Cybercrime , DDoS , Fraud Management & Cybercrime

Hacktivist Martin Gottesfeld Also Ordered to Pay Restitution(HealthInfoSec) • January 11, 2019    

A hacktivist who launched distributed denial-of-service attacks on Boston Children's Hospital and another local facility in 2014 has been sentenced to 10 years in federal prison and ordered to pay nearly $443,000 in restitution.

See Also: Key Drivers to Enable Digital Transformation in Financial Services

Martin Gottesfeld, a 34-year-old biotech professional from Somerville, Massachusetts, was sentenced Thursday in the U.S. District Court in Boston on two counts of conspiracy and two counts of intentionally damaging protected computers, according to court records. He was convicted in August by a federal jury.

The massive DDoS attack that Gottesfeld launched in protest of a controversial child custody case involving Boston Children's Hospital and the Wayside Youth and Family Support Network in Framingham, Massachusetts, disrupted the hospital's network for at least two weeks and hampered internet connectivity of other area hospitals.

Prosecutors say the attack disrupted the children's hospital's day-to-day operations, as well as its research capabilities. The attack cost the hospital more than $300,000 and caused an additional estimated $300,000 loss in donations because the attack disabled the hospital's fundraising portal.

The attack also caused Wayside to spend $18,000 on response and mitigation efforts, prosecutors say.

Hacktivism

Prosecutors alleged that Gottesfeld identified himself as a member of the hacktivist group Anonymous and launched the attacks on behalf of the group, demanding changes in the way Boston Children's Hospital was handling a custody situation involving teenager Justina Pelletier. Pelletier's Connecticut parents had lost custody of their daughter to the commonwealth of Massachusetts over allegations by the hospital that her parents medically abused the girl.

But even some individuals associated with Anonymous were not keen on the attacks. An April 25, 2014, Twitter message apparently posted an Anonymous news group known as @YourAnonNews, says: "To all Anons attacking Children's Hospital in the name of Anonymous ... It's a hospital, stop it."

The Department of Justice, in a statement following Gottesfeld's conviction, said the hacktivist "unleashed a DDoS attack that directed so much hostile traffic at the Children's Hospital computer network that he not only knocked Boston Children's Hospital off the internet, but knocked several other hospitals in the [Boston] Longwood Medical Area off the internet as well."

The attack flooded 65,000 IP addresses used by Boston Children's Hospital and several other area hospitals with "junk data" intended to make those computers unavailable for legitimate communications, the justice department charged.

Botched Getaway

In October 2014, federal law enforcement officials searched Gottesfeld's home and recovered computers, servers and hard drives. Gottesfeld, however, was not formally charged with a crime at the time the search warrant was executed.

But in an odd turn in the case, Gottesfeld was arrested in February 2016 after he was found in a small boat off the coast of Cuba.

Gottesfeld and his wife made a distress call after their boat ran into trouble (see: DDoS Suspect Arrested After Rescue at Sea). A nearby Disney cruise ship responded to the distress call and rescued the couple. The ship returned to Miami, where Gottesfeld was then arrested.

'Contemptible, Invidious and Loathsome'

Gottesfeld's apparent lack of remorse about the attacks drew scathing remarks from U.S. District Judge Nathaniel Gorton, who called his crimes "contemptible, invidious and loathsome," according to the Washington Post.

Gottesfeld has filed a notice of appeal with the court.

Hefty sentencing against hackers - as well as media attention about those sentences get - can potentially have a limited positive impact on crime deterrence, says Larry Whiteside, CISO at Greenway Health, a provider of cloud-based electronic health records and other software. In 2017, the company suffered a ransomware attack that disrupted several hundred of the company's clients (see: Doctors Regain EHR Access After Ransomware Targets Vendor).

The outcomes of cybercriminal cases need to get publicized as widely as the crimes themselves, Whiteside contends. "A lot gets publicized as far as the breaches, but the follow up of accountability when the attacker gets found and sentenced - those things don't get the same level press notoriety," he says. "From the standpoint of accountability, that type of press, those types of sentences and fines are going to stop nuisance hackers - the individuals and small criminals that are doing things out of opportunity."

But tough sentence for cybercrimes likely won't deter nation-state sponsored attackers or larger organized assaults, he argues.

