Connect with us

Technology

Welcome to DarkSide – and the inexorable rise of ransomware | John Naughton

Voice Of EU

Published

on

On Friday 7 May, Colonial, the quaintly named operator of the pipeline that brings 45% of the US east coast’s gasoline and jet fuel from Texas to New York, announced that it had been hacked. My initial assumption was that this was Russian retaliation for the Biden administration’s punitive cyber-attacks on Russia in response to the SolarWinds hack. After all, if a pipeline like this isn’t “critical infrastructure”, what is? If so, were we not witnessing a significant escalation in information warfare between two nuclear-armed powers?

Fortunately, my overheated imagination turned out to be wrong, but the reality – in a way – is almost as interesting. On 10 May, the FBI announced that the attack on Colonial was caused by an outfit called DarkSide, which specialises in ransomware, and that the bureau had forced the company to halt its pipeline’s operations so that it could carry out a full investigation into the breach.

So who or what is DarkSide? According to Intel 471, a security company that surveys the teeming cybercriminal ecosystem of the internet, DarkSide was first spotted in November 2020 on a Russian-language hacker forum, advertising for partners for a ransomware service. What it was pitching was a platform that “approved” cybercriminals could use to infect companies with ransomware and carry out negotiations and payments with victims. “We are a new product on the market,” it burbled, “but that does not mean that we have no experience and came from nowhere. We received millions of dollars profit by partnering with other well-known cryptolockers. We created DarkSide because we didn’t find the perfect product for us. Now we have it.” Not long afterwards, its software was found to be behind several ransomware attacks on manufacturers and legal firms in Europe and the US.

According to Intel 471, in March 2021, DarkSide “rolled out a number of new features in an effort to attract new affiliates. These included versions for targeting Microsoft Windows- and Linux-based systems, enhanced encryption settings, a fully fledged and integrated feature built directly into the management panel that enabled affiliates to arrange calls meant to pressure victims into paying ransoms and a way to launch a distributed denial of service (DDoS).”

Note the reference to a “management panel”. In conventional software packages, this would be called a “dashboard”, a visual tool to enable non-technical managers to run a complex program without knowing anything about the code. The panel also seems to provide scripts for conducting negotiations with victims. Intel 471 monitored one of these conversations. “This is a lot of money,” the victim writes. “My management needs a better understanding of what data you may have taken. Can you provide proof that you have our data?” Answer: “Yes will provide a sample for you.” The victim continues: “When you receive payment you will not publish the attack or sell exfiltrated data?” Answer: “Of course not, you will get access to a server with data and will delete it yourself. Also we can provide you with a pentest [penetration test] report how you have been breached and what [you] need to improve.”

You get the picture. This is awfully like the kind of dialogue you would see in a conventional business negotiation. What it shows is what the security expert Ross Anderson has been pointing out for years: that cybercrime has been industrialised and that one can analyse it using the methods and economic concepts that one would use if studying any burgeoning line of business.

In that sense, public discourse about cybercrime and its practitioners is way behind the curve. As Ross and his colleagues have shown, criminals are rational actors, not lone hackers with poor hygiene and a penchant for pizza. They see what they do as a low-risk activity with very high profit margins. And they operate in a networked world in which even large and wealthy companies are still failing to take computer security seriously. The significance of the Colonial hack is its confirmation of cybercrime as a major new industry.

Many years ago, I got my first insight into this underworld when a senior police officer took me on a virtual tour of this netherworld. We looked at the online markets in which stolen personal details were traded and the different prices at which various “products” were bought and sold. (PayPal logins attracted premium prices at the time; maybe they still do.) What it looked like was eBay for crooks. And the most striking thing was that in these marketplaces the traders seemed as anxious as you or I would be to establish reputations for reliability and quality. In some cases, there were even star rating systems like you’d see on Uber or, for that matter, on eBay. There may be honour among thieves, as the saying goes, but they still fretted about their online reputations. And DarkSide’s claim that it has occasionally donated some of its profits to charity suggests an interesting new interpretation of “corporate responsibility”. It’s time we wised up to this new reality.

What I’ve been reading

Picture perfect
Obscura No More is a lovely essay in the American Scholar by Andy Grundberg on the rise of photography as an art form.

Pandemic pandemonium
The origin of Covid: Did people or nature open Pandora’s box at Wuhan? is a great piece of analysis by Nicholas Wade in the Bulletin of the Atomic Scientists.

Ready for future shocks?
What Is Ours Is Only Ours to Give is an excellent essay by Maria Farrell on the Crooked Timber blog triggered by Kim Stanley Robinson’s new novel, The Ministry for the Future.

