Israeli spyware firm NSO group that manufactures the controversial Pegasus software has been accused of hacking journalists and human rights defenders in Mexico, after the current government explicitly said it was not going to use the program, according to new research.

The research showed that two journalists who reported on corruption cases and a prominent human rights defender were targeted by the Pegasus spyware between 2019 and 2021.&nbsp;

<a href="https://www.wionews.com/world/jamal-khashoggis-wife-planning-to-sue-nso-group-over-spyware-report-519068">Read more:&nbsp;Jamal Khashoggi's wife planning to sue NSO Group over spyware: Report</a>

When quizzed if he spied on the mentioned, individuals,&nbsp;Lopez Obrador said, "It's not true that journalists or opponents are spied on. My doctrine isn't hypocrisy, like the former administrations you all applaud."

The discovery was made by researchers at&nbsp;R3D (Red en Defensa de los Derechos Digitales) in collaboration with The Citizen Lab at the University of Toronto.

The use of Pegasus spyware was detected in the Northern American country in 2017 previously. Former President Enrique Pena Nieto had used the software to spy on&nbsp;politicians, journalists, activists and critics of the government.

However, after coming to power,&nbsp;Lopez Obrador assured that his government will not use spyware. Interestingly enough, NSO Group claims to&nbsp;sell its spyware to&nbsp;governments or law enforcement agencies only. Thus experts believe that Obrador had also made backdoor dealings with the Israeli firm.&nbsp;

<a href="https://www.wionews.com/world/senior-indonesian-officials-targeted-by-spyware-last-year-521333">Read more:&nbsp;Senior Indonesian officials 'targeted by spyware' last year</a>

The Pegasus controversy

The company has been wading in stormy waters, ever since its Pegasus spyware and its potent spying capabilities were revealed to the world.&nbsp;

Forbidden Stories along with Amnesty International and a consortium of journalists from 17 news outlets across the world first exposed Pegasus and its use by various governments across the globe.&nbsp;

As reported by WION, Pegasus infiltrates phones to vacuum up personal and location data and surreptitiously controls the smartphone’s microphones and cameras.

Read more:&nbsp;<a href="https://www.wionews.com/world/pegasus-snooping-us-blacklists-spyware-maker-nso-group-for-maliciously-targetting-journalists-426591" target="_blank">Pegasus snooping: US blacklists spyware maker NSO Group for maliciously targetting journalists</a>

The company is also being sued by Mark Zuckerberg for allegedly targeting some 1,400 users of its encrypted messaging service WhatsApp with its spyware.

Moreover, In November last year, Apple sued NSO, saying it violated US laws by breaking into the software installed on iPhones.

(With inputs from agencies) 
 
WATCH WION LIVE HERE:&nbsp;

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" loading="”lazy”" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

Israeli spyware firm NSO group that manufactures the controversial Pegasus software has been accused of hacking journalists and human rights defenders in Mexico, after the current government explicitly said it was not going to use the program, according to new research.

Israeli spyware firm NSO group that manufactures the controversial Pegasus software has been accused of hacking journalists and human rights defenders in Mexico, after the current government explicitly said it was not going to use the program, according to new research. The research showed that two journalists who reported on corruption cases and a prominent human rights defender were targeted by the Pegasus spyware between 2019 and 2021. Read more: Jamal Khashoggi's wife planning to sue NSO Group over spyware: Report When quizzed if he spied on the mentioned, individuals, Lopez Obrador said, "It's not true that journalists or opponents are spied on. My doctrine isn't hypocrisy, like the former administrations you all applaud." The discovery was made by researchers at R3D (Red en Defensa de los Derechos Digitales) in collaboration with The Citizen Lab at the University of Toronto. The use of Pegasus spyware was detected in the Northern American country in 2017 previously. Former President Enrique Pena Nieto had used the software to spy on politicians, journalists, activists and critics of the government. However, after coming to power, Lopez Obrador assured that his government will not use spyware. Interestingly enough, NSO Group claims to sell its spyware to governments or law enforcement agencies only. Thus experts believe that Obrador had also made backdoor dealings with the Israeli firm. Read more: Senior Indonesian officials 'targeted by spyware' last year The Pegasus controversy The company has been wading in stormy waters, ever since its Pegasus spyware and its potent spying capabilities were revealed to the world. Forbidden Stories along with Amnesty International and a consortium of journalists from 17 news outlets across the world first exposed Pegasus and its use by various governments across the globe. As reported by WION, Pegasus infiltrates phones to vacuum up personal and location data and surreptitiously controls the smartphone’s microphones and cameras. Read more: Pegasus snooping: US blacklists spyware maker NSO Group for maliciously targetting journalists The company is also being sued by Mark Zuckerberg for allegedly targeting some 1,400 users of its encrypted messaging service WhatsApp with its spyware. Moreover, In November last year, Apple sued NSO, saying it violated US laws by breaking into the software installed on iPhones. (With inputs from agencies) WATCH WION LIVE HERE:

Pegasus spyware strikes again in Mexico despite government's assurances: Report

The Joint Engineering Exam, or JEE Main, which decides the future of thousands of Indian students, was allegedly hacked last year, the Central Bureau of Investigation (CBI) said in its statement.

Giving details about this instance, the CBI stated that it was done by a Russian named Mikhail Shargan in 2021.&nbsp;

Shargan hacked into the software of JEE provided by IT major TCS, or Tata Consultancy Services.&nbsp;

<a href="https://www.wionews.com/india-news/india-man-forbids-wife-from-playing-garba-she-files-complaint-522178">Also read |&nbsp;India: Man forbids wife from playing Garba, she files complaint</a>

JEE is a computer-based entrance test where over a million students appear and are administered throughout India to determine admission to engineering colleges such as IIT, NIT, and NIIT.

As per the sources, Shargan hacked the TCS software, which the JEE was using as a platform to conduct exams to provide remote connectivity to take over the computer terminals of students appearing for the exam. To simplify, this means that through hacking, students will be able to cheat easily, as now the teachers or their coaches will be able to access their computers and give exams on their behalf.&nbsp;

An instance was reported of a private coaching centre in Uttar Pradesh named 'Affinity Education' that solved the question paper on behalf of students who paid the institute nearly $1227 to $1841.&nbsp;

<a href="https://www.wionews.com/india-news/india-jk-dgp-prisons-found-dead-at-friends-residence-cops-suspect-murder-522206">Also read |&nbsp;Terror outfit PAFF claims responsibility for killing Jammu and Kashmir Police's prison chief</a>

This remote access was provided through an examination centre in Sonepat, Haryana.&nbsp;

Approximately 20 students were believed to have cheated through this method and are now banned from taking the exam for the next three years.

Shargan was taken into custody at Delhi airport by the authorities after he landed from&nbsp;Kazakhstan, and was later arrested. &nbsp;

The case was then registered by the CBI, which conducted raids in different cities and seized laptops involved in the examination scam.&nbsp;

(With inputs from agencies)

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" loading="”lazy”" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

The Joint Engineering Exam, or JEE Main, which decides the future of thousands of Indian students, was allegedly hacked last year, the Central Bureau of Investigation (CBI) said in its statement.

The Joint Engineering Exam, or JEE Main, which decides the future of thousands of Indian students, was allegedly hacked last year, the Central Bureau of Investigation (CBI) said in its statement. Giving details about this instance, the CBI stated that it was done by a Russian named Mikhail Shargan in 2021. Shargan hacked into the software of JEE provided by IT major TCS, or Tata Consultancy Services. Also read | India: Man forbids wife from playing Garba, she files complaint JEE is a computer-based entrance test where over a million students appear and are administered throughout India to determine admission to engineering colleges such as IIT, NIT, and NIIT. As per the sources, Shargan hacked the TCS software, which the JEE was using as a platform to conduct exams to provide remote connectivity to take over the computer terminals of students appearing for the exam. To simplify, this means that through hacking, students will be able to cheat easily, as now the teachers or their coaches will be able to access their computers and give exams on their behalf. An instance was reported of a private coaching centre in Uttar Pradesh named 'Affinity Education' that solved the question paper on behalf of students who paid the institute nearly $1227 to $1841. Also read | Terror outfit PAFF claims responsibility for killing Jammu and Kashmir Police's prison chief This remote access was provided through an examination centre in Sonepat, Haryana. Approximately 20 students were believed to have cheated through this method and are now banned from taking the exam for the next three years. Shargan was taken into custody at Delhi airport by the authorities after he landed from Kazakhstan, and was later arrested. The case was then registered by the CBI, which conducted raids in different cities and seized laptops involved in the examination scam. (With inputs from agencies) WATCH WION LIVE HERE

India: Russian man arrested for hacking JEE Mains software to help students cheat

LastPass, a password manager used by more than 33 million people worldwide, reported that a hacker recently stole source code and confidential information after infiltrating its systems. According to a blog post on Thursday, the company doesn't think any passwords were taken as part of the breach and users shouldn't need to take any action to secure their accounts.

An investigation revealed that a "unauthorised party" gained access to its developer environment, which is the software used by staff members to create and maintain the LastPass product. The perpetrators were able to access the system by using a single compromised developer's account, the company claimed.

As per Bloomberg, the organisation that was attacked is one that automatically creates and maintains complex passwords for a variety of user accounts, including <a href="https://www.wionews.com/entertainment-news/netflix-sets-premiere-date-for-knives-out-2-509340">Netflix </a>and Gmail, so that customers don't have to manually enter their login information. On its website, LastPass cites Patagonia, Yelp Inc., and State Farm as clients.

According to the <a href="https://www.wionews.com/technology/tesla-autopilot-features-creates-confusion-by-recognising-horse-carriage-with-a-truck-netizens-amused-510043">cybersecurity </a>blog Bleeping Computer, it questioned LastPass two weeks ago about the hack. The "speedy notification" from LastPass impressed Allan Liska, an expert with cybersecurity firm Recorded Future's Computer Security Incident Response Team.

“While two weeks might seem like a long time to some, it can take a while for incident response teams to fully assess and report on a situation,” he said. “it will take time to fully determine the extent of any damage that may have been as result of the breach. However, for now it appears to not be client-impacting.”

On social media, there was suspicion that after stealing source code and confidential material, hackers might be able to get their hands on the passwords to password vaults. “It is unlikely that the stolen source code will give the criminals access to customer passwords,” Liska said.

Also WATCH |&nbsp;Facebook's edit button goes missing, users left disgruntled

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/facebooks-edit-button-goes-missing-users-left-disgruntled-509680/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

LastPass, a password manager used by more than 33 million people worldwide, reported that a hacker recently stole source code and confidential information after infiltrating its systems.

LastPass, a password manager used by more than 33 million people worldwide, reported that a hacker recently stole source code and confidential information after infiltrating its systems. According to a blog post on Thursday, the company doesn't think any passwords were taken as part of the breach and users shouldn't need to take any action to secure their accounts. An investigation revealed that a "unauthorised party" gained access to its developer environment, which is the software used by staff members to create and maintain the LastPass product. The perpetrators were able to access the system by using a single compromised developer's account, the company claimed. As per Bloomberg, the organisation that was attacked is one that automatically creates and maintains complex passwords for a variety of user accounts, including Netflix and Gmail, so that customers don't have to manually enter their login information. On its website, LastPass cites Patagonia, Yelp Inc., and State Farm as clients. According to the cybersecurity blog Bleeping Computer, it questioned LastPass two weeks ago about the hack. The "speedy notification" from LastPass impressed Allan Liska, an expert with cybersecurity firm Recorded Future's Computer Security Incident Response Team. “While two weeks might seem like a long time to some, it can take a while for incident response teams to fully assess and report on a situation,” he said. “it will take time to fully determine the extent of any damage that may have been as result of the breach. However, for now it appears to not be client-impacting.” On social media, there was suspicion that after stealing source code and confidential material, hackers might be able to get their hands on the passwords to password vaults. “It is unlikely that the stolen source code will give the criminals access to customer passwords,” Liska said. Also WATCH | Facebook's edit button goes missing, users left disgruntled

LastPass, world's most popular password manager claims it was hacked

Messaging app, Signal is said to be a secure service, it's considered the gold standard of privacy but the fact is like many other messaging apps, Signal is also not completely secure. The App whose tag line is say hello to privacy is also vulnerable to hacking incidents.

Tech Talk: Signal messaging app confirms data breach at verification partner Twilio

A ransomware attack on a UK software provider for the NHS is being probed for possible patient data theft after experts issued a warning that thieves would use personal information as a negotiating chip. The attack happened last week.&nbsp;

Guardian reports that when asked about "potential data access or exfiltration," Advanced, which offers services for NHS 111 and patient records, stated that it was looking into "potentially impacted data" and would update when it learned more.&nbsp;

Watch |&nbsp;People turn back to cash as prices rise, cost of living crisis worsens in the UK

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/people-turn-back-to-cash-as-prices-rise-cost-of-living-crisis-worsens-in-the-uk-505842/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

UK data watchdog, Information Commissioner’s Officer, which regulates the protection of people's data in the UK has acknowledged that it has been informed of the situation and said that it was conducting inquiries.

Speaking to Guardian, information security consultant Alexi Drew says that the ICO’s, involvement, raises major questions about whether sensitive data had been stolen.

Also read |&nbsp;<a href="https://www.wionews.com/world/archie-battersbees-parents-to-knock-at-european-human-rights-office-as-a-last-ditch-effort-503159">Archie Battersbee's parents to knock at European Human Rights office as a last-ditch effort</a>

"If the ICO is involved, they have to think that there is a credible risk that personal data has been stolen."

According to Drew, ransomware gangs frequently requested money to decrypt files that they lock during the attack. ANother possibility is that&nbsp;they may also ask for money in exchange for information or as a form of blackmail, she added.

Also read |&nbsp;<a href="https://www.wionews.com/world/for-the-first-time-since-march-us-gasoline-costs-drop-below-4-505953" hreflang="en">For the first time since March, US gasoline price drops below $4</a>

The Advanced Adastra system, which aids 111 administrators in ambulance dispatch and serves as a patient management system for emergency care, has also been impacted by the hack.

According to a report published on Wednesday by the Health Service Journal, at least nine NHS mental health trusts would be without access to the records of vulnerable patients for at least three weeks due to a "system outage" of the Carenotes electronic patient record, an Advanced product.

(With inputs from agencies)

Watch WION LIVE HERE:

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

A ransomware attack on a UK software provider for the NHS is being probed for possible patient data theft after experts issued a warning that thieves would use personal information as a negotiating chip.

A ransomware attack on a UK software provider for the NHS is being probed for possible patient data theft after experts issued a warning that thieves would use personal information as a negotiating chip. The attack happened last week. Guardian reports that when asked about "potential data access or exfiltration," Advanced, which offers services for NHS 111 and patient records, stated that it was looking into "potentially impacted data" and would update when it learned more. Watch | People turn back to cash as prices rise, cost of living crisis worsens in the UK UK data watchdog, Information Commissioner’s Officer, which regulates the protection of people's data in the UK has acknowledged that it has been informed of the situation and said that it was conducting inquiries. Speaking to Guardian, information security consultant Alexi Drew says that the ICO’s, involvement, raises major questions about whether sensitive data had been stolen. Also read | Archie Battersbee's parents to knock at European Human Rights office as a last-ditch effort "If the ICO is involved, they have to think that there is a credible risk that personal data has been stolen." According to Drew, ransomware gangs frequently requested money to decrypt files that they lock during the attack. ANother possibility is that they may also ask for money in exchange for information or as a form of blackmail, she added. Also read | For the first time since March, US gasoline price drops below $4 The Advanced Adastra system, which aids 111 administrators in ambulance dispatch and serves as a patient management system for emergency care, has also been impacted by the hack. According to a report published on Wednesday by the Health Service Journal, at least nine NHS mental health trusts would be without access to the records of vulnerable patients for at least three weeks due to a "system outage" of the Carenotes electronic patient record, an Advanced product. (With inputs from agencies) Watch WION LIVE HERE: You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here.

