Category Archives: General InfoSec

See You At EPRI Event in Chicago

Posted on by
3

Next Monday, June 17th, I’ll be presenting at the EPRI conference in Chicago. My topic is a threat update on what attackers are targeting and what kind of value future state designs and other research/planning data has on the attacker market. If you’re going to be at the event, please join me for my presentation. If you’d like to grab a coffee or the like, let me know. I’ll be around all day. 

Thanks for reading and I hope to see you there! 

People’s Republic of China and Hacking the US Defense Industrial Base (DIB)….

Posted on by
1

Good morning Folks –

Much news to post for a Sunday…remember the Red Dragon’s thought, controversial and unpopular stories are published on the weekends…today 9 JUNE 2013 is certainly a landmark day….enjoy the cyber threat intelligence news of the day from all corners of the cyber world…here is today’s edition of People’s Republic of China and Hacking the US Defense Industrial Base (DIB)….

Cyber ceasefire? US & the People’s Republic of Hacking <> square off over Internet espionage claims

http://rt.com/news/obama-xi-cyber-hacking-356/

US-China summit ends with accord on all but cyber-espionage
Obama’s meeting with Xi overshadowed by revelations of NSA’s snooping –

http://www.guardian.co.uk/world/2013/jun/09/us-china-summit-barack-obama-xi-jinping

Cyber crimes confrontation at Obama Xi summit

http://www.telegraph.co.uk/news/worldnews/asia/china/10108486/Cyber-crimes-confrontation-at-Obama-Xi-summit.html

U.S. and China Move Closer on North Korea, but Not on Cyberespionage

http://www.nytimes.com/2013/06/09/world/asia/obama-and-xi-try-building-a-new-model-for-china-us-ties.html?partner=rssnyt&emc=rss&pagewanted=all

Redefining relations [China Daily]

http://wanderingchina.org/2013/06/09/redefining-relations-china-daily-risingchina-xiobamasummit-transpacificcooperation/

Obama tells intelligence chiefs to draw up cyber target list – full document text
People’s Republic of China is @ the top of the targeting list…uh oh…

http://www.guardian.co.uk/world/interactive/2013/jun/07/obama-cyber-directive-full-text

People’s Republic of Hacking <> flips cybersecurity tables; reports claim U.S. is prepping attacks

http://www.washingtontimes.com/news/2013/jun/7/obama-urges-chinese-president-cooperate-cybersecur/

Did the People’s Republic of China Leak Prism Deliberately?

http://blog.knowbe4.com/bid/297153/did-china-leak-prism-deliberately?

The Economist’s ‘Brokeback Mountain’ Cover & PRISM Won’t Stop Obama & Xi

http://www.theatlanticwire.com/global/2013/06/economist-brokeback-mountain-cover-obama-xi/65999/

People’s Republic of China’s Response to Pentagon Report “Baseless, Counterproductive”

http://www.jamestown.org/programs/chinabrief/single/?tx_ttnews%5Btt_news%5D=40856&cHash=7454cb6965b8ef66e9be3338386ec41d

People’s Republic of China encircles U.S. by sailing warships in American waters, arming neighbors

http://www.washingtontimes.com/news/2013/jun/7/china-encircles-us-arming-western-hemisphere-state/

People’s Republic of China’s 2013 Defense White Paper in Perspective

http://www.jamestown.org/programs/chinabrief/single/?tx_ttnews%5Btt_news%5D=40783&cHash=ff46c8fad4f7da66e5e3e642e6da62e4

People’s Republic of China’s Iraq Oil Strategy Comes Into Sharper Focus

http://www.jamestown.org/programs/chinabrief/single/?tx_ttnews%5Btt_news%5D=40861&cHash=20da431fe2272ad34a6ace632cdecb96#.UbSEKfkqh8E

People’s Republic of China To America: You Hack Us, Too – Network Computing

http://www.networkcomputing.com/quickview/china-to-america-you-hack-us-too/3581?wc=4?cid=NWC_report_2013-06-08_html&elq=f22330ccd1b64c119ef17d90549174b7&wc=4

People’s Republic of China hacking vs. Pentagon whacking: An arms race in cyber-space?

http://rt.com/op-edge/china-pentagon-hacking-cyber-211/

People’s Republic of Chain’s Huawei reiterates that its products do not pose a security threat

http://www.phonearena.com/news/Huawei-reiterates-that-its-products-do-not-pose-a-security-threat_id43818?

Censoring Remembrance: People’s Republic of China’s Twenty-Fourth Unrealized Commemoration

http://wanderingchina.org/2013/06/08/censoring-remembrance-chinas-twenty-fourth-unrealized-commenoration-three-torches-risingchina-tiananmen/

People’s Republic of China’s Lenovo And Huawei: Chinese Smartphones Ready To Take On The World

http://seekingalpha.com/article/1487682-lenovo-and-huawei-chinese-smartphones-ready-to-take-on-the-world?source=feed

Fiat could look for new China partner for Jeep: CEO

http://www.reuters.com/article/2013/06/08/us-fiat-jeep-idUSBRE95707C20130608

US Naval Academy Launches Cyber Operations Major…Mandarin Chinese not to be offered….

http://defensetech.org/2013/06/08/naval-academy-launches-cyber-operations-major/

Is “cyber war” just a scare tactic?
“Officials warn of looming Armageddon. Critics say it’s a subterfuge to erode online privacy and accountability…”Oh, the hyperbole…”

http://www.salon.com/2013/05/26/is_cyber_war_just_a_scare_tactic_partner/singleton/

The State of Cyber-War
http://www.asiasentinel.com/index.php?option=com_content&task=view&id=5466&Itemid=422

