Ransomware rises as a national security threat as bigger targets fall

Ransomware rises as a national security threat as bigger targets fall

Cybercriminals are getting more sophisticated and brazen in ransomware attacks, freezing computer systems at school districts, major universities, police departments and hospitals. Now the US government is stepping up its approach to fighting computer crimes. 

Last week, the White House convened an international counter-ransomware event. Representatives from more than 30 countries, including big US allies like the UK, Canada and Japan, participated in the virtual gathering. Notably absent: Russia, which the US and other countries blame for harboring and possibly encouraging the groups behind the attacks.

The group pledged to share information and work together to track down and prosecute the cybercriminals behind ransomware attacks. "Governments recognize the need for urgent action, common priorities, and complementary efforts to reduce the risk of ransomware," the participants said in a joint statement released at the end of the meeting.

The high-level government attention to ransomware underscores its growing reach. Once nothing more than garbage malware locking up the hard drives of the tech unsavvy or of small businesses running dated versions of Windows, ransomware has become a global digital scourge.

It also shows no sign of letting up. Over the weekend, an apparent ransomware attack locked down servers and work stations at Sinclair Broadcast Group. Data also was stolen from the TV station operator, though it's currently unclear what information it contained. The company is investigating.

Earlier this year, a major oil pipeline and a huge meat processors were hit by cybercriminals who demanded millions of dollars in ransom.  The attacks on Colonial Pipeline and JBS USA Holdings made headlines for weeks. They also marked a rise in the ambitions of cybercriminals and caught the attention of government officials and cybersecurity experts. 

"It's really become a national security threat," Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, told the Billington Cybersecurity Summit last week. "Everything is connected, everything is vulnerable, and the threat actors are just getting more sophisticated."

According to a report issued Oct. 15 by the Department of the Treasury, suspected ransomware payments reported by banks and other financial institutions totaled $590 million for the first six months of this year, easily surpassing the $416 million in suspicious payments reported for all of 2020.  

Colonial Pipeline and JBS both forked over millions in ransom payments during that six-month period. The FBI was able to recover about $2.3 million of the $4.4 million paid by Colonial. Both ransoms were paid in bitcoin, a popular cryptocurrency. 

Both attacks wreaked temporary havoc, pushing up the price of gasoline and meat as the companies lost control of their supplies.

"It's amusing to the outside world that America doesn't care until it's about oil and meat," says Chester Wisniewski, a principal research scientist for the global cybersecurity firm Sophos.

Wisniewski says earlier attacks would target a dozen or so different entities. They didn't grab the same kind of national headlines, however, because they were separate, smaller attacks.

By today's standards, cybercriminals also weren't as talented. They bought the malware online and sent it out without much research into their targets. Companies would often pay the ransom, try to keep things quiet and move on.

That started to change a few years ago. As malware became more sophisticated, cybercriminals began hacking into a company's financial records to determine exactly how much money the company would likely be able to pay. Now ransoms often reach millions of dollars.

And other attack-related costs far outweigh the actual ransom. Even if a company pays and has its data restored, it still has to bring in experts to rebuild its systems and confirm they're no longer compromised. 

On top of that, an attack usually prompts a company to upgrade its cybersecurity defenses, another cost. 

Sometimes it can be tough for an entity to know exactly how much cybersecurity it should install. Even though JBS is a big company, many experts wouldn't have previously considered it to be an obvious target for a cyberattack.

While acknowledging in a June statement that it did pay the equivalent of $11 million in ransom, JBS said it was able to "quickly resolve" the issues resulting from the attack, thanks to its "cybersecurity protocols, redundant systems and encrypted backup servers," adding that it spends $200 million annually on IT and employs more than 850 IT people around the world. The company didn't immediately return an email seeking further comment for this story.

Even small companies should follow best practices that'll lessen the chances of a cyberattack or the fallout from one, says David Cowen, managing director of US Cyber Security Services at professional-services company KPMG. And those practices can be as simple as making sure employees protect their access to systems with strong passwords and always use two-factor authentication. 

The government can help, too, he says.

"Look at what happened with Colonial Pipeline," Cowen said. "That group initially got paid but then they got tracked down and some of the money got returned. That's what happens when the government gets involved."

