Software that tracks people on social media created by defence firm

A multinational security firm has secretly developed software capable of tracking people's movements and predicting future behaviour by mining data from social networking websites.

A video obtained by the Guardian reveals how an "extreme-scale analytics" system created by Raytheon, the world's fifth largest defence contractor, can gather vast amounts of information about people from websites including Facebook, Twitter and Foursquare.

Raytheon says it has not sold the software – named Riot, or Rapid Information Overlay Technology – to any clients.
....

The sophisticated technology demonstrates how the same social networks that helped propel the Arab Spring revolutions can be transformed into a "Google for spies" and tapped as a means of monitoring and control.

Using Riot it is possible to gain an entire snapshot of a person's life – their friends, the places they visit charted on a map – in little more than a few clicks of a button.

.....

The power of Riot to harness popular websites for surveillance offers a rare insight into controversial techniques that have attracted interest from intelligence and national security agencies, at the same time prompting civil liberties and online privacy concerns.

....

n April, Riot was scheduled to be showcased at a US government and industry national security conference for secretive, classified innovations, where it was listed under the category "big data – analytics, algorithms."

According to records published by the US government's trade controls department, the technology has been designated an "EAR99" item under export regulations, which means it "can be shipped without a licence to most destinations under most circumstances".

Click here to read more ....

Broad Powers Seen for Obama in Cyberstrikes

WASHINGTON — A secret legal review on the use of America’s growing arsenal of cyberweapons has concluded that President Obama has the broad power to order a pre-emptive strike if the United States detects credible evidence of a major digital attack looming from abroad, according to officials involved in the review. 

....

That decision is among several reached in recent months as the administration moves, in the next few weeks, to approve the nation’s first rules for how the military can defend, or retaliate, against a major cyberattack. New policies will also govern how the intelligence agencies can carry out searches of faraway computer networks for signs of potential attacks on the United States and, if the president approves, attack adversaries by injecting them with destructive code — even if there is no declared war.

....

Mr. Obama is known to have approved the use of cyberweapons only once, early in his presidency, when he ordered an escalating series of cyberattacks against Iran’s nuclear enrichment facilities. The operation was code-named Olympic Games, and while it began inside the Pentagon under President George W. Bush, it was quickly taken over by the National Security Agency, the largest of the intelligence agencies, under the president’s authority to conduct covert action.

As the process of defining the rules of engagement began more than a year ago, one senior administration official emphasized that the United States had restrained its use of cyberweapons. “There are levels of cyberwarfare that are far more aggressive than anything that has been used or recommended to be done,” the official said. 

....

While many potential targets are military, a country’s power grids, financial systems and communications networks can also be crippled. Even more complex, nonstate actors, like terrorists or criminal groups, can mount attacks, and it is often difficult to tell who is responsible. Some critics have said the cyberthreat is being exaggerated by contractors and consultants who see billions in potential earnings.

One senior American official said that officials quickly determined that the cyberweapons were so powerful that — like nuclear weapons — they should be unleashed only on the direct orders of the commander in chief. 

....

The Obama administration has urged stronger firewalls and other systems to provide a first line of defense, and then “resiliency” in the face of cyberattacks. It failed to get Congress to pass cybersecurity legislation that would have allowed the government to mandate standards. 

Click here to read more ....

Schmidt slams China as world's most prolific hacker

Google executive chairman Eric Schmidt has strongly criticised China, claiming the country is the world’s most prolific hacker of foreign firms and predicting that its actions will increasingly drive Western tech vendors closer to their governments.

The remarks came in a new book, The New Digital Age, which the Wall Street Journal has managed to get its hands on.

....

“The United States will not take the same path of digital corporate espionage, as its laws are much stricter (and better enforced) and because illicit competition violates the American sense of fair play,” the book states, according to the WSJ.

....

Most interestingly, the book apparently claims that Western tech firms may increasingly find themselves aligned with their governments in opposition to China and work to co-ordinate efforts “on both diplomatic and technical levels”.

....

Click here to read more ....