Source link

Technology

How to keep a support contract • The Register

Voice Of EU

Published

on

On Call Let us take a little trip back to the days before the PC, when terminals ruled supreme, to find that the more things change the more they stay the same. Welcome to On Call.

Today’s story comes from “Keith” (not his name) and concerns the rage of a user whose expensive terminal would crash once a day, pretty much at the same time.

The terminal in question was a TAB 132/15. It was an impressive bit of kit for the time and was capable of displaying 132 characters of crisp, green text on a 15-inch CRT housed in a futuristic plastic case. Luxury for sure, unless one was the financial trader trying to use the device.

Once a day, at around 13:30, the terminal would hang. The user would have to reach behind it, power it off, wait a bit, and then fire it back up again. To placate the angry customer, a replacement was dispatched, and all was well. Until the problem started again. Another replacement was made. Another week or so went by with no complaints. And again, another call: the terminal was hanging. Same time. A few times a week.

“These terminals were in the thousand-dollar range,” Keith told us, so a monthly replacement cycle was not really an option. He even used one of the faulty units himself for a while and encountered no issues, which was odd in itself and, we reckon, planted a seed of suspicion.

As for the customer, he was raging by this point. “He was threatening to cancel our contract for his entire firm,” remembered Keith, which would hit the bottom line hard. A salesperson was sent out to see what was happening, but there was no failure.

A technician went out; again no failure. Was this a case of “Technician Syndrome”, where a problem cannot be replicated in front of service personnel? Maybe. Keith’s team were at their wit’s end while the customer had hit the end of his tether and gone beyond.

The solution to the problem was accidental. Keith was back on site, diagnosing an unrelated software issue, but could see the suspect terminal on the other side of the room. As he watched, the trader using the machine sat back for lunch, flipping through the pages of a financial newspaper. A phone call came through, and the trader slung the paper on top of the monitor, took the call, and then resumed work.

Oblivious to the newspaper.

A few minutes later there was uproar. The trader had stood and was slapping the side of the terminal, yelling all manner of not-safe-for-work oaths and casting aspersions upon the good name of Keith’s firm, the software, the programmers, and the computing industry in general. The cursing continued as the trader reached behind for the power switch, knocking the paper aside.

Keith had his solution. But was smart enough to know that a bland presentation of facts would probably not help. Instead, he arranged for his office to call the trader and tell him that a tech was on the way to help. He waited until the trader was distracted and sauntered over.

“Sure enough,” said Keith, “he said he was glad to see me but launched into a tirade again about the device’s many faults.”

He let the customer vent for a while, and surreptitiously placed the newspaper back on top over the heat vents on the terminal while pretending to examine the rear of the unit.

Now patience was needed. It wouldn’t take long – the terminal had, after all, only just recovered from its last overheating episode – and Keith encouraged the trader to unload all his woes and grievances.

The bug list was building as the screen suddenly flickered and locked up. “There! You see that?” exclaimed the user. Keith nodded and reached round the side of the terminal to cycle the power. Sure enough, it came back up.

Keith made a show of thanking the user for showing him the elusive bug and was staging a call with a co-worker, supposedly to prepare a replacement, when the terminal locked up again.

Keith wrinkled his forehead at the “mystery” before offering up an explanation.

“Ah!” he exclaimed, “Did you see how that flicker started from the top and moved to the down?”

Those familiar with the technology will know it was just following the raster pattern. The customer, on the other hand, did not.

“That is often a sign it is overheating,” said Keith, playing fast and loose with the truth, “but this office is cool?”

He pretended to be mystified until the penny dropped for the trader, who unleashed yet more expletives as he realised where he’d dropped his newspaper and snatched it away from the vents.

Feeling the volcanic heat spewing from the depths of the terminal, he turned to Keith, suddenly concerned: “Will it be OK?”

Of course it would. It had only been overheating for a short time every day. The apologies from the customer, who had “discovered” the problem, were profuse and copious. Keith excused himself, but not before rubbing a bit more salt into the wound by telling the user he needed to cancel the burn-in process of yet another expensive replacement.

As it turned out, rather than the customer cancelling the support contact, it ended up being extended.

“It was a good thing I’d let him ‘discover’ the fault,” said Keith. “If I had found it, he would have been very defensive and we still might have lost that contract.”

The minor bugs the user had reported while Keith had been waiting for the overheating to happen again were swiftly dealt with and the enhancement requests logged. Keith also reported back to his boss, who spent rather a lot of time laughing.

“It was a good day.”

Ever set the stage so the customer thinks they’re the hero of the hour? Or maybe you’ve wished all manner of unpleasantness upon your suppliers before realising the blame laid with you all along? Tell us about the time you picked up the phone with an email to On Call. ®

Source link

Continue Reading

Technology

NUIG to spend €5m on research to help address global issues

Voice Of EU

Published

on

Several key research areas have been identified by NUI Galway to work towards for 2026.