A Boston Children's Hospital spokeswoman tells Information Security Media Group: "We believe the verdict and the sentence are appropriate." And a Wayside Youth and Family Support Network spokeswoman added: "We are pleased that the matter is now resolved."

Attempts by ISMG to reach an attorney representing Gottesfeld for comment about the sentencing were unsuccessful. Several attorneys who defended the hacktivist in earlier stages of the criminal case are no longer representing Gottesfeld.

A Department of Justice spokesperson said the agency could not comment on the sentencing due to partial federal government shutdown. "With the shutdown, we are prohibited from making any statements or putting out any kind of release," the spokesperson said. "My apologies, but we will have to let the sentence speak for itself."

Anti-Phishing, DMARC , Awareness & Training , Data Breach

Chinese Hackers Stole From Indian Unit of Italian Firm(gsuparna) • January 11, 2019    

In a case of business email compromise, Chinese hackers stole $18.6 million from the Indian arm of Tecnimont SpA, an Italian engineering company, through an elaborate cyber fraud scheme that included impersonating the firm's chief executive, the Economic Times reports.

See Also: Live Webinar | Sunset of Windows Server 2008: Migrate with Docker

The scammers sent emails requesting funds to the India head of Tecnimont, part of the publicly traded Maire Tecnimont, from an account that looked deceptively similar to one used by the Italian group's CEO, and also organized conference calls to discuss a "confidential" acquisition in China, the ET report said. The company has filed a complaint with Indian police.

The incident highlights the lack of awareness of business email compromise attacks, especially in the manufacturing sector.

"I am surprised that India head of an Italian subsidiary could be duped of such a huge amount. How could he trust only email and conference call and not have a direct call with the CEO of the company?" asks Shashank Kumar, security researcher at Binary.com, an online trading platform.

But defending against sophisticated BEC scams can be more difficult than spotting a phishing email, security experts note. "My advice would be have a direct face-to-face meeting or call while going forward with such requests [for funds], no matter how urgent the request seems," Kumar says.

Modus Operandi

According to the report in Economic Times, after sending emails to head of Indian subsidiary of the Milan-headquartered firm, hackers then arranged a series of conference calls to discuss a confidential acquisition in China. People pretending to be the group CEO, a top Switzerland-based lawyer and other senior executives of the company, were part of this call, according to the report.

The hackers requested that the India head transfer the money for an acquisition in China, convincing him that the money couldn't be transferred from Italy due to regulatory issues. He then transferred the amount in three batches during one week in November. The money that was transferred - $5.6 million, $9.4 million and $3.6 million - from India to banks in Hong Kong and withdrawn within minutes.

The scam came to light when Tecnimont SpA chairman Franco Ghiringhelli visited India, according to the news report.

The company has sacked the India chief and the head of accounts and finance, according to the company's complaint filed with the Mumbai cyber police.

Battling the Threat

BEC can be difficult to spot. For example, tools such as DMARC, Domain Message Authentication Reporting and Conformance, and SPF, Sender Policy Framework, only work when emails are sent from the same domain name.

"DMARC is a lot about business email compromise, spoofing of email etc, but it works only if hackers are spoofing on your domain. In such cases, SPF policies and DMARC will work and stop you from getting conned," says Shomiron Das Gupta, founder and CEO at Netmonastery, a SIEM security and event log management firm. "But if the email is coming from similar looking domain [as in this case], then it becomes tough as tools like DMARC won't work."

In BEC attacks, the fake message often comes from a legitimate email account that an attacker has gained access to, either through social engineering or a targeted compromise. The usual targets are high-level executives or others who have some financial authority in a given organization.

Between December 2017 and May 2018, BEC campaigns caused more than $12.5 billion in actual and attempted losses around the world, including $2.9 billion in the U.S., according to new statistics from the FBI's Internet Crime Complaint Center (IC3).

An Earlier Scam

In an earlier BEC case in India, an organization working on a large project with a client in Canada was scammed in 2015.

"Since they were old partners, invoices were usually cleared within one month of delivery. However, in this particular case, an invoice of $ 1.5 million was not cleared in the stipulated time," says Tarun Wig, senior consultant at AuthShield, a company in the authentication space, said in an interview with Information Security Media Group.