Taiwan to open new cyberwar unit

http://phys.org/news/2013-05-taiwan-cyberwar.html

2 more Taiwanese sites attacked in cyberwar tit-for-tat

http://www.gmanetwork.com/news/story/308017/scitech/technology/2-more-taiwanese-sites-attacked-in-cyberwar-tit-for-tat

China’s 2nd State…Taiwan Military Reform: Declining Operational Capabilities?

http://www.jamestown.org/programs/chinabrief/single/?tx_ttnews%5Btt_news%5D=40996&cHash=c90aea17a261bdf85762692f2104d44f

People’s Republic of China’s ZTE sends 400Gbps over 3,100 miles
People’s Republic of China’s ZTE redines High Speed Avenue of Approach in Chinese Military offensive cyber weapons arsenal…

http://www.computerworld.com/s/article/9239903/ZTE_sends_400Gbps_over_3_100_miles?sou

CCTV reveals Chinese army unit number, military praised for transparency

http://www.globaltimes.cn/content/756590.shtml

China v the US: how the superpowers compare |
http://www.guardian.co.uk/news/datablog/2013/jun/07/china-us-how-superpowers-compare-datablog

Defending an Open, Global Internet: China Is Not the Only Challenge, But Is a Big One

http://blogs.cfr.org/asia/2013/06/07/defending-an-open-global-internet-china-is-not-the-only-challenge-but-is-a-big-one/

Chinese Corporate Espionage: A Legal Gray Area?

http://chinadigitaltimes.net/2013/06/chinese-corporate-espionage-a-legal-gray-area/?

UK monthly exports to China hit £1bn for first time
ONS sees marked shift in Britain’s trading patterns as UK firms diversify away from crisis-hit eurozone

http://www.guardian.co.uk/business/2013/jun/07/uk-exports-china-ons

U.S. Internet Spying Draws Anger, and Envy

http://www.nytimes.com/2013/06/08/business/global/us-internet-spying-draws-anger-and-envy.html?partner=rssnyt&emc=rss&pagewanted=all

Cyber Attacks — the Reality, the Reason and the Resolution. Part 1

http://www.digitalcommunities.com/Column-Cyber-Attacks—-the-Reality-the-Reason-and-the-Resolution-Part-1.html

Cyber Attacks — the Reality, the Reason and the Resolution. Part 2

http://www.digitalcommunities.com/articles/Column-Cyber-Attacks-the-Reality-the-Reason-and-the-Resolution-Part-2.html?

U.S. on Offense in Cyber War: Building Command Center, Hiring Warriors

http://www.insurancejournal.com/news/national/2013/06/07/294731.htm

Clearing the air on cyber, electronic warfare | Deep Dive Intel

http://www.deepdiveintel.com/2013/05/30/clearing-the-air-about-electronic-warfare/?

Editorial: Cyberwar Defense

http://www.vnews.com/opinion/6456148-95/editorial-cyberwar-defense

Commentary: Keep Cyberwar Narrow |

http://nationalinterest.org/commentary/keep-cyberwar-narrow-8459

US DoD Sheds First Clear Light On AirSea Battle: Warfare Unfettered…discovers Chinese PLA “Unrestricted Warfare”…
http://breakingdefense.com/2013/06/03/dod-document-sheds-first-new-light-on-airsea-battle-warfare-unfettered/?

Waging the cyber war in Syria
http://fullcomment.nationalpost.com/2013/05/21/ronald-deibert-waging-the-cyber-war-in-syria/

Iranian Lawmaker: US Cyber War on Iran Violating Int’l Law

http://english.farsnews.com/newstext.php?nn=9202246150

Enjoy!

Semper Fi,

謝謝
紅龍

Cyber Espionage by the People’s Republic of Hacking…Operation Middle Kingdom

Posted on by
2

Good day Curious Friends –

Here’s the latest compilation of Cyber Espionage by the People’s Republic of Hacking…Operation Middle Kingdom…

Enjoy and start to learn Mandarin Chinese…the words you speak could save your life…

The Chinese cyber-intelligence effort

http://leisureguy.wordpress.com/2013/06/06/the-chinese-cyber-intelligence-effort/

Information Warfare: America Admits the People’s Republic of Hacking aka China Took It All
Operation Middle Kingdom now focuses on colonizing the United States states PLA spokeswoman in Beijing…

http://www.strategypage.com/htmw/htiw/articles/20130605.aspx

Getting the People’s Republic of China to talk about cyber espionage

http://www.washingtonpost.com/opinions/getting-china-to-talk-about-cyberespionage/2013/06/05/d69f5446-cdec-11e2-8845-d970ccb04497_story.html

Chinese Cyber Espionage: Our Weapons Are OK, Says US DoD; Aussie Counter-Intel HQ At Risk

http://breakingdefense.com/2013/05/28/chinese-cyber-espionage-not-to-worry-our-weapons-are-ok-say-dod-spokesman-aussie-pm/

People’s Republic of China Seen in Push to Gain Technology Insights
Phase III of Operation Middle Kingdom now successful states Chinese Academy of Sciences (CAS) Spokeswoman in Beijing…

http://www.nytimes.com/2013/06/06/world/asia/wide-china-push-is-seen-to-obtain-industry-secrets.html

With troops and techies, U.S. prepares for cyber warfare
矽對海洋和平，帕拉戰爭….Si vis pacem, para bellum

http://www.reuters.com/article/2013/06/07/us-usa-cyberwar-idUSBRE95608D20130607

Chinese hacked Obama, McCain campaigns, took internal documents, officials say
People’s Republic of China Hackers now linked to Political Cyber Espionage…

http://openchannel.nbcnews.com/_news/2013/06/06/18807056-chinese-hacked-obama-mccain-campaigns-took-internal-documents-officials-say?lite

