WASHINGTON, February 24, 2021 – In the first public hearing on the topic since the SolarWinds cyberattack in December, industry leaders testified Tuesday before the Senate Intelligence Select Committee that there are still unanswered questions about the attack.
Those questions include who did it, how they did it, and what they wanted.
Although the attack colloquially assigns SolarWinds as the victim, many companies were affected, and it was the cybersecurity firm FireEye that first announced they had been infiltrated.
The hack, which occurred between March and June 2020 and targeted several companies and federal agencies, has been widely attributed to Russian intelligence. FireEye’s CEO Kevin Mandia and Microsoft President Brad Smith, both whom testified at the hearing, said the adversary was likely the Russians, but did not want to give an irrefutable affirmation.
“We all pretty much know who it is,” said Mandia.
Although there is not yet definitive proof, we are confident from the evidence that this was the Russian intelligence agency, said Smith.
As Broadband Breakfast reported Tuesday, SolarWinds’ CEO Sudhakar Ramakrishna said that the attack was very sophisticated and required extensive expertise, as it occurred in the software update supply chain environment.
The other witnesses agreed. Mandia explained that FireEye found the implanted code from thousands of hours of examining detailed assembly code that requires specialized knowledge to understand.
Although we’ve seen many cyberattacks in the past, the scale of this attack was new, said Smith. The level of expertise we saw here required at least a thousand very skilled, capable engineers, he said.
Mandia said that this attack has been in the works for a long time. “This has been a multi-decade campaign for them. They just so happen to—in 2020—create a backdoor SolarWinds implant,” he said.
“They did a dry run in October of 2019, where they put innocuous code into the SolarWinds build just to make sure the results of their intrusion made it into the SolarWinds production platform environment,” he said.
SolarWinds still does not yet know how the attacker penetrated the company’s supply chain environment, but has narrowed it down to a few possibilities, said Ramakrishna. He did not elaborate on details, emphasizing that the investigation was still under way.
The witnesses said that what the hackers wanted and everything they took is still a mystery. At this point, we still don’t know everything the attacker did—only the attacker does, said Smith.
Various senators asked what needs to be done now that the world knows about the attack. The witnesses said they need better partnerships between the public and private sectors, especially a confidential way to report cyberattacks to the government.
They also said that nations need to agree on “ground rules” for engaging in cyberwarfare. During war, we agree not to bomb ambulances or hospitals, and in the digital space there needs to be equivalent off-limit targets, said Smith. These should include software updates, because the entire world and every type of infrastructure, both digital and physical, relies on them, he said.
The House Oversight and Homeland Security Committees are scheduled to hold a similar hearing Friday.
Companies Should Adopt Default No Trust Position on Programs to Protect Against Cyberattacks
Panelists identified risks in employees freely accepting links without thinking about their associated risks.
WASHINGTON, August, 24, 2022 – Companies should assume that new programs installed on company systems pose a threat to their networks to ensure a vigilant position on hacking risks, according to an expert on cybersecurity, after the country faced a number of high-profile cyberattacks recently.
The zero trust approach in which the default position is one of distrust of new programs was touted by Osman Saleem, cybersecurity and privacy director of operational technology and internet of things at professional services firm PricewaterHouseCoopers in Canada, who was speaking as a panelist on a Fierce Telecom event on Monday.
The event heard that the vast majority of security breaches at companies were a result of human error, including clicking on links containing malicious software (malware) that can wreak havoc on and suspend company systems. Data, in the case of a ransomware attack, can be locked away until the company pays a monetary sum to get it back.
Fred Gordy, director of cybersecurity at smart building company Intelligent Buildings, said companies sometimes don’t even back-up their systems in the event of an attack and only end up doing so in response to an attack.
Gordy also encouraged the zero trust approach to company security by assuming all digital programs and software have malware.
Opportunities for better cybersecurity
Saleem proposed that cybersecurity documents be reviewed and revised regularly because the cyber landscape always changes. This, he said, can protect the digital infrastructure of the companies’ systems, operations and employees.
Meanwhile, Congress has been pressing the issue, following the high-profile cyberattacks on software company SolarWinds, financial services company Robinhood, meat producer JBS, and oil transport company Colonial Pipeline. President Joe Biden earlier this year signed, as part of a larger budget bill, the Cyber Incident Reporting for Critical Infrastructure Act of 2022, which requires certain critical infrastructure companies to report cyberattacks to the federal government.
A House Oversight and Reform committee investigation concluded that certain hacks on companies were perpetrated through, in one example, an employee accepting a fake browser update. In the case of Colonial Pipeline and JBS, the use of many devices connected to the internet (IoT), the investigation found mass-produced factory password settings may have been the point of vulnerability.
Rep. Swalwell Says App Preference Bill Will Harm National Security
‘I just want to limit the ability for any bad actor to get into your device.’
July 27, 2022 – Antitrust legislation that would restrict the preferential treatment of certain apps on platforms would harm national security by making more visible apps from hostile nations, claimed Representative Eric Swalwell, D-Calif, at a Punchbowl News event Wednesday.
The American Innovation and Choice Online Act is currently under review by the Senate and, if passed, would prohibit certain online platforms from unfairly preferencing products, limiting another business’ ability to operate on a platform, or discriminating against competing products and services.
