Silicon Investor - Network Security

[JakeStraw] CrowdStrike Reports Second Quarter Fiscal Year 2027 Financial Results ir.crowdst...

JakeStraw — 8/31/2026 3:53:38 PM

CrowdStrike Reports Second Quarter Fiscal Year 2027 Financial Results
ir.crowdstrike.com
August 26, 2026

Delivers record net new ARR of $333 million, accelerates growth to 51% year-over-year
Increases FY27 net new ARR growth guidance by 630 basis points to 34% year-over-year growth at the midpoint
Exceeds $2.29 billion in ending ARR from accounts that have adopted Falcon Flex, accelerates growth to 101% year-over-year
Generates Q2 record cash flow from operations of $530 million and Q2 record free cash flow of $377 million

"Q2 was the best quarter in CrowdStrike's history," said George Kurtz, CrowdStrike’s Founder and Chief Executive Officer. "Delivering record Falcon Flex results, record net new ARR, and accelerating growth—the Falcon is soaring. We're raising our full year fiscal 2027 net new ARR growth outlook by 630 basis points. The Mythos moment translated into mass-market acceptance that AI adoption needs security, and that's CrowdStrike. Every enterprise will run on AI, and securing it is the largest market opportunity in our history."

Commenting on the company's financial results, Burt Podbere, CrowdStrike's Chief Financial Officer, added, "Q2 was a record-breaking quarter. We achieved record net new ARR of $333 million alongside record net new ARR from new logos, increased dollar-based gross and net retention rates, and Q2 record cash flow from operations and free cash flow. Given our strong Q2 results and record Q3 pipeline, we are raising our full-year fiscal 2027 net new ARR growth outlook to 34% at the midpoint, positioning us for continued durable, profitable growth."

[JakeStraw] Rubrik Reports Second Quarter Fiscal Year 2027 Financial Results rubrik.com ...

JakeStraw — 8/31/2026 3:48:59 PM

Rubrik Reports Second Quarter Fiscal Year 2027 Financial Results
rubrik.com

Results exceeded all guided metrics
Raising guidance for all guided metrics for fiscal year 2027
Second quarter subscription ARR grew 33% year-over-year to $1.66 billion
Second quarter revenue grew 38% year-over-year to $427.3 million
Operating cash flow margin of 18%; free cash flow margin of 15%

[Glenn Petersen] Triton is the world’s most murderous malware, and it’s spreading The rogue code...

Glenn Petersen — 12/22/2019 10:05:48 AM

Triton is the world’s most murderous malware, and it’s spreading

The rogue code can disable safety systems designed to prevent catastrophic industrial accidents. It was discovered in the Middle East, but the hackers behind it are now targeting companies in North America and other parts of the world, too.

by Martin Giles
MIT Technology Review
Mar 5, 2019

As an experienced cyber first responder, Julian Gutmanis had been called plenty of times before to help companies deal with the fallout from cyberattacks. But when the Australian security consultant was summoned to a petrochemical plant in Saudi Arabia in the summer of 2017, what he found made his blood run cold.

The hackers had deployed malicious software, or malware, that let them take over the plant’s safety instrumented systems. These physical controllers and their associated software are the last line of defense against life-threatening disasters. They are supposed to kick in if they detect dangerous conditions, returning processes to safe levels or shutting them down altogether by triggering things like shutoff valves and pressure-release mechanisms.

The malware made it possible to take over these systems remotely. Had the intruders disabled or tampered with them, and then used other software to make equipment at the plant malfunction, the consequences could have been catastrophic. Fortunately, a flaw in the code gave the hackers away before they could do any harm. It triggered a response from a safety system in June 2017, which brought the plant to a halt. Then in August, several more systems were tripped, causing another shutdown.

The first outage was mistakenly attributed to a mechanical glitch; after the second, the plant's owners called in investigators. The sleuths found the malware, which has since been dubbed “Triton” (or sometimes “Trisis”) for the Triconex safety controller model that it targeted, which is made by Schneider Electric, a French company.

In a worst-case scenario, the rogue code could have led to the release of toxic hydrogen sulfide gas or caused explosions, putting lives at risk both at the facility and in the surrounding area.

Gutmanis recalls that dealing with the malware at the petrochemical plant, which had been restarted after the second incident, was a nerve-racking experience. “We knew that we couldn’t rely on the integrity of the safety systems,” he says. “It was about as bad as it could get.”

In attacking the plant, the hackers crossed a terrifying Rubicon. This was the first time the cybersecurity world had seen code deliberately designed to put lives at risk. Safety instrumented systems aren’t just found in petrochemical plants; they’re also the last line of defense in everything from transportation systems to water treatment facilities to nuclear power stations.

Triton’s discovery raises questions about how the hackers were able to get into these critical systems. It also comes at a time when industrial facilities are embedding connectivity in all kinds of equipment—a phenomenon known as the industrial internet of things. This connectivity lets workers remotely monitor equipment and rapidly gather data so they can make operations more efficient, but it also gives hackers more potential targets.

Those behind Triton are now on the hunt for new victims. Dragos, a firm that specializes in industrial cybersecurity, and where Gutmanis now works, says it’s seen evidence over the past year or so that the hacking group that built the malware and inserted it into the Saudi plant is using some of the same digital tradecraft to research targets in places outside the Middle East, including North America. And it’s creating new strains of the code in order to compromise a broader range of safety instrumented systems.

Red alert

News of Triton’s existence was revealed in December 2017, though the identity of the plant’s owner has been kept secret. (Gutmanis and other experts involved in the initial investigation decline to name the company because they fear doing so might dissuade future targets from sharing information about cyberattacks privately with security researchers.)

Some notable cyber-physical threats2010 ?? StuxnetDeveloped by America’s National Security Agency, working in conjunction with Israeli intelligence, the malware was a computer worm, or code that replicates itself from computer to computer without human intervention. Most likely smuggled in on a USB stick, it targeted programmable logic controllers which govern automated processes, and caused the destruction of centrifuges used in the enrichment of uranium at a facility in Iran.2013 ?????? HavexHavex was designed to snoop on systems controlling industrial equipment, presumably so that hackers could work out how to mount attacks on the gear. The code was a remote access Trojan, or RAT, which is cyber-speak for software that lets hackers take control of computers remotely. Havex targeted thousands of US, European, and Canadian businesses, and especially ones in the energy and petrochemical industries.2015 ?? BlackEnergyBlackEnergy, which is another Trojan, had been circulating in the criminal underworld for a while before it was adapted by Russian hackers to launch an attack in December 2015 on several Ukranian power companies that helped trigger blackouts. The malware was used to gather intelligence about the power companies’ systems, and to steal log-in credentials from employees.2016 ?? CrashOverrideAlso known as Industroyer, this was developed by Russian cyber warriors too, who used it to mount an attack on a part of Ukraine’s electrical grid in December 2016. The malware replicated the protocols, or communications languages, that different elements of a grid used to talk to one another. This let it do things like show that a circuit breaker is closed when it’s really open. The code was used to strike an electrical transmission substation in Kiev, blacking out part of the city for a short time.Over the past couple of years, cybersecurity firms have been racing to deconstruct the malware—and to work out who’s behind it. Their research paints a worrying picture of a sophisticated cyberweapon built and deployed by a determined and patient hacking group whose identity has yet to be established with certainty.

The hackers appear to have been inside the petrochemical company’s corporate IT network since 2014. From there, they eventually found a way into the plant’s own network, most likely through a hole in a poorly configured digital firewall that was supposed to stop unauthorized access. They then got into an engineering workstation, either by exploiting an unpatched flaw in its Windows code or by intercepting an employee’s login credentials.

Since the workstation communicated with the plant’s safety instrumented systems, the hackers were able to learn the make and model of the systems’ hardware controllers, as well as the versions of their firmware—software that’s embedded in a device’s memory and governs how it communicates with other things.

It’s likely they next acquired an identical Schneider machine and used it to test the malware they developed. This made it possible to mimic the protocol, or set of digital rules, that the engineering workstation used to communicate with the safety systems. The hackers also found a “zero-day vulnerability”, or previously unknown bug, in the Triconex model’s firmware. This let them inject code into the safety systems’ memories that ensured they could access the controllers whenever they wanted to.

Thus, the intruders could have ordered the safety instrumented systems to disable themselves and then used other malware to trigger an unsafe situation at the plant.

The results could have been horrific. The world’s worst industrial disaster to date also involved a leak of poisonous gases. In December 1984 a Union Carbide pesticide plant in Bhopal, India, released a vast cloud of toxic fumes, killing thousands and causing severe injuries to many more. The cause that time was poor maintenance and human error. But malfunctioning and inoperable safety systems at the plant meant that its last line of defense failed.

More red alerts

There have been only a few previous examples of hackers using cyberspace to try to disrupt the physical world. They include Stuxnet, which caused hundreds of centrifuges at an Iranian nuclear plant to spin out of control and destroy themselves in 2010, and CrashOverride, which Russian hackers used in 2016 to strike at Ukraine’s power grid. (Our sidebar provides a summary of these and other notable cyber-physical attacks.)

However, not even the most pessimistic of cyber-Cassandras saw malware like Triton coming. “Targeting safety systems just seemed to be off limits morally and really hard to do technically,” explains Joe Slowik, a former information warfare officer in the US Navy, who also works at Dragos.

Other experts were also shocked when they saw news of the killer code. “Even with Stuxnet and other malware, there was never a blatant, flat-out intent to hurt people,” says Bradford Hegrat, a consultant at Accenture who specializes in industrial cybersecurity.

Ariel Davis

It’s almost certainly no coincidence that the malware appeared just as hackers from countries like Russia, Iran, and North Korea stepped up their probing of “critical infrastructure” sectors vital to the smooth running of modern economies, such as oil and gas companies, electrical utilities, and transport networks.

In a speech last year, Dan Coats, the US director of national intelligence, warned that the danger of a crippling cyberattack on critical American infrastructure was growing. He drew a parallel with the increased cyber chatter US intelligence agencies detected among terrorist groups before the World Trade Center attack in 2001. “Here we are nearly two decades later, and I’m here to say the warning lights are blinking red again,” said Coats. “Today, the digital infrastructure that serves this country is literally under attack.”

At first, Triton was widely thought to be the work of Iran, given that it and Saudi Arabia are archenemies. But cyber-whodunnits are rarely straightforward. In a report published last October, FireEye, a cybersecurity firm that was called in at the very beginning of the Triton investigation, fingered a different culprit: Russia.

The hackers behind Triton had tested elements of the code used during the intrusion to make it harder for antivirus programs to detect. FireEye’s researchers found a digital file they had left behind on the petrochemical company’s network, and they were then able to track down other files from the same test bed. These contained several names in Cyrillic characters, as well as an IP address that had been used to launch operations linked to the malware.

That address was registered to the Central Scientific Research Institute of Chemistry and Mechanics in Moscow, a government-owned organization with divisions that focus on critical infrastructure and industrial safety. FireEye also said it had found evidence that pointed to the involvement of a professor at the institute, though it didn’t name the person. Nevertheless, the report noted that FireEye hadn’t found specific evidence proving definitively that the institute had developed Triton.

Researchers are still digging into the malware’s origins, so more theories about who’s behind it may yet emerge. Gutmanis, meanwhile, is keen to help companies learn important lessons from his experience at the Saudi plant. In a presentation at the S4X19 industrial security conference in January, he outlined a number of them. They included the fact that the victim of the Triton attack had ignored multiple antivirus alarms triggered by the malware, and that it had failed to spot some unusual traffic across its networks. Workers at the plant had also left physical keys that control settings on Triconex systems in a position that allowed the machines’ software to be accessed remotely.

Triton: a timeline2014Hackers gain access to network of Saudi plantJune 2017First plant shutdown August 2017Second plant shutdownDecember 2017Cyberattack made publicOctober 2018Fireeye says Triton most likely built in Russian labJanuary 2019More details emerge of Triton incident responseIf that makes the Saudi business sound like a security basket case, Gutmanis says it isn’t. “I’ve been into a lot of plants in the US that were nowhere near as mature [in their approach to cybersecurity] as this organization was,” he explains.

Other experts note that Triton shows government hackers are now willing to go after even relatively obscure and hard-to-crack targets in industrial facilities. Safety instrumented systems are highly tailored to safeguard different kinds of processes, so crafting malware to control them involves a great deal of time and painstaking effort. Schneider Electric’s Triconex controller, for instance, comes in dozens of different models, and each of these could be loaded with different versions of firmware.

That hackers went to such great lengths to develop Triton has been a wake-up call for Schneider and other makers of safety instrumented systems—companies like Emerson in the US and Yokogawa in Japan. Schneider has drawn praise for publicly sharing details of how the hackers targeted its Triconex model at the Saudi plant, including highlighting the zero-day bug that has since been patched. But during his January presentation, Gutmanis criticized the firm for failing to communicate enough with investigators in the immediate aftermath of the attack.

Schneider responded by saying it had cooperated fully with the company whose plant was targeted, as well as with the US Department of Homeland Security and other agencies involved in investigating Triton. It has hired more people since the event to help it respond to future incidents, and has also beefed up the security of the firmware and protocols used in its devices.

Andrew Kling, a Schneider executive, says an important lesson from Triton’s discovery is that industrial companies and equipment manufacturers need to focus even more on areas that may seem like highly unlikely targets for hackers but could cause disaster if compromised. These include things like software applications that are rarely used and older protocols that govern machine-to-machine communication. “You may think nobody’s ever going to bother breaking [an] obscure protocol that’s not even documented,” Kling says, “but you need to ask, what are the consequences if they do?”

An analog future?

Over the past decade or so, companies have been adding internet connectivity and sensors to all kinds of industrial equipment. The data captured is being used for everything from predictive maintenance—which means using machine-learning models to better anticipate when equipment needs servicing—to fine-tuning production processes. There’s also been a big push to control processes remotely through things like smartphones and tablets.

All this can make businesses much more efficient and productive, which explains why they are expected to spend around $42 billion this year on industrial internet gear such as smart sensors and automated control systems, according to the ARC Group, which tracks the market. But the risks are also clear: the more connected equipment there is, the more targets hackers have to aim at.

To keep attackers out, industrial companies typically rely on a strategy known as “defense in depth.” This means creating multiple layers of security, starting with firewalls to separate corporate networks from the internet. Other layers are intended to prevent hackers who do get in from accessing plant networks and then industrial control systems.

These defenses also include things like antivirus tools to spot malware and, increasingly, artificial-intelligence software that tries to spot anomalous behavior inside IT systems. Then, as the ultimate backstop, there are the safety instrumented systems and physical fail-safes. The most critical systems typically have multiple physical backups to guard against the failure of any one element.

The strategy has proved robust. But the rise of nation-state hackers with the time, money, and motivation to target critical infrastructure, as well as the increasing use of internet-connected systems, means the past may well not be a reliable guide to the future.

Russia, in particular, has shown that it’s willing to weaponize software and deploy it against physical targets in Ukraine, which it has used as a testing ground for its cyber arms kit. And Triton’s deployment in Saudi Arabia shows that determined hackers will spend years of prodding and probing to find ways to drill through all those defensive layers.

Fortunately, the Saudi plant’s attackers were intercepted, and we now know a great deal more about how they worked. But it’s a sobering reminder that, just like other developers, hackers make mistakes too. What if the bug they inadvertently introduced, instead of triggering a safe shutdown, had disabled the plant’s safety systems just when a human error or other mistake had caused one of the critical processes in the plant to go haywire? The result could have been a catastrophe even if the hackers hadn’t intended to cause it.

Experts at places like the US’s Idaho National Laboratory are urging companies to revisit all their operations in the light of Triton and other cyber-physical threats, and to radically reduce, or eliminate, the digital pathways hackers could use to get to critical processes.

Businesses may chafe at the costs of doing that, but Triton is a reminder that the risks are increasing. Gutmanis thinks more attacks using the world’s most murderous malware are all but inevitable. “While this was the first,” he says, “I’d be surprised if it turns out to be the last.”

https://www.technologyreview.com/s/613054/cybersecurity-critical-infrastructure-triton-malware/?utm_medium=tr_social&utm_campaign=site_visitor.unpaid.engagement&utm_source=Twitter#Echobox=1576865275

[Glenn Petersen] McAfee plans return to public markets: WSJ Reuters July 10, 2019 (Reuters) - C...

Glenn Petersen — 7/11/2019 10:58:44 AM

McAfee plans return to public markets: WSJ

Reuters
July 10, 2019

(Reuters) - Cybersecurity software firm McAfee Llc is planning a return to the public markets, the Wall Street Journal reported on Wednesday, citing people familiar with the matter.

An IPO could raise at least $1 billion and value McAfee at more than $5 billion, according to the report.

Intel Corp ( INTC.O), which paid $7.7 billion for California-based McAfee in 2011, spun off 51% to private equity fund TPG Capital in 2017 at a $4.2 billion enterprise value. Thoma Bravo also joined as an investor in the same year.

McAfee declined to comment on the report, saying it “does not comment on rumors”.

Reporting by Sayanti Chakraborty in Bengaluru; Editing by Shounak Dasgupta

reuters.com

[Glenn Petersen] Inside Chronicle, Alphabet’s cybersecurity moonshot What exactly is Project La...

Glenn Petersen — 12/2/2018 2:18:31 PM

Inside Chronicle, Alphabet’s cybersecurity moonshot

What exactly is Project Lantern?

Nick Summers, @nisummers
11.30.18
engadet

Fifteen years ago, cybersecurity could be boiled down to a simple strategy: Secure the perimeter. Experts fought against malware and other nefarious code by implementing firewalls and other point-of-entry defenses. Since then, however, companies have moved their operations online and allowed employees to bring their own devices (BYOD) to work. The so-called perimeter has dissolved in the process, forcing security practitioners to prioritize tracking, understanding and ultimately making judgments about the information flowing both inside and outside of their company.

Many businesses use 10, 20 or 30 different security products to protect their systems. They all have advantages, and security practitioners will use different combinations to investigate a potential threat. If a team has access to 15 tools, for instance, one engineer might think to use three of them while another tries a completely different subset. There isn't enough time to try them all, so experts pick products based on their experience and what they believe will be best suited to the task.

It's a messy problem that doesn't have a simple answer. "Companies are paying for all these tools, but they're not actually getting the combined value," Mike Wiacek, CSO and co-founder of Chronicle, said. "Because ultimately they're relying on a human to try and piece all this together. And that doesn't really solve the problem."

Chronicle started as a project inside X, the semi-secretive "moonshot factory" owned by Google parent Alphabet. It was announced last January and immediately spun out into a standalone business underneath the Alphabet umbrella. The reveal confused some people who associate "moonshot" with head-turning hardware like self-driving cars, delivery drones and high-altitude balloons that provide internet service to rural areas. Cybersecurity, while undeniably important, seemed tame by comparison. What exactly had Chronicle built, and why did it need the moonshot treatment to exist?

The answer is complicated.

Mike Wiacek

Chronicle's chief security officer started his career in high school, working six-hour evenings at an internet service provider (ISP) on system administration, security and basic programming tasks. He then studied computer science at La Salle University in Philadelphia while working at various ISPs and hosting companies. Wiacek clearly had a knack for security and quickly landed a summer internship at the Department of Defense. He graduated in 2003 and joined the department full time as a global network exploitation and vulnerability analyst. "It was a job where I felt I was able to do some good for the world," he said.

Three years later, the internet had radically changed. The user-friendly Web 2.0 movement was in full swing, and Google had launched a wave of transformative services including Google Maps and Gmail. The company was still relatively small, but Wiacek knew it would grow and face some unique security challenges. In the summer of 2006, Wiacek moved to California and joined Google's Information Security Engineering Team. The differences in size, structure and culture were stark.

"In one day I might have been looking at code or trying to audit some security functionality in Gmail," Wiacek said. "And that same day, I would be looking at stuff for Google Search. Or looking at a compiler. In one day I would literally be covering entire chunks of the company, because it was still small enough that you weren't specialized in one particular thing." It would be many years before Google set up product-specific security teams.

After Operation Aurora, a sophisticated cyberattack that targeted Google, Adobe and many other technology companies in 2009, Wiacek created an intelligence task force called the Threat Analysis Group (TAG). Google was already expanding its security team for day-to-day maintenance and operations. Wiacek felt the company should also have a group dedicated to more-innovative and forward-thinking solutions. "So understanding if any country in the world has a hacking program for espionage, intellectual property or simply spying on dissidents and political activists," he said. "We shouldn't have to say, 'We'll deal with that when we find out about it.' I wanted to understand how that was happening and make sure that information and intelligence could be applied [at the company]."

