IEEE Cipher --- Items from security-related news (E182)
Summary:
The Internet grows and changes, but trust has trouble keeping up. A
researcher wondered what would happen if an abandoned DNS name for a
WHOIS server could be put back into service and have the trust of
users. Apparently 135K entities around the world sent queries and
presumably would have trusted the answers as if the original owner
still controlled the server.
Summary:
The company American Water Works has management systems for municipal
and military water supplies. They can provide the software for
controlling water delivery and for billing, and several million
customers are reliant on their software for getting their bills and
paying. In October the company discovered that an unknown entity had
infiltrated their billing system, so in an exuberance of caution,
they disconnected some of their customer portals and related systems
for billing while they examined the extent of the intrusion.
Apparently no software involved with managing water delivery was
affected. This information came to light through a regulatory
filing.
Summary:
The hacker intrusion into the billing and payment systems for American
Water Work have been deemed clean, and the company is resuming
customer services. There's no word on the identity of perpetrator of the
intrusion. The company operates in about 1700 communities around
the US.
Summary:
The article has a list of attacks on the computer systems of critical
infrastructure systems since 2021. Although there have no been many,
there have been four in this year already. The trend is upward.
Summary:
The problem with holidays is that 24/7 vigilance is less effective
when key employees enjoy time off. The reduced staffing gives
hackers opportunities that may be normally unavailable. This
seems to put security professionals into the same "no time
off for holidays" category as emergency room doctors.
The data showing how attacks proliferate during the holidays is in a report by security firm Semperis. Its title, "86% of Ransomware Victims Targeted on a Weekend or Holiday" should be a red flag to all companies.
Summary:
According to the Wall Street Journal, several large telecom carriers
were the object of a stealthy intrusion into customer data such as
call records and unencrypted text message. The hacker group has
been identified by Microsoft as one associated with the Chinese
intelligence service. The group has been dubbed "Salt Typhoon".
Although most text messages are encrypted, there was a gap until
September for messages exchanged between Android and Apple phones.
The same hacking group has shown up in investigations of intrusions of telecom carriers through the wiretapping entry point required by the Communications Assistance for Law Enforcement Act (CALEA).
Summary:
In the wake of revelations about the compromise of sensitive
information at US telecoms, Senator Wyden sent a letter to the
Department of Justice asking for greater oversight of the
"backdoor" access required by CALEA. The senator would like
to see corporations held liable for cyber negligence, among
other reforms.
Summary:
This article clarifies what information was available to Chinese
agents through US telecoms, why they were able to access it,
and the history of the existence of the remote access interface
and its obvious risks.
Summary:
The White House is taking the revelations about Chinese incursions
into US telecommunications systems very seriously. The scope of
the problem is as yet unknown, but Senator Mark Warner has called it
the "worst telecom hack in our nation's history." Meetings will
continue after the Thanksgiving holiday.
Summary:
It's no secret that a building's wifi network can be targeted by hackers
who are nearby, but if the attack is launched remotely, say from miles
away, one might think that the wifi signal was irrelevant. The
attack describe here shows some cleverness on the part of the
remote hacker. Finding the target network unbreachable from afar,
a remote attack was launched against a computer in a nearby
building. Once that was accomplished, the compromised computer
was used to scan the network for an adjacent building. There was
enough wifi signal strength to allow the remote hacker to launch
a "parking lot attack" against the second building.
Google Maps and a little information about where people live and work is enough to find a path from one vulnerable computer to a vulnerable network. Obviously, this can be extended indefinitely.