A recently introduced Senate bill would require critical infrastructure owners and operators, which would include companies like Colonial Pipeline, to report cyberattacks within three days.

In addition, nonprofits, businesses with more than 50 employees, and state and local governments would be required to notify the federal government within 24 hours if they make ransom payments.

Meanwhile, the Treasury Department says it'll sanction cryptocurrency exchanges, insurance companies and financial institutions that facilitate ransomware payments. It also said it was taking action against virtual currency exchange SUEX OTC for allegedly facilitating ransomware payments. Officials for SUEX couldn't be reached for comment.

Wisniewski, the cybersecurity researcher, says he likes the idea but questions how much good it'll do if the government doesn't take action against the countries behind the exchanges and financial institutions.

"Are we going to sanction China?" he asked. "I don't think so."

---

Source

Tags:

• Ransomware National Security Threat
• Ransomware Attacks On The Rise
• What Is A Ransomware
• Are Ransomware Attacks Increasing
• Ransomware Rise Every Year
• Ransomware Rise
• Ransomware Risico

Russians against ukraine war russian opinion on ukraine war articles about the war in ukraine how goes the war in ukraine amid ukraine war china threat rises war in ukraine wiki russia supplies s 400 to india amid warfare amiad water systems amidaware

Amid War in Ukraine, Should Ordinary Russians Be Banned From Trading Crypto?

Amid War in Ukraine, Should Ordinary Russians Be Banned From Trading Crypto?

This story is part of War in Ukraine, CNET's coverage of events there and of the wider effects on the world.

As Russia's war on Ukraine intensifies, the US and its allies have continued to increase their economic pressure on the Russian government, to isolate the country further from the global financial system and debilitate its military capacity. Western allies have frozen Russian assets abroad, removed Russian banks from international banking networks and even banned all gas and oil imports, among other unprecedented penalties. But there's still growing concern that Russian President Vladimir Putin and his supporters might turn to cryptocurrencies to avoid economic sanctions.

With their ability to operate as alternatives to the traditional financial system, cryptocurrency exchanges -- digital marketplaces where you can buy and trade digital currencies -- have become an effective option both for Ukraine supporters to raise funds for relief efforts and for ordinary Russians to seek financial shelter from the economic sanctions imposed on their country.

That's why both the Ukrainian government and advocates for even further economic penalties against Russia have become increasingly vocal about the role crypto exchanges can play in the conflict. Hundreds of Western businesses, such as oil companies Shell and BP and tech players Netflix and Microsoft, have scaled back or halted their dealings in Russia since the beginning of the war. And some people argue that similarly stopping crypto operations in the country could significantly weaken Putin's hold on Russia's economy and its citizens.

"I'm asking all major crypto exchanges to block addresses of Russian users," Ukraine's vice prime minister and minister of digital transformation, Mykhailo Fedorov, tweeted Feb. 28. "It's crucial to freeze not only the addresses linked to Russian and Belarusian politicians but also to sabotage ordinary users." 

Fedorov also sent letters to eight cryptocurrency exchanges, including two of the largest by volume, Coinbase and Binance, asking them to stop offering service to Russian users out of concern digital currencies are being used to evade sanctions.

The response was swift. 

"We are not preemptively banning all Russians from using Coinbase," CEO Brian Armstrong tweeted March 3. "We believe everyone deserves access to basic financial services unless the law says otherwise." And hours after getting Fedorov's letter, a Binance spokesperson told CNBC, "We are not going to unilaterally freeze millions of innocent users' accounts. Crypto is meant to provide greater financial freedom for people across the globe. To unilaterally decide to ban people's access to their crypto would fly in the face of the reason why crypto exists."

But the CEOs of several exchanges, including some that got Fedorov's letter, said that though they'll continue to offer access to ordinary Russians, they're complying with US law in regard to sanctions. On March 7, Coinbase reportedly said that to facilitate sanctions enforcement, it had blocked more than 25,000 wallet addresses related to Russian individuals or entities thought to have engaged in illicit activity and had reported them to the US government.

"Some ordinary Russians are using crypto as a lifeline now that their currency has collapsed. Many of them likely oppose what their country is doing, and a ban would hurt them, too."