It's a search problem

Wiacek quickly built out a team that included Shapor Naghibzadeh, a Linux systems administrator who had helped investigate and diagnose Project Aurora. "Getting ahead of these threats was something that was really interesting to me," Naghibzadeh said.

TAG's founding members knew they would never have the legal freedom or technical capabilities of a government outfit like the FBI. The group could, however, leverage two of Google's key strengths: storage and raw computing. "That was the big hammer I had," Wiacek said. "Let's view this problem through the lens of data mining." The team used tools like Bigtable, a distributed storage system for structured data, and MapReduce, a framework for running large-scale parallel computations, in conjunction with its own search algorithms and techniques for detecting malware.

The unique blend allowed TAG to quickly spot patterns and reinforce Google's defenses. In June 2011, for instance, the team spotted a spear-phishing attack aimed at hundreds of Gmail users, including US government officials, Chinese political activists, military personnel and journalists. "We were able to actively disrupt that," Wiacek said.

TAG was making a difference. But the group's efforts were only protecting Google and its users.

"That planted the seed in my head."

One day, Wiacek was in a meeting with 20 other security experts, each representing a different company, at a Department of Homeland Security office in Virginia. A representative of the US government was explaining an ongoing hack that Wiacek suspected had originated in China. "They passed out a list of host names and said to everyone in the room, 'Hey, if you have traffic to any of those host names from your network, you probably have an active infection,'" TAG's manager recalled. Within a few seconds, Wiacek had pulled out his laptop, typed in the host names and confirmed that Google's systems were secure.

The other companies were dumbfounded. Some asked how they could possibly check that their companies were secure. Another queried how long ago the hack probably took place. The government spokesperson explained that it was likely six to nine months ago. "That person almost threw up their hands and said, 'You know, if you told me this was something that happened in the last 48 hours, maybe 72, we could do something. But I have no idea what happened there,'" Wiacek recalled. Google had made search a core part of its systems and approach to cybersecurity. In that moment, he realized few others had developed and integrated the same capabilities.

"That planted the seed in my head," Wiacek said. A seed that would eventually blossom into Chronicle.

Chronicle co-founders Mike Wiacek (left), Stephen Gillett (center) and Shapor Naghibzadeh (right)
__________________________________---

Pitching Alphabet

TAG's manager took a sabbatical during the summer of 2015. He had worked at Google for nine years and seen the company grow from roughly 3,000 to 70,000 people globally. "I needed a break," Wiacek recalled, "and I was trying to figure out what I wanted to do [next]."

He thought back to the meeting in Virginia and started devising an "engineer's version of a business plan" with Naghibzadeh. Two months later, Google announced Alphabet, a major restructuring that separated Google, the X moonshot factory and various "other bets" including Life Services (later renamed Verily) and the health-focused Calico. "It didn't change our plans though," Wiacek explained. "X was still the logical place to try and incubate something. The only other real option was to quit Google altogether and try to talk to Google Ventures or something like that. We wanted to stay in the family."

Within two weeks, Alphabet's leadership had approved the project. Wiacek switched roles straight away; Naghibzadeh followed a little later.

VirusTotalX is a strange melting pot of talent. Walk through its facility and you might bump into a chemical engineer, a geothermal expert, a robotics technician or all three. That breadth of experience, coupled with some radical thinking and a seemingly infinite budget, is why X has been able to pursue such a wide range of radical ideas. It can also be a little daunting if you've spent the past decade surrounded almost exclusively by software engineers.

"I'm sitting at this desk by myself," Wiacek said, "Gmail's up, and I'm staring at the screen. I look around, and I'm just sitting there in a sea of empty desks. I thought to myself, 'What have I gotten myself into?'"

He wasn't truly alone, however. Wiacek had included VirusTotal, a small team based in Malaga, Spain, as part of his moonshot pitch.

The security company, created by cybersecurity developer Bernardo Quintero in 2004 and acquired by Google in 2012, runs a hugely popular file-and-URL-inspection service. The free-to-use platform is unique because it leverages more than 70 different antivirus scanners, including Symantec, Kaspersky and F-Secure, alongside various website-blacklisting services provided by Bitdefender, Yandex, Opera and others. "It's like the Switzerland of malware research," Wiacek said.

VirusTotal shares its aggregated findings with the user and all of its antivirus partners. That means everyone in the community is able to learn from one another and continuously improve their own systems. A premium service also allows approved customers, including independent cybersecurity professionals, to search for and access harmful file samples for research purposes. "I often will say that they're the CDC or World Health Organization of malware," Wiacek said. "In Atlanta, the Center for Disease Control has Ebola and smallpox in some cryogenic vault. VirusTotal has some of the world's scariest malware in their repository."

Wiacek knew that VirusTotal would be critical to his work at X. The company had a massive and constantly evolving data set for the team to test its search capabilities on. It also provided a unique perspective into what was happening beyond Google's borders. "One of the greater advantages of having VirusTotal to collaborate with," Naghibzadeh said, "was being able to open that aperture up and see the different threats and things that happen in the world more broadly."

Stephen GillettOne month into his new job, Wiacek was introduced to Stephen Gillett, an executive in residence helping startups at Google Ventures (now known as GV). They immediately clicked. "The guy is like, openly genuine and caring," Wiacek said, "And he's not a tyrant. Or a 'my way is the only way.' He actually has a lot of humility. But he also has a lot of bold ambition."

Gillett was a great fit for Wiacek's yet-to-be-named X project. He studied political science at the University of Oregon while working part-time at Office Depot and later, after impressing a regular customer, a full-time help desk and networking job at a nearby hospital. After graduation, he held a number of high-level roles at CNET Networks, Yahoo, Starbucks and Best Buy, among others. Along the way, he learned a bunch about IT, infrastructure and cybersecurity.

In 2011, Gillett joined the board of directors at Symantec. He was later appointed COO and worked with the company as it split into two independent companies, focused on security and information management, in late 2014. The latter portion, named Veritas Technologies, was sold to the Carlyle Group in August 2015. "They were investing in a lot of the assets that were not related to cybersecurity," Gillett said. "When we sold the majority of those assets to private equity in 2015, I left, as did much of the executive team, because [Symantec] was a different company focused on a much smaller part of the market."

He was then asked by David Krane, the CEO and managing partner at GV, to join Google as a startup advisor. The former Symantec executive was about to turn 40, however, and have a seventh child with his wife. "I was kind of reluctant," he said. "But they convinced me that I would get free food, I would get to ride the Google bike and I would also get to work with great entrepreneurs. And so I joined."

"I'm looking under the tinted part of the conference-room glass saying, 'I hope that's not Astro.'"

He was paired up with roughly 30 companies and helped them with hiring, product decisions and other basic issues, such as how to negotiate a new office lease. Soon after, he was invited to meet the Alphabet leadership team, including Google CEO Sundar Pichai, the head of Google Fiber and Astro Teller, the jovial Captain of Moonshots at X. Gillett agreed to the meetings but knew he wasn't interested in running a large company or department again. The meeting with Teller, however, changed everything.

"I wasn't really trying to sell myself," Gillett said. "So I didn't do a lot of homework on him. I didn't do a lot of research. Then I went down to the conference room on the first floor of our building, and I'm sitting in there, kind of waiting for Astro to walk in, and I see this guy coming toward me with rollerblades on and a ponytail in kind of a flannel T-shirt thing. I'm looking under the tinted part of the conference-room glass saying, 'I hope that's not Astro.'" It was Astro. The meeting was a great success, however, and by the end Gillett knew Teller was one of the smartest people he had ever met.

By January 2016, Gillett had joined Wiacek's team inside X. "Then I wasn't alone here anymore," Wiacek said. "Eventually it was Shapor [Naghibzadeh], me and Stephen [Gillett], which was great. But then from there we said, 'You know, how do we actually -- what do we do next? Who do we hire? What's our plan?'"

Life under X

The moonshot factory gave Wiacek, Gillett and Naghibzadeh the time to do some high-level thinking about the future of cybersecurity. They felt, unsurprisingly, that it would be software-based, unlike most X moonshots. The group also agreed that it would revolve around Alphabet and Google's core strengths: huge amounts of data stored in well-protected data centers, paired with enormous computing power and smart analysis of logs.

"We believed, and do believe, that the future looks like that," Gillett said. "Less like an on-premise [solution] or appliance or a particular endpoint product and more about giving organizations and companies the ability to understand the security-relevant information that exists in their company today." Every company in the world, in short, needed to be strong in so-called big data storage and analysis.

The question, then, was how to give other organizations the same capabilities as Google.

With fewer than five employees, the still-unnamed project inside X started talking to other companies. The group wasn't pitching a product yet: They just wanted to chat with other cybersecurity professionals about their problems. "We tried to validate our idea," Wiacek said. "We spent a lot of 2016 doing this, actually. We knew what we thought we wanted to build, but we didn't want to rush out and just build it in a sense of arrogance to say, 'This will solve your problems.' We thought it would, we knew it would, but we also knew that a lot of security teams and a lot of enterprises had tool overload."

Project Lantern

So what exactly did the team build, and how does it differ from every other AI-equipped cybersecurity product? Chronicle's co-founders are staying tight-lipped on the details for now. It was once called Project Lantern, though, and it's clearly inspired by the systems Wiacek and Naghibzadeh developed at TAG.

It's also obvious that the platform provides some kind of overview, or continuous monitoring, of a company. And that it can spot patterns, or links, related to vulnerabilities and cyberattacks. "We will give you unprecedented capabilities to understand that information and, in particular, your [company] environment," Gillett said. "When bad things are interacting with your environment, [it will] give you an understanding of how those things are connected, what the relationships are over time, to help you make judgements and verdicts."

Search and data mining are only effective, however, if companies can store information for long periods of time. Server space, of course, is relatively expensive, so the product will somehow address this too. "You'll see [Chronicle] directly address this economic issue and try very hard to remove the barriers of a lot of companies to store that information in cost effective and economic ways," Gillett said. Otherwise, companies won't be able to investigate breaches properly and understand how bad actors penetrated their defenses.

The pattern spotting also relies on a unique blend of artificial intelligence and machine learning. It's not clear, however, if the data collected and analyzed by VirusTotal is being used to train these algorithms. "That's actually quite the data set to train an algorithm," Gillett hinted. "Because if you have human beings that have said, 'This is good, this is not good,' across hundreds of millions of artifacts, that becomes quite a powerful training algorithm, or data set, for an algorithm to help make those verdicts themselves over time."

ChronicleThe team worked under X for almost two years, refining the product and, eventually, providing Alpha access to some carefully selected companies.

By the end of 2017, however, it was clear that the project needed a new identity. Gillett, for instance, was meeting with clients who couldn't find the product or any mention of the team on Alphabet's and X's websites. They weren't sure, therefore, if the project was going to mature into a distinct business like Waymo and Wing or wither away like Project Foghorn, an ambitious attempt to turn seawater into carbon-neutral fuel. "That forced us to really announce to the world that we existed," Gillett explained, "even if we weren't ready for full general availability of the product."

First, though, the team needed a new name. Wiacek's only demand was that it didn't sound macho or like something from a sci-fi movie. "I didn't want to have an identity that resonates with military attitudes or 'my computer will eat me if I don't do this' or any of that," he explained. "I wanted something that's basically 'you can sit down and trust these people.'" By this point, the core leadership structure was solidified, with Gillett as CEO, Wiacek as chief security officer and Naghibzadeh as the team's senior engineering lead. And one day, in a design meeting, Wiacek saw their names on a mock-up slide with the name Chronicle.

"It just made the hair on the back of my neck stand up a little bit," Wiacek said. "Because it just sounds like it stands for something good. It sounds like it's there with some principles."

On January 24th, 2018, Chronicle was announced to the world as an Alphabet business and former X project. The move allowed the team to set its own corporate structure and governance, branding (almost everything it does is yellow and black), and sales and marketing strategies. The company was distinct but, being under the Alphabet umbrella, could still leverage the talent and resources of other divisions, such as the AI-focused DeepMind and Google Brain. It was, and still is, the best of both worlds.

"We know exactly when and where and how we will go live."

Chronicle has kept a low profile over the past 11 months. The team has been rapidly hiring, however, and expanding the pool of companies that has access to its "intelligence and analytics platform." In September, it also announced VirusTotal Enterprise, an update for premium customers that includes high-speed searching and YARA (it stands for Yet Another Ridiculous Acronym) threat hunting.

"We continue to leverage the power of Google infrastructure to expand the search and analysis capabilities of VirusTotal," the team says in a blog post. "As part of Chronicle, we also continue to add features to make VirusTotal more useful for enterprise security analysts. VirusTotal Enterprise will give those analysts new ability to search more data, faster, and to visualize it in new ways. We believe this will help you understand threats better and improve your own security."

Two months ago, Chronicle moved into a new office next to the X moonshot factory. The VirusTotal team, which had been working together in a leased house, now has a proper base of operations in Malaga too. They're separated geographically but united by Project Lantern, which aims to "bring light to the darkness," Wiacek explained.

As for the grand reveal of its search-focused cybersecurity platform? That's still a mystery, for now. "We know exactly when and where and how we will go live," Gillett said.

2019, hopefully?

engadget.com

[Glenn Petersen] The World Once Laughed at North Korean Cyberpower. No More. By DAVID E. SAN...

Glenn Petersen — 10/17/2017 6:43:18 AM

The World Once Laughed at North Korean Cyberpower. No More.

By DAVID E. SANGER, DAVID D. KIRKPATRICK and NICOLE PERLROTH
New York Times
OCT. 15, 2017

A military officer who teaches computer science at the Mangyongdae Revolutionary School, on the outskirts of Pyongyang, North Korea. Credit Alexander F. Yuan/Associated Press
________________________________

When North Korean hackers tried to steal $1 billion from the New York Federal Reserve last year, only a spelling error stopped them. They were digitally looting an account of the Bangladesh Central Bank, when bankers grew suspicious about a withdrawal request that had misspelled “foundation” as “fandation.”

Even so, Kim Jong-un’s minions still got away with $81 million in that heist.

Then only sheer luck enabled a 22-year-old British hacker to defuse the biggest North Korean cyberattack to date, a ransomware attack last May that failed to generate much cash but brought down hundreds of thousands of computers across dozens of countries — and briefly crippled Britain’s National Health Service.

Their track record is mixed, but North Korea’s army of more than 6,000 hackers is undeniably persistent, and undeniably improving, according to American and British security officials who have traced these attacks and others back to the North.

Amid all the attention on Pyongyang’s progress in developing a nuclear weapon capable of striking the continental United States, the North Koreans have also quietly developed a cyberprogram that is stealing hundreds of millions of dollars and proving capable of unleashing global havoc.

Unlike its weapons tests, which have led to international sanctions, the North’s cyberstrikes have faced almost no pushback or punishment, even as the regime is already using its hacking capabilities for actual attacks against its adversaries in the West.

And just as Western analysts once scoffed at the potential of the North’s nuclear program, so did experts dismiss its cyberpotential — only to now acknowledge that hacking is an almost perfect weapon for a Pyongyang that is isolated and has little to lose.

The country’s primitive infrastructure is far less vulnerable to cyberretaliation, and North Korean hackers operate outside the country, anyway. Sanctions offer no useful response, since a raft of sanctions are already imposed. And Mr. Kim’s advisers are betting that no one will respond to a cyberattack with a military attack, for fear of a catastrophic escalation between North and South Korea.

Portraits of the former North Korean leaders, Kim Il-sung and Kim Jong-il, on a building in Pyongyang. Credit Ed Jones/Agence France-Presse — Getty Images
__________________________

“Cyber is a tailor-made instrument of power for them,” said Chris Inglis, a former deputy director of the National Security Agency, who now teaches about security at the United States Naval Academy. “There’s a low cost of entry, it’s largely asymmetrical, there’s some degree of anonymity and stealth in its use. It can hold large swaths of nation state infrastructure and private-sector infrastructure at risk. It’s a source of income.”

Mr. Inglis, speaking at the Cambridge Cyber Summit this month, added: “You could argue that they have one of the most successful cyberprograms on the planet, not because it’s technically sophisticated, but because it has achieved all of their aims at very low cost.”

It is hardly a one-way conflict: By some measures the United States and North Korea have been engaged in an active cyberconflict for years.

Both the United States and South Korea have also placed digital “implants” in the Reconnaissance General Bureau, the North Korean equivalent of the Central Intelligence Agency, according to documents that Edward J. Snowden released several years ago. American-created cyber- and electronic warfare weapons were deployed to disable North Korean missiles, an attack that was, at best, only partially successful.

Indeed, both sides see cyber as the way to gain tactical advantage in their nuclear and missile standoff.

A South Korean lawmaker last week revealed that the North had successfully broken into the South’s military networks to steal war plans, including for the “decapitation” of the North Korean leadership in the opening hours of a new Korean war.

There is evidence Pyongyang has planted so-called digital sleeper cells in the South’s critical infrastructure, and its Defense Ministry, that could be activated to paralyze power supplies and military command and control networks.

But the North is not motivated solely by politics: Its most famous cyberattack came in 2014, against Sony Pictures Entertainment, in a largely successful effort to block the release of a movie that satirized Mr. Kim.

What has not been disclosed, until now, is that North Korea had also hacked into a British television network a few weeks earlier to stop it from broadcasting a drama about a nuclear scientist kidnapped in Pyongyang.

Once North Korea counterfeited crude $100 bills to try to generate hard cash. Now intelligence officials estimate that North Korea reaps hundreds of millions of dollars a year from ransomware, digital bank heists, online video game cracking, and more recently, hacks of South Korean Bitcoin exchanges.

One former British intelligence chief estimates the take from its cyberheists may bring the North as much as $1 billion a year, or a third of the value of the nation’s exports.

The North Korean cyberthreat “crept up on us,” said Robert Hannigan, the former director of Britain’s Government Communications Headquarters, which handles electronic surveillance and cybersecurity.

“Because they are such a mix of the weird and absurd and medieval and highly sophisticated, people didn’t take it seriously,” he said. “How can such an isolated, backward country have this capability? Well, how can such an isolated backward country have this nuclear ability?”

The North Korean leader Kim Jong-un inspects a factory in Pyongyang. Credit Korean Central News Agency
___________________________
|
From Minor Leaguers to Serious Hackers

Kim Jong-il, the father of the current dictator and the initiator of North Korea’s cyberoperations, was a movie lover who became an internet enthusiast, a luxury reserved for the country’s elite. When Mr. Kim died in 2011, the country was estimated to have 1,024 IP addresses, fewer than on most New York City blocks.

Mr. Kim, like the Chinese, initially saw the internet as a threat to his regime’s ironclad control over information. But his attitude began to change in the early 1990s, after a group of North Korean computer scientists returned from travel abroad proposing to use the web to spy on and attack enemies like the United States and South Korea, according to defectors.

North Korea began identifying promising students at an early age for special training, sending many to China’s top computer science programs. In the late 1990s, the Federal Bureau of Investigation’s counterintelligence division noticed that North Koreans assigned to work at the United Nations were also quietly enrolling in university computer programming courses in New York.

“The F.B.I. called me and said, ‘What should we do?’ ” recalled James A. Lewis, at the time in charge of cybersecurity at the Commerce Department. “I told them, ‘Don’t do anything. Follow them and see what they are up to.’”

The North’s cyberwarfare unit gained priority after the 2003 invasion of Iraq by the United States. After watching the American “shock and awe” campaign on CNN, Kim Jong-il issued a warning to his military: “If warfare was about bullets and oil until now,” he told top commanders, according to a prominent defector, Kim Heung-kwang, “warfare in the 21st century is about information.”

The unit was marked initially by mishaps and bluster.

“There was an enormous growth in capability from 2009 or so, when they were a joke,” said Ben Buchanan, the author of “The Cybersecurity Dilemma” and a fellow at the Cyber Security Project at Harvard. “They would execute a very basic attack against a minor web page put up by the White House or an American intelligence agency, and then their sympathizers would claim they’d hacked the U.S. government. But since then, their hackers have gotten a lot better.”

A National Intelligence Estimate in 2009 wrote off the North’s hacking prowess, much as it underestimated its long-range missile program. It would be years before it could mount a meaningful threat, it claimed.

But the regime was building that threat.

When Kim Jong-un succeeded his father, in 2011, he expanded the cybermission beyond serving as just a weapon of war, focusing also on theft, harassment and political-score settling.

“Cyberwarfare, along with nuclear weapons and missiles, is an ‘all-purpose sword’ that guarantees our military’s capability to strike relentlessly,” Kim Jong-un reportedly declared, according to the testimony of a South Korean intelligence chief.