Ransomware attack hits UK NHS's software, experts fear theft of sensitive patient data

Already reeling under pressure from the allegations of sexual assault and kidnapping by over 550 women, ride-hailing platform Uber on Saturday admitted that it knew about the data breach in 2016 that affected 57 million customers and yet failed to inform the public or US Federal Trade Commission (FTC).

Reportedly, Uber has confessed to the US prosecutors to avoid being levelled with criminal charges, as part of a settlement.&nbsp;When quizzed about how Uber had escaped the criminal charges, Stephanie Hinds, United States Attorney for the Northern District of California stated that the new management of Uber, that took charge in the aftermath of the hacking incident cooperated properly and made informed disclosures.

Furthermore, the new management in 2018 committed FTC to maintain an extensive privacy program for the next twenty years.&nbsp; 
Reportedly, in late 2016, two hackers stole personal data, including phone numbers, email addresses, and names of 57 million Uber&nbsp;passengers, in addition to the driver’s licences of over 600,000 drivers working for the company.&nbsp;

Read More:&nbsp;<a href="https://www.wionews.com/world/550-women-sue-uber-over-allegations-including-kidnapping-and-sexual-assault-497365">550 women sue Uber over allegations including kidnapping and sexual assault</a>

Joseph Sullivan, the Chief Security Officer of Uber at the time had decided to conceal the all-important information. Reportedly, Sullivan was on the verge of offering $100,000 in Bitcoins to hackers to brush the news under the carpet. He had also got the hackers on board to sign a non-disclosure agreement.

However, when a ‘strong’ executive team took the centre stage, the breach was revealed and Sullivan was thrown to the law enforcement agencies. The former security officer is now being charged with wire fraud and as part of the non-prosecution agreement, Uber Technologies Ltd. will help the prosecutors indict him.

Read more: <a href="https://www.wionews.com/world/the-uber-files-leaked-docs-reveal-how-uber-won-access-to-world-leaders-deceived-investigators-496213">The Uber Files: Leaked docs reveal how Uber won access to world leaders, deceived investigators</a>

It is pertinent to note that Uber had to pay a fine of $148 million to all the 50 US states in September 2018, to settle the claims. However, given that Uber's market value amounted to $76 billion in the same year, many experts called it a mockery of the system.&nbsp;

(With inputs from agencies)

WATCH WION LIVE HERE:

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" loading="”lazy”" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1  width=&quot;100%&quot;"></iframe>

Already reeling under pressure from the allegations of sexual assault and kidnapping by over 550 women, ride-hailing platform Uber on Saturday admitted that it knew about the data breach in 2016 that affected 57 million customers and yet failed to inform the public or US Federal Trade Commission (FTC).

Already reeling under pressure from the allegations of sexual assault and kidnapping by over 550 women, ride-hailing platform Uber on Saturday admitted that it knew about the data breach in 2016 that affected 57 million customers and yet failed to inform the public or US Federal Trade Commission (FTC). Reportedly, Uber has confessed to the US prosecutors to avoid being levelled with criminal charges, as part of a settlement. When quizzed about how Uber had escaped the criminal charges, Stephanie Hinds, United States Attorney for the Northern District of California stated that the new management of Uber, that took charge in the aftermath of the hacking incident cooperated properly and made informed disclosures. Furthermore, the new management in 2018 committed FTC to maintain an extensive privacy program for the next twenty years. Reportedly, in late 2016, two hackers stole personal data, including phone numbers, email addresses, and names of 57 million Uber passengers, in addition to the driver’s licences of over 600,000 drivers working for the company. Read More: 550 women sue Uber over allegations including kidnapping and sexual assault Joseph Sullivan, the Chief Security Officer of Uber at the time had decided to conceal the all-important information. Reportedly, Sullivan was on the verge of offering $100,000 in Bitcoins to hackers to brush the news under the carpet. He had also got the hackers on board to sign a non-disclosure agreement. However, when a ‘strong’ executive team took the centre stage, the breach was revealed and Sullivan was thrown to the law enforcement agencies. The former security officer is now being charged with wire fraud and as part of the non-prosecution agreement, Uber Technologies Ltd. will help the prosecutors indict him. Read more: The Uber Files: Leaked docs reveal how Uber won access to world leaders, deceived investigators It is pertinent to note that Uber had to pay a fine of $148 million to all the 50 US states in September 2018, to settle the claims. However, given that Uber's market value amounted to $76 billion in the same year, many experts called it a mockery of the system. (With inputs from agencies) WATCH WION LIVE HERE:

Uber admits concealing the 2016 data leak of 57 million passengers; avoids criminal charges

A hacker has allegedly stolen the personal information of one billion people from the Shanghai police, which would represent one of the greatest data breaches in history, according to cyber experts. The internet user identified as "ChinaDan" posted on the hacker forum Breach Forums offering to sell more than 23 terabytes (TB) of data for 10 bitcoin, or approximately $200,000. The post said, "In 2022, the Shanghai National Police (SHGA) database was leaked." This database contains many TB of data and information on billions of Chinese citizens. The database contained personal information of 1 billion people including Name, residence, birthplace, national ID number and all crime/case details, reported by Reuters.<o:p></o:p>

The authenticity of the post was unable to be confirmed by the news agency Reuters. The agency was also unable to reach the self-proclaimed hacker ‘ChinaDan’ but the post created a lot of discussion on Chinese media platforms Weibo and WeChat, with many users considering this to be true. The hashtag "data leak" was being used on the platforms but was later blocked by Weibo on Sunday (July 3).

Also read |&nbsp;<a href="https://www.wionews.com/sports/chinese-driver-guanyu-zhou-claims-halo-saved-him-in-huge-british-gp-crash-494558">Chinese driver Guanyu Zhou claims halo saved him in huge British GP crash</a>

<o:p></o:p>

Kendra Schaefer, head of tech policy research at the Beijing-based consultancy Trivium, China tweeted, "hard to parse truth from rumour mill." She further added that if the hacker claimed to possess information originating from the Ministry of Public Security, it would be terrible for various reasons. She said it would be would be undoubtedly ranked as the biggest breaches in the history.

Watch |&nbsp;Gravitas: World's biggest drill to contain China

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/gravitas-worlds-biggest-drill-to-contain-china-494464/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

<o:p></o:p>

Zhao Changpeng, CEO of Binance, said that the cryptocurrency exchange has stepped up its user verification after the exchange’s intelligence discovered the sale of documents belonging to 1 billion citizens on the dark web. Changpeng on Twitter said one probable reason for this could be "a bug in Elastic Search deployment by a government authority."

<a href="https://www.wionews.com/south-asia/china-wants-instability-in-myanmar-southeast-asia-expert-bertil-lintner-494527">Also read |&nbsp;China wants instability in Myanmar: Southeast Asia expert Bertil Lintner</a>

<o:p></o:p>

China has vowed to improve the protection of online users and their personal data, instructing the tech companies to ensure storage for better management and storage. In addition to this, the country last year passed laws governing how data generated should remain within its borders.<o:p></o:p>

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

<o:p>(With inputs from agencies</o:p>)

A hacker has allegedly stolen the personal information of one billion people from the Shanghai police, which would represent one of the greatest data breaches in history, according to cyber experts.

A hacker has allegedly stolen the personal information of one billion people from the Shanghai police, which would represent one of the greatest data breaches in history, according to cyber experts. The internet user identified as "ChinaDan" posted on the hacker forum Breach Forums offering to sell more than 23 terabytes (TB) of data for 10 bitcoin, or approximately $200,000. The post said, "In 2022, the Shanghai National Police (SHGA) database was leaked." This database contains many TB of data and information on billions of Chinese citizens. The database contained personal information of 1 billion people including Name, residence, birthplace, national ID number and all crime/case details, reported by Reuters. The authenticity of the post was unable to be confirmed by the news agency Reuters. The agency was also unable to reach the self-proclaimed hacker ‘ChinaDan’ but the post created a lot of discussion on Chinese media platforms Weibo and WeChat, with many users considering this to be true. The hashtag "data leak" was being used on the platforms but was later blocked by Weibo on Sunday (July 3). Also read | Chinese driver Guanyu Zhou claims halo saved him in huge British GP crash Kendra Schaefer, head of tech policy research at the Beijing-based consultancy Trivium, China tweeted, "hard to parse truth from rumour mill." She further added that if the hacker claimed to possess information originating from the Ministry of Public Security, it would be terrible for various reasons. She said it would be would be undoubtedly ranked as the biggest breaches in the history. Watch | Gravitas: World's biggest drill to contain China Zhao Changpeng, CEO of Binance, said that the cryptocurrency exchange has stepped up its user verification after the exchange’s intelligence discovered the sale of documents belonging to 1 billion citizens on the dark web. Changpeng on Twitter said one probable reason for this could be "a bug in Elastic Search deployment by a government authority." Also read | China wants instability in Myanmar: Southeast Asia expert Bertil Lintner China has vowed to improve the protection of online users and their personal data, instructing the tech companies to ensure storage for better management and storage. In addition to this, the country last year passed laws governing how data generated should remain within its borders. WATCH WION LIVE HERE You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here. (With inputs from agencies)

Hacker claims to have stolen records of 1 billion Chinese citizens

The British Army has regained control of its Twitter and YouTube accounts on Sunday after they were briefly hacked and used to promote cryptocurrencies and non-fungible tokens (NFTs).

British Army regains control of its social media accounts after brief hacking

Chrome users have been warned as Google revealed 30 new security flaws, including seven that pose a 'high' threat.&nbsp;

The tech firm&nbsp;has warned billions of users that the browser has been successfully targeted by hackers.&nbsp;

In a statement, the company has informed that it is now releasing an update to fix the bugs. The update is expected to come within the next few days. &nbsp;

Google stated that the bug has affected Windows, macOS, and Linux. However, there is no confirmation that who is responsible for hacking. The company has also not clarified whether any users' security was put at risk.&nbsp;

ALSO READ |&nbsp;<a href="https://www.wionews.com/science/moderna-asks-fda-to-authorise-its-covid-vaccine-for-children-younger-than-6-474626">Moderna asks FDA to authorise its COVID vaccine for children younger than 6</a>

The company said: "We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed."&nbsp;

As per the statement, an update will be released by the tech giant&nbsp;within the next few days to fix the bugs.&nbsp;

WATCH |&nbsp;Tesla CEO Elon Musk publicly criticises Twitter staff which stirs fresh row

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/tesla-ceo-elon-musk-publicly-criticises-twitter-staff-which-stirs-fresh-row-474635/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>
</div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

ALSO READ |&nbsp;<a href="https://www.wionews.com/science/you-think-videoconferencing-is-the-new-normal-but-it-hinders-creativity-study-tells-474459">You think videoconferencing is the new normal? But it hinders creativity, study claims</a>

"Until a majority of users are updated with a fix" other hack details are currently being restricted by the company.&nbsp;

The company said that it will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.&nbsp;

"We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel," the company stated.&nbsp;

The company also said that the users can manually update their browsers through the settings features.&nbsp;

However, the browser will automatically update within a few days.&nbsp;

<hr />
Read latest on personal information and search results

Meanwhile, Google has announced an expansion of the list of personal content that it's planning to remove from search results to cover things like physical address, phone number, passwords, credit card numbers, bank account IDs, or photos of your handwritten signatures.&nbsp;

Google is also planning to remove things like 'non-consensual explicit or intimate personal images,'&nbsp;pornographic deep fakes, or links to sites with 'exploitative removal practices.'&nbsp;

As per reports from The Verge, Google is providing the new options because 'the internet is always evolving'&nbsp;and its search engine giving out your phone number or home address can be quite dangerous.&nbsp;

WATCH WION LIVE HERE&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false"><iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe></div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

(With inputs from agencies)&nbsp;

Chrome users have been warned as Google revealed 30 new security flaws, including seven that pose a 'high' threat. The tech firm has warned billions of users that the browser has been successfully targeted by hackers.

Chrome users have been warned as Google revealed 30 new security flaws, including seven that pose a 'high' threat. The tech firm has warned billions of users that the browser has been successfully targeted by hackers. In a statement, the company has informed that it is now releasing an update to fix the bugs. The update is expected to come within the next few days. Google stated that the bug has affected Windows, macOS, and Linux. However, there is no confirmation that who is responsible for hacking. The company has also not clarified whether any users' security was put at risk. ALSO READ | Moderna asks FDA to authorise its COVID vaccine for children younger than 6 The company said: "We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed." As per the statement, an update will be released by the tech giant within the next few days to fix the bugs. WATCH | Tesla CEO Elon Musk publicly criticises Twitter staff which stirs fresh row × ALSO READ | You think videoconferencing is the new normal? But it hinders creativity, study claims "Until a majority of users are updated with a fix" other hack details are currently being restricted by the company. The company said that it will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed. "We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel," the company stated. The company also said that the users can manually update their browsers through the settings features. However, the browser will automatically update within a few days. Read latest on personal information and search results Meanwhile, Google has announced an expansion of the list of personal content that it's planning to remove from search results to cover things like physical address, phone number, passwords, credit card numbers, bank account IDs, or photos of your handwritten signatures. Google is also planning to remove things like 'non-consensual explicit or intimate personal images,' pornographic deep fakes, or links to sites with 'exploitative removal practices.' As per reports from The Verge, Google is providing the new options because 'the internet is always evolving' and its search engine giving out your phone number or home address can be quite dangerous. WATCH WION LIVE HERE × (With inputs from agencies)

Warning to billions of Chrome users! Google says browser successfully targeted by hackers

The website of&nbsp;Gazprom&nbsp;Neft, the oil arm of Russian state gas giant&nbsp;Gazprom, went down on Wednesday (April 6) after an apparent hack, in what looked like the latest attack on government-linked sites following Russia's actions in Ukraine.

The website briefly showed a statement purporting to be from&nbsp;Gazprom&nbsp;chief executive Alexei Miller, a close ally of President Vladimir Putin.

Miller last month urged the gas giant's 500,000 employees to rally around Putin to preserve Russia as a great power in the face of foreign hostility.

Also read |&nbsp;<a href="https://www.wionews.com/world/russia-ukraine-war-us-threatens-beijing-with-sanctions-if-it-provides-material-support-to-moscow-468963">Russia-Ukraine war: US threatens Beijing with sanctions if it provides ‘material support’ to Moscow</a>

The statement attributed to him on what looked like a hacked version of the site cited him as making critical comments about Russia's decision to send tens of thousands of troops into neighbouring Ukraine, where thousands of soldiers and civilians have been killed.

The website stopped working soon afterwards.

Watch |&nbsp;Gravitas Global Headlines: Zelensky addresses Irish Parliament | Candlelight vigil for war victims

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/gravitas-global-headlines-zelensky-addresses-irish-parliament-candlelight-vigil-for-war-victims-468942/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

"The information published on the site on the morning of April 6 ... is not true and cannot be regarded as an official statement of the company's representatives or shareholders,"&nbsp;Gazprom&nbsp;Neft said.

A&nbsp;Gazprom&nbsp;spokesperson dismissed the statement on the website as nonsense.

Also read |&nbsp;<a href="https://www.wionews.com/world/ukrainian-president-volodymyr-zelensky-says-russia-hiding-thousands-killed-in-mariupol-468954">Ukrainian President Volodymyr Zelensky says Russia hiding 'thousands' killed in Mariupol</a>

The website of the state news agency TASS was hacked in February to show a message calling for Moscow to halt what it calls its "special operation" in Ukraine.

The website of Gazprom Neft, the oil arm of Russian state gas giant Gazprom, went down on Wednesday (April 6) after an apparent hack, in what looked like the latest attack on government-linked sites following Russia's actions in Ukraine.

