wiredmikey shares a report from SecurityWeek: The ongoing multi-vendor investigations into the SolarWinds mega-hack took another twist this week with the discovery of new malware artifacts that could be used in future supply chain attacks. According to a new report, the latest wave of attacks being attributed to APT29/Nobelium threat actor includes a custom downloader that is part of a "poisoned update installer" for electronic keys used by the Ukrainian government. SentinelOne principal threat researcher Juan Andres Guerrero-Saade documented the latest finding in a blog post that advances previous investigations from Microsoft and Volexity. "At this time, the means of distribution [for the poisoned update installer] are unknown. It's possible that these update archives are being used as part of a regionally-specific supply chain attack," Guerrero-Saade said.

Major meat supplier JBS USA was the latest victim of an organized cybersecurity attack, with servers in North American and Australian affected, the company said Sunday. From a report: Why it matters: JBS USA is the largest producer of beef in the country, The Hill notes, and also is a major supplier of poultry and pork. The disclosure of the attack comes as cyber threats have picked up over the last year. Last month, Colonial Pipeline was taken offline by its operator because of a cyberattack.

In March, a cyber-espionage unit backed by the Chinese government resulted in 30,000 U.S. victims, including many small businesses and local governments. Earlier this year, the U.S. intelligence community assessed that Russia was responsible for the major SolarWinds attack. Nine federal agencies and more than 100 private sector groups were compromised in the attack, per the Hill.

Xiaomi's at it again: The company's new fast charging technology can get a smartphone from 0 to 100 percent battery in less than 8 minutes. From a report: The 200W wired charging tech, used on a modified Xiaomi MI 11 Pro with a 4,000mAh battery, gets the phone from 0-10% in just 44 seconds. The phone gets to 50% in 3 minutes, and it's fully charged in 7:57 minutes. In a YouTube video, Xiaomi also showcased its 120W wireless charging tech, which gets a smartphone with a 4,000mAh battery from 0 to 100 percent battery in 15 minutes.

Denmark's foreign secret service allowed the US National Security Agency to tap into a crucial internet and telecommunications hub in Denmark and spy on the communications of European politicians, a joint investigation by some of Europe's biggest news agencies revealed on Sunday. From a report: The covert spying operation, called Operation Dunhammer, took place between 2012 and 2014, based on a secret partnership signed by the two agencies. The secret pact, signed between the NSA and the Danish Defense Intelligence Service (Danish: Forsvarets Efterretningstjeneste, FE) allowed US spies to deploy a data interception system named XKeyscore on the network of Sandagergardan, an important internet and communications hub in the city of Dragor, near Copenhagen, where several key submarine cables connected Denmark (and continental Europe) to the Scandinavian peninsula.

The NSA allegedly used XKeyscore to mass-sniff internet and mobile traffic and intercept communications such as emails, phone calls, SMS texts, and chat messages sent to the phone numbers and email addresses of European politicians. The covert operation abruptly stopped in 2014 after Danish government officials learned of the NSA-FE collaboration following the Snowden leaks. Danish officials put a stop to the operation after they learned that the NSA had also spied on Danish government members.

One of the internet's foundations just got an upgrade. From a report: Quic, a protocol for transmitting data between computers, improves speed and security on the internet and can replace Transmission Control Protocol, or TCP, a standard that dates back to Ye Olde Internet of 1974. Last week, the Internet Engineering Task Force, which sets many standards for the global network, published Quic as a standard. Web browsers and online services have been testing the technology for years, but the IETF's imprimatur is a sign the standard is mature enough to embrace fully.

It's extremely hard to improve the internet at the fundamental level of data transmission. Countless devices, programs and services are built to use the earlier infrastructure, which has lasted decades. Quic has been in public development for nearly eight years since Google first announced Quic in 2013 as an experimental addition to its Chrome browser. But upgrades to the internet's foundations are crucial to keep the world-spanning communication and commerce backbone humming. That's why engineers spend so much effort on titanic transitions like Quic, HTTPS for secure website communications, post-quantum cryptography to protect data from future quantum computers, and IPv6 for accommodating vastly more devices on the internet.

In the latest SolarWinds mass-phishing attack, "The highest percentage of emails went to the United States, but [incident response firm] Volexity also saw a significant number of victims in Europe..." according to Security Week.

In an article shared by Slashdot reader wiredmikey, they note that the attackers apparently compromised the Constant Contact account of USAID, an independent agency of the United States federal government that is primarily responsible for administering civilian foreign aid and development assistance — and then impersonated it in emails "to roughly 3,000 accounts across over 150 organizations in 24 countries."