NUI Galway’s recently launched research and innovation strategy includes a €5m investment on support for its multi-disciplinary research teams as they grapple with several global issues.

The strategy, which lays out plans for the university’s next five years of research, focuses on six areas: antimicrobial resistance, decarbonisation, democracy and its future, food security, human-centred data and ocean and coastal health.

“As a public university, we have a special responsibility to direct our research toward the most pressing questions and the most difficult issues,” said to Prof Jim Livesey, VP for research and innovation at NUI Galway.

“As we look into the future, we face uncertainty about the number and nature of challenges we will face, but we know that we will rely on our research capacity as we work together to overcome them,” Livesey added.

The plan focuses on creating the conditions to intensify the quality, scale and scope of research in the university into the future. This includes identifying areas with genuine potential to achieve international recognition for NUI Galway. It also aims to continue to cultivate a supportive and diverse environment within its research community.

NUI Galway has research collaborations with 3,267 international institutions in 114 different countries. The university also has five research institutes on its Galway city campus, including the Data Science Institute, the Whitaker Institute for social change and innovation and the Ryan Institute for marine research.

Its research centres in the medtech area include Science Foundation Ireland’s Cúram and the Corrib Research Centre for Advanced Imaging and Core Lab.

The university will also continue to involve the public with its research and innovation plans through various education and outreach initiatives. It is leading the Public Patient Involvement Ignite network, which it claims, will “bring the public into the heart of research initiatives”.

Another key area identified in the strategy report is the development of partnerships with industry stakeholders. NUI Galway has spun out many successful companies in recent years, including medtechs such as AuriGen Medical, Atrian, Vetex Medical and Neurent.

According to MedTech Europe, Ireland has the highest number of medtech employees per capita in Europe along with Switzerland.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Source link

Continue Reading

Technology

France hails victory as Facebook agrees to pay newspapers for content | France

Voice Of EU

Published

on

France has hailed a victory in its long-running quest for fairer action from tech companies after Facebook reached an agreement with a group of national and regional newspapers to pay for content shared by its users.

Facebook on Thursday announced a licensing agreement with the APIG alliance of French national and regional newspapers, which includes Le Parisien and Ouest-France as well as smaller titles. It said this meant “people on Facebook will be able to continue uploading and sharing news stories freely amongst their communities, whilst also ensuring that the copyright of our publishing partners is protected”.

France had been battling for two years to protect the publishing rights and revenue of its press and news agencies against what it termed the domination of powerful tech companies that share news content or show news stories in web searches.

In 2019 France became the first EU country to enact a directive on the publishing rights of media companies and news agencies, called “neighbouring rights”, which required large tech platforms to open talks with publishers seeking remuneration for use of news content. But it has taken long negotiations to reach agreements on paying publishers for content.

No detail was given of the exact amount agreed by Facebook and the APIG.

Pierre Louette, the head of the media group Les Echos-Le Parisien, led the alliance of newspapers who negotiated as a group with Facebook. He said the agreement was “the result of an outspoken and fruitful dialogue between publishers and a leading digital platform”. He said the terms agreed would allow Facebook to implement French law “while generating significant funding” for news publishers, notably the smallest ones.

Other newspapers, such as the national daily Le Monde, have negotiated their own deals in recent months. News agencies have also negotiated separately.

After the 2019 French directive to protect publishers’ rights, a copyright spat raged for more than a year in which French media groups sought to find common ground with international tech firms. Google initially refused to comply, saying media groups already benefited by receiving millions of visits to their websites. News outlets struggling with dwindling print subscriptions complained about not receiving a cut of the millions made from ads displayed alongside news stories, particularly on Google.

But this year Google announced it had reached a draft agreement with the APIG to pay publishers for a selection of content shown in its searches.

Facebook said that besides paying for French content, it would also launch a French news service, Facebook News, in January – a follow-up to similar services in the US and UK – to “give people a dedicated space to access content from trusted and reputable news sources”.

Facebook reached deals with most of Australia’s largest media companies earlier this year. Nine Entertainment, which includes the Sydney Morning Herald and the Age, said in its annual report that it was expecting “strong growth in the short-term” from its deals with Facebook and Google.

British newspapers including the Guardian signed up last year to a programme in which Facebook pays to license articles that appear on a dedicated news section on the social media site. Separately, in July Guardian Australia struck a deal with Facebook to license news content.

Source link

Continue Reading

Trending

Subscribe To Our Newsletter

Join our mailing list to receive the latest news and updates 
directly on your inbox.

You have Successfully Subscribed!