Daily Drop (505)

05-31-23

May 31, 2023

Wednesday, May 31, 2023 // (IG): BB // Intro Exploit Dev // Coffee for Bob

Russia Cancels National Cryptocurrency Exchange

Analyst Comments: Russia's decision to cancel the proposed nationwide cryptocurrency exchange and focus on regulatory frameworks reflects the country's recognition of the challenges and risks associated with such an endeavor. The impact of international sanctions and the need for compliance and cybersecurity are key factors in this shift in approach. By prioritizing regulation and supporting private entities in the crypto industry, Russia aims to promote competition, innovation, and user protection. The emphasis on multiple players and the regulation of platform access helps mitigate risks related to sanctions, cyber-attacks, and market dominance.

FROM THE MEDIA: Russia has decided to cancel its proposed nationwide cryptocurrency exchange due to the sanctions imposed by the international community following the Ukraine invasion. Instead, Russian authorities will focus on developing regulatory frameworks that allow private companies to establish cryptocurrency exchanges. The State Duma committee on the financial market, headed by Anatoly Aksakov, has expressed support for this new approach. The exchanges will be subject to regulation by the Russian Central Bank, which is expected to introduce new rules governing their operations by the end of the year. The emphasis is on prioritizing compliance and establishing clear regulations before proceeding with the exchange. Russian crypto companies also advocate for a regulatory framework to mitigate risks, enhance cybersecurity, and address market dominance concerns.

READ THE STORY: CNBTC

Rare Earths and Polysilicon and Why We Must De-Risk From China

Analyst Comments: The concerns raised in the blog post regarding China's control over critical materials have proven to be valid. The global supply chain vulnerabilities exposed by the COVID-19 pandemic and the recent trade tensions have heightened awareness about the risks of relying heavily on a single country. As countries seek to secure their supply chains and reduce dependencies on China, diversifying sources of rare earths and polysilicon has become a priority.

FROM THE MEDIA: The blog post discusses the concerns surrounding China's dominance in the global supply chain of rare earths and polysilicon, essential materials for high-tech industries including renewable energy. China's low-cost production, achieved by ignoring environmental and labor standards, has allowed it to export these materials at significantly lower prices while bearing the associated pollution and health risks. However, the downstream benefits and profits primarily accrue to foreign companies. The post also warns about the risk of overcapacity and price competition in the polysilicon market, potentially leading to the loss of competitors and increased dependence on China.

READ THE STORY: HB

Netherlands fears Chinese cyberattacks amid chips battle

Analyst Comments: The Dutch government's concerns about Chinese cyberattacks and intellectual property theft reflect the global anxieties surrounding China's cyber activities and its aggressive pursuit of advanced technologies. The Netherlands' position as a key player in the global chips industry and its past experiences with intellectual property theft have likely heightened its vigilance. By imposing export restrictions and banning certain Chinese-owned applications, the Netherlands is aligning itself with the United States and other countries that have taken measures to protect their national security and technological interests. These developments indicate the growing recognition of the potential risks posed by China's cyber capabilities and the efforts to mitigate them.

FROM THE MEDIA: The Netherlands has expressed concerns about Chinese cyberattacks and intellectual property theft, according to Dutch Foreign Minister Wopke Hoekstra. The country's worries align with reports from Dutch intelligence services that designate China as a significant cyber threat. The Netherlands, home to ASML, a crucial global chip production company, has experienced incidents of intellectual property theft linked to China in the past. The Dutch government recently implemented export restrictions on chip technology to China, joining the United States and Japan in an effort to prevent the supply of cutting-edge semiconductors to Beijing.

READ THE STORY: Politico

Dark Pink APT Group Leverages TelePowerBot and KamiKakaBot in Sophisticated Attacks

Analyst Comments: The activities of Dark Pink highlight the persistent and evolving nature of advanced threat actors and their targeted attacks. The APT group's focus on high-value targets across multiple countries underscores their intent to gather sensitive information for espionage purposes. The utilization of custom malware tools and sophisticated attack techniques demonstrates Dark Pink's advanced capabilities and the need for robust cybersecurity measures to detect and mitigate their activities. The group's adoption of new techniques and tools, such as the split functionality of KamiKakaBot and the use of webhook[.]site, indicates their adaptability and efforts to evade detection.

