­age for a Min­neso­ta-based pub­lic com­pa­ny at the time. The guys like mak­ing mon­ey. But they def­i­nite­ly would­n’t ever think of bend­ing the rules with sen­si­tive com­peti­tor data to make even more mon­ey and any such con­cerns are unwar­rant­ed, accord­ing the judge. That rea­son­ing was how this merg­er hap­pened.

    Oh, and in case you’re won­der­ing if Judge Nichols is a gift from the Trump admin­is­tra­tion, yep. And as we should expect being a Trump appointee, Judge Nichols is also affil­i­at­ed with the Fed­er­al­ist Soci­ety. But beyond that, it turns out he used to clerk for Supreme Court Jus­tice Clarence Thomas, the same Supreme Court jus­tice who has for decades been get­ting secret lav­ish treat­ment from bil­lion­aire sug­ar-dad­dy Har­lan Crow. So while we have no indi­ca­tion that judge Nichols has a secret bil­lion­aire sug­ar-dad­dy, the ‘apple did­n’t fall too far from the tree’ when it came to this for­mer Jus­tice Thomas clerk’s affin­i­ty for the wealthy and pow­er­ful. Or fall too far from Leonard Leo, the archi­tect of the con­sol­i­da­tion of pow­er in the US judi­cia­ry by a net­work of right-wing oli­garchs. Judge Nichol­s’s rul­ing was very on brand for his judi­cial pedi­gree. A pedi­gree with roots in the wield­ing of pow­er on behalf of con­cen­tra­tions of wealth.

    So as we wait and see how this health­care emer­gency pans out and how many small firms end up going under, it’s going to be worth keep­ing in mind the role the con­cen­tra­tion of wealth and eco­nom­ic pow­er play in enabling and shap­ing the con­se­quences of this mega-hack. It took the lock­ing up of just one fir­m’s com­put­ers to crip­ple the entire US health­care pay­ments sys­tem. That would­n’t have hap­pened even three years ago. This dis­as­ter was, to a large extent, a design choice of the con­tem­po­rary late-stage Cap­i­tal­ism nature of US econ­o­my. A con­cen­tra­tion of wealth and pow­er cre­at­ed an econ­o­my and soci­ety that is extra vul­ner­a­ble to hacks. Robust diverse mar­kets with many small­er play­ers have a whole new pur­pose in the age of the mega-hack. It’s a form of lit­er­al sys­temic sta­bil­i­ty for the dig­i­tal age. This is a sto­ry about a mega-hack, but it’s also a sto­ry about the gross inequal­i­ty of con­tem­po­rary Amer­i­ca, where fat cats make all the mon­ey while the lit­tle guy suf­fers the con­se­quences:

    Health­care IT News

    Change Health­care begins to restore ser­vice after cyber­at­tack – as law­suits begin

    Also: The ALPHV Black­Cat ran­somware group may have faked a sec­ond gov­ern­ment take­down, while the extent of the pro­tect­ed-data leak is still unknown.

    By Andrea Fox
    March 08, 2024
    03:47 PM

    As it begins to recov­er from the Change Health­care cyber­at­tack, Unit­ed­Health Group said this week that it is enabling its Rx Con­nect, Rx Edit and Rx Assist ser­vices for cus­tomers who have con­fig­ured direct inter­net access con­nec­tiv­i­ty.

    Unit­ed­Health also offered what it says is a time­line for full restora­tion of Change Health­care’s ser­vices.

    “We expect to begin test­ing and reestab­lish con­nec­tiv­i­ty to our claims net­work and soft­ware on March 18, restor­ing ser­vice through that week,” the com­pa­ny said in an announce­ment post­ed to its web­site about the cyber­at­tack, which began on Feb­ru­ary 21.

    Here’s a roundup of oth­er news relat­ed to the weeks-long attack – includ­ing a new wave of law­suits from cus­tomers impact­ed by the breach, news on Black­Cat ran­somware group’s cur­rent sta­tus and expert per­spec­tive on why Unit­ed­Health may have paid the ran­som.

    ALPHV fakes left after $22M in Bit­coin paid

    Accord­ing to Record­ed Future News Fri­day, the Depart­ment of Jus­tice, Europol and the U.K. Nation­al Crime Agency – all part of a Decem­ber take­down of Black­Cat ran­somware – denied any involve­ment in a new take­down notice post­ed on ALPHV’s web­site.

    “This tac­tic serves as a means for them to exe­cute one final sig­nif­i­cant scam before resur­fac­ing with less scruti­ny,” Ree­gun Jaya­paul, prin­ci­pal at Trust­wave said in the sto­ry.

    One Black­Cat ran­somware affil­i­ate report­ed­ly claimed that after get­ting the $22 mil­lion pay­ment, ALPHV lead­ers shut down and effec­tive­ly stole the entire ran­som from their affil­i­ates to make the Change Health­care breach their last hur­rah.

    ...

    Patient delays, pri­va­cy, pend­ing law­suits

    Mean­while, Axios report­ed Wednes­day that the first post-cyber­at­tack patient law­suits are begin­ning to emerge, focus­ing on loss of access to vital pre­scrip­tions and treat­ments.

    How­ev­er, the poten­tial to expose data exfil­trat­ed in the attack, which could be 6TB of data, is also a con­cern for UHG. The cyber­crim­i­nals alleged that the stolen data includes pro­tect­ed infor­ma­tion held by the U.S. mil­i­tary’s Tri­care health­care pro­gram, Medicare, CVS Care­mark, MetLife, Health Net and oth­ers, a Bleep­ing Com­put­er report said on Feb­ru­ary 28.

    ...

    Stolen data could have far-reach­ing effects down the line.

    “Health­care infor­ma­tion is the most sought after and high­est resal­able data by attack­ers and on the dark web because it can be used in so many ways to per­pe­trate fraud,” not­ed Kurt Osburn, direc­tor of risk man­age­ment and gov­er­nance at NCC Group, a glob­al cyber­se­cu­ri­ty con­sult­ing firm, in a state­ment sent by email.

    Pro­tect­ing assets and infor­ma­tion is expen­sive, and takes addi­tion­al staff and man­aged ser­vices, he said. Most health­care orga­ni­za­tions fail to imple­ment risk-analy­sis and risk-mit­i­ga­tion tools due to costs.

    Michael McLaugh­lin, prin­ci­pal and cyber­se­cu­ri­ty and data pri­va­cy prac­tice group coleader at the legal firm Buchanan Inger­soll and Rooney, said in an email Thurs­day that while UHG, which owns Optum’s Change Health­care, has not dis­closed the full extent of the data breach, one class-action suit alleges the types of data exfil­trat­ed.

    The suit, filed in fed­er­al court in Min­neso­ta, claims the ran­somware group took per­son­al­ly iden­ti­fi­able infor­ma­tion, med­ical records, den­tal records, pay­ment infor­ma­tion, claims infor­ma­tion, patients’ infor­ma­tion (i.e. phone num­bers, address­es, Social Secu­ri­ty num­bers and email address­es), insur­ance records, patient health infor­ma­tion and more.

    McLaugh­lin said that the suit bases the data on the group’s claims about its role in the Change cyber­at­tack, and advised tak­ing it with grains of salt.

    “I would urge cau­tion in rely­ing on state­ments of the ran­somware actor about the types of data impact­ed,” he wrote. The ran­somware actor like­ly sam­pled files indi­cat­ing sen­si­tive infor­ma­tion may be con­tained with­in “and based their state­ment on that cur­so­ry review,” he said.

    “This is in no way rep­re­sen­ta­tive of the data as a whole,” said McLaugh­lin.

    Breach mag­ni­tude? Too soon to tell

    “UHG pay­ing the ran­som is not indica­tive of the sen­si­tiv­i­ty of the data,” McLaugh­lin said.

    He explained that he believed that UHG’s deci­sion to pay like­ly was pri­mar­i­ly dri­ven by the need to resume busi­ness oper­a­tions as quick­ly as pos­si­ble “rather than to pro­tect the data from fur­ther expo­sure.”

    Wide­spread reports of providers strain­ing in the out­age have a num­ber of orga­ni­za­tions, like the Amer­i­can Med­ical Asso­ci­a­tion, appeal­ing to law­mak­ers in Wash­ing­ton, D.C., to release emer­gency funds to pro­tect providers nation­wide from the finan­cial fall­out.

    UHG is like­ly inves­ti­gat­ing the full scope of the inci­dent try­ing to under­stand the indi­vid­u­als impact­ed and the types of data involved, McLaugh­lin said.

    It’s a resource-inten­sive process requir­ing advanced data min­ing and man­u­al human review of “poten­tial­ly mil­lions of files.”

    ...

    ———–

    “Change Health­care begins to restore ser­vice after cyber­at­tack – as law­suits begin” By Andrea Fox; Health­care IT News; 03/08/2024

    ““We expect to begin test­ing and reestab­lish con­nec­tiv­i­ty to our claims net­work and soft­ware on March 18, restor­ing ser­vice through that week,” the com­pa­ny said in an announce­ment post­ed to its web­site about the cyber­at­tack, which began on Feb­ru­ary 21.”

    Ser­vices will be restored some time after March 18, near­ly a month after the Feb­ru­ary 21 hack. A month of no abil­i­ty to process insur­ance claims for much of the US health­care sec­tor. It’s not won­der that we have orga­ni­za­tions like the AMA call­ing for a fed­er­al release of emer­gency funds to the health­care sec­tor. You can’t just halt claims pro­cess­ing for a month and not expect that it’s going to dri­ve health­care providers out of busi­ness. Espe­cial­ly the small­est providers:

    ...
    Wide­spread reports of providers strain­ing in the out­age have a num­ber of orga­ni­za­tions, like the Amer­i­can Med­ical Asso­ci­a­tion, appeal­ing to law­mak­ers in Wash­ing­ton, D.C., to release emer­gency funds to pro­tect providers nation­wide from the finan­cial fall­out.
    ...

    But the fall­out isn’t just hit­ting health­care providers. Patients are suf­fer­ing too, with con­se­quences that could play out down the line. In oth­er words, don’t expect this first round of patient law­suits to nec­es­sar­i­ly be the last. And accord­ing to one of the class action law­suits already under­way, the 5 ter­abytes of stolen data includ­ed per­son­al­ly iden­ti­fi­able infor­ma­tion, med­ical records, den­tal records, pay­ment infor­ma­tion, claims infor­ma­tion, patients’ infor­ma­tion (i.e. phone num­bers, address­es, Social Secu­ri­ty num­bers and email address­es), insur­ance records, patient health infor­ma­tion and more. Which is plen­ty of data for cre­at­ing patient con­se­quences for years to come:

    ...
    Mean­while, Axios report­ed Wednes­day that the first post-cyber­at­tack patient law­suits are begin­ning to emerge, focus­ing on loss of access to vital pre­scrip­tions and treat­ments.

    How­ev­er, the poten­tial to expose data exfil­trat­ed in the attack, which could be 6TB of data, is also a con­cern for UHG. The cyber­crim­i­nals alleged that the stolen data includes pro­tect­ed infor­ma­tion held by the U.S. mil­i­tary’s Tri­care health­care pro­gram, Medicare, CVS Care­mark, MetLife, Health Net and oth­ers, a Bleep­ing Com­put­er report said on Feb­ru­ary 28.

    ...

    Stolen data could have far-reach­ing effects down the line.

    “Health­care infor­ma­tion is the most sought after and high­est resal­able data by attack­ers and on the dark web because it can be used in so many ways to per­pe­trate fraud,” not­ed Kurt Osburn, direc­tor of risk man­age­ment and gov­er­nance at NCC Group, a glob­al cyber­se­cu­ri­ty con­sult­ing firm, in a state­ment sent by email.

    ...

    Michael McLaugh­lin, prin­ci­pal and cyber­se­cu­ri­ty and data pri­va­cy prac­tice group coleader at the legal firm Buchanan Inger­soll and Rooney, said in an email Thurs­day that while UHG, which owns Optum’s Change Health­care, has not dis­closed the full extent of the data breach, one class-action suit alleges the types of data exfil­trat­ed.

    The suit, filed in fed­er­al court in Min­neso­ta, claims the ran­somware group took per­son­al­ly iden­ti­fi­able infor­ma­tion, med­ical records, den­tal records, pay­ment infor­ma­tion, claims infor­ma­tion, patients’ infor­ma­tion (i.e. phone num­bers, address­es, Social Secu­ri­ty num­bers and email address­es), insur­ance records, patient health infor­ma­tion and more.

    McLaugh­lin said that the suit bases the data on the group’s claims about its role in the Change cyber­at­tack, and advised tak­ing it with grains of salt.

    “I would urge cau­tion in rely­ing on state­ments of the ran­somware actor about the types of data impact­ed,” he wrote. The ran­somware actor like­ly sam­pled files indi­cat­ing sen­si­tive infor­ma­tion may be con­tained with­in “and based their state­ment on that cur­so­ry review,” he said.

    “This is in no way rep­re­sen­ta­tive of the data as a whole,” said McLaugh­lin.

    ...

    UHG is like­ly inves­ti­gat­ing the full scope of the inci­dent try­ing to under­stand the indi­vid­u­als impact­ed and the types of data involved, McLaugh­lin said.

    It’s a resource-inten­sive process requir­ing advanced data min­ing and man­u­al human review of “poten­tial­ly mil­lions of files.”
    ...

    And note the obser­va­tions on the trade­offs between pro­tect­ing data and prof­it­ing: accord­ing to Kurt Osburn, direc­tor of risk man­age­ment and gov­er­nance at NCC Group, most health­care orga­ni­za­tions fail to imple­ment risk-analy­sis and risk-mit­i­ga­tion tools due to costs. And at the same time, we hear­ing spec­u­la­tion that Unit­ed decid­ed to pay the ran­som, not in an effort to pro­tect the stolen data from release, but instead to get oper­a­tions back up and run­ning as soon as pos­si­ble. Which, if true, would be a sce­nario that sug­gests Unit­ed-owned Change Health­care was­n’t back­ing up its data. The point being that we prob­a­bly should­n’t assume Unit­ed was will­ing to pay the costs required to bet­ter pro­tect this data sim­ply because its a giant com­pa­ny with almost unlim­it­ed resources at its dis­pos­al. That’s not how monop­oly cap­i­tal­ism works.:

    ...
    Pro­tect­ing assets and infor­ma­tion is expen­sive, and takes addi­tion­al staff and man­aged ser­vices, he said. Most health­care orga­ni­za­tions fail to imple­ment risk-analy­sis and risk-mit­i­ga­tion tools due to costs.

    ...

    Breach mag­ni­tude? Too soon to tell

    “UHG pay­ing the ran­som is not indica­tive of the sen­si­tiv­i­ty of the data,” McLaugh­lin said.

    He explained that he believed that UHG’s deci­sion to pay like­ly was pri­mar­i­ly dri­ven by the need to resume busi­ness oper­a­tions as quick­ly as pos­si­ble “rather than to pro­tect the data from fur­ther expo­sure.”
    ...

    So with weeks to go before the US health­care mar­kets regain the abil­i­ty to process insur­ance claims, the clock is tick­ing ever more urgent­ly for all those small care providers at risk of bank­rupt­cy. Which makes this a good time to reflect on the fact that the scale of the impact of this hack was entire­ly avoid­able. All that was required was some enforce­ment of the anti-trust laws that were clear­ly vio­lat­ed with Unit­ed Health’s acqui­si­tion of Change Health­care. A merg­er that was so obvi­ous­ly a sys­temic risk that the DOJ sued to block it, until a Trump-appoint­ed fed­er­al judge block the suit and allowed the merg­er to go through:

    New York Mag­a­zine

    Cor­po­rate Greed Made the Change Health­care Cyber­at­tack Worse

    By Chris Stan­ton
    03/07/2024 9:31 A.M.

    When doc­tors at the New Mex­i­co Can­cer Cen­ter got to work on Thurs­day, Feb­ru­ary 22, they imme­di­ate­ly knew some­thing was very wrong. As they attempt­ed to treat their patients, they found them­selves unable to com­plete essen­tial admin­is­tra­tive tasks on their com­put­ers, from elec­tron­i­cal­ly fill­ing pre­scrip­tions to ver­i­fy­ing a patient’s eli­gi­bil­i­ty for treat­ment to sub­mit­ting insur­ance claims so they could get paid for their work. As they soon learned, the third-par­ty ser­vice they use to facil­i­tate those trans­ac­tions, Change Health­care, had been hit with a cyber­at­tack the day before. For the can­cer cen­ter, that meant that busi­ness, in effect, was at a stand­still — though their patients’ ill­ness­es were not. Anx­i­eties began to swirl around the office: How could they make sure this wouldn’t inter­rupt anyone’s treat­ment? And how long could they afford to stay in busi­ness with­out any mon­ey com­ing in?

    “We can make it two to three weeks, and then we’re out of mon­ey,” New Mex­i­co Can­cer Center’s CEO, Dr. Bar­bara McA­ne­ny, told me last week, adding that some physi­cians on staff have agreed to for­go their salaries until this is over. “Then I don’t know what we will do, because our patients are depend­ing on us for their chemother­a­py.”

    Two weeks after the attack, the out­age is ongo­ing with no clear end in sight, affect­ing thou­sands of med­ical prac­tices, hos­pi­tals, and phar­ma­cies across the coun­try, which rely on Change Healthcare’s ser­vices to vary­ing degrees — as the com­pa­ny boasts on its own web­site, it han­dles records for one in three patients in the U.S. At min­i­mum, it has meant that busi­ness­es that con­tract with Change have had to scram­ble to switch to one of its few com­peti­tors (a process that can take weeks) or devise labor-inten­sive workarounds, which often involve old-school tools like paper pre­scrip­tions and fax machines. For phar­ma­cies that con­tract with Change, the out­age has dis­rupt­ed their abil­i­ty to con­duct trans­ac­tions with doc­tors and insur­ance com­pa­nies, forc­ing some phar­ma­cists to either hand out med­ica­tion and trust insur­ers to pay them back lat­er or make their cus­tomers pay for the full cost of their drugs out of pock­et. If the out­age lasts long enough, though, its ulti­mate lega­cy may be the num­ber of small med­ical providers it puts out of busi­ness entire­ly.

    When news of the cyber­at­tack began to trick­le out, Unit­ed­Health Group — the health-care behe­moth that owns Change through yet anoth­er sub­sidiary, Optum — claimed the cul­prit was asso­ci­at­ed with a “nation-state,” though it turned out to be the ran­somware gang Black­Cat, which appears to have stolen data about patients, encrypt­ed it, then demand­ed pay­ment for its safe return. Cyber­at­tacks on the health-care sec­tor have been on the rise, but the Change Health­care attack is “unprece­dent­ed” in terms of how wide­spread its impact has been, accord­ing to the Amer­i­can Hos­pi­tal Association’s cyber­se­cu­ri­ty advis­er, John Rig­gi. While Change is lit­tle-known out­side of the indus­try, its sta­tus as a dom­i­nant hub for insur­ance approvals and reim­burse­ments made it a ripe tar­get, guar­an­tee­ing that a sin­gle attack could threat­en not only the well-being of patients, but the finan­cial sol­ven­cy of health-care providers across the coun­try. For patients, the attack might also con­sti­tute a mas­sive data breach of per­son­al infor­ma­tion.

    Amid what Rig­gi calls a “slow-rolling dis­as­ter,” it’s still too ear­ly to cal­cu­late the attack’s dam­age in terms of delayed treat­ments, leaked data, and cash-starved med­ical prac­tices. (One esti­mate sug­gest­ed U.S. health-care providers are hem­or­rhag­ing $100 mil­lion per day.) To the array of indus­try pro­fes­sion­als that I spoke with, though, what is already clear is that the dev­as­tat­ing scope of the attack is a direct prod­uct of indus­try con­sol­i­da­tion, par­tic­u­lar­ly at Unit­ed­Health Group, Change’s own­er and the country’s largest health-care provider.

    “This is what hap­pens when every­thing merges and you only have one option,” McA­ne­ny said. “When we have one option, then the hack­ers have one big tar­get that they know if they bring that down, they can grind U.S. health care to a halt.”

    Under­stand­ing how Change got its ten­drils in almost every facet of the health-care indus­try requires tak­ing a peek at the lit­er­al­ly dozens of acqui­si­tions that formed it (which Mau­reen Tkacik com­piled over at One esti­mate). In short, it orig­i­nat­ed as a sub­sidiary of Aet­na, which was then bought by a claims-pro­cess­ing com­pa­ny called Envoy in 1997 that was itself bought by Healtheon/WebMD in 2000. When Web­MD exec­u­tives got indict­ed in a kick­back scheme, the com­pa­ny rebrand­ed as Emdeon and pro­ceed­ed to gob­ble up oth­er health-tech­nol­o­gy com­pa­nies, get­ting acquired along the way by the pri­vate-equi­ty giant Black­stone, which rebrand­ed it as Change Health­care in 2015.