The website of Gazprom Neft, the oil arm of Russian state gas giant Gazprom, went down on Wednesday (April 6) after an apparent hack, in what looked like the latest attack on government-linked sites following Russia's actions in Ukraine. The website briefly showed a statement purporting to be from Gazprom chief executive Alexei Miller, a close ally of President Vladimir Putin. Miller last month urged the gas giant's 500,000 employees to rally around Putin to preserve Russia as a great power in the face of foreign hostility. Also read | Russia-Ukraine war: US threatens Beijing with sanctions if it provides ‘material support’ to Moscow The statement attributed to him on what looked like a hacked version of the site cited him as making critical comments about Russia's decision to send tens of thousands of troops into neighbouring Ukraine, where thousands of soldiers and civilians have been killed. The website stopped working soon afterwards. Watch | Gravitas Global Headlines: Zelensky addresses Irish Parliament | Candlelight vigil for war victims "The information published on the site on the morning of April 6 ... is not true and cannot be regarded as an official statement of the company's representatives or shareholders," Gazprom Neft said. A Gazprom spokesperson dismissed the statement on the website as nonsense. Also read | Ukrainian President Volodymyr Zelensky says Russia hiding 'thousands' killed in Mariupol The website of the state news agency TASS was hacked in February to show a message calling for Moscow to halt what it calls its "special operation" in Ukraine.

Website of Russian oil company Gazprom Neft goes down after apparent hack

Were Apple and Meta compromised? A report has claimed that the tech giants gave user data to hackers who forged legal requests. Palki Sharma tells you more.

Gravitas: Apple and Meta gave user data to hackers

A passenger flying on India's IndiGo airline said that he hacked the airline's website after he lost his baggage. Nandan Kumar, the passenger, took to Twitter and described the sequence of events tagging IndiGo.

"Hey IndiGo, want to hear a story? And at the end of it I will tell you hole (technical vulnerability )in your system?", read Kumar's first tweet posted on March 28

In his tweet thread, Kumar has mentioned that he took an IndiGo flight from Patna to Bengaluru on March 27. His bag got exchanged with that of a fellow passenger as both of them were nearly identical.

"After multiple calls and navigating through @IndiGo6E IVR and of course a lot of wait I was able to connect to one of your customer care agents and they tried to connect me with the co-passenger. But all in vain. 4/n" reads one of his tweets in the thread.

Kumar says that he requested the airline to provide contact details of the other passenger. The customer care agent declined this request citing privacy and data protection rules. However, the agent said that the airline will get back to Kumar once the other passenger was contacted.

Kumar says as he didn't get a response even the next day, he decided to check the developer console on IndiGo website by pressing F12.

"So now, after all the failed attempts, my dev instinct kicked in and I pressed the F12 button on my computer keyboard and opened the developer console on the @IndiGo6E website and started the whole checkin flow with network log record on," he says.

Nandan Kumar said in subsequent tweets that he got his co-passenger's number and they met to return each other the correct baggage.

Here's the complete Twitter thread.

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet">
Hey <a href="https://twitter.com/IndiGo6E?ref_src=twsrc%5Etfw">@IndiGo6E</a> , 
Want to hear a story? And at the end of it I will tell you hole (technical vulnerability )in your system? <a href="https://twitter.com/hashtag/dev?src=hash&amp;ref_src=twsrc%5Etfw">#dev</a> <a href="https://twitter.com/hashtag/bug?src=hash&amp;ref_src=twsrc%5Etfw">#bug</a> <a href="https://twitter.com/hashtag/bugbounty?src=hash&amp;ref_src=twsrc%5Etfw">#bugbounty</a> 😝😝 1/n
— Nandan kumar (@_sirius93_) <a href="https://twitter.com/_sirius93_/status/1508423479594733568?ref_src=twsrc%5Etfw">March 28, 2022</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

&nbsp;

IndiGo has denied that its website was hacked. The airline has posted a statement at the end of Nandan Kumar's thread.

"The airline said in its statement that its "IT processes are completely robust and, at no point was the IndiGo website compromised"

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet">
<a href="https://t.co/GnnGKypGGJ">pic.twitter.com/GnnGKypGGJ</a>
— IndiGo (@IndiGo6E) <a href="https://twitter.com/IndiGo6E/status/1508748146717130758?ref_src=twsrc%5Etfw">March 29, 2022</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

&nbsp;

A passenger flying on India's IndiGo airline said that he hacked the airline's website after he lost his baggage. Nandan Kumar, the passenger, took to Twitter and described the sequence of events tagging IndiGo.

A passenger flying on India's IndiGo airline said that he hacked the airline's website after he lost his baggage. Nandan Kumar, the passenger, took to Twitter and described the sequence of events tagging IndiGo. "Hey IndiGo, want to hear a story? And at the end of it I will tell you hole (technical vulnerability )in your system?", read Kumar's first tweet posted on March 28 In his tweet thread, Kumar has mentioned that he took an IndiGo flight from Patna to Bengaluru on March 27. His bag got exchanged with that of a fellow passenger as both of them were nearly identical. "After multiple calls and navigating through @IndiGo6E IVR and of course a lot of wait I was able to connect to one of your customer care agents and they tried to connect me with the co-passenger. But all in vain. 4/n" reads one of his tweets in the thread. Kumar says that he requested the airline to provide contact details of the other passenger. The customer care agent declined this request citing privacy and data protection rules. However, the agent said that the airline will get back to Kumar once the other passenger was contacted. Kumar says as he didn't get a response even the next day, he decided to check the developer console on IndiGo website by pressing F12. "So now, after all the failed attempts, my dev instinct kicked in and I pressed the F12 button on my computer keyboard and opened the developer console on the @IndiGo6E website and started the whole checkin flow with network log record on," he says. Nandan Kumar said in subsequent tweets that he got his co-passenger's number and they met to return each other the correct baggage. Here's the complete Twitter thread. Hey @IndiGo6E , Want to hear a story? And at the end of it I will tell you hole (technical vulnerability )in your system? #dev #bug #bugbounty 😝😝 1/n — Nandan kumar (@_sirius93_) March 28, 2022 × IndiGo has denied that its website was hacked. The airline has posted a statement at the end of Nandan Kumar's thread. "The airline said in its statement that its "IT processes are completely robust and, at no point was the IndiGo website compromised" pic.twitter.com/GnnGKypGGJ — IndiGo (@IndiGo6E) March 29, 2022 ×

IndiGo website 'hacked' by passenger after losing baggage

Apple Inc and Meta provided their customer data to hackers who pretended to be enforcement officials, according to three people with knowledge of this matter, reported news agency AFP on Wednesday (March 30) citing a company source.&nbsp;

As per the report, both Apple and Meta provided their basic subscriber details such as the customer's address, phone number, IP address in mid-2021 in response to the forged "emergency data requests".&nbsp;

According to people such demands are usually provided with a search warrant or subpoena signed by a judge. However, emergency requests don't require a court order.&nbsp;

The report mentioned that the same hackers sent a forged legal request to Snap Inc, but it's unclear whether the company has provided the data in response. It's also unclear that hoe many times the company has provided data in response to forged legal requests.&nbsp;

Also read |&nbsp;<a href="https://www.wionews.com/india-news/how-a-group-of-student-photographers-from-india-caught-apple-ceo-tim-cooks-attention-466671">How a group of student photographers from India caught Apple CEO Tim Cook's attention</a>

As per the reports, cybersecurity experts suspect that some of the hackers are sending these forged requests are minors located in the UK and the US.&nbsp;

Seven people were recently arrested by the City of London Police in connection with an investigation into the lapsus$ hacking group, the investigation is still going.&nbsp;

An Apple representative referred a section of its law enforcement guidelines to Bloomberg News. According to the guidelines, a government supervisor or law enforcement agent who submitted the request "may be called and asked to confirm to Apple that the emergency request was legitimate".&nbsp;

Also read |<a href="https://www.wionews.com/technology/625-million-in-ether-stolen-in-one-of-the-biggest-crypto-heists-466848">&nbsp;$625 million in Ether stolen in one of the biggest crypto heists</a>

In response, Meta spokesperson Andy Stone said, "We review every data request for legal sufficiency and use advanced systems and processes to validate law enforcement requests and detect abuse."&nbsp;

"We block known compromised accounts from making requests and work with law enforcement to respond to incidents involving suspected fraudulent requests, as we have done in this case," Stone added.&nbsp;

Cyber expert Brian Krebs wrote on Tuesday that criminal hackers have been compromising email accounts or websites tied to police or government and claiming they can't wait for a judge's order for information because it's an "urgent matter of life and death".&nbsp;

Krebs noted that the lack of a unitary, national system for these type of requests is one of the key problems associated with them, as companies end up deciding how to deal with them.&nbsp;

"To make matters more complicated, there are tens of thousands of police jurisdictions around the world — including roughly 18,000 in the United States alone&nbsp;— and all it takes for hackers to succeed is illicit access to a single police email account," he wrote.&nbsp;

WATCH | Facebook's parent company Meta gave user data to hackers&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/facebooks-parent-company-meta-gave-user-data-to-hackers-467090/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>
</div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

(With inputs from agencies)&nbsp;

Apple Inc and Meta provided their customer data to hackers who pretended to be enforcement officials, according to three people with knowledge of this matter, reported news agency AFP on Wednesday (March 30) citing a company source.

Apple Inc and Meta provided their customer data to hackers who pretended to be enforcement officials, according to three people with knowledge of this matter, reported news agency AFP on Wednesday (March 30) citing a company source. As per the report, both Apple and Meta provided their basic subscriber details such as the customer's address, phone number, IP address in mid-2021 in response to the forged "emergency data requests". According to people such demands are usually provided with a search warrant or subpoena signed by a judge. However, emergency requests don't require a court order. The report mentioned that the same hackers sent a forged legal request to Snap Inc, but it's unclear whether the company has provided the data in response. It's also unclear that hoe many times the company has provided data in response to forged legal requests. Also read | How a group of student photographers from India caught Apple CEO Tim Cook's attention As per the reports, cybersecurity experts suspect that some of the hackers are sending these forged requests are minors located in the UK and the US. Seven people were recently arrested by the City of London Police in connection with an investigation into the lapsus$ hacking group, the investigation is still going. An Apple representative referred a section of its law enforcement guidelines to Bloomberg News. According to the guidelines, a government supervisor or law enforcement agent who submitted the request "may be called and asked to confirm to Apple that the emergency request was legitimate". Also read | $625 million in Ether stolen in one of the biggest crypto heists In response, Meta spokesperson Andy Stone said, "We review every data request for legal sufficiency and use advanced systems and processes to validate law enforcement requests and detect abuse." "We block known compromised accounts from making requests and work with law enforcement to respond to incidents involving suspected fraudulent requests, as we have done in this case," Stone added. Cyber expert Brian Krebs wrote on Tuesday that criminal hackers have been compromising email accounts or websites tied to police or government and claiming they can't wait for a judge's order for information because it's an "urgent matter of life and death". Krebs noted that the lack of a unitary, national system for these type of requests is one of the key problems associated with them, as companies end up deciding how to deal with them. "To make matters more complicated, there are tens of thousands of police jurisdictions around the world — including roughly 18,000 in the United States alone — and all it takes for hackers to succeed is illicit access to a single police email account," he wrote. WATCH | Facebook's parent company Meta gave user data to hackers × (With inputs from agencies)

Apple and Meta give user data to hackers who pretended to be enforcement officials: Report

When the United States barred Americans from doing business with Russian banks, oil and gas developers and other companies in 2014, after the country’s invasion of Crimea, the hit to Russia’s economy was swift and immense. Economists estimated that sanctions imposed by Western nations cost Russia $50 billion a year.

Since then, the global market for cryptocurrencies and other digital assets has ballooned. That is bad news for enforcers of sanctions and good news for Russia.

On Tuesday, the Biden administration enacted fresh sanctions on Russia over the conflict in Ukraine, aiming to thwart its access to foreign capital. But Russian entities are preparing to blunt some of the worst effects by making deals with anyone around the world willing to work with them, experts said. And, they say, those entities can then use digital currencies to bypass the control points that governments rely on — mainly transfers of money by banks — to block deal execution.

“Russia has had a lot of time to think about this specific consequence,” said Michael Parker, a former federal prosecutor who now heads the anti-money laundering and sanctions practice at Washington, D.C., law firm Ferrari &amp; Associates. “It would be naive to think that they haven’t gamed out exactly this scenario.”

Sanctions are some of the most powerful tools the United States and European countries have to influence the behavior of nations they don’t consider allies. The United States in particular is able to use sanctions as a diplomatic tool because the dollar is the world’s reserve currency and used in payments worldwide. But American government officials are increasingly aware of the potential for cryptocurrencies to lessen the impact of sanctions and are stepping up their scrutiny of digital assets.

To apply sanctions, a government makes a list of people and businesses its citizens must avoid. Anyone caught engaging with a member of the list faces heavy fines. But the real key to any effective sanctions program is the global financial system. Banks around the world play a major role in enforcement: They see where money comes from and where it is bound, and anti-money laundering laws require them to block transactions with sanctioned entities and report what they see to authorities. But if banks are the eyes and ears of governments in this space, the explosion of digital currencies is blinding them.

Banks have to abide by “know your customer” rules, which include verifying their clients’ identities. But exchanges and other platforms that facilitate the buying and selling of cryptocurrencies and digital assets are rarely as good at tracking their customers as banks are, even though they are supposed to follow the same rules. In October, the U.S. Treasury Department warned that cryptocurrencies posed an increasingly serious threat to the U.S. sanctions program and that U.S. authorities needed to educate themselves about the technology.

Should it choose to evade sanctions, Russia has multiple cryptocurrency-related tools at its disposal, experts said. All it needs is to find ways to trade without touching the dollar.

The Russian government is developing its own central bank digital currency, a so-called digital ruble that it hopes to use to trade directly with other countries willing to accept it without first converting it into dollars. Hacking techniques like ransomware could help Russian actors steal digital currencies and make up revenue lost to sanctions.

And while cryptocurrency transactions are recorded on the underlying blockchain, making them transparent, new tools developed in Russia can help mask the origin of such transactions. That would allow businesses to trade with Russian entities without detection.

There is a precedent for these kinds of workarounds. Iran and North Korea are among countries that have used digital currencies to mitigate the effects of Western sanctions, a trend that U.S. and United Nations officials have recently observed. North Korea, for instance, has used ransomware to steal cryptocurrency to fund its nuclear program, according to a U.N. report.

In October 2020, representatives of Russia’s central bank told a Moscow newspaper that the new “digital ruble” would make the country less dependent on the United States and better able to resist sanctions. It would let Russian entities conduct transactions outside the international banking system with any country willing to trade in digital currency.

Russia could find willing partners in other nations targeted by U.S. sanctions, including Iran, that are also developing government-backed digital currencies. China, Russia’s largest trading partner in both imports and exports according to the World Bank, has already launched its own central bank digital currency. The country’s leader, Xi Jinping, recently described China’s relationship with Russia as having “no limits.”

The developing system of central banks directly exchanging digital currencies creates new risks, said Yaya Fanusie, a fellow at the Center for a New American Security who has studied the effects of cryptocurrency on sanctions. “The lessening of U.S. sanctions power comes from a system where these nation states are able to do transactions without going through the global banking system.”

In early February, independent sanctions monitors told the U.N. Security Council that North Korea was using cryptocurrencies to fund its nuclear and ballistic missile program, according to Reuters. (A spokesperson for Norway’s permanent mission to the U.N. confirmed the existence of the report, which has not yet been made public.) In May, consulting firm Elliptic described how Iran was using revenue from Bitcoin mining to make up for the limitations on its ability to sell oil because of sanctions.

Sanctioned Russian entities could deploy their own evasion strategy, using ransomware attacks. The playbook is straightforward: A hacker breaks into computer networks and locks up digital information until the victim pays for its release, usually in cryptocurrency.

Russia is at the center of the growing ransomware industry. Last year, about 74% of global ransomware revenue, or more than $400 million worth of cryptocurrency, went to entities that are probably affiliated with Russia in some way, according to a Feb. 14 report by blockchain-tracking firm Chainalysis.

Illegal funds have also flowed into Russia through a dark web marketplace called Hydra, which is powered by cryptocurrency and handled more than $1 billion in sales in 2020, according to Chainalysis. The platform’s strict rules — sellers are allowed to liquidate cryptocurrency only through certain regional exchanges — have made it difficult for researchers to follow the money.