So what happens next?

The Associated Press reports: The White House says it believes U.S. government agencies largely fended off the latest cyberespionage onslaught blamed on Russian intelligence operatives, saying the spear-phishing campaign should not further damage relations with Moscow ahead of next month's planned presidential summit. Officials downplayed the cyber assault as "basic phishing" in which hackers used malware-laden emails to target the computer systems of U.S. and foreign government agencies, think tanks and humanitarian groups.

Microsoft, which disclosed the effort late Thursday, said it believed most of the emails were blocked by automated systems that marked them as spam. As of Friday afternoon, the company said it was "not seeing evidence of any significant number of compromised organizations at this time."

Even so, the revelation of a new spy campaign so close to the June 16 summit between President Joe Biden and Russian counterpart Vladimir Putin adds to the urgency of White House efforts to confront the Kremlin over aggressive cyber activity that criminal indictments and diplomatic sanctions have done little to deter. "I don't think it'll create a new point of tension because the point of tension is already so big," said James Lewis, a senior vice president at the Center for Strategic and International Studies. "This clearly has to be on the summit agenda. The president has to lay down some markers" to make clear "that the days when you people could do whatever you want are over."
There's a famous story about Vladimir Putin meeting Joe Biden back in 2011. A decade earlier former U.S. president George W. Bush had said when he'd looked Putin in the eye, "I was able to get a sense of his soul." But as Biden tells it, when he'd met Putin (who was then Russia Prime Minister), "I said, 'Mr. Prime Minister, I'm looking into your eyes, and I don't think you have a soul.'"

"He looked back at me, and he smiled, and he said, 'We understand one another.'"

it's high time for companies to start adding cybersecurity professionals to their teams, reports CNN. "The only hitch: There's a massive, longstanding labor shortage in the cybersecurity industry." "It's a talent war," said Bryan Orme, principal at GuidePoint Security. "There's a shortage of supply and increased demand."

Experts have been tracking the cybersecurity labor shortage for at least a decade — and now, a new surge in companies looking to hire following recent attacks could exacerbate the problem. The stakes are only growing, as technology evolves and bad actors become more advanced. In the United States, there are around 879,000 cybersecurity professionals in the workforce and an unfilled need for another 359,000 workers, according to a 2020 survey by (ISC)2, an international nonprofit that offers cybersecurity training and certification programs. Globally, the gap is even larger at nearly 3.12 million unfilled positions, the group says... The U.S. Bureau of Labor Statistics projects "information security analyst" will be the 10th fastest growing occupation over the next decade, with an employment growth rate of 31% compared to the 4% average growth rate for all occupations.

If demand for cybersecurity professionals in the private sector increases dramatically, some experts say talented workers could leave the government for more lucrative corporate jobs — a risk that is especially acute for smaller, local government agencies that manage critical infrastructure in their communities but have limited budgets. "Think of the criticality of what your local government does: water purification, waste treatment, traffic management, communications for law enforcement, public safety, emergency management," said Mike Hamilton, chief information security officer at Critical Insight. "But Amazon is out there waving around bags of cash to protect their retail operation." Hamilton — who was the former chief information security officer for Seattle, Washington, from 2006 to 2013 — added that local governments "cannot attract and retain these people when the competition for them is so high, which is why we've got to make lots of them."
The article notes educational training/up-skilling programs working to address the shortage, including GuidePoint, which helps train veterans leaving the military for cybersecurity careers. CNN also notes U.S. President Joe Biden's $2 trillion American Jobs Plan included $20 billion for state, local and tribal governments to update and improve cybersecurity controls for their energy systems.

"Still, experts say more needs to be done, suggesting a broad rethinking of education systems from elementary school through higher education to include more cybersecurity training."

Twitch has received a "batch" of new takedown notices from music publishers over copyrighted songs in recorded streams (known as VODs), the company said in an email to streamers today. From a report: The notice may be worrying for some streamers who were affected by the waves of takedowns that hit last year, because if a user gets three copyright strikes on their channel, they will be permanently banned from the platform, according to Twitch's policies. With this advance warning, it seems Twitch is trying to get ahead of a sudden flurry of takedowns and give streamers some time to remove potentially offending VODs.

"We recently received a batch of DMCA takedown notifications with about 1,000 individual claims from music publishers," Twitch said in an email Friday, which was sent to a Verge staffer. "All of the claims are for VODs, and the vast majority target streamers listening to background music while playing video games or IRL streaming." [...] In Friday's email, Twitch noted that the only way to avoid DMCA (or Digital Millennium Copyright Act) strikes is to not stream copyrighted material in the first place, and said that if a streamer does have unauthorized content in their VODs or clips, "we strongly recommend that you permanently delete anything that contains that material."