    Most of those moves could be con­sid­ered par for the course in an acqui­si­tion-hap­py indus­try, but Unit­ed­Health Group turned heads among both health-care pro­fes­sion­als and gov­ern­ment reg­u­la­tors when it moved to buy Change in 2021. By that point, Unit­ed­Health Group had expand­ed well beyond the insur­ance busi­ness, pri­mar­i­ly through its sub­sidiary Optum, which owns every­thing from phar­ma­ceu­ti­cal ser­vices to physi­cian prac­tices. (Optum is now the country’s largest employ­er of physi­cians, with 90,000 on staff.) At the time, Optum and Change were two of the biggest providers of health IT ser­vices in the coun­try, and med­ical trade groups, includ­ing the AHA, protest­ed that the merg­er would result in Unit­ed­Health Group hav­ing near-monop­o­lis­tic con­trol over cer­tain ser­vices. The Jus­tice Depart­ment agreed and sued to block the merg­er in 2022, alleg­ing that Unit­ed might also use Change’s data to access sen­si­tive info about its rivals. The suit failed, and the $13 bil­lion merg­er went through.

    Change was impor­tant to the dai­ly oper­a­tions of the U.S. health-care sys­tem before Unit­ed­Health bought it, but the merg­er turned it into crit­i­cal infra­struc­ture — pro­vid­ing a tar­get that, if hit cor­rect­ly, could simul­ta­ne­ous­ly post­pone a surgery in Mil­wau­kee, delay a teenager’s pre­scrip­tion refill in New York, and choke the rev­enue stream of an oncol­o­gy prac­tice in Albu­querque. The attack’s “cas­cad­ing effects,” as Rig­gi calls them, are too numer­ous to list — Utah’s Med­ic­aid office, which uses Change to han­dle pre­scrip­tions, is giv­ing out 30-day refills for free and instruct­ing phar­ma­cists to fill out this Google form for reim­burse­ment. Ken Raske, the pres­i­dent of the Greater New York Hos­pi­tal Asso­ci­a­tion, says some New York hos­pi­tals will be out of cash in a week. If providers who opposed the Change acqui­si­tion weren’t cur­rent­ly strug­gling to keep their heads above water, this might’ve made for an apt moment to tell Unit­ed­Health Group “I told you so.”

    ...

    As Raske points out, though, Unit­ed­Health Group is not yet bear­ing the brunt of its own mis­takes. With Change down, the com­pa­ny is pay­ing out few­er insur­ance claims than usu­al, mean­ing that — while med­ical prac­tices verge on bank­rupt­cy — Unit­ed­Health Group may just be stock­pil­ing more cash. (Last year, the com­pa­ny raked in $371.6 bil­lion in rev­enue.) The com­pa­ny did set up a loan pro­gram to help out providers with cash-flow issues amid the out­age, but providers have called it insuf­fi­cient, with the AHA say­ing it pro­vides “very lim­it­ed relief” under “shock­ing­ly oner­ous terms and con­di­tions.”

    Short-term relief, ulti­mate­ly, may come in oth­er forms. The trade groups are lob­by­ing for gov­ern­ment inter­ven­tion, both at the state and fed­er­al lev­el. Some ideas involve sus­pend­ing cer­tain reg­u­la­tions until this is over, such as relax­ing require­ments around Medicare pre­scrip­tions or accel­er­at­ing some Medicare pay­ments to providers. (The Depart­ment of Health and Human Ser­vices imple­ment­ed those two changes on Tues­day.) Health-care providers, how­ev­er, have made clear that what they need is cash, fast. Groups like the AMA have asked the fed­er­al gov­ern­ment to make emer­gency funds avail­able, while McA­ne­ny is advo­cat­ing for a COVID-like bailout pack­age, even if the relief funds are just a loan.

    ...

    While it has yet to pay much of a price for the cyber­at­tack, Unit­ed­Health isn’t off the hook. Last week, the Jus­tice Depart­ment announced an unre­lat­ed antitrust inves­ti­ga­tion into the com­pa­ny, which is pri­mar­i­ly focused on Optum’s acqui­si­tions of physi­cian prac­tices but will like­ly be influ­enced by the ongo­ing Change cri­sis. Even if the com­pa­ny emerges rel­a­tive­ly unscathed from the inves­ti­ga­tion, it’s cur­rent­ly fac­ing a cri­sis on mul­ti­ple fronts: Ear­li­er this week, some­one paid Black­Cat $22 mil­lion in bit­coin, which could mean that Unit­ed­Health paid its hack­ers the ran­som they were demand­ing. And when the Change out­age is even­tu­al­ly resolved, law­suits will inevitably fly in UnitedHealth’s direc­tion, mean­ing the providers cur­rent­ly strug­gling to keep afloat could see a pay­out sev­er­al years down the line. For now, health-care providers like McA­ne­ny are just try­ing to stay in busi­ness.

    “Will we ever get paid? I cer­tain­ly hope so,” McA­ne­ny said. “Will we get paid in time to keep all these prac­tices alive and well? I cer­tain­ly hope so.”

    ————.

    “Cor­po­rate Greed Made the Change Health­care Cyber­at­tack Worse” By Chris Stan­ton; New York Mag­a­zine; 03/07/2024

    “Two weeks after the attack, the out­age is ongo­ing with no clear end in sight, affect­ing thou­sands of med­ical prac­tices, hos­pi­tals, and phar­ma­cies across the coun­try, which rely on Change Healthcare’s ser­vices to vary­ing degrees — as the com­pa­ny boasts on its own web­site, it han­dles records for one in three patients in the U.S. At min­i­mum, it has meant that busi­ness­es that con­tract with Change have had to scram­ble to switch to one of its few com­peti­tors (a process that can take weeks) or devise labor-inten­sive workarounds, which often involve old-school tools like paper pre­scrip­tions and fax machines. For phar­ma­cies that con­tract with Change, the out­age has dis­rupt­ed their abil­i­ty to con­duct trans­ac­tions with doc­tors and insur­ance com­pa­nies, forc­ing some phar­ma­cists to either hand out med­ica­tion and trust insur­ers to pay them back lat­er or make their cus­tomers pay for the full cost of their drugs out of pock­et. If the out­age lasts long enough, though, its ulti­mate lega­cy may be the num­ber of small med­ical providers it puts out of busi­ness entire­ly.”

    The largest health insur­er in the US, which also hap­pens to own the largest insur­ance claims gets hacked and the end result might be the bank­rupt­cy of a large num­ber of small med­ical ser­vice provider. Monop­oly cap­i­tal­ism in action. And as experts observe, the fall­out to the indus­try is a direct con­se­quence of Unit­ed­Health’s mas­sive share of the mar­ket­place for pro­vid­ing claims ser­vices. It’s effec­tive­ly the only option fol­low­ing Unit­ed’s acqui­si­tion of Change Health­care from pri­vate-equi­ty giant Black­stone:

    ...
    Amid what Rig­gi calls a “slow-rolling dis­as­ter,” it’s still too ear­ly to cal­cu­late the attack’s dam­age in terms of delayed treat­ments, leaked data, and cash-starved med­ical prac­tices. (One esti­mate sug­gest­ed U.S. health-care providers are hem­or­rhag­ing $100 mil­lion per day.) To the array of indus­try pro­fes­sion­als that I spoke with, though, what is already clear is that the dev­as­tat­ing scope of the attack is a direct prod­uct of indus­try con­sol­i­da­tion, par­tic­u­lar­ly at Unit­ed­Health Group, Change’s own­er and the country’s largest health-care provider.

    “This is what hap­pens when every­thing merges and you only have one option,” McA­ne­ny said. “When we have one option, then the hack­ers have one big tar­get that they know if they bring that down, they can grind U.S. health care to a halt.”

    Under­stand­ing how Change got its ten­drils in almost every facet of the health-care indus­try requires tak­ing a peek at the lit­er­al­ly dozens of acqui­si­tions that formed it (which Mau­reen Tkacik com­piled over at One esti­mate). In short, it orig­i­nat­ed as a sub­sidiary of Aet­na, which was then bought by a claims-pro­cess­ing com­pa­ny called Envoy in 1997 that was itself bought by Healtheon/WebMD in 2000. When Web­MD exec­u­tives got indict­ed in a kick­back scheme, the com­pa­ny rebrand­ed as Emdeon and pro­ceed­ed to gob­ble up oth­er health-tech­nol­o­gy com­pa­nies, get­ting acquired along the way by the pri­vate-equi­ty giant Black­stone, which rebrand­ed it as Change Health­care in 2015.

    ...

    Change was impor­tant to the dai­ly oper­a­tions of the U.S. health-care sys­tem before Unit­ed­Health bought it, but the merg­er turned it into crit­i­cal infra­struc­ture — pro­vid­ing a tar­get that, if hit cor­rect­ly, could simul­ta­ne­ous­ly post­pone a surgery in Mil­wau­kee, delay a teenager’s pre­scrip­tion refill in New York, and choke the rev­enue stream of an oncol­o­gy prac­tice in Albu­querque. The attack’s “cas­cad­ing effects,” as Rig­gi calls them, are too numer­ous to list — Utah’s Med­ic­aid office, which uses Change to han­dle pre­scrip­tions, is giv­ing out 30-day refills for free and instruct­ing phar­ma­cists to fill out this Google form for reim­burse­ment. Ken Raske, the pres­i­dent of the Greater New York Hos­pi­tal Asso­ci­a­tion, says some New York hos­pi­tals will be out of cash in a week. If providers who opposed the Change acqui­si­tion weren’t cur­rent­ly strug­gling to keep their heads above water, this might’ve made for an apt moment to tell Unit­ed­Health Group “I told you so.”
    ...

    Per­verse­ly, while small­er health­care providers risk going out of busi­ness as their abil­i­ty to process claims is thwart­ed, Unit­ed Health is in the posi­tion of being able to stock­pile extra cash as a result of pay­ing out few­er insur­ance claims than usu­al thanks to the hack:

    ...
    As Raske points out, though, Unit­ed­Health Group is not yet bear­ing the brunt of its own mis­takes. With Change down, the com­pa­ny is pay­ing out few­er insur­ance claims than usu­al, mean­ing that — while med­ical prac­tices verge on bank­rupt­cy — Unit­ed­Health Group may just be stock­pil­ing more cash. (Last year, the com­pa­ny raked in $371.6 bil­lion in rev­enue.) The com­pa­ny did set up a loan pro­gram to help out providers with cash-flow issues amid the out­age, but providers have called it insuf­fi­cient, with the AHA say­ing it pro­vides “very lim­it­ed relief” under “shock­ing­ly oner­ous terms and con­di­tions.”
    ...

    And it’s not like it was­n’t obvi­ous that Unit­ed’s acqui­si­tion of Change Health­care was going to cre­ate a near monop­oly in the claims pro­cess­ing space for the entire US health­care sec­tor. The AHA warned about this and the DOJ sued to block the merg­er. But that suit failed and the merg­er went through:

    ...
    Most of those moves could be con­sid­ered par for the course in an acqui­si­tion-hap­py indus­try, but Unit­ed­Health Group turned heads among both health-care pro­fes­sion­als and gov­ern­ment reg­u­la­tors when it moved to buy Change in 2021. By that point, Unit­ed­Health Group had expand­ed well beyond the insur­ance busi­ness, pri­mar­i­ly through its sub­sidiary Optum, which owns every­thing from phar­ma­ceu­ti­cal ser­vices to physi­cian prac­tices. (Optum is now the country’s largest employ­er of physi­cians, with 90,000 on staff.) At the time, Optum and Change were two of the biggest providers of health IT ser­vices in the coun­try, and med­ical trade groups, includ­ing the AHA, protest­ed that the merg­er would result in Unit­ed­Health Group hav­ing near-monop­o­lis­tic con­trol over cer­tain ser­vices. The Jus­tice Depart­ment agreed and sued to block the merg­er in 2022, alleg­ing that Unit­ed might also use Change’s data to access sen­si­tive info about its rivals. The suit failed, and the $13 bil­lion merg­er went through.
    ...

    So what was it that con­vinced the judge that the merg­er that cre­at­ed a near-monop­oly in this cru­cial seg­ment of the health­care ser­vices mar­ket did­n’t pose a sys­temic risk to the sec­tor? Well, accord­ing to the judge, the DOJ’s case con­tained “seri­ous­ly flaws”, which appar­ent­ly includ­ed the flaw of sus­pect­ing that Unit­ed­Health might be tempt­ed to abuse the access it gained to high­ly sen­si­tive com­peti­tor data. Instead of shar­ing the DOJ’s fears, Judge Nichols was appar­ent­ly swayed by the “con­vinc­ing tes­ti­mo­ny” from senior Unit­ed­Health exec­u­tives who said such abus­es would be against the company’s prac­tices and risk its cred­i­bil­i­ty. LOL:

    Health­care Dive

    DOJ’s case against UnitedHealth’s Change buy was ham­pered by ‘seri­ous flaws,’ judge finds

    The most seri­ous flaws were fail­ing to prove that Unit­ed­Health is like­ly to mis­use Change Healthcare’s data to advan­tage the com­pa­ny, Judge Carl Nichols wrote.

    Saman­tha Liss
    Senior Reporter
    Pub­lished Sept. 23, 2022

    A fed­er­al judge unsealed his opin­ion on Wednes­day in the case that allows Unit­ed­Health Group to buy Change Health­care in a $13 bil­lion deal that expands the health­care giant’s reach in the sec­tor.

    Judge Carl Nichols said each step of the DOJ’s argu­ments had “seri­ous flaws” and that it relied on “spec­u­la­tion” rather than real-world evi­dence to prove its antitrust claims.

    The most seri­ous flaws were fail­ing to prove that Unit­ed­Health is like­ly to mis­use Change Healthcare’s data to advan­tage the com­pa­ny, a move that would ulti­mate­ly chill inno­va­tion among rivals, Nichols, a for­mer Pres­i­dent Don­ald Trump appointee, said.

    ...

    Nichols’ opin­ion was ini­tial­ly placed under seal to pro­tect poten­tial­ly com­pet­i­tive­ly sen­si­tive infor­ma­tion. A redact­ed ver­sion was lat­er made avail­able on the pub­lic dock­et, explain­ing Nichols ratio­nale for sid­ing with Unit­ed­Health.

    After a thor­ough tri­al that last­ed more than two weeks, includ­ed more than two dozen wit­ness­es and tal­lied more than 1,000 exhibits, the DOJ failed to prove the trans­ac­tion is like­ly to sub­stan­tial­ly lessen com­pe­ti­tion, Nichols said in his opin­ion.

    ...

    Health­care providers use Change’s tech­nol­o­gy to sub­mit claims to health insur­ers, who also use the tech­nol­o­gy to eval­u­ate and process these claims. The DOJ sued to stop the pur­chase in Feb­ru­ary.

    The case hinged on how the acqui­si­tion would affect two tech­nolo­gies that are vital to pro­cess­ing pay­ments for med­ical ser­vices.

    In one of its claims, the DOJ argued UnitedHealth’s pur­chase of Change Health­care would cre­ate a monop­oly of what’s known as first-pass claims edit­ing solu­tions. The tech­nol­o­gy allows insur­ers to process mil­lions of claims per day by apply­ing a payer’s cov­er­age poli­cies or “edits” to a claim, quick­ly deter­min­ing whether it should be cov­ered.

    Change Healthcare’s tech­nol­o­gy, Claim­sX­ten, con­trols near­ly 70% of the mar­ket for first-pass claims edit­ing.

    The DOJ argued the com­bi­na­tion with Unit­ed­Health would unite the two lead­ers of the space, giv­ing the pair a 90% mar­ket share and elim­i­nate head-to-head com­peti­tors.

    To alle­vi­ate reg­u­la­to­ry con­cerns, Unit­ed­Health agreed to divest Claim­sX­ten to a pri­vate equi­ty group TPG Cap­i­tal.

    But the DOJ argued that Claim­sX­ten would be less com­pet­i­tive if pur­chased by TPG.

    Nichols dis­agreed. The divesti­ture will main­tain and may even improve the firm’s “com­pet­i­tive edge,” Nichols said. A key exec­u­tive and 375 oth­er peo­ple will con­tin­ue work­ing with Claim­sX­ten as part of the divesti­ture, he added.

    In its sec­ond argu­ment, the DOJ claimed the acqui­si­tion would give Unit­ed­Health access to com­pet­i­tive­ly sen­si­tive data that pass­es through Change and that Unit­ed­Health would mis­use it by min­ing rival insur­ers’ strate­gies and prac­tices.

    But this claim rests on “spec­u­la­tion rather than real-world evi­dence,” Nichols said. He was swayed by “con­vinc­ing tes­ti­mo­ny” from senior Unit­ed­Health exec­u­tives who said it would be against the company’s prac­tices — and risk its cred­i­bil­i­ty — to share Optum’s client data to advan­tage the pay­er arm of the busi­ness, Unit­ed­Health­care.

    The evi­dence pro­duced at tri­al shows that “for it to be like­ly that the pro­posed acqui­si­tion would sub­stan­tial­ly lessen com­pe­ti­tion, Unit­ed would have to uproot its entire busi­ness strat­e­gy and cor­po­rate cul­ture; inten­tion­al­ly vio­late or repeal long­stand­ing fire­wall poli­cies; flout exist­ing con­trac­tu­al com­mit­ments; and sac­ri­fice sig­nif­i­cant finan­cial and rep­u­ta­tion­al inter­ests,” Nichols said.

    ———-

    “DOJ’s case against UnitedHealth’s Change buy was ham­pered by ‘seri­ous flaws,’ judge finds” by Saman­tha Liss; Health­care Dive; 09/23/2022

    “The most seri­ous flaws were fail­ing to prove that Unit­ed­Health is like­ly to mis­use Change Healthcare’s data to advan­tage the com­pa­ny, a move that would ulti­mate­ly chill inno­va­tion among rivals, Nichols, a for­mer Pres­i­dent Don­ald Trump appointee, said.”

    Yep, it turns out the judge who reject­ed the DOJ antitrust objec­tions to merge was a Trump appointee. Sur­prise!

    So how did Judge Nichols ratio­nal­ize the merg­er? Well, part of the ini­tial objec­tions had to do with the fact that Change Health­care-owned Claim­sX­ten con­trolled 70% of the “first-pass claims edit­ing” mar­ket, which could have result­ed in Unit­ed con­trol­ling 90% of that mar­ket fol­low­ing the merg­er. So to address those con­cerns, Unit­ed agreed to have Change Health­care spin off Claim­sX­ten to pri­vate equi­ty firm TPG Cap­i­tal:

    ...
    The case hinged on how the acqui­si­tion would affect two tech­nolo­gies that are vital to pro­cess­ing pay­ments for med­ical ser­vices.

    In one of its claims, the DOJ argued UnitedHealth’s pur­chase of Change Health­care would cre­ate a monop­oly of what’s known as first-pass claims edit­ing solu­tions. The tech­nol­o­gy allows insur­ers to process mil­lions of claims per day by apply­ing a payer’s cov­er­age poli­cies or “edits” to a claim, quick­ly deter­min­ing whether it should be cov­ered.

    Change Healthcare’s tech­nol­o­gy, Claim­sX­ten, con­trols near­ly 70% of the mar­ket for first-pass claims edit­ing.

    The DOJ argued the com­bi­na­tion with Unit­ed­Health would unite the two lead­ers of the space, giv­ing the pair a 90% mar­ket share and elim­i­nate head-to-head com­peti­tors.

    To alle­vi­ate reg­u­la­to­ry con­cerns, Unit­ed­Health agreed to divest Claim­sX­ten to a pri­vate equi­ty group TPG Cap­i­tal.
    ...

    But the spin­off of ClaimX­ten did­n’t sat­is­fy the DOJ, which fur­ther argued that Claim­sX­ten would be less com­pet­i­tive if split off from the rest of Change Health­care. Fur­ther­more, the DOJ warned about the inher­ent com­pet­i­tive risks in give Unit­ed access to the sen­si­tive com­peti­tor data that pass­es through Change Health­care’s sys­tem. Judge Nichols appar­ent­ly strong­ly dis­agreed with this assess­ment, point­ing the “con­vinc­ing tes­ti­mo­ny” of the cur­rent and for­mer Unit­ed­Health CEOs who assured the judge that Unit­ed would­n’t think of abus­ing such infor­ma­tion:

    ...
    Nichols’ opin­ion was ini­tial­ly placed under seal to pro­tect poten­tial­ly com­pet­i­tive­ly sen­si­tive infor­ma­tion. A redact­ed ver­sion was lat­er made avail­able on the pub­lic dock­et, explain­ing Nichols ratio­nale for sid­ing with Unit­ed­Health.