FROM THE MEDIA: The advanced persistent threat (APT) actor known as Dark Pink, or Saaiwc Group, has been linked to five new attacks targeting entities in Belgium, Brunei, Indonesia, Thailand, and Vietnam between February 2022 and April 2023. The attacks focused on educational entities, government agencies, military bodies, and non-profit organizations, indicating Dark Pink's continued interest in high-value targets. The APT group, believed to be of Asia-Pacific origin, utilizes custom malware tools such as TelePowerBot and KamiKakaBot to exfiltrate sensitive data from compromised hosts. Dark Pink employs spear-phishing emails and advanced persistence mechanisms to maintain control and remain undetected within target networks. Recent modifications to Dark Pink's attack sequence and the enhancement of KamiKakaBot demonstrate the group's efforts to impede analysis and improve functionality. The APT actor has been observed using Telegram for command-and-control and exfiltrating stolen data over HTTP using webhook[.]site. Dark Pink's activities suggest a broader victimology footprint than previously assumed, and its ongoing updates to existing tools indicate a persistent threat to organizations.

READ THE STORY: THN

Molly White Tracks Crypto Scams. It’s Going Just Great

Analyst Comments: Molly White's blog serves an important role in providing a critical perspective on the cryptocurrency industry, highlighting its pitfalls and risks that often go unnoticed in mainstream coverage. The series of collapses and fraud cases in the industry have underscored the need for regulation and raised awareness among policymakers. White's efforts to shed light on these issues and contribute to the dialogue on regulation are valuable in ensuring a more transparent and accountable crypto industry.

FROM THE MEDIA: Molly White, a software engineer, started the blog "Web3 Is Going Just Great" to provide a critical perspective on the cryptocurrency industry, highlighting its dark side and the risks involved. The blog gained popularity as it chronicled thefts, failures, and scams, earning White a reputation as an authoritative crypto pundit. While White initially admired the pro-privacy and anti-censorship principles of crypto, she became disillusioned by the focus on personal profit and the negative impact it had on society. Despite facing online abuse and threats, White persisted in her critique. The series of collapses and fraud cases in the crypto industry in 2022 further validated her concerns and brought attention to the need for regulation. White hopes her work can contribute to policymakers understanding the risks and taking appropriate measures.

READ THE STORY: Wired

Uncle Sam vows to Micron-manage China's memory chip ban

Analyst Comments: Secretary Raimondo's strong stance against China's actions regarding Micron reflects the ongoing tensions between the two nations over trade and economic practices. The US is pushing back against what it perceives as unfair treatment of American companies and has expressed its commitment to protecting its businesses and workers. The conflict highlights the larger issue of economic coercion and non-market practices employed by China, which is a concern for the US and its allies.

FROM THE MEDIA: US Commerce Secretary Gina Raimondo has stated that the Biden administration will not tolerate an effective ban on sales of Micron memory chips in China. Raimondo called China's moves against Micron economic coercion and stated that the US sees no evidence of national security concerns. She emphasized that the US is working closely with partner nations to address challenges related to China's non-market practices. China's Cyberspace Administration recently ruled that Micron should be considered a threat to national security, prompting calls for retaliation from the US. Raimondo's remarks come after her meeting with China's Commerce Minister to discuss US-China commercial relations.

READ THE STORY: The Register

iPhone maker Foxconn follows Nvidia with forecast for AI sales boost

Analyst Comments: Foxconn's optimistic forecast for its AI server business reflects the increasing demand for AI-related infrastructure and services. As AI systems like ChatGPT become more prevalent and relied upon, the need for robust AI servers rises, benefiting companies involved in their manufacturing. The growth in AI server demand aligns with the broader trend of AI-driven technologies shaping various industries. While Foxconn's revenue from AI servers is a smaller portion of its overall business, the company's diverse manufacturing capabilities position it well to capitalize on the momentum in the market.