People’s Republic of China Seen in Push to Gain Technology Insights
Phase III of Operation Middle Kingdom now successful states Chinese Academy of Sciences (CAS) Spokeswoman in Beijing…

http://www.nytimes.com/2013/06/06/world/asia/wide-china-push-is-seen-to-obtain-industry-secrets.html

In Asia’s waters, an assertive China means long-lasting disputes
I wonder if President Obama will bring up the People’s Republic of China’s claim to own Okinawa, Huangyan, Daiyu Island Chains…?

http://www.washingtonpost.com/world/in-asias-waters-an-assertive-china-means-long-lasting-disputes/2013/06/06/846f735e-90c5-11e2-bdea-e32ad90da239_story.html?

People’s Republic of China: The Morphing Dragon

http://seekingalpha.com/article/1484271-china-the-morphing-dragon?source=email_global_markets&ifp=0

Tomato Garden Campaign – Possible Microsoft Office zero day in the wild used against Tibet and China Democracy activists

http://blog.malwaretracker.com/2013/06/tomato-garden-campaign-possible.html

People’s Republic of China Criticizes US For Making Weapon Plans Steal-able, Alleges Attacks From US

http://slashdot.org/story/13/06/05/1715203/china-criticizes-us-for-making-weapon-plans-steal-able-alleges-attacks-from-us

US-China cyber security wrangle lies ahead

http://www.bbc.co.uk/news/world-asia-china-22809936

Cyber disputes loom large as Obama meets China’s Xi

http://www.reuters.com/article/2013/06/07/us-usa-china-idUSBRE9560B120130607

People’s Republic of Hacking (China) Huawei controversy flares up

http://www.stuff.co.nz/technology/8764891/Huawei-controversy-flares-up-again

People’s Republic of China’s Huawei not blocked by GCSB from broadband initiative –

http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10888839

British Government defends People’s Republic of China’s Huawei after MPs warn on security

http://www.computing.co.uk/ctg/news/2273325/government-defends-huawei-after-mps-warn-on-security

Report: UK acts to soften criticisms of People’s Republic of China’s Huawei
UK Government acknowledges colonization by the People’s Republic of China is 85% complete…mandatory Mandarin Chinese classes to commence @ King’s College as offered by RUSI…

http://www.fiercewireless.com/europe/story/report-uk-acts-soften-criticisms-huawei/2013-06-05?

Should the UK worry about the People’s Republic of Chain’s Huawei? Nah – UK has already been colonized

http://www.bbc.co.uk/news/uk-22803510

UK Web privacy – outsourced to the US and People’s Republic of China? Further evidence of the UK having been colonized

http://www.bbc.co.uk/news/technology-22811002

The summit … America & The Middle Kingdom
Barack Obama and Xi Jinping have a chance to recast this century’s most important bilateral relationship

http://www.economist.com/news/leaders/21579003-barack-obama-and-xi-jinping-have-chance-recast-centurys-most-important-bilateral?fsrc=rss|lea

Xi’s Not Ready – Why Obama should skip the shirt-sleeves summit with China’s new leader.

http://www.foreignpolicy.com/articles/2013/06/04/xi_s_not_ready_obama_summit?page=full

An Insider’s Guide to ‘Shirt-Sleeves Summit’

http://blogs.wsj.com/chinarealtime/2013/06/07/what-to-expect-from-xi-obama-summit-an-insiders-guide/

U.S. & People’s Republic of Hacking (China) to Hold Talks on Hacking
President Obama to ask President Xi about Operation Middle Kingdom
http://www.nytimes.com/2013/06/02/world/asia/us-and-china-to-hold-talks-on-hacking.html?pagewanted=all

The People’s Republic of China’s New Backyard – Latin America

http://www.foreignpolicy.com/articles/2013/06/06/china_s_new_backyard_latin_america?page=full

UK defends People’s Republic of Hacking : China telecom firm deals
Uh oh…United Kingdom in chaos over whether or not they have been colonized by the People’s Republic of China….

http://www.bbc.co.uk/news/uk-politics-22795226

The Changing and Terrifying Nature of the New Cyber-Warfare
“The sky is falling, the sky is falling….!

http://www.vanityfair.com/culture/2013/07/new-cyberwar-victims-american-business

Cyberthreats: Welcome to the New Cold War
http://www.cnbc.com/id/100792398

Spooks nicking your tech? What you need is THE CLOUD – NSA boss •

http://www.theregister.co.uk/2013/06/05/nsa_cycon_keynote/

US Cyber Command Redefines the Art of incompetence

http://www.afcea.org/content/?q=node/11117

Soldiers and spies

http://afpak.foreignpolicy.com/posts/2013/06/06/soldiers_and_spies

Fear the cyber enemy within or without?
http://www.bbc.co.uk/news/business-22812922

U.S. Veterans Affairs Dept. repeatedly targeted by foreign hackers
Yet the US National Security Agency (NSA) collects data on US citizens worried about terrorism…who is in charge?

http://www.net-security.org/secworld.php?id=15015

Semper Fi;

謝謝
紅龍

Guest Blog Post: Less Pwn, More Help!

Posted on by
5

By: Mick Douglas (@bettersafetynet)

The client looked at us from across the table, grimacing as they gulped the foul coffee (sure it’s awful, but hey it’s a free perk!).  They leaned in and said conspiratorially “So can you… umm… sort of… help us get the inside scoop on how we can pass this pentest?” 