    ...

    But the DOJ argued that Claim­sX­ten would be less com­pet­i­tive if pur­chased by TPG.

    Nichols dis­agreed. The divesti­ture will main­tain and may even improve the firm’s “com­pet­i­tive edge,” Nichols said. A key exec­u­tive and 375 oth­er peo­ple will con­tin­ue work­ing with Claim­sX­ten as part of the divesti­ture, he added.

    In its sec­ond argu­ment, the DOJ claimed the acqui­si­tion would give Unit­ed­Health access to com­pet­i­tive­ly sen­si­tive data that pass­es through Change and that Unit­ed­Health would mis­use it by min­ing rival insur­ers’ strate­gies and prac­tices.

    But this claim rests on “spec­u­la­tion rather than real-world evi­dence,” Nichols said. He was swayed by “con­vinc­ing tes­ti­mo­ny” from senior Unit­ed­Health exec­u­tives who said it would be against the company’s prac­tices — and risk its cred­i­bil­i­ty — to share Optum’s client data to advan­tage the pay­er arm of the busi­ness, Unit­ed­Health­care.

    The evi­dence pro­duced at tri­al shows that “for it to be like­ly that the pro­posed acqui­si­tion would sub­stan­tial­ly lessen com­pe­ti­tion, Unit­ed would have to uproot its entire busi­ness strat­e­gy and cor­po­rate cul­ture; inten­tion­al­ly vio­late or repeal long­stand­ing fire­wall poli­cies; flout exist­ing con­trac­tu­al com­mit­ments; and sac­ri­fice sig­nif­i­cant finan­cial and rep­u­ta­tion­al inter­ests,” Nichols said.
    ...

    Judge Nichols sure seems to have a lot of faith in the integri­ty of cor­po­rate CEOs. So to get a bet­ter of idea of where that faith may be com­ing from, it’s worth not­ing that Judge Nichols was­n’t just a Trump appointee. Nor is he just a Fed­er­al­ist Soci­ety affil­i­at­ed judge. As the fol­low­ing arti­cle notes, Judge Nichols used to clerk for Supreme Court Jus­tice Clarence Thomas. And as we’ve seen, you can’t real­ly under­stand Clarence Thomas’s think­ing on mat­ters with­out rec­og­niz­ing his remark­able rela­tion­ship with ultra-wealthy ‘friends’ who have show­ered Thomas with lav­ish gifts for decades. And while we have no indi­ca­tion that Judge Thomas’s bil­lion­aire sug­ar-dad­dies are show­er­ing Judge Nichols with sim­i­lar favors, you have to won­der just how much much ‘bil­lion­aire benev­o­lence’ Nichols end­ed up wit­ness­ing dur­ing his time as Thomas’s clerk and how that might ulti­mate­ly affect his will­ing­ness to trust in the good faith of over­paid CEOs:

    Health­care Dive

    DOJ drops appeal against UnitedHealth’s acqui­si­tion of Change

    In a Mon­day fil­ing with a fed­er­al appeals court, the DOJ-led group agreed to with­draw its suit against a rul­ing that had allowed the merg­er.

    Syd­ney Halle­man
    Edi­tor
    Pub­lished March 22, 2023

    The U.S. Depart­ment of Jus­tice and par­ties from New York and Min­neso­ta have filed to drop an appeal to block Unit­ed­Health Group’s acqui­si­tion of Change Health­care, after a Sep­tem­ber rul­ing in U.S. Dis­trict Court allowed the $13 bil­lion deal to go through.

    In a Mon­day fil­ing with the U.S. Court of Appeals for the Dis­trict of Colum­bia Cir­cuit, all par­ties agreed to vol­un­tar­i­ly dis­miss the case and assume any costs incurred by the appeal.

    The DOJ wait­ed over a month to file its Novem­ber appeal after the deal between Unit­ed­Health and Change closed in Octo­ber, prompt­ing some antitrust experts to won­der if the agency would let the deal go through with­out fur­ther chal­lenge.

    Dur­ing bench tri­als to block the merg­er, the DOJ argued that UnitedHealth’s acqui­si­tion of Change would dis­ad­van­tage rivals and result in high­er costs and low­er qual­i­ty of com­mer­cial health insur­ance. Unit­ed Health, one of the largest health­care insur­ers in the U.S., pro­posed to buy Change Health­care in 2021 in order to incor­po­rate its data-pro­cess­ing capa­bil­i­ties for insur­ance claims and inte­grate the busi­ness into its Optum arm.

    Judge Carl Nichols said in a Sep­tem­ber opin­ion that the DOJ’s argu­ments had “seri­ous flaws,” and that they relied on “spec­u­la­tion” rather than real-world evi­dence to prove the department’s antitrust claims. Nichols served as a law clerk to Supreme Court jus­tice Clarence Thomas, and was appoint­ed to the bench by then-Pres­i­dent Don­ald Trump.

    ...

    ———–

    “DOJ drops appeal against UnitedHealth’s acqui­si­tion of Change” by Syd­ney Halle­man; Health­care Dive; 03/22/2023

    “Judge Carl Nichols said in a Sep­tem­ber opin­ion that the DOJ’s argu­ments had “seri­ous flaws,” and that they relied on “spec­u­la­tion” rather than real-world evi­dence to prove the department’s antitrust claims. Nichols served as a law clerk to Supreme Court jus­tice Clarence Thomas, and was appoint­ed to the bench by then-Pres­i­dent Don­ald Trump.”

    Judge Nichols isn’t just anoth­er Trump appointee from the Fed­er­al­ist Soci­ety. He was Clarence Thomas’s law clerk. Jus­tice Sug­ar Baby’s clerk found the CEO tes­ti­monies quite con­vince while only see­ing “seri­ous flaws” in the DOJs con­cerns. Because who could believe a com­pa­ny as large as Unit­ed­Health would do some­thing irre­spon­si­ble while no one is look­ing. Cyn­ics at the DOJ, that’s who.

    So as bad as this mega-hack sto­ry is, keep in mind it could be worse. The claims pro­cess­ing mar­ket could have been com­plete­ly under the con­trol of Unit­ed­Health, instead of almost com­plete­ly under its con­trol. It could be worse, but not much worse, because that’s how bad we let this get. Monop­o­lies are a lot more brit­tle in the age of the mega-hack. Well, not so much the monop­o­lies but rather the soci­eties reliant on them. The monop­o­lies will be fine.

    Posted by Pterrafractyl | March 8, 2024, 11:52 pm

  29. It’s not over. Not even close. The Change Health­care hack lum­bers on, despite the $22 mil­lion in ran­som already paid out. Not only are health­care providers still run­ning into dif­fi­cul­ties pro­cess­ing past claims — and meet­ing pay­roll as a con­se­quence — but ran­soms are still being demand­ed. Although with new enti­ties mak­ing the demands this time.

    As we’re going to see, it turns out the ALPHV/Blackcat hack­ing group that claimed cred­it for the hack — and sub­se­quent­ly received $22 mil­lion in bit­coin ran­som pay­ments from Unit­ed­Health — did the thing many feared it was going to do: walk away with the mon­ey with­out delet­ing the data and ten­ta­tive­ly resolv­ing the sit­u­a­tion. But it’s worse than that. Because the stolen data isn’t just in the hands of ALPHV/Blackcat. Anoth­er hack­ing group, Ran­somHub, is appar­ent­ly in pos­ses­sion of the stolen data too, and Ran­somHub nev­er got its cut of the $22 mil­lion. Guess what hap­pen next?

    Yes, Ran­somHub is now mak­ing ran­som demands of its own in order to pre­vent the leak­age of the sen­si­tive patient data on mil­lions of Amer­i­cans. While insist­ing that pay­ees can trust that, this time, the ran­som pay­ment real­ly is going to result in the dele­tion of the stolen data. ALPHA/Blackcat may have been a bad faith ran­somware pur­vey­or, but you can trust Ran­somHub. That’s the remark­able devel­op­ment in the cyber­crim­i­nal space cur­rent­ly unfold­ing.

    And the ran­soms aren’t just being request­ed from Unit­ed­Health and its Change Health­care sub­sidiary. Change Health­care’s major clients, whose patient data was being processed by the com­pa­ny and was ulti­mate­ly stolen, are the enti­ties being asked to pay this time. Major health­care insur­ers like MetLife, CVS Care­mark, Davis Vision, Health Net, and Teach­ers Health Trust.

    It’s not clear how much ran­som is being request­ed of these enti­ties. Nor is it clear if any­one has paid yet. But to make clear that the threat is real, Ran­somHub has shared infor­ma­tion with jour­nal­ists like Wired’s Andy Green­berg. Infor­ma­tion that includes med­ical and den­tal records, pay­ment claims, insur­ance details, and per­son­al infor­ma­tion like Social Secu­ri­ty num­bers and email address­es. In oth­er words, the kind of infor­ma­tion that could be very harm­ful to the mil­lions of indi­vid­ual patients from an iden­ti­ty theft stand­point. And there­fore the kind of infor­ma­tion that might elic­it some hand­some ran­som pay­ments. Even if the ran­som has already been paid and it’s not know if fur­ther pay­ments are going to get results.

    It’s a fas­ci­nat­ing devel­op­ment in the ran­somware crim­i­nal space. What kind of rep­u­ta­tion­al dam­age could this do to all ran­somware attacks? Peo­ple aren’t going to keep pay­ing if past ran­som pay­ments don’t get results.

    And yet, as we’ve seen, warn­ings of this kind of devel­op­ment in the ran­somware have been flash­ing, and recent­ly. For exam­ple, there was the US bust of the Lock­Bit ran­somware ring back in Feb­ru­ary, weeks before the Change Health­care hack, that dis­cov­ered the group was still in pos­ses­sion of data that for which the ran­som had already been paid. It’s always been obvi­ous that a ran­somware pay­ment won’t nec­es­sar­i­ly mean the stolen data has be delet­ed, but it’s anoth­er thing to con­firm it. But that’s what hap­pened with the Lock­Bit bust. And here we are, two months lat­er, with Ran­somHub issu­ing new ran­som requests, to the clients of Change Health­care this time, after Change Health­care paid $22 mil­lion, the sec­ond largest ran­somware ran­som in his­to­ry to day:

    Wired

    Change Healthcare’s New Ran­somware Night­mare Goes From Bad to Worse

    A cyber­crim­i­nal gang called Ran­somHub claims to be sell­ing high­ly sen­si­tive patient infor­ma­tion stolen from Change Health­care fol­low­ing a ran­somware attack by anoth­er group in Feb­ru­ary.

    ERIC GELLER

    SECURITY
    APR 16, 2024 3:09 PM

    Change Health­care is fac­ing a new cyber­se­cu­ri­ty night­mare after a ran­somware group began sell­ing what it claims is Amer­i­cans’ sen­si­tive med­ical and finan­cial records stolen from the health care giant.

    “For most US indi­vid­u­als out there doubt­ing us, we prob­a­bly have your per­son­al data,” the Ran­somHub gang said in an announce­ment seen by WIRED.

    The stolen data alleged­ly includes med­ical and den­tal records, pay­ment claims, insur­ance details, and per­son­al infor­ma­tion like Social Secu­ri­ty num­bers and email address­es, accord­ing to screen­shots. Ran­somHub claimed it had health care data on active-duty US mil­i­tary per­son­nel.

    The sprawl­ing theft and sale of sen­si­tive health care data rep­re­sents a dra­mat­ic new form of fall­out from the Feb­ru­ary cyber­at­tack on Change Health­care that crip­pled the company’s claims-pay­ment oper­a­tions and sent the US health care sys­tem into cri­sis as hos­pi­tals strug­gled to stay open with­out reg­u­lar fund­ing.

    ...

    The wide vari­ety of patient data that Ran­somHub claims to be sell­ing is a tes­ta­ment to Change Healthcare’s role as a crit­i­cal inter­me­di­ary between insur­ers and health care providers, facil­i­tat­ing pay­ments between both par­ties and col­lect­ing reams of sen­si­tive infor­ma­tion about patients and their med­ical pro­ce­dures in the process.

    Among the sam­ple records that Ran­somHub post­ed are a list of open claims han­dled by the company’s EquiClaim sub­sidiary that includes patient and provider names; a hos­pi­tal record for a 74-year-old woman in Tam­pa, Flori­da; and part of a data­base record relat­ed to US mil­i­tary ser­vice mem­bers’ health care.

    Ran­somHub said it would allow indi­vid­ual insur­ance com­pa­nies that worked with Change Health­care and had their data com­pro­mised to pay ran­soms to pre­vent the sale of their records. It spec­i­fied that it was sell­ing data belong­ing to MetLife, CVS Care­mark, Davis Vision, Health Net, and Teach­ers Health Trust.

    Change Healthcare’s “pro­cess­ing of sen­si­tive data for all of these com­pa­nies is just some­thing unbe­liev­able,” Ran­somHub said in its announce­ment.

    ...

    Brett Cal­low, a threat ana­lyst at the secu­ri­ty firm Emsisoft who close­ly tracks ran­somware gangs, says the new sale of stolen data was prob­a­bly “less about actu­al­ly sell­ing the data” and more about putting Change Healthcare—and the part­ner com­pa­nies whose records it failed to protect—“under addi­tion­al pres­sure to pay.”

    Change Health­care appears to have paid a $22 mil­lion ran­som to AlphV to stop it from leak­ing ter­abytes of stolen data.

    Two months into the cri­sis spawned by the ran­somware attack, Change Health­care has faced mount­ing loss­es. The com­pa­ny recent­ly report­ed spend­ing $872 mil­lion respond­ing to the inci­dent as of March 31.

    At the same time, Change is under increas­ing pres­sure from law­mak­ers and reg­u­la­tors to explain its cyber­se­cu­ri­ty lapse and the steps it’s tak­ing to pre­vent anoth­er hack.

    A sub­com­mit­tee of the House Ener­gy and Com­merce Com­mit­tee held a hear­ing on the health sector’s cyber pos­ture on Tues­day, with key law­mak­ers say­ing they were dis­ap­point­ed that Unit­ed­Health Group declined to make an exec­u­tive avail­able to tes­ti­fy. And the Depart­ment of Health and Human Ser­vices is inves­ti­gat­ing whether Change Healthcare’s fail­ure to pre­vent hack­ers from access­ing and steal­ing its data vio­lat­ed fed­er­al data-secu­ri­ty rules.

    Updat­ed 4/16/2024, 5:38 pm ET: Added addi­tion­al details about the firms whose data Ran­somHub claims to pos­sess.

    ———–

    “Change Healthcare’s New Ran­somware Night­mare Goes From Bad to Worse” by ERIC GELLER; Wired; 04/16/2024

    “The stolen data alleged­ly includes med­ical and den­tal records, pay­ment claims, insur­ance details, and per­son­al infor­ma­tion like Social Secu­ri­ty num­bers and email address­es, accord­ing to screen­shots. Ran­somHub claimed it had health care data on active-duty US mil­i­tary per­son­nel.”

    It’s not just med­ical records. It’s Social Secu­ri­ty num­bers and insur­ance details too. That’s not the kind of infor­ma­tion you want to see leaked to the pub­lic. But that’s what Ran­somHub is now threat­en­ing to leak if they don’t receive ran­som pay­ments. And it’s not just Change Health­care or Unit­ed Health receiv­ing the ran­som notice. All of their clients whose data was being processed by Change Health­care are also fac­ing calls to pay a ran­som. It’s a much larg­er ran­som-col­lect­ing oper­a­tion. Inter­est­ing­ly, Ran­somHub itself even seemed to express dis­be­lief that Change Health­care could be pro­cess­ing such sen­si­tive data for so many dif­fer­ent com­pa­nies:

    ...
    The wide vari­ety of patient data that Ran­somHub claims to be sell­ing is a tes­ta­ment to Change Healthcare’s role as a crit­i­cal inter­me­di­ary between insur­ers and health care providers, facil­i­tat­ing pay­ments between both par­ties and col­lect­ing reams of sen­si­tive infor­ma­tion about patients and their med­ical pro­ce­dures in the process.

    ...

    Ran­somHub said it would allow indi­vid­ual insur­ance com­pa­nies that worked with Change Health­care and had their data com­pro­mised to pay ran­soms to pre­vent the sale of their records. It spec­i­fied that it was sell­ing data belong­ing to MetLife, CVS Care­mark, Davis Vision, Health Net, and Teach­ers Health Trust.

    Change Healthcare’s “pro­cess­ing of sen­si­tive data for all of these com­pa­nies is just some­thing unbe­liev­able,” Ran­somHub said in its announce­ment.

    ...

    Brett Cal­low, a threat ana­lyst at the secu­ri­ty firm Emsisoft who close­ly tracks ran­somware gangs, says the new sale of stolen data was prob­a­bly “less about actu­al­ly sell­ing the data” and more about putting Change Healthcare—and the part­ner com­pa­nies whose records it failed to protect—“under addi­tion­al pres­sure to pay.”
    ...

    And as a reminder that this is a scan­dal cen­tered around an immense­ly pow­er­ful indus­try giant, note how Unit­ed­Health did­n’t even both­er make an exec­u­tive avail­able for con­gres­sion­al tes­ti­mo­ny. Most com­pa­nies would prob­a­bly fear piss­ing off Con­gress in this sit­u­a­tion. But not Unit­ed­Health:

    ...
    At the same time, Change is under increas­ing pres­sure from law­mak­ers and reg­u­la­tors to explain its cyber­se­cu­ri­ty lapse and the steps it’s tak­ing to pre­vent anoth­er hack.

    A sub­com­mit­tee of the House Ener­gy and Com­merce Com­mit­tee held a hear­ing on the health sector’s cyber pos­ture on Tues­day, with key law­mak­ers say­ing they were dis­ap­point­ed that Unit­ed­Health Group declined to make an exec­u­tive avail­able to tes­ti­fy. And the Depart­ment of Health and Human Ser­vices is inves­ti­gat­ing whether Change Healthcare’s fail­ure to pre­vent hack­ers from access­ing and steal­ing its data vio­lat­ed fed­er­al data-secu­ri­ty rules.
    ...

    And in case there were sus­pi­cions that this is just some sort of emp­ty threat and Ran­somHub does­n’t actu­al­ly pos­sess this data, here’s an inter­view with Wired’s Andy Green­berg who has been in com­mu­ni­ca­tion with the Ran­somHub group. Green­berg con­firms they shared exam­ple data with him in an attempt to ver­i­fy their threat.

    Gree­berg also addressed the real­i­ty that this expand­ed ran­som demand from the Ran­somHub group is com­ing after the ALPHV/Blackcat hack­ing group already claimed respon­si­bil­i­ty for the hack and received a $22 mil­lion ran­som pay­ment. ALPHV/Blackcat even claimed to have shut down and retired after the pay­ment was received. And yet here we are with their appar­ent part­ner in crime, Ran­somHub, mak­ing its own expand­ed ran­som demands. It’s a remark­able devel­op­ment in the ran­somware indus­try. After all, there’s not going to be any incen­tive to pay a ran­som if pay­ment does­n’t make the night­mare go away. But as Green­berg explains, it appears ALPHV/Blackcat sim­ply took all of the ran­som mon­ey and dis­ap­peared with­out ever shar­ing it with Ran­somHub. In fact, Ran­somHub even tried to explain this sit­u­a­tion to Green­berg by insist­ing that “Well, we are not like that oth­er cyber crim­i­nal group. We can be trust­ed. We don’t even want to hold this data, as soon as we are paid, we’ll delete it.”

    So at the same time the Change Health­care night­mare hack is get­ting worse, we’re see­ing a fas­ci­nat­ing test of the Ran­somware crime busi­ness mod­el. What kind of impact will ALPHV/Blackcat’s betray­al of Ran­somHub have on this grow­ing crim­i­nal sec­tor? Are we going to see ran­som pay­ments by Change Health­care’s clients too? Or will the bad faith nature of pre­vi­ous pay­ment give them pause? And how much data will Ran­somHub end up leak­ing if it does­n’t get the ran­som its now demand­ing? As Green­berg puts it, “So this is tru­ly kind of worse than worst-case sce­nario. It’s some­thing that I’ve nev­er seen before in the ran­som ware ecosys­tem”:

    Kare11

    ‘Worse than worst-case sce­nario’ | Change Health­care faces more ran­somware demands as dis­rup­tions con­tin­ue

    Weeks after a hack­ing group appeared to receive a $22M ran­som pay­ment, a report from Wired indi­cates the stolen patient data was nev­er delet­ed.

