African internet riches threatened by lawsuit and corruption

December 23, 2021Frank Articles, Blog AFRINIC, Internet, IP addresses

Two young boys use a computer at an internet cafe in the low-income Kibera neighborhood of Nairobi, Kenya Wednesday, Sept. 29, 2021. Instead of serving Africa's internet development, millions of internet addresses reserved for Africa have been waylaid, some fraudulently, including in insider machinations linked to a former top employee of the nonprofit that assigns the continent's addresses. (AP Photo/Brian Inganga)

By ALAN SUDERMAN, FRANK BAJAK and RODNEY MUHUMUZA

November 23, 2021

KAMPALA, Uganda (AP) — Outsiders have long profited from Africa’s riches of gold, diamonds, and even people. Digital resources have proven no different.

Millions of internet addresses assigned to Africa have been waylaid, some fraudulently, including through insider machinations linked to a former top employee of the nonprofit that assigns the continent’s addresses. Instead of serving Africa’s internet development, many have benefited spammers and scammers, while others satiate Chinese appetites for pornography and gambling.

New leadership at the nonprofit, AFRINIC, is working to reclaim the lost addresses. But a legal challenge by a deep-pocketed Chinese businessman is threatening the body’s very existence.

The businessman is Lu Heng, a Hong Kong-based arbitrage specialist. Under contested circumstances, he obtained 6.2 million African addresses from 2013 to 2016. That’s about 5% of the continent’s total — more than Kenya has.

AFRINIC made no claim of graft when it revoked Lu’s addresses, now worth about $150 million, saying his company was not adequately serving Africa’s interests. Lu fought back. His lawyers in late July persuaded a judge in Mauritius, where AFRICNIC is based, to freeze its bank accounts. His company also filed a $80 million defamation claim against AFRINIC and its new CEO.

It’s a shock to the global networking community, which has long considered the internet as technological scaffolding for advancing society. Some worry it could undermine the entire numerical address system that makes the internet work.

Big Pentagon internet mystery partially solved

September 6, 2021September 6, 2021Frank Articles internet governance, Pentagon

By FRANK BAJAK

April 25, 2021

This image has an empty alt attribute; its file name is 1000.jpeg

BOSTON (AP) — A very strange thing happened on the internet the day President Joe Biden was sworn in. A shadowy company residing at a shared workspace above a Florida bank announced to the world’s computer networks that it was now managing a colossal, previously idle chunk of the internet owned by the U.S. Department of Defense.

That real estate has since more than quadrupled to 175 million addresses — about 1/25th the size of the current internet.

”It is massive. That is the biggest thing in the history of the internet,” said Doug Madory, director of internet analysis at Kentik, a network operating company. It’s also more than twice the size of the internet space actually used by the Pentagon.

After weeks of wonder by the networking community, the Pentagon has now provided a very terse explanation for what it’s doing. But it has not answered many basic questions, beginning with why it chose to entrust management of the address space to a company that seems not to have existed until September.

FULL STORY

In crosshairs of ransomware crooks, cyber insurers struggle

July 26, 2021Frank Articles cyber insurance, ransoms, ransomware, ransomware ban

By FRANK BAJAK

July 5, 2021

BOSTON (AP) — In the past few weeks, ransomware criminals claimed as trophies at least three North American insurance brokerages that offer policies to help others survive the very network-paralyzing, data-pilfering extortion attacks they themselves apparently suffered.

Cybercriminals who hack into corporate and government networks to steal sensitive data for extortion routinely try to learn how much cyber insurance coverage the victims have. Knowing what victims can afford to pay can give them an edge in ransom negotiations. The cyber insurance industry, too, is a prime target for crooks seeking its customers’ identities and scope of coverage.

Before ransomware evolved into a full-scale global epidemic plaguing businesses, hospitals, schools and local governments, cyber insurance was a profitable niche industry. It was accused of fueling the criminal feeding frenzy by routinely recommending that victims pay up, but kept many from going bankrupt.

Now, the sector isn’t just in the criminals’ crosshairs. It’s teetering on the edge of profitability, upended by a more than 400% rise last year in ransomware cases and skyrocketing extortion demands. As a percentage of premiums collected, cyber insurance payouts now top 70%, the break-even point.