“We know that there’s no questions asked, and we know that Hydra operates not just throughout Eastern Europe but throughout western Europe,” said Kim Grauer, director of research at Chainalysis. “There’s definitely cross-border business happening.”

Digital currencies all use blockchain technology, a form of computer code that is publicly viewable by anyone, anywhere. This public ledger keeps track of the movements of individual digital coins from one “wallet” — as online repositories for digital assets are called — to another. In theory, this should let authorities track all crypto transactions and keep sanctioned entities from completing them.

But the technology behind Hydra masks the source of transactions, offering a potential tool for Russian users to move money outside the country’s borders. On its own, Hydra is not yet big enough to handle the volume of transactions that Russia would need to successfully evade sanctions. But other money-laundering techniques — including “nesting,” in which an illicit marketplace buries itself within a larger, legitimate structure to hide its activities — could also help.

There are signs that the United States is stepping up its monitoring of cryptocurrency activity. On Feb. 17, the Justice Department announced it had created a new national cryptocurrency enforcement team, a move that seemed to emphasize that federal prosecutors were paying extra attention to bad behavior among cryptocurrency users.

Parker, the former prosecutor, said that the Feb. 8 arrests of a Manhattan couple for stealing $3.6 billion in Bitcoin from Hong Kong cryptocurrency exchange Bitfinex is “a tangible example of the government getting very good and up to speed on what they need to do to be able to trace this.”

Administration officials are also urging the cryptocurrency industry to implement internal controls that prevent bad actors from using their services. In October, the Treasury Department published a 30-page sanctions-compliance manual recommending that cryptocurrency companies use geolocation tools to weed out customers in sanctioned jurisdictions. In many cases, the report said, crypto companies have taken months or years to implement such compliance procedures.

That may change as the industry starts to mature. Chainalysis offers a “know your transaction” tool that alerts companies when blacklisted entities use their services. Last year, the company doubled its number of private-sector customers, many of whom use the compliance tool.

But savvy cryptocurrency users can find ways around a blacklist.

“A Treasury designation of a crypto wallet address is not foolproof,” said Fanusie of the Center for a New American Security. “That designated actor can still open up a new wallet elsewhere. You can do that quite easily.”

When the United States barred Americans from doing business with Russian banks, oil and gas developers and other companies in 2014, after the country’s invasion of Crimea, the hit to Russia’s economy was swift and immense.

When the United States barred Americans from doing business with Russian banks, oil and gas developers and other companies in 2014, after the country’s invasion of Crimea, the hit to Russia’s economy was swift and immense. Economists estimated that sanctions imposed by Western nations cost Russia $50 billion a year. Since then, the global market for cryptocurrencies and other digital assets has ballooned. That is bad news for enforcers of sanctions and good news for Russia. On Tuesday, the Biden administration enacted fresh sanctions on Russia over the conflict in Ukraine, aiming to thwart its access to foreign capital. But Russian entities are preparing to blunt some of the worst effects by making deals with anyone around the world willing to work with them, experts said. And, they say, those entities can then use digital currencies to bypass the control points that governments rely on — mainly transfers of money by banks — to block deal execution. “Russia has had a lot of time to think about this specific consequence,” said Michael Parker, a former federal prosecutor who now heads the anti-money laundering and sanctions practice at Washington, D.C., law firm Ferrari & Associates. “It would be naive to think that they haven’t gamed out exactly this scenario.” Sanctions are some of the most powerful tools the United States and European countries have to influence the behavior of nations they don’t consider allies. The United States in particular is able to use sanctions as a diplomatic tool because the dollar is the world’s reserve currency and used in payments worldwide. But American government officials are increasingly aware of the potential for cryptocurrencies to lessen the impact of sanctions and are stepping up their scrutiny of digital assets. To apply sanctions, a government makes a list of people and businesses its citizens must avoid. Anyone caught engaging with a member of the list faces heavy fines. But the real key to any effective sanctions program is the global financial system. Banks around the world play a major role in enforcement: They see where money comes from and where it is bound, and anti-money laundering laws require them to block transactions with sanctioned entities and report what they see to authorities. But if banks are the eyes and ears of governments in this space, the explosion of digital currencies is blinding them. Banks have to abide by “know your customer” rules, which include verifying their clients’ identities. But exchanges and other platforms that facilitate the buying and selling of cryptocurrencies and digital assets are rarely as good at tracking their customers as banks are, even though they are supposed to follow the same rules. In October, the U.S. Treasury Department warned that cryptocurrencies posed an increasingly serious threat to the U.S. sanctions program and that U.S. authorities needed to educate themselves about the technology. Should it choose to evade sanctions, Russia has multiple cryptocurrency-related tools at its disposal, experts said. All it needs is to find ways to trade without touching the dollar. The Russian government is developing its own central bank digital currency, a so-called digital ruble that it hopes to use to trade directly with other countries willing to accept it without first converting it into dollars. Hacking techniques like ransomware could help Russian actors steal digital currencies and make up revenue lost to sanctions. And while cryptocurrency transactions are recorded on the underlying blockchain, making them transparent, new tools developed in Russia can help mask the origin of such transactions. That would allow businesses to trade with Russian entities without detection. There is a precedent for these kinds of workarounds. Iran and North Korea are among countries that have used digital currencies to mitigate the effects of Western sanctions, a trend that U.S. and United Nations officials have recently observed. North Korea, for instance, has used ransomware to steal cryptocurrency to fund its nuclear program, according to a U.N. report. In October 2020, representatives of Russia’s central bank told a Moscow newspaper that the new “digital ruble” would make the country less dependent on the United States and better able to resist sanctions. It would let Russian entities conduct transactions outside the international banking system with any country willing to trade in digital currency. Russia could find willing partners in other nations targeted by U.S. sanctions, including Iran, that are also developing government-backed digital currencies. China, Russia’s largest trading partner in both imports and exports according to the World Bank, has already launched its own central bank digital currency. The country’s leader, Xi Jinping, recently described China’s relationship with Russia as having “no limits.” The developing system of central banks directly exchanging digital currencies creates new risks, said Yaya Fanusie, a fellow at the Center for a New American Security who has studied the effects of cryptocurrency on sanctions. “The lessening of U.S. sanctions power comes from a system where these nation states are able to do transactions without going through the global banking system.” In early February, independent sanctions monitors told the U.N. Security Council that North Korea was using cryptocurrencies to fund its nuclear and ballistic missile program, according to Reuters. (A spokesperson for Norway’s permanent mission to the U.N. confirmed the existence of the report, which has not yet been made public.) In May, consulting firm Elliptic described how Iran was using revenue from Bitcoin mining to make up for the limitations on its ability to sell oil because of sanctions. Sanctioned Russian entities could deploy their own evasion strategy, using ransomware attacks. The playbook is straightforward: A hacker breaks into computer networks and locks up digital information until the victim pays for its release, usually in cryptocurrency. Russia is at the center of the growing ransomware industry. Last year, about 74% of global ransomware revenue, or more than $400 million worth of cryptocurrency, went to entities that are probably affiliated with Russia in some way, according to a Feb. 14 report by blockchain-tracking firm Chainalysis. Illegal funds have also flowed into Russia through a dark web marketplace called Hydra, which is powered by cryptocurrency and handled more than $1 billion in sales in 2020, according to Chainalysis. The platform’s strict rules — sellers are allowed to liquidate cryptocurrency only through certain regional exchanges — have made it difficult for researchers to follow the money. “We know that there’s no questions asked, and we know that Hydra operates not just throughout Eastern Europe but throughout western Europe,” said Kim Grauer, director of research at Chainalysis. “There’s definitely cross-border business happening.” Digital currencies all use blockchain technology, a form of computer code that is publicly viewable by anyone, anywhere. This public ledger keeps track of the movements of individual digital coins from one “wallet” — as online repositories for digital assets are called — to another. In theory, this should let authorities track all crypto transactions and keep sanctioned entities from completing them. But the technology behind Hydra masks the source of transactions, offering a potential tool for Russian users to move money outside the country’s borders. On its own, Hydra is not yet big enough to handle the volume of transactions that Russia would need to successfully evade sanctions. But other money-laundering techniques — including “nesting,” in which an illicit marketplace buries itself within a larger, legitimate structure to hide its activities — could also help. There are signs that the United States is stepping up its monitoring of cryptocurrency activity. On Feb. 17, the Justice Department announced it had created a new national cryptocurrency enforcement team, a move that seemed to emphasize that federal prosecutors were paying extra attention to bad behavior among cryptocurrency users. Parker, the former prosecutor, said that the Feb. 8 arrests of a Manhattan couple for stealing $3.6 billion in Bitcoin from Hong Kong cryptocurrency exchange Bitfinex is “a tangible example of the government getting very good and up to speed on what they need to do to be able to trace this.” Administration officials are also urging the cryptocurrency industry to implement internal controls that prevent bad actors from using their services. In October, the Treasury Department published a 30-page sanctions-compliance manual recommending that cryptocurrency companies use geolocation tools to weed out customers in sanctioned jurisdictions. In many cases, the report said, crypto companies have taken months or years to implement such compliance procedures. That may change as the industry starts to mature. Chainalysis offers a “know your transaction” tool that alerts companies when blacklisted entities use their services. Last year, the company doubled its number of private-sector customers, many of whom use the compliance tool. But savvy cryptocurrency users can find ways around a blacklist. “A Treasury designation of a crypto wallet address is not foolproof,” said Fanusie of the Center for a New American Security. “That designated actor can still open up a new wallet elsewhere. You can do that quite easily.”

Russia could use cryptocurrency to blunt the force of US sanctions

Hackers have stolen cryptocurrency worth more than $320 million from a decentralised finance platform, the fourth-largest crypto heist on record and the latest to shake the fast-growing DeFi sector.

Wormhole, a site that allows the transfer of information from one crypto network to another, said on Twitter on Wednesday that it was "exploited" for 120,000 units of a version of the second-largest cryptocurrency, ether.

Wormhole did not immediately respond to a Reuters request for comment.

London-based blockchain analysis firm Elliptic said that attackers were able to fraudulently create the wETH tokens, almost 94,000 of which were later transferred to the ethereum blockchain, which powers transactions for ether.

Wormhole said in another tweet early on Thursday that it had fixed the vulnerability in its system but was still working to get the network back up.

So-called DeFi platforms allow users to lend, borrow and save - usually in cryptocurrencies - while bypassing traditional gatekeepers of finance such as banks.

Cash has poured into DeFi sites, mirroring the explosion of interest in cryptocurrencies as a whole. Many investors, facing historically low or sub-zero interest rates, are drawn to DeFi by the promise of high returns on savings.

Yet with their breakneck growth, DeFi platforms have emerged as a major hacking risk, with bugs in code and design flaws allowing criminals to target DeFi sites and deep pools of liquidity, and also to launder the proceeds of crime, while leaving few traces.

Fraud and theft at DeFi platforms surpassed $10 billion last year, research showed on Thursday, laying bare the risks in the fast-growing but mostly unregulated area of cryptocurrencies.

In August, hackers behind likely the biggest ever digital coin heist returned nearly all of the $610 million-plus they stole from the DeFi site Poly Network.

Hacks have long plagued crypto platforms. In 2018, digital tokens worth some $530 million were stolen from Tokyo-based platform Coincheck. Mt. Gox, another Japanese exchange, collapsed in 2014 after hackers stole half a billion dollars of crypto.

Hackers have stolen cryptocurrency worth more than $320 million from a decentralised finance platform, the fourth-largest crypto heist on record and the latest to shake the fast-growing DeFi sector.

Hackers have stolen cryptocurrency worth more than $320 million from a decentralised finance platform, the fourth-largest crypto heist on record and the latest to shake the fast-growing DeFi sector. Wormhole, a site that allows the transfer of information from one crypto network to another, said on Twitter on Wednesday that it was "exploited" for 120,000 units of a version of the second-largest cryptocurrency, ether. Wormhole did not immediately respond to a Reuters request for comment. London-based blockchain analysis firm Elliptic said that attackers were able to fraudulently create the wETH tokens, almost 94,000 of which were later transferred to the ethereum blockchain, which powers transactions for ether. Wormhole said in another tweet early on Thursday that it had fixed the vulnerability in its system but was still working to get the network back up. So-called DeFi platforms allow users to lend, borrow and save - usually in cryptocurrencies - while bypassing traditional gatekeepers of finance such as banks. Cash has poured into DeFi sites, mirroring the explosion of interest in cryptocurrencies as a whole. Many investors, facing historically low or sub-zero interest rates, are drawn to DeFi by the promise of high returns on savings. Yet with their breakneck growth, DeFi platforms have emerged as a major hacking risk, with bugs in code and design flaws allowing criminals to target DeFi sites and deep pools of liquidity, and also to launder the proceeds of crime, while leaving few traces. Fraud and theft at DeFi platforms surpassed $10 billion last year, research showed on Thursday, laying bare the risks in the fast-growing but mostly unregulated area of cryptocurrencies. In August, hackers behind likely the biggest ever digital coin heist returned nearly all of the $610 million-plus they stole from the DeFi site Poly Network. Hacks have long plagued crypto platforms. In 2018, digital tokens worth some $530 million were stolen from Tokyo-based platform Coincheck. Mt. Gox, another Japanese exchange, collapsed in 2014 after hackers stole half a billion dollars of crypto.

Crypto platform Wormhole hit by $320 million hack

Iranian state broadcaster was hacked on Thursday. Dissents hijacked the broadcast - and called for the death of Iran's Supreme Leader. Tehran is blaming an old enemy for the hack. Palki Sharma tells you.

Gravitas: Iran State TV hacked, broadcast calls for Khamenei's death

Several channels of Iran’s state television were hacked allegedly by exiled dissident groups who showed graphic images calling for the death of the country’s supreme leader, Ayatollah Khamenei.

For several seconds on Thursday, viewers across the country witnessed the image of Khamenei crossed out with red lines appearing on the screen while a man shouted, “Salute to Rajavi, death to Khamenei”.

Massoud Rajavi is the founder of exiled Iranian politico-militant group People's Mujahedin (MEK).&nbsp;

Rajavi and his wife Maryam Rajavi lead the group’s political wing the National Council of Resistance of Iran (NCRI) in Paris.

Later, a speech of Rajavi briefly plays over the images, where he was heard saying, ‘Today, we still honour the time that we declared death to the reactionary. We stood by it.”

Massoud Rajavi hasn’t been seen publicly in nearly two decades and is presumed to have died. Maryam Rajavi now reportedly runs the MEK.

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet">
<a href="https://twitter.com/hashtag/BreakingNews?src=hash&amp;ref_src=twsrc%5Etfw">#BreakingNews</a> <a href="https://twitter.com/hashtag/Iran?src=hash&amp;ref_src=twsrc%5Etfw">#Iran</a> mullahs regime TV Channel 1 was hacked by Iranian defiant youth! 
The posters of Iranian resistance leaders (Massoud and <a href="https://twitter.com/Maryam_Rajavi?ref_src=twsrc%5Etfw">@Maryam_Rajavi</a>) were broadcasted. <a href="https://twitter.com/FoxNews?ref_src=twsrc%5Etfw">@FoxNews</a> <a href="https://twitter.com/RadioFarda_?ref_src=twsrc%5Etfw">@RadioFarda_</a> <a href="https://twitter.com/AFP?ref_src=twsrc%5Etfw">@AFP</a> <a href="https://twitter.com/hashtag/MEK?src=hash&amp;ref_src=twsrc%5Etfw">#MEK</a> <a href="https://twitter.com/hashtag/PMOI?src=hash&amp;ref_src=twsrc%5Etfw">#PMOI</a> <a href="https://twitter.com/hashtag/NCRI?src=hash&amp;ref_src=twsrc%5Etfw">#NCRI</a> <a href="https://t.co/vRvDE3f1uY">pic.twitter.com/vRvDE3f1uY</a>
— Mitra Motamed (@MitraMotamed) <a href="https://twitter.com/MitraMotamed/status/1486683125652598785?ref_src=twsrc%5Etfw">January 27, 2022</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

Iran’s state TV authorities acknowledged the incident as a “hack” and said that they would investigate the intrusion.