    Author: Kent Erdahl
    Pub­lished: 7:56 PM CDT April 15, 2024
    Updat­ed: 7:56 PM CDT April 15, 2024

    MINNEAPOLIS — An ongo­ing cyber­se­cu­ri­ty saga involv­ing Change Health­care, a sub­sidiary of Min­neso­ta-based Unit­ed Health Group, appears to offer a cau­tion­ary tale for large com­pa­nies deal­ing with ran­somware attacks.

    “There tru­ly is no hon­or among these thieves it seems,” said Andy Green­berg a senior writer for Wired, who has been cov­er­ing the Change Health­care cyber­at­tack since it was first dis­cov­ered in late Feb­ru­ary. “When you pay these ran­somware groups, you can’t nec­es­sar­i­ly trust that they are going to fol­low through on their promis­es.”

    ...

    But short­ly after report­ing on that pay­ment, which would be the sec­ond largest in U.S. his­to­ry, Green­berg heard from a sec­ond hack­ing group that claimed to still have sen­si­tive patient data.

    “I was told that first group of hack­ers, known as AlphV, sim­ply ran off with the mon­ey they were paid rather than shar­ing it with their part­ners who are still in pos­ses­sion of that stolen data,” he said. “So this is tru­ly kind of worse than worst-case sce­nario. It’s some­thing that I’ve nev­er seen before in the ran­som ware ecosys­tem.”

    He says that group is now threat­en­ing to release that stolen data, or sell it to the high­est bid­der, unless it receives also receives a ran­som.

    Kent Erdahl: “As of right now, do we know that any patient infor­ma­tion has been shared?”

    Andy Green­berg: “Well, some patient infor­ma­tion has actu­al­ly been shared with me. When I asked Ran­somHub — this sec­ond group of hack­ers who are extort­ing Change Health­care — to prove that this was­n’t just an emp­ty threat, they did send me a few sam­ples of patient records, a con­tract that Change Health­care had with anoth­er com­pa­ny. We don’t know that they have the full, four ter­abytes of data that they claim to have and are threat­en­ing to leak, but if they did that would be, obvi­ous­ly, a ter­ri­ble out­come for patients who would have just very sen­si­tive infor­ma­tion about them­selves spilled onto the dark web.”

    Erdahl: “I think the obvi­ous ques­tion is, why would it be advis­able for a com­pa­ny to pay a sec­ond ran­som when the first one did­n’t even real­ly do what was promised?”

    Green­berg: “Well, it’s almost com­i­cal. Ran­somHub did even say to me — in response to this ques­tion — ‘Well, we are not like that oth­er cyber crim­i­nal group. We can be trust­ed. We don’t even want to hold this data, as soon as we are paid, we’ll delete it.’ But yes, can you actu­al­ly believe that when the first group of ran­somware hack­ers actu­al­ly said exact­ly the same thing?”

    Sen­si­tive patient data isn’t the only thing hang­ing in the bal­ance right now, there are still large num­bers of physi­cians and hos­pi­tal sys­tems nation­wide stuck in the lurch as Change Health­care sorts out the dis­rup­tions to its billing, pay­ment and care por­tals.

    In a nation­wide sur­vey released by the Amer­i­can Med­ical Asso­ci­a­tion, 80% of physi­cians who respond­ed said they have lost rev­enue from unpaid claims and near­ly one-third were unable to make pay­roll.

    ...

    “Some of our mem­bers are just dead in the water,” said Joe Schindler, vice pres­i­dent of finance for the Min­neso­ta Hos­pi­tal Asso­ci­a­tion. “They’re just wait­ing to try and get bills sent out the door on behalf of their patients to be able to get paid and to keep rev­enue flow­ing.”

    Schindler says some providers have got­ten some help with pay­ments and cash flow issues, but he says it could be Hal­loween before some patient bills will be sort­ed out and sent in the mail. If you’re a patient wait­ing for pri­or autho­riza­tion before get­ting a pro­ce­dure or a cost­ly test, he says Change Health­care has yet to pro­vide much help or clar­i­ty.

    ————

    “ ‘Worse than worst-case sce­nario’ | Change Health­care faces more ran­somware demands as dis­rup­tions con­tin­ue” by Kent Erdahl; Kare11; 04/15/2024

    “Andy Green­berg: “Well, some patient infor­ma­tion has actu­al­ly been shared with me. When I asked Ran­somHub — this sec­ond group of hack­ers who are extort­ing Change Health­care — to prove that this was­n’t just an emp­ty threat, they did send me a few sam­ples of patient records, a con­tract that Change Health­care had with anoth­er com­pa­ny. We don’t know that they have the full, four ter­abytes of data that they claim to have and are threat­en­ing to leak, but if they did that would be, obvi­ous­ly, a ter­ri­ble out­come for patients who would have just very sen­si­tive infor­ma­tion about them­selves spilled onto the dark web.” ”

    Ran­somHub isn’t issu­ing emp­ty threats. The group appar­ent­ly nev­er got its cut of the ran­som from ALPHV/Blackcat but still has the data and is deter­mined to get a pay­ment one way or anoth­er. It’s new ter­ri­to­ry for the ran­somware sec­tor, although it’s almost sur­pris­ing a sce­nario like this has­n’t erupt­ed before. It seems kind of inevitable. And here we are, with Ran­somHub try­ing to empha­size to a Wired reporter about how they are gen­uine­ly trust­wor­thy and real­ly will delete the data upon receipt of the ran­som and not just run off with the mon­ey like their untrust­wor­thy crim­i­nal part­ners just did:

    ...
    But short­ly after report­ing on that pay­ment, which would be the sec­ond largest in U.S. his­to­ry, Green­berg heard from a sec­ond hack­ing group that claimed to still have sen­si­tive patient data.

    “I was told that first group of hack­ers, known as AlphV, sim­ply ran off with the mon­ey they were paid rather than shar­ing it with their part­ners who are still in pos­ses­sion of that stolen data,” he said. “So this is tru­ly kind of worse than worst-case sce­nario. It’s some­thing that I’ve nev­er seen before in the ran­som ware ecosys­tem.”

    He says that group is now threat­en­ing to release that stolen data, or sell it to the high­est bid­der, unless it receives also receives a ran­som.

    ...

    Erdahl: “I think the obvi­ous ques­tion is, why would it be advis­able for a com­pa­ny to pay a sec­ond ran­som when the first one did­n’t even real­ly do what was promised?”

    Green­berg: “Well, it’s almost com­i­cal. Ran­somHub did even say to me — in response to this ques­tion — ‘Well, we are not like that oth­er cyber crim­i­nal group. We can be trust­ed. We don’t even want to hold this data, as soon as we are paid, we’ll delete it.’ But yes, can you actu­al­ly believe that when the first group of ran­somware hack­ers actu­al­ly said exact­ly the same thing?”
    ...

    Final­ly, note how the cri­sis is NOT over for large num­bers of physi­cians and hos­pi­tals, with over a third of physi­cians indi­cat­ing dif­fi­cul­ty sim­ply meet­ing pay­roll as a result of the hack­’s ongo­ing dis­rup­tion to claims pro­cess­ing. It’s an ongo­ing cri­sis, which is only going to make the new­ly issued demands for more ran­som all the more com­pelling for the tar­get­ed par­ties:

    ...
    Sen­si­tive patient data isn’t the only thing hang­ing in the bal­ance right now, there are still large num­bers of physi­cians and hos­pi­tal sys­tems nation­wide stuck in the lurch as Change Health­care sorts out the dis­rup­tions to its billing, pay­ment and care por­tals.

    In a nation­wide sur­vey released by the Amer­i­can Med­ical Asso­ci­a­tion, 80% of physi­cians who respond­ed said they have lost rev­enue from unpaid claims and near­ly one-third were unable to make pay­roll.

    ...

    “Some of our mem­bers are just dead in the water,” said Joe Schindler, vice pres­i­dent of finance for the Min­neso­ta Hos­pi­tal Asso­ci­a­tion. “They’re just wait­ing to try and get bills sent out the door on behalf of their patients to be able to get paid and to keep rev­enue flow­ing.”

    Schindler says some providers have got­ten some help with pay­ments and cash flow issues, but he says it could be Hal­loween before some patient bills will be sort­ed out and sent in the mail. If you’re a patient wait­ing for pri­or autho­riza­tion before get­ting a pro­ce­dure or a cost­ly test, he says Change Health­care has yet to pro­vide much help or clar­i­ty.
    ...

    Hal­loween isn’t exact­ly around the cor­ner. It’s April. Plen­ty of time for more twists and turns in this sto­ry between now and then. How far will the ran­som demands get? Don’t for­get we’re talk­ing about the threat of leak­ing patient infor­ma­tion. There’s no rea­son patients can’t be ran­somed too.

    So we’ll see how this lat­est secu­ri­ty night­mare plays out. But don’t plan on a res­o­lu­tion any time soon. If ever. It’s the nature of the ran­somware indus­try. Whether or not the ran­somers ask­ing for one last pay­ment insist oth­er­wise.

    Posted by Pterrafractyl | April 21, 2024, 8:43 pm

  30. We got some sig­nif­i­cant updates on the Change Health­care mega-hack. Updates on the scale of the poten­tial dam­age and updates how it hap­pened in the first. All hor­ri­ble updates, in keep­ing with the gen­er­al theme of this sto­ry:

    First, we got con­fir­ma­tion from Unit­ed­Health on whether or not the sec­ond round of demand­ed ran­som was paid. It was. Anoth­er $22 mil­lion paid out, this time to Ran­somHub. Although as we also learned, it was­n’t Ran­somHub who was actu­al­ly cheat­ed out of their cut of the ran­som. That would a hack­er who goes by the name “Notchy”. It was “Notchy” was part­nered with Ran­somHub to get the sec­ond ran­som. Which also means the num­ber of actors poten­tial­ly in pos­ses­sion of all of that sen­si­tive health care data is now Blackcat/ALPHV, Notchy, and Ran­somHub. Let’s hope two pay­ments of $22 mil­lion ensures that data was destroyed. Fin­gers crossed.

    And then we got a tru­ly dis­turb­ing reas­sur­ance from Unit­ed­Health: The com­pa­ny let us know that is is unaware so far that any com­plete med­ical his­to­ries were stolen. It’s the kind of reas­sur­ance that strong­ly implies the com­pa­ny thinks it was pos­si­ble entire med­ical his­to­ries were stolen. And when we’re talk­ing about a mega-hack, we have to assume the dis­clo­sures come in stages. It typ­i­cal­ly starts off with ‘it could be worse’ assur­ances, fol­low­ing by belat­ed acknowl­edg­ment that it’s actu­al­ly worse. Which means we should prob­a­bly assume entire med­ical his­to­ries were stolen for at least some peo­ple.

    How many? Well, that’s where we got anoth­er awful update. Because while we still don’t know the scale of the dam­age, Unit­ed­Health is now acknowl­edg­ing that pos­si­ble one in three Amer­i­cans may be impact­ed, which is more or less what we should expect giv­en giv­en that Change Health­care is so vast that it’s ser­vices touch rough­ly one in three med­ical records.

    But Unit­ed­Health can’t yet assess the dam­age, in part, because it appears the hack­ers were not only able to encrypt their cus­tomer data­bas­es but also all the back­ups. Yes, it turns out Change Health­care’s data back­up sys­tems were on site, so once the hack­ers gained access to the net­work they were able to encrypt all the back­ups too. Whoops! The com­pa­ny is now insist­ing it will need sev­er­al more months before it can ful­ly assess the dam­age. Which kind of sounds like the twin $22 mil­lion pay­ments did­n’t actu­al­ly buy a decryp­tion key. Just the promise that the data won’t be leaked.

    We’re also told that Change Health­care’s sys­tems aren’t just being rebuilt from the ground up but they are now mov­ing to the cloud. We don’t know which cloud. Maybe it will be Google. Maybe Microsoft or Ama­zon. But who­ev­er it is will have anoth­er trove of high sen­si­tive data sit­ting on their cloud servers. And sure, Change Health­care to in the­o­ry encrypt that data and make it unread­able for the cloud provider. But are they going to do so?

    We’re also learn­ing that the hack appar­ent­ly began on Feb­ru­ary 12, nine days before the ran­somware was deployed on Change Health­care’s sys­tems. That’s part of what makes pos­si­bil­i­ty that entire med­ical his­to­ries may have been stolen so dis­turb­ing. They had 9 days to exfil­trate data unde­tect­ed.

    And then we got some sig­nif­i­cant updates on the nature of the vul­ner­a­bil­i­ty that was exploit­ed in the first place: we are told that it was­n’t the Con­nect­Wise vul­ner­a­bil­i­ty at all. Recall how it was Feb­ru­ary 19 when it was pub­licly dis­closed that the Con­nect­Wise Screen­Con­nect remote access soft­ware had a mas­sive vul­ner­a­bil­i­ty that allowed any hack to eas­i­ly cre­ate admin accounts and that hack­ers were run­ning wild. So when we learned about the Change Health­care deba­cle two days lat­er, it was wide­ly sus­pect that Con­nect­Wise was the cul­prit, although Con­nect­Wise denied any involve­ment at the time. Well, it appears Con­nect­Wise’s denials were cor­rect. Accord­ing to Unit­ed­Health, it was a dif­fer­ent remote access soft­ware por­tal that was bro­ken into: the Cit­rix remote access soft­ware.

    As we’re going to see, Con­nect­Wise isn’t the only wide­ly remote access soft­ware tool that has been the source of IT night­mares in recent months. A vul­ner­a­bil­i­ty in Cit­rix’s soft­ware known as “Cit­rix Bleed” has been exploit­ed by hack­ers since at least August. Thou­sands of orga­ni­za­tions were at risk. The com­pa­ny did­n’t issue a patch until Octo­ber, although even then it sounds like a patch alone isn’t enough and steps will need to be tak­en to route out any intrud­ers. It also sounds like thou­sands of Cit­rix’s clients were lax on imple­ment­ing the fix­es. Two more Cit­rix vul­ner­a­bil­i­ties were dis­closed in Jan­u­ary. As reports were warn­ing at the begin­ning of this year, we should expect new dis­clo­sures from of a Cit­rix-relat­ed breach for months to come. And then, a month and a half lat­er, Change Health­care gets hacked from a Cit­rix por­tal.

    So was “Cit­rix Bleed” the source of the hack? Well, not quite. Because Unit­ed­Health is also insist­ing that the known vul­ner­a­bil­i­ties in Cit­rix weren’t the cause of the hack. Instead, “com­pro­mised cre­den­tials” were used on a Cit­rix por­tal with­out MFA. That’s it. Some­how a hack­er got “com­pro­mised cre­den­tials” and just logged in. Unit­ed­Health appears to be empha­siz­ing the lack of MFA as the cause of the entire thing in its pub­lic rela­tions, while also sug­gest­ing that this lack of MFA on the por­tal was due to lega­cy prac­tices of Change Health­care and that Unit­ed­Health just had­n’t yet com­plet­ed its mod­ern­iza­tion of Change’s IT prac­tices (the com­pa­ny was acquired at the end of 2022). In oth­er words, Unit­ed­Health is striv­ing for an ‘Oop­sy! Mis­takes were made by our IT staff!’ kind of expla­na­tion.

    It’s quite a remark­able coin­ci­dence of tim­ing involved with this expla­na­tion: On Feb­ru­ary 12, we are told the hack began via “com­pro­mised cre­den­tials” on a Cit­rix por­tal run­ning on Change Health­care’s net­works and def­i­nite­ly NOT via the many known Cit­rix vul­ner­a­bil­i­ties that has been per­co­lat­ing for months. A week lat­er, it was pub­licly dis­closed that the Con­nect­Wise vul­ner­a­bil­i­ty exists and was being exploit­ed in the wild. Two day lat­er, the ran­somware is deploy on Change Health­care’s net­works. So Change Health­care was­n’t a vic­tim of either of the two major remote access vul­ner­a­bil­i­ties that were being wide­ly exploit­ed at the time of the hack but instead a hack­er just hap­pened to have some “com­pro­mised cre­den­tials”. It’s pos­si­ble this is real­ly how it all hap­pened. But it’s hard not to won­der if the com­pa­ny is try­ing to come up with the more lia­bil­i­ty-free expla­na­tion pos­si­ble. Because it’s not hard to imag­ine the law­suits are going to get exten­sive with one in three Amer­i­cans poten­tial­ly vic­tims of this breach,.

    So that’s the remark­ably awful set of updates we’ve received: Unit­ed­Health assures us it’s not aware of any entire med­ical his­to­ries being stolen, which means we’re prob­a­bly going to learn about entire med­ical his­to­ries being stolen in upcom­ing updates. And Unit­ed­Health also assures us that it was all an inno­cent “com­pro­mised cre­den­tials” issue and def­i­nite­ly NOT due to either of the major remote access vul­ner­a­bil­i­ties that were being wide­ly exploit­ed by hack­ers at the time. And, while that may or may not be the real expla­na­tion, it’s not even clear it’s a bet­ter expla­na­tion from a secu­ri­ty stand­point, although it might be bet­ter from a lia­bil­i­ty stand­point. And we got to learn that the sec­ond ran­som def­i­nite­ly was paid. But despite pay­ing the ran­som twice, the ran­somwared data remains encrypt­ed. The pay­ments only pre­vent a leak. One has to hope:

    Bleep­ing­Com­put­er

    Unit­ed­Health con­firms it paid ran­somware gang to stop data leak

    By Bill Toulas
    April 23, 2024 10:28 AM

    Unit­ed­Health con­firms it paid ran­somware gang to stop data leak

    The Unit­ed­Health Group has con­firmed that it paid a ran­som to cyber­crim­i­nals to pro­tect sen­si­tive data stolen dur­ing the Optum ran­somware attack in late Feb­ru­ary.

    The attack led to an out­age that impact­ed the Change Health­care pay­ment, affect­ing a range of crit­i­cal ser­vices used by health­care providers and phar­ma­cies across the U.S., includ­ing pay­ment pro­cess­ing, pre­scrip­tion writ­ing, and insur­ance claims.

    The orga­ni­za­tion report­ed that the cyber­at­tack had caused $872 mil­lion in finan­cial dam­ages.

    The BlackCat/ALPHV ran­somware gang claimed the attack, alleg­ing to have stolen 6TB of sen­si­tive patient data. In ear­ly March, Black­Cat per­formed an exit scam after alleged­ly get­ting $22 mil­lion in ran­som from Unit­ed­Health.

    At that time, one of the gang’s affil­i­ate known as “Notchy” claimed that they had Unit­ed­Health data because they con­duct­ed the attack and that Black­Cat cheat­ed them of the ran­som pay­ment.

    ...

    By mid-April, the extor­tion group Ran­somHub raised the pres­sure even more on Unit­ed­Health by start­ing to leak what they claimed to be cor­po­rate and patient data stolen dur­ing the attack.

    Unit­ed­Health’s patient data reached Ran­somHub after “Notchy” part­nered with them to extort the com­pa­ny again.

    Data stolen, ran­som paid

    In a state­ment for Bleep­ing­Com­put­er, the com­pa­ny con­firmed that it paid a ran­som to avoid patient data from being sold to cyber­crim­i­nals or leaked pub­licly.

    “A ran­som was paid as part of the company’s com­mit­ment to do all it could to pro­tect patient data from dis­clo­sure” — Unit­ed­Health Group

    Bleep­ing­Com­put­er checked Ran­somHub’s data leak web­site and can con­firm that the threat actor has removed Unit­ed­Health from its list of vic­tims.

    UnitedHealth’s removal from RansomHub’s site may indi­cate that today’s con­fir­ma­tion is for a pay­ment to the new ran­somware gang rather than the alleged $22 mil­lion pay­ment to Black­Cat in March.

    Yes­ter­day, Unit­ed­Health post­ed an update on its web­site announc­ing sup­port for peo­ple whose data had been exposed by the Feb­ru­ary ran­somware attack, offi­cial­ly con­firm­ing the data breach inci­dent.

    “Based on ini­tial tar­get­ed data sam­pling to date, the com­pa­ny has found files con­tain­ing pro­tect­ed health infor­ma­tion (PHI) or per­son­al­ly iden­ti­fi­able infor­ma­tion (PII), which could cov­er a sub­stan­tial pro­por­tion of peo­ple in Amer­i­ca,” reads the announce­ment.

    “To date, the com­pa­ny has not seen evi­dence of exfil­tra­tion of mate­ri­als such as doc­tors’ charts or full med­ical his­to­ries among the data,” the com­pa­ny says.