Twitter clients stay signed in with pre-breach passwords

OAuth means apps can connect despite reset of passwords made unsafe by breach

Twitter has detected a breach and suggested 250,000 users change their passwords. Yet users who heed that advice will still find that apps using the Twitter API, including the company's own, allow access to the service without asking users to enter the new password.
.....
A password change performed on the web did not, however, cause Twitter's own apps for iPad (under iOS 5.1.1 on an iPad 1) or iOS (under iOS 6 on an iPhone 5) to prompt us for the new password. Instead, it remained possible to post tweets from both.
....
Other users of Twitter's iOS app confirmed the same issue, one telling The Reg that only after he deleted and re-installed the app was he prompted for a new password.
......
Twitter spokesperson Jim Prosser did not deny that clients can continue to access the service even after passwords have been changed, and told The Reg, by email, that “TweetDeck and other clients use [open authentication standard] OAuth, so as long as you don't sign out, you don't have to re-input your credential every time you open the app.”
.....

Click here to read more ...... 

US Department of Energy hacked, employees' personal information stolen

by Graham Cluley on February 4, 2013

According to media reports, the US Department of Energy has been hit by a "sophisticated cyber attack" in the last few weeks, which resulted in the personal information of several hundred employees being compromised.
......

The FBI is said to be investigating the hack, which occurred two weeks ago at the Department of Energy's Washington-based HQ, and affected 14 servers and 20 desktop workstations.

A Fox News headline on the incident attempts to link the attack to Chinese hackers, but the original Free Beacon report admits that both the source and identity of the hackers is unknown.
......

But, once again, it's important to remember that it's very hard to prove who is behind an internet attack - especially as hackers can easily bounce their attacks between multiple compromised computers spread around the globe.

And there is a chance that China could become an all-too-convenient bogeyman, that can easily be blamed for any embarrassing security breach.
...... 


Click here to read more ....

Global credit card fraud: New malware behind fraud, suspect bankers

Bankers say that the spurt in credit card frauds is possibly caused by a new malware Dexter which has been used to commit digital fraud internationally.

Typically digital fraud involves hackers breaking into either a banking network or payment aggregator's server or what is being seen as more recent trend -installing a malware in the point of sale. Bankers feel this is likely because the pattern is unlike earlier cases of skimming where numbers are limited and are concentrated in some geographies.
.......
Scamsters buy individual information after sampling few card numbers. Bankers say that since cards are invariably blocked after an initial transaction, scamsters buy card information in bulk and these are sold at prices as low as $2 per card information. Once this information is available it can be used to clone cards. Theoretically, card information can be stolen from a retail chain in India, by a hacker in Russia and sold to scamsters in US.
......
Precautions to prevent cyber fraud 

Things to remember 

* Never access your banking account from a cyber cafe or a shared computer as you can never know how you are being monitored, or what spy software might be installed on those machines. 

* Always use your home computer 

* Be careful of any emails that ask you to update your bank account info. They could be an attempt at phishing, which could result in identity theft. 

* Never open any attachments from sources that you do not know 

* Do not give any confi dential information such as password, customer ID, credit/debit card number or PIN, CVV, DOB to any email request, even if the request appears to be coming from govt authorities like I-T dept or any associate company like VISA or Master Card 

* Don't click on any link that you receive in your email even if it appears to be from your bank. Instead, make it a point to remember the URL, and type it manually in the address bar before making any transactions. Scammers create websites that look and feel authentic 

* Always update your operating system for security patches. Also use a reputed anti-virus 

* When choosing a password for your banking accounts, choose something that is long and includes upper, lower case & special characters 

* Avoid using your birthdates or anniversaries as passwords as these can easily be guessed 

* Scammers use publicly available information on social networking sites to identify and lure potential victims 

* Check SSL (Secure Socket Layer)/ https security on login page of bank's website. The 's' after the 'http' denotes the site is secure 

Must do 

* Most banks recommend that you apply for a replacement credit card after returning back from a foreign trip. 

* Dealing on foreign websites could be riskier as the 2-factor authentication mandated by the RBI (besides login and PIN) is for web businesses in India only 

* Scratch out the three digit CVV number at the back of your card. Also sign the strip on your credit/debit card as it makes it tougher for anyone else to use 

* Notify your credit-card provider/bank immediately of any illegal use of your card from an online transaction. The longer you wait, the more diffi cult it can be to resolve the situation, especially if you've become a victim of identity theft


Click here to read more ...... 