And the array of United Nations sanctions against Pyongyang only incentivized Mr. Kim’s embrace.

“We’re already sanctioning anything and everything we can,” said Robert P. Silvers, the former assistant secretary for cyberpolicy at the Department of Homeland Security during the Obama administration. “They’re already the most isolated nation in the world.”

By 2012, government officials and private researchers say North Korea had dispersed its hacking teams abroad, relying principally on China’s internet infrastructure. This allowed the North to exploit largely nonsecure internet connections and maintain a degree of plausible deniability.

A recent analysis by the cybersecurity firm Recorded Future found heavy North Korean internet activity in India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, and Indonesia. In some cases, like that of New Zealand, North Korean hackers were simply routing their attacks through the country’s computers from abroad. In others, researchers believe they are now physically stationed in countries like India, where nearly one-fifth of Pyongyang’s cyberattacks now originate.

Intelligence agencies are now trying to track the North Korean hackers in these countries the way they have previously tracked terrorist sleeper cells or nuclear proliferators: looking for their favorite hotels, lurking in online forums they may inhabit, attempting to feed them bad computer code and counterattacking their own servers.

Members of the Korea Internet Security Agency monitoring for cyberattacks at a briefing room in Seoul. Credit Jung Yeon-Je/Agence France-Presse — Getty Images
__________________________

Learning From Iran, Growing Bolder

For decades Iran and North Korea have shared missile technology, and American intelligence agencies have long sought evidence of secret cooperation in the nuclear arena. In cyber, the Iranians taught the North Koreans something important: When confronting an enemy that has internet-connected banks, trading systems, oil and water pipelines, dams, hospitals, and entire cities, the opportunities to wreak havoc are endless.

By midsummer 2012, Iran’s hackers, still recovering from an American and Israeli-led cyberattack on Iran’s nuclear enrichment operations, found an easy target in Saudi Aramco, Saudi Arabia’s state-owned oil company and the world’s most valuable company.

That August, Iranian hackers flipped a kill switch at precisely 11:08 a.m., unleashing a simple wiper virus onto 30,000 Aramco computers and 10,000 servers that would destroy data, and replace it with a partial image of a burning American flag. The damage was tremendous.

Seven months later, during joint military exercises between American and South Korean forces, North Korean hackers, operating from computers inside China, deployed a very similar cyberweapon against computer networks at three major South Korean banks and South Korea’s two largest broadcasters. Like Iran’s Aramco attacks, the North Korean attacks on South Korean targets used wiping malware to eradicate data and paralyze their business operations.

It may have been a copycat operation, but Mr. Hannigan, the former British official, said recently: “We have to assume they are getting help from the Iranians.”

And inside the National Security Agency, just a few years after analysts had written off Pyongyang as a low grade threat, there was suddenly a new appreciation that the country was figuring out cyber just as it had figured out nuclear weapons: test by test.

“North Korea showed that to achieve its political objectives, it will take down any company — period,” Mr. Silvers said.

Workers remove a poster for “The Interview” from a billboard in Hollywood, California, on December 18, 2014, a day after Sony announced it would cancel the movie’s Christmas release and pull it from theaters. Credit Robyn Beck/Agence France-Presse — Getty Images
_______________________________

Protecting Kim’s Image

A chief political objective of the cyberprogram is to preserve the image of the North’s 33-year-old leader, Kim Jong-un. In August 2014, North Korean hackers went after a British broadcaster, Channel Four, which had announced plans for a television series about a British nuclear scientist kidnapped in Pyongyang.

First, the North Koreans protested to the British government. “A scandalous farce,” North Korea called the series. When that was ignored, British authorities found that the North had hacked into the television network’s computer system. The attack was stopped before inflicting any damage, and David Abraham, the chief executive of Channel Four, initially vowed to continue the production.

That attack, however, was just a prelude. When Sony Pictures Entertainment released a trailer for “The Interview,” a comedy about two journalists dispatched to Pyongyang to assassinate North Korea’s young new dictator, Pyongyang wrote a letter of complaint to the secretary general of the United Nations to stop the production. Then came threats to Sony.

Michael Lynton, then Sony’s chief executive, said when Sony officials called the State Department, they were told it was just more “bluster,” he said.

“At that point in time, Kim Jong-un was relatively new in the job, and I don’t think it was clear yet how he was different from his father,” Mr. Lynton said in an interview. “Nobody ever mentioned anything about their cyber capabilities.”

In September 2014, while still attempting to crack Channel 4, North Korean hackers buried deep into Sony’s networks, lurking patiently for the next three months, as both Sony and American intelligence completely missed their presence.

The director of national intelligence, James Clapper, was even in Pyongyang at the time, trying to win the release of a detained American, and had dinner with the then-chief of the Reconnaissance General Bureau.

On Nov. 24, the attack on Sony began: Employees arriving at work that day found their computer screens taken over by a picture of a red skeleton with a message signed “GOP,” for “Guardians of Peace.”

“We’ve obtained all your internal data including your secrets and top secrets,” the message said. “If you don’t obey us, we’ll release data shown below to the world.”

That was actually a diversion: The code destroyed 70 percent of Sony Pictures’ laptops and computers. Sony employees were reduced to communicating via pen, paper and phone.

Mr. Lynton said the F.B.I. told him that nothing could have been done to prevent the attack, since it was waged by a sovereign state. “We learned that you really have no way of protecting yourself in any meaningful way,” he said of such nation-state attacks.

Sony struggled to distribute the film as theaters were intimidated. (Ultimately it was distributed for download, and may have done better than it would have.) In London, outside investors in Channel Four’s North Korea project suddenly dried up, and the project effectively died.

The Obama White House responded to the Sony hack with sanctions that the North barely noticed, but with no other retaliation. “A cyberbattle would be a lot more risky for the United States and its allies than for North Korea,” said Mr. Silvers.

Pho

Staff members at the Korea Internet and Security Agency in Seoul monitor the spread of ransomware cyberattacks earlier this year. Credit Yonhap
___________________________

Robbing Banks, Pyongyang Style

Beyond respect, and retribution, the North wanted hard currency from its cyberprogram.

So soon the digital bank heists began — an attack in the Philippines in October 2015; then the Tien Phong Bank in Vietnam at the end of the same year; and then the Bangladesh Central Bank. Researchers at Symantec said it was the first time a state had used a cyberattack not for espionage or war, but to finance the country’s operations.

Now, the attacks are increasingly cunning. Security experts noticed in February that the website of Poland’s financial regulator was unintentionally infecting visitors with malware.

It turned out that visitors to the Polish regulator’s website — employees from Polish banks, from the central banks of Brazil, Chile, Estonia, Mexico, Venezuela, and even from prominent Western banks like Bank of America — had been targeted with a so-called watering hole attack, in which North Korean hackers waited for their victims to visit the site, then installed malware in their machines. Forensics showed that the hackers had put together a list of internet addresses from 103 organizations, most of them banks, and designed their malware to specifically infect visitors from those banks, in what researchers said appeared to be an effort to move around stolen currency.

More recently, North Koreans seemed to have changed tack once again. North Korean hackers’ fingerprints showed up in a series of attempted attacks on so-called cryptocurrency exchanges in South Korea, and were successful in at least one case, according to researchers at FireEye.

The attacks on Bitcoin exchanges, which see hundreds of millions of dollars worth of Bitcoin exchanged a day, offered Pyongyang a potentially very lucrative source of new funds. And, researchers say, there is evidence they have been exchanging Bitcoin gathered from their heists for Monero, a highly anonymous version of cryptocurrency that is far harder for global authorities to trace.

The most widespread hack was WannaCry, a global ransomware attack that used a program that cripples a computer and demands a ransom payment in exchange for unlocking the computer, or its data. In a twist the North Koreans surely enjoyed, their hackers based the attack on a secret tool, called “Eternal Blue,” stolen from the National Security Agency.

In the late afternoon of May 12, panicked phone calls flooded in from around Britain and the world. The computer systems of several major British hospital systems were shut down, forcing diversions of ambulances and the deferral of nonemergency surgeries. Banks and transportation systems across dozens of countries were affected.

Britain’s National Cyber Security Center had picked up no warning of the attack, said Paul Chichester, its director of operations. Investigators now think the WannaCry attack may have been an early misfire of a weapon that was still under development — or a test of tactics and vulnerabilities.

“This was part of an evolving effort to find ways to disable key industries,” said Brian Lord, a former deputy director for intelligence and cyber operations at the Government Communications Headquarters in Britain. “All I have to do is create a moderately disabling attack on a key part of the social infrastructure, and then watch the media sensationalize it and panic the public.”

It ended thanks to Marcus Hutchins, a college dropout and self-taught hacker living with his parents in the southwest of England. He spotted a web address somewhere in the software and, on a lark, paid $10.69 to register it as a domain name. The activation of the domain name turned out to act as a kill switch causing the malware to stop spreading.

British officials privately acknowledge that they know North Korea perpetrated the attack, but the government has taken no retaliatory action, uncertain what they can do.

A screen shows news coverage of a North Korean missile test in a public square outside Pyongyang in August. Credit Kim Won-Jin/Agence France-Presse — Getty Images
____________________________________

A Cyber Arms Race

While American and South Korean officials often express outrage about North Korea’s cyberactivities, they rarely talk about their own — and whether that helps fuel the cyber arms race.

Yet both Seoul and Washington target the North’s Reconnaissance General Bureau, its nuclear program and its missile program. Hundreds, if not thousands, of American cyberwarriors spend each day mapping the North’s few networks, looking for vulnerabilities that could be activated in time of crisis.

At a recent meeting of American strategists to evaluate North Korea’s capabilities, some participants expressed concerns that the escalating cyberwar could actually tempt the North to use its weapons — both nuclear and cyber — very quickly in any conflict, for fear that the United States has secret ways to shut the country down.

The director of the Central Intelligence Agency, Mike Pompeo, said last week that the United States is trying to compile a better picture of the leadership around Kim Jong-un, for a report to President Trump. Figuring out who oversees cyber and special operations is a central mystery. The Japanese press recently speculated it could be an official named Jang Kil-su. Others are curious about Gen. No Kwang-chol, who was elevated to the Central Committee of the North’s ruling party in May 2016, and is one of the only members whose portfolio is undisclosed.

The big question is whether Mr. Kim, fearful that his nuclear program is becoming too large and obvious a target, is focusing instead on how to shut down the United States without ever lighting off a missile. “Everyone is focused on mushroom clouds,” Mr. Silvers said, “but there is far more potential for another kind of disastrous escalation.”

Choe Sang-Hun contributed reporting from Seoul.

A version of this article appears in print on October 16, 2017, on Page A1 of the New York edition with the headline: North Korea Deploys Corps Of Hackers Bent on Chaos.

nytimes.com

[Glenn Petersen] Hacking a Power Grid in Three (Not-So-Easy) Steps Author: Andy Greenberg Wired ...

Glenn Petersen — 10/16/2017 9:31:58 PM

Hacking a Power Grid in Three (Not-So-Easy) Steps

Author: Andy Greenberg
Wired
10.13.1712:00 pm

Getty Images
____________________________

In 2017, it can sometimes seem like power grids are practically crawling with digital intruders. Over just the last four months, news has emerged that Russian hackers penetrated a nuclear power plant, that the same group may have had hands-on access to an American energy utility's control systems, that another group of Kremlin hackers used a new form of automated malware to induce a power outage in Ukraine—and now this week, that North Korean hackers breached an American energy utility. Reading those headlines, you'd be forgiven for thinking that hacker-induced blackouts were a near-weekly occurrence, not a twice-ever-in-history event.

But as real as the threat of power-utility hacking may be, not every grid penetration calls for Defcon 1. Responding to them all with an equal sense of alarm is like conflating a street mugging with an intercontinental ballistic missile attack. What's publicly referred to as a "breach" of an energy utility could range from something barely more sophisticated than a typical malware infection to a nation-state-funded moonshot months or years in the making. Those incidents could also have vastly different consequences, from mere data theft to a potentially catastrophic infrastructure failure.

It's true that the last several years have seen a "stark spike" in hacking attempts on industrial control systems like power utilities, water, and manufacturing, says Rob Lee, a former NSA analyst who now runs the critical-infrastructure-focused security firm Dragos, Inc. But Lee says it's crucial to keep a sense of proportion: Of the hundreds of well-funded hacker groups that Dragos tracks globally, Lee says that roughly 50 have targeted companies with industrial control systems. Of those, Dragos has found only six or seven groups that have reached into companies' so-called "operations" network—the actual controls of physical infrastructure. And even among those cases, Lee says, only two such groups have been known to actually trigger real physical disruption: The Equation Group, believed to be the NSA team that used the Stuxnet malware to destroy Iranian nuclear enrichment centrifuges, and the Sandworm team behind the blackouts in Ukraine.

So when news arises that hackers have merely "penetrated" an energy utility—as North Korean hackers recently did—receive it with those numbers in mind, and not with the assumption that the next Stuxnet or Sandworm has dropped. "This is a world where people can die," Lee says. "If we come out and say it’s a big deal, it should be a big deal."

To that end, here's WIRED's guide to the different gradations of grid hacking, to help you dial in your panic to the appropriate level for the power-grid penetrations to come. And there will be more.

Step One: Network Breach

When government agencies or the press warn that hackers have compromised a power utility, in the vast majority of cases those intruders haven't penetrated the systems that control the flow of actual power, like circuit breakers, generators, and transformers. They're instead hacking into far more prosaic targets: corporate email accounts, browsers, and web servers.

Those penetrations, which typically start with spearphishing emails, or "watering hole" attacks that infect target users by hijacking a website they commonly visit, don't necessarily differ from traditional criminal or espionage-focused hacking. Most importantly, they don't generate the means of causing any physical damage or disruption. In some cases, the hackers may be performing reconnaissance for future attacks, but nonetheless don't get anywhere near the actual control systems that can tamper with electricity generation or transmission.

Earlier this week, for instance, a leaked report from security firm FireEye raised alarms when it revealed that North Korean hackers had targeted US energy facilities. A followup report from security news site Cyberscoop asserted that at least one of those attempts successfully penetrated a US utility. But a subsequent FireEye blog post indicated that its analysts had only found evidence that the hackers had sent a series of spearphishing emails to its intended victims—a fairly routine hacking operation that doesn't appear to have come close to any sensitive control systems.

"We have not observed suspected North Korean actors using any tool or method specifically designed to compromise or manipulate the industrial control systems (ICS) networks that regulate the supply of power," FireEye's statement reads. "Furthermore, we have not uncovered evidence that North Korean-linked actors have access to any such capability at this time."

North Korea no doubt has ambitions to wield power over US grid systems, and the fact that they've taken the first step is significant. But for now those attacks—and any others that stop at the level of IT compromise—should be seen at worst as foreboding, rather than an imminent threat of hacker blackouts.

Step Two: Operational Access

Hackers poking around an energy firm's IT system should cause some concern. Hackers poking at operational technology systems, or what some security experts call OT, is a far more serious situation. When hackers penetrate OT, or gain so-called operational access, they've moved from the computer systems that exist in practically every modern corporation to the far more specialized and customized control systems for power equipment, a major step towards manipulating physical infrastructure.

In one recent hacking campaign, for instance, Symantec revealed that a group of hackers it named DragonFly 2.0—possibly the same Russian group reported earlier in the summer to have broken into a US nuclear facility— had gained operational access to a "handful" of US energy firms. The intruders had gone so far as to screenshot the so-called human-machine interfaces for power systems, likely so that they could study them, and prepare to start flipping actual switches to launch a full-on grid attack.

"Evidence of a phish attempt and probably infection is one step in a ladder," says Mike Assante, a power-grid security expert and instructor at the SANS Institute, asecurity-focused training organization. "Scrapes from an HMI is a few rungs up the access scale," Assante says, contrasting the recent North Korean phishing with the Dragonfly 2.0 attack.

In theory, OT systems are "air-gapped" from IT systems, with no network connections between the two. But with the exception of nuclear power plants, which strictly regulate their operational systems' disconnection from outside networks, that air-gap is often more permeable than it ought to be, says Galina Antova, a co-founder of the industrial control system security firm Claroty. She says that Claroty has never analyzed an industrial control facility's setup and not found a "trivial" way in to its OT systems. "Just by mapping the network, we can see the pathway from IT to OT," she says. "There are ways of getting in."

But Dragos' Lee counters that given the small proportion of hackers that actually do manage to cross that gap, it's hardly a trivial distinction. That's in part because while IT systems are somewhat standardized, OT systems are more customized and esoteric, making them far less familiar. "They can basically practice and train so that they can completely compromise IT networks," Lee says. "If they want to get to operations networks, it's going to be weird equipment and weird setups, and they're going to have to learn that."

Step Three: Coordinated Attack

Even when intruders have "hands-on-the-switches" access to grid control systems, Lee says, using that access effectively is far harder than it might seem. In fact, he argues that all actions ahead of flipping that switch are just a preparatory stage that represents only about 20 percent of the hackers' work.

Beyond the obscurity of whatever equipment setup a utility may have, Lee points out that its physical processes can require real expertise to manipulate, as well as months more effort and resources—not just opening a few circuit breakers to cause a blackout. Even after hackers gain access to those controls, "I can confidently say they’re still not at a stage to turn off the power," Lee says. "They could turn off some [circuit] breakers, but they’d have no understanding of the effect. They might be stopped by a safety system. They don’t know."

In the Ukrainian blackout of late 2015, the first-ever confirmed case of hackers causing a power outage, for instance, the intruders manually opened dozens of circuit breakers at three different facilities across the country, using remote access to electric distribution stations' control systems—in many cases by literally hijacking the mouse controls of the stations' operators. Analysts who responded to the attack believe it likely required months of planning and a team of dozens working in coordination. Even so, the blackout it caused lasted just six hours, for roughly a quarter-million Ukrainians.

Hackers essentially have to chose between the scope and duration of a blackout, Lee says. "If they wanted to do the full Eastern Interconnect, that’s exponentially more resources," he says, referring to the grid that covers nearly the full eastern half of the US. "And if they want to take it down for a full week, that’s an exponential of an exponential."

Some grid hackers do appear to be putting in the work to plan a wider, more disruptive operation. The second Ukrainian blackout attack used a piece of malware known as Crash Override, or Industroyer, capable of automating the process of sending sabotage commands to grid equipment, and built to be adapted to different countries' setups so that it could be deployed broadly across multiple targets.

That specimen of ultra-advanced grid hacking malware is troubling. But it's also extraordinarily rare. And there's a significant gap between a piece of Black Swan malware and the dozens number of grid-penetration incidents that often amount to little more than spearphishing. No power grid breach is a good thing. But better to recognize the difference between a dress rehearsal and the main event—especially when there are more of those events on the horizon.

wired.com

[Glenn Petersen] Chinese Company Behind Adware That Infected Over 250 Million Computers By Cata...

Glenn Petersen — 6/3/2017 7:54:34 PM

Chinese Company Behind Adware That Infected Over 250 Million Computers

By Catalin Cimpanu
Bleeping Compute
June 2, 2017 04:10 AM

A Chinese digital marketing company named Rafotech is behind a wave of inter-connected adware families that found their way onto the computers of millions of users, says Israeli cyber-security firm Check Point.

According to an extensive investigation, Check Point claims Rafotech has designed a very intrusive adware that hijacks people's browsers with the primary purpose of redirecting traffic to fake search engines.

These fake search engines do nothing more than divert search queries through Google and Yahoo's affiliate programs, earning the Chinese company a commission.

Fireball adware family is on a rampageRafotech spreads its adware by bundling it with legitimate software, sometimes without giving users the opportunity to opt-out of the installation.

This tactic has landed various of its adware strains on the computers of over 250 million computers, according to a rough estimation from Check Point's team.

The most affected countries are India (25.3 million infections - 10.1%), Brazil (24.1 million - 9.6%), Mexico (16.1 million - 6.4%), and Indonesia (13.1 million - 5.2%). The US is also on the list with 5.5 million infections, accounting for 2.2% of the total global infection numbers.

Furthermore, experts believe the adware made its way in over 20% of all corporate networks, which means that one in five companies has a computer infected with this adware, which Check Point nicknamed Fireball.

Fireball adware has backdoor trojan-level capabilitiesThe adware's reach inside corporate networks is a big issue because adware, in general, has evolved in the past year. As Bleeping Computer's malware expert Lawrence Abrams wrote numerous times in our adware removal guides, most of today's adware contains the same features found in banking or backdoor trojans.