    The com­pa­ny reas­sures patients that only 22 screen­shots of stolen files, some con­tain­ing per­son­al­ly iden­ti­fi­able infor­ma­tion, were post­ed on the dark web, and that no oth­er data exfil­trat­ed in the attack has been pub­lished “at this time.”

    ...

    A ded­i­cat­ed call cen­ter that will be offer­ing two years of free cred­it mon­i­tor­ing and iden­ti­ty theft pro­tec­tion ser­vices has also been set up as part of the orga­ni­za­tion’s effort to sup­port those impact­ed.

    Cur­rent­ly, 99% of the impact­ed ser­vices are oper­a­tional, med­ical claims flow at near-nor­mal lev­els, and pay­ment pro­cess­ing stands at approx­i­mate­ly 86%.

    ————

    “Unit­ed­Health con­firms it paid ran­somware gang to stop data leak” By Bill Toulas; Bleep­ing­Com­put­er; 04/23/2024

    “In a state­ment for Bleep­ing­Com­put­er, the com­pa­ny con­firmed that it paid a ran­som to avoid patient data from being sold to cyber­crim­i­nals or leaked pub­licly.”

    There’s no need to spec­u­late. Unit­ed­Health is mak­ing its sec­ond ran­som pay­ment pub­lic. Will this be the end of the ran­som­ing? Time will tell. But if it’s not the end, it’s prob­a­bly the start of a much larg­er night­mare, for more than just Unit­ed­Health. Every­one whose health infor­ma­tion is part of this poten­tial­ly drawn out night­mare too.

    And note how drawn out the night­mare has been for care providers. This arti­cle was pub­lished April 23, more than two weeks into the claims process ser­vice out­age. And 14% of the ser­vices (what­ev­er that means) were still down. It’s an obtuse way of dis­close that many health providers still aren’t get­ting paid for ser­vices ren­dered:

    ...
    Cur­rent­ly, 99% of the impact­ed ser­vices are oper­a­tional, med­ical claims flow at near-nor­mal lev­els, and pay­ment pro­cess­ing stands at approx­i­mate­ly 86%.
    ...

    And also note this very trou­bling reas­sur­gane: Unit­ed­Health assures us that it is unaware at this time of “exfil­tra­tion of mate­ri­als such as doc­tors’ charts or full med­ical his­to­ries among the data”.” That might sound nice. But, for starters, there’s the obvi­ous real­i­ty that if the com­pa­ny feels to assure us that full med­ical his­to­ries weren’t stolen, it means full med­ical his­to­ries were exposed to the hack­ers and could have been stolen. And then there’s the fact that when you are deal­ing with hacks like this, and the hacked enti­ty sug­gests things could be worse, it’s best to assume they will lat­er dis­close that things are indeed worse. The pro­gres­sive sever­i­ty of many dis­clo­sure over turn is part of the pub­lic rela­tions dam­age con­trol. And when they are simul­ta­ne­ous­ly warn­ings us that a “sub­stan­tial pro­por­tion of peo­ple in Amer­i­ca” are poten­tial­ly impact­ed, we should assume dis­as­trous dis­clo­sures are yet to come. And prob­a­bly also assume that entire med­ical his­to­ries were stolen in some cas­es and we’re going to be informed of this in com­ing months:

    ...
    Yes­ter­day, Unit­ed­Health post­ed an update on its web­site announc­ing sup­port for peo­ple whose data had been exposed by the Feb­ru­ary ran­somware attack, offi­cial­ly con­firm­ing the data breach inci­dent.

    “Based on ini­tial tar­get­ed data sam­pling to date, the com­pa­ny has found files con­tain­ing pro­tect­ed health infor­ma­tion (PHI) or per­son­al­ly iden­ti­fi­able infor­ma­tion (PII), which could cov­er a sub­stan­tial pro­por­tion of peo­ple in Amer­i­ca,” reads the announce­ment.

    “To date, the com­pa­ny has not seen evi­dence of exfil­tra­tion of mate­ri­als such as doc­tors’ charts or full med­ical his­to­ries among the data,” the com­pa­ny says.

    The com­pa­ny reas­sures patients that only 22 screen­shots of stolen files, some con­tain­ing per­son­al­ly iden­ti­fi­able infor­ma­tion, were post­ed on the dark web, and that no oth­er data exfil­trat­ed in the attack has been pub­lished “at this time.”

    ...

    A ded­i­cat­ed call cen­ter that will be offer­ing two years of free cred­it mon­i­tor­ing and iden­ti­ty theft pro­tec­tion ser­vices has also been set up as part of the orga­ni­za­tion’s effort to sup­port those impact­ed.
    ...

    Let’s hope that sec­ond $22 mil­lion real­ly did result in all of that data being delet­ed. But also note one oth­er wrin­kle to this sto­ry that we’ve stum­bled across: Ran­somHub, the seem­ing­ly aggriev­ed enti­ty who nev­er got their cut of the orig­i­nal ran­som, isn’t actu­al­ly the aggriev­ed enti­ty. That would be “Notchy”, who appar­ent­ly trans­ferred the data to Ran­somHub. So in terms of assur­ances that this med­ical records aren’t leaked despite the two ran­soms that have now been paid, it’s worth keep in mind that the enti­ties known to already pos­sess at least some of the data include “Notchy”, Ran­somHub, and pre­sum­ably ALPHV/Blackcat too. Fin­gers crossed:

    ...
    At that time, one of the gang’s affil­i­ate known as “Notchy” claimed that they had Unit­ed­Health data because they con­duct­ed the attack and that Black­Cat cheat­ed them of the ran­som pay­ment.

    ...

    By mid-April, the extor­tion group Ran­somHub raised the pres­sure even more on Unit­ed­Health by start­ing to leak what they claimed to be cor­po­rate and patient data stolen dur­ing the attack.

    Unit­ed­Health’s patient data reached Ran­somHub after “Notchy” part­nered with them to extort the com­pa­ny again.
    ...

    We can no doubt be con­fi­dent “Notchy” & Friends will make good on the deal. Right? Keep in mind that, for any ran­somware oper­a­tion, the pri­ma­ry motive for delet­ing the data after receiv­ing the ran­som is to main­tain the pub­lic integri­ty of the ran­somware sec­tor’s rep­u­ta­tion to facil­i­tate future ran­som pay­ments from future vic­tims. It’s a weird kind of ‘pay it for­ward’ dynam­ic for a crim­i­nal activ­i­ty and one that real­ly only makes sense for a crim­i­nal indus­try that thrives on repeat vic­tims. Not giant scores. And also keep in mind that the enti­ties who vio­lat­ed that agree­ment and dam­aged the integri­ty of the ran­somware indus­try in this sto­ry, Blackcat/ALPHV, claimed to have retired after this job. That ini­tial $22 mil­lion ran­som was enough for them to call it quits. Who knows if they did but it’s a reminder that the ‘pay it for­ward’ hon­or among thieves here is going to be less and less applic­a­ble the big­ger the ‘score’. Who cares about the integri­ty of the ran­somware indus­try when you just received tens of mil­lions of dol­lars (or more going for­ward) in cryp­to and can live a life of lux­u­ry. Why not keep copies of that stolen trove just in case you need to get rich again. Or maybe just because you are board and like ran­som­ing peo­ple. Don’t for­get that each indi­vid­ual vic­tim is a poten­tial ran­somware vic­tim. And that espe­cial­ly includes peo­ple who might even­tu­al­ly learn they had their entire med­ical his­to­ries stolen.

    And regard­ing the pos­si­bil­i­ty of entire med­ical his­to­ries get­ting exfil­trat­ed, we also learned anoth­er set of poten­tial­ly rel­e­vant details: the hack began on Feb­ru­ary 12, nine days before the emer­gency was declared at Change Health­care and ser­vices were cut off. Keep in mind that it was Feb­ru­ary 19 when we learned that the Con­nect­Wise remote access soft­ware had a severe vul­ner­a­bil­i­ty allow­ing hack­ers to gain admin access to the sys­tems of poten­tial­ly thou­sands of orga­ni­za­tions, requir­ing an imme­di­ate patch. Although Con­nect­Wise denied any involve­ment with the Change Health­Care hack. So if we assume that Unit­ed­Health was hacked on Feb­ru­ary 12 via the Con­nect­Wise vul­ner­a­bil­i­ty, that sug­gests the larg­er impact from that vulern­abil­i­ty across Con­nect­Wise’s thou­sands of cus­tomers could be much worse. But it also gives us an idea of how long the hack­ers had access to Change Health­Care’s sys­tems. And the longer they had access, the more data they were like­ly able to steal:

    Wall Street Jour­nal

    Hack­ers Broke Into Change Healthcare’s Sys­tems Days Before Cyber­at­tack

    Unit­ed­Health Group paid ran­som to hack­ers, per­son famil­iar with the cyber inves­ti­ga­tion says

    By James Run­dle
    Updat­ed April 22, 2024 7:40 pm ET

    The hack­ers who attacked Unit­ed­Health Group’s Change Health­care unit were in the company’s net­works for more than a week before they launched a ran­somware strike that has crip­pled vital parts of the U.S. health­care sys­tem since Feb­ru­ary.

    The attack­ers, who rep­re­sent­ed them­selves as the ALPHV ran­somware gang or one of its affil­i­ates, gained entry into Change’s net­work on Feb. 12, a per­son famil­iar with the cyber inves­ti­ga­tion said. They used com­pro­mised cre­den­tials on an appli­ca­tion that allows staff to remote­ly access sys­tems, the per­son said.

    Mul­ti­fac­tor authen­ti­ca­tion pro­to­cols are typ­i­cal­ly used to guard against such breach­es, includ­ing the use of text-mes­sage codes or access tokens keyed to indi­vid­ual users. MFA wasn’t enabled on this par­tic­u­lar appli­ca­tion, the per­son said.

    ...

    Change’s par­ent, insur­er Unit­ed­Health Group, even­tu­al­ly paid a ran­som to the attack­ers, the per­son said, declin­ing to say how much, or if the com­pa­ny has paid a sec­ond ran­som since anoth­er group of hack­ers began leak­ing data in recent days. Wired mag­a­zine report­ed on March 4 that Unit­ed­Health like­ly paid around $22 mil­lion in bit­coin to the attack­ers, cit­ing dark­net forum posts and analy­sis of the pub­lic blockchain.

    Between Feb. 12 and when the ran­somware was det­o­nat­ed on Feb. 21, the hack­ers were mov­ing lat­er­al­ly with­in Change’s net­work, the per­son said. The length of time the attack­ers were in the net­work sug­gests they might have been able to steal sig­nif­i­cant amounts of data from Change’s sys­tems.

    Change process­es around 15 bil­lion trans­ac­tions a year, and touch­es one in three med­ical records. It shut down more than 100 of its sys­tems in the wake of the attack, and the effects of that out­age have left many small­er providers reliant on loans and per­son­al funds to stay afloat while they are unable to take in rev­enue. Some have con­tem­plat­ed clos­ing.

    ...

    The com­pa­ny has been steadi­ly restor­ing sys­tems since March, includ­ing its phar­ma­cy soft­ware, claims man­age­ment and oth­er plat­forms. It has also launched finan­cial assis­tance pro­grams, although some providers have com­plained of low amounts offered. Some providers have said they have been pres­sured by Unit­ed­Health staff to make pos­i­tive pub­lic com­ments about the loans.

    Law­mak­ers have raised ques­tions about the cyber risks asso­ci­at­ed with a hand­ful of health­care com­pa­nies hold­ing dom­i­nant posi­tions. The U.S. Depart­ment of Health and Human Ser­vices has also launched a probe into the poten­tial com­pro­mise of sen­si­tive patient infor­ma­tion.

    Unit­ed­Health said late Mon­day that an inves­ti­ga­tion and review of the data com­pro­mised by a recent cyber­at­tack includes pro­tect­ed health or per­son­al­ly iden­ti­fi­able infor­ma­tion.

    The health­care and insur­ance com­pa­ny said “a sub­stan­tial pro­por­tion of peo­ple in Amer­i­ca” could be affect­ed by the inci­dent, but that it hasn’t seen evi­dence of any removal of mate­ri­als such as doc­tors’ charts or full med­ical his­to­ries among the data.

    The com­pa­ny also warned it will most like­ly take months to iden­ti­fy and noti­fy the cus­tomers and indi­vid­u­als affect­ed.

    ...

    ———-

    “Hack­ers Broke Into Change Healthcare’s Sys­tems Days Before Cyber­at­tack” By James Run­dle; Wall Street Jour­nal; 04/22/2024

    “The attack­ers, who rep­re­sent­ed them­selves as the ALPHV ran­somware gang or one of its affil­i­ates, gained entry into Change’s net­work on Feb. 12, a per­son famil­iar with the cyber inves­ti­ga­tion said. They used com­pro­mised cre­den­tials on an appli­ca­tion that allows staff to remote­ly access sys­tems, the per­son said.”

    It’s not the admis­sion we want to hear, but it is what it is: the hack­ers had access to Change Health­Care’s sys­tems for a week and a half before the com­pa­ny was even aware of what was going on. And note how we are told com­pro­mised cre­den­tials “on an appli­ca­tion that allows staff to remote­ly access sys­tems” was the source of the attack. That sure sounds a lot like an admis­sion that the Con­nect­Wise vul­ner­a­bil­i­ty, pub­licly dis­closed on Feb­ru­ary 19, was the like­ly cul­prit. But Unit­ed­Health was­n’t spec­i­fy­ing which remote access app was involved.

    And as we are warned, that Feb 12 intru­sion date sug­gests the hack­ers may have been able to steal sig­nif­i­cant amounts of data. Which is extra prob­lem­at­ic when they fur­ther dis­close that Change Health­care’s ser­vices touched one in three med­ical records in the US:

    ...
    Between Feb. 12 and when the ran­somware was det­o­nat­ed on Feb. 21, the hack­ers were mov­ing lat­er­al­ly with­in Change’s net­work, the per­son said. The length of time the attack­ers were in the net­work sug­gests they might have been able to steal sig­nif­i­cant amounts of data from Change’s sys­tems.

    Change process­es around 15 bil­lion trans­ac­tions a year, and touch­es one in three med­ical records. It shut down more than 100 of its sys­tems in the wake of the attack, and the effects of that out­age have left many small­er providers reliant on loans and per­son­al funds to stay afloat while they are unable to take in rev­enue. Some have con­tem­plat­ed clos­ing.
    ...

    And then there’s the sleazy behav­ior of Unit­ed­Health in response to this cri­sis that includes preda­to­ry loans to the impact­ed health care providers. It’s the kind of behav­ior that will hope­ful­ly prompt greater law­mak­er scruti­ny over the wis­dom of allow­ing this much mar­ket con­cen­tra­tion. It’s a reminder that antitrust laws might need an update in the era of the mega-hack:

    ...
    The com­pa­ny has been steadi­ly restor­ing sys­tems since March, includ­ing its phar­ma­cy soft­ware, claims man­age­ment and oth­er plat­forms. It has also launched finan­cial assis­tance pro­grams, although some providers have com­plained of low amounts offered. Some providers have said they have been pres­sured by Unit­ed­Health staff to make pos­i­tive pub­lic com­ments about the loans.

    Law­mak­ers have raised ques­tions about the cyber risks asso­ci­at­ed with a hand­ful of health­care com­pa­nies hold­ing dom­i­nant posi­tions. The U.S. Depart­ment of Health and Human Ser­vices has also launched a probe into the poten­tial com­pro­mise of sen­si­tive patient infor­ma­tion.
    ...

    Keep in mind that we’ve learned that the Biden admin­is­tra­tion has qui­et­ly opened an antitrust probe of Unit­ed­Health a week after the hack was made pub­lic. We’ll see if any­thing emerges from that, but these antitrust rum­blings are also a reminder of the polit­i­cal per­il poten­tial­ly fac­ing Unit­ed­Health. You don’t want to expose a “sub­stan­tial” por­tion of the US pub­lic to poten­tial ran­somware threats over stolen med­ical infor­ma­tion dur­ing a pres­i­den­tial elec­tion year.

    Espe­cial­ly when that “sub­stan­tial” por­tion is maybe up to a third of Amer­i­cans, as Unit­ed­Health’s CEO Andrew Wit­ty acknowl­edged dur­ing a recent con­gres­sion­al tes­ti­mo­ny. It was an inter­est­ing tes­ti­mo­ny. Wit­ty attrib­uted the hack to com­pro­mised cre­den­tials on a remote access por­tal and a lack of mul­ti-fac­tor authen­ti­ca­tion (MFA). Keep in mind that the Con­nect­Wise vul­ner­a­bil­i­ty was indeed a vul­ner­a­bil­i­ty in its Screen­Con­nect remote access soft­ware. But it was a vul­ner­a­bil­i­ty that allowed for the bypass­ing of the cre­den­tial­ing step entire­ly, where hack­ers could go straight to a set­up page where they could cre­ate a new admin account. Was the Con­nect­Wise vul­ner­a­bil­i­ty not the issue here?

    Oh, and as a pair of con­gres­sion­al mem­bers also point out, if the stolen sen­si­tive health infor­ma­tion ends up in the hands of adver­sar­i­al gov­ern­ments and includes infor­ma­tion on peo­ple with high-lev­el nation­al secu­ri­ty clear­ances, we’re poten­tial­ly look­ing at a source of high-lev­el black­mail. Is this the case? Who knows, but with a third of Amer­i­cans impact­ed, and entire med­ical his­to­ries poten­tial­ly stolen, it’s hard to rule that out:

    Gov­Tech

    CEO: Change Health­care Hack May Touch a Third of Amer­i­cans

    At a con­gres­sion­al hear­ing, Unit­ed­Health Group CEO Andrew Wit­ty said the cyber theft includes per­son­al­ly iden­ti­fi­able infor­ma­tion on “maybe a third” of all Amer­i­cans.

    May 02, 2024 •
    Jule Pat­ti­son-Gor­don

    Unit­ed­Health Group still is work­ing to deter­mine the full scope of data that ran­somware actors stole recent­ly from its Change Health­care sub­sidiary. But in a recent U.S. House of Rep­re­sen­ta­tives sub­com­mit­tee hear­ing, CEO Andrew Wit­ty said the theft includes pro­tect­ed health infor­ma­tion and per­son­al­ly iden­ti­fi­able infor­ma­tion on “maybe a third” of all Amer­i­cans.

    One chal­lenge to get­ting the full pic­ture is that hack­ers also encrypt­ed Change’s cus­tomer data­base, mak­ing it hard to know who to noti­fy about the inci­dent, Wit­ty said. Unit­ed­Health Group will like­ly need sev­er­al months of analy­sis before it can iden­ti­fy and con­tact every­one affect­ed. And, of course, when deal­ing with crim­i­nals there’s no guar­an­tees: Wit­ty acknowl­edged that despite his com­pa­ny pay­ing a $22 mil­lion ran­som, he can­not con­firm whether hack­ers actu­al­ly delet­ed all their stolen data. Since that extor­tion pay­ment, an addi­tion­al hack­ing group has come for­ward claim­ing to have the stolen data.

    Rep. Gary Palmer said nation­al secu­ri­ty could be at risk if the theft includes sen­si­tive data on fed­er­al employ­ees with high-lev­el secu­ri­ty clear­ances. For­eign adver­saries might use the infor­ma­tion for black­mail, Rep. Mor­gan Grif­fith agreed.

    In Feb­ru­ary, Black­Cat ran­somware hack­ers pen­e­trat­ed Change’s sys­tems by tak­ing advan­tage of a sim­ple mis­take: Change hadn’t applied mul­ti­fac­tor authen­ti­ca­tion to a remote desk­top access por­tal, mean­ing hack­ers only need­ed com­pro­mised cre­den­tials to access it. From there, the hack­ers spread through Change sys­tems, exfil­trat­ing data over the course of nine days, before ulti­mate­ly encrypt­ing and demand­ing pay­ment, Wit­ty tes­ti­fied.

    ...

    But Unit­ed­Health Group’s com­pa­ny pol­i­cy is already to have mul­ti­fac­tor authen­ti­ca­tion on all exter­nal­ly fac­ing sys­tems, Wit­ty said, and the com­pa­ny is inves­ti­gat­ing why it was miss­ing on the tar­get­ed serv­er.

    Wit­ty sug­gest­ed the prob­lems may stem from his­toric prac­tices at Change. In 2022, Unit­ed­Health Group acquired Change, bring­ing on board an old­er com­pa­ny with old­er tech­nol­o­gy, he said. Unit­ed­Health Group had been work­ing to upgrade Change’s sys­tems and cyber­se­cu­ri­ty but hadn’t fin­ished the job.