Coinbase CEO Brian Armstrong

Ukraine's request for an all-out ban on Russian users, and the unequivocal rejection from most regulated crypto exchanges, has sparked a debate about the responsibilities digital currency platforms have in an international conflict. As a growing number of Western companies decide to stop conducting business in Russia, should crypto exchanges follow suit and go beyond what they're required to do by law? And even if they did, would banning all Russian users from crypto exchanges make a difference in slowing down Russia's invasion of Ukraine?

Some crypto specialists interviewed by CNET, including executives from crypto companies and public officials working to prevent Russia from using digital assets to sidestep economic sanctions, said a full Russian ban from crypto platforms could do more harm than good in regard to ordinary Russians. And some said the volume of the whole crypto market is still too small to really help Putin's government counter the impact of Western economic penalties, even if it tried.

But other experts on the role the private sector can play in global conflicts said bringing the Russian economy to a standstill is the one nonmilitary way to thwart Putin's advance on Ukraine, and that crypto exchanges can contribute to that only if they stop operating in Russia altogether. 

Cryptocurrencies are digital assets that are recorded on a blockchain, a distributed digital ledger that can't be altered. They usually aren't backed by an underlying asset, such as fiat currency. That's why they could be an ideal safe haven amid a wave of economic sanctions. 

Why crypto exchanges won't budge on Russia

In refusing to kick ordinary Russians off their platforms, cryptocurrency exchanges argue that the move would further hurt Russian citizens who are suffering from the economic impact of the war and who might consider buying cryptocurrencies as a way to protect their financial standing.

"We all saw those photos of runs on ATMs from Russian citizens -- lines around the block in Moscow," said Todd Conklin, counselor to the deputy secretary of the US Treasury Department. "One would suspect ordinary citizens may have been looking for an alternative to the ruble." Conklin made the remarks during a March 4 webinar hosted by blockchain analytics company TRM Labs about the possibility Russia could use cryptocurrencies to avoid economic sanctions. 

The ruble, Russia's national currency, has lost nearly 50% of its value against the US dollar since the start of the year, according to Reuters. Other parts of Russia's financial system have also been impacted by the West's pressure on the country to stop its aggression on Ukraine. Digital payment services such as Apple Pay, Google Pay and Samsung Pay aren't available in Russia any longer. Visa, Mastercard and PayPal also halted operations in the country. Ordinary Russian citizens, worried that economic sanctions will devastate the Russian economy even further, have flocked to ATMs and banks, seeking to withdraw as much cash as possible before it might be too late. 

"Some ordinary Russians are using crypto as a lifeline now that their currency has collapsed," Armstrong, the Coinbase CEO, tweeted. "Many of them likely oppose what their country is doing, and a ban would hurt them, too."

As long as US crypto businesses are complying with US laws in ensuring that sanctioned individuals or entities aren't using their platforms, "crypto could be a vital lifeline for ordinary Russians to preserve their savings [and] receive familial remittances," Michael Parker said in an email. Parker is a former federal prosecutor who's now head of anti-money laundering and sanctions practice at Ferrari & Associates, a Washington, DC-based law firm.

Jesse Powell, co-founder and CEO of Kraken Exchange, another crypto platform, tweeted that though he understood the rationale behind Ukraine's request to remove all Russians from crypto exchanges, Kraken "cannot freeze the accounts of our Russian clients without a legal requirement to do so." 

"I would guess that the vast majority of crypto holders on @krakenfx are anti-war," Powell tweeted. "#Bitcoin is the embodiment of libertarian values, which strongly favor individualism and human rights."

Given the anti-authority libertarian streak that fuels so much of the cryptocurrency sector, the refusal from crypto exchange executives to stop operations in Russia isn't surprising, said Yale University professor Jeffrey Sonnenfeld, who's the president of the Chief Executive Leadership Institute, a nonprofit focused on CEO leadership and corporate governance.

Crypto executives don't like "being told what to do," Sonnenfeld said. "And yet, there's a striking naivete [in] that they are working in support of [Putin], the greatest autocrat alive today, the most restricted world leader, [who] they are tacitly supporting by enabling a bypass, if it's even for the cognoscenti, for elites and for oligarchs, if it was as limited as some claim."

Sonnenfeld said that the reason more than 300 Western companies have pulled out of Russia so far isn't that the government told them to do so. "It's the maverick streak of these CEOs who pulled out and started this thundering herd," he said, "courageous CEOs who had the moral character to pull out."