FROM THE MEDIA: Foxconn, the world's largest contract electronics manufacturer, expects its AI server business to at least double in the second half of 2023. The rise in demand for AI servers, driven by the rapid spread of generative AI systems like ChatGPT and increasing reliance on them, has contributed to the growth forecast. Foxconn, known as Apple's largest manufacturing partner, manufactures a wide range of electronic products and components. While the company has a significant market share in server manufacturing, its revenue from AI servers accounts for 20% of its server business. The forecast aligns with the overall surge in demand for data center capacity and chip-related products driven by AI growth, as highlighted by Nvidia and Taiwan Semiconductor Manufacturing.

READ THE STORY: FT

Hackers Exploit Barracuda Email Security Gateway 0-Day Flaw for 7 Months

Analyst Comments: The exploitation of the zero-day vulnerability in Barracuda's Email Security Gateway appliances highlights the persistent threat of targeted attacks against critical infrastructure. The extended period of exploitation prior to detection and patching underscores the need for robust security measures and regular patching practices. The presence of multiple malware strains indicates the attackers' intent to establish persistence and carry out various malicious activities. The source code overlap with an open-source backdoor suggesting potential connections or inspirations for the threat actors. Barracuda's prompt response in releasing patches and notifying affected organizations demonstrates a commitment to addressing the issue.

FROM THE MEDIA: Barracuda, an enterprise security firm, revealed that threat actors had been exploiting a zero-day vulnerability in its Email Security Gateway (ESG) appliances since October 2022. The critical flaw, designated as CVE-2023-2868, allows remote attackers to execute code on vulnerable installations. The vulnerability affected ESG appliance versions 5.1.3.001 through 9.2.0.006. Barracuda released patches on May 20 and May 21 to address the issue. The company stated that a subset of impacted appliances had been accessed without authorization, with evidence of data exfiltration. Three malware strains, named SALTWATER, SEASPY, and SEASIDE, were identified in the attacks. The source code overlap between SEASPY and an open-source backdoor called cd00r has been noted. The attacks have not been attributed to any specific threat actor or group.

READ THE STORY: THN

US intelligence research agency examines cyberpsychology to outwit criminal hackers

Analyst Comments: The ReSCIND project represents an innovative approach to cybersecurity by focusing on understanding the psychological weaknesses of attackers. By exploring the cognitive vulnerabilities of hackers, the initiative seeks to develop effective defensive systems that exploit these weaknesses. Integrating cyberpsychology into cybersecurity strategies could lead to breakthroughs in addressing human-related cybersecurity challenges. However, the successful implementation of such an approach will require careful research and analysis to identify relevant weaknesses and develop practical software solutions. The project's high-risk, high-reward nature demonstrates the commitment of IARPA to explore unconventional avenues to improve cybersecurity.

FROM THE MEDIA: The ongoing China-Taiwan issue, dating back to 1949, presents a complex geopolitical challenge rooted in territorial and sovereignty disputes. This discord has escalated in recent years, further complicated by Taiwan's efforts to gain international recognition and recent political exchanges with U.S. officials. China remains steadfast in its “One China Principle” asserting Taiwan as part of its territory while proposing a "one country, two systems" model. This proposition, however, is largely rejected by Taiwan, which fears a loss of autonomy and political freedoms. Internationally, China's position as a significant player within the United Nations, especially its seat on the Security Council, restricts Taiwan's ability to gain wider diplomatic recognition. Despite fulfilling traditional statehood criteria, Taiwan's formal diplomatic recognition is limited to a small number of countries with limited global influence.

READ THE STORY: Cyberscoop

Taiwan’s International Status: “A Country Within a Country”

Analyst Comments: The China-Taiwan issue remains a complex geopolitical conundrum, fueled by historical, territorial, and sovereignty disputes. Since 1949, the divide has persisted, leading to a potentially volatile situation. Given recent developments, including meetings between Taiwan's president and U.S. officials, the tensions appear to be escalating, adding another layer of complexity to the situation. China's firm stance on its "One China Principle" or the One China Policy has been unwavering, pushing for reunification and claiming Taiwan as an integral part of its territory. On the other hand, Taiwan continues to assert its autonomy and sovereignty, aiming to bolster its international recognition as an independent state. China's proposal of a "one country, two systems" model, as used in Hong Kong and Macau, doesn't seem to resonate with the Taiwanese populace and government officials who fear the loss of their political freedoms and autonomy. The rejection is further amplified by what has been observed in Hong Kong in recent years, with the territory experiencing an erosion of its freedoms and autonomy under this model.

