At its core, cyberwarfare refers the use of digital attacks by one country or nation to disrupt the computer systems of another with the aim of create significant damage, death or destruction. Perhaps unsurprisingly – considering that cyberwarfare involves spies, hackers and top secret digital weapons projects – it’s a still a shadowy and ill-defined area of conflict, but one that is increasingly important and dangerous.
Like traditional conflicts, cyberwarfare comes in many shapes and sizes, but it is increasingly clear that cyberwarfare is going to be a significant component of pretty much every present and future conflict.
Read everything you need to know about cyberwar on ZDNet.
A decade has passed since we learned about pacemaker hacks, but still implantable medical devices that can save patients’ lives can be hacked to potentially kill them. Even now, as was highlighted at Black Hat USA, attackers can cause pacemakers to deliver a deadly shock to the heart or deny a life-saving shock, as well as prevent insulin pumps from delivering insulin.
At the recent Black Hat and Def Con security conferences in Las Vegas, one set of researchers showed off hacks to pacemakers and insulin pumps that could potentially prove lethal, while another researcher explained how hospital patients’ vital signs could be falsified in real time.
Read more about the disturbing discoveries relating to medical device insecurity on CSO.
The increasing sophistication and power of state-backed cyber attacks has led some experts to fear that, sooner or later, by design or by accident, one of these incidents will result in somebody getting killed.
It might sound far-fetched, but a former head of the UK’s intelligence agency has already warned about the physical threat posed by cyber attacks and the potential damage they could do.
Read more about the big — and scary — question of what will happen when a cyber attack actually results in someone getting killed, the probability of which is ever increasing, on ZDNet.
More than two-thirds (69%) of cybersecurity experts predict a successful cyberattack will hit US infrastructure within the next two years – and a majority express low confidence both in security technology to protect their organizations and in the US government to defend the nation against attacks.
Respondents of the 2018 Black Hat Attendee Survey, a group of 315 IT and security pros who attended the conference in 2017 or who are registered for this year’s conference, were asked to rate the effectiveness of technologies available to enterprise security teams. It was the first time this question was included in the survey and responses indicate the security community sees ample room for improvement.
Read more about the 2018 Black Hat Attendee survey, which reveals worries over the effectiveness of enterprise security technology, and threats to US infrastructure, on DarkReading.
Pen Test Partners’ Ken Munro and his colleagues – some of which are former ship crew members who really understand bridge and propulsion systems – have been probing the security of ships’ IT systems for a while now and the results are depressing: satcom terminals exposed on the Internet, admin interfaces accessible via insecure protocols, no firmware signing, easy-to-guess default credentials, and so on.
“Ship security is in its infancy – most of these types of issues were fixed years ago in mainstream IT systems,” Pen Test Partners’ Ken Munro says, and points out that the advent of always-on satellite connections has exposed shipping to hacking attacks.
Read more about the dismal state of ship security as reported by Ken Munro and his colleagues on Help Net Security.
It’s been four years since researcher Ruben Santamarta rocked the security world with his chilling discovery of major vulnerabilities in satellite equipment that could be abused to hijack and disrupt communications links to airplanes, ships, military operations, and industrial facilities.
Santamarta has now proven out those findings and taken his research to the level of terrifying, by successfully hacking into in-flight airplane WiFi networks and satcom equipment from the ground. “As far as I know I will be the first researcher that will demonstrate that it’s possible to hack into communications devices on an in-flight aircraft … from the ground,” he says.
Read more about the disconcerting findings of IOActive researcher Santamarta, who will demonstrate at Black Hat USA how satellite equipment can be ‘weaponized,’ on DarkReading.
Industrial control systems around the world might be at risk as hardcoded credentials are found in flawed software. The Yokogawa Stardom vulnerability (CVE-2018-10592) affects the FCJ, FCN-100, FCN-RTU and FCN-500 controllers running firmware version R4.02 or earlier. These industrial control systems (ICS) are used around the world in various infrastructure capacities including the energy sector, food production and manufacturing.
According to the security advisory for the Yokogawa Stardom vulnerability, an attacker could remotely log in with the hardcoded credentials and be able to execute system commands. The official advisory from Yokogawa and the advisory from ICS-CERT disagree slightly though: Yokogawa labels the issue as being of medium difficulty to exploit, while ICS-CERT notes that it takes “low skill level.”
Read more about the Yokogawa Stardom vulnerability that leaves industrial control systems in critical infrastructure around the world at risk because of hardcoded credentials in the software on TechTarget.
The group behind the Trisis malware attack on an oil and gas company in Saudi Arabia last year has also now hacked industrial firms in other countries, according to new research. Cybersecurity company Dragos Inc. has published a report that identifies a new threat group called Xenotime as the authors of the Trisis malware, also known as Triton, and warned of a similar malware campaign that has been targeting unnamed companies globally with industrial control system (ICS) attacks.
“Dragos assesses with moderate confidence that Xenotime intends to establish required access and capability to cause a potential, future disruptive — or even destructive — event,” Dragos said in its blog post about the threat. “The group created a custom malware framework and tailor-made credential gathering tools, but an apparent misconfiguration prevented the attack from executing properly. As Xenotime matures, it is less likely that the group will make this mistake in the future.”
Read more about the newly identified threat group called Xenotime on TechTarget.
A severe vulnerability in a widely used industrial control software could have been used to disrupt and shut down power plants and other critical infrastructure. Researchers at security firm Tenable found the flaw in the popular Schneider Electric software, used across the manufacturing and power industries, which if exploited could have allowed a skilled attacker to attack systems on the network.
It’s the latest vulnerability that risks an attack to the core of any major plant’s operations at a time when these systems have become a greater target in recent years. The report follows a recent warning, issued by the FBI and Homeland Security, from Russian hackers.
Read more about the bug in the industrial control software that could leave power and manufacturing plants exposed on ZDNet.
Medical devices produced by Becton, Dickinson and Company (BD) are vulnerable to the infamous KRACK bug, potentially exposing patient records. Discovered in October, KRACK, which stands for Key Reinstallation Attack, exploits a flaw in the Wi-Fi Protected Access II (WPA2) protocol which is used to secure modern wireless networks.
If exploited, KRACK gives threat actors the key required to join wireless networks which would otherwise require a password for authentication. Once they have joined, they can snoop on network traffic, perform Man-in-The-Middle (MiTM) attacks, hijack connections, and potentially send out malicious network packets. In a security bulletin, BD said that successful exploit in a select range of products could also lead to patient record changes or exfiltration, and major IT disruptions.
Read more about how the KRACK Wi-Fi vulnerability can be used to steal and tamper with patient records on ZDNet.