Credit card fraud higher in Southeast Asia, say banks, travel agents

CHENNAI: Credit cards may be the most convenient way to pay on a trip abroad, but in some countries it is unsafe to use them. It is riskier to swipe credit cards in Sri Lanka, Thailand, the Philippines, Malaysia, and Indonesia than in Europe, warn travel agents. 

Many travel agents have an informal list of countries where it is risky to use credit cards because information can be stolen and misused. Credit card information thieves often target tourists who buy electronics, or visit pubs and clubs. 

"We tell travelers not to use credit cards at clubs, pubs, casinos, department stores or small shops when they travel abroad. It is a risk to use ATM machines in Malaysia. There is no advisory or black list available, but we get a lot of feedback from other travel agents about customer experiences abroad," said Basheer Ahmed, an office-bearer of Travel Agents' Federation of India.

.........

Click here to read more ....

Global credit card fraud: 5 Indians among 18 charged in New York

NEWARK: At least five Indian-origin men are among 18 people charged in New York for running a whopping $200 million global credit card fraud under which they used thousands of fake identities to dupe businesses and financial firms and wired millions of dollars to Pakistan and India. 
....
Law enforcement officers from the FBI arrested 13 men and searched locations in New Jersey, New York, Pennsylvania and Connecticut. Among those charged are Babar Quereshi (59), Ijaz Butt (53), Raghbir Singh (57), Mohammad Khan (48), Sat Verma (60), Vijay Verma (45), Tarsem Lal (74) and Vinod Dadlani (49). Each of them faces a maximum penalty of 30 years in jail and a $1 million fine. 

"The criminal activity highlights an extensive, sophisticated, organized scheme, executed against US financial institutions, which, in turn, affects every US citizen," acting special agent in charge David Velazquez said. 
.......

Click here to read more ....

Hackers in China Attacked The Times for Last 4 Months

SAN FRANCISCO — For the last four months, Chinese hackers have persistently attacked The New York Times, infiltrating its computer systems and getting passwords for its reporters and other employees.

.......
The timing of the attacks coincided with the reporting for a Times investigation, published online on Oct. 25, that found that the relatives of Wen Jiabao, China’s prime minister, had accumulated a fortune worth several billion dollars through business dealings.
.........
The hackers tried to cloak the source of the attacks on The Times by first penetrating computers at United States universities and routing the attacks through them, said computer security experts at Mandiant, the company hired by The Times. This matches the subterfuge used in many other attacks that Mandiant has tracked to China.
...........

Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees, most of them outside The Times’s newsroom. Experts found no evidence that the intruders used the passwords to seek information that was not related to the reporting on the Wen family.
.............

Click here to read more ....

Hack Attack On 'New York Times' Looks Like Part Of Chinese Campaign

This news ...

"For the last four months, Chinese hackers have persistently attacked The New York Times, infiltrating its computer systems and getting passwords for its reporters and other employees."

... appears to be "part of a broader campaign against American media reporting on Chinese leaders," NPR's Louisa Lim reports from Beijing.

......

Update at 4:45 p.m. ET. Wall Street Journal Hacked, Too:

The Wall Street Journal reports that it, too, "had been infiltrated by Chinese hackers."

The Journal reports:

"'Evidence shows that infiltration efforts target the monitoring of the Journal's coverage of China and are not an attempt to gain commercial advantage or to misappropriate customer information,' Paula Keve, chief spokeswoman for the Journal's parent company, Dow Jones & Co., said in a written statement Thursday. Dow Jones is a unit of News Corp.

"The infiltration of networks related to coverage of China is an "ongoing issue," Ms. Keve said. 'We continue to work closely with the authorities and outside security specialists, taking extensive measures to protect our customers, employees, journalists and sources.'"

.......

Click here to read more ....