FROM THE MEDIA: The relationship between China and Taiwan has been strained since 1949, with both sides asserting their claims to sovereignty and territorial integrity. Recent events, such as the meeting between Taiwan's President Tsai Ing-wen and U.S. House Speaker Kevin McCarthy, have further deteriorated bilateral relations and increased the potential for armed conflict. China has deployed its military near Taiwan to prevent perceived provocations, while Taiwan maintains its autonomy as a self-governing entity. Proposals for resolving the issue, such as a "one country, two systems" model, have been met with resistance in Taiwan. The international recognition of Taiwan remains complex, with limited formal diplomatic ties.

READ THE STORY: Modern Diplomacy

Chinese Cyber Activities Against Critical Infrastructure Raises the Stakes in U.S.-China Relations

FROM THE MEDIA: The U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) and the Five Eyes intelligence alliance have issued advisories regarding a cyber campaign called VOLT TYPHOON, attributed to China. The campaign, ongoing since at least 2021, targeted critical infrastructures and organizations in the United States and Guam, with a focus on cyber espionage. The attackers used fileless attack techniques and legitimate tools to evade detection. The timing of the advisory is significant given the strained relations between China and the United States.

READ THE STORY: OODALOOP

How China Aims to Counter US ‘Containment’ Efforts in Tech

Analyst Comments: The revelation that TikTok has been storing sensitive financial data on servers in China raises serious concerns about the security and privacy of user information. Storing such data in a country known for its surveillance capabilities and previous incidents of data theft from Americans raises questions about the integrity of TikTok's data handling practices. The discrepancies between the CEO's congressional testimony and the internal records obtained by Forbes further erode trust in the platform. Regulatory bodies in the US and Europe are likely to investigate TikTok's handling of user data, especially in light of previous privacy violations. Users and creators may also express concerns about the security of their financial information, potentially impacting their trust in the platform and willingness to participate in its monetization programs.

FROM THE MEDIA: The United States and China are engaged in strategic competition, with the U.S. aiming to prevent China from gaining an edge in advanced technology that could pose a threat to jobs and national security. The Biden administration has pursued an industrial strategy to support domestic industries and diversify supply chains while imposing trade restrictions, blacklists, and investment curbs on China. China, led by President Xi Jinping, is focused on achieving self-reliance in critical technologies through central planning and the mobilization of private companies and public funds. China has made significant advancements in areas such as supercomputers, electric vehicles, and critical minerals processing but faces challenges in securing advanced semiconductors. The Chinese government has implemented policies to promote collaboration between private capital and government initiatives to address technological weaknesses.

READ THE STORY: The Washington Post

Into the Bunker: drone attacks bring the war home to Russia

Analyst Comments: The recent drone attacks in Moscow have raised concerns about the vulnerability of the city and highlighted the impact of the war between Russia and Ukraine on Russian territory. The attacks have shaken even the elite residents of Moscow's gated communities, leading to increased demand for properties with bunkers or basements. While most of the city appears unchanged and locals continue their daily activities, the attacks have sparked anxiety among the population. The Ukrainian strikes inside Russia are aimed at diverting resources from the frontline and undermining Russian morale. Western backers of Ukraine have expressed concerns about attacks on Russian territory involving NATO weaponry. Russian hardline nationalists are calling for a state of total war in response to the attacks.

FROM THE MEDIA: The drone attacks in Moscow have disrupted the sense of security among the city's elite and have wider implications for the ongoing war between Russia and Ukraine. The attacks, while not as destructive as Russia's assaults on Ukrainian cities, have caused anxiety and raised concerns about Moscow's vulnerability. They have also highlighted the diverging experiences of Moscow residents, who have been largely insulated from the war, and those in border areas who have been subjected to regular attacks. The growing resentment towards Moscow, coupled with long-standing grievances about inequality and concentration of power, poses a risk to Russian popular support for the war.