An anonymous reader shares a report: Last month, security firm FireEye detected a Chinese hacking campaign that exploited a zero-day vulnerability in Pulse Secure VPN appliances to breach defense contractors and government organizations in the US and across Europe. The hacking campaign allowed the threat actors -- two groups which FireEye tracks as UNC2630 and UNC2717 -- to install web shells on Pulse Secure devices, which the attackers used to pivot to internal networks from where they stole internal network credentials, email communications, and sensitive documents.

But in a follow-up report published today, FireEye said it found something strange -- namely that at least one of the groups involved in the attacks began removing its malware from infected networks three days before its researchers exposed the attacks. "Between April 17th and 20th, 2021, Mandiant incident responders observed UNC2630 access dozens of compromised devices and remove webshells like ATRIUM and SLIGHTPULSE," researchers said on Thursday. The threat actor's actions are highly suspicious and raise questions if they knew of FireEye's probing.

The hackers behind one of the worst data breaches ever to hit the US government have launched a new global cyberattack on more than 150 government agencies, think tanks and other organizations, according to Microsoft. ytene shares a report: The group, which Microsoft calls "Nobelium," targeted 3,000 email accounts at various organizations this week -- most of which were in the United States, the company said in a blog post Thursday. It believes the hackers are part of the same Russian group behind last year's devastating attack on SolarWinds -- a software vendor -- that targeted at least nine US federal agencies and 100 companies.

Cybersecurity has been a major focus for the US government following the revelations that hackers had put malicious code into a tool published by SolarWinds. A ransomware attack that shut down one of America's most important pieces of energy infrastructure -- the Colonial Pipeline -- earlier this month has only heightened the sense of alarm. That attack was carried out by a criminal group originating in Russia, according to the FBI. Microsoft said that at least a quarter of the targets of this week's attacks were involved in international development, humanitarian, and human rights work, across at least 24 countries. It said Nobelium launched the attack by gaining access to a Constant Contact email marketing account used by the US Agency for International Development.

Australian security researcher Troy Hunt announced today that he granted the US Federal Bureau of Investigation a direct line to upload new content into Have I Been Pwned, a website that indexes data from security breaches. From a report: The HIBP creator said that when the FBI discovers password collections during their investigations, they will upload the data into a section of the site called Pwned Passwords. The FBI will provide passwords as SHA-1 and NTLM hashes and not in plain text. No user personal details will be provided, but only the password hashes. The passwords will be added to Pwned Passwords, a collection of more than 613 million leaked passwords. While the main HIBP website allows users to search if their emails, names, or usernames have been leaked online in past security breaches, Pwned Passwords is a smaller and more specialized component of the HIBP site that tells users if a password string has ever been leaked online, without attaching the password to any user details.

Chinese-speaking hackers are masquerading as the United Nations in ongoing cyber-attacks against Uyghurs, according to the cybersecurity firms Check Point and Kaspersky. MIT Technology Review reports: Researchers identified an attack in which hackers posing as the UN Human Rights Council send a document detailing human rights violations to Uyghur individuals. It is in fact a malicious Microsoft Word file that, once downloaded, fetches malware: the likely goal, say the two companies, is to trick high-profile Uyghurs inside China and Pakistan into opening a back door to their computers. "We believe that these cyber-attacks are motivated by espionage, with the endgame of the operation being the installation of a back door into the computers of high-profile targets in the Uyghur community," said Lotem Finkelstein, head of threat intelligence at Check Point, in a statement. "The attacks are designed to fingerprint infected devices, including all of [their] running programs. From what we can tell, these attacks are ongoing, and new infrastructure is being created for what look like future attacks."

In addition to pretending to be from the United Nations, the hackers also built a fake and malicious website for a human rights organization called the "Turkic Culture and Heritage Foundation," according to the report. The group's fake website offers grants -- but in fact, anybody who attempts to apply for a grant is prompted to download a false "security scanner" that is in fact a back door into the target's computer, the researchers explained. "The attackers behind these cyber-attacks send malicious documents under the guise of the United Nations and fake human rights foundations to their targets, tricking them into installing a backdoor to the Microsoft Windows software running on their computers," the researchers wrote. This allows the attackers to collect basic information they seek from the victim's computer, as well as running more malware on the machine with the potential to do more damage. The researchers say they haven't yet seen all the capabilities of this malware. The researchers weren't able to determine an exact known hacking group, but the code in these attacks "was found to be identical to code found on multiple Chinese-language hacking forums and may have been copied directly from there," the report notes.