They said that the attack may have been carried out with help from foreigners.

However, the MEK group distanced itself from the incident.

Speaking to news agency The Associated Press, Shahin Gobadi, a Paris-based MEK spokesperson said, “We, like you, were just informed about the issue.”

“It appears that it was done by supporters of the MEK and resistance units within the regime’s radio and television stations,” he said, without directly claiming responsibility.

He offered no evidence to support his assertion, AP reported.

Widely regarded as a cult, the MEK was once designated as a terrorist organisation by the US and UK,

The MEK began as a Marxist group opposing the rule of Shah Mohammad Reza Pahlavi. It claimed and was suspected in a series of attacks against US&nbsp;officials in Iran in the 1970s, something the group now denies.

It supported the 1979 Islamic Revolution, but soon had a falling out with Khomeini and turned against the clerical regime. It carried out a series of assassinations and bombings targeting the young Islamic Republic.

Since its exile from Iran in the early 1980s, the MEK has been committed to the overthrow of the Islamic republic.

The MEK later fled into Iraq and backed dictator Saddam Hussein during his bloody eight-year war against Iran in the 1980s. That saw many oppose the group in Iran.

Although largely based in Albania, to this day the group claims to operate a network inside Iran.

(With inputs from agencies)

Several channels of Iran’s state television were hacked allegedly by exiled dissident groups who showed graphic images calling for the death of the country’s supreme leader, Ayatollah Khamenei.

Several channels of Iran’s state television were hacked allegedly by exiled dissident groups who showed graphic images calling for the death of the country’s supreme leader, Ayatollah Khamenei. For several seconds on Thursday, viewers across the country witnessed the image of Khamenei crossed out with red lines appearing on the screen while a man shouted, “Salute to Rajavi, death to Khamenei”. Massoud Rajavi is the founder of exiled Iranian politico-militant group People's Mujahedin (MEK). Rajavi and his wife Maryam Rajavi lead the group’s political wing the National Council of Resistance of Iran (NCRI) in Paris. Later, a speech of Rajavi briefly plays over the images, where he was heard saying, ‘Today, we still honour the time that we declared death to the reactionary. We stood by it.” Massoud Rajavi hasn’t been seen publicly in nearly two decades and is presumed to have died. Maryam Rajavi now reportedly runs the MEK. #BreakingNews #Iran mullahs regime TV Channel 1 was hacked by Iranian defiant youth! The posters of Iranian resistance leaders (Massoud and @Maryam_Rajavi) were broadcasted. @FoxNews @RadioFarda_ @AFP #MEK #PMOI #NCRI pic.twitter.com/vRvDE3f1uY — Mitra Motamed (@MitraMotamed) January 27, 2022 × Iran’s state TV authorities acknowledged the incident as a “hack” and said that they would investigate the intrusion. They said that the attack may have been carried out with help from foreigners. However, the MEK group distanced itself from the incident. Speaking to news agency The Associated Press, Shahin Gobadi, a Paris-based MEK spokesperson said, “We, like you, were just informed about the issue.” “It appears that it was done by supporters of the MEK and resistance units within the regime’s radio and television stations,” he said, without directly claiming responsibility. He offered no evidence to support his assertion, AP reported. Widely regarded as a cult, the MEK was once designated as a terrorist organisation by the US and UK, The MEK began as a Marxist group opposing the rule of Shah Mohammad Reza Pahlavi. It claimed and was suspected in a series of attacks against US officials in Iran in the 1970s, something the group now denies. It supported the 1979 Islamic Revolution, but soon had a falling out with Khomeini and turned against the clerical regime. It carried out a series of assassinations and bombings targeting the young Islamic Republic. Since its exile from Iran in the early 1980s, the MEK has been committed to the overthrow of the Islamic republic. The MEK later fled into Iraq and backed dictator Saddam Hussein during his bloody eight-year war against Iran in the 1980s. That saw many oppose the group in Iran. Although largely based in Albania, to this day the group claims to operate a network inside Iran. (With inputs from agencies)

Watch | Iranian state television hacked, ‘death to Khamenei’ chant flashed for several seconds

Israel's Foreign Minister Yair Lapid distanced the government from the NSO Group, a firm blacklisted this week by the United States over alleged misuse of its phone-hacking spyware.

Israeli foreign minister Yair Lapid distances government from blacklisted NSO Group

A group of hackers have leaked personal information, appointment details and test results of nearly 290,000 patients of Israel's Machon Mor medical institute.<o:p></o:p>

Black Shadow, a hacker group linked to Iran, uploaded the directory of patients of an Israeli hospital on Tuesday night. As per the local reports, the data released in public includes names, personal information, vaccine status, appointments and medical test results of more than 290,000 patients of a specific medical center.<o:p></o:p>

Describing this as "one of the most serious attacks on privacy that Israel has ever seen,"&nbsp;the Head of the Israel Internet Association Yoram Hacohen told the Times of Israel that "Israeli citizens are experiencing cyber terrorism... This is terrorism in every sense and the focus now must be on minimizing the damage and suppressing the distribution of the information as much as possible."

<o:p>Also read |&nbsp;<a href="https://www.wionews.com/world/watch-you-are-the-most-popular-man-in-israel-come-and-join-my-party-israeli-pm-naftali-bennett-tells-modi-426193">Watch: You are the most popular man in Israel, come and join my party, Israeli PM Naftali Bennett tells Modi</a></o:p>

He also blamed Telegram for the increase in hacking activities in the country. The chief said that Telegram has failed to establish boundaries and is partially responsible for this as the social media platform does not limit the spread of private information.<o:p></o:p>

This hack of patients' records comes a few hours after the same hacker group released the whole user database of an LGBTQ dating website of the country.<o:p></o:p>

The Iran-backed group, Black Shadow, uploaded information from the database of Atraf LGBTQ dating website on Telegram, during the early hours of Tuesday. The information released included sensitive details about users such as name, age, location, HIV status and more.

<o:p><a href="https://www.wionews.com/videos/cop26-climate-conference-israel-energy-minister-on-wheelchair-stranded-at-glasgow-426134">WATCH |</a></o:p>

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/cop26-climate-conference-israel-energy-minister-on-wheelchair-stranded-at-glasgow-426134/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

This was done by Black Shadow as a punishment to the dating website as the owners of the dating platform had refused to pay a ransom of $1 million in digital currency that the hackers had demanded, in exchange of giving up the private information safely.<o:p></o:p>

In addition to this, the group had also hacked the systems of Israeli internet hosting company, CyberServe, which had adversely affected the LGBTQ dating website, websites of tourism company Pegasus, public transportation company Dan and children's museum Kavim.<o:p></o:p>

Israel claims they are being targeted with cyber crime more frequently now, especially since Iran’s gas distribution system had suffered a major loss due to a similar hack on October 26 — Iran had blamed the US and Israel for their loss.<o:p></o:p>

A group of hackers have leaked personal information, appointment details and test results of nearly 290,000 patients of Israel's Machon Mor medical institute. Black Shadow, a hacker group linked to Iran, uploaded the directory of patients of an Israeli hospital on Tuesday night.

A group of hackers have leaked personal information, appointment details and test results of nearly 290,000 patients of Israel's Machon Mor medical institute. Black Shadow, a hacker group linked to Iran, uploaded the directory of patients of an Israeli hospital on Tuesday night. As per the local reports, the data released in public includes names, personal information, vaccine status, appointments and medical test results of more than 290,000 patients of a specific medical center. Describing this as "one of the most serious attacks on privacy that Israel has ever seen," the Head of the Israel Internet Association Yoram Hacohen told the Times of Israel that "Israeli citizens are experiencing cyber terrorism... This is terrorism in every sense and the focus now must be on minimizing the damage and suppressing the distribution of the information as much as possible." Also read | Watch: You are the most popular man in Israel, come and join my party, Israeli PM Naftali Bennett tells Modi He also blamed Telegram for the increase in hacking activities in the country. The chief said that Telegram has failed to establish boundaries and is partially responsible for this as the social media platform does not limit the spread of private information. This hack of patients' records comes a few hours after the same hacker group released the whole user database of an LGBTQ dating website of the country. The Iran-backed group, Black Shadow, uploaded information from the database of Atraf LGBTQ dating website on Telegram, during the early hours of Tuesday. The information released included sensitive details about users such as name, age, location, HIV status and more. WATCH | This was done by Black Shadow as a punishment to the dating website as the owners of the dating platform had refused to pay a ransom of $1 million in digital currency that the hackers had demanded, in exchange of giving up the private information safely. In addition to this, the group had also hacked the systems of Israeli internet hosting company, CyberServe, which had adversely affected the LGBTQ dating website, websites of tourism company Pegasus, public transportation company Dan and children's museum Kavim. Israel claims they are being targeted with cyber crime more frequently now, especially since Iran’s gas distribution system had suffered a major loss due to a similar hack on October 26 — Iran had blamed the US and Israel for their loss.

Israel: Iran-based hacker group leaks private information of 290,000 patients

After the Biden administration accused China of cyberattack&nbsp;against Microsoft, the Chinese foreign ministry hit back saying the allegations were "unreasonable criticism" and were "fabricated".

"The US has mustered its allies to carry out unreasonable criticisms against China on the issue of cybersecurity, this move is fabricated out of nothing... (and) wholly motivated by political purposes," Zhao Lijian, China's foreign ministry said.

The US government had accused China of hacking Microsoft Exchange in March as it charged four Chinese nationals on Monday even as US Secretary of State Antony Blinken asserted that, "China's Ministry of State Security, or MSS, has fostered an ecosystem of criminal contract hackers."

US President Joe Biden also slammed China saying that the Xi regime was "protecting" and "maybe even accommodating" hackers and compared it to the Russian government.

"China will absolutely not accept this," the country's foreign ministry said, adding, "China does not engage in cyberattacks and the technical details Washington has provided do not constitute a complete chain of evidence."

Microsoft had also earlier blamed China for the cyberattack. NATO, EU and other countries also joined the US to condemn the alleged attempt by China to hack Microsoft.

Australia's home affairs minister Karen Andrews said, "China's Ministry of State Security exploited vulnerabilities in the Microsoft exchange software."&nbsp;

Andrews said Australia won't compromise on its sovereignty and national security over the "malicious cyber attack". The Australian minister hit out saying: "They won't get away with it scot-free."

The Chinese embassy in Washington however hit back saying the accusations were &nbsp;"irresponsible".

(With inputs from Agencies)

After the Biden administration accused China of cyberattack against Microsoft, the Chinese foreign ministry hit back saying the allegations were "unreasonable criticism" and were "fabricated".

After the Biden administration accused China of cyberattack against Microsoft, the Chinese foreign ministry hit back saying the allegations were "unreasonable criticism" and were "fabricated". "The US has mustered its allies to carry out unreasonable criticisms against China on the issue of cybersecurity, this move is fabricated out of nothing... (and) wholly motivated by political purposes," Zhao Lijian, China's foreign ministry said. The US government had accused China of hacking Microsoft Exchange in March as it charged four Chinese nationals on Monday even as US Secretary of State Antony Blinken asserted that, "China's Ministry of State Security, or MSS, has fostered an ecosystem of criminal contract hackers." US President Joe Biden also slammed China saying that the Xi regime was "protecting" and "maybe even accommodating" hackers and compared it to the Russian government. "China will absolutely not accept this," the country's foreign ministry said, adding, "China does not engage in cyberattacks and the technical details Washington has provided do not constitute a complete chain of evidence." Microsoft had also earlier blamed China for the cyberattack. NATO, EU and other countries also joined the US to condemn the alleged attempt by China to hack Microsoft. Australia's home affairs minister Karen Andrews said, "China's Ministry of State Security exploited vulnerabilities in the Microsoft exchange software." Andrews said Australia won't compromise on its sovereignty and national security over the "malicious cyber attack". The Australian minister hit out saying: "They won't get away with it scot-free." The Chinese embassy in Washington however hit back saying the accusations were "irresponsible". (With inputs from Agencies)

US move fabricated out of nothing, unreasonable criticism, says China on Microsoft hacking case

Microsoft believes malware used to infect PCs running its Windows operating system was created by an Israeli organisation.

Microsoft is taking a new effort to reduce internet security issues.

The company has also been looking for government-backed hackers, such as the Chinese organisation Hafnium, which it believes is responsible for attacks on its Exchange Server email software.&nbsp;

The problem was only recently rectified by Microsoft, and it took them a long time to resolve, with several people claiming that it was ineffective for their experience.

The threat actors were revealed to be from the private sector, and the company launched an inquiry to learn more about their genuine motives.&nbsp;

Microsoft's investigation into their latest breach and zero-day vulnerability came from an Israeli private sector business called "Sourgum," according to the company's blog post. 
 
Watch: India rolls out new education policy, teams up with Microsoft

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/india-rolls-out-new-education-policy-teams-up-with-microsoft-389629/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

The company in question is a PSOA, or private sector offensive actor, intending to sell "cyberweapons" to its clients to hack them.&nbsp;

Another group discovered in the investigation is known as "Candiru," and they have been related to Sourgum with regards to the recent Microsoft attack.

While the motives of Candiru are unknown, it poses a direct threat to Microsoft and would be subject to an inquiry in the hopes of apprehending the perpetrator.&nbsp;

(With inputs from agencies)

Microsoft believes malware used to infect PCs running its Windows operating system was created by an Israeli organisation. Microsoft is taking a new effort to reduce internet security issues.

Microsoft believes malware used to infect PCs running its Windows operating system was created by an Israeli organisation. Microsoft is taking a new effort to reduce internet security issues. The company has also been looking for government-backed hackers, such as the Chinese organisation Hafnium, which it believes is responsible for attacks on its Exchange Server email software. The problem was only recently rectified by Microsoft, and it took them a long time to resolve, with several people claiming that it was ineffective for their experience. The threat actors were revealed to be from the private sector, and the company launched an inquiry to learn more about their genuine motives. Microsoft's investigation into their latest breach and zero-day vulnerability came from an Israeli private sector business called "Sourgum," according to the company's blog post. Watch: India rolls out new education policy, teams up with Microsoft The company in question is a PSOA, or private sector offensive actor, intending to sell "cyberweapons" to its clients to hack them. Another group discovered in the investigation is known as "Candiru," and they have been related to Sourgum with regards to the recent Microsoft attack. While the motives of Candiru are unknown, it poses a direct threat to Microsoft and would be subject to an inquiry in the hopes of apprehending the perpetrator. (With inputs from agencies)

Israeli company is behind malware that affected Windows PCs: Microsoft

Facebook said on Thursday that it disrupted Iran-based spying operation that targetted aerospace and defence workers in the US and Europe.&nbsp;

As per head of cyber espionage investigations Mike Dvilyanski, fake accounts posing as company job recruiters or employees were used to dupe targets.

"This effort was highly targeted," Dvilyanski said in a telephone briefing.

"It is hard for us to know how successful this campaign was, but it had all the hallmarks of a well-resourced operation."

A company named Mahak Rayan Afraz tech company in Tehran made some of the malicious code used in the cyber spying campaign. The company has ties to Islamic Revolutionary Guard corps, according to Dvilyanski

Also Read | <a href="https://www.wionews.com/world/iran-not-ready-for-nuclear-talks-until-president-elect-ebrahim-raisi-takes-over-398123">Iran not ready for nuclear talks until President-elect Ebrahim Raisi takes over</a>

Facebook took down 200 accounts it said where used to dupe defense or aerospace industry workers into connecting outside the social network, say by email or at bogus job websites.

The group referred to as "Tortoiseshell" had focused its activities in the Middle East until last year, when it took aim primarily at the United States, according to Dvilyanski.

"This group used various malicious tactics to identify its targets and infect their devices with malware to enable espionage," said Facebook director of threat disruption David Agranovich.