    Lack of mul­ti­fac­tor authen­ti­ca­tion led to the ini­tial intru­sion, but stronger back­up prac­tices might have helped Change bounce back. Unfor­tu­nate­ly, most of Change’s back­ups were stored in on-prem data cen­ters that hack­ers also encrypt­ed dur­ing the attack, pre­vent­ing easy restora­tion, Wit­ty said. Stor­ing back­ups in the cloud would’ve been safer, he said.

    Now Unit­ed­Health is rebuild­ing Change’s infra­struc­ture from scratch, intro­duc­ing mod­ern and often cloud-based tech with bet­ter secu­ri­ty, Wit­ty said.

    ...

    As for Change’s own restora­tion, near­ly all phar­ma­cies can again process claims, and pay­ment pro­cess­ing is run­ning at about 86 per­cent of pre-inci­dent lev­els, Wit­ty wrote. Addi­tion­al­ly, med­ical claims are flow­ing at “near nor­mal lev­els” due either to sys­tems being restored or providers switch­ing to dif­fer­ent meth­ods.

    Still, he acknowl­edged that some enti­ties that rely on unre­stored sys­tems remain unable to switch to oth­er Change sys­tems or to one of its com­peti­tors. In such cas­es, the com­pa­ny is pro­vid­ing them with loans to ease the finan­cial strain. UnitedHealth’s loan pro­gram orig­i­nal­ly came under fire for “sus­pect” terms and con­di­tions that some providers feared could be wield­ed “in a preda­to­ry way,” said Rep. Kim Schri­er. But the com­pa­ny has since revised its approach, Wit­ty said, now offer­ing loans with­out fees or inter­est, and let­ting providers repay 45 busi­ness days after self-report­ing that their cash flow is back to nor­mal.

    Wit­ty also dis­put­ed reports that Unit­ed­Health had snatched up com­pa­nies that fell into dire finan­cial straits due to rev­enue dry­ing up dur­ing Change’s out­age. UnitedHealth’s recent pur­chase of a med­ical prac­tice had been agreed to before the attack, and its recent acqui­si­tion of two inde­pen­dent physi­cian asso­ci­a­tions were based on pre-inci­dent eco­nom­ic assess­ments, Wit­ty told law­mak­ers.

    ———–

    “CEO: Change Health­care Hack May Touch a Third of Amer­i­cans” Jule Pat­ti­son-Gor­don; Gov­Tech; 05/02/2024

    “Unit­ed­Health Group still is work­ing to deter­mine the full scope of data that ran­somware actors stole recent­ly from its Change Health­care sub­sidiary. But in a recent U.S. House of Rep­re­sen­ta­tives sub­com­mit­tee hear­ing, CEO Andrew Wit­ty said the theft includes pro­tect­ed health infor­ma­tion and per­son­al­ly iden­ti­fi­able infor­ma­tion on “maybe a third” of all Amer­i­cans.”

    “Maybe a third” of all Amer­i­cans had at least some of their sen­si­tive health data stolen. That’s more or less what we should have expect­ed giv­en that Change Health­Care touched around 1 in 3 med­ical records. But we don’t have clar­i­ty on that yet because even Unit­ed­Health appar­ent­ly lacks clar­i­ty thanks to the fact that the hack­ers encrypt­ed Change’s cus­tomer data­base. Keep in mind that the $22 mil­lion ran­som has been paid twice now. Appar­ent­ly those pay­ments did­n’t include a decryp­tion pass­word:

    ...
    One chal­lenge to get­ting the full pic­ture is that hack­ers also encrypt­ed Change’s cus­tomer data­base, mak­ing it hard to know who to noti­fy about the inci­dent, Wit­ty said. Unit­ed­Health Group will like­ly need sev­er­al months of analy­sis before it can iden­ti­fy and con­tact every­one affect­ed. And, of course, when deal­ing with crim­i­nals there’s no guar­an­tees: Wit­ty acknowl­edged that despite his com­pa­ny pay­ing a $22 mil­lion ran­som, he can­not con­firm whether hack­ers actu­al­ly delet­ed all their stolen data. Since that extor­tion pay­ment, an addi­tion­al hack­ing group has come for­ward claim­ing to have the stolen data.
    ...

    But the encryp­tion of Change’s data­bas­es isn’t the only rea­son the com­pa­ny is going to need months to even fig­ure out who was impact­ed. Because these kinds of data­bas­es typ­i­cal­ly have back­ups. Except those back­ups also got encrypt­ed since they were stored in ‘on-prem’ data cen­ters that were appar­ent­ly also acces­si­ble to the hack­ers. It’s not how you’re sup­posed to do back­ups. But now, in response, we’re going to see all of that data moved to a cloud some­where, which all of the access to that trove of data made avail­able to some lucky cloud provider. Will it be Microsoft­’s cloud? Google’s? Ama­zon’s? We’ll see. But unless Unit­ed­Health takes steps to hide that data from from the cloud providers them­selves, we can assume that all of that sen­si­tive med­ical infor­ma­tion will be acces­si­ble to who­ev­er Unit­ed­Health selects to pro­vide these cloud ser­vices:

    ...
    Lack of mul­ti­fac­tor authen­ti­ca­tion led to the ini­tial intru­sion, but stronger back­up prac­tices might have helped Change bounce back. Unfor­tu­nate­ly, most of Change’s back­ups were stored in on-prem data cen­ters that hack­ers also encrypt­ed dur­ing the attack, pre­vent­ing easy restora­tion, Wit­ty said. Stor­ing back­ups in the cloud would’ve been safer, he said.

    Now Unit­ed­Health is rebuild­ing Change’s infra­struc­ture from scratch, intro­duc­ing mod­ern and often cloud-based tech with bet­ter secu­ri­ty, Wit­ty said.
    ...

    And note how the poten­tial dam­age of a hack on this scale goes far beyond just the pri­va­cy vio­la­tions of a large por­tion of the US pop­u­la­tion. There’s also the fact that this is the kind of infor­ma­tion that could be used for black­mail. Espe­cial­ly black­mail­ing peo­ple with high-lev­el secu­ri­ty clear­ances. The poten­tial cost of this hack can’t real­ly be cal­cu­lat­ed when you fac­tor in sce­nar­ios like that:

    ...
    Rep. Gary Palmer said nation­al secu­ri­ty could be at risk if the theft includes sen­si­tive data on fed­er­al employ­ees with high-lev­el secu­ri­ty clear­ances. For­eign adver­saries might use the infor­ma­tion for black­mail, Rep. Mor­gan Grif­fith agreed.
    ...

    And then we get to Unit­ed­Health’s rebut­tals dur­ing the con­gres­sion­al tes­ti­mo­ny of the accu­sa­tions of preda­to­ry loans to its vic­tims. A rebut­tal that amount­ed to ‘don’t wor­ry, we fixed all the prob­lems’. And this, of course, includes the vic­tims that still can’t process their claims. Note how Wit­ty still cit­ed the “86 per­cent” fig­ure when describ­ing how much of the halt­ed ser­vices are back online. That’s the same fig­ure we got by Unit­ed­Health in the reports from a week and a half ear­li­er. That’s not great progress for an emer­gency sit­u­a­tion:

    ...
    As for Change’s own restora­tion, near­ly all phar­ma­cies can again process claims, and pay­ment pro­cess­ing is run­ning at about 86 per­cent of pre-inci­dent lev­els, Wit­ty wrote. Addi­tion­al­ly, med­ical claims are flow­ing at “near nor­mal lev­els” due either to sys­tems being restored or providers switch­ing to dif­fer­ent meth­ods.

    Still, he acknowl­edged that some enti­ties that rely on unre­stored sys­tems remain unable to switch to oth­er Change sys­tems or to one of its com­peti­tors. In such cas­es, the com­pa­ny is pro­vid­ing them with loans to ease the finan­cial strain. UnitedHealth’s loan pro­gram orig­i­nal­ly came under fire for “sus­pect” terms and con­di­tions that some providers feared could be wield­ed “in a preda­to­ry way,” said Rep. Kim Schri­er. But the com­pa­ny has since revised its approach, Wit­ty said, now offer­ing loans with­out fees or inter­est, and let­ting providers repay 45 busi­ness days after self-report­ing that their cash flow is back to nor­mal.
    ...

    And then we get to the rebut­tal over the accu­sa­tions that Unit­ed­Health was oppor­tunis­ti­cal­ly acquir­ing firms that were dis­tressed as a result of these lost claims pro­cess­ing ser­vices. The rebut­tal appears to include the assur­ance that the com­pa­nies Unit­ed­Health has recent­ly acquired since the start of this emer­gency were com­pa­nies Unit­ed­Health already had its eye on before the emer­gency. Which isn’t exact­ly a great excuse unless we sub­se­quent­ly learn that the val­ue of com­pa­nies Unit­ed­Health had to pay was in no way neg­a­tive­ly impact­ed by the emer­gency. This is also a good time to recall how the lack of claims pro­cess­ing end­ed up actu­al­ly pre­vent­ing Unit­ed­Health from hav­ing to pay out on all sorts of claims, allow­ing the com­pa­ny to stock­pile cash. Cash stock­piles that could come in handy should any oppor­tu­ni­ties arise dur­ing a peri­od of wide­spread dis­tress for the sec­tor:

    ...
    Wit­ty also dis­put­ed reports that Unit­ed­Health had snatched up com­pa­nies that fell into dire finan­cial straits due to rev­enue dry­ing up dur­ing Change’s out­age. UnitedHealth’s recent pur­chase of a med­ical prac­tice had been agreed to before the attack, and its recent acqui­si­tion of two inde­pen­dent physi­cian asso­ci­a­tions were based on pre-inci­dent eco­nom­ic assess­ments, Wit­ty told law­mak­ers.
    ...

    But then we get this curi­ous attempt at deflec­tion over who’s to blame for the whole hack on a lack of MFA safe­guards. And while it’s true that an MFA set­up could have poten­tial­ly pre­vent­ed a hack that was exclu­sive­ly due to ‘com­pro­mised cre­den­tials’, it’s worth keep­ing in mind that we did­n’t hear any­thing about MFA pro­tect­ing against the Con­nect­Wise vul­ner­a­bil­i­ty. Instead, that vul­ner­a­bil­i­ty appeared to allow hack­ers to bypass the cre­den­tial sys­tem entire­ly and go direct­ly to a set­up Wiz­ard that allowed for the cre­ation of admin-lev­el accounts. It’s not clear MFA would actu­al­ly help in this case and the lack of calls for the imple­men­ta­tion of MFA in the wake of the dis­clo­sure of this vul­ner­a­bil­i­ty sug­gests MFA was­n’t actu­al­ly a fix. Was Change Health­care hacked via a dif­fer­ent route? Is it just a coin­ci­dence that this hack — which the com­pa­ny admits was due to a prob­lem with remote access soft­ware — coin­cid­ed with the emer­gence of a mas­sive vul­ner­a­bil­i­ty with remote access soft­ware? Don’t for­get that Con­nect­Wise denied it had any role in the Change Health­care hack. Is that true?

    ...
    In Feb­ru­ary, Black­Cat ran­somware hack­ers pen­e­trat­ed Change’s sys­tems by tak­ing advan­tage of a sim­ple mis­take: Change hadn’t applied mul­ti­fac­tor authen­ti­ca­tion to a remote desk­top access por­tal, mean­ing hack­ers only need­ed com­pro­mised cre­den­tials to access it. From there, the hack­ers spread through Change sys­tems, exfil­trat­ing data over the course of nine days, before ulti­mate­ly encrypt­ing and demand­ing pay­ment, Wit­ty tes­ti­fied.

    ...

    But Unit­ed­Health Group’s com­pa­ny pol­i­cy is already to have mul­ti­fac­tor authen­ti­ca­tion on all exter­nal­ly fac­ing sys­tems, Wit­ty said, and the com­pa­ny is inves­ti­gat­ing why it was miss­ing on the tar­get­ed serv­er.

    Wit­ty sug­gest­ed the prob­lems may stem from his­toric prac­tices at Change. In 2022, Unit­ed­Health Group acquired Change, bring­ing on board an old­er com­pa­ny with old­er tech­nol­o­gy, he said. Unit­ed­Health Group had been work­ing to upgrade Change’s sys­tems and cyber­se­cu­ri­ty but hadn’t fin­ished the job.
    ...

    And that brings us to the fol­low­ing arti­cle with more details we’ve recent­ly learned from Unit­ed­Health about how the hack hap­pened: we are told the hack start­ed on Feb­ru­ary 12 due to “com­pro­mised cre­den­tials” on a remote access por­tal. But it was­n’t Con­nect­Wise’s remote access soft­ware. It was Cit­rix, anoth­er remote access soft­ware devel­op­er. And it turns out Cit­rix had some night­mare secu­ri­ty vul­ner­a­bil­i­ties of its own in recent months. Back in Octo­ber, the com­pa­ny had to issue a patch for a “Cit­rix Bleed” vul­ner­a­bil­i­ty that had been exploit­ed by hack­ers since at least August. And anoth­er set of vul­ner­a­bil­i­ties dis­closed in Jan­u­ary. And yet, we are also being told that the hack of Change Health­care did not hap­pen as a result of these known vul­ner­a­bil­i­ties. Instead, we are told that it was sim­ply “com­pro­mised cre­den­tial” for a Cit­rix por­tal on a machine with­out MFA:

    Tech Tar­get

    Change Health­care breached via Cit­rix por­tal with no MFA

    Unit­ed­Health Group CEO Andrew Wit­ty’s open­ing state­ment for Wednes­day’s con­gres­sion­al hear­ing shed more light on the ran­somware attack against Change Health­care.

    By Arielle Wald­man, News Writer
    Pub­lished: 30 Apr 2024

    Unit­ed­Health Group con­firmed that the BlackCat/Alphv ran­somware group breached Change Health­care in Feb­ru­ary by using com­pro­mised cre­den­tials for a Cit­rix remote access por­tal that did not have mul­ti­fac­tor authen­ti­ca­tion enabled.

    On Mon­day, a pre­pared state­ment from Unit­ed­Health Group CEO Andrew Wit­ty, titled “Exam­in­ing the Change Health­care Cyber­at­tack,” was released ahead of Wednes­day’s House Ener­gy and Com­merce Com­mit­tee Sub­com­mit­tee on Over­sight and Inves­ti­ga­tions hear­ing. Wit­ty recon­firmed that Alphv/BlackCat was behind the attack against its tech sub­sidiary Change Health­care, which pro­vides a vari­ety of ser­vices includ­ing finan­cial and admin­is­tra­tive man­age­ment to med­ical facil­i­ties and phar­ma­cies.

    ...

    Wit­ty’s open­ing state­ment for the hear­ing shed more light on the attack time­line and vec­tor, though many ques­tions remain.

    “On Feb­ru­ary 12, crim­i­nals used com­pro­mised cre­den­tials to remote­ly access a Change Health­care Cit­rix por­tal, an appli­ca­tion used to enable remote access to desk­tops. The por­tal did not have mul­ti-fac­tor authen­ti­ca­tion. Once the threat actor gained access, they moved lat­er­al­ly with­in the sys­tems in more sophis­ti­cat­ed ways and exfil­trat­ed data. Ran­somware was deployed nine days lat­er,” Wit­ty said in the pre­pared state­ment.

    Vul­ner­a­ble Cit­rix prod­ucts have been pop­u­lar tar­gets for attack­ers for some time. In Novem­ber, CISA and the FBI warned orga­ni­za­tions that the Lock­Bit ran­somware group was wide­ly exploit­ing a crit­i­cal Cit­rix NetScaler ADC and NetScaler Gate­way vul­ner­a­bil­i­ty, tracked as CVE-2023–4966 and dubbed “Cit­rix Bleed,” that was dis­closed and patched in Octo­ber.

    The advi­so­ry con­nect­ed an Octo­ber attack against avi­a­tion giant Boe­ing to Cit­rix Bleed. Boe­ing con­firmed that threat actors had exploit­ed CVE-2023–4966 to gain ini­tial access to its parts and dis­tri­b­u­tion busi­ness.

    Then, in Jan­u­ary, Cit­rix dis­closed that two new zero-day vul­ner­a­bil­i­ties in the same prod­ucts were under attack, though attri­bu­tion was not pro­vid­ed. In addi­tion, insur­ance provider Coali­tion pub­lished its “Cyber Threat Index 2024” in Feb­ru­ary that high­light­ed the sub­stan­tial fall­out Cit­rix Bleed vic­tims faced.

    How­ev­er, the attack on Change Health­care appar­ent­ly did not involve the exploita­tion of Cit­rix flaws, as the attack­ers sim­ply used com­pro­mised cre­den­tials to gain an ini­tial foothold in the com­pa­ny’s net­work.

    MFA is a stan­dard secu­ri­ty mea­sure that the indus­try and gov­ern­ment agen­cies have been push­ing for years to mit­i­gate the threat of com­pro­mised cre­den­tials. Sev­er­al recent, high-pro­file attacks have seen threat actors tar­get­ing and com­pro­mis­ing ser­vices and assets that lack MFA pro­tec­tion. For exam­ple, an inves­ti­ga­tion into the Mid­night Bliz­zard attack against Microsoft in July revealed that the com­pro­mised cloud ten­ant did not have MFA enabled.

    ...

    ———-

    “Change Health­care breached via Cit­rix por­tal with no MFA” By Arielle Wald­man; Tech Tar­get; 04/30/2024

    “How­ev­er, the attack on Change Health­care appar­ent­ly did not involve the exploita­tion of Cit­rix flaws, as the attack­ers sim­ply used com­pro­mised cre­den­tials to gain an ini­tial foothold in the com­pa­ny’s net­work.”

    It was­n’t Con­nect­Wise. No, it was Cit­rix’s remote access soft­ware that was exploit­ed. But the hack­ers appar­ent­ly did­n’t exploit the “Cit­rix Bleed” vul­ner­a­bil­i­ty that secu­ri­ty researchers flagged back in Novem­ber. Or the new Cit­rix vul­ner­a­bil­i­ties dis­closed in Jan­u­ary. No, we are told the attack­ers sim­ply used “com­pro­mised cre­den­tials” on a machine with no MFA set up. That’s the sto­ry they are going with:

    ...
    “On Feb­ru­ary 12, crim­i­nals used com­pro­mised cre­den­tials to remote­ly access a Change Health­care Cit­rix por­tal, an appli­ca­tion used to enable remote access to desk­tops. The por­tal did not have mul­ti-fac­tor authen­ti­ca­tion. Once the threat actor gained access, they moved lat­er­al­ly with­in the sys­tems in more sophis­ti­cat­ed ways and exfil­trat­ed data. Ran­somware was deployed nine days lat­er,” Wit­ty said in the pre­pared state­ment.

    Vul­ner­a­ble Cit­rix prod­ucts have been pop­u­lar tar­gets for attack­ers for some time. In Novem­ber, CISA and the FBI warned orga­ni­za­tions that the Lock­Bit ran­somware group was wide­ly exploit­ing a crit­i­cal Cit­rix NetScaler ADC and NetScaler Gate­way vul­ner­a­bil­i­ty, tracked as CVE-2023–4966 and dubbed “Cit­rix Bleed,” that was dis­closed and patched in Octo­ber.

    The advi­so­ry con­nect­ed an Octo­ber attack against avi­a­tion giant Boe­ing to Cit­rix Bleed. Boe­ing con­firmed that threat actors had exploit­ed CVE-2023–4966 to gain ini­tial access to its parts and dis­tri­b­u­tion busi­ness.

    Then, in Jan­u­ary, Cit­rix dis­closed that two new zero-day vul­ner­a­bil­i­ties in the same prod­ucts were under attack, though attri­bu­tion was not pro­vid­ed. In addi­tion, insur­ance provider Coali­tion pub­lished its “Cyber Threat Index 2024” in Feb­ru­ary that high­light­ed the sub­stan­tial fall­out Cit­rix Bleed vic­tims faced.
    ...

    So was it real­ly just a coin­ci­dence that this hack was appar­ent­ly dis­cov­ered just days after the announce­ment of a major vul­ner­a­bil­i­ty with the Con­nect­Wise remote access soft­ware but was due to com­plete­ly dif­fer­ent remote access soft­ware? And it was­n’t due to the pre­vi­ous­ly dis­closed vul­ner­a­bil­i­ties in this oth­er soft­ware but instead was sim­ply a case of “com­pro­mised cre­den­tials”? That’s what we are going told.