I pause and close my eyes for a second.  I’ve heard pleas like this throughout my career.  If you’re a veteran pentester, no doubt you have too.  And what I always think… no matter how large or small the client…  Nobody passes pentests!   It’s their turn to suffer under our boot as we hijack the network and have shells fall down on us like rain.  Nobody… nobody passes a pentest.  There’s always a way in.  Once we’re in, we make their worst nightmares come alive right under their own nose!  No, pentests aren’t for passing.  They’re to be endured.
 
Strong though the predatory instinct is, I must push it aside.  The “pop ’em all” approach — while immensely fun — is not the way of the true pentester.  All too often InfoSec practitioners focus on the technical aspect of the pentest.  If you’re reading this site, chances are good you’re a techie… not a suit.  So unless fate has given you a tour of duty on the other side of the table, you have no idea what hell you’re about to bring to someone who’d rather be doing anything else than deal with you — the pentester.  Things are about to get ugly, and your shell count has nothing to do with it.  You are about to turn their world upside down in ways you cannot begin to fathom.
 
It doesn’t matter if you’re internal, external, a consultant… whatever… you are the enemy.. and not in the way you think.  Sure, you’re the “enemy” as The Almighty Red Team here to cause mayhem and pop boxes.  However, what you might not realize is that the havoc is just getting started once you leave the engagement.  Next to nobody will remember the pivots, the recon, or the OSINT you did.  None of that really matters… What they will remember is that “Jake the InfoSec Guy” failed at his job — miserably. But wait there’s more!  Not only did he fail, but someone — who doesn’t know our systems — was able to use freely available tools from the internet to compromise our entire network!! To make matters worse, it was done in under a week!! It’s a safe bet that soon the client will look at the budget spent on firewalls, AV, IDS, even the salaries — everything — and think “All this spending… for what? They brushed aside our best efforts as if they were nothing more than cobwebs!”
 
If all your client gets out of your pentest is that they’ve got a crappy infosec program, then know what? You’re a crappy pentester.  

You may hate to hear this, but you *owe* your client.  
 
You need to give them a complete assessment which checks for multiple paths to the victory conditions.
 
You need to give them reports which are understandable, actionable, and brief.
 
You need to teach them what you did so they can re-test for themselves.
 
You have to show what’s wrong, but also give them multiple options on how to fix, remediate, or compensate for the findings.
 
You need to offer “quick win” fixes so the infosec program can start rebuilding their credibility after you clipped their wings.
 
You need to give them suggestions on how to alter business operations to better avoid risks altogether.
 
You need to give them a road map on how to get better tomorrow… and the next day after.
 
You need to give and give.
 
Most of all, you need to give them hope.
 

About the Author:

Mick Douglas (twitter.com/bettersafetynet) does R&D, PenTesting, and profesional services for Diebold Inc.  When he’s not doing tech stuff, he’s off in the woods somewhere hiking or trying — mostly in vain — to improve his photography chops.

Thanks to Mick for contributing. I think he’s right on with what we need to do as penetration testers. — Brent Huston

People’s Republic of Hacking…

Posted on by
Reply

Good day –

Here is a summary of the latest cyber threat situational awareness you should be read in on if our are serious about securing your enterprise against malevolent cyber threats from the People’s Republic of Hacking…

People’s Republic of China attempts to take high ground over US cyberattacks – Telegraph

http://www.telegraph.co.uk/technology/news/10101227/China-attempts-to-take-high-ground-over-US-cyberattacks.html

Report: People’s Republic of China IP theft now equal in value to US exports to Asia • The Register

http://www.theregister.co.uk/2013/05/23/us_government_report_chinese_ip_theft/

British MPs raise alarm over Chinese equipment in UK phone networks
It is waaay too late the United Kingdom has already been colonized by the People’s Republic of China…”Committee flags up fears that telecoms firm Huawei could be involved in spying or cyber-attacks”

http://www.guardian.co.uk/technology/2013/jun/06/chinese-equipment-uk-phone-networks-huawei

Cyber experts say calling out People’s Republic of China may be working
Or…causing the People’s Republic of Hacking to make counter accusations against the United States…remember an ‘expert’ is a drip under pressure…

http://www.detroitnews.com/article/20130605/NATION/306050346/1020/rss09

People’s Republic of Hacking…WIDE CHINA PUSH IS SEEN TO OBTAIN INDUSTRY SECRETS |

http://newsle.com/article/0/78110562/

People’s Republic of China Seen in Push to Gain Technology Insights

http://www.nytimes.com/2013/06/06/world/asia/wide-china-push-is-seen-to-obtain-industry-secrets.html?

Chinese Internet Chief, Huang Chengqing, (CNCERT) Hits Back At US Hacking Accusations |

http://www.techweekeurope.co.uk/news/chinese-internet-chief-us-hacking-accusations-118233?

People’s Republic of China is victim of hacking attacks – News – China Daily Asia
Huang Chengqing, director of the National Computer Network Emergency Response Technical Team/Coordination Centre of China (CNCERT), states emphatically that the United States is the aggressor against the People’s Republic of China…

http://www.chinadailyasia.com/news/2013-06/05/content_15075474.html

People’s Republic of China cyber security chief makes US hacking claim – E & T Magazine
Huang Chengqing, director of the National Computer Network Emergency Response Technical Team/Coordination Centre of China (CNCERT), said it would be irresponsible to blame Washington for such attacks and called for greater cooperation to fight hacking.

http://eandt.theiet.org/news/2013/jun/china-ushack.cfm

Chinese Supercomputer Poised to Take No. 1 Ranking – China Digital Times (CDT)

http://chinadigitaltimes.net/2013/06/chinese-supercomputer-poised-to-take-no-1-ranking/?

