• chevron_right

      Microsoft blamed for “a cascade of security failures” in Exchange breach report

      news.movim.eu / ArsTechnica · Wednesday, 3 April - 18:51

    Microsoft logo on a wide sign

    Enlarge (credit: Getty Images)

    A federal Cyber Safety Review Board has issued its report on what led to last summer's capture of hundreds of thousands of emails by Chinese hackers from cloud customers, including federal agencies. It cites "a cascade of security failures at Microsoft" and finds that "Microsoft's security culture was inadequate" and needs to adjust to a "new normal" of cloud provider targeting.

    The report , mandated by President Biden in the wake of the far-reaching intrusion, details the steps that Microsoft took before, during, and after the breach and in each case finds critical failure. The breach was "preventable," even though it cites Microsoft as not knowing precisely how Storm-0558, a "hacking group assessed to be affiliated with the People's Republic of China," got in.

    "Throughout this review, the board identified a series of Microsoft operational and strategic decisions that collectively points to a corporate culture that deprioritized both enterprise security investments and rigorous risk management," the report reads.

    Read 15 remaining paragraphs | Comments

    • Th chevron_right

      Government-Made Comic Books Try to Fight Election Disinformation

      news.movim.eu / TheIntercept · Monday, 25 March - 21:35 · 7 minutes

    With the 2024 elections looming, the Department of Homeland Security has a little-noticed weapon in its war on disinformation: comic books. Few have read them, but the series is attracting criticism from members of Congress. Calling the comics “creepy,” Rep. Dan Bishop, R-N.C., complained earlier this month that the Cybersecurity and Infrastructure Security Agency-produced series was just another way for the federal government to “trample on the First Amendment” in its zeal to fight so-called disinformation.

    “DC Comics won’t be adding these taxpayer-funded comic books … to their repertoire anytime soon,” cracked Kentucky Sen. Rand Paul’s annual report on government waste released in December.

    The comics read like well-meaning (if corny) attempts to grapple with efforts by foreign governments to influence American public opinion, as articulated in intelligence community assessments . But there is a risk that the federal government’s fight against foreign disinformation positions it as an arbiter of the truth, which raises civil liberties concerns. The efficacy of the DHS “Resilience Series” of comic books is also far from obvious.

    The members of Congress might be comforted to know that few people ever noticed the comics. The Cybersecurity and Infrastructure Security Agency urges users to “share” their “Resilience Series” comics, but a search of the webpage’s address on X shows that it is linked to fewer than a dozen times. CISA also produced glossy-looking YouTube trailers for its two graphic novels that garnered just 4,000 and 6,000 views respectively — a far cry from the hundreds of thousands of views trailers for other graphic novels attract.

    For CISA, disinformation is no laughing matter. “Disinformation is an existential threat to the United States,” declares CISA’s webpage detailing its “ Resilience Series ” of comic books.

    Third in sales by genre, only behind general fiction and romance novels, graphic novels are particularly popular among the youngest readers. One industry observer notes that in Japan, more paper is used for manga books than for toilet paper. School Library Journal concluded in their graphic novels survey last year that popularity increased over 90 percent year over year in school libraries. The survey also found that nearly 60 percent of school librarians reported opposition to graphic novels from teachers, parents, and others who didn’t consider them “real books.”

    Though first released in 2020 in anticipation of the Trump–Biden presidential election, the comics were intended to be an evergreen resource in the war on disinformation. “Learn the dangers & risks associated with dis- & misinformation through fictional stories that are inspired by real-world events in @CISAgov’s Resilience Series,” the U.S. Attorney for Nevada posted on X last April.

    CISA produced two graphic novels, “Real Fake” and “Bug Bytes.” “Real Fake” tells the story of Rachel O’Sullivan, a “gamer” and a “patriot” who infiltrates a troll farm circulating false narratives about elections to American voters. “Bug Bytes” addresses disinformation around Covid-19, following Ava Williams, a journalism student who realizes that a malicious cyber campaign spreading conspiracy theories about 5G technology is inspiring attacks on 5G towers.

