Critical Infrastructure Security , Cyberwarfare / Nation-state attacks , Fraud Management & Cybercrime

Argentina and Others Suffer Power Outages; System Maintenance Disrupts Target(euroinfosec) • June 17, 2019    A Target store in Richmond, Texas (Photo: Target)

Not all that crashes has been hacked. To wit, this past weekend there were multiple major outages. But none were due to cyberattacks.

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

On Sunday at 7 a.m. local time, a massive power outage hit Argentina, leaving much of the country in the dark and disrupting train, traffic lights and water supplies, local media reported. Some other countries - including Uruguay, Paraguay and some cities in Chile - were also affected.

Also this past weekend, U.S. retailer Target suffered separate outages that left customers unable to pay for anything.

Dark in Argentina

The power outages in Argentina occurred just prior to local elections being held in many parts of the country. Suspicious, right? But not as suspicious as what experts say is the country's aging power infrastructure.

Indeed, Argentina's Clarín newspaper reports that the Argentinian government has blamed the "gigantic" outage on the country's electric power interconnection systems collapsing due to coastal storms. Officials also noted that the rolling blackouts had taken out not just Argentina, but large parts of Uruguay. Apparently, that's also what took out parts of Paraguay and Chile.

For the record, local elections in Argentina went ahead - even if the lights weren't on - and electricity was restored to many parts of the country by late afternoon.

Target Back Online After Outage

Also this past weekend, Target suffered twin outages, neither of which trace to a hack attack. On Saturday, customers were unable to buy any goods in stores or online as a result of an outage caused by what Target blamed on "an internal technology issue" that lasted about two hours.

"Our technology team worked quickly to identify and fix the issue, and we apologize for the inconvenience and frustration this caused for our guests," a Target spokesman said. "After an initial but thorough review, we can confirm that this was not a data breach or security-related issue, and no guest information was compromised at any time."

In a separate incident on Sunday, customers couldn't use their payment cards in some stores for a couple of hours. Target blamed that failure on the outage of a data center run by NCR, which Target uses to process payments.

NCR didn't immediately respond to a request for comment.

"We can confirm that this was not a security-related issue and no payment information was compromised," a Target spokeswoman told the Wall Street Journal.

Don't Bet on Hacking

What the Target and power outage episodes have in common is that none appear to have been caused by hackers.

But as with any outage, it appears that some commentators didn't hesitate to suggest that for the power grid outage at least, hackers might have been at work.

"There are some very irresponsible people with very large audiences claiming the electric grid outages in South America are a cyberattack with zero expertise or insight into the subject or case," said industrial control system expert Robert M. Lee, CEO of Dragos, via Twitter. "Please ignore these people as always."

As the security expert known as The Grugq tweeted, squirrels remain a much more likely explanation for any power outage than hackers.

Indeed, statistically speaking, not just squirrels, but also birds, snakes and even monkeys - not to mention human error - are much more likely causes of outages than any type of cyberattack (see: US Navy Collisions: Don't Bet on Hacking).

Power Grids: Good News

Cause of known disruptions as of Jan. 21 (Source: Cyber Squirrel 1)

The good news about power grids, security experts have long told me, is that they're so heterogeneous - and often filled with equipment of drastically different ages - that crashing a country's entire electric grid would likely be incredibly difficult (see: How Triton Malware Targets Industrial Control Systems).

There's no one piece of malware that could accomplish the task. Instead, malware would have to be customized for each unique environment, and likely built using a physical recreation of every different target environment.

Given the myriad power providers across any given geographic region, knocking any country off the grid, using malware, likely remains a very difficult task (see: Xenotime Group Sets Sights on Electrical Power Plants).

Now for the Bad News

But what has reportedly lately been hacked - as in infiltrated, but not crashed - are power networks in Russia, by U.S. Cyber Command, which is the arm of the Pentagon that handles online offensive and defensive hacking operations, The New York Times reported on Saturday.

Following President Donald Trump issuing the still-classified National Security Presidential Memoranda 13 last summer, U.S. Cyber Command has been placing "implants" - pieces of software that can be used to eavesdrop or crash equipment - across the systems that run Russia's power grid, among other targets, the Times reports. While such surveillance has been underway since 2012, it reports, the recent moves represent an escalation in U.S. tactics.

Gen. Paul M. Nakasone, who heads U.S. Cyber Command, last August used his agency's expanded powers to authorize a hacking campaign that crashed the computer systems at Russia's Internet Research Agency, as one of four offensive campaigns timed around the midterm elections, the Times reported. Public details about any of those efforts, however, remain scant (see: Before Elections, US Cut Russian Trolls' Internet Access).

Lt. Gen. Paul Nakasone appeared on March 1, 2018, before the Senate Armed Forces Committee, as part of his successful nomination by President Trump to serve as the director of the National Security Agency as well as U.S. Cyber Command. (Source: C-SPAN)

The latest moves are reportedly meant to serve as a warning to Russia over its hacking efforts, including its attempts to influence elections as well as conduct offensive espionage operations, such as attempting to steal nuclear power research from Westinghouse Electric Corp. in Pennsylvania (see: Dutch and British Governments Slam Russia for Cyberattacks).

Last July, meanwhile, the U.S. Department of Homeland Security warned that a Russian attack group known as Energetic Bear or Dragonfly, aka APT28, had amassed "hundreds of victims" as part of an ongoing campaign to infiltrate U.S. power companies, The Wall Street Journal reported.