The People’s Republic of China is not the world’s other superpower [Washington Post]

http://wanderingchina.org/2013/06/06/china-is-not-the-worlds-other-superpower-washington-post-risingchina-sinous/

Dell opens a new factory in People’s Republic of China – E & T Magazine
Embedded Chinese Hacking Code installed without additional cost…

http://eandt.theiet.org/news/2013/jun/dell-china.cfm

A method for “temporal cloaking” of optical communications could improve security for telecommunications.
http://eandt.theiet.org/news/2013/jun/temp-cloak.cfm

Enjoy!

Semper Fi…

謝謝
紅龍

InfoSec, The World & YOU Episode 2

Posted on by
Reply

Once again, Victoria Lowengart (@gisobiz) and I team up to discuss events in the real world and how they impact cyber threats. This time around we talk North Korea, Anonymous and touch on Industrial Control Systems. We also give a quick preview of Op Petrol. Check it out here:

Grab the MP3.

Thanks for listening and until next time, stay safe out there! 

People’s Republic of Hacking…Latest Cyber Threat SA…

Posted on by
Reply

Good day folks, here’s the most current People’s Republic of Hacking…Latest Cyber Threat SA…

People’s Republic of Hacking: Chinese Hackers Behind ‘NetTraveller’ Global Cyber Surveillance

http://www.techweekeurope.co.uk/news/chinese-hackers-nettraveller-global-cyber-surveillance-118140?

People’s Republic of China has ‘mountains of data’ about U.S. cyber attacks: official

http://www.reuters.com/article/2013/06/05/us-china-usa-hacking-idUSBRE95404L20130605

People’s Republic of China is victim of hacking attacks – People’s Daily Online
Incredible Infographic about the People’s Republic of China as a victim of hacking….

http://english.peopledaily.com.cn/90883/8271052.html

How the People’s Republic of China’s ZTE is winning the US market – People’s Daily Online

http://english.peopledaily.com.cn/90778/8270807.html

Global IT and techno-jingoism – People’s Daily Online

http://english.peopledaily.com.cn/90778/8270803.html

This week Barack Obama must avoid the start of a cold war with People’s Republic of China
Guess no one told the Guardian that the Cold War with the People’s Republic of China started months ago…

http://www.guardian.co.uk/commentisfree/2013/jun/05/obama-china-superpower-decline

Shaming Chinese hackers won’t work because cyber-espionage is here to stay

http://www.guardian.co.uk/commentisfree/2013/may/30/china-hacking-cyber-espionage-obama?INTCMP=ILCNETTXT3487

People’s Republic of Siamese Copycats: Lei Jun Builds His Xiaomi Empire by Aping Apple and Steve Jobs

http://www.nytimes.com/2013/06/05/business/global/in-china-an-empire-built-by-aping-apple.html?partner=rssnyt&emc=rss&_r=0&pagewanted=all

People’s Republic of Hacking: Cyber-attacks likely to take centre stage when Obama and Xi meet in California

http://www.guardian.co.uk/world/2013/jun/04/obama-xi-cyberattacks-california-summit

Michelle Obama ‘snubs’ China’s first lady

http://www.telegraph.co.uk/news/worldnews/michelle-obama/10100017/Michelle-Obama-snubs-Chinas-first-lady.html

Cyber Command Redefines the Art | SIGNAL Magazine

http://www.afcea.org/content/?q=node%2F11117

Enjoy –

Semper Fi,

謝謝
紅龍

International Cyber Threat Situational Awareness…

Posted on by
Reply

Good morning Folks;

Here is a very comprehensive list of the latest International Cyber Threat Situational Awareness…

Silicon Valley at front line of global cyber-war…People’s Republic of China dominates US

http://gadgets.ndtv.com/internet/news/silicon-valley-at-front-line-of-global-cyber-war-375258

China’s military to drill on digitalized forces – Xinhua | English.news.cn

http://news.xinhuanet.com/english/china/2013-05/29/c_132415053.htm

OP Middle Kingdom: PLA joint cyberwarfare drill to show new strength and sophistication
The People’s Liberation Army will conduct its first joint combat drills involving cyberwarfare, special troops, army aviation and electronic countermeasures units next month to test the integration and co-ordination of its land and air forces, state media reported yesterday.

http://asitimes.blogspot.com/2013/05/pla-joint-cyberwarfare-drill-to-show.html

People’s Republic of China Developing ‘Digital’ Military Forces

http://www.thetelecomblog.com/2013/05/30/china-developing-digital-military-forces/

PLA joint cyberwarfare drill to show new strength and sophistication

http://www.scmp.com/news/china/article/1249255/pla-prepares-massive-drill-show-its-new-strength-and-sophistication

Chinese army to include digital forces in June military drill
The drill will be carried out in late June at the Zhurihe training base in North China’s Inner Mongolia autonomous region, which is the country’s largest military field, it said. Forces from the Beijing Military Area Command, as well as eight military academics will be participating.

http://www.zdnet.com/cn/chinese-army-to-include-digital-forces-in-june-military-drill-7000016008/

People’s Republic of China Doesn’t Care if Its ‘Digitalized’ Military Cyberwar Drill Scares You

http://www.theatlanticwire.com/technology/2013/05/china-cyberwar-drill/65678/

People’s Republic of China army to conduct first digital exercise

http://www.reuters.com/article/2013/05/29/us-china-defence-idUSBRE94S03O20130529

People’s Republic of China army to conduct first “digital” exercise

http://news.yahoo.com/china-army-conduct-first-digital-exercise-022542367.html

People’s Republic of China’s Huawei Denies Involvement in US Cyber-Attacks

http://www.thetelecomblog.com/2013/05/10/huawei-denies-involvement-in-us-cyber-attacks/