"Our platform was one of the elements of the much broader cross-platform cyber-espionage operation, and its activity on Facebook manifested primarily in social engineering and driving people off-platform."

Malware slipped onto devices of victims was designed to glean information including log-in credentials to email or social media, according to Dvilyanski.

Facebook said it appeared fewer than 200 users may have fallen for the ruse, and that those people have been notified of the deception.

Facebook also blocked some of the booby-trapped website links from being shared at the social network, according to executives.

The US tech giant added that it shared findings with internet industry peers and law enforcement.

"We were only part of this campaign, and we are taking action on our platform," Dvilyanski said.

(With inputs from agencies)

Facebook said on Thursday that it disrupted Iran-based spying operation that targetted aerospace and defence workers in the US and Europe. As per head of cyber espionage investigations Mike Dvilyanski, fake accounts posing as company job recruiters or employees were used to dupe targets.

Facebook said on Thursday that it disrupted Iran-based spying operation that targetted aerospace and defence workers in the US and Europe. As per head of cyber espionage investigations Mike Dvilyanski, fake accounts posing as company job recruiters or employees were used to dupe targets. "This effort was highly targeted," Dvilyanski said in a telephone briefing. "It is hard for us to know how successful this campaign was, but it had all the hallmarks of a well-resourced operation." A company named Mahak Rayan Afraz tech company in Tehran made some of the malicious code used in the cyber spying campaign. The company has ties to Islamic Revolutionary Guard corps, according to Dvilyanski Also Read | Iran not ready for nuclear talks until President-elect Ebrahim Raisi takes over Facebook took down 200 accounts it said where used to dupe defense or aerospace industry workers into connecting outside the social network, say by email or at bogus job websites. The group referred to as "Tortoiseshell" had focused its activities in the Middle East until last year, when it took aim primarily at the United States, according to Dvilyanski. "This group used various malicious tactics to identify its targets and infect their devices with malware to enable espionage," said Facebook director of threat disruption David Agranovich. "Our platform was one of the elements of the much broader cross-platform cyber-espionage operation, and its activity on Facebook manifested primarily in social engineering and driving people off-platform." Malware slipped onto devices of victims was designed to glean information including log-in credentials to email or social media, according to Dvilyanski. Facebook said it appeared fewer than 200 users may have fallen for the ruse, and that those people have been notified of the deception. Facebook also blocked some of the booby-trapped website links from being shared at the social network, according to executives. The US tech giant added that it shared findings with internet industry peers and law enforcement. "We were only part of this campaign, and we are taking action on our platform," Dvilyanski said. (With inputs from agencies)

Iran-based spies targetted US, European defence workers, says Facebook

Microsoft said on Friday an attacker had won access to one of its customer-service agents and then used information from that to launch hacking attempts against customers. 
 
The company said it had found the compromise during its response to hacks by a team it identifies as responsible for earlier major breaches at SolarWinds and Microsoft. 
 
Microsoft said it had warned the affected customers. A copy of one warning seen by Reuters said the attacker belonged to the group Microsoft calls Nobelium and that it had access during the second half of May. 
 
"A sophisticated Nation-State associated actor that Microsoft identifies as NOBELLIUM accessed Microsoft customer support tools to review information regarding your Microsoft Services subscriptions," the warning reads in part. The US&nbsp;government has publicly attributed the earlier attacks to the Russian government, which denies involvement. 
 
When Reuters asked about that warning, Microsoft announced the breach publicly. 
 
After commenting on a broader phishing campaign it said had compromised a small number of entities, Microsoft said it had also found the breach of its own agent, who it said had limited powers. 
 
The agent could see billing contact information and what services the customers pay for, among other things. 
 
"The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign," Microsoft said. 
 
Microsoft warned affected customers to be careful about communications to their billing contacts and consider changing those usernames and email addresses, as well as barring old usernames from logging in. 
 
Microsoft said it was aware of three entities that had been compromised in the phishing campaign. 
 
It did not immediately clarify whether any had been among those whose data was viewed through the support agent, or if the agent had been tricked by the broader campaign. 
 
Microsoft did not say whether the agent was at a contractor or a direct employee. 
 
A spokesman said the latest breach by the threat actor was not part of Nobelium`s previous successful attack on Microsoft, in which it obtained some source code. 
 
In the SolarWinds attack, the group altered code at that company to access SolarWinds customers, including nine U.S. federal agencies. 
 
At the SolarWinds customers and others, the attackers also took advantage of weaknesses in the way Microsoft programs were configured, according to the Department of Homeland Security. 
 
Microsoft later said the group had compromised its own employee accounts and taken software instructions governing how Microsoft verifies user identities. 
 
A White House official said the latest intrusion and phishing campaign was far less serious than the SolarWinds fiasco. 
 
"This appears to be largely unsuccessful, run-of-the-mill espionage," the official said. 
 
Scott McConnell, a spokesman for Homeland Security`s Cybersecurity and Infrastructure Security Agency, said the defensive group “is working with Microsoft and our interagency partners to evaluate the impact. We stand ready to assist any affected entities.” 
 
A SolarWinds spokesperson said, "The latest cyberattack reported by Microsoft does not involve our company or our customers in any way."

Microsoft said on Friday an attacker had won access to one of its customer-service agents and then used information from that to launch hacking attempts against customers.

Microsoft said on Friday an attacker had won access to one of its customer-service agents and then used information from that to launch hacking attempts against customers. The company said it had found the compromise during its response to hacks by a team it identifies as responsible for earlier major breaches at SolarWinds and Microsoft. Microsoft said it had warned the affected customers. A copy of one warning seen by Reuters said the attacker belonged to the group Microsoft calls Nobelium and that it had access during the second half of May. "A sophisticated Nation-State associated actor that Microsoft identifies as NOBELLIUM accessed Microsoft customer support tools to review information regarding your Microsoft Services subscriptions," the warning reads in part. The US government has publicly attributed the earlier attacks to the Russian government, which denies involvement. When Reuters asked about that warning, Microsoft announced the breach publicly. After commenting on a broader phishing campaign it said had compromised a small number of entities, Microsoft said it had also found the breach of its own agent, who it said had limited powers. The agent could see billing contact information and what services the customers pay for, among other things. "The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign," Microsoft said. Microsoft warned affected customers to be careful about communications to their billing contacts and consider changing those usernames and email addresses, as well as barring old usernames from logging in. Microsoft said it was aware of three entities that had been compromised in the phishing campaign. It did not immediately clarify whether any had been among those whose data was viewed through the support agent, or if the agent had been tricked by the broader campaign. Microsoft did not say whether the agent was at a contractor or a direct employee. A spokesman said the latest breach by the threat actor was not part of Nobelium`s previous successful attack on Microsoft, in which it obtained some source code. In the SolarWinds attack, the group altered code at that company to access SolarWinds customers, including nine U.S. federal agencies. At the SolarWinds customers and others, the attackers also took advantage of weaknesses in the way Microsoft programs were configured, according to the Department of Homeland Security. Microsoft later said the group had compromised its own employee accounts and taken software instructions governing how Microsoft verifies user identities. A White House official said the latest intrusion and phishing campaign was far less serious than the SolarWinds fiasco. "This appears to be largely unsuccessful, run-of-the-mill espionage," the official said. Scott McConnell, a spokesman for Homeland Security`s Cybersecurity and Infrastructure Security Agency, said the defensive group “is working with Microsoft and our interagency partners to evaluate the impact. We stand ready to assist any affected entities.” A SolarWinds spokesperson said, "The latest cyberattack reported by Microsoft does not involve our company or our customers in any way."

Microsoft says new breach discovered in probe of suspected SolarWinds hackers

Italy has created a cybersecurity agency. The step has come after the country's Prime Minister Mario Draghi warned that Europe needed to protect itself from Russian interference. The approval for the new agency was given in a meeting late on Thursday.

The cybersecurity agency will need to "protect national interests and the resilience of services and essential functions of the State from cyber threats," said the government in a statement.

On May 25, Draghi spoke in Brussels following a European Union summi and said that urgent action was needed against digital threats.

"We need to strengthen ourselves, we need to strengthen ourselves a lot, especially in terms of cybersecurity, all of us, at national level and at EU level... because the level of [Russian] interference both with spies and with manipulation of the web has become truly alarming," he said.

Earlier this year, an Italian navy captain was caught red-handed by police while selling confidential military documents, leaked from his computer, to a Russian embassy official.

The new cybersecurity agency was tasked with developing strategies to prevent, monitor, detect and mitigate cyber attacks and stepping up national defences.

The agency, which according to media reports will employ around 300 people, will be controlled by Draghi and his security services advisor, ex-police chief Franco Gabrielli. The new head of cybersecurity agency is yet to be appointed

Draghi, a former European Central Bank chief, has been quite active on intelligence matters since he was appointed in February to lead a national unity government.&nbsp;

Last month, he named Elisabetta Belloni, a career diplomat, to lead Italy's secret services. She is the first woman to occupy the post.&nbsp;

The Corriere della Sera named Roberto Baldoni, a computer engineering professor who already works on cybersecurity with intelligence services, and Nunzia Ciardi, head of the internet police, as the top candidates.

(With inputs from agencies)

Italy has created a cybersecurity agency. The step has come after the country's Prime Minister Mario Draghi warned that Europe needed to protect itself from Russian interference.

Italy has created a cybersecurity agency. The step has come after the country's Prime Minister Mario Draghi warned that Europe needed to protect itself from Russian interference. The approval for the new agency was given in a meeting late on Thursday. The cybersecurity agency will need to "protect national interests and the resilience of services and essential functions of the State from cyber threats," said the government in a statement. On May 25, Draghi spoke in Brussels following a European Union summi and said that urgent action was needed against digital threats. "We need to strengthen ourselves, we need to strengthen ourselves a lot, especially in terms of cybersecurity, all of us, at national level and at EU level... because the level of [Russian] interference both with spies and with manipulation of the web has become truly alarming," he said. Earlier this year, an Italian navy captain was caught red-handed by police while selling confidential military documents, leaked from his computer, to a Russian embassy official. The new cybersecurity agency was tasked with developing strategies to prevent, monitor, detect and mitigate cyber attacks and stepping up national defences. The agency, which according to media reports will employ around 300 people, will be controlled by Draghi and his security services advisor, ex-police chief Franco Gabrielli. The new head of cybersecurity agency is yet to be appointed Draghi, a former European Central Bank chief, has been quite active on intelligence matters since he was appointed in February to lead a national unity government. Last month, he named Elisabetta Belloni, a career diplomat, to lead Italy's secret services. She is the first woman to occupy the post. The Corriere della Sera named Roberto Baldoni, a computer engineering professor who already works on cybersecurity with intelligence services, and Nunzia Ciardi, head of the internet police, as the top candidates. (With inputs from agencies)

Italy forms cybersecurity agency to counter Russian 'interference'

The hackers that paralysed Colonial Pipeline operations have stolen a large amount of data, reported Bloomberg News citing people familiar with the matter.

The attackers, part of a cybercrime group called DarkSide and have been reported to have stolen 100 GB data in just two hours on Thursday (May 6).

The massive cyberattack forced Colonial Pipeline to shut its operations. The top pipeline network supplies nearly half of US East Coast's fuel supply.

The company transports 2.5 million barrels per day of gasoline, diesel, jet fuel and other refined products through 5,500 miles (8,850 km) of pipelines linking refiners on the Gulf Coast to the eastern and southern United States.

The cyberattack on Colonial Pipeline involved ransomware.

(With inputs from agencies)

The hackers that paralysed Colonial Pipeline operations have stolen a large amount of data, reported Bloomberg News citing people familiar with the matter. The attackers, part of a cybercrime group called DarkSide and have been reported to have stolen 100 GB data in just two hours on Thursday (May 6).

The hackers that paralysed Colonial Pipeline operations have stolen a large amount of data, reported Bloomberg News citing people familiar with the matter. The attackers, part of a cybercrime group called DarkSide and have been reported to have stolen 100 GB data in just two hours on Thursday (May 6). The massive cyberattack forced Colonial Pipeline to shut its operations. The top pipeline network supplies nearly half of US East Coast's fuel supply. The company transports 2.5 million barrels per day of gasoline, diesel, jet fuel and other refined products through 5,500 miles (8,850 km) of pipelines linking refiners on the Gulf Coast to the eastern and southern United States. The cyberattack on Colonial Pipeline involved ransomware. (With inputs from agencies)

Colonial Pipeline hackers stole large amount of data, says report

The Washington DC&nbsp;police department's server has been hacked, US&nbsp;media quoted it as saying, in an attack that news agency AP reported&nbsp;had been claimed by a Russian-speaking ransomware group.

The department said it was still assessing the extent of the unauthorised access.

"While we determine the full impact and continue to review activity, we have engaged the FBI to fully investigate this matter," the district`s Metropolitan Police Department said in a statement cited late on Monday by outlets including AP and NBC News.

Also read:&nbsp;<a href="US will 'immediately' send vaccine components, medical supplies to India, says Biden">US will 'immediately' send vaccine components, medical supplies to India, says Biden</a>

The statement did not identify suspects for the attack, according to the reports. The department did not immediately respond to Reuters'&nbsp;request for comment.

AP said there was no indication of any police operations being affected, though it added that ransomware group Babuk had claimed responsibility, and to have stolen sensitive data, including on informants, that it had threatened to share with criminal gangs.

Ransomware groups hold files and networks hostage unless a payment is made.

The Department of Homeland Security's Secretary Alejandro Mayorkas said last month that dealing with such groups had become his department's top priority.

The Washington DC police department's server has been hacked, US media quoted it as saying, in an attack that news agency AP reported had been claimed by a Russian-speaking ransomware group.

The Washington DC police department's server has been hacked, US media quoted it as saying, in an attack that news agency AP reported had been claimed by a Russian-speaking ransomware group. The department said it was still assessing the extent of the unauthorised access. "While we determine the full impact and continue to review activity, we have engaged the FBI to fully investigate this matter," the district`s Metropolitan Police Department said in a statement cited late on Monday by outlets including AP and NBC News. Also read: US will 'immediately' send vaccine components, medical supplies to India, says Biden The statement did not identify suspects for the attack, according to the reports. The department did not immediately respond to Reuters' request for comment. AP said there was no indication of any police operations being affected, though it added that ransomware group Babuk had claimed responsibility, and to have stolen sensitive data, including on informants, that it had threatened to share with criminal gangs. Ransomware groups hold files and networks hostage unless a payment is made. The Department of Homeland Security's Secretary Alejandro Mayorkas said last month that dealing with such groups had become his department's top priority.

Washington DC police server hacked, Russian-speaking group claims responsibility: Reports

Security threats are not limited to land and sea borders. Now, the biggest threats loom on the digital world. India has no data security law and a big hacking attack just took place.

If you order pizza from Domino's, your credit card details could have been leaked. Reportedly, one million credit card details and a lot of other data has&nbsp;been leaked in India. The hackers are trying to sell all of this on the dark web.

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/gravitas-dominos-india-hack-credit-card-data-of-1-million-customers-stolen-378890/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

The hack was discovered by an Israeli cybercrime specialist who shared the specifics on Sunday. A hacker allegedly stole 13 terabytes of data from Domino's earlier this month. The database includes details of 18 crore (180 million) orders, customer names, phone numbers, email IDs, addresses and payment details including details of at least 10 lakh (1 million)&nbsp;credit cards. The hacker also accessed the internal records of Domino's employees.

Also read:&nbsp;<a href="http://13.235.153.162/technology/hacktivism-adding-to-woes-of-cybersecurity-at-alarming-rate-373454" hreflang="en">'Hacktivism' adding to woes of cybersecurity at alarming rate</a>

Reports say details of 250 employees have been leaked. The hacked data is now up for sale on the dark web - the internet space that remains hidden from the masses and can't be accessed with a simple Google search.

Why was the data stolen?

Reportedly, the hacker wants to sell it. A price has been quoted $550,000, over 4 crore (40 million) rupees . Jubilant Foodworks, the company that operates Domino's Pizza in India has a network of more than 1,000 restaurants in over 200 Indian cities.