Artificial Intelligence & Machine Learning , DevSecOps , Endpoint Security

London Conference Tackles Data Breaches, Machine Learning, Cybercrime and More(euroinfosec) • June 18, 2019    

June means it's time for the annual Infosecurity Europe conference, and as in recent years, the 2019 edition of the conference earlier this month returned to London.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

Visitors flocked to West London to catch keynotes covering data breaches, darknets, new regulations and more, and exhibitors displaying wares ranging from data breach and insider threat prevention tools to threat intelligence feeds and penetration testing services, among many other areas. Beyond the cybersecurity guidance and briefing, tchotchkes were also dispensed aplenty.

Here are visual highlights from this year's conference.

Attendees Galore

Organizers estimated that more than 19,500 individuals attended this year's conference. Entry was free, provided you registered in advance.

Packed Exhibition Hall

Located on Hammersmith Road in London's West Kensington neighborhood, the Olympia exhibition center was built in 1886 and originally known as the National Agricultural Hall. For this year's Infosecurity Europe, more than 400 exhibitors set up shop in the Olympia for the three-day event.

Full Side Hall

As with last year, the conference has gotten so large that it expanded into a side hall attached to the main Olympia hall.

Keynotes, Workshops, Geek Street and More

Attendees had more than 240 sessions from which to choose, spanning keynotes, a Cyber Innovation Showcase, an "immersive zone" called Geek Street and more (see: 11 Hot Sessions: Infosecurity Europe 2019).

Live From the Keynote Stage

Maersk CTO and CIO Adam Banks

This year's conference featured dozens of keynotes, ranging from Maersk CTO and CIO Adam Banks talking NotPetya cleanup, to "Have I Been Pwned?" founder Troy Hunt on the nonstop rise of breaches, to cybercrime expert Jamie Bartlett on how darknet markets are evolving, to a panel of CISOs on dealing with the latest regulations, including the EU's General Data Protection Regulation.

Unlike last year, when some keynotes were held at an Olympia facility located next door to the main venue, this year's Infosecurity Europe managed to replicate the keynote stage of years past on the upper floor, albeit with better seating and layout.

Interviews Galore

Chester Wisniewski, principal research scientist, Sophos

At this year's Infosecurity Europe, my colleague Nick Holland and I conducted dozens of video interviews with leading information security experts.

See ISMG's Infosecurity Europe Conference highlights to review all of our video interviews, including with Infosecurity Hall of Fame inductees Troy Hunt and Brian Honan, as well as experts from numerous firms, including Akamai, Avast, Contrast Security, Cymulate, Egress, Expanse, Kaspersky, MetaCompliance, Sophos, ZeroFOX and many more.

Cybersecurity: Hot Topics

ISMG's Nick Holland prepares to interview Senseon's David Atkinson

Based on the sessions I attended and conversations we had with information security professionals at Infosecurity Europe, what's hot in 2019?

Start with authentication, identity management and privileged account management, as well as digital transformation and application security, including DevSecOps, among numerous other topics. From a threat standpoint, meanwhile, don't forget phishing attacks, business email compromise and other forms of social engineering, or data breaches, cybercrime and malicious insiders.

And when it comes to battling attacks and trying to keep track of it all, also don't forget the increasing use of machine learning to help. Just don't call it artificial intelligence.

Machine Learning Gets More Nuanced

Indeed, many of the security experts and vendors I spoke with at the conference had a clear message for the industry, as for example encapsulated here by John Matthews, CIO of ExtraHop: "Stop calling machine learning AI!"

Security experts have long been optimistic about the impact that ML can have. Retired RSA Chairman Art Coviello told me at last year's RSA conference in San Francisco that ML was fast proving a natural fit for improving endpoint security tools. But its application has continued to grow, as have the nuances underpinning discussions about the approach, which today are much less about ML for ML's sake, and much more about what it's supporting - typically, crunching larger and larger data sets to spot anomalies or unusual behavior so more automated controls can clamp down.

As Tony Pepper, CEO of Egress told me: "Too many businesses talk about machine learning like it's all things to all men, but in reality, machine learning isn't the thing that's really neat and sexy, actually - it's how you're using machine learning to solve real business problems."

British Businesses Exposed

Tod Beardsley, director of research, Rapid7

While at the conference, I also sat down with Tod Beardsley, director of research at Rapid7, which recently scanned the internet to identify the services and servers being exposed by Britain's biggest publicly traded firms (see: Cyberattack Risk: Scans Find Big Businesses Exposed).

"The bright spot ... is that corporate U.K. has done a pretty great job of getting rid of SMB and telnet," Beardsley told me in a podcast interview. That's good news, because it means big British businesses have dramatically reduced their attack surface in the wake of WannaCry.

But these organizations are still getting hacked. "We do see attack traffic emanating from the FTSE 250," he said, referring to the biggest firms that are publicly traded on London Stock Exchange.

Networking Opportunities

With nearly 20,000 attendees, this year's Infosecurity Europe left plenty of opportunities not just for browsing the latest technology and services, keynotes and "tech talks," but also networking.

May the Booth Fun Be With You

This year's conference offered numerous opportunities to collect bounteous amounts of swag - glowing bouncy balls, light sabers, keychains and more. Also on offer: taking selfies with iconic "dark side" Star Wars characters, playing security-themed video games, getting your caricature drawn or just trouncing friends in a bout of air hockey.

Save the Date

As with years past, this year's conference flew by. Don't blink: The next Infosecurity Europe has already been scheduled to run from June 2 to 4, 2020. Catch you there?

Photographs by Mathew Schwartz