People’s Republic of China’s Huawei Security Chief: We Are the Most “Poked” Company in the World

http://news.softpedia.com/news/Huawei-Security-Chief-We-Are-the-Most-Poked-Company-in-the-World-356340.shtml

People’s Republic of China Denies Stealing New ASIO Headquarters Plans
Chinese military spokeswoman says ” we have already colonized Australia, why would we steal anything?”

http://news.softpedia.com/news/China-Denies-Stealing-New-ASIO-Headquarter-Plans-356487.shtml

People’s Republic of China’s digitalized troops begin to take shape – People’s Daily

http://english.peopledaily.com.cn/90786/8245879.html

People’s Republic of China willing to hold dialogues with U.S. on cyber security – People’s Daily

http://english.peopledaily.com.cn/90786/8269498.html

People’s Republic of China’s Doublethink on the Law of the Sea

http://thediplomat.com/the-naval-diplomat/2013/06/05/chinas-doublethink-on-the-law-of-the-sea/?

Tiananmen Square online searches censored by Chinese authorities

http://www.guardian.co.uk/world/2013/jun/04/tiananmen-square-online-search-censored

People’s Republic of China signals hunger for Arctic’s mineral riches
Operation Middle Kingdom focuses on further colonization of Iceland and eventually most of Scandinavia including Norway….

http://www.guardian.co.uk/environment/2013/jun/04/china-arctics-mineral-riches

Xi Jinping’s Chinese Dream
People’s Republic of China’s President Xi Jinping decsribes Operation Middle Kingdom as the reformist/nationalist view aka The Chinese Dream

http://www.nytimes.com/2013/06/05/opinion/global/xi-jinpings-chinese-dream.html?partner=rssnyt&emc=rss&_r=0&pagewanted=all

Soft Power? The People’s Republic of China Has Plenty
Great article defining Operation Middle Kingdom and the colonization of Australia, British Isles and Canada….

http://thediplomat.com/2013/06/04/soft-power-china-has-plenty/?all=true

TAIWAN: President Ma takes part in computerized war games

http://www.chinapost.com.tw/taiwan/national/national-news/2013/05/29/379836/President-Ma.htm

Commentary: People’s Republic of China should publish report on U.S. military power – People’s Daily

http://english.peopledaily.com.cn/90786/8244270.html

People’s Republic of China, Canada sign initiative on military cooperation – People’s Daily
OP Middle Kingdom – the People’s Republic of China now successful in adding Canada as the latest country to be colonized…United Kingdom and Australia have already initiated mandatory “Learn Chinese” courses…

http://english.peopledaily.com.cn/90786/8269530.html

Chinese defense minister meets Canadian Minister of National Defence – People’s Daily

http://english.peopledaily.com.cn/90786/8268981.html

Intellectual property theft detection is the best prevention

http://www.scmagazineuk.com/intellectual-property-theft–detection-is-the-best-prevention/article/295643/

IT security: M&A transactions are a different matter

http://www.scmagazineuk.com/it-security-ma-transactions-are-a-different-matter/article/295689/

American Gets Targeted by Digital Spy Tool Sold to Foreign Governments

http://www.wired.com/threatlevel/2013/06/spy-tool-sold-to-governments/

Google believes zero-day vulnerabilities should be responded to within a week

http://www.scmagazineuk.com/google-believes-zero-day-vulnerabilities-should-be-responded-to-within-a-week/article/295641/

DEFEATING INTERNET BLOCKING WITH LAHANA VPN-TOR BRIDGE

http://threatpost.com/defeating-internet-blocking-with-lahana-vpn-tor-bridge/

Microsoft to offer threat data in ‘near real-time’ to Certs and ISPs

http://www.scmagazineuk.com/microsoft-to-offer-threat-data-in-near-real-time-to-certs-and-isps/article/295448/

Semper Fi,

謝謝
紅龍

Ask the Experts: Travel Abroad with Electronics

Posted on by
6

This time around, a reader wrote in with a very common question:

Q: “A member of my management team is about to go on a business trip to a country with known cyber-spying capabilities. She wants to take her phone, tablet and laptop so she can be productive on the road. What can I do to make this safer for her and our organization without restricting her work capability on the road in an unreasonable manner?”

Adam Hostetler opened with: 

The standard here is don’t bring anything electronic, if you can help it. In most cases, that’s not probable so don’t bring your normal personal phones or laptops, no smartphone at all is advisable. Bring loaner devices that have only exactly what they need and can be burned when they get back. Only connect through a VPN, and have that account monitored on the other end. Don’t leave phone or laptop in a hotel room, even in the safe, and don’t talk business there either.

Jim Klun added:

There is likely no way to do this without restricting – or at least significantly changing – the way she works. 

It has to be assumed that any information on her personal devices will be compromised. 
It also can be assumed that any information flowing between her devices and the outside world will be compromised. 

I would recommend two things:

1. Take only what you can afford to lose. Communicate only what you can afford to lose. 

        So – take a small number of devices (e.g. phone, laptop) minimally configured with only that information absolutely required for this trip. 
        Better to have corporate staff respond to email requests from her rather than to allow access to critical corporate resources from suspect location. 
        If internal connectivity to corporate resources must be allowed ( e.g VPN) it should be ideally require 2-factor auth of some sort, use strong encryption, and grant access only to a limited subset of resources. 
        All credentials can be assumed to be lost – hence the utility of two-factor.  All of the employees credentials should be changed on return. 