What a full ban on Russia would and wouldn't do

Some specialists said that blocking all Russians from crypto would not only potentially inflict damage on millions of innocent citizens, but it would also do little to amplify the West's sanctions on Russia's economy. The reason? Russia doesn't have the digital infrastructure to tap into crypto assets at a level required to outmaneuver the economic penalties already imposed by the US and its allies.

"You can't flip a switch overnight and run a G20 economy on cryptocurrency," Conklin said during the webinar hosted by blockchain intelligence company TRM. He explained that in recent years, Russia has worked to bolster the ruble and build up its reserves, instead of laying the rails needed to support crypto. That's why US economic sanctions have been focused on preventing Russia from accessing the reserves it keeps overseas. "Big banks in an economy need real liquidity," Conklin said. "Conducting large-scale transactions in virtual currency is likely to be slow and expensive."

Anthony Citrano, founder of Los Angeles-based NFT platform Acquicent, pointed to crypto prices as a clue to what's going on. "If the Russian government really were using crypto as a major piece of their international finance strategy, you'd expect to see absolutely explosive growth in prices of major crypto [currencies]," he said, "which we have not seen. Time will tell, but for now there is zero evidence this is happening."

"If you can show [Putin] to be truly impotent over the economy, that he doesn't have control over civil society, then he and the oligarchs fall flat on their face, and that's what cryptocurrency mavericks can do."

Yale University professor Jeffrey Sonnenfeld

Former federal prosecutor Ari Redbord, who's now head of legal and government affairs at TRM, said the economic sanctions levied so far have been so "serious and so draconian in their measures" that Russia would need much more than crypto assets to counterbalance them. "We're talking about [the] potential loss of, or no access to, hundreds of billions of dollars in frozen [Russian] Central Bank assets. We're talking about $1.5 trillion in potential trade losses," he said. "The entire crypto market cap doesn't approach what ultimately Russia would need to prop up a G20 [economy] government and fight what is going to become a more and more costly war."

But that doesn't mean the Russian government or Putin's supporters won't try to use crypto to circumvent economic sanctions. "Russian actors are very adept at money laundering and have been for a long time," Redbord said. In the case of crypto, they'll be looking for "noncompliant exchanges in order to move those funds." 

Such exchanges include platforms like Suex, which was blacklisted by the Biden administration in September for allegedly helping launder ransomware payments. TRM has identified about 340 exchanges that are either in Russia or Russia-related and don't have compliance controls in place, "and that is where illicit actors will look to move on as on-ramps and off-ramps for crypto," Redbord said.

Those digital platforms are already operating outside the law, though. For any US business, including businesses in the crypto industry, "there is still a full compliance obligation to not deal with sanctioned parties or interests in blocked property," said Parker, from Ferrari & Associates. "US crypto businesses must, and largely do, institute robust compliance programs, including advanced analytics software, to ensure legal compliance with US sanctions."

Bringing Russia to a standstill

Yale's Sonnenfeld argues that it's beside the point whether Putin and his supporters can actually get their hands on enough digital assets to offset the impact of Western sanctions. He said that by halting all operations in Russia, crypto exchanges could contribute to putting even more pressure on Putin's government, until it reaches a tipping point.

"Government-ordered sanctions have limits," Sonnenfeld said, even if they're a coordinated effort between multiple international actors, including the US, the EU, the UK, Australia, Japan and the UN. "They work best when voluntary efforts of the private sector rally."

That's what happened in South Africa in the late 1980s, Sonnenfeld said, when international pressure contributed to putting an end to apartheid, a system of institutionalized racial segregation that had ruled the country for more than 40 years. Economic sanctions imposed by the US government had an effect only when dozens of major private companies joined in. "It brought civil society to a stop/standstill," he said.

Sonnenfeld and his research team at Yale compiled a list of companies that continued operating in Russia following its invasion of Ukraine. After the publication of a Washington Post story that mentioned that McDonald's and Starbucks were on the list, both chains announced plans to stop operating in Russia. Since the list was created and made public, it now shows "over 330 companies [that] have announced their withdrawal from Russia in protest" of the Ukraine war.

For Sonnenfeld, paralyzing Russia's economy is the only nonmilitary option the West has against Putin's advances on Ukraine.