Security Flaws in Universal Plug and Play: Unplug, Don't Play

Posted by HD Moore in Information Security on Jan 29, 2013 1:05:19 AM on  Street Security


This morning we released a whitepaper entitled Security Flaws in Universal Plug and Play. This paper is the result of a research project spanning the second half of 2012 that measured the global exposure of UPnP-enabled network devices. The results were shocking to the say the least. Over 80 million unique IPs were identified that responded to UPnP discovery requests from the internet. Somewhere between 40 and 50 million IPs are vulnerable to at least one of three attacks outlined in this paper. The two most commonly used UPnP software libraries both contained remotely exploitable vulnerabilities. In the case of the Portable UPnP SDK, over 23 million IPs are vulnerable to remote code execution through a single UDP packet. All told, we were able to identify over 6,900 product versions that were vulnerable through UPnP. This list encompasses over 1,500 vendors and only took into account devices that exposed the UPnP SOAP service to the internet, a serious vulnerability in of itself.
...





Click here to read more ....

Web smut sites are SAFER than search engines, declares Cisco

Cisco proclaimed that it is more dangerous to click on a web ad than a porn site these days as it unveiled the latest version of its security threat report.
......

Chris Young, senior veep for Cisco's Security and Government Group, said the nature of IT security threats were changing in the same way as the industry as a whole, meaning "the cloud" and "mobility" are trends for the cybercrime community too. This means that security managers should worry less about securing the perimeter and consider the "any-to-any" problem (any user, on any device, on any connection).

Cyber criminals and other miscreants were hitting their targets where they were most likely to gather, he said, and were increasingly launching "combinational" attacks.

This throws up some, arguably counterintuitive, conclusions. Malicious content is 27 times more likely to be encountered via search engines than counterfeit software, the vendor's 2012 Annual Security Report claims.

.......

Click here to read more ....

Hacker faces 105 years inside after FBI 'sexploitation' arrest

The FBI has announced the arrest of a 27-year-old man over charges that he hacked into the data of over 350 female victims and blackmailed them into providing him with nude photographs and video calls.

Karen "Gary" Kazaryan, 27, was arrested in Glendale, California on Tuesday after being indicted on 15 counts of computer intrusion and 15 counts of aggravated identity theft, and faces a possible 105 years in the Big House if convicted. Police found over 3,000 images of women he is claimed to have targeted on his computer.

According to the FBI – which dubbed the case one of "sextortion" – between 2009 and 2010, Kazaryan hacked into women's computers and email accounts in search for images of the victim unclothed, as well as any passwords and details on their female friends. He would then contact these friends, pretending to be the victim, and persuade them to disrobe so he could take pictures of them.

..........


Police say over 350 women have been traced from Kazaryan's records so far, but others are still unidentified. Anyone thought to have been affected by this should contact the FBI’s Los Angeles Field Office at +1 (310) 477-6565.

.......

Click here to read more ....

Apple blocks Java on the Mac over security concerns

......

Apple, along with browser manufacturers, started blocking Java when a major security hole was discovered in the code earlier in the month. Oracle downplayed its significance, but then was forced to admit that it had a problem and rushed out a code patch (with the obligatory offers to install crapware at the same time).

Now Apple has blocked it again, and other players are starting to make moves to get rid of Java as far as possible. On Tuesday, Mozilla announced it was ending the auto-loading of plug-ins for Firefox – while not actually mentioning Java by name – and Apple has already stopped bundling it with OS X by default.

'No Java for you!', says Apple (source: MacGeneration)

.......

Click here to read more ....

Russia, China seek new cybercrime agreement

Russia and China are pushing for a new agreement to combat cybercrime, Federation Council Speaker Valentina Matviyenko said on Monday.

All the Asia Pacific Parliamentary Forum's member states are concerned by the problem, but they are split on how best to tackle it, she said.

She explained that a new initiative in this area is needed because of how much has changed since the declaration on cyber security was adopted in Budapest a decade ago.

“During these 10 years, [cyber] space has changed so greatly that Russia, China and a number of other countries insist on the preparation of a new agreement to combat cybercrime,” Matviyenko said.

“Frankly speaking, no one has proposed any effective ways, effective measures of meeting this new challenge.”

......


Click here to read more ....