It also operates Domino's Pizza in Bangladesh, Nepal and Sri Lanka. It is unclear if customers from these South Asian countries were affected or not. Jubilant Foodworks says it suffered an "information security incident" and financial data of customers wasn't compromised.

Also read:&nbsp;<a href="http://13.235.153.162/technology/mark-zuckerbergs-private-phone-number-goes-online-in-facebook-hack-375395" hreflang="en">Mark Zuckerberg’s private phone number goes online in Facebook hack</a>

Indians have been victims of several large scale data breaches in the recent past. Last month, data of digital wallet company Mobikwik was hacked and private information of nearly 100 million users was exposed. In December last year, Indigo Airlines said its servers had been hacked and that some of the company's internal documents may be leaked.

Last month, the government told the parliament that cyber attacks during the pandemic had risen by almost 300 per cent. As India goes digital and the pandemic accelerates this transition, India's parliament is yet to pass a data security law. Until that happens, we’re all at risk.

Security threats are not limited to land and sea borders. Now, the biggest threats loom on the digital world. India has no data security law and a big hacking attack just took place.

Security threats are not limited to land and sea borders. Now, the biggest threats loom on the digital world. India has no data security law and a big hacking attack just took place. If you order pizza from Domino's, your credit card details could have been leaked. Reportedly, one million credit card details and a lot of other data has been leaked in India. The hackers are trying to sell all of this on the dark web. The hack was discovered by an Israeli cybercrime specialist who shared the specifics on Sunday. A hacker allegedly stole 13 terabytes of data from Domino's earlier this month. The database includes details of 18 crore (180 million) orders, customer names, phone numbers, email IDs, addresses and payment details including details of at least 10 lakh (1 million) credit cards. The hacker also accessed the internal records of Domino's employees. Also read: 'Hacktivism' adding to woes of cybersecurity at alarming rate Reports say details of 250 employees have been leaked. The hacked data is now up for sale on the dark web - the internet space that remains hidden from the masses and can't be accessed with a simple Google search. Why was the data stolen? Reportedly, the hacker wants to sell it. A price has been quoted $550,000, over 4 crore (40 million) rupees . Jubilant Foodworks, the company that operates Domino's Pizza in India has a network of more than 1,000 restaurants in over 200 Indian cities. It also operates Domino's Pizza in Bangladesh, Nepal and Sri Lanka. It is unclear if customers from these South Asian countries were affected or not. Jubilant Foodworks says it suffered an "information security incident" and financial data of customers wasn't compromised. Also read: Mark Zuckerberg’s private phone number goes online in Facebook hack Indians have been victims of several large scale data breaches in the recent past. Last month, data of digital wallet company Mobikwik was hacked and private information of nearly 100 million users was exposed. In December last year, Indigo Airlines said its servers had been hacked and that some of the company's internal documents may be leaked. Last month, the government told the parliament that cyber attacks during the pandemic had risen by almost 300 per cent. As India goes digital and the pandemic accelerates this transition, India's parliament is yet to pass a data security law. Until that happens, we’re all at risk.

Domino's Pizza hack in India: What details were stolen and what happens next

Japan police are investigating cyberattacks on about 200 Japanese companies and research organisations, including the country’s space agency JAXA.

Investigators suspect that a group of hackers backed by the Chinese military is behind the cyberattack.

According to the Japan Broadcasting Corporation, police sent papers to prosecutors on a Chinese Communist Party (CCP) member on Tuesday on suspicion of forging digital records related to the cyberattacks.

The Tokyo Metropolitan Police Department said the Japan Aerospace Exploration Agency, or JAXA, suffered a cyberattack in 2016. The police identified a Chinese man who had leased several servers in Japan that were allegedly used in the attack.

The man, who is no longer in Japan, is said to be a computer engineer in his 30s. He allegedly rented servers five times under false names.

Investigative sources said the servers' ID and other credentials were then passed on to a Chinese hacker group known as "Tick."

Tokyo police suspect that the Chinese People's Liberation Army instructed Tick to stage cyberattacks in Japan. Sources say that about 200 companies and advanced research institutions, including Mitsubishi Electric and Keio University, were targeted.

A JAXA spokesperson told NHK that the space agency did experience unauthorised access, but suffered no data leaks or other damage.

Meanwhile, another Chinese man is also said to have rented several servers in Japan using fake identities. This was allegedly under the instruction of a member of unit 61419 -- a bureau in charge of cyberattacks within China's PLA.

The revelation comes at a time when tensions between China and Japan have escalated amid increased activity by Beijing in the disputed East China Sea.

This comes after Beijing implements a new law that allows the country's quasi-military force to use weapons against foreign ships that China sees as illegally entering its waters.

Last month, Japan said China's coastguard had expanded its presence in the contested waters by entering twice a month and as frequently as twice a week near the Japanese-controlled Senkaku Islands, known by the Chinese as Diaoyu.

Last month, Microsoft, the US company, said a sophisticated group of hackers linked to China has hacked into its popular email service that allowed them to gain access to computers.

The company had said that four vulnerabilities in its software allowed hackers to access servers for Microsoft Exchange, "which enabled access to email accounts, and allowed the installation of additional malware to facilitate long-term access to victim environments," reported CNN.

Last year, in a major breach of security, Australia was hit by a major cyberattack by a "state-based actor".

(With inputs from agencies)

Japan police are investigating cyberattacks on about 200 Japanese companies and research organisations, including the country’s space agency JAXA. Investigators suspect that a group of hackers backed by the Chinese military is behind the cyberattack.

Japan police are investigating cyberattacks on about 200 Japanese companies and research organisations, including the country’s space agency JAXA. Investigators suspect that a group of hackers backed by the Chinese military is behind the cyberattack. According to the Japan Broadcasting Corporation, police sent papers to prosecutors on a Chinese Communist Party (CCP) member on Tuesday on suspicion of forging digital records related to the cyberattacks. The Tokyo Metropolitan Police Department said the Japan Aerospace Exploration Agency, or JAXA, suffered a cyberattack in 2016. The police identified a Chinese man who had leased several servers in Japan that were allegedly used in the attack. The man, who is no longer in Japan, is said to be a computer engineer in his 30s. He allegedly rented servers five times under false names. Investigative sources said the servers' ID and other credentials were then passed on to a Chinese hacker group known as "Tick." Tokyo police suspect that the Chinese People's Liberation Army instructed Tick to stage cyberattacks in Japan. Sources say that about 200 companies and advanced research institutions, including Mitsubishi Electric and Keio University, were targeted. A JAXA spokesperson told NHK that the space agency did experience unauthorised access, but suffered no data leaks or other damage. Meanwhile, another Chinese man is also said to have rented several servers in Japan using fake identities. This was allegedly under the instruction of a member of unit 61419 -- a bureau in charge of cyberattacks within China's PLA. The revelation comes at a time when tensions between China and Japan have escalated amid increased activity by Beijing in the disputed East China Sea. This comes after Beijing implements a new law that allows the country's quasi-military force to use weapons against foreign ships that China sees as illegally entering its waters. Last month, Japan said China's coastguard had expanded its presence in the contested waters by entering twice a month and as frequently as twice a week near the Japanese-controlled Senkaku Islands, known by the Chinese as Diaoyu. Last month, Microsoft, the US company, said a sophisticated group of hackers linked to China has hacked into its popular email service that allowed them to gain access to computers. The company had said that four vulnerabilities in its software allowed hackers to access servers for Microsoft Exchange, "which enabled access to email accounts, and allowed the installation of additional malware to facilitate long-term access to victim environments," reported CNN. Last year, in a major breach of security, Australia was hit by a major cyberattack by a "state-based actor". (With inputs from agencies)

Chinese military-backed hackers likely behind Japan cyberattacks

A US court has authorised Federal Bureau of Investigation to directly investigate backdoors into hundreds of Microsoft Exchange email servers across the US. Four months ago, hackers had used vulnerabilities in the server&nbsp;to attack multiple networks.

As part of this move, the FBI will be allowed to copy and remove backdoors, as announced by the Justice Department on Tuesday, TechCrunch first reported.

Microsoft had discovered a new hacking group from China in March called “Hafnium” which targeted Exchange servers on company networks. Clubbed together, the four vulnerabilities allowed hackers to get access to a vulnerable Exchange server and successfully steal its contents.

Also read:&nbsp;<a href="http://13.235.153.162/world/putins-chef-urges-fbi-to-remove-his-name-from-wanted-list-of-criminals-372814" hreflang="en">'Putin's chef' urges FBI to remove his name from wanted list of criminals</a>

Even though Microsoft claimed that the vulnerabilities were patched, but the patches from backdoors did not close. After the loopholes became public, multiple hacking groups began capitalising on servers and installing ransomware.

According to a Justice Department statement, hundreds of Microsoft Exchange servers continue to remain vulnerable as backdoors remain difficult to identify and to get rid of.

Also read:&nbsp;<a href="http://13.235.153.162/world/fbi-releases-new-footage-of-washington-pipe-bomb-suspect-369262" hreflang="en">FBI releases new footage of Washington pipe bomb suspect</a>

The FBI is attempting to inform owners of servers via email after removal of backdoors. According to the Justice Department, the operation only removed the backdoors, but failed to fix the loopholes in place. In addition, the malware installed by hackers has not been removed. This marks the first FBI intervening in private networks after a cyberattack.&nbsp;

A US court has authorised Federal Bureau of Investigation to directly investigate backdoors into hundreds of Microsoft Exchange email servers across the US. Four months ago, hackers had used vulnerabilities in the server to attack multiple networks.

A US court has authorised Federal Bureau of Investigation to directly investigate backdoors into hundreds of Microsoft Exchange email servers across the US. Four months ago, hackers had used vulnerabilities in the server to attack multiple networks. As part of this move, the FBI will be allowed to copy and remove backdoors, as announced by the Justice Department on Tuesday, TechCrunch first reported. Microsoft had discovered a new hacking group from China in March called “Hafnium” which targeted Exchange servers on company networks. Clubbed together, the four vulnerabilities allowed hackers to get access to a vulnerable Exchange server and successfully steal its contents. Also read: 'Putin's chef' urges FBI to remove his name from wanted list of criminals Even though Microsoft claimed that the vulnerabilities were patched, but the patches from backdoors did not close. After the loopholes became public, multiple hacking groups began capitalising on servers and installing ransomware. According to a Justice Department statement, hundreds of Microsoft Exchange servers continue to remain vulnerable as backdoors remain difficult to identify and to get rid of. Also read: FBI releases new footage of Washington pipe bomb suspect The FBI is attempting to inform owners of servers via email after removal of backdoors. According to the Justice Department, the operation only removed the backdoors, but failed to fix the loopholes in place. In addition, the malware installed by hackers has not been removed. This marks the first FBI intervening in private networks after a cyberattack.

FBI to remove backdoors from hacked Microsoft Exchange servers, in a first for federal agency

A new attack is affecting SMS messaging with the users never finding out. The attack, uncovered by Motherboard, uses text-messaging management services to redirect messages to hackers from the user.

These services are&nbsp;used by businesses, but now hackers are capitalising on the service’s loopholes. The service essentially provides the hackers access to everything in your texts, ranging from two-factor authentication codes, login links, and one-time passwords that are usually delivered via SMS.

As if that was not enough to scare users, the hackers can also respond to messages on your behalf without you even finding out.

It is common for companies to not tell the user that their messages are being redirected to someone else. And the worst part of it all? Anybody can deploy the attack, and it costs less than $16, as uncovered by a Motherboard reporter, Joseph Cox, who was able to successfully hack his own phone using the exploits already in place within the industry.

Also read:&nbsp;<a href="https://www.wionews.com/world/just-111-facebook-users-spread-half-of-covid-vaccine-doubts-370729" hreflang="en">Just 111 Facebook users spread half of Covid vaccine doubts&nbsp;</a>

Not many companies are doing anything, or worse - lack awareness about the loophole which allows such attacks to continue unabated.

It’s not the attack which could compromise one’s data, but the content of our private SMSs - a service now largely used just for authentication purposes, as users have moved on to app-based messaging like WhatsApp and Telegram.

Also read:&nbsp;<a href="https://www.wionews.com/technology/twitter-users-experiencing-bizarre-bug-banning-users-for-mentioning-memphis-370619" hreflang="en">Twitter users experiencing bizarre bug banning users for mentioning 'Memphis'</a>

SMSing has become largely obsolete for private conversations, but could still be exploited to access important links, for companies still using SMSs to send password reset links - ranging from banks to social media companies. In addition, many also send login links on SMS.

The attacker can easily click on these links to change passwords of your important accounts and services. Easiest way to avoid being hacked? Stop using SMS services for anything security-related.

A new attack is affecting SMS messaging with the users never finding out. The attack, uncovered by Motherboard, uses text-messaging management services to redirect messages to hackers from the user.

A new attack is affecting SMS messaging with the users never finding out. The attack, uncovered by Motherboard, uses text-messaging management services to redirect messages to hackers from the user. These services are used by businesses, but now hackers are capitalising on the service’s loopholes. The service essentially provides the hackers access to everything in your texts, ranging from two-factor authentication codes, login links, and one-time passwords that are usually delivered via SMS. As if that was not enough to scare users, the hackers can also respond to messages on your behalf without you even finding out. It is common for companies to not tell the user that their messages are being redirected to someone else. And the worst part of it all? Anybody can deploy the attack, and it costs less than $16, as uncovered by a Motherboard reporter, Joseph Cox, who was able to successfully hack his own phone using the exploits already in place within the industry. Also read: Just 111 Facebook users spread half of Covid vaccine doubts Not many companies are doing anything, or worse - lack awareness about the loophole which allows such attacks to continue unabated. It’s not the attack which could compromise one’s data, but the content of our private SMSs - a service now largely used just for authentication purposes, as users have moved on to app-based messaging like WhatsApp and Telegram. Also read: Twitter users experiencing bizarre bug banning users for mentioning 'Memphis' SMSing has become largely obsolete for private conversations, but could still be exploited to access important links, for companies still using SMSs to send password reset links - ranging from banks to social media companies. In addition, many also send login links on SMS. The attacker can easily click on these links to change passwords of your important accounts and services. Easiest way to avoid being hacked? Stop using SMS services for anything security-related.

Telecom companies may be redirecting your SMSs to hackers for less than $16!

The sophisticated hacks pulled off by Russia and China against a broad array of government and industrial targets in the United States — and the failure of the intelligence agencies to detect them — are driving the Biden administration and Congress to rethink how the nation should protect itself from growing cyber threats.

Both hacks exploited the same gaping vulnerability in the existing system: They were launched from inside the United States — on servers run by Amazon, GoDaddy and smaller domestic providers — putting them out of reach of the early-warning system run by the National Security Agency.

The agency, like the CIA and other U.S. intelligence agencies, is prohibited by law from conducting surveillance inside the United States, to protect the privacy of American citizens.

But the FBI and Department of Homeland Security — the two agencies that can legally operate inside the United States — were also blind to what happened, raising additional concerns about the nation’s capacity to defend itself from both rival governments and nonstate attackers like criminal and terrorist groups.

In the end, the hacks were detected long after they had begun — not by any government agency, but by private computer security firms.

The full extent of the damage to US&nbsp;interests from the hacks is not yet clear, but the latest, attributed by Microsoft to China, is now revealing a second vulnerability. As Microsoft releases new “patches” to close the holes in its system, that code is being reverse-engineered by criminal groups and exploited to launch rapid ransomware attacks on corporations, industry executives said. So a race is on — between Microsoft’s efforts to seal up systems, and criminal efforts to get inside those networks before the patches are applied.

“When not one but two cyberhacks have gone undetected by the federal government in such a short period of time, it’s hard to say that we don’t have a problem,” said Rep. Mike Gallagher, R-Wis. and a co-chair of a congressionally mandated cyberspace commission. “The system is blinking red.”