"The humanitarian thing to do is to not go with bombs and bullets, and to strangle civil society" and dissolve Putin's image of being a totalitarian with full control over all sectors, he said. "If you can show him to be truly impotent over the economy, that he doesn't have control over civil society, then he and the oligarchs fall flat on their face, and that's what cryptocurrency mavericks can do" should they decide to halt operations in Russia. "They can be really helpful here." 

Allowing ordinary Russians to have access to digital assets through crypto exchanges is "not doing anything humanitarian," Sonnenfeld said. "People should be thrown out of work, they should be out on the street" due to an economic collapse brought on by government-ordered sanctions and to private companies denying Russian citizens access to services, goods and money. "Is that cruel?" Sonnenfeld said. "No, it is better than shooting them, than bombing them -- and that's the stage we're at right now."

---

Source

As russia s cyberattacks on ukraine mount the risk of loss as russia s cyberattacks on ukraine mount the efi as russia s cyberattacks on ukraine mount the horse as russia s cyberattacks on ukraine history as russia s cyberattacks on ukraine many russians as russia s cyberattacks on the rise as russia s cyberattacks on healthcare who followed gorbachev as russian president as russia digs in as russia stalls

As Russia's Cyberattacks on Ukraine Mount, the Risk of Impact in Other Countries Rises

---

As Russia's Cyberattacks on Ukraine Mount, the Risk of Impact in Other Countries Rises

This story is part of War in Ukraine, CNET's coverage of events there and of the wider effects on the world.

Russia could ramp up cyberattacks against Ukraine in an effort to destabilize its government and economy, security experts warn, an online assault that potentially might spread to other countries, including the US.

In recent weeks, the Russian government is believed to have initiated a handful of cyberattacks against Ukraine. Last month, hacker groups linked to Russia's intelligence services were blamed for a cyberattack that defaced dozens of Ukrainian government sites with a message warning the country to "be afraid and expect the worst." 

Days later, Microsoft said it had identified dozens of computer networks at Ukrainian government agencies and organizations infected with destructive malware disguised as ransomware. On Feb. 16, the New York Police Department warned that Russian or pro-Russian criminal threat actors could launch cyberattacks on infrastructure, government entities, and local law enforcement according to CBS News.  

Cybersecurity experts say the attacks could be a precursor to more serious cyberassaults on Ukraine, which Russia is determined to prevent from joining the NATO security alliance. Russia has amassed more than 100,000 troops on Ukraine's border, raising concerns Moscow may be preparing for an invasion of its neighbor. Russia annexed a portion of Ukraine in 2014.

The Russian troop buildup has prompted a flurry of diplomatic activity aimed at defusing tension. So far, those efforts haven't been successful. US intelligence officials said in early February that they had evidence that Russia was planning to create a video that will depict a fake attack on its troops that could be used as a pretext to invade Ukraine. Days later, President Joe Biden urged Americans in Ukraine to leave rather than risk getting caught in a potential invasion.

If Russia does invade, it will undoubtedly employ more cyberattacks as part of its military strategy, researchers say.

Adam Meyers, senior vice president of intelligence at CrowdStrike, says the current round of cyberattacks on Ukraine could indicate Russia is refining its cyber capabilities. Russia's game plan with online attacks, he says, is to create chaos and inflame tensions between the two countries.

"From what we've seen in Ukraine historically, it's almost been a laboratory of experimentation for Russia," Meyers said.

He pointed to the NotPetya attack, which crippled computers across Ukraine in 2017. The malware locked up files like criminal ransomware would. When experts took a closer look, however, they realized that its true purpose was to destroy data rather than make money.

NotPetya did what it was intended to do -- wreak havoc in Ukraine. It also spread to unintended targets far outside of that country, shutting down companies including FedEx, Merck, Cadbury and AP Moller-Maersk.

The most recent malware attacks against Ukrainian targets, dubbed WhisperGate, also appear to be bent on destruction rather than making money, Meyers said.

Of course, cyberattacks will only be part of a broader campaign if Russia chooses to invade Ukraine, with malware and online disinformation being among the many weapons the country could use.

Quentin Hodgson, a senior international and defense researcher at the Rand Corporation focusing on cybersecurity, said Russia's cyberoperations are unique because they aren't clearly separated from conventional military and intelligence operations as they are in other countries, including the US.