    “Fellow comic geeks, assemble!” CISA said when the comic books were initially released. “Let’s band together to take on disinformation and misinformation.” The CISA post quotes another X post by the FBI’s Washington field office recommending the graphic novels and exhorting the importance of “finding trusted information.”

    “The resilience series products were released in 2020 and 2021 to raise awareness on tactics of foreign influence and disinformation,” a spokesperson for CISA told The Intercept, noting that despite continued reference by members of Congress and critics, that this series of comic books has now been discontinued.

    “The problem is not that panels about African troll farms ( Real Fake ) or homegrown antivaxxers ( Bug Bytes ) might make readers feel insecure—it’s that they don’t make readers feel insecure enough,” writes Russ Castronovo, director of University of Wisconsin-Madison’s Center for the Humanities and professor of American studies and English, in Public Books magazine. “Or, more precisely, these comics might be judged aesthetic failures because—due to their proximity to propaganda—they leave little space for the vulnerabilities inherent in the act of reading. So, while readers learn that meddling by foreign powers ‘is scary, especially in an election year,’ the graphic fictions commissioned by US cybersecurity assume reading itself to be a process whereby information (as opposed to disinformation) is obtained, questions are answered, and doubts are resolved.”

    Writing in Bulletin of the Atomic Scientists, Thomas Gaulkin said that “the Resilience Series … conjures a certain jingoism peculiar to government publications that can mimic the very threat being addressed.”

    All of which raises the question as to what role the Department of Homeland Security should play in adjudicating “media literacy,” as the series webpage says.

    Both “Real Fake” and “Bug Bytes” were written by Clint Watts, a former FBI special agent who works as a contributor to MSNBC and is affiliated with Microsoft’s Threat Analysis Center, and Farid Haque, an education technology entrepreneur who is CEO of London-based Erly Stage Studios and was previously CEO of StartUp Britain, a campaign launched by then-U.K. Prime Minister David Cameron.

    Watts, who writes and speaks about Russian influence campaigns, has testified to Congress on the matter and has been affiliated with a number of think tanks, including the Alliance for Securing Democracy, the German Marshall Fund, and the Foreign Policy Research Institute. Clearly knowledgeable, his own writings can sometimes veer into hyperbole — a potent reminder that even experts on disinformation are not infallible.

    “Over the past three years, Russia has implemented and run the most effective and efficient influence campaign in world history,” Watts said in testimony to the Senate Intelligence Committee in 2017. While Russia’s propaganda regarding its first invasion of Ukraine and Crimea was no doubt effective, that employed in 2016 against the U.S. presidential election was “neither well organized nor especially well resourced” according to a detailed study by the Pentagon-backed Rand Corporation. The think tank later concluded that “the impact of Russian efforts in the West has been uncertain.”

    Co-author Haque, according to an interview in Forbes, became involved in the Resilience Series after a chance meeting at a bookstore with actor Mel Brooks’s son, Max Brooks, who would later join Erly Stage’s advisory board and introduce Haque to his Americans contacts, which included Watts.

    “There is now a real need for schools and public authorities to educate young people on how much fake news there is across all forms of media,” Haque told Forbes.

    Related

    The Government Created a New Disinformation Office to Oversee All the Other Ones

    Counter-disinformation has become a cottage industry in the federal government, with offices and programs now dedicated to exposing foreign influence, as The Intercept has previously reported . CISA’s Resilience Series webpage directs questions to an email for the Countering Foreign Influence Task Force (not to be confused with the FBI’s own effort, the Foreign Influence Task Force, or the intelligence community’s Foreign Malign Influence Center). In 2021, the CISA Task Force was replaced by a Misinformation, Disinformation, and Malinformation team according to a government audit , which CISA tells The Intercept has now been rolled into something called “the Election Security and Resilience subdivision.” (Malinformation refers to information based on fact but used out of context to mislead, harm, or manipulate, according to CISA.)