Fireball is one of those adware families. Check Point experts said yesterday in a report that Fireball contains features that allow the Chinese company to push and execute any file (malware) to the victim's computer.

Because the adware is so intrusive at the browser level, experts fear that its maintainers would have no technical impediment from switching from a revenue model that's based on traffic redirection and ad injection to something that involves stealing user credentials.

Fireball's fake search engines rank in Alexa Top 10KIf you're wondering how come you've never heard of a malware family that infected over 250 million computers, the explanation resides in the fact that Check Point refers to all the adware created by Rafotech as Fireball.

Adware strains like the one Rafotech create are usually referred to by the name of the site it redirects traffic to. For example, Fireball contains adware strains such as the hugely prevalent Youndoo adware [ removal guide], Trotux [ removal guide], Startpageing123 [ removal guide], Luckysearch123 [ removal guide], Hohosearch [ removal guide], Yessearches [ removal guide], and many others.

Some of these fake search engines to which Fireball adware strains redirect traffic can be found in the Alexa Top 10,000 most popular sites on the Internet. Some of these fake search engines receive so much traffic that a few managed to break into the Alexa Top 1,000 site list, well above many legitimate sites. This shows the massive scale of Rafotech's operation.

bleepingcomputer.com

[FJB] Trend Micro presents their report in a .pdf file, which is a format susceptible ...

FJB — 5/28/2017 3:32:28 AM

Trend Micro presents their report in a .pdf file, which is a format susceptible to malware infection. You can't make this stuff up. This article doesn't use the word attachment a single time. DON'T OPEN ATTACHMENTS, especially of dubious origin. WannaCrypt requires you to open an attachment for infection.

[Glenn Petersen] Feeling Locky, punk? Ransomware grew eight-fold last year Days of future past ...

Glenn Petersen — 5/27/2017 8:36:17 PM

Feeling Locky, punk? Ransomware grew eight-fold last year

Days of future past

24 May 2017 at 21:04, John Leyden
The Register

Ransomware saw a more than eight-fold (752 per cent) increase as a mode of attack in 2016, according to Trend Micro.

The infosec firm estimates file-scrambling malware families such as Locky and Goldeneye raked in $1 billion in 2016.

2016 was the year when ransomware ruled, and this danger has been maintained by recent WannaCrypt attacks and the latest threat Eternal Rocks, which has no kill switch and continues to grow.

Trend Micro's report, Ransomware: Past, Present and Future (pdf), provides a useful overview of the history and evolution of ransomware, from its beginnings in Russia in 2005/6 to the growth of the ransomware-as-a-service ( RaaS) business model.

RaaS means that unskilled crooks can hire code and rent the command and control infrastructure they need to run ransomware attacks.

Crooks behind ransomware attacks in general are targeting organisations rather than individual consumers, with the encryption of business-critical files like databases in order to inflict the maximum damage and exert the maximum leverage in securing payouts.

Trend Micro's report concludes with a list of top tips in defending against ransomware attacks. It's mostly standard stuff about the need for patching and users education against the threat of phishing. However it's backup advice is a slight variant on the usual. Regular back-ups of key data: three copies, two formats, and one air-gapped from the network should be taken, security researchers at Trend Micro advises. ®

theregister.co.uk

[Glenn Petersen] h/t Ron America’s dangerous Internet delusion By Robert J. Samuelson The Was...

Glenn Petersen — 5/23/2017 11:26:16 PM

h/t Ron

America’s dangerous Internet delusion

By Robert J. Samuelson
The Washington Post
May 21, 2017

A screenshot shows a WannaCry ransomware demand in May 2017. (Symantec/Reuters)
________________

The United States may have escaped most digital damage from this month’s unleashing of a global “ ransomware” virus, though cyber-experts fear more attacks. One possible explanation is that the malicious software (“malware”) harms older versions of Microsoft’s Windows operating system, which most Americans have replaced. Perhaps many users in other countries haven’t. Whatever the explanation, this is not the end of Internet threats.

The unmistakable lesson of recent years is that the Internet is a double-edged sword. Despite enormous benefits — instant access to huge quantities of information, the proliferation of new forms of businesses, communications and entertainment — it also encourages crime, global conflict and economic disruption. The drift seems ominous.

The Russians, it is widely agreed, hacked into the computers of the Democratic National Committee, raising fears that the U.S. presidential election was compromised. In Dallas, hackers turned on the city’s emergency sirens for more than an hour. Cyberthieves stole $81?million from Bangladesh’s central bank, though some of the money has apparently been recovered.

We are dangerously dependent on Internet-based systems. All these incidents threatened the social fabric of the victimized societies. If the Russians hacked the Democrats, who might be next? Could whoever triggered Dallas’s sirens turn off the traffic lights or the local power grid? How safe are electronic financial transfers?

Ransomware validates these fears. What was stunning is how quickly the recent outbreak spread. One estimate had it quickly migrating to 150 countries and affecting 200,000 computers. Despite the rapid response — the discovery of a so-called “kill switch” in the malware that deactivated the virus — the basic message remains: Much health care, transportation and ordinary business might close if deprived of Internet access, whether by hostile governments (North Korea?) or cybercriminals.

This makes the Internet a weapon that can be used against us — or by us. In a presentation to the Senate Intelligence Committee, Daniel Coats, the director of national intelligence, put it this way: “Our adversaries are becoming more adept at using cyberspace to threaten our interests and advance their own, and despite improving cyber defenses, nearly all information, communication networks and systems will be at risk for years.”

The trouble is that we are aiding and abetting our adversaries. We are addicted to the Internet and refuse to recognize how our addiction subtracts from our security. The more we connect our devices and instruments to the Internet, the more we create paths for others to use against us, either by shutting down websites or by controlling what they do. Put differently, we are — incredibly — inviting trouble. Our commercial interests and our national security diverge.

The latest example of this tension is the “Internet of things” or the “smart home.” It involves connecting various devices and gadgets (thermostats, lights, cameras, locks, ovens) to the Internet so they can be operated or monitored remotely. This would be a major Internet expansion and moneymaker.

One consulting firm, Ovum, forecasts that from 2016 to 2021, the number of smart homes worldwide will rise from 90?million to 463 million, with the largest concentrations in the United States and China. Ovum anticipates that each smart home will have nearly nine separate devices attached to the Internet and that the global total will hit 4 billion by 2021.

All this increases the vulnerability of Americans and others to cyberattacks. To be sure, the “Internet of things” will be fitted with security protections. But as we’ve seen, mistakes and gaps occur. Or hackers circumvent security firewalls. The growth of the “Internet of things” creates more avenues and opportunities for hostile nations or rogue hackers to penetrate various cyberdefenses.

The Coats presentation makes this explicit: “In the future, state and nonstate actors will likely use [‘Internet of things’] devices to support intelligence operations .?.?. or attack targeted computer networks.”

Just how we can or should regulate the tension between our commercial interests and our strategic security isn’t clear. But we can’t even start a conversation if we don’t admit that the tension is real and is getting worse all the time.

Instead of candor, we compartmentalize. We lavish praise on our cybercapitalists — Mark Zuckerberg, Jeff Bezos and others — for their accomplishments while conveniently forgetting that the same technologies also make us less safe. (Disclosure: Bezos owns The Post.) If there are deficiencies with cybersecurity, we consider them separately. We embrace the “Internet of things” without admitting that it’s also the “Internet of hazards.”

The technologies to promote the Internet and protect it are one and the same. We need to consider our addiction in all its aspects, even the disagreeable. But we are in denial.

washingtonpost.com

[Glenn Petersen] Cyberattack’s Impact Could Worsen in ‘Second Wave’ of Ransomware By SEWELL CHA...

Glenn Petersen — 5/14/2017 4:57:42 PM

Cyberattack’s Impact Could Worsen in ‘Second Wave’ of Ransomware

By SEWELL CHAN and MARK SCOTT
New York Times
MAY 14, 2017

LONDON — Security experts are warning that the global cyberattack that began on Friday is likely to be magnified in the new workweek as users return to their offices and turn on their computers.

Many workers, particularly in Asia, had logged off on Friday before the malicious software, stolen from the United States government, began proliferating across computer systems around the world. So the true effect of the attack may emerge on Monday as employees return and log in.

Moreover, copycat variants of the malicious software behind the attacks have begun to spread, according to experts. “We are in the second wave,” said Matthieu Suiche of Comae Technologies, a cybersecurity company based in the United Arab Emirates. “As expected, the attackers have released new variants of the malware. We can surely expect more.”

Britain’s National Cyber Security Center said Sunday that it had seen “no sustained new attacks” but warned that compromised computers might not have been detected yet and that the malware could further spread within networks.

So far, the main targets of the ransomware attack have been outside the United States. But neither the federal government nor American corporations assume that this will continue to be the case.

Over the weekend, the Trump administration’s top security officials, led by the homeland security adviser, Thomas P. Bossert, gathered in the White House Situation Room to assess the threat to American interests, including government agencies, companies and hospitals.

Monday could bring a wave of attacks to the United States, warned Caleb Barlow, vice president of threat intelligence for IBM. “How the infections spread across Asia, then Europe overnight will be telling for businesses here in the United States,” he said.

The cyberattack has hit 200,000 computers in more than 150 countries, according to Rob Wainwright, the executive director of Europol, the European Union’s police agency.

Among the organizations hit were FedEx in the United States, the Spanish telecom giant Telefónica, the French automaker Renault, universities in China, Germany’s federal railway system and Russia’s Interior Ministry. The most disruptive attacks infected Britain’s public health system, where surgeries had to be rescheduled and some patients were turned away from emergency rooms.

A 22-year-old British researcher who uses the Twitter name MalwareTech has been credited with inadvertently helping to stanch the spread of the assault by identifying the web domain for the hackers’ “kill switch” — a way of disabling the malware. Mr. Suiche of Comae Technologies said he had done the same for one of the new variants of malware to surface since the initial wave.

On Sunday, MalwareTech was one of many security experts warning that a less-vulnerable version of the malware is likely to be released. On Twitter, he urged users to immediately install a security patch for older versions of Microsoft’s Windows, including Windows XP. (The attack did not target Windows 10.)

Robert Pritchard, a former cybersecurity expert at Britain’s defense ministry, said that security specialists might not be able to keep pace with the hackers.

“This vulnerability still exits; other people are bound to exploit it,” he said. “The current variant will make its way into antivirus software. But what about any new variants that will come in the future?”

All it would take is for a new group of hackers to change the original malware code slightly to remove the “kill switch” and send it off into the world, using the same email-based methods to infiltrate computer systems that the original attackers used, experts said.

“The bad guys who create ransomware, they steal from each other with impunity,” said Allan Liska, an analyst with Recorded Future, a cybersecurity company. “If something works, others will grab it. Something I’m worried about is someone else adopt this strategy because it works so well.”

The Microsoft patch will help, but installing it across large organizations will take time.

Microsoft has complained for years that a large majority of computers running its software are using pirated versions. The spread of hacking attacks has made legal versions of software more popular, as they typically provide automatic updates of security upgrades.

Governments around the world were bracing themselves for the start of the workweek.

“This is crucial for businesses when reopening on Monday: Please beware and anticipate, and take preventive steps against the WannaCry malware attack,” Indonesia’s communication and information minister, Rudiantara, who like many Indonesians uses only one name, said at a news conference.

He confirmed that one hospital — Dharmais Hospital in the capital, Jakarta, which specializes in cancer treatment — had been afflicted by the malware, but without major effects on patients.

“Through collective efforts by Indonesian cybersecurity stakeholders, I am optimistic that we will be able to minimize the severity of the threat,” Mr. Rudiantara said in a phone interview.

In Britain, the fallout from the attack continued on Sunday. Two opposition parties, the Labour Party and the Liberal Democrats, asserted that the governing Conservative Party had not done enough to prevent the attack. With a general election scheduled for June 8, officials have been racing to get ahead of the problem.

Britain’s defense minister, Michael Fallon, told the BBC on Sunday that the government was spending about 50 million pounds, about $64 million, to improve cybersecurity at the National Health Service, where many computers still run the outdated Windows XP software, which Microsoft had stopped supporting.

A government regulator warned the N.H.S. last July that updating antiquated hardware and software was “a matter of urgency,” and noted that one hospital had already had to pay £700,000, about $900,000, to repair a breach that began after an employee clicked on a web link in an unsafe email.

“The threat from cyber attacks has not only put patient information at risk of loss or compromise but also jeopardizes access to critical patient record systems by clinicians,” the regulator, the Care Quality Commission, wrote in its report.

At the National Health Service, employees said they had been cautioned about their computer use.

“We are all being extra careful,” said Greg Elston, a paramedic at St. Mary’s Hospital in central London. “We’ve been instructed not to open email attachments on our phones.”

Nancy Harper, who accompanied her mother to the hospital on Saturday for an X-ray, said: “It’s concerning that the N.H.S. was dependent on these outdated systems. If your average person has access to cheap cloud storage these days, then hospitals should be using similar backup methods. I hope this was a wake-up call.”

Others praised the service for maintaining services despite the strain. Himmat Sandut, who took his mother to the emergency room after she collapsed at home, said his experience had been smooth and fast.

“I was worried we would be faced with a huge queue, but we were seen within 10 minutes, and they’ve now given my mum a bed,” he said on Saturday. “I’m surprised and impressed under the current circumstances.”

The least functioning part of the hospital appeared to be the elevator, which got stuck on Saturday before resuming operations — in the wrong direction.

“Was the elevator hacked as well?” one man asked jokingly, causing an elevator packed with tense doctors and nurses to erupt in laughter. “Are we going to have to pay a ransom to get out?”

Sewell Chan reported from London, and Mark Scott from Rome. Reporting was contributed by Keith Bradsher from Beijing; Joe Cochrane from Jakarta, Indonesia; Paul Mozur from Hong Kong; Richard C. Paddock from Bangkok; Austin Ramzy from New York; and Ceylan Yeginsu from London.

nytimes.com

[Glenn Petersen] COBOL Is Everywhere. Who Will Maintain It? by David Cassel The New Stack ...

Glenn Petersen — 5/14/2017 10:41:51 AM

COBOL Is Everywhere. Who Will Maintain It?

by David Cassel

The New Stack

6 May 2017 9:00am

Think COBOL is dead? About 95 percent of ATM swipes use COBOL code, Reuters reported in April, and the 58-year-old language even powers 80 percent of in-person transactions. In fact, Reuters calculates that there’s still 220 billion lines of COBOL code currently being used in production today, and that every day, COBOL systems handle $3 trillion in commerce. Back in 2014, the prevalence of COBOL drew some concern from the trade newspaper American Banker.

“The mainframe was supposed to have been be replaced by farms of smaller commodity servers and cloud computing by now, but it still endures at many banks,” the trade pub reported.

But should we be concerned that so much of our financial infrastructure runs on an ancient infrastructure? American Banker found 92 of the top 100 banks were still using mainframe computers — and so were 71 percent of the companies in the Fortune 500. As recently as five years ago, the IT group at the Bank of New York Mellon had to tend to 112,500 different COBOL programs — 343 million lines of code, according to a 2012 article in Computerworld. And today a quick Google search today shows the Bank of New York Mellon is still hiring COBOL developers.

COBOL was originally developed in the 1950s as a stop-gap by the Department of Defense, but then computer manufacturers began supporting it, “resulting in widespread adoption,” according to Wikipedia. Now the Eisenhower-era programming language — based on design work by Grace Hopper — is everywhere. And because it’s so entrenched it can be difficult to transition to a new language. Reuters reported in April that when Commonwealth Bank of Australia replaced its core COBOL platform in 2012, it took five years — and cost $749.9 million.

One COBOL programmer told the Tampa Bay Times his experience with a company transitioning to Java from COBOL. “It’s taken them four years, and they’re still not done.”

There’s now some concerns about where the next generation of COBOL programmers will come from. In 2014, American Banker reported banks are “having trouble finding talented young techies who want to work in a bank and a shortage of people with mainframe and COBOL skills.” The CIO at the $38 billion-asset First Niagara Financial Group in Buffalo said they can’t compete with Google and Facebook when it comes to offering young techies a “cool” workplace for their resume.

And then there’s the language itself. “COBOL isn’t as sexy as working with Elixir, or Golang,” argued The Next Web. COBOL historically hasn’t been the most attractive option for a hip young programmer, admitted to Stuart McGill, chief technology officer at development tools vendor Micro Focus. Back in 2009, he was telling Computerworld, “If you’ve been trained on Windows using Virtual Studio the last thing you want to do is go back to the mainframe.”

In a March thread on Hacker News, someone described learning COBOL as “like swallowing a barbed cube-shaped pill,” lamenting the decades-old legacy code “swamped with technical debt…modified, extended, updated, moved to new hardware over and over… Documentation, if any, is hopelessly out of date.”

Another commenter complained that “You will most likely spend the rest of your career doing maintenance work rather than any greenfield development. There is nothing wrong with that but not everybody likes the fact they can’t create something new.”

And a May 2016 study published by Congress’ Government Accountability Office criticized the U.S. Department of Justice and the Treasury Department for their legacy COBOL systems. It found many agencies were using COBOL — including the Department of Homeland Security (which uses COBOL and other languages to track hiring for immigration and customs enforcement agents on a 2008 IBM z10 mainframe). Veterans’ benefits claims were also tracked with a COBOL system, and the Social Security Administration was using COBOL to calculate retirement benefits. (In fact, the SSA had to re-hire some retired employees just to maintain its existing COBOL systems, according to the report.)Even the Department of Justice’s Information about the inmate population passes through a hybrid COBOL/Java system.

There have been reports that some institutions are still clinging to elderly COBOL programmers — suggesting they’re having trouble finding qualified replacements. In 2014, Bob Olson, a vice president at Unisys, even told American Banker about a government client with an IT worker “who’s on oxygen. He’s 70 years old, he knows the keys to the kingdom, he knows where everything is, it’s all sitting in his head. They send out a police car to pick him up every morning and bring him into work in a vault-like room.”

Of course, this has also created some opportunities. 75-year-old Bill Hinshaw, a former COBOL programmer, has even founded a company in northern Texas named COBOL Cowboys. (And yes, their client list includes at least five banks.) The company’s slogan? “Not our first rodeo.”

“Some of the software I wrote for banks in the 1970s is still being used,” Hinshaw told Reuters. “After researching many published articles (both positive and negative) on the future life of COBOL, we came away with renewed confidence in its continued life in the coming years,” explained the company’s web page. It cites IBM enhancements which allow Cobol and Java to run together on mainframes.

Reuters reported that Hinshaw divides his time between 32 children and grandchildren “and helping U.S. companies avert crippling computer meltdowns.” When he started programming, instructions were coded into punch cards which were fed into mainframes. But decades later, when he finally reached retirement age, “calls from former clients just kept coming.”

They’re willing to pay almost anything, he told Reuters, and “You better believe they are nice since they have a problem only you can fix.” Some companies even offered him a full-time position.

The company boasts some retirement age coders on its roster, as well as some “youngsters” who are in their 40s and early 50s.

There are strong reactions to a recent article arguing banks should let COBOL die. “The idea that large corporations are simply going to move on from COBOL is out of touch with reality,” one commenter wrote on Hacker News. “It really can’t be overstated how deeply old COBOL programs are embedded into these corporations. I worked for one that had been using them since the language itself was created, and while they all could see the writing on the wall, the money to do the change simply wasn’t there.”

But they also believed it would be possible to find new programmers. “They just need to maintain and occasionally update some ancient program that’s been rock-solid for longer than they’ve been alive.”

Computerworld also reported that there were 75 schools in the U.S. that were still teaching COBOL, “thanks in part to efforts by companies like IBM.” American Banker found they were mostly community colleges and technical schools, though it adds that 68,000 students entered IBM’s “Master the Mainframe” contest between 2012 and 2014. Last month IBM told Reuters that over the last 12 years they’ve trained more than 180,000 developers through fellowships and other training programs — which averages out to 15,000 a year. One IBM fellow insisted that “Just because a language is 50 years old, doesn’t mean that it isn’t good.” So there are at least some channels in place to create new COBOL programmers.

Leon Kappelman, a professor of information systems at the University of North Texas, says he’s been hearing dire predictions about COBOL’s future for the last 30 years. Last year he told CIO magazine, undergrads who take the school’s two classes in mainframe COBOL “tend to earn about $10,000 per year more starting out than those that don’t.” He also believes it’s a secure career because large organizations rarely have a compelling business case for replacing their COBOL code with something new.

“The potential for career advancement could be limited, so you get a lot of job security – but it could get boring.”