"On reminding the client, they were informed that the invoice had been cleared almost 15 days prior. On investigating, it was found that one of their accounts had been hacked; the hacker had sent mails requesting a change in bank accounts and communicated with the client on the matter."

David Stubley, CEO at 7 Elements, a security testing firm, says use of multifactor authentication is an important step in the battle against the BEC threat.

"But certainly if there is a compromise, the more auditing you've got, the more alerting you've got and the more blocks you have in place, you're going to frustrate the attacker and you're going to give yourself the opportunity to see it occurring and therefore stop it before the worst-case scenario, which is money being paid out of the business," he tells ISMG.

Another important strategy is to leverage brand monitoring. "Here you emulate similar looking domains, similar sounding domains and go block those domains," Das Gupta explains. "But manufacturing companies generally have lower level of awareness, and the problem is most of them don't want to learn these new techniques."

Companies in all sectors also need to educate their employees about how BEC scams work so they can identify warning signs. "All technologies in place will only be effective when employees are cyber aware," says Prashant Mali, a Bombay high court lawyer.

Rakesh Goyal, a CERT-In certified auditor, says that in addition to always using two-factor authentication to verify the identity of those sending messages, for money transfer requests, recipients should ask for related documents using known emails, SMS, fax or secure/encrypted social media modes, such as WhatsApp - or via a personal visit.

General Data Protection Regulation (GDPR) , Governance , Legislation & Litigation

European Court of Justice Gets Non-Binding Legal Opinion From Advocate General(euroinfosec) • January 11, 2019    

Europe's "right to be forgotten" should not apply worldwide, but only inside the EU.

See Also: Live Webinar | Sunset of Windows Server 2008: Migrate with Docker

So said an advocate general for the European Court of Justice, the EU's highest court, on Thursday in a case involving Google and France's data protection authority CNIL - the Commission nationale de l'information et des libertés.

Last year, CNIL argued before a 15-judge panel that the so-called right to be forgotten should apply worldwide. Its view is backed by both the French and Austrian governments (see: Google and EU Fight France Over 'Right to Be Forgotten').

But others, including Google as well as the European Commission - the EU's politically independent executive arm - argued that the right to be forgotten should only apply within the 28 member states within the EU.

On Thursday, Advocate General Maciej Szpunar issued an opinion that the relevant European law does not address extraterritoriality, and thus he was not in favor of extending the right to be forgotten worldwide, except in exceptional cases.

"He therefore takes the view that a distinction must be made depending on the location from which the search is performed," the ECJ says in a press release summarizing Szpunar's opinion.

"Thus, search requests made outside the EU should not be affected by the dereferencing of the search results," it says. "He is therefore not in favor of giving the provisions of EU law such a broad interpretation that they would have effects beyond the borders of the 28 [EU] member states."

Opinion is Non-Binding on Court

Szpunar is one of 11 advocates general who serve on the ECJ. Their job is to issue a preliminary opinion in a case, which is not binding on the court. "It is the role of the advocates general to propose to the court, in complete independence, a legal solution to the cases for which they are responsible," the ECJ says. "The judges of the court are now beginning their deliberations in this case. Judgment will be given at a later date."

The opinion comes as part of the "scope of 'right to be forgotten' being defined," says Stewart Room, head of consultancy PwC's GDPR practice, in a blog post. "[The] interim position of EU court is that Google should apply [it] only in EU."

Google didn't immediately respond to a request for comment on the advocate general's opinion.

The Right to Erasure

Europe's right to be forgotten - aka "right to erasure" or delisting - predates the EU's General Data Protection Regulation, which went into full effect in May 2018. But GDPR further enshrines those rights under article 17, which states that in certain cases, "the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay."

When Europe created the right to be forgotten, however, it did not detail how exactly it should be implemented. That has led to ongoing negotiations - and legal disagreements - between data controllers, including search engine operators, and EU member states' data protection authorities over the threshold for when delisting should occur, balanced with a public right to access knowledge.

In May 2015, the president of France's CNIL served a formal notice to Google stating that when it approved a "right to be forgotten" request to delist a link, it should remove links to the information from all of its website domain extensions worldwide.

Google refused to comply with that request, although did later propose to implement geo-blocking requests that would remove links not only from its European website domains, but also prevent anyone who appeared to be located inside from Europe from accessing the delisted links from any Google site.