    Keep in mind that, if true, this is arguably a much worse look for Unit­ed­Health. After all, if the hack was due to Con­nect­Wise, that vul­ner­a­bil­i­ty was­n’t dis­closed until Feb­ru­ary 19, a week after the ini­tial Feb­ru­ary 12 hack. At least Change Health­care could point to the unknown nature of that vul­ner­a­bil­i­ty if that was the cul­prit.

    Cit­rix, on the oth­er hand, had a major vul­ner­a­bil­i­ty of its own revealed back in Octo­ber and then two more warn­ings in Jan­u­ary. So while we are told by Unit­ed­Health that “com­pro­mised cre­den­tials” was the cul­prit, keep in mind that this “com­pro­mised cre­den­tials with no MFA” expla­na­tion might be prefer­able, from a lia­bil­i­ty stand­point, to admit­ting that their sys­tems were impact­ed by Cit­rix vul­ner­a­bil­i­ties dis­closed months ago.

    And as the fol­low­ing Axios piece from back in Jan­u­ary about the then-ongo­ing Cit­rix secu­ri­ty night­mare reveals, one of the ter­ri­fy­ing fea­tures of the “Cit­rix Bleed” vul­ner­a­bil­i­ty that was dis­cov­ered back in Octo­ber — but used by hack­ers since at least August — was its abil­i­ty to bypass MFA authen­ti­ca­tion. And as the arti­cle also warned, the orga­ni­za­tions hit by Cit­rix Bleed weren’t going to have an easy time fix­ing the sit­u­a­tion and that we should expect dis­clo­sures about Cit­rix Bleed hacks in the com­ing months. And about a month and a half after this arti­cle, Change Health­care is seem­ing­ly hacked via Cit­rix but, we are told, it did­n’t hap­pen due to the Cit­rix Bleed hack. It was just “com­pro­mised cre­den­tials”. So we have to ask: is Change Health­care a vic­tim of Cit­rix Bleed but extreme­ly hes­i­tant about shar­ing that with the world? Or did the com­pa­ny real­ly just coin­ci­den­tal­ly get hacked via Cit­rix through com­pro­mised cre­den­tials:

    Axios

    The secu­ri­ty flaw haunt­ing cyber defend­ers in 2024

    Sam Sabin, author of Axios Code­book
    Jan 2, 2024 -
    Tech­nol­o­gy

    Com­pa­nies are start­ing 2024 grap­pling with the fall­out from a secu­ri­ty vul­ner­a­bil­i­ty they’ve known about for months.

    Dri­ving the news: Xfin­i­ty said last month that hack­ers had exploit­ed a high-sever­i­ty vul­ner­a­bil­i­ty in net­work hard­ware devel­oped by Cit­rix, result­ing in the theft of 36 mil­lion cus­tomers’ sen­si­tive infor­ma­tion.

    * The dis­cov­ery came rough­ly two months after Xfin­i­ty had patched the flaw in its sys­tem.

    Why it mat­ters: Researchers believe hack­ers have been exploit­ing the vul­ner­a­bil­i­ty, known as Cit­rix Bleed, since at least August, and Cit­rix did­n’t find the flaw and issue a patch until Octo­ber.

    ...

    Catch up quick: Ran­somware gangs have report­ed­ly used Cit­rix Bleed to tar­get some of the biggest cor­po­ra­tions in recent months, includ­ing Boe­ing, the Indus­tri­al and Com­mer­cial Bank of Chi­na, and more than 60 cred­it unions.

    * The Cit­rix Bleed vul­ner­a­bil­i­ty affects Cit­rix’s NetScaler Gate­way appli­ances and NetScaler web appli­ca­tion deliv­ery con­trols — pop­u­lar enter­prise tools that allow employ­ees to remote­ly access a vari­ety of work­place appli­ca­tions.
    * The flaw can give hack­ers rare access to employ­ees’ pass­words and ses­sion tokens that allow them to bypass mul­ti­fac­tor authen­ti­ca­tion tools.
    * U.S. cyber offi­cials have warned that both nation-state and crim­i­nal groups are now tar­get­ing Cit­rix Bleed.

    Yes, but: The num­ber of vul­ner­a­ble sys­tems has sig­nif­i­cant­ly decreased in the last two months, sug­gest­ing com­pa­nies are actu­al­ly tak­ing the steps need­ed to resolve the flaw.

    * As of Dec. 31, rough­ly 1,300 vul­ner­a­ble instances of the Cit­rix prod­uct were still online — com­pared to around 4,600 on Oct. 31, per data from secu­ri­ty orga­ni­za­tion Shad­owserv­er.

    What they’re say­ing: “We’re going to con­tin­ue to see data exfil­tra­tion news where data was stolen,” Chris Hen­der­son, senior direc­tor of threat oper­a­tions at secu­ri­ty plat­form Huntress, told Axios.

    * “For peo­ple who are now patched, the risk of ran­somware has­n’t passed, but we would’ve heard of most of them already,” he added.

    The big pic­ture: It often takes months for com­pa­nies to fig­ure out the true scope of a cyber intru­sion.

    * Expect to see more orga­ni­za­tions issu­ing notices in the com­ing months detail­ing just how much access Cit­rix Bleed had giv­en intrud­ers to their net­works.

    Between the lines: Patch­ing Cit­rix Bleed is also a bit tricky since it requires com­pa­nies to imple­ment a sep­a­rate set of mit­i­ga­tions to kick out any lin­ger­ing intrud­ers, Hen­der­son said.

    * Some orga­ni­za­tions were also slow to patch the vul­ner­a­bil­i­ty in their sys­tems after Cit­rix announced it, he added, leav­ing those com­pa­nies open to attacks from hack­ing groups that quick­ly fig­ured out how to tar­get them.

    ...

    Be smart: Cit­rix Bleed is a reminder that com­pa­ny secu­ri­ty teams need to weigh the pri­va­cy costs of a data breach over com­pli­ance and dis­rup­tions to busi­ness oper­a­tions.

    * When a crit­i­cal secu­ri­ty flaw is dis­cov­ered, some com­pa­nies might be tempt­ed to wait a few days to patch it so they don’t dis­rupt any crit­i­cal busi­ness oper­a­tions, Hen­der­son said.
    * “It’s prob­a­bly cheap­er for them to go pay for that iden­ti­ty pro­tec­tion on every­body than to take out­ages,” Hen­der­son said. “Real­ly con­sid­er­ing the knock-on effects of the indi­vid­u­als impact­ed beyond just the hit to rev­enue and prof­itabil­i­ty — it needs to start being a tighter con­sid­er­a­tion for these [events.]”

    ———-

    “The secu­ri­ty flaw haunt­ing cyber defend­ers in 2024” by Sam Sabin; Axios; 01/02/2024

    “Why it mat­ters: Researchers believe hack­ers have been exploit­ing the vul­ner­a­bil­i­ty, known as Cit­rix Bleed, since at least August, and Cit­rix did­n’t find the flaw and issue a patch until Octo­ber.”

    The Cit­rix Bleed night­mare start­ed in August and was­n’t patched until Octo­ber. The more we’re learn­ing about these Cit­rix vul­ner­a­bil­i­ties the worse it sounds. Espe­cial­ly the fact that this Cit­rix Bleed vul­ner­a­bil­i­ty appar­ent­ly allowed for the bypass­ing of MFA safe­guards

    ...
    * The Cit­rix Bleed vul­ner­a­bil­i­ty affects Cit­rix’s NetScaler Gate­way appli­ances and NetScaler web appli­ca­tion deliv­ery con­trols — pop­u­lar enter­prise tools that allow employ­ees to remote­ly access a vari­ety of work­place appli­ca­tions.
    * The flaw can give hack­ers rare access to employ­ees’ pass­words and ses­sion tokens that allow them to bypass mul­ti­fac­tor authen­ti­ca­tion tools.
    * U.S. cyber offi­cials have warned that both nation-state and crim­i­nal groups are now tar­get­ing Cit­rix Bleed.
    ...

    Also note who else got hit by Cit­rix Bleed: Boe­ing. Giv­en the mul­ti­ple mys­te­ri­ous Boe­ing whistle­blow­er deaths over the past cou­ple of months, you have to won­der what the hack­ers may have uncov­ered on those inter­nal net­works:

    ...
    Catch up quick: Ran­somware gangs have report­ed­ly used Cit­rix Bleed to tar­get some of the biggest cor­po­ra­tions in recent months, includ­ing Boe­ing, the Indus­tri­al and Com­mer­cial Bank of Chi­na, and more than 60 cred­it unions.
    ...

    Final­ly, note this warn­ing from back in Jan­u­ary that seems awful­ly pre­scient now: giv­en the large num­bers of orga­ni­za­tions that had yet to patch the vul­ner­a­bil­i­ty, we should expect to see more orga­ni­za­tions give details about a Cit­rix Bleed inva­sion in com­ing months:

    ...
    Yes, but: The num­ber of vul­ner­a­ble sys­tems has sig­nif­i­cant­ly decreased in the last two months, sug­gest­ing com­pa­nies are actu­al­ly tak­ing the steps need­ed to resolve the flaw.

    * As of Dec. 31, rough­ly 1,300 vul­ner­a­ble instances of the Cit­rix prod­uct were still online — com­pared to around 4,600 on Oct. 31, per data from secu­ri­ty orga­ni­za­tion Shad­owserv­er.

    ...

    The big pic­ture: It often takes months for com­pa­nies to fig­ure out the true scope of a cyber intru­sion.

    * Expect to see more orga­ni­za­tions issu­ing notices in the com­ing months detail­ing just how much access Cit­rix Bleed had giv­en intrud­ers to their net­works.
    ...

    This is a good time to keep in mind that the Feb­ru­ary 12 date for the ini­tial hack is pure­ly com­ing from Unit­ed­Health. It’s not like we have oth­er par­ties that are cor­rob­o­rat­ing that date. It’s hard to rule out at this point the pos­si­bil­i­ty that Change Health­care was hacked much ear­li­er than Feb 12 as part of the Cit­rix-relat­ed secu­ri­ty night­mare that was unfold­ing since at least August of 2023.

    But who knows, maybe the hack real­ly was­n’t a con­se­quence of the mul­ti­ple super-vul­ner­a­bil­i­ties in remote access soft­ware that have been active­ly exploit­ed by hack­ers in recent months. It’s pos­si­ble Change Health­care got itself hacked through much more ‘tra­di­tion­al’ means. Which, again, isn’t nec­es­sar­i­ly bet­ter news, except maybe ‘bet­ter’ for Unit­ed­Health from a class action law­suit per­spec­tive.

    At this point, we’re large­ly forced to just trust Unit­ed­Health to han­dle this night­mare appro­pri­ate­ly. And con­tin­ue trust­ing it with the han­dling of one in three US med­ical records that it will con­tin­ue to process for the fore­see­able future. It’s one of the priv­i­leges of being a mar­ket giant after decades of limp antitrust enforce­ment and ever-increas­ing mar­ket con­sol­i­da­tion. We’re left with the options of trust­ing Unit­ed­Health, or not trust­ing it but watch­ing help­less­ly any­way as it process­es our sen­si­tive infor­ma­tion any­way because it owns the mar­ket. Either/or. Every­thing is basi­cal­ly fine for the giants. Even dis­as­ters.

    Posted by Pterrafractyl | May 7, 2024, 3:15 am

  31. It just keeps hap­pen­ing. We have anoth­er major hack and remote access soft­ware is once again the sus­pect­ed weak link in the chain that lead to the hack. Recall how, back in Feb­ru­ary 2024, when the Change­Health­care mega-hack was first dis­closed, we also learned how the Con­nect­Wise Screen­Con­nect remote access soft­ware had a mas­sive vul­ner­a­bil­i­ty that allowed any hack to eas­i­ly cre­ate admin accounts and that hack­ers were run­ning wild. So it was assumed ini­tial­ly that the Con­nect­Wise vul­ner­a­bil­i­ty caused the hack but Con­nect­Wise denied any involve­ment at the time. Lat­er, Unit­ed­Health — Change­Health­care’s par­ent com­pa­ny — insist­ed that it was a dif­fer­ent remote access soft­ware por­tal that was bro­ken into: the Cit­rix remote access soft­ware. But, odd­ly, Unit­ed­Health also insist­ed that the hack­ers had­n’t exploit­ed a known Cit­rix vul­ner­a­bil­i­ty known as “Cit­rixBleed”. Instead, Unit­ed­Health assert­ed that the hack­ers had some­how gained login cre­den­tials for a Cit­rix account and tried to ulti­mate­ly pin the blame on a lack of Mul­ti-fac­tor-authen­ti­ca­tion. And now here we are with the US Trea­sury Depart­ment announc­ing a new hack blamed on anoth­er remote access soft­ware provider, BeyondTrust, with a sim­i­lar expla­na­tion to what Unit­ed­Health gave: a hack­er some­how gained a BeyondTrust secu­ri­ty key and used that to log into cer­tain Trea­sury work­sta­tions.

    At least that’s the sto­ry we’re get­ting from the US gov­ern­ment at this point regard­ing the Trea­sury hack. Along with some strong asser­tions that it was Chi­nese state hack­ers behind it. Strong asser­tions that don’t actu­al­ly sound very strong when you look at the lan­guage of the state­ment released about how the attri­bu­tion to a Chi­nese hack­ing group was “based on avail­able indi­ca­tors” and the com­plete lack of any evi­dence that us far pro­vid­ed by the US. Which is anoth­er way of say­ing some­one is look­ing at the evi­dence and mak­ing an edu­cat­ed guess. Evi­dence that, by its dig­i­tal nature, is high­ly spoofa­ble and can eas­i­ly be used to leave ‘indi­ca­tors’ point­ing towards who­ev­er one might want to impli­cate. And that’s assum­ing we ever even get to see the evi­dence. Usu­al­ly we’re just assured it exists and that’s it.

    We are also told that the hack­ers appeared to behave like they were on an espi­onage mis­sion, as opposed to sab­o­tage or theft. Along with US offi­cials point­ing out that the Trea­sury Depart­ment is the agency tasked with impos­ing sanc­tions on Chi­nese com­pa­nies, includ­ing sanc­tions relat­ed to those aid­ing Rus­sia in the war against Ukraine.

    Offi­cials tell us the hack went from Decem­ber 2nd through the 8th, which hap­pens to be right around the time the US was impos­ing com­mer­cial sanc­tions on Chi­nese com­pa­nies as pun­ish­ment for a major hack of US tele­com firms ear­li­er this year that was also blamed on Chi­na. That hack, dubbed Salt Typhoon, had tar­gets that includ­ed the com­mer­cial, unen­crypt­ed phone lines used by Pres­i­dent-elect Don­ald J. Trump, Vice Pres­i­dent-elect JD Vance and top nation­al secu­ri­ty offi­cials. We are also told Salt Typhoon result­ed in hack­ers obtain­ing a near­ly com­plete list of phone num­bers the Jus­tice Depart­ment has wire­tapped to mon­i­tor peo­ple sus­pect­ed of crimes or espi­onage. Mak­ing the infor­ma­tion stolen dur­ing Salt Typhoon the kind of infor­ma­tion that just about any intel­li­gence ser­vice or crim­i­nal orga­ni­za­tion in the world world be extreme­ly inter­est­ed in get­ting their hands on.

    But Chi­na got blamed and on Decem­ber 16th, 8 days after BeyondTrust report­ed the hack to Trea­sury, the NY Times report­ed that the US had imposed com­mer­cial sanc­tions on Chi­na Tele­com — Chi­na’s largest tele­com com­pa­ny — as pun­ish­ment for Salt Typhoon the pri­or week. So it sounds like the sanc­tions on Chi­na Tele­com were issued right around the time this new Trea­sury hack was dis­cov­ered. Mak­ing this hack the per­fect excuse for a much tougher new round of anti-Chi­na sanc­tions.

    We don’t know how what the fall­out is going to be but it’s clear the US has arrived at a cul­prit. Nor do we real­ly know the full extent of the dam­age from the hack itself, although one ear­ly detail is rather trou­bling: we are told the hack­ers are sus­pect­ed of hav­ing the abil­i­ty to cre­ate new accounts and change pass­words and bypass­ing secu­ri­ty. Which, if true, sug­gests they were gain­ing admin­is­tra­tive access through this BeyondTrust remote access soft­ware. Which would­n’t be sur­pris­ing since it sounds like BeyondTrust is used for pro­vid­ing remote tech­ni­cal assis­tance, which can often require admin priv­i­leges.

    Also keep in mind that when BeyondTrust told Trea­sury on Decem­ber about the hack, the com­pa­ny also made a blog post where it announced that an attack gained access to a lim­it­ed num­ber of BeyondTrust cus­tomers’ instances of Remote Sup­port SaaS, an access-man­age­ment tool. The com­pa­ny also since dis­closed that it patched two found vul­ner­a­bil­i­ties in its Remote Sup­port SaaS and Priv­i­leged Remote Access prod­ucts and that mul­ti­ple BeyondTrust cus­tomers were impact­ed. One of those vul­ner­a­bil­i­ties was only added to the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agen­cy’s cat­a­log of known exploit­ed vul­ner­a­bil­i­ties after this patch was made. Which is the kind of detail that sug­gests BeyondTrust may not have been the only remote access soft­ware provider vul­ner­a­ble to this exploit.

    And that’s all why, while we don’t know how many more clients beyond the Trea­sury Depart­ment were impact­ed by this hack, we know it’s this is big­ger than just the Trea­sury hack. So don’t be shocked if we learn the dam­age from this hack was much worse than expect­ed and also don’t be sur­prised that results in even more sanc­tions on Chi­na:

    The New York Times

    Chi­na Hacked Trea­sury Dept. in ‘Major’ Breach, U.S. Says

    The episode comes at a par­tic­u­lar­ly sen­si­tive moment, just as the Biden White House is deal­ing with one of the most far-reach­ing, and dam­ag­ing, hacks into Amer­i­can infra­struc­ture in the cyber­age.

    By Ana Swan­son and David E. Sanger
    Report­ing from Wash­ing­ton
    Pub­lished Dec. 30, 2024
    Updat­ed Dec. 31, 2024, 3:35 a.m. ET

    One of China’s intel­li­gence agen­cies hacked the U.S. Trea­sury Depart­ment, gain­ing access to the work­sta­tions of gov­ern­ment employ­ees and unclas­si­fied doc­u­ments, the Biden admin­is­tra­tion said on Mon­day, the lat­est in a series of embar­rass­ing sur­veil­lance oper­a­tions against major Amer­i­can insti­tu­tions.

    It was unclear from the Treasury’s lim­it­ed first account of the episode exact­ly what the hack­ers were seek­ing. But senior offi­cials with access to the intel­li­gence on the breach said that it appeared to be entire­ly an espi­onage oper­a­tion and not part of oth­er Chi­nese efforts to insert mali­cious com­put­er code into util­i­ty grids and water sup­ply sys­tems, giv­ing them a capa­bil­i­ty to shut off crit­i­cal Amer­i­can infra­struc­ture.

    In a let­ter inform­ing law­mak­ers of the episode, the Trea­sury Depart­ment said it had been noti­fied on Dec. 8 by a third-par­ty soft­ware ser­vice com­pa­ny, BeyondTrust, that the hack­er had obtained a secu­ri­ty key that allowed it to gain remote access to cer­tain Trea­sury work­sta­tions and doc­u­ments on them.

    “Based on avail­able indi­ca­tors, the inci­dent has been attrib­uted to a Chi­na state-spon­sored Advanced Per­sis­tent Threat (APT) actor,” the let­ter said. “In accor­dance with Trea­sury pol­i­cy, intru­sions attrib­ut­able to an APT are con­sid­ered a major cyber­se­cu­ri­ty inci­dent.”

    Top Chi­nese offi­cials have a deep inter­est in the activ­i­ties of the Trea­sury Depart­ment, which over­sees sen­si­tive data about glob­al finan­cial sys­tems — and esti­mates of China’s own trou­bled econ­o­my. The depart­ment also imple­ments sanc­tions against Chi­nese firms, includ­ing, in recent times, those aid­ing Rus­sia in the war against Ukraine./b>.

    Ear­li­er in the year, Chi­nese intel­li­gence cracked email accounts used by Com­merce Sec­re­tary Gina Rai­mon­do as she was mak­ing deter­mi­na­tions about new export con­trols on advanced semi­con­duc­tors and oth­er key tech­nol­o­gy, an attempt to slow their acqui­si­tion by Chi­nese firms. Sim­i­lar efforts were made against tar­gets in the State Depart­ment.

    ...

    In recent months, a series of rev­e­la­tions have shown how a sophis­ti­cat­ed Chi­nese intel­li­gence group, called Salt Typhoon, pen­e­trat­ed deep into at least nine U.S. telecom­mu­ni­ca­tions firms.