Some commenters on Hacker News see the issue pragmatically. “What you have to remember is that when the COBOL code was written, it replaced hundreds, maybe thousands of people doing manual data entry and manipulation, maybe even pen-on-paper,” one commenter wrote in April. “That gives you a fantastic return on investment. After that’s been done, replacing one computer system with a newer one is completely different, a spectacular case of diminishing returns.”

So business remains strong for the Cobol Cowboys. Recent press coverage (including the Reuters article) brought visitors from 125 countries to their website — and over 300 requests to join their group. I contacted CEO Hinshaw to ask him about the language’s future, and Hinshaw says he feels there’s a renewed interest COBOL that “may help to bring the younger generation of programmers into COBOL if they can overcome the press on COBOL and concentrate on a career of backroom business solutions written in COBOL.” He points out that the billions of lines of code obviously represent “60+ years of proven business rules.”

Even if companies transitioned to Java, the problem could recur later. “Will a future generation of young programmers want to transition away from Java to a newer language — and companies will have to once again go through another expensive and time-consuming transition.”

“Only time will tell if COBOL programmers are a dying breed, or a new breed embracing COBOL comes riding onto the scene….”

thenewstack.io

[JakeStraw] Cyberattack stings U.K. health system, moves across globe May 12, 201 seekingalp...

JakeStraw — 5/12/2017 3:26:29 PM

Cyberattack stings U.K. health system, moves across globe
May 12, 201
seekingalpha.com

[JakeStraw] Fortinet Reports First Quarter 2017 Financial Results markets.siliconinvestor.co...

JakeStraw — 5/2/2017 8:17:51 AM

Fortinet Reports First Quarter 2017 Financial Results
markets.siliconinvestor.com

[JakeStraw] Cisco, Palo Alto, Symantec Gear Up For Cloud Cybersecurity Shift investors.com

JakeStraw — 1/19/2017 11:41:34 AM

[JakeStraw] CyberArk Software Ltd. was upgraded by analysts at Imperial Capital from an "in-...

JakeStraw — 11/7/2016 11:22:26 AM

CyberArk Software Ltd. was upgraded by analysts at Imperial Capital from an "in-line" rating to an "outperform" rating. They now have a $55.00 price target on the stock.

[JakeStraw] CyberArk Announces Strong Third Quarter 2016 Results finance.yahoo.com “CyberAr...

JakeStraw — 11/3/2016 8:13:11 AM

CyberArk Announces Strong Third Quarter 2016 Results
finance.yahoo.com

“CyberArk’s record revenues in the third quarter were driven by strong global demand across verticals as organizations continue to prioritize privileged account security,” said Udi Mokady, CyberArk Chairman and CEO. “Our results demonstrate that companies of all sizes are choosing CyberArk as a strategic partner to help protect their most valuable assets on premise and in the cloud. Our investments in product innovation, expanding our sales and marketing engine and growing our partner ecosystem, are strengthening our position as the leader in privileged account security.”

[JakeStraw] Security-Software Picks for the Rest of 2016 CyberArk Software, Fortinet, Palo A...

JakeStraw — 9/13/2016 8:33:25 AM

Security-Software Picks for the Rest of 2016
CyberArk Software, Fortinet, Palo Alto and Proofpoint are rated at Outperform.
barrons.com

[Glenn Petersen] Intel weighs sale of cyber security business Hannah Kuchler in San Francisco an...

Glenn Petersen — 6/27/2016 9:34:57 AM

Intel weighs sale of cyber security business

Hannah Kuchler in San Francisco and James Fontanella-Khan in New York
Financial Times
June 26, 2016 2:04 pm

Intel is looking at options for Intel Security, including potentially selling the antivirus software maker formerly known as McAfee which it bought for $7.7bn almost six years ago.

The Silicon Valley chipmaker has been talking to bankers about the future of its cyber security unit in a deal that would be one of the largest in the sector, according to people close to the discussions.

Private equity buyers are increasingly interested in cyber security companies, anticipating strong cash flow as corporate customers become increasingly worried about protecting their business from cyber attacks. A group of PE firms might club together to buy Intel Security if it is sold for the same price or higher than the $7.7bn Intel originally paid for it.

Earlier this month, Bain Capital sold Blue Coat Security to Symantec for almost twice what it paid the cyber defence company last year. Vista Equity Partners also bought Ping Identity, an authentication service, which had been planning an initial public offering at the start of June.

Venture capital flooded into the highly fragmented cyber security industry in 2014 and 2015, as the old stalwarts appeared unable to protect against newer, more sophisticated attacks. Now, as fundraisings slow and in some cases valuations come down, many in the industry expect consolidation as small start-ups are bought for their technology or their sought-after cyber security engineers.

Intel has been restructuring its business after it was hit by the declining PC market, announcing plans this year to cut 12,000 jobs in its largest workforce reduction in a decade. The company is trying to refocus around selling chips for cloud computing rather than PCs, which still contribute 60 per cent of sales and 40 per cent of profits.

The chipmaker bought McAfee in 2010 intending to embed its cyber security functionality on to chips, promising the ability to detect threats at a deeper level. Under this plan, device manufacturers would still have to decide to activate this option.

But almost six years later Intel has not yet completed this plan. David DeWalt, the chief executive who helped engineer the sale, left to lead FireEye, a next generation security company and his replacement, Mike DeCesare, left in 2014 and now runs another security company called ForeScout. Intel Security is led by Chris Young, a former Cisco senior vice-president.

Intel renamed the company Intel Security but maintained the McAfee brand for some of its products.

ft.com

[Glenn Petersen] Blue Coat's planned IPO is off the table as the company is being acquired: Syma...

Glenn Petersen — 6/12/2016 11:25:52 PM

Blue Coat's planned IPO is off the table as the company is being acquired:

Symantec Set to Buy Blue Coat Systems in $4.65 Billion Deal

Computer-security company to gain portfolio of cyberdefense technologies along with a new CEO

By Robert McMillan and Dana Cimilluca
The Wall Street Journal
June 12, 2016 7:38 p.m. ET

Symantec Corp. SYMC -0.52 % agreed to buy Blue Coat Systems Inc. in a $4.65 billion deal that will give the computer-security company a new portfolio of cyberdefense technologies along with a new chief executive.

Blue Coat Chief Executive Greg Clark is set to take that role at Symantec after the deal closes, which is expected to occur before October, the companies announced late Sunday. Symantec has been searching for a new CEO ever since Michael Brown stepped down in April amid disappointing financial results.

In moves representing votes of confidence on the deal, private-equity firm Bain Capital LLC, which controls Blue Coat, will invest $750 million of the proceeds back into the combined company in the form of debt convertible into equity, while Silver Lake will invest $500 million in convertible debt on top of $500 million it already agreed to put into Symantec this year.

Following a rash of high-profile breaches, computer security is now a major topic of discussion in corporate boardrooms. While Symantec is a pioneer in antivirus software that runs on personal computers, Blue Coat’s domain is the World Wide Web. The company’s technology is used by more than 15,000 companies to block dangerous or inappropriate websites.

Blue Coat is also a seller of security services delivered over the internet, also known as “cloud” computing. Blue Coat had filed for an initial public offering earlier this year, and analysts’ estimates for the value of the company should it have taken that route were in the range of what Symantec is paying.

In a joint interview, Symantec Chairman Daniel Schulman and Mr. Clark said the combined company would be a security juggernaut that would have more than 3,000 engineers at its disposal.

“This is an extremely compelling combination,” Mr. Schulman said. “We now are going to have the scale, the portfolio of products and services, and the resources necessary to protect customers against a constantly evolving threat landscape.”

“There is virtually no product overlap between Blue Coat and Symantec,” Mr. Clark added.

Symantec has struggled to translate increased corporate concern about cyberthreats into new revenue. Sales of the company’s corporate-security products were down 2%, totaling $2.1 billion, during its 2015 fiscal year. Revenue in the company’s consumer business dropped 9%. Shares of Symantec have declined 27% the past year.

The deal is Symantec’s largest acquisition since its 2005 purchase of Veritas Software, and the latest in a series of big steps it has taken as Symantec tries to turn around its fortunes in the increasingly competitive market for computer-security products.

In January, Symantec sold off its Veritas data-storage division to Carlyle Group CG -1.56 % for $7.4 billion. Back in 2005, Symantec had paid more than $10 billion for the company, but the acquisition proved to be an unwieldy distraction.

Some layoffs are expected following the acquisition. “I think inevitably in any combination of companies there are some redundancies,” Mr. Schulman said.

Bain has done well on its Blue Coat investment. It bought the company about a year ago in a deal valued at $2.4 billion. It has since bolstered the company with a couple of cloud-related acquisitions.

David Humphrey, a Bain managing director, will be appointed to Symantec’s board when the transaction closes.

Buying Blue Coat last year “would have been impossible,” operationally, as the company was in the process of divesting itself of Veritas, said Thomas Seifert, Symantec’s chief financial officer.

“If you look at what we’ve paid, it’s well within the range of what an IPO valuation would have been,” he said in a separate interview. “With this IPO path in mind, we think we paid fair value for what we’re receiving.”

The combined company would have some $4.4 billion in fiscal-2016 revenue, nearly two-thirds from corporate security. Symantec ultimately expects $150 million of cost savings from the deal, on top of a $400 million expense-reduction drive the company had already announced.

Write to Robert McMillan at Robert.Mcmillan@wsj.com and Dana Cimilluca at dana.cimilluca@wsj.com

wsj.com

[The Ox] Message 30613659

The Ox — 6/9/2016 11:51:52 AM

[Glenn Petersen] Blue Coat Systems, which went private in December 2011 and was acquired by Bain ...

Glenn Petersen — 6/6/2016 9:39:42 AM

Blue Coat Systems, which went private in December 2011 and was acquired by Bain Capital for $2.4 billion in March 2015, is being taken public again. The stand-alone board: Subject 30976

It has been renamed Blue Coat Inc. and will trade under the symbol BCLT.

[Glenn Petersen] SEC says cyber security biggest risk to financial system By Lisa Lambert and ...

Glenn Petersen — 5/23/2016 9:30:39 AM

SEC says cyber security biggest risk to financial system

By Lisa Lambert and Suzanne Barlyn
Reuters
Wed May 18, 2016 7:07am EDT

WASHINGTON Cyber security is the biggest risk facing the financial system, the chair of the U.S. Securities and Exchange Commission (SEC) said on Tuesday, in one of the frankest assessments yet of the threat to Wall Street from digital attacks.

Banks around the world have been rattled by a $81 million cyber theft from the Bangladesh central bank that was funneled through SWIFT, a member-owned industry cooperative that handles the bulk of cross-border payment instructions between banks.

The SEC, which regulates securities markets, has found some major exchanges, dark pools and clearing houses did not have cyber policies in place that matched the sort of risks they faced, SEC Chair Mary Jo White told the Reuters Financial Regulation Summit in Washington D.C.

"What we found, as a general matter so far, is a lot of preparedness, a lot of awareness but also their policies and procedures are not tailored to their particular risks," she said.

"As we go out there now, we are pointing that out."

White said SEC examiners were very pro-active about doing sweeps of broker-dealers and investment advisers to assess their defenses against a cyber attack.

"We can't do enough in this sector," she said.

Cyber security experts said her remarks represented the SEC’s strongest warning to date of the threat posed by hackers.

A former member of the World Bank’s security team, Tom Kellermann, who is now chief executive of the investment firm Strategic Cyber Ventures LLC, called it "a historic recognition of the systemic risk facing Wall Street."

BROKEN WINDOWS

Under White, a former federal prosecutor, the SEC introduced an initiative called "broken windows" designed to crack down on small violations of SEC rules to deter traders and others from larger transgressions.

But critics have questioned whether the initiative, similar to one used by former New York City Mayor Rudy Giuliani in his crackdown on crime in the city, is an effective use of the agency’s limited resources.

The policy has been applied to instances of “rampant non-compliance” involving serious, significant rules, White said, noting that she considers the initiative a huge success.

For example, the SEC brought three groups of cases in a key area, the prohibition against short selling ahead of an IPO by individuals who then participated in the IPO, since 2013, she said. Each year, there have been fewer cases, with the most recent number at around 12, White said.

GAAP VS. NON-GAAP

Also on Tuesday, the SEC released guidance about how certain accounting practices could potentially mislead investors that White called "consequential."

Companies are increasingly using non-Generally Accepted Accounting Principles, or non-GAAP, to report earnings, permitting them to back out certain expenses from earnings figures, such as non-cash costs. But critics say the practice can also mislead investors by creating a rosier picture of a company’s profits.

The SEC’s current rules allow companies to report with figures that do not comply with GAAP, as long as certain conditions are met and White said the guidance spells out those conditions, such as a requirement that “the GAAP measure has to be of equal or greater prominence than non-GAAP."

Non-GAAP "is not supposed to supplant GAAP and obviously not obscure GAAP," she said.

She declined to say if the SEC is considering enforcement actions against companies that might be misleading investors with non-GAAP, but noted the SEC would not hesitate to bring one if it uncovered an “actionable violation.”

For months now, the SEC has only had three commissioners, down from its full complement of five, and the U.S. Congress has stalled on confirming two nominees.

"We're really functioning on all cylinders," White said, ticking off a list of projects the commission has recently completed.

She added that, to comply with rules on meetings and disclosures, commissioners typically meet one-on-one.

"If there are only three of you, it's shorter-circuited to some degree," she said. "There are some advantages, too."

(Additional reporting by Sarah N. Lynch)

reuters.com

[JakeStraw] New Imperva Camouflage Data Masking Reduces Risk of Sensitive Data Theft and Non...

JakeStraw — 5/17/2016 3:44:59 PM

New Imperva Camouflage Data Masking Reduces Risk of Sensitive Data Theft and Non-Compliance for Global Enterprises
finance.yahoo.com

Technology Alliance with Camouflage Software Adds New Product to the Imperva Security Portfolio

[Glenn Petersen] FireEye Names Mandia as CEO; Its Loss Widens Revenue is at low end of its expec...

Glenn Petersen — 5/6/2016 9:19:27 AM

FireEye Names Mandia as CEO; Its Loss Widens

Revenue is at low end of its expectations, and the cybersecurity company cut its sales view for the year

By Tess Stynes
The Wall Street Journal
May 5, 2016 5:34 p.m. ET

FireEye Inc. reported a wider loss for the first quarter and named Kevin Mandia as its new chief executive.

Shares fell 8% to $14.70 in recent after-hours trading as the cybersecurity company also projected a wider loss for the second quarter than analysts had feared and revenue that missed Wall Street’s view.

Revenue in the latest quarter was at the low end of its expectations, and the company cut its sales view for the year.

Mr. Mandia has been the company’s chief operating officer since late 2013, when FireEye acquired Mandiant, which he founded in 2004. He will take the helm at FireEye on June 15.

Current Chairman and Chief Executive David DeWalt will become executive chairman. Mr. DeWalt has been CEO since November 2012 and chairman since May of that year.

The Milpitas, Calif., company lowered 2016 revenue guidance to $780 million to $810 million, down from its previous estimate for revenue of $815 million to $845 million.

For the second quarter, the company forecast a per-share loss of 38 cents to 40 cents and revenue of $178 million to $185 million. Analysts polled by Thomson Reuters expected a per-share loss of 36 cents and revenue of $193 million.

FireEye’s main business is selling software to large organizations to detect malicious computer code, or malware. Where FireEye tries to prevent attacks with its software, its Mandiant unit, acquired in late 2013, has focused on investigating security breaches that have occurred.

In January, FireEye expanded its offerings with its $200 million acquisition of iSight Partners Inc., a Dallas company that hires intelligence agents abroad to try to spot cyberattacks before they happen. In February, FireEye added closely held Invotas International Corp., a provider of security automation technology that helps security teams identify and respond to threats more quickly.

Though FireEye, which went public in 2013, has continued to log increases in revenue and billings, the company’s spending has also grown as it has expanded. During its March analyst meeting, FireEye said it is aiming for profitability in the second half of 2017.

Over all, FireEye reported a first-quarter loss of $155.9 million, or 98 cents a share, compared with a year-earlier loss of $134 million, or 88 cents a share, a year earlier. Excluding items, the adjusted per-share loss was 47 cents, compared with a year-earlier per-share loss of 48 cents.

Revenue increased 34% to $168 million.

The company expected an adjusted per-share loss of 49 cents to 53 cents and revenue of $167 million to $177 million.

Among other leadership changes unveiled Thursday, FireEye Chief Financial Officer Mike Berry will add the role of chief operating officer. Travis Reese, president of FireEye’s Mandiant business, will become president of FireEye.

The board also named former Symantec Corp. Chief Executive Enrique Salem as lead independent director.

wsj.com

[Glenn Petersen] Hackers’ $81 Million Sneak Attack on World Banking By MICHAEL CORKERY New Yo...

Glenn Petersen — 5/2/2016 5:23:12 PM

Hackers’ $81 Million Sneak Attack on World Banking

By MICHAEL CORKERY
New York Times
DealBook
APRIL 30, 2016

Anxieties have arisen since thieves stole $81 million from the central bank of Bangladesh by gaining access to an international bank messaging system called Swift. Credit Amr Abdallah Dalsh/Reuters
______________________

Tens of millions of dollars siphoned from the Federal Reserve Bank of New York. A shadowy set of casinos in the Philippines. A large bank in Bangladesh with creaky technology. An unknown — and perhaps uncatchable — group of anonymous thieves with sophisticated hacking skills.

What unites this curious cast of characters and enabled one of the most brazen digital bank heists ever is a ubiquitous and highly trusted international bank messaging system called Swift.

Swift — the Society for Worldwide Interbank Financial Telecommunication — is billed as a supersecure system that banks use to authorize payments from one account to another. “The Rolls-Royce of payments networks,” one financial analyst said.

But last week, for the first time since hackers captured $81 million from Bangladesh’s central bank in February, Swift acknowledged that the thieves have tried to carry out similar heists at other banks on its network by sneaking into the beating heart of the global banking system.

“There are many banks out there right now saying, ‘There but for the grace of God go us,’” said Gareth Lodge, a payments analyst at Celent, a financial consulting firm.

The admission that the attack was not a one-time event in a developing country but perhaps part of a broader threat has thrust Swift into a spotlight, raising questions about how securely money is being moved around the world. Some financial security experts point out the Swift system is only as safe as its weakest link.

The attack also reflects a growing sophistication among digital criminals, who for years have been breaching personal bank accounts and stealing credit card credentials. The thieves in Bangladesh may have spent months lurking inside the central bank’s computers, studying how to steal the necessary credentials to gain access to Swift.

“The trend is moving from opportunistic crime to Hollywood-scale attacks,” said Mr. Nish, whose firm has analyzed the malware believed to have been used in the Bangladesh breach.

In the United States, most banks take special precautions with their Swift computers, building multiple firewalls to isolate the system from the bank’s other networks and keeping the machines physically isolated in a separate locked room.

But elsewhere, some banks take far fewer precautions. And security experts who have analyzed the Swift breach said they had concluded that the Bangladesh bank may have been particularly vulnerable to an attack.

“Swift is a great organization,” said Chris Larsen, the founder of Ripple, a financial technology company that aims to speed up global money transmissions. “But the system is fractured and antiquated. The way it is set up, you cannot totally isolate problems in a place like Bangladesh from the whole network.”

In some ways, Swift is a testament to how technology has helped all countries — including poorer ones — gain access to the financial system. But that broader access has a downside.

The central bank in Bangladesh, by some accounts, employed fewer protections against cyberattacks than many other large banks. The bank, for example, used $10 routers and no firewalls, according to news reports.

The server software that the Bangladesh bank employed was a Swift product called Alliance Access, which connects banks to the central messaging system. In a sign of how seriously Swift regards the breach of Alliance Access, the group issued a “mandatory software update” last week to help its members identify possible irregularities.

The central bank of Bangladesh, in Dhaka, the capital.
__________________________________

The heist was timed so that when Federal Reserve officials tried to contact Bangladesh, it was a weekend there and no one was working. By the time central bankers in Bangladesh discovered the theft, it was the weekend in New York and the Fed was closed. Credit Ashikur Rahman/Reuters “These hackers figured out this was a weak point on the periphery, and they went for it,” said Jeffrey Kutler, editor in chief at the Global Association of Risk Professionals, a trade group. “But they were not able to compromise the core.”

Swift’s core is built on technology that has been evolving for decades. What began in 1973 as a relatively small network of 240 banks in Europe and North America is now a sprawling network of 11,000 users that includes both banks and large corporations. At first, Swift could be used to authorize payments across national borders. But it is now also used to transmit messages related to domestic payments, securities settlements and other transactions.