The Indonesian government has blocked access inside its borders to Raid Forums, a well-known cybercrime hub, in an attempt to limit the spread of a sensitive data leak. From a report: The ban, which the government wants internet service providers to implement, comes after a threat actor claimed in a Raid Forums post on May 12 to be in possession and selling the personal data of 279 million Indonesians. The threat actor, an individual known as Kotz, leaked a sample of one million citizens' details to prove their claims. The leaked data included citizen names, national ID numbers, tax registration information, mobile phone numbers, and for some citizens also came with headshots and salary-related information.

An anonymous reader quotes a report from ZDNet: VMware is urging its vCenter users to update vCenter Server versions 6.5, 6.7, and 7.0 immediately, after a pair of vulnerabilities were reported privately to the company. The most pressing is CVE-2021-21985, which relates to a remote code execution vulnerability in a vSAN plugin enabled by default in vCenter that an attacker could use to run whatever they wished on the underlying host machine, provided they can access port 443. Even if users do not use vSAN, they are likely to be affected because the vSAN plugin is enabled by default. "This needs your immediate attention if you are using vCenter Server," VMware said in a blog post.

The second vulnerability, CVE-2021-21986, would allow an attacker to perform actions allowed by plugins without authentication. "The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins," VMware said. In terms of CVSSv3 scores, CVE-2021-21985 hit an 9.8, while CVE-2021-21986 was scored as 6.5.

An anonymous reader quotes a report from CNBC: Nation states are serving as safe havens for sophisticated criminal cyber actors and that is leading to an "increased blending of the threat," said John Demers, assistant attorney general at the National Security Division at the Department of Justice, speaking on a CNBC Evolve livestream on Wednesday. He said that is also a reason to believe that DarkSide could be back, or is still operating under a new name.

"When nation states aren't doing their part to investigate and root out hacking activity happening within their borders, then any number of things could have been the answer to ... what happened to the DarkSide infrastructure including that ... they're just off renaming themselves, so we'll see." "Groups like that will come back," he added. "Probably Darkside itself, those actors that comprise that group, will be back if they're not already out there in other forms operating as we're talking about."

Michael Orlando, acting director of the National Counterintelligence and Security Center, said during the CNBC Evolve livestream that ransomware attacks on critical infrastructure rise to the level of national security threat and the "safe haven" aspect is one part of the cybersecurity riddle the government and business world will have to counteract. "We do know that countries like Russia and China, Iran and others certainly create safe havens for criminal hackers as long as they don't conduct attacks against them. But that's a challenge for us that we're going to have to work through as we figure out how to counter ransomware attacks." DarkSide received a total of $90 million in bitcoin ransom payments before shutting down. The hacker group coincidentally lost control of its web servers and some of the funds the day after President Joe Biden announced plans to disrupt the hackers.

AmiMoJo shares a report from Tom's Hardware: Asahi Linux developer Hector Martin has revealed a covert channel vulnerability in the Apple M1 chip that he dubbed M1RACLES, and in the process, he's gently criticized the way security flaws have started to be shared with the public. Martin's executive summary for M1RACLES sounds dire: "A flaw in the design of the Apple Silicon 'M1' chip allows any two applications running under an OS to covertly exchange data between them, without using memory, sockets, files, or any other normal operating system features. This works between processes running as different users and under different privilege levels, creating a covert channel for surreptitious data exchange. [...] The vulnerability is baked into Apple Silicon chips, and cannot be fixed without a new silicon revision."

He also noted that this was the result of an intentional decision on Apple's part. "Basically, Apple decided to break the ARM spec by removing a mandatory feature, because they figured they'd never need to use that feature for macOS," he explained. "And then it turned out that removing that feature made it much harder for existing OSes to mitigate this vulnerability." The company would have to make a change on the silicon level with its followup to the M1 to mitigate this flaw. But he also made it clear in the FAQ that Mac owners shouldn't be particularly worried about M1RACLES because that covert channel affects two bits. It can be expanded, and Martin said that transfer rates over 1 MB/s are possible "without much optimization," but any malicious apps that might take advantage of such methods would be far more likely to share information via other channels. Calling this a two-bit vulnerability would be both technically and linguistically correct. It's a real security flaw, sure, but it's unlikely to pose a real threat to Apple's customers.