Pentagon plans massive surge in Cyber Command staff

Boosting online warrior numbers from 900 to 4,900

By Iain Thomson in San Francisco 

The US military is planning a massive increase in the capabilities of its Cyber Command online-warfare department as it seeks to exert dominance over the digital battlefield.

.....

Currently there are around 900 uniformed and civilian staff employed by the Pentagon in its Cyber Command, which is separate from the National Security Agency – at least in principle. In practice, however, the two work side-by-side, and both are headed by the same man, General Keith Alexander

A senior defense official told the paper that the Pentagon would primarily focus on online activity outside of US domestic borders, and would only be involved in major online attacks, not minor hacking and phishing annoyances. US companies and those international companies that use American-hosted services won't be touched.

....

The staffing increase is scheduled to begin later this year and next, but there are likely to be problems simply finding that many people with the right skills to do the job. The military was at last year's Black Hat hacking conference looking for recruits and support from the private security industry, but weren't finding many takers.
Security researchers who have worked with the Pentagon have complained that all too often the government wants to know their security tricks, but isn't willing to share its knowledge or pay the kind of rates that researchers can make in private industry.

........



Click here to read more ....

Israeli Troops Swap Guns for Computers as Cyber Attacks Rise

At an army base outside Tel Aviv, soldiers sit in front of screens glued to scrolling colored computer code, keyboards at the ready to deflect attacks.

They’re Israel’s cyber defense team in training, among the uniformed men and women learning how to stalk hackers and pounce on virtual enemies as the state shields everything from ministry websites to the systems running the Tel Aviv stock market.

“To become one of the leading countries in cyber security, we have to act quickly to ensure that everyone will understand Israel is on its way to becoming a leading cyber-nation,” Rami Efrati, head of the civilian division of the National Cyber Bureau, said in an interview at the year-old agency this month. “Cyber security can be a national growth engine.”

.......

Israeli government networks are among the most highly attacked in the world, with daily assaults numbering in the tens of thousands, the Soufan Group, a New York-based security adviser, said in a Jan. 14 report.

Two months ago, civilian computer technicians sat in front of a bank of screens in a Jerusalem government building deflecting millions of attempted attacks on Israeli government websites as the country’s air force struck the Hamas-controlled Gaza Strip and rockets hit Israel’s towns and cities.

Palestinian militants in Gaza consider cyber part of their resistance to Israel. “Our professional hackers never sleep,” said the spokesman for a pro-Hamas group who goes by the name Abu Mujahid. Islamic Jihad, which like Hamas is considered a terrorist organization by Israel, the U.S. and the European Union, said in November its operatives hacked into 5,000 mobile phones belonging to senior Israeli army officers.

......

Click here to read more ....

Activists urge Skype: Tell us who is spying on us

Microsoft mum on privacy, security policies

By Neil McAllister in San Francisco • Get more from this author

Posted in Security, 25th January 2013 02:11 GMT

A coalition of activists, privacy organizations, journalists, and others have called upon Microsoft to be more forthright about when, why, and to whom it discloses information about Skype users and their communications.

.......

Among the group's concerns is that although Skype was founded in Europe, its acquisition by a US-based company – Microsoft – may mean it is now subject to different eavesdropping and data-disclosure requirements than it was before.

The group claims that both Microsoft and Skype have refused to answer questions about what kinds of user data the service retains, whether it discloses such data to governments, and whether Skype conversations can be intercepted.

The letter calls upon Microsoft to publish a regular Transparency Report outlining what kind of data Skype collects, what third parties might be able to intercept or retain, and how Skype interprets its responsibilities under the laws that pertain to it. In addition it asks for quantitative data about when, why, and how Skype shares data with third parties, including governments.

.......

Click here to read more ......

Australia puts digital frontier at heart of national security plan

Prepares for ‘long, persistent fight’ online with new national Cyber Security Centre

By Simon Rockman • Get more from this author

Posted in Government, 23rd January 2013 03:06 GMT

Australia is tooling up for a “long, persistent fight” online, and believes digital combat will be as important to the nation’s future security as involvements in Iraq and Afghanistan were in the last decade.