    The proliferation of various counter-disinformation entities has been disjointed, prompting the Department of Homeland Security’s own inspector general to conclude that “DHS does not have a unified, department-wide strategy to set overarching goals and objectives for addressing and mitigating threats from disinformation campaigns that appear in social media.”

    CISA’s mission, originally focused on traditional cyber and critical infrastructure security, evolved in the wake of the 2016 election. In the waning days of the Obama administration, Secretary of Homeland Security Jeh Johnson officially designated the election systems as a part of critical infrastructure. Since then, CISA has expanded its focus to include fighting disinformation, arguing that human thought can be said to constitute infrastructure.

    “One could argue we’re in the business of critical infrastructure, and the most critical infrastructure is our cognitive infrastructure, so building that resilience to misinformation and disinformation, I think, is incredibly important,” CISA Director Jen Easterly said in 2021.

    In pursuit of that cognitive infrastructure, CISA launched the Resilience Series, with an eye to mediums that would appeal to popular audiences.

    “We have to find new ways to engage with people through mediums that use soft power and creative messaging, rather than being seen to preach,” Haque said in the Forbes interview.

    The post Government-Made Comic Books Try to Fight Election Disinformation appeared first on The Intercept .

    • chevron_right

      Agencies using vulnerable Ivanti products have until Saturday to disconnect them

      news.movim.eu / ArsTechnica · Thursday, 1 February - 23:45 · 1 minute

    Photograph depicts a security scanner extracting virus from a string of binary code. Hand with the word "exploit"

    Enlarge (credit: Getty Images)

    Federal civilian agencies have until midnight Saturday morning to sever all network connections to Ivanti VPN software, which is currently under mass exploitation by multiple threat groups. The US Cybersecurity and Infrastructure Security Agency mandated the move on Wednesday after disclosing three critical vulnerabilities in recent weeks.

    Three weeks ago, Ivanti disclosed two critical vulnerabilities that it said threat actors were already actively exploiting. The attacks, the company said, targeted “a limited number of customers” using the company’s Connect Secure and Policy Secure VPN products. Security firm Volexity said on the same day that the vulnerabilities had been under exploitation since early December. Ivanti didn’t have a patch available and instead advised customers to follow several steps to protect themselves against attacks. Among the steps was running an integrity checker the company released to detect any compromises.

    Almost two weeks later, researchers said the zero-days were under mass exploitation in attacks that were backdooring customer networks around the globe. A day later, Ivanti failed to make good on an earlier pledge to begin rolling out a proper patch by January 24. The company didn’t start the process until Wednesday, two weeks after the deadline it set for itself.

    Read 8 remaining paragraphs | Comments

    • chevron_right

      Federal agency hacked by 2 groups thanks to flaw that went unpatched for 4 years

      news.movim.eu / ArsTechnica · Thursday, 16 March, 2023 - 20:24

    Federal agency hacked by 2 groups thanks to flaw that went unpatched for 4 years

    Enlarge (credit: Getty Images)

    Multiple threat actors—one working on behalf of a nation-state—gained access to the network of a US federal agency by exploiting a four-year-old vulnerability that remained unpatched, the US government warned.

    Exploit activities by one group likely began in August 2021 and last August by the other, according to an advisory jointly published by the Cybersecurity and Infrastructure Security Agency, the FBI, and the Multi-State Information Sharing and Analysis Center. From last November to early January, the server exhibited signs of compromise.

    Vulnerability not detected for 4 years

    Both groups exploited a code-execution vulnerability tracked as CVE-2019-18935 in a developer tool known as the Telerik user interface (UI) for ASP.NET AJAX, which was located in the agency’s Microsoft Internet Information Services (IIS) web server. The advisory didn’t identify the agency other than to say it was a Federal Civilian Executive Branch Agency under the CISA authority.

    Read 9 remaining paragraphs | Comments