READ THE STORY: FT

Pegasus-pusher NSO gets new owner keen on the commercial spyware biz

Analyst Comments: The restructuring and change of ownership of NSO Group suggest that the company is attempting to revamp its image and address the controversies surrounding its spyware. The transfer of ownership to Dufresne Holdings may be a strategic move to distance NSO from its previous associations and navigate government bans and legal challenges. However, NSO's actions and accountability will determine whether these changes bring about substantive improvements. The continued reports of Pegasus being used against human rights advocates and journalists highlight the ongoing concerns surrounding the misuse of spyware and the need for stricter regulations and oversight. Government actions, such as blacklisting and executive orders, demonstrate the increasing scrutiny and efforts to curb the proliferation of commercial spyware. The proposed Tech Lab in the EU indicates a recognition of the need for technical expertise to address surveillance technologies effectively.

FROM THE MEDIA: Spyware maker NSO Group, known for its Pegasus malware, has undergone a restructuring and change of ownership after facing government bans and financial difficulties. The company's creditors, Credit Suisse and Senate Investment Group, foreclosed on NSO and the Israeli company's ownership has been transferred to Luxembourg-based holding firm Dufresne Holdings, controlled by NSO co-founder Omri Lavie. NSO has faced criticism for its Pegasus spyware, which can secretly monitor calls, messages, and other activities on a victim's device. The company has also faced government sanctions and legal action, including a lawsuit from Meta. Governments and tech companies have taken action against NSO and commercial spyware, with the US blacklisting the company and issuing an executive order banning the use of commercial spy tools in certain situations. European lawmakers have opened an inquiry into spyware, particularly Pegasus.

READ THE STORY: The Register

RomCom RAT Using Deceptive Web of Rogue Software Sites for Covert Attacks

Analyst Comments: The use of a network of fake websites to distribute malware underscores the sophistication of the threat actors behind RomCom RAT. By impersonating popular software, they increase the chances of users downloading malicious versions. The targeted nature of the attacks, including the focus on Ukrainian state bodies and military systems, suggests specific objectives. The abuse of Google Ads demonstrates the adaptability of threat actors to leverage legitimate platforms for nefarious purposes. The improvements made to RomCom RAT, such as expanded command capabilities and the ability to download additional payloads, indicate a continuous effort to enhance its effectiveness. The use of signed certificates adds an extra layer of deception, making it harder to identify the malicious software. The convergence of tactics between cyber criminals and APT groups highlights the evolving threat landscape, with financially motivated actors adopting techniques once associated with state-sponsored activities.

FROM THE MEDIA: The threat actors behind RomCom RAT, also known as Void Rabisu, have been using a network of fake websites since July 2022 to infiltrate targets. These websites advertise rogue versions of popular software, including AstraChat, Signal, and OpenAI ChatGPT, among others. The cybersecurity firm Trend Micro is tracking this activity cluster, which has targeted Ukrainian state bodies, military systems, and other isolated targets in the Americas and Asia. Void Rabisu has also abused Google Ads to trick users into visiting fake websites. The use of RomCom RAT as a backdoor for targeted intrusions has been accompanied by improvements to the malware, expanding its capabilities to exert control over compromised hosts and download additional payloads. The attacks also utilize signed certificates to enhance the credibility of the malicious software installers. The blurring line between cybercrime and advanced persistent threats (APTs) suggests that tactics once associated with financially motivated actors are now being employed for geopolitical purposes.

READ THE STORY: THN

US clamps down on sensitive export requests to China

Analyst Comments: The testimony highlights the U.S. government's efforts to safeguard sensitive technologies from falling into the hands of China and potentially aiding its military advancements. The denial or rejection of a significant portion of export license applications demonstrates a deliberate approach to prevent the transfer of critical technologies. By scrutinizing exports and adding Chinese entities to the export control list, the U.S. aims to counter China's military modernization and address concerns related to national security and human rights abuses. The ongoing discussions regarding restrictions on outbound investments show the government's cautious approach to avoid unintended consequences and protect American interests.

FROM THE MEDIA: The U.S. government has been closely scrutinizing exports to China and denying or taking no action on about 26% of requests in order to prevent sales that could advance Beijing's militarization, according to testimony from senior officials. The Commerce Department reviews export and re-export license applications, identifying sensitive technologies and developing strategies to protect them. Additionally, more than 200 Chinese entities have been added to the U.S. export control list since the start of the Biden administration. The goal is to counter China's military modernization and activities that go against U.S. national security and foreign policy interests. Plans to restrict certain U.S. outbound investments in sensitive technologies are still being discussed.