FULL STORY

EXPLAINER: No ransomware silver bullet, crooks out of reach

July 26, 2021Frank Articles cybercrime, ransomware

By FRANK BAJAK

April 29, 2021

BOSTON (AP) — Political hand-wringing in Washington over Russia’s hacking of federal agencies and interference in U.S. politics has mostly overshadowed a worsening digital scourge with a far broader wallop: crippling and dispiriting extortionary ransomware attacks by cybercriminal mafias that mostly operate in foreign safe havens out of the reach of Western law enforcement.

Stricken in the United States alone last year were more than 100 federal, state and municipal agencies, upwards of 500 health care centers, 1,680 educational institutions and untold thousands of businesses, according to the cybersecurity firm Emsisoft. Dollar losses are in the tens of billions. Accurate numbers are elusive. Many victims shun reporting, fearing the reputational blight.

All the while, ransomware gangsters have become more brazen and cocky as they put more and more lives and livelihoods at risk. This week, one syndicate threatened to make available to local criminal gangs data they say they stole from the Washington, D.C., metro police on informants. Another recently offered to share data purloined from corporate victims with Wall Street inside traders. Cybercriminals have even reached out directly to people whose personal info was harvested from third parties to pressure victims to pay up.

“In general, the ransomware actors have gotten more bold and more ruthless,” said Allan Liska, an analyst with the cybersecurity firm Recorded Future.

On Thursday, a public-private task force including Microsoft, Amazon, the National Governors Association, the FBI, Secret Service and Britain and Canada’s elite crime agencies delivered to the White House an 81-page urgent action plan for an aggressive and comprehensive whole-of-government assault on ransomware.

FULL STORY

Tech audit of Colonial Pipeline found ‘glaring’ problems

July 26, 2021Frank Articles audit, Colonial Pipeline, cybersecurity, ransomware

By FRANK BAJAK

May 12, 2021

BOSTON (AP) — An outside audit three years ago of the major East Coast pipeline company hit by a cyberattack found “atrocious” information management practices and “a patchwork of poorly connected and secured systems,” its author told The Associated Press.

“We found glaring deficiencies and big problems,” said Robert F. Smallwood, whose consulting firm delivered an 89-page report in January 2018 after a six-month audit. “I mean an eighth-grader could have hacked into that system.”

How far the company, Colonial Pipeline, went to address the vulnerabilities isn’t clear. Colonial said Wednesday that since 2017, it has hired four independent firms for cybersecurity risk assessments and increased its overall IT spending by more than 50%. While it did not specify an amount, it said it has spent tens of millions of dollars.

FULL STORY

How the Kremlin provides a safe harbor for ransomware

April 30, 2021Frank Articles ransomware

By FRANK BAJAK
April 16, 2021

BOSTON (AP) — A global epidemic of digital extortion known as ransomware is crippling local governments, hospitals, school districts and businesses by scrambling their data files until they pay up. Law enforcement has been largely powerless to stop it.

One big reason: Ransomware rackets are dominated by Russian-speaking cybercriminals who are shielded — and sometimes employed — by Russian intelligence agencies, according to security researchers, U.S. law enforcement, and now the Biden administration.

On Thursday, as the U.S. slapped sanctions on Russia for malign activities including state-backed hacking, the Treasury Department said Russian intelligence has enabled ransomware attacks by cultivating and co-opting criminal hackers and giving them safe harbor. With ransomware damages now well into the tens of billions of dollars, former British intelligence cyber chief Marcus Willett recently deemed the scourge “arguably more strategically damaging than state cyber-spying.”

Convicted money-launderer Aleksander Vinnik

The value of Kremlin protection isn’t lost on the cybercriminals themselves. Earlier this year, a Russian-language dark-web forum lit up with criticism of a ransomware purveyor known only as “Bugatti,” whose gang had been caught in a rare U.S.-Europol sting. The assembled posters accused him of inviting the crackdown with technical sloppiness and by recruiting non-Russian affiliates who might be snitches or undercover cops.

FireEye CEO: Reckless Microsoft hack unusual for China

March 14, 2021March 14, 2021Frank Articles China, Exchange, FireEye, hacking, Hafnium, Kevin Mandia, Microsoft, web shell

By FRANK BAJAK and NATHAN ELLGREN
March 9, 2021

RESTON, Va. (AP) — Cyber sleuths have already blamed China for a hack that exposed tens of thousands of servers running Microsoft’s Exchange email program to potential hacks. The CEO of a prominent cybersecurity firm says it now seems clear China also unleashed an indiscriminate, automated second wave of hacking that opened the way for ransomware and other cyberattacks.