No less a figure that Prime Minister Julia Gillard expressed that opinion today in a speech billed as a landmark security policy pronouncement that had as its premise the assertion that “The 9/11 decade is ending and a new one is taking its place.”

To ready the nation for coming online battles, Gillard said Australia will combine the infosec functions of several agencies – the Attorney-General’s Department, the Australian Defence Force, ASIO, the Australian Federal Police and the Australian Crime Commission - in a single location to operate as the new Australian Cyber Security Centre. The new operation should be up and running by year’s end.
.....

One signal missing from the speech is just how the Centre will engage with the private sector. One element of that sector - security vendors - has not been shy of approaching the Australian government to push their agendas and have not been rebuffed when the offer aid. McAfee recently helped to prepare a cyber-safety campaign for Australian children, while The Register is aware of a prominent security vendor’s involvement in lobbying for and formulating data breach laws due to go before Parliament this year.
One hint of what the new Centre might get up to derives, in part, from our own story that ASIO, Australia’s largest intelligence agency, has changed its recruiting practices to ensure it has specialist staff to assist in its work.
.......

Click here to read more ....

"Red October" Diplomatic Cyber Attacks Investigation

Executive Summary

In October 2012, Kaspersky Lab’s Global Research & Analysis Team initiated a new threat research after a series of attacks against computer networks of various international diplomatic service agencies. A large scale cyber-espionage network was revealed and analyzed during the investigation, which we called «Red October» (after famous novel «The Hunt For The Red October»).

This report is based on detailed technical analysis of a series of targeted attacks against diplomatic, governmental and scientific research organizations in different countries, mostly related to the region of Eastern Europe, former USSR members and countries in Central Asia.

The main objective of the attackers was to gather intelligence from the compromised organizations, which included computer systems, personal mobile devices and network equipment.

The earliest evidence indicates that the cyber-espionage campaign was active since 2007 and is still active at the time of writing (January 2013). Besides that, registration data used for the purchase of several Command & Control (C&C) servers and unique malware filenames related to the current attackers hints at even earlier time of activity dating back to May 2007.

Main Findings

Advanced Cyber-espionage Network: 

Unique architecture: 

Broad variety of targets: 

Importation of exploits:

Attacker identification: 

Anatomy of the attack

General description

These attacks comprised of the classical scenario of specific targeted attacks, consisting of two major stages:

1. Initial infection
2. Additional modules deployed for intelligence gathering

The malicious code was delivered via e-mail as attachments (Microsoft Excel, Word and, probably PDF documents) which were rigged with exploit code for known security vulnerabilities in the mentioned applications.

Right after the victim opened the malicious document on a vulnerable system, the embedded malicious code initiated the setup of the main component which in turn handled further communication with the C&C servers.

Next, the system receives a number of additional spy modules from the C&C server, including modules to handle infection of smartphones.

The main purpose of the spying modules is to steal information. This includes files from different cryptographic systems, such as «Acid Cryptofiler», (see https://fr.wikipedia.org/wiki/Acid_Cryptofiler) which is known to be used in organizations of European Union/European Parliament/European Commission since the summer of 2011. All gathered information is packed, encrypted and only then transferred to the C&C server.

.......

Another noteworthy fact is in the first line of this file, which is a command to switch the codepage of an infected system to 1251. This is required to address files and directories that contain Cyrillic characters in their names.

The «LHAFD.GCP» file is encrypted with RC4 and compressed with the "Zlib" library. This file is essentially a backdoor, which is decoded by the loader module (svchost.exe). The decrypted file is injected into system memory and is responsible for communication with the C&C server.

...........

There is a notable module among all others, which is essentially created to be embedded into Adobe Reader and Microsoft Office applications. The main purpose of its code is to create a foolproof way to regain access to the target system. The module expects a specially crafted document with attached executable code and special tags. The document may be sent to the victim via e-mail. It will not have an exploit code and will safely pass all security checks. However, like with exploit case, the document will be instantly processed by the module and the module will start a malicious application attached to the document.

.....

Timeline

We have identified over 1000 different malicious files related to over 30 modules of this Trojan kit. Most of them were created between May 2010 and October 2012.