The failures have prompted the White House to begin assessing options for overhauling the nation’s cyberdefenses even as the government investigates the hacks. Some former officials believe the hacks show Congress needs to give the government additional powers.

But briefing reporters Friday about the progress of the investigations, senior administration officials said the White House had no plans to urge Congress to rewrite the laws that prevent U.S. intelligence agencies from operating inside America’s borders.

One senior adviser to President Joe Biden said, however, that a new structure was needed, one that combined traditional intelligence collection with the talents of private-sector firms.

It was FireEye, a cybersecurity company, that ultimately found the SolarWinds attack organized by Russia, and a small Virginia firm named Volexity that revealed to Microsoft the fact that Chinese hackers found four previously unknown vulnerabilities in their systems, exposing hundreds of thousands of computer servers that use Microsoft Exchange software.

But even as officials try to assemble the lessons of those attacks, the one on Microsoft’s systems, used by companies and government agencies, has grown more complex. On Friday, Microsoft warned that cybercriminals are using the backdoors Chinese hackers left behind to deploy ransomware, which is used to lock up computer systems until payment is made.

The first efforts to freeze up U.S. systems began Thursday night, Microsoft said, and U.S. officials warned Friday that its customers had limited time, “measured in hours, not days,” to patch their systems to avoid a costly nightmare.

Biden was briefed last week on the effort to seal up the holes in federal defenses, a senior administration official told reporters Friday, adding that the federal government was in the third week of a monthlong effort to plug holes made obvious by the SolarWinds hack. A presidential order on longer-range fixes is coming.

But the first problem is detecting attacks — and there the United States has enormous work to do.

America’s foremost hacking teams and digital defenders reside in Fort Meade, Maryland, home to the National Security Agency and its military counterpart, US&nbsp;Cyber Command. Over more than a decade, with billions of dollars in new technology, they have littered foreign networks with various forms of “beacons” that give them access to detect attacks as they are coming together or begin.

But, like missile defense, that is hardly an impermeable shield. And foreign actors have begun to identify America’s blind spot: If hackers can assemble an attack from inside America’s borders, the U.S. government’s best hunt teams can be blindsided.

“The NSA cannot operate in the domestic infrastructure,” retired Adm. Michael Rogers, the former director of the agency, said Friday at the Kellogg School of Management at Northwestern University. “You can’t defend something you can’t see.”

But there is no political appetite to reverse decades of limits on intelligence agencies to monitor and defend network traffic inside the United States.

Instead, Biden administration officials said they would seek a deeper partnership with the private sector, tapping the knowledge of emerging hacking threats gathered by technology companies and cybersecurity firms.

The hope, current and former officials say, is to set up a real-time threat-sharing arrangement, whereby private companies would send threat data to a central repository where the government could pair it with intelligence from the National Security Agency, the CIA and other spy shops to provide a far earlier warning than is possible today.

“You could stop attacks dead in their tracks,” said Glenn Gerstell, a former general counsel for the National Security Agency. “We need a way to get threat intelligence into a one-stop shopping center.”

The question is how to set up such a system.

After revelations in 2013 by former intelligence contractor Edward Snowden that set off a debate about government surveillance, U.S. technology companies are wary of the appearance of sharing data with U.S. intelligence agencies, even if that data is just warnings about malware. Google was stung by the revelation in the Snowden documents that the National Security Agency was intercepting data transmitted between its servers overseas. Several years later, under pressure from its employees, it ended its participation in Project Maven, a Pentagon effort to use artificial intelligence to make its drones more accurate.

Amazon, in contrast, has no such compunctions about sensitive government work: It runs the cloud server operations for the CIA. But when the Senate Intelligence Committee asked company officials to testify last month — alongside executives of FireEye, Microsoft and SolarWinds — about how the Russians exploited systems on U.S. soil to launch their attacks, they declined to attend.

Companies say that before they share reporting on vulnerabilities, they would need strong legal liability protections.

The most politically palatable headquarters for such a clearinghouse — avoiding the legal and civil liberties concerns of using the National Security Agency — would be the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. Gerstell described the idea as “automated computer sensors and artificial intelligence acting on information as it comes in and instantaneously spitting it back out.”

The department’s existing “Einstein” system, which is supposed to monitor intrusions and potential attacks on federal agencies, never saw the Russian attack underway — even though it hit nine federal departments and agencies. The FBI, lawmakers say, does not have broad monitoring capabilities, and its focus is divided across other forms of crime, counterterrorism and now domestic extremism threats.

“I don’t want the intelligence agencies spying on Americans, but that leaves the FBI as the de facto domestic intelligence agency to deal with these kinds of attacks,” said Sen. Angus King, I-Maine, a member of the Senate Intelligence Committee and co-chair of the cyberspace commission. “I’m just not sure they’re set up for this.”

There are other hurdles. The process of getting a search warrant is too cumbersome for tracking nation-state cyberattacks, Gerstell said. “Someone’s got to be able to take that information from the NSA and instantly go take a look at that computer,” he said. “But the FBI needs a warrant to do that, and that takes time, by which point the adversary has escaped.”

Another obstacle is the slowness of identifying attackers. While the director of national intelligence concluded that the SolarWinds attack, carried out last year, was “likely” Russian in origin, a definitive assessment is not expected until this week or next. Only then can the United States respond with sanctions or cyberoperations — nearly a year after the attack began.

“The thing that worries me in both of these cases, too, is just how slowly we tend to attribute and respond,” Gallagher said.

On Friday, Jake Sullivan, the president’s national security adviser, told reporters that an investigation was underway to identify who was behind using the hack of the Microsoft systems to spy on law firms, infectious disease research, universities, military contractors, think tanks and other targets. Microsoft has already said the hackers were a Chinese, state-backed group.

Last month, in the days before Microsoft released an emergency patch for vulnerable Exchange servers, multiple state-backed Chinese groups were apparently tipped off that the company was testing a patch. They began gorging on vulnerable systems with a speed and aggression that some security experts said they had never seen before.

It is unclear how exactly these Chinese groups learned of Microsoft’s patch, but the timing suggests they caught wind of the moves when Microsoft rolled out a test version of its patch to its security partners at cybersecurity firms in late February.

Eighty companies participate in a long-standing partnership with Microsoft, known as the Microsoft Active Protections Program, including 10 Chinese firms. Microsoft confidentially alerts these companies to emerging cyberthreats and vulnerabilities before its official patch cycle. The company is investigating whether one of its partners may have leaked to Chinese hackers or was itself hacked.

Microsoft said that if it determined a leak was responsible for the spike in attacks, the responsible partners would “face consequences.”

The attacks forced Microsoft to release its patch one week early, on March 2. Within a week, the number of vulnerable Exchange servers dropped from 400,000 to 100,000, according to RiskIQ, an internet security company.

Now, however, 82,000 servers are still awaiting updates. Among those still vulnerable are more than 400 state, local and federal government entities in the United States — including more than a dozen servers run by federal agencies — according to an analysis by BitSight, a cybersecurity risk ratings company. The Biden administration has said nothing about the scope of federal vulnerability.

If the government is able to attribute the Microsoft attack to the Chinese, Gallagher said, there are “a variety of things we could do to inflict pain” on the government in Beijing.

The sophisticated hacks pulled off by Russia and China against a broad array of government and industrial targets in the United States — and the failure of the intelligence agencies to detect them — are driving the Biden administration and Congress to rethink how the nation should protect itself from growing cyber threats.

The sophisticated hacks pulled off by Russia and China against a broad array of government and industrial targets in the United States — and the failure of the intelligence agencies to detect them — are driving the Biden administration and Congress to rethink how the nation should protect itself from growing cyber threats. Both hacks exploited the same gaping vulnerability in the existing system: They were launched from inside the United States — on servers run by Amazon, GoDaddy and smaller domestic providers — putting them out of reach of the early-warning system run by the National Security Agency. The agency, like the CIA and other U.S. intelligence agencies, is prohibited by law from conducting surveillance inside the United States, to protect the privacy of American citizens. But the FBI and Department of Homeland Security — the two agencies that can legally operate inside the United States — were also blind to what happened, raising additional concerns about the nation’s capacity to defend itself from both rival governments and nonstate attackers like criminal and terrorist groups. In the end, the hacks were detected long after they had begun — not by any government agency, but by private computer security firms. The full extent of the damage to US interests from the hacks is not yet clear, but the latest, attributed by Microsoft to China, is now revealing a second vulnerability. As Microsoft releases new “patches” to close the holes in its system, that code is being reverse-engineered by criminal groups and exploited to launch rapid ransomware attacks on corporations, industry executives said. So a race is on — between Microsoft’s efforts to seal up systems, and criminal efforts to get inside those networks before the patches are applied. “When not one but two cyberhacks have gone undetected by the federal government in such a short period of time, it’s hard to say that we don’t have a problem,” said Rep. Mike Gallagher, R-Wis. and a co-chair of a congressionally mandated cyberspace commission. “The system is blinking red.” The failures have prompted the White House to begin assessing options for overhauling the nation’s cyberdefenses even as the government investigates the hacks. Some former officials believe the hacks show Congress needs to give the government additional powers. But briefing reporters Friday about the progress of the investigations, senior administration officials said the White House had no plans to urge Congress to rewrite the laws that prevent U.S. intelligence agencies from operating inside America’s borders. One senior adviser to President Joe Biden said, however, that a new structure was needed, one that combined traditional intelligence collection with the talents of private-sector firms. It was FireEye, a cybersecurity company, that ultimately found the SolarWinds attack organized by Russia, and a small Virginia firm named Volexity that revealed to Microsoft the fact that Chinese hackers found four previously unknown vulnerabilities in their systems, exposing hundreds of thousands of computer servers that use Microsoft Exchange software. But even as officials try to assemble the lessons of those attacks, the one on Microsoft’s systems, used by companies and government agencies, has grown more complex. On Friday, Microsoft warned that cybercriminals are using the backdoors Chinese hackers left behind to deploy ransomware, which is used to lock up computer systems until payment is made. The first efforts to freeze up U.S. systems began Thursday night, Microsoft said, and U.S. officials warned Friday that its customers had limited time, “measured in hours, not days,” to patch their systems to avoid a costly nightmare. Biden was briefed last week on the effort to seal up the holes in federal defenses, a senior administration official told reporters Friday, adding that the federal government was in the third week of a monthlong effort to plug holes made obvious by the SolarWinds hack. A presidential order on longer-range fixes is coming. But the first problem is detecting attacks — and there the United States has enormous work to do. America’s foremost hacking teams and digital defenders reside in Fort Meade, Maryland, home to the National Security Agency and its military counterpart, US Cyber Command. Over more than a decade, with billions of dollars in new technology, they have littered foreign networks with various forms of “beacons” that give them access to detect attacks as they are coming together or begin. But, like missile defense, that is hardly an impermeable shield. And foreign actors have begun to identify America’s blind spot: If hackers can assemble an attack from inside America’s borders, the U.S. government’s best hunt teams can be blindsided. “The NSA cannot operate in the domestic infrastructure,” retired Adm. Michael Rogers, the former director of the agency, said Friday at the Kellogg School of Management at Northwestern University. “You can’t defend something you can’t see.” But there is no political appetite to reverse decades of limits on intelligence agencies to monitor and defend network traffic inside the United States. Instead, Biden administration officials said they would seek a deeper partnership with the private sector, tapping the knowledge of emerging hacking threats gathered by technology companies and cybersecurity firms. The hope, current and former officials say, is to set up a real-time threat-sharing arrangement, whereby private companies would send threat data to a central repository where the government could pair it with intelligence from the National Security Agency, the CIA and other spy shops to provide a far earlier warning than is possible today. “You could stop attacks dead in their tracks,” said Glenn Gerstell, a former general counsel for the National Security Agency. “We need a way to get threat intelligence into a one-stop shopping center.” The question is how to set up such a system. After revelations in 2013 by former intelligence contractor Edward Snowden that set off a debate about government surveillance, U.S. technology companies are wary of the appearance of sharing data with U.S. intelligence agencies, even if that data is just warnings about malware. Google was stung by the revelation in the Snowden documents that the National Security Agency was intercepting data transmitted between its servers overseas. Several years later, under pressure from its employees, it ended its participation in Project Maven, a Pentagon effort to use artificial intelligence to make its drones more accurate. Amazon, in contrast, has no such compunctions about sensitive government work: It runs the cloud server operations for the CIA. But when the Senate Intelligence Committee asked company officials to testify last month — alongside executives of FireEye, Microsoft and SolarWinds — about how the Russians exploited systems on U.S. soil to launch their attacks, they declined to attend. Companies say that before they share reporting on vulnerabilities, they would need strong legal liability protections. The most politically palatable headquarters for such a clearinghouse — avoiding the legal and civil liberties concerns of using the National Security Agency — would be the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. Gerstell described the idea as “automated computer sensors and artificial intelligence acting on information as it comes in and instantaneously spitting it back out.” The department’s existing “Einstein” system, which is supposed to monitor intrusions and potential attacks on federal agencies, never saw the Russian attack underway — even though it hit nine federal departments and agencies. The FBI, lawmakers say, does not have broad monitoring capabilities, and its focus is divided across other forms of crime, counterterrorism and now domestic extremism threats. “I don’t want the intelligence agencies spying on Americans, but that leaves the FBI as the de facto domestic intelligence agency to deal with these kinds of attacks,” said Sen. Angus King, I-Maine, a member of the Senate Intelligence Committee and co-chair of the cyberspace commission. “I’m just not sure they’re set up for this.” There are other hurdles. The process of getting a search warrant is too cumbersome for tracking nation-state cyberattacks, Gerstell said. “Someone’s got to be able to take that information from the NSA and instantly go take a look at that computer,” he said. “But the FBI needs a warrant to do that, and that takes time, by which point the adversary has escaped.” Another obstacle is the slowness of identifying attackers. While the director of national intelligence concluded that the SolarWinds attack, carried out last year, was “likely” Russian in origin, a definitive assessment is not expected until this week or next. Only then can the United States respond with sanctions or cyberoperations — nearly a year after the attack began. “The thing that worries me in both of these cases, too, is just how slowly we tend to attribute and respond,” Gallagher said. On Friday, Jake Sullivan, the president’s national security adviser, told reporters that an investigation was underway to identify who was behind using the hack of the Microsoft systems to spy on law firms, infectious disease research, universities, military contractors, think tanks and other targets. Microsoft has already said the hackers were a Chinese, state-backed group. Last month, in the days before Microsoft released an emergency patch for vulnerable Exchange servers, multiple state-backed Chinese groups were apparently tipped off that the company was testing a patch. They began gorging on vulnerable systems with a speed and aggression that some security experts said they had never seen before. It is unclear how exactly these Chinese groups learned of Microsoft’s patch, but the timing suggests they caught wind of the moves when Microsoft rolled out a test version of its patch to its security partners at cybersecurity firms in late February. Eighty companies participate in a long-standing partnership with Microsoft, known as the Microsoft Active Protections Program, including 10 Chinese firms. Microsoft confidentially alerts these companies to emerging cyberthreats and vulnerabilities before its official patch cycle. The company is investigating whether one of its partners may have leaked to Chinese hackers or was itself hacked. Microsoft said that if it determined a leak was responsible for the spike in attacks, the responsible partners would “face consequences.” The attacks forced Microsoft to release its patch one week early, on March 2. Within a week, the number of vulnerable Exchange servers dropped from 400,000 to 100,000, according to RiskIQ, an internet security company. Now, however, 82,000 servers are still awaiting updates. Among those still vulnerable are more than 400 state, local and federal government entities in the United States — including more than a dozen servers run by federal agencies — according to an analysis by BitSight, a cybersecurity risk ratings company. The Biden administration has said nothing about the scope of federal vulnerability. If the government is able to attribute the Microsoft attack to the Chinese, Gallagher said, there are “a variety of things we could do to inflict pain” on the government in Beijing.

White House weighs new cybersecurity approach after failure to detect hacks

hacking

Hacking, News on Hacking, stories on Hacking, articles on Hacking, Hacking stories at Wion, Hacking news, Hacking latest news