The second wave, which began Feb. 26, is highly uncharacteristic of Beijing’s elite cyber spies and far exceeds the norms of espionage, said Kevin Mandia of FireEye. In its massive scale it diverges radically from the highly targeted nature of the original hack, which was detected in January.

“You never want to see a modern nation like China that has an offense capability — that they usually control with discipline — suddenly hit potentially a hundred thousand systems,” Mandia said Tuesday in an interview with The Associated Press.

Mandia said his company assesses based on the forensics that two groups of Chinese state-backed hackers — in an explosion of automated seeding — installed backdoors known as “web shells” on an as-yet undetermined number of systems. Experts fear a large number could easily be exploited for second-stage infections of ransomware by criminals, who also use automation to identify and infect targets.

Casting a wide intrusion net: Dozens burned with single hack

March 14, 2021Frank Articles, Blog Accellion, Clop, SolarWinds, supply-chain hack

By FRANK BAJAK
March 7 , 2021

BOSTON — The SolarWinds hacking campaign blamed on Russian spies and the “grave threat” it poses to U.S. national security are widely known. A very different — and no less alarming — coordinated series of intrusions also detected in December has gotten considerably less public attention.

Nimble, highly skilled criminal hackers believed to operate out of Eastern Europe hacked dozens of companies and government agencies on at least four continents by breaking into a single product they all used.

The victims include New Zealand’s central bank, Harvard Business School, Australia’s securities regulator, the high-powered U.S. law firm Jones Day — whose clients include former President Donald Trump — the rail freight company CSX and the Kroger supermarket and pharmacy chain. Also hit was Washington state’s auditor’s office, where the personal data of up to 1.3 million people gathered for an investigation into unemployment fraud was potentially exposed.

The two-stage mega-hack in December and January of a popular file-transfer program from the Silicon Valley company Accellion highlights a threat that security experts fear may be getting out of hand: intrusions by top-flight criminal and state-backed hackers into software supply chains and third-party services.

Review: ‘Missionaries’ sees our forever wars as vocation

October 5, 2020Frank Articles Colombia, National Book Award, Novels, Phil Klay

By FRANK BAJAK
Oct. 5, 2020

Phil Klay’s “Redeployment” was a masterwork in mostly spare prose, its tonal range from laugh-out-loud, Joseph Heller-esque absurdity to soul-crushing bleakness. It may be our best literary window into the Iraq war.

A young Marine veteran’s literary debut, the short story collection won a 2014 National Book Award.

“Missionaries,” out Oct. 6 from Penguin Press, is Klay’s next act. A big, ambitious novel, it spans a few decades and continents and plumbs U.S. forever wars’ psychic imprint on peripatetic American warriors, militarism as a way of being and the consequences of ill-conceived foreign meddling.

Two U.S. Special Forces vets of Afghanistan and Iraq — transitioned to mercenary and a military attaché — have fought “in enough murky war zones to lack the near-religious faith in democracy that the war was sold on.” Their next stop is Colombia, where Washington’s targeting-killing apparatus, first turned on leftist insurgents, now hunts drug-trafficking warlords.

Secretive, never profitable Palantir makes market debut

October 5, 2020Frank Articles Big Brother tech, CIA, data-mining, deportation crackdown, ICE, IN-Q-Tel, Integrated Case Management, Palantir, surveillance

By FRANK BAJAK
September 30, 2020

BOSTON (AP) — Seventeen years after it was born with the help of CIA seed money, the data-mining outfit Palantir Technologies is finally going public in the biggest Wall Street tech offering since last year’s debut of Slack and Uber.

Never profitable and dogged by ethical objections for assisting in the Trump administration’s deportation crackdown, Palantir forged ahead Wednesday with a direct listing of its stock, gaining 31% in its first trading day.

The big question for both investors and company management: Can Palantir successfully transition from a business built on the costly handholding of government customers to serving corporate customers at scale? The company is a hybrid provider of software and consulting services that often embeds its own engineers with clients.