There were 115 file-creation dates identified which are related to these campaigns via emails during the last two and a half years. Concentration of file creation dates around a particular day may indicate date of the massive attacks (which was also confirmed by some of our side observations):

Year 2010

• 19.05.2010
• 21.07.2010
• 04.09.2010

Year 2011

• 05.01.2011
• 14.03.2011
• 05.04.2011
• 23.06.2011
• 06.09.2011
• 21.09.2011

Year 2012

• 12.01.2012

Targets

We used two approaches to identify targets for these attacks. First, we used the Kaspersky Security Network (KSN) and then we set up our own sinkhole server. The data received using two independent ways was correlating and this confirmed objective findings.

........

RUSSIAN FEDERATION	35
KAZAKHSTAN	21
AZERBAIJAN	15
BELGIUM	15
INDIA	15
AFGHANISTAN	10
ARMENIA	10
IRAN	7
TURKMENISTAN	7
UKRAINE	6
UNITED STATES	6
VIET NAM	6
BELARUS	5
GREECE	5
ITALY	5
MOROCCO	5
PAKISTAN	5
SWITZERLAND	5
UGANDA	5
UNITED ARAB EMIRATES	5
BRAZIL	4
FRANCE	4
GEORGIA	4
GERMANY	4
JORDAN	4
MOLDOVA	4
SOUTH AFRICA	4
TAJIKISTAN	4
TURKEY	4
UZBEKISTAN	4
AUSTRIA	3
CYPRUS	3
KYRGYZSTAN	3
LEBANON	3
MALAYSIA	3
QATAR	3
SAUDI ARABIA	3
CONGO	2
INDONESIA	2
KENYA	2
LITHUANIA	2
OMAN	2
TANZANIA	2

Countries with more than one infections

From the point of view of country distribution of connections to the sinkhole, we have observed victims in 39 countries, with most of IPs being from Switzerland. Kazakhstan and Greece follow next.

I.......

KSN + sinkhole data

Some of the victim organizations were identified using IP addresses and public WHOIS information or remote system names.

Most «interesting» out of those are:

Algeria - Embassy

Afghanistan - Gov, Military, Embassy,

Armenia - Gov, Embassy

Austria - Embassy

Azerbaijan - Oil/Energy, Embassy, Research,

Belarus - Research, Oil/Energy, Gov, Embassy

Belgium - Embassy

Bosnia and Herzegovina - Embassy

Botswana - Embassy

Brunei Darussalam – Gov

Congo – Embassy

Cyprus - Embassy, Gov

France - Embassy, Military

Georgia - Embassy

Germany - Embassy

Greece – Embassy

Hungary -Embassy

India – Embassy

Indonesia - Embassy

Iran – Embassy

Iraq – Gov

Ireland - Embassy

Israel - Embassy

Italy -Embassy

Japan - Trade, Embassy

Jordan - Embassy

Kazakhstan - Gov, Research, Aerospace, Nuclear/Energy, Military

Kenya - Embassy

Kuwait - Embassy

Latvia - Embassy

Lebanon - Embassy

Lithuania - Embassy

Luxembourg - Gov

Mauritania - Embassy

Moldova - Gov, Military, Embassy

Morocco - Embassy

Mozambique - Embassy

Oman - Embassy

Pakistan - Embassy

Portugal - Embassy

Qatar - Embassy

Russia - Embassy, Research, Military, Nuclear/Energy

Saudi Arabia - Embassy

South Africa - Embassy

Spain - Gov, Embassy

Switzerland - Embassy

Tanzania - Embassy

Turkey - Embassy

Turkmenistan - Gov, Oil/Energy

Uganda - Embassy

Ukraine - Military

United Arab Emirates - Oil/Energy, Embassy, Gov

United States - Embassy

Uzbekistan - Embassy

............

For instance, a top level XLS dropper presumably used against a Polish target, named “Katyn_-_opinia_Rosjan.xls” contains the hardcoded victim ID “F50D0B17F870EB38026F”. A similar XLS named “tactlist_05-05-2011_.8634.xls / EEAS New contact list (05-05-2011).xls” possibly used in Moldova contains a victim ID “FCF5E48A0AE558F4B859”.

Click here to read more ....