App developer and scam app hunter Kosta Eleftheriou's latest discovery is a real doozy: an iOS app that refuses to function until you give it at least a 3-star review in the App Store. From a report: Although the UPNP Xtreme app -- which claimed to let users stream video to their TVs -- now appears to have been pulled, we were able to verify that it generates the App Store rating box the second it opens. You can't dismiss the ratings box, nor can you tap the 1 or 2-star ratings, Eleftheriou said. We verified this behavior, but some other users report they were able to dismiss the dialog box or leave a lower rating.

AmiMoJo writes: The USB-C standard will let you plug in power-hungry devices like gaming laptops, docking stations, 4K monitors and printers with an upgrade that accommodates up to 240 watts starting this year. The jump in maximum power is more than double today's 100-watt top capacity. The USB Implementers Forum, the industry group that develops the technology, revealed the new power levels in the version 2.1 update to its USB Type-C specification on Tuesday. The new 240-watt option is called Extended Power Range, or EPR. "We expect devices supporting higher wattages in the second half of 2021," USB-IF said in a statement.

USB began as a useful but limited port for plugging keyboards, mice and printers into PCs. It later swept aside Firewire and other ports as faster speeds let it tackle more demanding tasks. It proved useful for charging phones as the mobile revolution began, paving the way for its use delivering power, not just data. The 240W Extended Power Range option means USB likely will expand its turf yet again. Cables supporting 240 watts will have additional requirements to accommodate the new levels. And USB-IF will require the cables to bear specific icons "so that end users will be able to confirm visually that the cable supports up to...240W," USB-IF said in the specification document.

WhatsApp has sued the Indian government challenging the second largest internet market's new regulations that could allow authorities to make people's private messages "traceable," and conduct mass surveillance. From a report: The Facebook-owned instant messaging service, which identifies India as its biggest market by users, said it filed the lawsuit in the High Court of Delhi on Wednesday. It said New Delhi's "traceability" requirement -- which would require WhatsApp to help New Delhi identify the originator of a particular message -- violated citizens' constitutional right to privacy.

"Civil society and technical experts around the world have consistently argued that a requirement to 'trace' private messages would break end-to-end encryption and lead to real abuse. WhatsApp is committed to protecting the privacy of people's personal messages and we will continue to do all we can within the laws of India to do so," WhatsApp said in a statement. India first proposed WhatsApp to make software changes to make the originator of a message traceable in 2018. The suggestion came at a time when WhatsApp was grappling with containing spread of false information in India, where circulation of such information had resulted in multiple real-life casualties. But its suggestion didn't become the law until this year. Traceability requirement is part of New Delhi's sweeping IT rules that also require social media firms to appoint several officers in India to address on-ground concerns, and also gives authorities greater power over taking down posts it deems offensive. Further reading: India says WhatsApp's lawsuit over new regulations a clear act of defiance.

An anonymous reader quotes a report from The Record: Thousands of Google Chrome extensions available on the official Chrome Web Store are tampering with security headers on popular websites, putting users at risk of a wide range of web-based attacks. While they are a little-known technical detail, security headers are an important part of the current internet landscape. At a technical level, a security header is an HTTP response sent by the server to a client app, such as a browser. [...] In a paper presented at the MADWeb workshop at the NDSS 2021 security conference, researchers from the CISPA Helmholtz Center for Information Security said they tried to assess the number of Chrome extensions tampering with security headers for the very first time. Using a custom framework they built specifically for their study, the research team said they analyzed 186,434 Chrome extensions that were available on the official Chrome Web Store last year. Their work found that 2,485 extensions were intercepting and modifying at least one security header used by today's Top 100 most popular websites (as available in the Tranco list).

The study didn't focus on all security headers, but only on the four most common ones, such as: Content-Security Policy (CSP), HTTP Strict-Transport-Security (HSTS), X-Frame-Options, and X-Content-Type-Options. While 2,485 extensions disabled at least one, researchers said they found 553 disabling all the four security headers they analyzed in their research. The most commonly disabled security header was CSP, a security header that was developed to allow site owners to control what web resources a page is allowed to load inside a browser and a typical defense that can protect websites and browsers against XSS and data injection attacks. According to the research team, in most of the cases they analyzed, the Chrome extensions disabled CSP and other security headers "to introduce additional seemingly benign functionalities on the visited webpage," and didn't look to be malicious in nature. However, even if the extensions wanted to enrich a user's experience online, the German academics argued that by tampering with security headers, all the extensions did was to expose users to attacks from other scripts and sites running inside the browser and on the web.