Swift’s growth in recent years — it set a record for messages in March — reflects the increasingly global and interconnected nature of finance. But it also shows the risk of so many financial instructions running through a single system made up of a patchwork of banks and companies with varying levels of online protection.

Each bank on the Swift network is identified by a set of codes. And it was the codes assigned to the Bank of Bangladesh that were recognized — correctly — by the Federal Reserve Bank of New York when it transferred $81 million of the Bangladesh bank’s money to the Philippines, not knowing that someone, somewhere, had stolen the credentials of the Bangladesh bank and installed malware to cover his or her tracks.

Initially, the thieves requested the transfer of $951 million into a handful of bank accounts in Sri Lanka and the Philippines — a number that prompted the New York Fed to ask the Bangladesh bank to reconfirm that it indeed wanted to move the money.

In the end, the Fed processed only five of the 35 fraudulent payment requests, after it could not reconfirm with officials in Bangladesh.

The hackers seemed to time the attack perfectly: When officials from the Fed tried to reach out to Bangladesh, it was a weekend there and no one was working. By the time central bankers in Bangladesh discovered the fraud, it was the weekend in New York and the Fed offices were closed.

To conceal the crime, the malware disabled a printer in the Bangladesh bank to prevent officials from reviewing a log of the fraudulent transfers.

Representative Carolyn B. Maloney, Democrat of New York, has called for an investigation into the theft. Credit Robin Caplin/Bloomberg
____________________________

The money was transferred to accounts in the Philippines and then into the Philippine casino system, which is exempt from many of the country’s anti-money-laundering requirements.

The New York Fed has been criticized for letting the $81 million slip out. Representative Carolyn B. Maloney, a New York Democrat and member of the Financial Services Committee, has called for an investigation, warning that the breach “threatens to undermine the confidence that foreign central banks have in the Federal Reserve, and in the safety and soundness of international monetary transactions.”

The New York Fed said in a statement that “there is no evidence that any Fed systems were compromised” and that the transfer of the money had been “fully authenticated” by Swift.

Swift, which prides itself on its secrecy and low public profile, also put out a statement about the attacks. But its executives declined to speak on the record about the episodes, which are still under investigation. The group’s chairman, Yawar Shah, who is a senior executive at Citigroup, also declined to comment.

In its statement, Swift emphasized that the hackers had been able to breach only some of the banks that communicate over Swift, not the network itself.

“The commonality in what we have seen is that (internal or external) attackers have successfully compromised banks’ own environments,” Swift said.

Even if officials at the Bangladesh bank had employed the highest of security measures, the thieves displayed a level of skill, cunning and determination that may have been able to penetrate a far more secure system.

“If you have an attacker who really wants to get in and knows there is a big prize,” Mr. Nish said, “keeping them out over the long term is really difficult.”

[Glenn Petersen] Bangladesh Bank exposed to hackers by cheap switches, no firewall: police DHAKA...

Glenn Petersen — 4/22/2016 4:42:42 PM

Bangladesh Bank exposed to hackers by cheap switches, no firewall: police

DHAKA | By Serajul Quadir
Reuters
Fri Apr 22, 2016 1:51pm EDT

Commuters pass by the front of the Bangladesh central bank building in Dhaka March 8, 2016.
Reuters/Ashikur Rahman/File Photo
_______________________________-

DHAKA Bangladesh's central bank was vulnerable to hackers because it did not have a firewall and used second-hand, $10 switches to network computers connected to the SWIFT global payment network, an investigator into one of the world's biggest cyber heists said.

The shortcomings made it easier for hackers to break into the Bangladesh Bank system earlier this year and attempt to siphon off nearly $1 billion using the bank's SWIFT credentials, said Mohammad Shah Alam, head of the Forensic Training Institute of the Bangladesh police's criminal investigation department.

"It could be difficult to hack if there was a firewall," Alam said in an interview.

The lack of sophisticated switches, which can cost several hundred dollars or more, also means it is difficult for investigators to figure out what the hackers did and where they might have been based, he added.

Experts in bank security said that the findings described by Alam were disturbing.

"You are talking about an organization that has access to billions of dollars and they are not taking even the most basic security precautions," said Jeff Wichman, a consultant with cyber firm Optiv.

Tom Kellermann, a former member of the World Bank security team, said that the security shortcomings described by Alam were "egregious," and that he believed there were "a handful" of central banks in developing countries that were equally insecure.

Kellermann, now chief executive of investment firm Strategic Cyber Ventures LLC, said that some banks fail to adequately protect their networks because they focus security budgets on physically defending their facilities.

POLICE BLAME BANK, SWIFT

Cyber criminals broke into Bangladesh Bank's system and in early February tried to make fraudulent transfers totaling $951 million from its account at the Federal Reserve Bank of New York.

Most of the payments were blocked, but $81 million was routed to accounts in the Philippines and diverted to casinos there. Most of those funds remain missing.

The police believe that both the bank and SWIFT should take the blame for the oversight, Alam said in an interview.

"It was their responsibility to point it out but we haven't found any evidence that they advised before the heist," he said, referring to SWIFT.

A spokeswoman for Brussels-based SWIFT declined comment.

SWIFT has previously said the attack was related to an internal operational issue at Bangladesh Bank and that SWIFT's core messaging services were not compromised.

A spokesman for Bangladesh Bank said SWIFT officials advised the bank to upgrade the switches only when their system engineers from Malaysia visited after the heist.

"There might have been a deficiency in the system in the SWIFT room," said the spokesman, Subhankar Saha, confirming that the switch was old and needed to be upgraded.

"Two (SWIFT) engineers came and visited the bank after the heist and suggested to upgrade the system," Saha said.

GLOBAL WHODUNIT

The heist's masterminds have yet to be identified.

Bangladesh police said earlier this week they had identified 20 foreigners involved in the heist but they appear to be people who received some of the payments, rather than those who initially stole the money.

Bangladesh Bank has about 5,000 computers used by officials in different departments, Alam said.

The SWIFT room is roughly 12 feet by 8 feet, a window-less office located on the eight floor of the bank's annex building in Dhaka. There are four servers and four monitors in the room.

All transactions from the previous day are automatically printed on a printer in the room.

The SWIFT facility should have been walled off from the rest of the network. That could have been done if the bank had used the more expensive, "managed" switches, which allow engineers to create separate networks, said Alam, whose institute includes a cyber-crime division.

Moreover, considering the importance of the room, the bank should have deployed staff to monitor activity round the clock, including weekends and holidays, he said.

(Additional reporting by Jim Finkle in BOSTON; Editing by Paritosh Bansal, Raju Gopalakrishnan and Alan Crosby)

reuters.com

[Glenn Petersen] Inside the Cunning, Unprecedented Hack of Ukraine’s Power Grid Author: Kim Zett...

Glenn Petersen — 3/5/2016 4:12:48 PM

Inside the Cunning, Unprecedented Hack of Ukraine’s Power Grid

Author: Kim Zetter
Wired Magazine
Date of Publication: 03.03.16. 03.03.16
Time of Publication: 7:00 am. 7:00 am

Jose A. Bernat Bacet/Getty Images
__________________________________________

\It was 3:30 p.m. last December 23, and residents of the Ivano-Frankivsk region of Western Ukraine were preparing to end their workday and head home through the cold winter streets. Inside the Prykarpattyaoblenergo control center, which distributes power to the region’s residents, operators too were nearing the end of their shift. But just as one worker was organizing papers at his desk that day, the cursor on his computer suddenly skittered across the screen of its own accord.

He watched as it navigated purposefully toward buttons controlling the circuit breakers at a substation in the region and then clicked on a box to open the breakers and take the substation offline. A dialogue window popped up on screen asking to confirm the action, and the operator stared dumbfounded as the cursor glided to the box and clicked to affirm. Somewhere in a region outside the city he knew that thousands of residents had just lost their lights and heaters.

The operator grabbed his mouse and tried desperately to seize control of the cursor, but it was unresponsive. Then as the cursor moved in the direction of another breaker, the machine suddenly logged him out of the control panel. Although he tried frantically to log back in, the attackers had changed his password preventing him from gaining re-entry. All he could do was stare helplessly at his screen while the ghosts in the machine clicked open one breaker after another, eventually taking about 30 substations offline. The attackers didn’t stop there, however. They also struck two other power distribution centers at the same time, nearly doubling the number of substations taken offline and leaving more than 230,000 residents in the dark. And as if that weren’t enough, they also disabled backup power supplies to two of the three distribution centers, leaving operators themselves stumbling in the dark.

A Brilliant Plan

The hackers who struck the power centers in Ukraine—the first confirmed hack to take down a power grid—weren’t opportunists who just happened upon the networks and launched an attack to test their abilities; according to new details from an extensive investigation into the hack, they were skilled and stealthy strategists who carefully planned their assault over many months, first doing reconnaissance to study the networks and siphon operator credentials, then launching a synchronized assault in a well-choreographed dance.

“It was brilliant,” says Robert M. Lee, who assisted in the investigation. Lee is a former cyber warfare operations officer for the US Air Force and is co-founder of Dragos Security, a critical infrastructure security company. “In terms of sophistication, most people always [focus on the] malware [that’s used in an attack],” he says. “To me what makes sophistication is logistics and planning and operations and … what’s going on during the length of it. And this was highly sophisticated.”

Ukraine was quick to point the finger at Russia for the assault. Lee shies away from attributing it to any actor but says there are clear delineations between the various phases of the operation that suggest different levels of actors worked on different parts of the assault. This raises the possibility that the attack might have involved collaboration between completely different parties—possibly cybercriminals and nation-state actors.

“This had to be a well-funded, well-trained team. …but it didn’t have to be a nation-state,” he says. It could have started out with cybercriminals getting initial access to the network, then handing it off to nation-state attackers who did the rest.

The control systems in Ukraine were surprisingly more secure than some in the US.

Regardless, the successful assault holds many lessons for power generation plants and distribution centers here in the US, experts say; the control systems in Ukraine were surprisingly more secure than some in the US, since they were well-segmented from the control center business networks with robust firewalls. But in the end they still weren’t secure enough—workers logging remotely into the SCADA network, the Supervisory Control and Data Acquisition network that controlled the grid, weren’t required to use two-factor authentication, which allowed the attackers to hijack their credentials and gain crucial access to systems that controlled the breakers.

The power wasn’t out long in Ukraine: just one to six hours for all the areas hit. But more than two months after the attack, the control centers are still not fully operational, according to a recent US report. Ukrainian and US computer security experts involved in the investigation say the attackers overwrote firmware on critical devices at 16 of the substations, leaving them unresponsive to any remote commands from operators. The power is on, but workers still have to control the breakers manually.

That’s actually a better outcome than what might occur in the US, experts say, since many power grid control systems here don’t have manual backup functionality, which means that if attackers were to sabotage automated systems here, it could be much harder for workers to restore power.

Timeline of the Attack

Multiple agencies in the US helped the Ukrainians in their investigation of the attack, including the FBI and DHS. Among computer security experts who consulted on the wider investigation were Lee and Michael J. Assante, both of whom teach computer security at the SANS Institute in Washington DC and plan to release a report about their analysis today. They say investigators were pleasantly surprised to discover that the Ukrainian power distribution companies had a vast collection of firewall and system logs that helped them reconstruct events—an uncommon bonanza for any corporate network, but an even rarer find for critical infrastructure environments, which seldom have robust logging capabilities.

According to Lee and a Ukrainian security expert who assisted in the investigation, the attacks began last spring with a spear-phishing campaign that targeted IT staff and system administrators working for multiple companies responsible for distributing electricity throughout Ukraine. Ukraine has 24 regions, each divided into between 11 and 27 provinces, with a different power distribution company serving each region. The phishing campaign delivered email to workers at three of the companies with a malicious Word document attached. When workers clicked on the attachment, a popup displayed asking them to enable macros for the document. If they complied, a program called BlackEnergy3—variants of which have infected other systems in Europe and the US—infected their machines and opened a backdoor to the hackers. The method is notable because most intrusions these days exploit a coding mistake or vulnerability in a software program; but in this case the attackers exploited an intentional feature in the Microsoft Word program. Exploiting the macros feature is an old-school method from the 90’s that attackers have recently revived in multiple attacks.

The initial intrusion got the attackers only as far as the corporate networks. But they still had to get to the SCADA networks that controlled the grid. The companies had wisely segregated those networks with a firewall, so the attackers were left with two options: either find vulnerabilities that would let them punch through the firewalls or find another way to get in. They chose the latter.

Over many months they conducted extensive reconnaissance, exploring and mapping the networks and getting access to the Windows Domain Controllers, where user accounts for networks are managed. Here they harvested worker credentials, some of them for VPNs the grid workers used to remotely log in to the SCADA network. Once they got into the SCADA networks, they slowly set the stage for their attack.

More on Critical Infrastructure Hacks

First they reconfigured the uninterruptible power supply1, or UPS, responsible for providing backup power to two of the control centers. It wasn’t enough to plunge customers into the dark—when power went out for the wider region they wanted operators to be blind, too. It was an egregious and aggressive move, the sort that could be interpreted as a “giant fuck you” to the power companies, says Lee.

Each company used a different distribution management system for its grid, and during the reconnaissance phase, the attackers studied each of them carefully. Then they wrote malicious firmware to replace the legitimate firmware on serial-to-Ethernet converters at more than a dozen substations (the converters are used to process commands sent from the SCADA network to the substation control systems). Taking out the converters would prevent operators from sending remote commands to re-open breakers once a blackout occurred. “Operation-specific malicious firmware updates [in an industrial control setting] has never been done before,” Lee says. “From an attack perspective, it was just so awesome. I mean really well done by them.”

The same model of serial-to-Ethernet converters used in Ukraine are used in the US power-distribution grid.

Armed with the malicious firmware, the attackers were ready for their assault.

Sometime around 3:30 p.m. on December 23 they entered the SCADA networks through the hijacked VPNs and sent commands to disable the UPS systems they had already reconfigured. Then they began to open breakers. But before they did, they launched a telephone denial-of-service attack against customer call centers to prevent customers from calling in to report the outage. TDoS attacks are similar to DDoS attacks that send a flood of data to web servers. In this case, the center’s phone systems were flooded with thousands of bogus calls that appeared to come from Moscow, in order to prevent legitimate callers from getting through. Lee notes that the move illustrates a high level of sophistication and planning on the part of the attackers. Cybercriminals and even some nation-state actors often fail to anticipate all contingencies. “What sophisticated actors do is they put concerted effort into even unlikely scenarios to make sure they’re covering all aspects of what could go wrong,” he says.

The move certainly bought the attackers more time to complete their mission because by the time the operator whose machine was hijacked noticed what was happening, a number of substations had already been taken down. But if this was a political hack launched by Russia against Ukraine, the TDoS likely also had another goal Lee and Assante say: to stoke the ire of Ukrainian customers and weaken their trust in the Ukrainian power companies and government.

It wasn't enough to plunge customers into the dark–they wanted operators blind, too.

As the attackers opened up breakers and took a string of substations off the grid, they also overwrote the firmware on some of the substation serial-to-Ethernet converters, replacing legitimate firmware with their malicious firmware and rendering the converters thereafter inoperable and unrecoverable, unable to receive commands. “Once you … rewrite the firmware, there’s no going back from that [to aid recovery]. You have to be at that site and manually switch operations,” Lee says. “Blowing [these] gateways with firmware modifications means they can’t recover until they get new devices and integrate them.”

After they had completed all of this, they then used a piece of malware called KillDisk to wipe files from operator stations to render them inoperable as well. KillDisk wipes or overwrites data in essential system files, causing computers to crash. Because it also overwrites the master boot record, the infected computers could not reboot.

Some of the KillDisk components had to be set off manually, but Lee says that in two cases the attackers used a logic bomb that launched KillDisk automatically about 90 minutes into the attack. This would have been around 5 p.m., the same time that Prykarpattyaoblenergo posted a note to its web site acknowledging for the first time what customers already knew—that power was out in certain regions—and reassuring them that it was working feverishly to figure out the source of the problem. Half an hour later, after KillDisk would have completed its dirty deed and left power operators with little doubt about what caused the widespread blackout, the company then posted a second note to customers saying the cause of the outage was hackers.

Was Russia the Cause?

Ukraine’s intelligence community has said with utter certainty that Russia is behind the attack, though it has offered no proof to support the claim. But given political tensions between the two nations it’s not a far-fetched scenario. Relations have been strained between Russia and Ukraine ever since Russia annexed Crimea in 2014 and Crimean authorities began nationalizing Ukrainian-owned energy companies there, angering Ukrainian owners. Then, right before the December blackout in Ukraine occurred, pro-Ukrainian activists physically attacked substations feeding power to Crimea, leaving two million Crimean residents without power in the region that Russia had annexed, as well as a Russian naval base. Speculation has been rampant that the subsequent blackouts in Ukraine were retaliation for the attack on the Crimean substations.

But the attackers who targeted the Ukrainian power companies had begun their operation at least six months before the Crimean substations were attacked. So, although the attack in Crimea may have been a catalyst for the subsequent attack on the Ukrainian power companies, it’s clear that it wasn’t the original motivation, Lee says. Lee says the forensic evidence suggests in fact that the attackers may not have planned to take out the power in Ukraine when they did, but rushed their plans after the attack in Crimea.

“Looking at the data, it looks like they would have benefited and been able to do more had they been planning and gathering intelligence longer,” he says. “So it looks like they may have rushed the campaign.”

He speculates that if Russia is responsible for the attack, the impetus may have been something completely different. Recently, for example, the Ukrainian parliament has been considering a bill to nationalize privately owned power companies in Ukraine. Some of those companies are owned by a powerful Russian oligarch who has close ties to Putin. Lee says it’s possible the attack on the Ukrainian power companies was a message to Ukrainian authorities not to pursue privatization.

That analysis is supported by another facet of the attack: The fact that the hackers could have done much more damage than they did do if only they had decided to physically destroy substation equipment as well, making it much harder to restore power after the blackout. The US government demonstrated an attack in 2007 that showed how hackers could physically destroy a power generator simply by remotely sending 21 lines of malicious code.

Lee says everything about the Ukraine power grid attack suggests it was primarily designed to send a message. “‘We want to be seen, and we want to send you a message,’” is how he interprets it. “This is very mafioso in terms of like, oh, you think you can take away the power [in Crimea]? Well I can take away the power from you.”

Whatever the intent of the blackout, it was a first-of-its-kind attack that set an ominous precedent for the safety and security of power grids everywhere. The operator at Prykarpattyaoblenergo could not have known what that little flicker of his mouse cursor portended that day. But now the people in charge of the world’s power supplies have been warned. This attack was relatively short-lived and benign. The next one might not be.

1Correction 3/03/16 8:17 a.m. ET: UPS here stands for uninterruptible power supply, not universal power supply.

http://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/

[JakeStraw] Edited Transcript of CYBR earnings conference call or presentation finance.yahoo...

JakeStraw — 11/10/2015 12:47:10 PM

Edited Transcript of CYBR earnings conference call or presentation
finance.yahoo.com

[JakeStraw] FEYE, PANW, CYBR - to name a few - getting crushed today...

JakeStraw — 10/21/2015 12:52:50 PM

[Glenn Petersen] Russian Hackers Infiltrate Dow Jones Servers Walter Russell Mead & Staff The Am...

Glenn Petersen — 10/17/2015 4:47:53 PM

Russian Hackers Infiltrate Dow Jones Servers

Walter Russell Mead & Staff
The American Interest
Posted: Oct 16, 2015 - 4:58 pm

The servers of Dow Jones & Co, Inc. were seriously compromised by Russian hackers last year, according to Bloomberg:

The Federal Bureau of Investigation, Secret Service and the Securities and Exchange Commission are leading an investigation of the infiltration…. The probe began at least a year ago, one of them said.

The breach is described by the people as far more serious than a lower-grade intrusion disclosed a week ago by Dow Jones, a unit of Rupert Murdoch’s News Corp. The company said last week that it was working with a cybersecurity firm and law enforcement after learning that hackers had sought contact and payment information of about 3,500 customers.

There has been a great deal of talk about China and cybersecurity lately, but less attention has been paid to Russia, perhaps because the Kremlin is busy engaging in more old-fashioned warfare, distracting analysts from its online activities. Yet, according to a Threat Assessment prepared for the Senate Armed Services Committee last February, hackers in Russia are the principal cyber threat to the United States.

