Sunday, February 11, 2018

Four things we learned when Facebook, Google, Twitter testified in Russia inquiry | ZDNet

Four things we learned when Facebook, Google, Twitter testified in Russia inquiry | ZDNet

Four things we learned when Facebook, Google, Twitter testified in Russia inquiry

capitoldome111116getty.jpg

(Image: File photo)

Tech giants Facebook, Google, and Twitter testified for the first time to senators on Tuesday as part of an ongoing congressional investigation into Russian meddling in the 2016 election.

Representatives from the three tech titans spoke to what they know about alleged Russian interference using their platforms to buy ads, promote stories, and spread misinformation in an effort to influence the outcome of the election.

All three company representatives agreed with the intelligence community's assessment that the Kremlin was instrumental in launching propaganda operations against the US before and during the election period, they confirmed.

Read also: Cyberwar and the Future of Cybersecurity | Video: How Russia and other state actors hack social media | More from CNET: Facebook, Twitter aim to dodge regulators by regulating themselves | Google: Russian groups did use our ads and YouTube to influence 2016 elections | Twitter bans Russian media companies from advertising on its platform | Facebook, Google, Twitter execs to testify at Russia hearings | TechRepublic: Facebook splitting news feed could force companies to re-think social media marketing

One of the likely end-game outcomes for lawmakers is to push legislation, notably the Honest Ads Act, to increase advertising transparency to help counter the effects of foreign governments and so-called troll farms. That includes the notorious Kremlin-based Internet Research Agency (IRA), a key instrument used by the Russian state to spread fake and false content during the election, lawmakers contend.

That said, not one of the company representatives would say if they would support the newly created draft legislation.

Here's what we learned from Tuesday's hearing:

FACEBOOK SAYS OVER 126 MILLION PEOPLE SAW RUSSIAN-PRODUCED POSTS IN THE RUN-UP TO THE ELECTION

Colin Stretch, Facebook's general counsel, said 29 million US-based Facebook users were served ads and other promoted content to their news feed from the IRA.

That's almost three-fold on the original figure that Facebook provided Congress earlier this year.

But because these posts were shared and promoted, the company said as many as 126 million users may have seen the ads -- accounting for more than half of its US user base. Many of the ads and promoted content were on highly charged political topics relating to gun ownership and LGBTQ+ and racial issues. Facebook said in its testimony that the total number of those illegitimate ads are a drop in the ocean -- less than 0.004 percent of all content -- or about 1 in 23,000 news feed items. But Stretch conceded that "any amount is too much."

The company said it deleted around 170 accounts on Instagram, which it owns, accounting for about 120,000 posts.

TWITTER REVEALS THOUSANDS OF ACCOUNTS ASSOCIATED WITH RUSSIAN ELECTION MEDDLING

In his published testimony, Sean Edgett, Twitter's acting general counsel, confirmed that 2,752 accounts were associated with the IRA, up from the initially reported 201 accounts previously identified.

Twitter has faced criticism for claims that it was slow to respond to deleting accounts associated with Russian meddling, per reports. Edgett's testimony said that some of the accounts were known about as early as 2015. Sen. Mark Warner (D-VA) criticized the social media giant at the time for not conducting a thorough initial investigation.

Those 2,752 accounts have all since been suspended from the service, Twitter said.

Out of more than 16 billion tweets, the company said about 1.4 million automated, election-related tweets received about 288 million impressions. Twitter stressed that the figure was a small proportion of overall election-related tweets -- less than 1 percent.

FACEBOOK SAYS IT STOPPED RUSSIA-BACKED "APT28" HACKERS TARGETING US POLITICAL PARTY EMPLOYEES

Facebook also confirmed for the first time that APT28, a Russian intelligence agency-backed hacking group, was using the social platform in the run-up to the election in an effort to target employees of major US political parties.

"We warned the targets who were at highest risk, and were later in contact with law enforcement authorities about this activity," said Stretch.

The hacking group, also known as "Fancy Bear," is notorious for state-sponsored campaigns and political meddling as part of the Kremlin's cyber-espionage programs. The group is thought to be responsible for the attacks on the Democratic National Committee (DNC) during last year's election, which led to thousands of emails from the Clinton campaign to be leaked and published online.

FireEye earlier this year revealed several attacks attributed to the group, using malware to target specific groups or individuals.

The relevance is important. Microsoft earlier this year sued the hacking group in an evidently one-sided legal battle, and won. The action allowed the company to seize domain names used to impersonate Microsoft by the hackers to spread malware.

GOOGLE SAYS IT SAW ONLY "LIMITED ACTIVITY" FROM RUSSIAN MEDDLING, BUT VOWS TO DO BETTER

Google's published and spoken testimony pointed to "limited activity" by Russian propagandists on its network and services, according to the company's senior counsel, Richard Salgado.