The legislation would ban Apple and Google from preferencing their own first-party apps on their app stores, which would make it easier for apps disseminated from hostile nations to be seen on the online stores, Swalwell said.
“[Russia and China] could flood the app store with apps that can vacuum up consumer data and send it back to China,” said Swalwell, adding that disinformation regarding American elections would spread. “Until these security concerns are addressed, we should really pump the breaks on this.”
Swalwell asked for a hearing conducted by Judiciary Committee of the House with the National Security Agency, Federal Bureau of Investigation, and Homeland Security officials to lay out what the bill would mean for national security.
“I just want to limit the ability for any bad actor to get into your device, whether you’re an individual or small business,” said Swalwell.
Lawmakers have become increasingly concerned about China’s access to American data through popular video-sharing apps, such as TikTok. Last month, Federal Communications Commissioner Brendan Carr called for Apple and Google to remove the app on the grounds that the app’s parent company, ByteDance, is “beholden” to the Communist government in China and required to comply with “surveillance demands.”
The comments follow debate surrounding the bill, which was introduced to the Senate on May 2 by Sen. Amy Klobuchar, D-Minn., on how it would affect small businesses and American competitiveness globally.
Government Should Incentivize Information Sharing for Ransomware Attacks, Experts Say
‘Information sharing between the government and the private sector, while integral to tackling ransomware, is inconsistent.’
WASHINGTON, July 27, 2022 – The federal government should incentivize the reporting of cyberattacks through safe harbor and shield laws, said experts at an Atlantic Council event Tuesday, as a recent law requiring companies in critical infrastructure sectors to report such attacks to the federal government is limited and currently unclear on who exactly it impacts.
The Cyber Incident Reporting for Critical Infrastructure Act passed in March does not cover private companies who do not operate in the critical infrastructure sectors and does not include safe harbor and shield laws that would encourage private companies to engage in the process.
Oftentimes, companies will avoid interacting with law enforcement to avoid the stigma associated with being a victim of a cyberattack and out of fear of being held liable by regulators and investors, said Trent Teyema, senior fellow at technology policy university collaborative GeoTech Center.
Teyema called for a safe harbor framework, a law that provides protection against legal liability when other conditions are met. Such a provision would decrease the risk of companies being held liable for cyberattacks from regulators, investors, and the public.
He also called for shield laws that would protect against revealing certain information to the government as a requirement for receiving law enforcement assistance.
The government needs to make it easy for the private sector to share information with law enforcement, said Teyema.
“Information sharing between the government and the private sector, while integral to tackling ransomware, is inconsistent,” read a report written by Teyema and David Bray, fellow at GeoTech Center. Information sharing across sectors allows cybersecurity experts in both sectors to learn about new vulnerabilities in software and new attack vectors. It strengthens collective resiliency and can influence the processes used to anticipate and respond to threats, continued the report.
Ransomware on the rise
Ransomware attacks in which bad actors demand money to release encrypted data are increasing dramatically, reported the White House last year. Ransomware incidents often disrupt critical services, such as banks, hospitals and schools that require constant access to data. In 2021, there was approximately $20 billion in damages from ransomware attacks in the United States, with $11 billion in 2020 and $5 billion the year before, said Bray.
This follows on the heels of the 2021 Colonial Pipeline hack that targeted the billing system and led to the shutdown of the largest fuel pipeline in the United States. The Russian-speaking cybercrime group responsible, DarkSide, received $4.4 million in ransom from Colonial, part of which was later recovered by the United States law enforcement.
Research firm Cybersecurity Ventures predicts that there will be a ransomware attack every two seconds by the year 2031 with global costs exceeding $265 billion.
- High Demand for Middle Mile Grants, Local Concerns in FCC Process, Musk Agrees to Buy Twitter Again
- Paul Atkinson: Why Fiber Trumps Satellite When Bridging the Digital Divide
- FCC Targets Spam Call Offenders, Disaster Assistance Requirements, U.S. 23rd in Fiber Development
- Wireless Internet Service Providers Facing Challenges Meeting BEAD Program Requirements: Experts
- Johnny Kampis: Wireless Survey Shows 5G’s Role in Closing Digital Divide
- Lack of Adequate Workforce Expected to Hamper Broadband Industry, Says Panel
Signup for Broadband Breakfast
Broadband Roundup4 weeks ago
AT&T Sues T-Mobile Over Ad, Nokia Partners with Ready, LightPath Expanding
#broadbandlive3 days ago
Broadband Breakfast on October 5, 2022 – How to Reform the Universal Service Fund
Broadband Mapping & Data3 weeks ago
Broadband Mapping Masterclass on September 27, 2022
Broadband Mapping & Data4 weeks ago
FCC’s Fabric Challenge Process Important Part of Getting Map Right, Agency Says
WISP3 weeks ago
Wisper Internet CEO Takes Issue With Federal Government Preference for Fiber
Big Tech4 weeks ago
A White House Event, Biden Administration Seeks Regulation of Big Tech
Funding4 weeks ago
NTIA Middle Mile Director Stresses Need for Infrastructure to Withstand Climate Events
Fiber4 weeks ago
In ‘Office Hours’ Sessions, NTIA Addresses Questions of Middle Mile Grant Applicants