        All devices brought back should be assumed to be compromised and will need complete re-imaging. 
                

2.  Consider creating “go-kits” and well-defined repeatable processes for employees who travel to such locations. 

     A special set of devices ( laptop, phone, etc) that are minimally configured and can be wiped on return.  No personally owned devices should be allowed. 
     Connectivity for those devices – if absolutely needed – that allows access only to a tightly restricted and monitored subset of internal corporate resources. 
     Most importantly – training for employees who make these trips.  The employee must understand the special risks being incurred and be aware of their responsibility to protect the company and the companies existing customers.   
      As above – all of the employees credentials should be changed on return.

Bill Hagestad summed it up with this: 

This one is near and dear to my heart…I call these rules of counter cyber espionage the  李侃如的中國旅遊規則 (Lieberthal’s China Travel Rules)

Cellphone and laptop @ home brings “loaner” devices, erased before he leaves home country & wiped clean immediately upon returns;

In China, disable Bluetooth & Wi-Fi, phone never out of his sight;

In meetings, not only turn off his phone but also remove battery, microphone could be turned on remotely;

Connect to the Internet only via encrypted, password-protected channel, copies & pastes his password from a USB thumb drive;

Never type in a password directly, “the Chinese are very good at installing key-logging software on your laptop.”

The article can be found @ http://www.nytimes.com/2012/02/11/technology/electronic-security-a-worry-in-an-age-of-digital-espionage.html?pagewanted=all

Brent Huston closed with:

Any electronic items they do take on the road with them should be current on patches, AV signatures and detection capabilities. All data, drives, systems, etc. should be strongly encrypted when possible to do so (Pay special attention to export restrictions on crypto depending on where they are going.) Also, turn and burn EVERYTHING when they come back. Treat all media and data obtained during the travel as suspicious or malicious in nature. Trojans of data and documents are common (and usually they scan as clean with common tools). This is especially true for high value targets and critical infrastructure clients. Trust us! Safe travels! 

李侃如的中國旅遊規則

(Lieberthal’s China Travel Rules)


ØCellphone and laptop @ home brings “loaner” devices, erased before he leaves home country & wiped clean immediately upon returns;
ØIn China, disable Bluetooth & Wi-Fi, phone never out of his sight;
ØIn meetings, not only turn off his phone but also remove battery, microphone could be turned on remotely;
ØConnect to the Internet only via encrypted, password-protected channel, copies & pastes his password from a USB thumb drive;
ØNever types in a password directly, “the Chinese are very good at installing key-logging software on your laptop.”

Global Cyber Threat Intelligence…Holy Crap All This on a Monday…?!

Posted on by
1

Good morning Folks..Global Cyber Threat Intelligence…Holy Crap All This on a Monday…?! All this and a bag of chips…

People’s Republic of China’s digitalized troops begin to take shape
http://english.peopledaily.com.cn/90786/8245879.html

What to Expect June 4, People’s Republic of China’s Unofficial and Orwellian ‘Internet Maintenance Day’
http://www.techinasia.com/june-4-china-unofficial-orwellian-internet-maintenance-day/

People’s Republic of China’s Government is Stifling Tech Innovation and Prolonging Social Problems
http://www.techinasia.com/chinas-government-stifling-tech-innovation-prolonging-social-problems/

Raspberry Pi: Beating the Censorship of The People’s Republic of China’s Great Firewall
http://www.techinasia.com/censorship-china-great-firewall-raspberry-pi/

US & People’s Republic of China to discuss cybersecurity at high-level diplomatic meetings
United States is next target of OP Middle Kingdom…colonization by the People’s Republic of China….
http://www.guardian.co.uk/world/2013/jun/02/us-china-cybersecurity-hacking-espionage-meetings

US Sec Def Chuck Hagel accuses People’s Republic of China of ‘cyber intrusions’ on US
Didn’t Hagel get the memo from POTUS…?
http://www.telegraph.co.uk/news/worldnews/asia/china/10092909/Chuck-Hagel-accuses-China-of-cyber-intrusions-on-US.html

What happens when People’s Republic of China hacks U.S. weapons designs?
http://killerapps.foreignpolicy.com/posts/2013/05/31/what_happens_when_china_hacks_us_weapons_designs

People’s Republic of China, US agree to talks on cyber theft and espionage
http://www.theage.com.au/it-pro/security-it/china-us-agree-to-talks-on-cyber-theft-and-espionage-20130602-2nk06.html

Hackers Are Spying On You: Inside the World of Digital Espionage
http://www.thedailybeast.com/newsweek/2013/05/29/hackers-are-spying-on-you-inside-the-world-of-digital-espionage.html

Hagel says Chinese cyberattacks a “growing threat” People’s Republic of China |
http://www.homelandsecuritynewswire.com/dr20130603-hagel-says-chinese-cyberattacks-a-growing-threat

US Cyber Chief: Military Is Unprepared for Hacking
http://thediplomat.com/the-editor/2013/05/31/us-cyber-chief-military-is-unprepared-for-hacking/?