CNIL said that approach was insufficient, and on March 10, 2016, imposed a fine of €100,000 ($115,000) on Google.

Google contested the fine, arguing that it should be dismissed, and in August 2017, asked the European Court of Justice to rule on the matter.

Opinion Backs Google's Approach

The Thursday advocate general opinion follows testimony before the ECJ last September by Google, the EC, CNIL and others, including privacy rights groups.

The advocate general says that "the fundamental right to be forgotten must be balanced against other fundamental rights, such as the right to data protection and the right to privacy, as well as the legitimate public interest in accessing the information sought," the ECJ says.

"He therefore proposes that the court should hold that the search engine operator is not required, when acceding to a request for dereferencing, to carry out that dereferencing on all the domain names of its search engine in such a way that the links in question no longer appear, irrespective of the location from which the search on the basis of the requesting party's name is performed."

But the advocate general wants to see the controls put in place by Google continue, including its practice of using multiple means to restrict access from inside the EU to any de-listed results.

"Once a right to dereferencing within the EU has been established, the search engine operator must take every measure available to it to ensure full and effective dereferencing within the EU, including by use of the 'geo-blocking' technique, in respect of an IP address deemed to be located in one of the member states, irrespective of the domain name used by the internet user who performs the search," the ECJ says of the advocate general's opinion.

Delisting requests sent to Google from Jan. 22, 2016, through Jan. 11, 2019

Google says that under the right to be forgotten, so far it has received 762,315 requests that have collectively asked it to "delist" 2.9 million URLs. It says 89 percent of requests have come from individuals, rather than on behalf of organizations.

Breach Preparedness , Critical Infrastructure Security , Cyberwarfare / Nation-state attacks

Readiness, Morale, Investigations and Recruitment at Risk as Standoff Persists(jeremy_kirk) • January 11, 2019    

There's a stark message on the front page of the U.S. National Institute of Standards and Technology's website: "NOTICE: Due to a lapse in federal funding, most of this website is not available."

See Also: Live Webinar | Sunset of Windows Server 2008: Migrate with Docker

The warning points to the continuing standoff between President Donald Trump and Congress over the $5.7 billion he wants to fund a fortified border wall with Mexico.

Trump says he won't sign a spending bill for fiscal 2019 that would reopen the government that lacks the funding he wants for the wall. Building the wall was one of his key campaign promises that attracted voters worried about illegal immigration.

The government shutdown, which started on Dec. 21, 2018, is affecting as many as 800,000 federal workers, some of whom are continuing to work without pay. With the Democrats in control of the House of Representatives and neither party showing signs of budging, it's unclear how the standoff will be resolved.

The shutdown is affecting agencies that have a key hand in the nation's cybersecurity readiness, such as the Department of Homeland Security. That is generating anxiety over whether it could impact the U.S.'s defenses and whether opportunistic adversaries may seize the moment.

"I am not sleeping well," says Tom Kellermann, chief cybersecurity officer for the vendor Carbon Black. "The U.S. is under siege by Chinese, Russian and North Korean cyber spies, and now we do not have sufficient watchers on the wall. We have never been this vulnerable to asymmetrical warfare."

Kellermann says that when the government returns to normal, the "first order of business will be to immediately conduct compromise assessments and suppress the adversaries who have infiltrated government systems."

NIST: We're Mostly Closed

Prior to the lapse in funding, the Commerce Department published a comprehensive document detailing how agencies would be pared down.

And while much has been cut back, vital cybersecurity functions - including defending networks and cooperating with the private sector to investigate intrusions - are continuing, says Michael Daniel, CEO of the Cyber Threat Alliance.

But the longer the shutdown continues, the more impact it will have, says Daniel, who served as White House cybersecurity coordinator between 2012 and 2017.

"Like so many areas across the government, over time a shutdown will steadily erode the federal government's cybersecurity readiness," he says.

One of the most affected agencies is NIST, the U.S. government's science laboratory that develops specification and standards for everything from cryptography to microbial systems to quantum electromagnetics. Much of its staff has been furloughed, and its website has been mostly shut down.

NIST's website is mostly disabled.

NIST's guidelines on computer security are used within the U.S. but the agency's advice is respected and followed worldwide. The shutdown means that work on that kind of guidance will be delayed.