This latest attack was not only cyber theft but also potentially part of an insider trading scheme. Hackers sought to gain access to material nonpublic information that they could then sell to investors or trade on themselves. Investigators say the attack highlights the challenges the internet poses to regulators looking to stop insider trading. But it doesn’t end there—indeed, this brave new online world presents all sorts of new limits, as well as powers, to businesses, regulators, and troublemakers of other sorts.

the-american-interest.com

[JakeStraw] CyberArk: Unique Niche in Hot Sector moneyshow.com

JakeStraw — 10/16/2015 2:37:46 PM

[Glenn Petersen] Dell Files Confidentially for IPO of Cybersecurity Unit SecureWorks SecureWorks...

Glenn Petersen — 10/10/2015 11:07:06 AM

Dell Files Confidentially for IPO of Cybersecurity Unit SecureWorks

SecureWorks could begin trading by year-end and may be worth as much as $2 billion

By Telis Demos and Dana Cimilluca
Wall Street Journal
Updated Oct. 9, 2015 7:04 p.m. ET

Dell Inc. has filed confidentially for an initial public offering of its cybersecurity unit, Dell SecureWorks Inc., as the personal-computer maker plots a dramatic reshaping of its businesses.

The software and consulting firm, which Dell acquired in 2011, filed papers for the IPO over the summer and has been working with banks including Bank of America Corp. and Morgan Stanley and on the potential deal, according to people familiar with the matter.

The roadshow to market the stock to investors could launch as soon as December, the people added—meaning the stock could start trading around the end of the year. The business could be worth as much as $2 billion, though the target valuation isn’t yet finalized, some the people said.

Separating out SecureWorks is part of a broader strategic rethinking at the company founded by Michael Dell in a dorm room in 1984. Dell went private in a roughly $25 billion buyout by Mr. Dell and private-equity firm Silver Lake in 2013. The two are now in advanced negotiations to acquire data-storage giant EMC Corp. EMC 2.50 % for more than $60 billion, according to people familiar with the matter. SecureWorks is now less of strategic fit with Dell’s other offerings, which include servers, storage and networking gear, said one of the people.

Under a 2012 law, companies with annual revenue of less than $1 billion are allowed to make a secret IPO filing with the Securities and Exchange Commission. They must lift the veil on the filing at least 21 days before the roadshow begins.

Dell isn’t expected to sell any of its ownership in SecureWorks in the IPO, the people said. The offering will raise money for SecureWorks by bringing in outside investors and potentially paving the way for future acquisitions, some of the people said.

SecureWorks sells managed-security services, online tools that companies can use to keep tabs on their network activity and prevent hackers from breaking into their computer systems.

Dell bought SecureWorks for $612 million, looking to beef up its services business and expand beyond its core computer hardware offerings. Since then, SecureWorks has continued to operate as a discrete unit within Dell.

Recently, security has become one of the hottest investments for venture-capital firms, producing a string of successful IPOs, including Rapid7 Inc., which is up 52% since its July IPO, and CyberArk Software Ltd., up 233% since its debut in September 2014, and that has likely encouraged Dell to pursue the move. Meanwhile, Internet and other tech IPOs have struggled, with tech IPOs this year representing the smallest share of the U.S. IPO market since 2008.

“Cyber security has been one of the bright spots in the tech food chain,” said Daniel Ives an analyst with FBR Capital Markets.

—Robert McMillan contributed to this article.

Write to Telis Demos at telis.demos@wsj.com and Dana Cimilluca at dana.cimilluca@wsj.com

wsj.com

[Glenn Petersen] Intelligence Start-Up Goes Behind Enemy Lines to Get Ahead of Hackers By NIC...

Glenn Petersen — 9/26/2015 5:37:08 PM

Intelligence Start-Up Goes Behind Enemy Lines to Get Ahead of Hackers

By NICOLE PERLROTH
New York Times
SEPT. 13, 2015

One of scores of intelligence analysts working at his computer at the headquarters of the security firm iSight in Chantilly, Va. Credit Gabriella Demczuk for The New York Times
__________________

CHANTILLY, Va. — On a recent Wednesday morning, 100 intelligence analysts crammed into a nondescript conference room here and dialed into a group call with 100 counterparts in Argentina, Brazil, Cyprus, India, the Netherlands, Romania, Spain, Taiwan and Ukraine.

As they worked their way around the room, the analysts briefed one another on the latest developments in the “dark web.”

A security firm in Pakistan was doing a little moonlighting, selling its espionage tools for as little as $500. Several American utility companies were under attack. A group of criminals were up to old tricks, infecting victims with a new form of “ransomware,” which encrypts PCs until victims pay a ransom.

The analysts, employees of iSight Partners, a company that provides intelligence about threats to computer security in much the same way military scouts provide intelligence about enemy troops, were careful not to name names or clients, in case someone, somewhere, was listening on the open line.

Within 30 minutes, they were all back at their keyboards, monitoring underground chatter and markets, analyzing computer code meant to cause harm, watching the networks of potential attackers and poring over social media channels for signs of imminent attacks.

John Watters, iSight’s chief, evokes military jargon to talk about his company’s focus. Credit Brandon Thibodeaux for The New York Times
_______________________

For the last eight years, iSight has been quietly assembling what may be the largest private team of experts in a nascent business called threat intelligence. Of the company’s 311 employees, 243 are so-called cyberintelligence professionals, a statistic that executives there say would rank iSight, if it were a government-run cyberintelligence agency, among the 10 largest in the world, though that statistic is impossible to verify given the secretive nature of these operations.

ISight analysts spend their days digging around the underground web, piecing together hackers’ intentions, targets and techniques to provide their clients with information like warnings of imminent attacks and the latest tools and techniques being used to break into computer networks.

The company’s focus is what John P. Watters, iSight’s chief executive, calls “left of boom,” which is military jargon for the moment before an explosive device detonates. Mr. Watters, a tall, 51-year-old Texan whose standard uniform consists of Hawaiian shirts and custom cowboy boots, frequently invokes war analogies when talking about online threats.

“When we went into Iraq, the biggest loss of life wasn’t from snipers,” he said. It was from concealed explosive devices. “We didn’t get ahead of the threat until we started asking ourselves, ‘Who’s making the bombs? How are they getting their materials? How are they detonating them? And how do we get into that cycle before the bombs are ever placed there?’”

“Our business,” Mr. Watters continued, “is tracking the arms merchants and bomb makers so we can be left of boom and avoid the impact altogether.”

ISight’s investors, who have put $60 million into the company so far, believe that its services fill a critical gap in the battle to get ahead of threats. Most security companies, like FireEye, Symantec, Palo Alto Networks and Intel’s security unit, focus on blocking or detecting intrusions as they occur or responding to attacks after the fact.

ISight goes straight to the enemy. Its analysts — many of them fluent in Russian, Mandarin, Portuguese or 21 other languages — infiltrate the underground, where they watch criminals putting their schemes together and selling their tools.

The analysts’ reports help clients — including 280 government agencies, as well as banks and credit-card, health care, retail and oil and gas companies — prioritize the most imminent and possibly destructive threats.

Security experts say the need for such intelligence has never been greater. For the last three years, businesses have been investing in “big data” analytic tools that sound alarms anytime someone does something unusual, like gain access to a server in China, set up a private connection or siphon unusually large amounts of data from a corporate network.

The result is near constant and confusing noise. “Except for the most mature organizations, most businesses are drowning in alerts,” said Jason Clark, the chief security officer at Optiv, a security firm.

The average organization receives 16,937 alerts a week. Only 19 percent of them are deemed “reliable,” and only 4 percent are investigated, according to a study released in January by the Ponemon Institute, which tracks data breaches. By the time criminals make enough noise to merit a full investigation, it can take financial services companies more than three months, on average, to discover them, and retailers more than six months.

“Just generating more alerts is wasting billions of dollars of venture capital,” said David Cowan, an iSight investor and a partner at Bessemer Venture Partners. The last thing an executive in charge of network security needs is more alerts, he said: “They don’t have time. They need human, actionable threat intelligence.”

Mr. Cowan and others point to what happened to Target in 2013, when the retailer ignored an alert that ultimately could have stopped criminals from stealing 40 million customers’ payment details from its network.

A year earlier, iSight warned its clients that criminals were compiling and selling malware that was specifically designed to scrape payment data off cash registers. Had Target received that warning, the blip on its network might not have gone unnoticed.

“Target faced the same problem every retailer does every day,” Mr. Watters said. “They are awash in a sea of critical alerts every day. Without threat intelligence, they had roulette odds of picking the right one.”

Gartner, the research firm, estimates that the market for threat intelligence like iSight’s could grow to $1 billion in two years from $255 million in 2013. Gartner predicts that by 2018, 60 percent of businesses will incorporate threat intelligence into their defensive security strategy.

ISight, which plans to file for an initial public offering of stock next year, hopes to capitalize, as do the dozens of other cyberthreat intelligence outfits now flooding the market, each with a slightly different approach.

That proliferation of start-ups has led to a new complaint from computer security chiefs: overlapping information — sometimes as much as 40 percent — in the reports they receive, none of which is cheap. ISight charges customers based on size, and while it does not disclose pricing, some customers say they pay $500,000 or more annually for the company’s services, as much as five times what low-end services charge.

ISight makes 90 percent of its revenue from subscriptions to its six intelligence streams, each focused on a particular threat, including cyberespionage and cybercrime.

The company’s most recent competition comes from its oldest clients, particularly banks, which have been hiring former intelligence analysts to start internal operations. One former client, which declined to be named because of concerns that doing so could violate a nondisclosure agreement, said it had been able to build its own intelligence program at half the cost of its canceled iSight subscriptions.

But most businesses do not have the same resources as, say, a company like Bank of America, whose chief executive recently said there was no cap on the bank’s cybersecurity budget.

Many of those businesses remain paralyzed by the drumbeat of alarms that expensive security technologies are sounding on their networks.

At iSight’s threat center, the company’s approach is perhaps best summed up by a logo emblazoned on a T-shirt worn by one of its top analysts: “Someone should do something.”

nytimes.com

[Glenn Petersen] U.S. and China Seek Arms Deal for Cyberspace By DAVID E. SANGER New York Times...

Glenn Petersen — 9/19/2015 9:57:02 PM

U.S. and China Seek Arms Deal for Cyberspace

By DAVID E. SANGER
New York Times
SEPT. 19, 2015

WASHINGTON — The United States and China are negotiating what could become the first arms control accord for cyberspace, embracing a commitment by each country that it will not be the first to use cyberweapons to cripple the other’s critical infrastructure during peacetime, according to officials involved in the talks.

While such an agreement could address attacks on power stations, banking systems, cellphone networks and hospitals, it would not, at least in its first version, protect against most of the attacks that China has been accused of conducting in the United States, including the widespread poaching of intellectual property and the theft of millions of government employees’ personal data.

The negotiations have been conducted with urgency in recent weeks, with a goal to announce an agreement when President Xi Jinping of China arrives in Washington for a state visit on Thursday. President Obama hinted at the negotiations on Wednesday, when he told the Business Roundtable that the rising number of cyberattacks would “probably be one of the biggest topics” of the summit meeting, and that his goal was to see “if we and the Chinese are able to coalesce around a process for negotiations” that would ultimately “bring a lot of other countries along.”

But a senior administration official involved in the discussions cautioned that an initial statement between Mr. Obama and Mr. Xi may not contain “a specific, detailed mention” of a prohibition on attacking critical infrastructure. Rather, it would be a more “generic embrace” of a code of conduct adopted recently by a working group at the United Nations.

One of the key principles of the United Nations document on principles for cyberspace is that no state should allow activity “that intentionally damages critical infrastructure or otherwise impairs the use and operation of critical infrastructure to provide services to the public.” The goal of the American negotiators is to have Chinese leaders embrace the principles of the United Nations code of conduct in a bilateral agreement with Washington.

But it seems unlikely that any deal coming out of the talks would directly address the most urgent problems with cyberattacks of Chinese origin, according to officials who spoke on the condition of anonymity to describe continuing negotiations.

Most of those attacks have focused on espionage and theft of intellectual property. The rules under discussion would have done nothing to stop the theft of 22 million personal security files from the Office of Personnel Management, which the director of national intelligence, James R. Clapper Jr., recently told Congress did not constitute an “attack” because it was intelligence collection — something the United States does, too.

The agreement being negotiated would also not appear to cover the use of tools to steal intellectual property, as the Chinese military does often to bolster state-owned industries, according to an indictment of five officers of the People’s Liberation Army last year. And it is not clear that the rules would prohibit the kind of attack carried out last year against Sony Pictures Entertainment, for which the United States blamed North Korea. That attack melted down about 70 percent of Sony’s computer systems.

Sony is not, by most definitions, part of the nation’s “critical infrastructure,” although the Department of Homeland Security does include “movie studios” on its list of critical “commercial facilities,” along with stadiums, museums and convention centers.

Still, any agreement to limit cyberattacks in peacetime would be a start. “It would be the first time that cyber is treated as a military capability that needs to be governed as nuclear, chemical and biological weapons are,” said Vikram Singh, a former Pentagon and State Department official who is now vice president for international security at the Center for American Progress.

Within the Obama administration, the effort to design “a set of norms of behavior” to limit cyberattacks has been compared to President John F. Kennedy’s first major nuclear treaty with the Soviet Union in 1963, which banned atmospheric nuclear tests. That accord did not stop the development of nuclear weapons or even halt underground tests, which continued for decades. But it was a first effort to prevent an environmental disaster, just as this would be a first effort by the world’s two biggest economic powers to prevent the most catastrophic use of cyberweapons.

Joseph S. Nye, a Harvard professor known for his studies of American power, said the concept of a “no first use” doctrine for cyberattacks had been “gestating for some time” in a variety of international forums. “It could create some self-restraint,” Mr. Nye said, but he added that the problem was, “how do you verify it, and what is its value if it can’t be verified?”

That problem goes to the heart of why arms control agreements in the cyberspace arena are so much more complicated than better-known agreements covering nuclear weapons.

In the Cold War and still today, nuclear arms remain in the hands of states, meaning they can usually be counted and their movements observed. Cyberweapons, too, are often developed by countries — the United States, Russia, China and Iran are among the most sophisticated — but they can also be found in the hands of criminal groups and teenagers, neither of which negotiate treaties.

Moreover, it was usually clear where a conventional attack had originated; the trajectory of a missile could be tracked by radar or satellite. Mr. Obama himself noted last week the difficulty of tracing a cyberattack, and thus of deterring it — or retaliating with confidence.

Earlier efforts to get Mr. Xi and other senior Chinese leaders to address cyberattacks have largely failed. Mr. Obama spent a considerable amount of time on the issue during a summit meeting with Mr. Xi at Sunnylands, a California estate, in 2013. But even after that session, the Chinese denied that their military was involved in attacks, and portrayed themselves as victims of attacks from the United States.

It was not an entirely spurious claim: Classified documents released by Edward J. Snowden showed a complex effort by the National Security Agency to get into the systems of a Chinese telecommunications giant, Huawei, though the United States maintained that the effort was for national security surveillance, not for the theft of intellectual property.

The recent Chinese movement on cybersecurity can be traced to several events, officials say.

The Office of Personnel Management breach, which went undetected for roughly a year, was traced to Chinese sources, and one official said evidence had been presented to Chinese officials. In August, Susan E. Rice, Mr. Obama’s national security adviser, took a trip to Beijing to meet with Mr. Xi and other officials, and used it to increase pressure on China, suggesting that newly devised economic sanctions could be imposed. Mr. Obama referred to that possibility in two recent speeches, suggesting that he would hold off only if there was progress with Mr. Xi.

Last week, a high-level Communist Party envoy, Meng Jianzhu, who is responsible for state security, came to Washington and met with Ms. Rice, several American intelligence officials and the director of the F.B.I., James B. Comey. That session focused on coming up with some kind of agreement, however vaguely worded, that Mr. Obama and Mr. Xi could announce on Friday.

For the United States, agreements limiting cyberweapons are also problematic. The country is spending billions of dollars on new generations of weapons, and in at least one famous case, the cyberattacks on Iran’s nuclear enrichment site at Natanz, it has used them.

American cyberwarriors would be concerned about any rules that limited their ability in peacetime to place “beacons” or “implants” in foreign computer networks; these are pieces of code that monitor how foreign computer systems work, and they can be vital in determining how to launch a covert or wartime attack. The Chinese have littered American networks with similar technology, often to the consternation of the Pentagon and intelligence agencies.

“One of the things to look for are any rules that bar ‘preparing the battlefield,’ ” said Robert K. Knake, a senior fellow at the Council on Foreign Relations who worked in the White House cybersecurity office earlier in the Obama administration.

Mr. Obama, who has said little about the United States’ development of cyberweapons during his presidency, has begun to talk about it in recent days. “If we wanted to go on offense, a whole bunch of countries would have some significant problems,” he told the Business Roundtable on Wednesday.

nytimes.com

[Sr K] darkreading.com

Sr K — 9/13/2015 9:45:21 AM

[Doren] CVS Health's photo service, UCLA Health get hacked reuters.com

Doren — 7/17/2015 9:03:41 PM

[Doren] RPD Rapid 7 up 58% today...

Doren — 7/17/2015 9:03:02 PM

[Glenn Petersen] U.S. Power Grid Being Hit With ‘Increasing’ Hacking Attacks, Government Warns P...

Glenn Petersen — 6/24/2015 5:15:12 PM

U.S. Power Grid Being Hit With ‘Increasing’ Hacking Attacks, Government Warns

Potential to ‘take down’ U.S. power grids, water systems and other critical infrastructure

BY: Adam Kredo
Washington Free Beacon
June 24, 2015 5:00 am

Major attacks on the U.S. power grid system are “increasing,” with hackers stepping up efforts to penetrate critical systems and to implant malicious software that could compromise the power grid and result in a nationwide crisis, according to a government report.

While experts have long signaled that the U.S. power grid and related systems are vulnerable to physical attacks by terrorists and other individuals, the U.S. government is now warning that sensitive computer systems that maintain the grid are increasingly being attacked, according to a Congressional Research Service (CRS) report that was not made public until the Federation of American Scientists (FAS) disclosed it this month.

The report warns that hackers potentially affiliated with terrorist groups or rogue nations have the ability to insert harmful malware into the internal systems governing the U.S. grid, which increasingly are being hooked into the Internet.

These types of computer viruses are able to comb internal systems for private information in a clandestine manner; they can also be used to wrest control of certain computers away from their owners.

“In recent years, new threats have materialized as new vulnerabilities have come to light, and a number of major concerns have emerged about the resilience and security of the nation’s electric power system,” the report says. “In particular, the cyber security of the electricity grid has been a focus of recent efforts to protect the integrity of the electric power system.”

The threat is compounded by the revelation that many power companies are only living up to the “minimum standards” set for cyber security by the U.S. government.

“Although malware intrusions may not have resulted in a significant disruption of grid operations so far, they still have been possible even with mandatory standards in place,” the report states.

Cyber attacks on the U.S. grid and power companies are becoming more prevalent.

“Incidents of reported cyber intrusions and attacks aimed at undermining the U.S. grid appear to be increasing,” according to the report. “While parts of the electric power subsector have mandatory and enforceable cyber and physical security standards, some have argued that minimum, consensus-based standards are not enough to secure the system.”

The report continues: “Further, the electric grid is not isolated from attacks on other critical infrastructure sectors on which it depends (i.e., the natural gas subsector, water, and transportation), and mandatory and enforceable cyber security standards apply to only a few of the critical infrastructure sectors,” the report states.

Experts and government authorities remain concerned about attacks on “critical infrastructure.”

“The increasing frequency of cyber intrusions on industrial control systems of critical infrastructure is a trend of concern to the electric utility industry,” the report warns “The National Security Agency reported that it has seen intrusions into [industrial control] systems by entities with the apparent technical capability ‘to take down control systems that operate U.S. power grids, water systems and other critical infrastructure.’”

The report documents a number of recent attacks on U.S. power grid computer systems.

In October 2014, for instance, the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) revealed that “several industrial control systems has been infected” by a virus capable of gathering information about how the grid system functions.

“Hackers are reported to have used the BlackEnergy Trojan horse to deliver plug-in modules used for several purposes, including keylogging, audio recording, and grabbing screenshots,” according to the report. “Researchers looking at the BlackEnergy malware are reported to have identified a plug-in that can destroy hard disks, and believe that the attackers will activate the module once they are discovered in order to hide their presence.”

Another virus named HAVEX has been used to open so-called “back doors” into computer systems.

“The cyberattack leaves the company’s system in what appears to be a normal operating condition, but the attacker now has a backdoor to access and possibly control the company’s” control systems.

These threats, the report warns, are only growing more sophisticated as the industry struggles to combat such attacks.