The search giant said it conducted a broad review of its ads network -- its primary money-maker -- dating back to mid-2015, but only two accounts were identified as connected to Russia-backed entities. Google also said it found 18 channels on YouTube with 1,100 videos dedicated to political content, of which only a fraction had more than a few thousand views. Salgado said the videos weren't targeted at anyone in particular, but were shared on other social media platforms. Many of those social accounts were set up using Gmail, said Salgado.

Salgado promised that the company will release a transparency report regarding election ads on top of its existing government data demands and takedown request reports.



Elyssa D. Durant 
Research &  Policy Analyst
 '

Dutch spies tipped off NSA that Russia was hacking the Democrats, new reports claim | ZDNet

Dutch spies tipped off NSA that Russia was hacking the Democrats, new reports claim | ZDNet



Dutch spies tipped off NSA that Russia was hacking the Democrats, new reports claim

aivd-zoetermeer-2.png

The Netherlands AIVD's access to the Russian hackers' networks yielded "crucial evidence" of Russian involvement in the Democratic leaks.

Image: AIVD

When hackers operating next to Moscow's Red Square launched an attack against the Democratic Party in 2015, someone was watching. And that someone, according to new reports, was the Dutch General Intelligence and Security Service (AIVD).

Netherlands newspaper de Volkskrant and the public broadcaster NOS reported on Thursday evening that AIVD hackers had penetrated the Russian operation back in the summer of 2014.

The Russian operation was what security researchers at CrowdStrike would later dub Cozy Bear, which, along with a separate group called Fancy Bear, emerged as the prime suspects for the hacking of the Democratic National Committee (DNC) during the 2016 presidential election campaign.

The emails covered communications spanning 2015 and the early months of 2016 and -- when they appeared on a site called DCLeaks and on Julian Assange's WikiLeaks in mid-2016 -- they greatly embarrassed the Democrats at a crucial time in the campaign.

Apart from reams of sensitive personal information, the emails demonstrated that the DNC had clearly favored the candidacy of Hillary Clinton during the Democratic primaries, and had undermined Bernie Sanders' bid to take on the Republicans from the left.

According to the new reports, the AIVD's access to the Russian hackers' networks yielded "crucial evidence" of Russian involvement in the DNC leaks, a matter that is now a key focus of special prosecutor Robert Mueller's investigation into possible collusion between Donald Trump's campaign and the Kremlin.

Download now: System update policy (free PDF)

What exactly did the Dutch spies learn about Cozy Bear, also known as APT29? The precise details remain a mystery for now, but Thursday's reports draw on six US and Netherlands sources to argue that the Russian operation was responsible for attacks around the world since 2010.

Targets included "governments, energy corporations and telecom companies", some of them in the Netherlands.

Cozy Bear apparently comprised around 10 active agents at most times. The AIVD managed to hack into the security camera watching those entering and leaving the hackers' room in a university building, which allowed the Dutch to figure out that Russia's Foreign Intelligence Service (SVR) was running the operation.

After the Dutch intelligence agency spotted the Russians hacking the US State Department and warned the NSA, a 24-hour-long battle between attackers and defenders reportedly ensued.

Before being booted out of the State Department's systems, the Russians managed to send a plausible-looking email to the White House, which in turn gave them access to servers holding some of then-president Barack Obama's emails.

In return for all this intelligence, the Americans reportedly sent some back to their Dutch counterparts, along with cake and flowers. However, the story has a sour ending.

With Trump denying any Russian support in his victory, US intelligence has been leaking like a sieve to prove the contrary. According to de Volkskrant, these leaks angered the Dutch, who didn't want their access -- now lost -- to be revealed, even if they were not specifically identified to the media as the source of all this crucial information.

As is the case with Israel and the UK, both of which have been burned by Trump himself after divulging intelligence to the US, the Dutch are now warier about sharing the secrets they find with the Americans.

Previous and related coverage

Four things we learned when Facebook, Google, Twitter testified in Russia inquiry

Tuesday's hearing in the Senate marks the first of several hearings involving the tech giants and how Russian-backed hackers and propagandists used their services to spread misinformation and false news.

Google: Russian groups did use our ads and YouTube to influence 2016 elections

Google, Facebook, and Twitter reveal how Russian agents reached millions of US voters before the 2016 election.

The hackers that never went away: Brace for more state-backed attacks, leaks and copycats this year

Attacks on the US presidential election might just be the beginning; expect more hacking and leaking this year across the globe.

US election hack: Microsoft wins latest round in court against Fancy Bear phishers

A US judge has banned the Fancy Bear hackers from attacking Microsoft's customers.

Democrats urge Facebook and Twitter to probe Russian bots (CNET)

Sen. Dianne Feinstein and Rep. Adam Schiff have asked the companies to investigate Russian involvement in the #ReleaseTheMemo social media campaign.



Elyssa D. Durant 
Research &  Policy Analyst
 '

DDoS mystery: Who's behind this massive wave of attacks targeting Dutch banks? | ZDNet

DDoS mystery: Who's behind this massive wave of attacks targeting Dutch banks? | ZDNet
As I was saying earlier...