"New policy work is essentially frozen, so needed changes or updates to existing policies will not occur, nor will the government develop policies to address new areas," Daniel says.

Chris Morales, head of security analytics at Vectra, says it's understandable much of NIST would be subject to closure because it's primarily a research and publication institute. Morales says it might be concerning that some individuals couldn't reach the organization's Cybersecurity Framework, but that document is still available via a direct link.

Still Running: NVD, US-CERT

A key part of NIST, the National Vulnerability Database, remains open. The NVD is the U.S. government's compilation of the latest software vulnerabilities, which is combined with analysis and mitigation information.

The NVD will continue to be staffed by a computer scientist and an IT specialist, according to a report in Decipher, a security news site sponsored by Duo Security, which was acquired by Cisco last year.

The Commerce Department has also said NIST's timing infrastructure, which is essential for synchronizing computer clocks, will remain running. Also, the U.S. Computer Emergency Readiness Team, which is part of the Department of Homeland Security, is continuing to publish alerts.

Fortunately, that means some of the most important work is continuing but likely at the cost of longer-term sacrifice, says John Bambenek, vice president of security research and intelligence at ThreatSTOP.

"That said, government workers are working in many cases without support staff, which does have some ancillary impacts," Bambenek says.

It might also pinch a new initiative. In November 2018, a new organization called the Cybersecurity and Infrastructure Security Agency, or CISA, was created after Trump signed the Cybersecurity and Infrastructure Security Agency Act of 2018.

The agency is aimed at being a hub for threats affecting infrastructure and providing incident response and defensive capabilities for the government in cooperation with the private sector. But Decipher reports that 45 percent of its staff has been furloughed.

That may make it harder for the new agency to gain momentum when funding returns. Daniel says that shutdowns tend to affected support activities disproportionately, including hiring and letting of contracts.

"Thus, over time, personnel slots will go unfilled and contracts will expire, making it difficult to sustain the workforce or upgrade equipment," Daniel says.

Shutdown Hurts FBI Investigations

The shutdown is also affecting activities that could have a long-term cybersecurity impact in other ways. The FBI, for example, reports that the shutdown is compromising its ability to run operations or pay informants.

The FBI Agents Association, meanwhile, reports that many FBI agents have a security clearance, which relies on them avoiding debt. But with agents not getting paid, they are at greater risk of going into debt and losing their clearance, which could further compound the bureau's operational readiness. "Financial security is a matter of national security," the group warns in an open letter.

Government Certificates Expire

Other signs of the shutdown's security impact also continue to magnify. U.K. anti-cybercrime firm Netcraft on Thursday warned that due to the shutdown, more than 80 TLS certificate for .gov websites have not been renewed, thus making them inaccessible due to the stronger protections now in place in modern browsers. In some cases, the sites can still be accessed, but only if users click through security alerts warning that the sites may not be secure, in violation of good browser security practices.

This U.S. Court of Appeals website, which provides links to a document filing system as well as the Public Access to Court Electronic Records - PACER - expired on Jan. 5 and has yet to be renewed. (Source: Netcraft)

"Dozens of U.S. government websites have been rendered either insecure or inaccessible during the ongoing U.S. federal shutdown," Netcraft says. "These sites include sensitive government payment portals and remote access services, affecting the likes of NASA, the U.S. Department of Justice and the Court of Appeals."

Declining Morale

The shutdown also carries a public relations cost. Cybersecurity is a hot industry: There simply aren't enough skilled people to fill the jobs created by the fast-growing field. While public service is respected, the pay doesn't come close to that offered by private companies.

It means that for those government workers going without a paycheck, a new employer - and a pay raise - could be just an email or a phone call away.

"Long term, I think it kills us on retention and morale," ThreatSTOP's Bambenek says. "If an incident happens I think they'll find a way to make it work. But I'd assume the recruiting and retention impact lasts years beyond the shutdown."

CTA's Daniel says that a prolonged shutdown could also dim people's views of public service if they've never had a government job before.

"The shutdown certainly deters some people from even considering working for the government," he says. "And even when it's done, the specter of the shutdown will linger as a deterrent for people considering whether to take a government cybersecurity position."

(Executive Editor Mathew Schwartz also contributed to this story.)