Still, Russia will likely lean on old-school military muscle to grab the attention of the Ukrainian people, he says

"At the end of the day, they're still massing troops on the border," Hodgson said. "That's sending a signal that cyber can't."

According to a memo obtained by CNN in January, the Department of Homeland Security warned operators of US critical infrastructure, along with state and local governments, that Russia could launch a cyberattack on US targets if it feels its long-term security is threatened by a NATO or US response to what's going on in Ukraine.

CrowdStrike's Meyers said he thinks it's unlikely Russia would intentionally provoke the US with a state-sponsored attack against an American target. But US companies with a presence in Ukraine, such as hotel chains, along with international aid groups and think tanks, might have something to worry about. 

Russia also could just look the other way, as it has for many years, when the cybercrime gangs known to run rampant within its borders go after US targets.

While Russian government arrests of known ransomware gang members and other cybercriminals have grabbed headlines recently, President Vladimir Putin hasn't historically been much help in bringing cybercriminals that target the West to justice, says James Turgal, former executive assistant director for the FBI's information and technology branch.

Turgal, who now serves as vice president of cyber risk, strategy and board relations for Optiv Security, says last year's ransomware attacks against Colonial Pipeline and meat processor JBS USA should serve as wakeup calls to all companies, especially those that can be considered critical infrastructure. Both those attacks were attributed to cybercriminals in Russia.

The NotPetya attack was a perfect example of how cyberattacks can affect countries far away from the conflict, he said.

"Whether it's intentional or not, whether you're a particular target or just collateral damage," Turgal said, "the threat is real."

---

Source

Eero’s Network Protection Service Just Got Way Better

Eero guest network security eero pro malware protection eero plus network security iot devices eero wifi system security eero for service providers eero network security key what is an eero network eero network eero saarinen chair eero saarinen buildings

Eero's network protection service just got way better

Eero's network protection service just got way better

Got an Eero Wi-Fi system? You can now protect your smart devices from the worst of the internet with an enhanced version of Eero's new subscription service, Eero Plus.

The update is designed to protect you from malware, viruses, ads and tracking. It includes VPN service from encrypt.me, anti-malware protection from Malwarebytes, a password manager from 1Password and ad blocking.

Read more:  Wi-Fi 6: Better, faster internet is coming this year -- here's everything you need to know   

Eero Plus launched earlier this year as an optional premium subscription service along with the second generation Eero Wi-Fi system. It only featured enhanced parental controls and advanced security against malware, ransomware and phishing attacks. 

The new, updated service still costs $10 per month or $99 per year, and current Eero Plus subscribers will automatically receive the upgrade.

With a subscription to Eero Plus, your devices will now be protected from malware, ads and hackers.

Josh Miller/CNET

Encrypt.me: A Virtual Private Network (VPN) service. It gives you a private internet connection that you can access at home, on public Wi-Fi or on your mobile network. All data transferred to and from your devices over a VPN will be encrypted and inaccessible to hackers.

Malwarebytes: Keeps you safe when browsing by blocking malicious sites and other attacks with anti-virus and anti-malware protection. 

1Password: Gives you a personal online vault to store and share your complex passwords without having to remember all of them. 

Ad blocking: This feature is in beta and is supposed to (you guessed it) block ads and pop-ups, while improving load times for ad-heavy sites. I'm skeptical, but Eero also says it works on every device -- even TVs and other smart devices. You'll be able to turn it on and off via the app.

Eero says these services (along with advanced browsing protection and content filtering at $99 per year), cost $368 per year if you buy them individually. But I found that encrypt.me is $100 per year, Malwarebytes is $40 per year and 1Password is $60 per year, a total of only $299 for single user licenses. Eero gives you multi-user licenses for some of those services, so if you don't need those extra licenses, the deal isn't as sweet as they say it is.

Either way, the Eero Plus service is $99 per year. So you'll save money on the deal, just maybe not as much as Eero claims.

Please note that ad blocking is the only feature available right now, and it's still in beta. You'll have to wait until December to use encrypt.me, Malwarebytes and 1Password.

CNET Smart Home : We transformed a real house into a test lab for the hottest category in tech.

Tech Enabled : CNET chronicles tech's role in providing new kinds of accessibility.

---

Source