DDoS mystery: Who's behind this massive wave of attacks targeting Dutch banks?

abnamroheadoffice.jpg

Amsterdam-headquartered ABN Amro was the first Netherlands bank to be hit, followed by Rabobank and ING Bank.

Image: ABN Amro

There is as yet no indication of who is behind the massive distributed denial of service (DDoS) attacks on Netherlands banks and government websites that ran from last weekend to Tuesday. Initial reports suggesting a Russian connection appear baseless.

The attacks began just a couple of days after media reports stated that Dutch intelligence tipped off their American counterparts about state-sponsored Russian spies hacking the apparatus of the Democratic Party and stealing the infamous "leaked emails" that may have swayed the 2016 election.

The publication NL Times reported that the Bratislava-based security company ESET had identified the attacks as coming from servers in Russia.

That fact would, of course, be less than solid evidence that Russian attackers are to blame, because DDoS attacks can bounce all over the place before finally hitting their target, always making attribution troublesome.

But when ZDNet contacted the security firm, it denied ever making a claim about a Russian connection. "This report about an ESET claim was an unfortunate mistake and misrepresentation by one Dutch news outlet and was corrected by them," spokesman Branislav Ondrasik said.

The bank ABN Amro became the first victim on Saturday, while Rabobank and ING Bank were hit on Monday, along with the Dutch Taxation Authority. All four were hit again on Tuesday, but this time their defenses reportedly fared better.

ABN Amro told ZDNet on Wednesday morning that the attack was "not ongoing at the moment". The bank stressed in an earlier statement that the DDoS did not threaten the security of its services -- it just knocked them out.

Read: Cybersecurity in 2018: A roundup of predictions

"This weekend's DDoS attacks were heavier than previous ones and lasted longer. At the moment, it is unknown who is behind the attacks, and in by far most cases, the source of an attack is never discovered," ABN Amro said.

Rabobank spokeswoman Margo van Wijgerden said most attacks on the company's servers did not have any impact on its clients. However, a DDoS that took place at 9.07am on Monday did stop customers from logging in for about 10 minutes. After that time, they still had issues with the connection for another couple of hours.

"Later Monday and yesterday there have been attacks, but without any impact," she said. "We are not aware of the identity of the attacker(s). We leave that to the police to investigate."

Police spokesperson Suzanne van de Graaf said the authorities could not share any information about ongoing investigations.

Previous and related coverage

Dutch spies tipped off NSA that Russia was hacking the Democrats, new reports claim

Netherlands intelligence penetrated Russia's US election hackers and alerted US counterparts, sources say.

Hacker jailed for DDoS attacks against Skype and Google

The 21-year-old has been jailed for running a botnet and selling malware in the Dark Web.

Read more on cybercrime



Elyssa D. Durant 
Research &  Policy Analyst
 '

Shared from Impersonated Wordpress Account

Blocked and Disabled my VPN. - https://wp.me/p1dFmO-6mI

Elyssa Durant
Columbia University

Saturday, February 10, 2018

Yahoo to Warn Users of State-Sponsored Attacks | Threatpost | The first stop for security news

Yahoo to Warn Users of State-Sponsored Attacks | Threatpost | The first stop for security news


Yahoo to Warn Users of State-Sponsored Attacks

Yahoo has announced it will follow in the footsteps of Twitter and Facebook and begin warning users when it believes their accounts have been targeted by a state-sponsored actor.

Bob Lord, who was hired as the company's new CISO in October, discussed the initiative in a blog post Monday.

Lord said Yahoo will only notify users only if it "strongly suspects" their account may have been targeted by a state-sponsored actor. From there it will give users a series of steps to take to verify their accounts are safe.












Those steps include default safety mechanisms Yahoo already offers, like turning on two-step verification, enabling a Yahoo account key, and maintaining a strong and unique password.

Lord stresses the warnings won't mean that Yahoo's systems have been compromised, or even that the users' account has been hacked necessarily, instead that the company suspects the user has been targeted.

Yahoo is the latest company to offer such notifications. In October Facebook announced that it would begin informing users when it believes their account is either targeted by an attacker or has been compromised by a nation-state campaign.

Just last week Twitter began rolling out notifications to a handful of users, including several connected to the privacy and security industry, that their accounts may have been targeted by state-sponsored hackers. Twitter claimed that hackers, possibly associated "with a government," were attempting to steal users' email addresses, IP addresses and phone numbers.

Twitter did not inform users how it arrived at this conclusion, and was a little vague when it came to telling users what to do next.

"The notification was not terribly helpful. The message states that my account may have been targeted, but it does not say much about what I can or should do next," Runa Sandvik, a privacy and security researcher who received a notification, told Threatpost last week.

Like Twitter and Facebook, Yahoo wouldn't specify exactly how it plans to know whether an attack is state-sponsored, citing security reasons.



"In order to prevent the actors from learning our detection methods, we do not share any details publicly about these attacks," Lord wrote, "However, rest assured we only send these notifications of suspected attacks by state-sponsored actors when we have a high degree of confidence."

"Distrust and caution are the parents of security" - Benjamin Franklin





^ed