ICS

Electric Sector Targeting in Context

As we move into late December (I started writing this on 23 December 2018), all eyes in the information security and especially the industrial control system (ICS) security space typically turn to Ukraine. In 2015 and again in 2016, malicious entities – likely Russian in origin – gained access to Read more…

By Joe, ago
Infosec

A Tale of Two Attributions

19 and 20 December 2018 will likely blend into the overall insanity of the entire year, especially when considered from a US/UK political perspective. Yet these dates, aside from being consecutive, also featured an interesting juxtaposition in the world of cybersecurity threat intelligence. On 19 December 2018, the company Area1 Read more…

By Joe, ago
Infosec

CozyBear – In from the Cold?

On 15 November, something long-awaited (and presumably expected) came to pass in the information security community – CozyBear/APT29/CozyDuke/”The Dukes”/”Office Monkeys” were (or seemed to be) back. Subsequent reporting defined the scope of the event: a large phishing campaign on 14 November targeting multiple organizations spanning “military agencies, law enforcement, defense Read more…

By Joe, ago
General

Strategic Communication and Cyber Attacks

When reporting on cyber-attacks, articles and media frequently (if not exclusively) focus on the damage or immediate result: how many machines were impacted, how much data was compromised, or what (if any) physical consequences emerged from the event. The latter is especially the case with ICS-focused attacks, from Stuxnet to Read more…

By Joe, ago
General

Speculation and Judgment

Recently I engaged in conversation with Dale Peterson dealing with the gas explosion events in Massachusetts. For background, following the event in question there were multiple unfounded claims of a “cyber” cause behind these events followed by significant pushback from various ICS security experts. Where Dale and I enter the Read more…

By Joe, ago
Infosec

Threat Profiling and Adversary Attribution

Recently I was part of a Twitter conversation that started with excellent points on profiling and managing threats that led to some good comments on the value of “who-based” attribution. If you’ve followed this blog and my related works, you will know that I already have strong feelings on the Read more…

By Joe, ago
ICS

YARA for Hunting

YARA – or “yet another regex alternative” – is a pattern matching tool with multiple uses but extensive application in malware analysis and alerting. The framework itself is simple, relatively easy to understand (especially on basic string matching), and incredibly flexible. Yet in application and advertised use, YARA is often Read more…

By Joe, ago
General

Semi-Controlled Chaos

Black Hat/DEF CON week is upon us again. While many poke fun at RSAC (an issue I addressed earlier this year), the annual “Hacker Summer Camp” in Las Vegas is rapidly approaching (or eclipsing) the size of RSA while also becoming more “commercial” and “marketing-oriented” with each passing year. While Read more…

By Joe, ago
General

Making the Case and Its Implications

The United States Department of Justice (DOJ) released a powerful – and incredibly detailed – indictment of 12 named individuals working for the Russian GRU. While many will see this as similar to the indictment of several Chinese nationals for spying in 2014, the cases seem far different in my Read more…

By Joe, ago