    That breach exploit­ed crit­i­cal gaps in the patched-togeth­er U.S. telecom­mu­ni­ca­tions infra­struc­ture, giv­ing the hack­ers access to not only text mes­sages but also phone con­ver­sa­tions. Inves­ti­ga­tors said that among the tar­gets were the com­mer­cial, unen­crypt­ed phone lines used by Pres­i­dent-elect Don­ald J. Trump, Vice Pres­i­dent-elect JD Vance and top nation­al secu­ri­ty offi­cials, though it is not clear what con­ver­sa­tions, if any, the hack­ers were able to mon­i­tor.

    The Salt Typhoon hack­ers also obtained a near­ly com­plete list of phone num­bers the Jus­tice Depart­ment has wire­tapped to mon­i­tor peo­ple sus­pect­ed of crimes or espi­onage, giv­ing the Chi­nese gov­ern­ment insight into which Chi­nese spies the Unit­ed States has iden­ti­fied — and which it has missed. As a result, the breach has con­cerned coun­ter­in­tel­li­gence offi­cials, who fear that Bei­jing will learn who is under sus­pi­cion and who is not.

    The Trea­sury Depart­ment said it had worked with the F.B.I., the intel­li­gence com­mu­ni­ty and oth­er inves­ti­ga­tors to deter­mine the impact of the lat­est breach. The com­pro­mised ser­vice has been tak­en offline, and there is no evi­dence that the Chi­nese hack­ers still have access to Trea­sury infor­ma­tion, the depart­ment said.

    ...

    On Tues­day, a spokes­woman for China’s for­eign min­istry, Mao Ning, called the alle­ga­tion by the Unit­ed States “ground­less.” Ms. Mao added that Chi­na opposed all forms of hack­ing attacks and “we are even more opposed to the spread of false infor­ma­tion against Chi­na for polit­i­cal pur­pos­es.”

    Chi­nese offi­cials have long denied any gov­ern­ment role in hack­ing, and have set up dia­logues with the Unit­ed States to work togeth­er on cyber­se­cu­ri­ty. Ear­li­er this month, offi­cials from the Trea­sury Depart­ment trav­eled to Chi­na for a round of meet­ings of their eco­nom­ic and finan­cial work­ing groups, which cov­er col­lab­o­ra­tion on cyber­se­cu­ri­ty issues.

    In response to the Salt Typhoon hack, the Com­merce Depart­ment said this month that it would ban the few remain­ing oper­a­tions of Chi­na Tele­com, one of the country’s biggest com­mu­ni­ca­tions firms, from the Unit­ed States.

    ————

    “Chi­na Hacked Trea­sury Dept. in ‘Major’ Breach, U.S. Says” By Ana Swan­son and David E. Sanger; The New York Times; 12/30/2024

    “In a let­ter inform­ing law­mak­ers of the episode, the Trea­sury Depart­ment said it had been noti­fied on Dec. 8 by a third-par­ty soft­ware ser­vice com­pa­ny, BeyondTrust, that the hack­er had obtained a secu­ri­ty key that allowed it to gain remote access to cer­tain Trea­sury work­sta­tions and doc­u­ments on them.”

    It just keeps hap­pen­ing. Remote access soft­ware is once again the point of vul­ner­a­bil­i­ty lead­ing to a hack, which sounds plau­si­ble giv­en all the oth­er remote access hacks in recent years. At least that’s the sto­ry we’re get­ting at this point regard­ing the Trea­sury hack. Along with some strong asser­tions that it was Chi­nese state hack­ers behind it. Strong asser­tions that don’t actu­al­ly sound very strong when you look at the lan­guage of the state­ment released about how the attri­bu­tion to a Chi­nese hack­ing group was “based on avail­able indi­ca­tors”. Which is anoth­er way of say­ing some­one is look­ing at the evi­dence and mak­ing an edu­cat­ed guess. Evi­dence that, by its dig­i­tal nature, is high­ly spoofa­ble and can eas­i­ly be used to leave ‘indi­ca­tors’ point­ing towards who­ev­er one might want to impli­cate. And that’s assum­ing we ever even get to see the evi­dence. Usu­al­ly we’re just assured it exists and that’s it:

    ...
    “Based on avail­able indi­ca­tors, the inci­dent has been attrib­uted to a Chi­na state-spon­sored Advanced Per­sis­tent Threat (APT) actor,” the let­ter said. “In accor­dance with Trea­sury pol­i­cy, intru­sions attrib­ut­able to an APT are con­sid­ered a major cyber­se­cu­ri­ty inci­dent.”

    ...

    The Trea­sury Depart­ment said it had worked with the F.B.I., the intel­li­gence com­mu­ni­ty and oth­er inves­ti­ga­tors to deter­mine the impact of the lat­est breach. The com­pro­mised ser­vice has been tak­en offline, and there is no evi­dence that the Chi­nese hack­ers still have access to Trea­sury infor­ma­tion, the depart­ment said.
    ...

    But also note the remark­able tim­ing and poten­tial fall­out from this hack: it came right around the time the US was impos­ing sanc­tions on Chi­na Tele­com over the Salt Typhoon mega-hack of US phone com­pa­nies which was also blamed on Chi­na. Are new sanc­tions against Chi­nese firms on the way?

    ...
    Top Chi­nese offi­cials have a deep inter­est in the activ­i­ties of the Trea­sury Depart­ment, which over­sees sen­si­tive data about glob­al finan­cial sys­tems — and esti­mates of China’s own trou­bled econ­o­my. The depart­ment also imple­ments sanc­tions against Chi­nese firms, includ­ing, in recent times, those aid­ing Rus­sia in the war against Ukraine./b>.

    Ear­li­er in the year, Chi­nese intel­li­gence cracked email accounts used by Com­merce Sec­re­tary Gina Rai­mon­do as she was mak­ing deter­mi­na­tions about new export con­trols on advanced semi­con­duc­tors and oth­er key tech­nol­o­gy, an attempt to slow their acqui­si­tion by Chi­nese firms. Sim­i­lar efforts were made against tar­gets in the State Depart­ment.

    ...

    In recent months, a series of rev­e­la­tions have shown how a sophis­ti­cat­ed Chi­nese intel­li­gence group, called Salt Typhoon, pen­e­trat­ed deep into at least nine U.S. telecom­mu­ni­ca­tions firms.

    That breach exploit­ed crit­i­cal gaps in the patched-togeth­er U.S. telecom­mu­ni­ca­tions infra­struc­ture, giv­ing the hack­ers access to not only text mes­sages but also phone con­ver­sa­tions. Inves­ti­ga­tors said that among the tar­gets were the com­mer­cial, unen­crypt­ed phone lines used by Pres­i­dent-elect Don­ald J. Trump, Vice Pres­i­dent-elect JD Vance and top nation­al secu­ri­ty offi­cials, though it is not clear what con­ver­sa­tions, if any, the hack­ers were able to mon­i­tor.

    The Salt Typhoon hack­ers also obtained a near­ly com­plete list of phone num­bers the Jus­tice Depart­ment has wire­tapped to mon­i­tor peo­ple sus­pect­ed of crimes or espi­onage, giv­ing the Chi­nese gov­ern­ment insight into which Chi­nese spies the Unit­ed States has iden­ti­fied — and which it has missed. As a result, the breach has con­cerned coun­ter­in­tel­li­gence offi­cials, who fear that Bei­jing will learn who is under sus­pi­cion and who is not.

    ...

    Chi­nese offi­cials have long denied any gov­ern­ment role in hack­ing, and have set up dia­logues with the Unit­ed States to work togeth­er on cyber­se­cu­ri­ty. Ear­li­er this month, offi­cials from the Trea­sury Depart­ment trav­eled to Chi­na for a round of meet­ings of their eco­nom­ic and finan­cial work­ing groups, which cov­er col­lab­o­ra­tion on cyber­se­cu­ri­ty issues.

    In response to the Salt Typhoon hack, the Com­merce Depart­ment said this month that it would ban the few remain­ing oper­a­tions of Chi­na Tele­com, one of the country’s biggest com­mu­ni­ca­tions firms, from the Unit­ed States.
    ...

    Time will tell in terms of the fall­out from this hack but it’s not hard to imag­ine new sanc­tions of some sort. And as the fol­low­ing BBC report reminds us, the US has­n’t actu­al­ly pro­vid­ed any evi­dence for its attri­bu­tion of this hack yet. So time will also tell whether or not we ever get any more details on why it was that the US is con­vinced it must have been a Chi­nese state oper­a­tion, but don’t hold your breath. Pub­lic expla­na­tions of hack­ing inves­ti­ga­tions aren’t some­thing we can real­ly expect at this point.

    But it is worth not­ing one inter­est­ing tech­ni­cal detail regard­ing the nature of this hack and what the hack­er may have been capa­ble of doing on the Trea­sury Depart­men­t’s net­work: we are told it’s sus­pect­ed the hack­ers may have had the abil­i­ty to cre­ate new accounts or change pass­words. Which sug­gests they were gain­ing access to admin­is­tra­tive accounts. Which could be real­ly bad for Trea­sury. And bad for Chi­na after it takes the blame:

    BBC

    US Trea­sury says it was hacked by Chi­na in ‘major inci­dent’

    12/31/2024
    Nadine Yousif and Joe Tidy
    BBC News

    Chi­nese state-spon­sored hack­ers broke into the US Trea­sury Depart­men­t’s sys­tems ear­li­er this month and were able to access employ­ee work­sta­tions and some unclas­si­fied doc­u­ments, Amer­i­can offi­cials have said.

    The Trea­sury Depart­ment deemed the breach a “major inci­dent” after dis­clos­ing it via a let­ter noti­fy­ing law­mak­ers to the inci­dent.

    ...

    It is the lat­est in a series of high-pro­file and embar­rass­ing secu­ri­ty breach­es in the US being blamed on Chi­na.

    A hack of tele­coms com­pa­nies in Decem­ber poten­tial­ly accessed phone record data across large swathes of Amer­i­can soci­ety.

    The Trea­sury Depart­ment said in its let­ter to law­mak­ers that this lat­est attack involved Chi­na-based actors over­rid­ing secu­ri­ty via a key used by a third-par­ty ser­vice provider. The appli­ca­tion offers remote tech­ni­cal sup­port to its employ­ees.

    The com­pro­mised third-par­ty ser­vice — called BeyondTrust — has since been tak­en offline, offi­cials said. There was no evi­dence to sug­gest the hack­er had con­tin­ued to access to Trea­sury Depart­ment infor­ma­tion since, the state­ment con­tin­ued.

    The depart­ment said it had been work­ing with the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency and third-par­ty foren­sic inves­ti­ga­tors to deter­mine the over­all impact.

    Offi­cials said ini­tial inves­ti­ga­tions sug­gest­ed the hack appeared to have been car­ried out by “a Chi­na-based Advanced Per­sis­tent Threat (APT) actor”.

    “In accor­dance with Trea­sury pol­i­cy, intru­sions attrib­ut­able to an APT are con­sid­ered a major cyber­se­cu­ri­ty inci­dent,” Trea­sury Depart­ment offi­cials said.

    The depart­ment mon­i­tors glob­al finan­cial sys­tems and economies, and in recent years has levied US sanc­tions against Chi­na.

    It said it was made aware of the hack on 8 Decem­ber by BeyondTrust, a spokesper­son told the BBC. Accord­ing to the com­pa­ny, the sus­pi­cious activ­i­ty was first spot­ted on 2 Decem­ber, but it took three days for the com­pa­ny to deter­mine it had been hacked.

    The spokesper­son said the hack­ers were able to remote­ly access sev­er­al Trea­sury user work­sta­tions and some unclas­si­fied doc­u­ments that were kept by those users.

    The depart­ment did not spec­i­fy the nature of these files, or when and for how long the hack took place. They also did not spec­i­fy the lev­el of con­fi­den­tial­i­ty of the com­put­er sys­tems or the senior­i­ty of the staff whose mate­ri­als were accessed.

    The hack­ers may have been able to cre­ate accounts or change pass­words in the three days that they were being watched by BeyondTrust.

    As espi­onage agents, the hack­ers are believed to have been seek­ing infor­ma­tion, rather than attempt­ing to steal funds.

    ...

    In the last year, two sep­a­rate groups of sus­pect­ed Chi­nese gov­ern­ment hack­ers have been iden­ti­fied.

    Volt Typhoon has been accused of break­ing into crit­i­cal infra­struc­ture organ­i­sa­tions for poten­tial dis­rup­tion attacks and Salt Typhoon is accused of car­ry­ing out espi­onage mis­sions, includ­ing the tele­coms hack ear­li­er this month.

    Chi­na rou­tine­ly denies involve­ment and a spokesman for the Chi­nese embassy in Wash­ing­ton DC told BBC News that the lat­est accu­sa­tion was part of a smear attack with­out any fac­tu­al basis.

    “The US needs to stop using cyber secu­ri­ty to smear and slan­der Chi­na, and stop spread­ing all kinds of dis­in­for­ma­tion about the so-called Chi­nese hack­ing threats,” embassy spokesman Liu Pengyu said.

    The US has not sup­plied any evi­dence that Chi­na is respon­si­ble for the hack.

    ———-

    “US Trea­sury says it was hacked by Chi­na in ‘major inci­dent’ ” by Nadine Yousif and Joe Tidy; BBC; 12/31/2024

    “The US has not sup­plied any evi­dence that Chi­na is respon­si­ble for the hack.”

    No evi­dence yet. Is it forth­com­ing? Again, don’t hold your breath. But don’t sur­prised if we get more updates on the dam­age done by this hack. Because it sounds like the access grant­ed via the BeyondTrust soft­ware is like­ly the kind of admin­is­tra­tive access often nec­es­sary for pro­vid­ing remote tech­ni­cal sup­port and the hack­ers used those priv­i­leges to ‘over­ride secu­ri­ty via a key’ used by BeyondTrust:

    ...
    The Trea­sury Depart­ment said in its let­ter to law­mak­ers that this lat­est attack involved Chi­na-based actors over­rid­ing secu­ri­ty via a key used by a third-par­ty ser­vice provider. The appli­ca­tion offers remote tech­ni­cal sup­port to its employ­ees.

    ...

    The depart­ment mon­i­tors glob­al finan­cial sys­tems and economies, and in recent years has levied US sanc­tions against Chi­na.

    It said it was made aware of the hack on 8 Decem­ber by BeyondTrust, a spokesper­son told the BBC. Accord­ing to the com­pa­ny, the sus­pi­cious activ­i­ty was first spot­ted on 2 Decem­ber, but it took three days for the com­pa­ny to deter­mine it had been hacked.

    The spokesper­son said the hack­ers were able to remote­ly access sev­er­al Trea­sury user work­sta­tions and some unclas­si­fied doc­u­ments that were kept by those users.

    The depart­ment did not spec­i­fy the nature of these files, or when and for how long the hack took place. They also did not spec­i­fy the lev­el of con­fi­den­tial­i­ty of the com­put­er sys­tems or the senior­i­ty of the staff whose mate­ri­als were accessed.

    The hack­ers may have been able to cre­ate accounts or change pass­words in the three days that they were being watched by BeyondTrust.
    ...

    Which remote access tool will the Trea­sury Depart­ment rely on now? Who knows, but it’s worth keep­ing in mind that, while we don’t know who else may have been impact­ed by this BeyondTrust secu­ri­ty vul­ner­a­bil­i­ty, we do know the Trea­sury Depart­ment was­n’t BeyondTrust’s only impact­ed cus­tomer:

    Cyber­se­cu­ri­ty Dive

    BeyondTrust cus­tomers hit by wave of attacks linked to com­pro­mised API key

    The cyber­se­cu­ri­ty ven­dor said an attack­er com­pro­mised its access-man­age­ment tool and reset cus­tomer pass­words.

    Pub­lished Dec. 20, 2024
    Matt Kap­ko Senior Reporter

    An attack­er gained access to a lim­it­ed num­ber of BeyondTrust cus­tomers’ instances of Remote Sup­port SaaS, an access-man­age­ment tool, the com­pa­ny said in a Dec. 8 blog post, which was updat­ed Wednes­day. The attack­er com­pro­mised a Remote Sup­port SaaS API key and reset pass­words of mul­ti­ple accounts.

    The cyber­se­cu­ri­ty ven­dor ini­tial­ly detect­ed anom­alous activ­i­ty on one cus­tomer instance of Remote Sup­port SaaS on Dec. 2, accord­ing to the updat­ed blog. Three days lat­er, the com­pa­ny deter­mined mul­ti­ple cus­tomers were impact­ed, sus­pend­ed those instances and revoked the com­pro­mised API key.

    ...

    *****

    BeyondTrust also iden­ti­fied and patched a pair of vul­ner­a­bil­i­ties in its Remote Sup­port SaaS and Priv­i­leged Remote Access prod­ucts, CVE-2024–12356 and CVE-2024–12686, dur­ing its inves­ti­ga­tion into the attacks. The vul­ner­a­bil­i­ties were dis­closed and patched on Mon­day and Wednes­day.

    The com­pa­ny did not describe either flaw as active­ly exploit­ed in its advi­sories, yet the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency added CVE-2024–12356, a crit­i­cal com­mand injec­tion vul­ner­a­bil­i­ty, to its known exploit­ed vul­ner­a­bil­i­ties cat­a­log on Thurs­day.

    BeyondTrust hasn’t acknowl­edged a direct link between the attacks and the active­ly exploit­ed crit­i­cal CVE, which has a CVSS score of 9.8. The com­pa­ny did not respond to a request for com­ment.

    ...

    BeyondTrust said it had 20,000 cus­tomers across its prod­uct port­fo­lio ear­li­er this year, includ­ing 75 of the For­tune 100.

    ———–

    “BeyondTrust cus­tomers hit by wave of attacks linked to com­pro­mised API key” by Matt Kap­ko; Cyber­se­cu­ri­ty Dive; 12/20/2024

    “The cyber­se­cu­ri­ty ven­dor ini­tial­ly detect­ed anom­alous activ­i­ty on one cus­tomer instance of Remote Sup­port SaaS on Dec. 2, accord­ing to the updat­ed blog. Three days lat­er, the com­pa­ny deter­mined mul­ti­ple cus­tomers were impact­ed, sus­pend­ed those instances and revoked the com­pro­mised API key.”

    Mul­ti­ple cus­tomers were impact­ed. This isn’t just a Trea­sury hack sto­ry. The Trea­sury hack is just the biggest part of it. So far.

    But when we see BeyondTrust also acknowl­edg­ing that a pair of vul­ner­a­bil­i­ties have since been iden­ti­fied and patched, and one of those vul­ner­a­bil­i­ties, CVE-2024–12356, was only added to the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agen­cy’s list of known exploit­ed vul­ner­a­bil­i­ties cat­e­go­ry after that patch sug­gests BeyondTrust may not have been the only vic­tim of that exploit. Which is a anoth­er reminder the remote access soft­ware indus­try seems to have a much larg­er indus­try-wide secu­ri­ty prob­lem:

    ...
    BeyondTrust also iden­ti­fied and patched a pair of vul­ner­a­bil­i­ties in its Remote Sup­port SaaS and Priv­i­leged Remote Access prod­ucts, CVE-2024–12356 and CVE-2024–12686, dur­ing its inves­ti­ga­tion into the attacks. The vul­ner­a­bil­i­ties were dis­closed and patched on Mon­day and Wednes­day.

    The com­pa­ny did not describe either flaw as active­ly exploit­ed in its advi­sories, yet the Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency added CVE-2024–12356, a crit­i­cal com­mand injec­tion vul­ner­a­bil­i­ty, to its known exploit­ed vul­ner­a­bil­i­ties cat­a­log on Thurs­day.

    BeyondTrust hasn’t acknowl­edged a direct link between the attacks and the active­ly exploit­ed crit­i­cal CVE, which has a CVSS score of 9.8. The com­pa­ny did not respond to a request for com­ment.
    ...

    How long before we learn about the next remote access soft­ware night­mare? Again, time will tell. But we can be con­fi­dent it’s just a mat­ter of time. And prob­a­bly soon­er rather than lat­er at this rate. But it’s going to hap­pen. And it’s going to be blamed on Chi­na. Or maybe Rus­sia. But, real­ly, giv­en that there’s only so much room left for the US to impose more sanc­tions on Rus­sia, it will prob­a­bly be Chi­na.

    Posted by Pterrafractyl | January 2, 2025, 3:14 am

Post a comment

MISCELLANEOUS ARCHIVES

MussoliniUncle Sam and Il Duce American Support for Mussolini and the Mythology of the Corporate State Read more »