Government-developed standards not an effective cybersecurity approach..Hire the People’s Republic of China
http://www.homelandsecuritynewswire.com/dr20130602-governmentdeveloped-standards-not-an-effective-cybersecurity-approach-analyst

Why the US needs People’s Republic of China’s Huawei more than Huawei needs the US
http://gigaom.com/2013/05/31/why-the-us-needs-huawei-more-than-huawei-needs-the-us/

Australian Defence electronics manufacturer hacked by Chinese
http://www.manmonthly.com.au/features/defence-electronics-manufacturer-hacked-by-chinese

If Britain wants greater prosperity, we need to look East to People’s Republic of China
United Kingdom colonization by People’s Republic of China is now complete…OP Middle Kingdom
http://www.telegraph.co.uk/news/worldnews/asia/china/10092754/If-Britain-wants-greater-prosperity-we-need-to-look-East-to-China.html

Kuwait Commercial and government enterprise market key to Huawei’s growth in 2013 | Huawei Technologies
http://www.ameinfo.com/kuwait-commercial-government-enterprise-market-key-344164

Los Alamos director: cyber-securing U.S. electrical grid key to energy security
http://www.homelandsecuritynewswire.com/dr20130602-los-alamos-director-cybersecuring-u-s-electrical-grid-key-to-energy-security

An Elizabethan Cyberwar
http://www.nytimes.com/2013/06/01/opinion/an-elizabethan-cyberwar.html?src=recg

A Fierce Domain: Conflict in Cyberspace, 1986 to 2012 | Atlantic Council
http://www.acus.org/afiercedomain

U.S. & People’s Republic of China to Hold Regular Talks on Hacking
http://www.nytimes.com/2013/06/02/world/asia/us-and-china-to-hold-talks-on-hacking.html?src=recg

People’s Republic of China Rapidly Taking Over World Economically
http://www.newsmax.com/Newsfront/chine-buying-corporations-economic/2013/06/02/id/507585

People’s Republic of China Reaps Biggest Benefits of Iraq Oil Boom
http://www.nytimes.com/2013/06/03/world/middleeast/china-reaps-biggest-benefits-of-iraq-oil-boom.html?

People’s Republic of China And The Biggest Territory Grab Since World War II
http://www.forbes.com/sites/gordonchang/2013/06/02/china-and-the-biggest-territory-grab-since-world-war-ii/

People’s Republic of China’s Economic Empire
http://www.nytimes.com/2013/06/02/opinion/sunday/chinas-economic-empire.html?_r=2&pagewanted=all

How to Play Well With People’s Republic of China
http://www.nytimes.com/2013/06/02/opinion/sunday/how-to-play-well-with-china.html?_r=0&smid=tw-share&pagewanted=all

China Voice: Pentagon report deviates from building trust – People’s Daily Online
http://english.peopledaily.com.cn/90786/8237325.html

People’s Republic of China skeptical of expanded US role in the Pacific
http://www.apnewsarchive.com/2013/China-questions-expanded-US-role-in-the-Pacific;-Hagel-warns-Beijing-on-computer-based-attacks/id-526b8c8f680443d9ac415836133521be

Chinese navy begins US economic zone patrols – FT.com
US Navy Admiral Samual Locklear says”It is ok the PLAN is patrolling, we encourage them to do that, especially since we are not under he OSD Sequester and have US Marines aboard our flat bottom amphibs”….
http://www.ft.com/intl/cms/s/0/02ce257e-cb4a-11e2-8ff3-00144feab7de.html

Chinese general reveals ‘strategy’ for Panatag takeover
Major General Zhang Zhaozhong reflects on US Navy Admiral Samual Locklear comments “It is ok the PLAN is patrolling, we encourage them to do that, especially since we are not under he OSD Sequester and have US Marines aboard our flat bottom amphibs”….
http://www.philstar.com/headlines/2013/05/31/948591/chinese-general-reveals-strategy-panatag-takeover?

People’s Republic of China accused the U.S. of interfering in China’s internal affairs by the June incident
中国指责美国借六四事件干涉中国内政 – 中国数字时代
https://kexueshangwang.info/chinese/2013/06/bbc-中国指责美国借六四事件干涉中国内政/?

People’s Republic of China’s Ministry of Truth: Japan-Africa, South China Sea – China Digital Times (CDT)

Ministry of Truth: Japan-Africa, South China Sea

People’s Republic of China warns U.N. against ‘irresponsible remarks’ on North Koreans | Reuters
http://uk.reuters.com/article/2013/06/03/uk-korea-north-china-idUKBRE9520AB20130603

China-North Korea Dossier No. 2: “China’s ‘Measure of Reserve’ toward Succession”

China-North Korea Dossier No. 2: “China’s ‘Measure of Reserve’ toward Succession”

Hacking the Drone War’s Secret History
http://www.wired.com/dangerroom/2013/05/drone-api/

Hackers Spawn Web Supercomputer on Way to Chess World Record
http://www.wired.com/wiredenterprise/2013/06/43651/

USSR’s old domain name attracts cybercriminals
http://news.yahoo.com/ussrs-old-domain-name-attracts-cybercriminals-070143935.html

U.S. Targets Iran’s Petrochemical Industry
http://www.nytimes.com/2013/06/01/world/middleeast/us-targets-irans-petrochemical-industry.html?src=recg

Iran prepared to counter US cyber threats: Lawmaker
http://www.presstv.ir/detail/2013/06/01/306540/iran-ready-to-counter-us-cyber-threats/

Marine Corps prepares to cut cord on NMCI…NON MISSION CAPABLE INTERNET…
http://www.federalnewsradio.com/412/3342421/Marine-Corps-prepares-to-cut-cord-on-NMCI

Back to the Basics: Chess, Poker & the Future of Warfare
http://smallwarsjournal.com/jrnl/art/back-to-the-basics-chess-poker-the-future-of-warfare

Interpol filter scope creep: ASIC ordering unilateral website blocks

Interpol filter scope creep: ASIC ordering unilateral website blocks


Anticipating Cyber Threats Beyond APT
http://blog.zeltser.com/post/50497161014/anticipating-cyber-threats-beyond-apt

Semper Fi,

謝謝

紅龍