“The threats facing the grid are evolving, and with each new intrusion or cyber attack, priorities to protect the system can shift,” the report explains. “But that does not mean previous attacks can be considered past issues.”

While nation-states may use such attacks to gather data, experts believe they are less likely to launch an attack due to the prospect of likely retaliation by the United States.

However, terrorists have no such concern, the report says.

“A terrorist or similar organization would likely be undeterred by such a consequence [of potential retaliation], and may use the worm for its own purposes,” according to the report. “Given the potential for damage to the nation’s economy from a major cyberattack on the grid, some might suggest a greater focus on recovery is needed and should become as much a part of a cybersecurity strategy as are efforts to secure the system.”

freebeacon.com

[Glenn Petersen] I can't believe that thus story is not getting more coverage: Attack Gave Chine...

Glenn Petersen — 6/21/2015 10:35:31 AM

I can't believe that thus story is not getting more coverage:

Attack Gave Chinese Hackers Privileged Access to U.S. Systems

By DAVID E. SANGER, NICOLE PERLROTH and MICHAEL D. SHEAR
New York Times
JUNE 20, 2015

WASHINGTON — For more than five years, American intelligence agencies followed several groups of Chinese hackers who were systematically draining information from defense contractors, energy firms and electronics makers, their targets shifting to fit Beijing’s latest economic priorities.

But last summer, officials lost the trail as some of the hackers changed focus again, burrowing deep into United States government computer systems that contain vast troves of personnel data, according to American officials briefed on a federal investigation into the attack and private security experts.

Undetected for nearly a year, the Chinese intruders executed a sophisticated attack that gave them “administrator privileges” into the computer networks at the Office of Personnel Management, mimicking the credentials of people who run the agency’s systems, two senior administration officials said. The hackers began siphoning out a rush of data after constructing what amounted to an electronic pipeline that led back to China, investigators told Congress last week in classified briefings.

Much of the personnel data had been stored in the lightly protected systems of the Department of the Interior, because it had cheap, available space for digital data storage. The hackers’ ultimate target: the one million or so federal employees and contractors who have filled out a form known as SF-86, which is stored in a different computer bank and details personal, financial and medical histories for anyone seeking a security clearance.

“This was classic espionage, just on a scale we’ve never seen before from a traditional adversary,” one senior administration official said. “And it’s not a satisfactory answer to say, ‘We found it and stopped it,’ when we should have seen it coming years ago.”

The administration is urgently working to determine what other agencies are storing similarly sensitive information with weak protections. Officials would not identify their top concerns, but an audit issued early last year, before the Chinese attacks, harshly criticized lax security at the Internal Revenue Service, the Nuclear Regulatory Commission, the Energy Department, the Securities and Exchange Commission — and the Department of Homeland Security, which has responsibility for securing the nation’s critical networks.

At the Nuclear Regulatory Commission, which regulates nuclear facilities, information about crucial components was left on unsecured network drives, and the agency lost track of laptops with critical data.

Computers at the I.R.S. allowed employees to use weak passwords like “password.” One report detailed 7,329 “potential vulnerabilities” because software patches had not been installed. Auditors at the Department of Education, which stores information from millions of student loan applicants, were able to connect “rogue” computers and hardware to the network without being noticed. And at the Securities and Exchange Commission, part of the network had no firewall or intrusion protection for months.

“We are not where we need to be in terms of federal cybersecurity,” said Lisa Monaco, President Obama’s homeland security adviser. At an Aspen Institute conference in Washington on Tuesday, she blamed out-of-date “legacy systems” that have not been updated for a modern, networked world where remote access is routine. The systems are not continuously monitored to know who is online, and what kind of data they are shipping out.

In congressional testimony and in interviews, officials investigating the breach at the personnel office have struggled to explain why the defenses were so poor for so long. Last week, the office’s director, Katherine Archuleta, stumbled through a two-hour congressional hearing. She was unable to say why the agency did not follow through on inspector general reports, dating back to 2010, that found severe security lapses and recommended shutting down systems with security clearance data.

When she failed to explain why much of the information in the system was not encrypted — something that is standard today on iPhones, for example — Representative Stephen F. Lynch, a Massachusetts Democrat who usually supports Mr. Obama’s initiatives, snapped at her. “I wish that you were as strenuous and hardworking at keeping information out of the hands of hackers,” he said, “as you are keeping information out of the hands of Congress and federal employees.”

Her performance in classified briefings also frustrated several lawmakers. “I don’t get the sense at all they understand the problem,” said Representative Jim Langevin, a Rhode Island Democrat, who called for Ms. Archuleta’s resignation. “They seem like deer in the headlights.”

Josh Earnest, the White House spokesman, said on Wednesday that Mr. Obama remained confident that Ms. Archuleta “is the right person for the job.” Ms. Archuleta, who took office in November 2013, did not respond to a request for an interview.

But even some White House aides say a lack of focus by managers contributed to the security problems. It was not until early last year, as computer attacks began on United States Investigations Services, a private contractor that conducts security clearance interviews for the personnel office, that serious efforts to develop a strategic plan to seal up the agency’s many vulnerabilities started.

The attacks on the contractor “should have been a huge red flag,” said one senior military official who has reviewed the evidence of China’s involvement. “But it didn’t set off the alarms it should have.”

Federal and private investigators piecing together the attacks now say they believe the same groups responsible for the attacks on the personnel office and the contractor had previously intruded on computer networks at health insurance companies, notably Anthem Inc. and Premera Blue Cross.

What those attacks had in common was the theft of millions of pieces of valuable personal data — including Social Security numbers — that have never shown up on black markets, where such information can fetch a high price. That could be an indicator of state sponsorship, according to James A. Lewis, a cybersecurity expert at the Center for Strategic and International Studies.

But federal investigators, who like other officials would not speak on the record about a continuing inquiry, said the exact affiliation between the hackers and the Chinese government was not fully understood. Their tools and techniques, though, were easily identifiable to intelligence analysts and the security researchers who have been analyzing the breaches at the insurers and the Office of Personnel Management. Federal officials believe several groups were involved, though some security experts only detected one.

“Since mid-2014, we have observed a threat group target valuable ‘personally identifiable information’ from multiple organizations in the health care insurance and travel industries,” said Mike Oppenheim, the manager of threat intelligence at FireEye, a cybersecurity company. “We believe this group is behind the O.P.M. breach and have tracked this group’s activities since early 2013.”

But he argued that “unlike other actors operating from China who conduct industrial espionage, take intellectual property or steal defense technology, this group has primarily targeted information that would enable it to build a database of Americans, with a likely focus on diplomats, intelligence operatives and those with business in China.”

While Mr. Obama publicly named North Korea as the country that attacked Sony Pictures Entertainment last year, he and his aides have described the Chinese hackers in the government records case only to members of Congress in classified hearings. Blaming the Chinese in public could affect cooperation on limiting the Iranian nuclear program and tensions with China’s Asian neighbors. But the subject is bound to come up this week when senior Chinese officials meet in Washington for an annual strategic and economic dialogue.

Though their targets have changed over time, the hackers’ digital fingerprints stayed much the same. That allowed analysts at the National Security Agency and the F.B.I. to periodically catch glimpses of their movements as they breached an ever more diverse array of computer networks.

Yet there is no indication that the personnel office realized that it had become a Chinese target for almost a year. Donna K. Seymour, the chief information officer, said the agency put together last year “a very progressive, proactive plan that allowed us to see the adversarial activity,” and argued that “had we not been on that path, we may never have seen anything” this spring. She cautioned, “There is no one security tool that is a panacea.”

A congressional report issued in February 2014 by the Republican staff of the Senate Homeland Security Committee, concluded that multiple federal agencies with responsibility for critical infrastructure and holding vast amounts of information “continue to leave themselves vulnerable, often by failing to take the most basic steps towards securing their systems and information.”

The report reserves its harshest criticism for the repeated failures of agency officials to take steps — some of them very basic — that would help thwart cyberattacks.

Computers at the Department of Homeland Security, which is charged with protecting the nation’s public infrastructure, contained hundreds of vulnerabilities as recently as 2010, according to authors of the report. They said computer security failures remained across agencies even though the government has spent “at least $65 billion” since 2006 on protective measures.

At the personnel office, a set of new intrusion tools used on the system set off an alarm in March, Ms. Seymour said. The F.B.I. and the United States Computer Emergency Response Team, which works on network intrusions, found evidence that the hackers had obtained the credentials used by people who run the computer systems. Ms. Seymour would say only that the hackers got “privileged user access.” The administration is still trying to determine how many of the SF-86 national security forms — which include information that could be useful for anyone seeking to identify or recruit an American intelligence agent, nuclear weapons engineer or vulnerable diplomat — had been stolen.

“They are casting a very wide net,” John Hultquist, a senior manager of cyberespionage threat intelligence at iSight Partners, said of the hackers targeting of Americans’ personal data. “We’re in a new space here and we don’t entirely know what they’re trying to do with it.”

David E. Sanger and Michael D. Shear reported from Washington, and Nicole Perlroth from San Francisco.

nytimes.com

[Glenn Petersen] The Rapid7 registration statement: sec.gov Security firm Rapid7 files for $80 m...

Glenn Petersen — 6/11/2015 6:38:37 PM

The Rapid7 registration statement: sec.gov

Security firm Rapid7 files for $80 million IPO

by Robert Hackett @rhhackett
Fortune
June 11, 2015, 2:28 PM EDT

As the security space heats up, another hot cyber firm has announced that it will go public.

Rapid7, a Boston, Mass.-based cybersecurity company, has filed for an $80 million IPO.

According to the tech firm’s publicly available S-1 form, Rapid7 will begin selling its common stock “as soon as practicable.” The company was founded over a decade ago and has raised more than $90 million in funding to date.

The company will join an elite group of security companies that have moved from private venture capital markets into the public investing arena in recent years, which include FireEye FEYE -0.30% in 2013 and Palo Alto Networks PANW -0.02% in 2012. Industry watchers are keeping their eyes on other security firms such as Veracode, Bit9 + Carbon Black, LogRhythm, Mimecast and Okta that appear poised to go public in the near future, too.

Rapid7 sells security software and services that help companies understand their IT environments and reduce their exposure to cyber attacks. One of its more popular offerings is its Metasploit penetration testing products, which it acquired in a 2009 deal.

The company has 3,900 customers in more than 90 countries, including nearly a third of Fortune 1000 companies, and its revenue increased to $76.9 million last year, up from the $60 million it made the year before, according to the SEC filing. Its top line has also more than doubled from $31 million in 2011.

Some of the company’s customers include federal security agencies, like the National Security Agency and the U.S. Department of Homeland Security, defense contractors such as Lockheed Martin LMT 1.16% and General Dynamics GD 0.50% , and others like Amazon AMZN 0.51% and American Express AXP 0.14% .

After raising $30 million in a Series D funding round at the end of last year, CEO and president Corey Thomas told SecurityWeek that filing for an IPO would be a “natural progression” for the company, although Thomas didn’t reveal any details or future plans at that time. Thomas also told technology news site eWeek that funds raised would help build the company’s engineering and sales teams.

“There is a heightened and increasing level of awareness and concern over cyber security that’s being driven by the perfect storm,” Thomas told SecurityWeek, mentioning the rise of the cloud and mobile, the ease of buying hacking tools online, and the frequency of big data breaches.

The company has selected Morgan Stanley to lead the IPO. Its proposed NASDAQ ticker is “RPD” and its investors include Bain Capital Ventures and Technology Crossover Ventures

fortune.com

[Doren] Kim Dotcom’s MegaNet Preps Jan 2016 Crowdfunding Campaign Kim Dotcom's dream ...

Doren — 6/11/2015 3:44:19 AM

Kim Dotcom’s MegaNet Preps Jan 2016 Crowdfunding Campaign

Kim Dotcom's dream of a people-powered, censorship-resistant Internet will rely on the goodwill of supporters to get off the ground. In an announcement this morning, the entrepreneur confirmed that his MegaNet project will seek equity via a crowd-funding campaign set to launch on the January 2016 anniversary of the raid on Megaupload.

[Doren] Kaspersky Lab cybersecurity firm is hacked bbc.com

Doren — 6/10/2015 11:34:22 AM

[Doren] They are going to fly today: Millions of US government workers hit by data bre...

Doren — 6/5/2015 3:04:55 AM

They are going to fly today:

Millions of US government workers hit by data breach

bbc.com

[Glenn Petersen] Raytheon to Plow $1.7 Billion Into New Cyber Venture Defense Contractor Buys Co...

Glenn Petersen — 4/21/2015 9:13:45 AM

Raytheon to Plow $1.7 Billion Into New Cyber Venture

Defense Contractor Buys Control of Websense, Which Will Be Core of Operation

By Doug Cameron
Wall Street Journal
Updated April 20, 2015 7:26 a.m. ET

The price Raytheon is paying for control of Websense is equivalent to more than four to five times the cyber company’s annual sales, a pricey multiple for the defense industry. Photo: BLOOMBERG NEWS
________________

Raytheon Co. RTN -0.21 % is betting it can leverage the cybersecurity skills it honed for the U.S. military and intelligence agencies to sell to banks and retailers, investing almost $1.7 billion to establish a stand-alone business in an area where its defense peers have struggled to make money.

The company on Monday said it would buy control of Websense Inc. from private-equity firm Vista Partners LLC. Raytheon said Austin, Texas-based Websense, which has 21,000 data-security clients, half of them overseas, will form the core of a new cyber joint venture with forecast sales of $500 million this year and margins of around 20%.

Raytheon Chief Executive Tom Kennedy said the threat of cyberattacks such as the one suffered last year by Target Corp. TGT 1.14 % is increasing as cloud computing and mobile services make companies more vulnerable to costly electronic intrusions by state-sponsored hackers, terrorists, organized crime or insiders.

“CEOs are shaking in their boots,” said the 59-year-old Mr. Kennedy, who took the helm of the fourth-largest U.S. defense contractor by sales in March of last year.

Raytheon is paying the equivalent of more than four to five times Websense’s annual sales, a pricey multiple for the defense industry. The deal is the largest acquisition in a decade by one of the nation’s five prime contractors. Collectively those companies have done dozens of deals aimed at parlaying their experience with the Pentagon into commercial work. The results have been mixed.

Defense companies have found it tough to convert salespeople who are used to dealing with the Defense Department to selling cyber products to other business clients, while the Pentagon has been reluctant to allow contractors to transfer technology to their nonmilitary customers.

Raytheon executives said the Websense deal addressed both issues. The firm has an experienced commercial sales staff, while Raytheon has long-standing deals with the Pentagon to use some intellectual property in the commercial sector.

Raytheon has made the defense industry’s most concerted push into cyber, with 14 acquisitions since 2007, including the $420 million purchase of Blackbird Technologies last November, which added capabilities in the intelligence and special-operations markets.

With dozens of commercial cybersecurity companies springing up and attracting rich valuations, defense companies have found it tough to gain traction. General Dynamics Corp. GD 1.53 % last week sold a commercial cyber firm it acquired three years ago, and plans to focus on government work. Boeing Co. BA 2.05 % made a similar move in January, but Lockheed Martin Corp. LMT 1.02 % is continuing to target commercial cyber business.

Both the commercial and defense sectors will converge this week at a big cybersecurity conference in San Francisco, Defense Secretary Ash Carter is expected to outline the Pentagon’s new cyber strategy at a separate event on Thursday.

Raytheon’s shares have has underperformed its peers during a three-year run-up in defense stocks, partly because it devoted more funds to deals and research than its counterparts, who have delivered billions of dollars in buybacks and higher dividends.

Websense “would clearly take Raytheon well into the commercial cybersecurity space, which we believe would involve significant risk,” said Sanford C. Bernstein & Co. analysts in a recent report on the sector.

Websense CEO John McCormack, who will head the new Raytheon venture, said the focus of commercial cyber has shifted from deterring threats to limiting their damage. “The days are gone when you can prevent intrusion,” he said in an interview.

“It screams out automation and integration,” added Mr. McCormack, an 18-year veteran of the industry who says clienmts are hamstrung by lack of trained staff and the cost and time spent upgrading legacy systems.

He said Websense has outperformed a global commercial cyber market, growing at around 8% a year, with a top 10 market position in monitoring Web gateways and providing data-loss protection.

Raytheon, which is based in Waltham, Mass., predicted the joint venture would deliver high-single-digit revenue growth next year and mid-double-digit growth in 2017, and would be profitable from day one. Raytheon will have an 80% stake in the new cyber venture, with Vista Partners LLC holding 20%.

Raytheon is investing $965 million in cash, providing a $600 million loan and injecting $400 million of existing cyber assets into the as-yet unnamed venture. The private-equity firm, which took Websense private for $890 million in 2013, will also invest $335 million in the venture.

wsj.com

[The Ox] Fortinet Inc. ...

The Ox — 4/20/2015 6:09:31 PM

Fortinet Inc. FTNT, +2.71% shares rallied in the extended session Monday after the network-security company's first-quarter results topped Wall Street estimates. Fortinet shares rose 7.4% to $37.20 on moderate volume. The company reported adjusted first-quarter earnings of 8 cents a share on revenue of $212.9 million. Analysts surveyed by FactSet had estimated 6 cents a share on revenue of $205 million.

[Doren] Cyber IPO pipeline grows as data breaches boost security spending reuters.com ...

Doren — 3/20/2015 5:22:42 PM

Cyber IPO pipeline grows as data breaches boost security spending

reuters.com

Too busy to comment or keep up right now.

[Glenn Petersen] Blue Coat Systems has changed hands again, doubling in value. Expect an IPO. Ba...

Glenn Petersen — 3/11/2015 3:26:25 AM

Blue Coat Systems has changed hands again, doubling in value. Expect an IPO.

Bain to buy Blue Coat for about $2.4 billion

By Greg Roumeliotis
Tue Mar 10, 2015 10:56am EDT

(Reuters) - Bain Capital LLC will acquire Blue Coat Systems Inc from fellow private equity firm Thoma Bravo LLC in a deal that the network security company said on Tuesday would value it at about $2.4 billion, including debt.

The deal comes amid strong demand for cybersecurity technology following a spate of high-profile breaches that have crippled businesses and rattled conglomerates such as Sony Corp and Target Corp.

"This is a land-grab market opportunity, and private equity as well as larger tech players, have a strong appetite for vendors that play in this $15 to $20 billion market opportunity," said FBR Capital Markets analyst Daniel Ives.

Reuters first reported on the deal earlier on Tuesday.

Blue Coat, which San Francisco-based Thoma Bravo took private in February 2012 for $1.3 billion, operates in an area where businesses and governments are increasing their spending to counter and contain cybersecurity threats.

Its products are used to speed up data flow over the Internet and block inappropriate websites and cyber attacks.

"The world's most trusted brands use Blue Coat, and the acquisition by Bain Capital sets us on the trajectory to further grow our portfolio, better serve our customers and help us prepare to return to the public markets," Blue Coat Chief Executive Officer Gregory Clark said in a statement.

Since going private, Blue Coat has increased its scale through a number of acquisitions. These have included anti-malware company Norman Shark; Solera Networks, which uses data mining to detect potential security threats; and Netronome's SSL technology, which helps inspect Internet traffic.

Goldman Sachs Group Inc and Wilson Sonsini Goodrich & Rosati are advising Blue Coat.

Jefferies LLC is advising Bain and providing debt financing for the deal. Ropes & Gray LLP is legal counsel, and PwC LLP is accounting adviser to the private equity firm.

(Reporting by Greg Roumeliotis in New York; Additional reporting by Jim Finkle in Boston and Liana B. Baker in New York; Editing by Chizu Nomiyama and Lisa Von Ahn)

reuters.com

[Glenn Petersen] Exclusive: Veracode files for IPO by Dan Primack@danprimack Fortune ...

Glenn Petersen — 3/2/2015 12:33:40 PM

Exclusive: Veracode files for IPO

by Dan Primack @danprimack
Fortune
March 2, 2015, 11:09 AM EST

Cybersecurity company plans to price IPO this spring.

Cybersecurity company Veracode is planning to go public in May, Fortune has learned.

The Burlington, Mass.-based company already has filed confidential IPO documents with the SEC, and is expected to file its publicly-available S-1 shortly. Veracode is said to have already picked banks to underwrite the offering, but we were unable to discover their identities.

Veracode has raised over $110 million in venture capital funding. Its most recent round was a $40 million Series F infusion last September led by Wellington Management, at a post-money valuation of around $450 million. The IPO is expected to value Veracode at around twice that figure.

The company declined comment, via a spokeswoman.

fortune.com