READ THE STORY: Reuters

Hong Kong Set to Lift Retail Crypto Trading Ban, Observers Question Crypto Rules and City’s Priorities

Analyst Comments: Hong Kong's decision to allow retail trading of cryptocurrencies reflects its efforts to position itself as a leading global blockchain hub. By implementing a regulatory framework that accommodates retail investors, Hong Kong aims to meet the growing demand for digital assets and attract crypto companies to its market. The move also underscores a shift in attitude towards cryptocurrencies, moving away from previous restrictions and recognizing the potential economic benefits of embracing digital assets. The regulatory requirements, including measures to protect traders and ensure compliance, demonstrate Hong Kong's commitment to fostering a safe and regulated crypto environment. The country's favorable taxation guidance, fast-growing industry, and supportive regulations make it an attractive destination for crypto companies and investors.

FROM THE MEDIA: Hong Kong is set to allow retail trading of cryptocurrencies as it seeks to regain its status as a global blockchain hub. The Securities and Futures Commission (SFC) has developed a regulatory framework that will enable licensed entities to offer crypto services to retail investors. The new regime will replace the outgoing system and will come into effect in June. The regulatory requirements aim to protect traders and will include measures such as suitability checks, good governance, and enhanced token due diligence. Hong Kong's move to embrace cryptocurrencies and develop a digital economy is attracting crypto companies and exchanges to the jurisdiction.

READ THE STORY: Securities

Items of interest

The Wiretap: Spyware In Warfare

Analyst Comments: The findings underscore the increasing global issue of state-sponsored cyber espionage and the misuse of spyware like Pegasus for purposes that infringe on privacy rights and freedom of expression. It's a clear violation of international law, particularly in the context of a contentious conflict where such tools can escalate tensions and potentially lead to further harm. It is concerning that the origin of these spyware attacks remains unclear, highlighting the difficulty in establishing accountability in cyberspace. The calls by Amnesty International for a ban on highly invasive spyware like Pegasus and for the establishment of robust regulation and oversight mechanisms reflect a growing consensus among human rights and digital privacy advocates. The situation demonstrates the need for comprehensive international standards on cyber surveillance tools and their use, as well as stronger mechanisms to enforce these standards.

FROM THE MEDIA: From October 2020 to December 2022, at least twelve Armenian public figures, including journalists, human rights defenders, and officials, were targeted with the Pegasus spyware, developed by the NSO Group. Victims include representatives from Radio Free Europe/Radio Liberty, Armenia's Human Rights Defender, a United Nations official, and the former spokesperson of Armenia's Foreign Ministry. Evidence suggests that the Nagorno-Karabakh conflict may have influenced the targeting. The investigation, initiated after Apple sent out warnings of potential state-sponsored spyware in November 2021, identified two clusters of Pegasus infections in Armenia, the first following Armenia's defeat in the 2020 Nagorno-Karabakh conflict, and the second in 2022, coinciding with major escalations and peace talks between Armenia and Azerbaijan.

READ THE STORY: Forbes

Google Just Turned the Raspberry Pi into a Supercomputer (Video)

FROM THE MEDIA: In this video, the presenter explores the capabilities of the Raspberry Pi when combined with Google's Coral AI Edge TPU, a hardware designed to run machine learning algorithms. This combination is said to transform the Raspberry Pi, a relatively low-power device, into a supercomputer.

Getting Started in Reverse Engineering (Video)

FROM THE MEDIA: In this video, the presenter, known as Mark or "смех", provides a virtual lecture on introductory reverse engineering concepts. He shares his personal journey into the field, starting from his teenage years when he began game hacking and exploring HEX editors and binary editing.

These open-source products are reviewed by analysts at InfoDom Securities, providing possible context about current media trends related to the realm of cyber security. The stories selected cover a broad array of cyber threats and are intended to aid readers in framing key publicly discussed threats and overall situational awareness. InfoDom Securities does not endorse any third-party claims made in their original material or related links on their sites; the opinions expressed by third parties are theirs alone. For further questions, please contact InfoDom Securities at dominanceinformation@gmail.com.

Bob’s Newsletter

Discussion about this post