Mediaboss Marketing

The group that released two vulnerabilities used in Tuesday's ransomware outbreak one of which was also used in the similarly devastatingWannaCry outbreak in May is making an effort to capitalize on the notoriety.

The ShadowBrokers, which claims to be releasing cyber weaponry stolen from the National Security Agency, announced pricing changes to a "wine of the month"-type leak program and a new "VIP" product in their attempts to monetize the hacking tools and apparent government documents in their possession.

"Another global cyber attack is fitting end for first month of theshadowbrokers dump service. There is much theshadowbrokers can be saying about this but what is point and having not already being said? So to business! Time is still being left to make subscribe and getting June dump. Dont be let company fall victim to next cyber attack, maybe losing big bonus or maybe price on stock options be going down after attack. June dump service is being great success for theshadowbrokers, many many subscribers, so in July theshadowbrokers is raising price," the ShadowBrokers wrote in an online message released early Wednesday.

The ShadowBrokers have been active since summer 2016and have over time leaked potent hacking tools that could bypass security measures in popular security hardware and Windows machines, as well as documents appearing to show the NSA hacked a Middle Eastern banking services company as a vector into its clients.

Tuesday's attack also used a second ShadowBrokers vulnerability, EternalRomance, that targets Windows XP systems as well as a hacked updating feature for Ukrainian accounting software.

The Tuesday attack did most of its damage in Ukraine and Europe, but reports of infections have spread to India, throughout Asia and in the United States. Major victims include the U.S. law firmDLA Piper, the pharmaceutical giant Merck and the Russian oil firmRosneft.

WannaCry infected hundreds of thousands of computers worldwide.

The ShadowBrokers launched its monthly subscription document leaks service this month at a price of $27,000 a month in digital currency. Their new release more than doubles the price to $61,000.

The ShadowBrokers also announced a new premium service allowing customers to make requests for assistance or specific document releases.

"For months many peoples is messaging theshadowbrokers...Do you have X or Y vulnerability? Will you hack X or Y for me? Do you have intel on X or Y organization? Do you have intel on my organization? Have I been hacked? In past theshadowbrokers is not taking request or providing individual services. This changes with VIP Service," said the ShadowBrokers.

"For one time payment of [$120,000] you getting theshadowbrokers VIP attention. VIP Service is no guarantee of future good or services, negotiation for those is being separate."

The ShadowBrokers also used their latest announcement to threaten a critic, calling out someone the group only identified as "the doctor" who posted criticaltweets online. The ShadowBrokers claim the critic left enough digital breadcrumbs to embarrass them online.

"TheShadowBrokers is thinking 'doctor' person is co-founder of new security company and is having much venture capital. TheShadowBrokers is hoping 'doctor' person is deciding to subscribe to dump service in July. If theshadowbrokers is not seeing subscription payment with corporate email address of doctor@newsecuritycompany.com then theshadowbrokers might be taking tweets personally and dumping data of 'doctor' persons hacks of China with real id and security company name," it said.

Read more:
Alleged NSA leakers capitalize on ransomware scare based on their wares - The Hill

One of the surveillance state's biggest cheerleaders is seeing his years of support pay off.

Two congressional sources confirmed a May meeting, where Sen. John Cornyn, (R-Tex.), a vocal supporter of the intelligence community, got a private audience with the NSA Director Adm. Michael Rogers.

Cornyn also got a private tour of the signals intelligence facility at Fort Meade, Maryland at the same time as the May meeting.

Officials "familiar with the situation" (possibly read "jealous as hell") expressed concern about Cornyn's personal NSA tour. And for good reason. If Rogers and other NSA officials were feeding Cornyn information the rest of the NSA's Congressional oversight isn't privy to, that's a problem. It's more of a problem as the date for Section 702's reauthorization approaches. And it seems even more problematic that Cornyn was given a personal walk-and-talk while oversight members were failing to get substantive answers from the DNI during a Senate hearing.

There's a long history of the IC playing favorites with oversight members (and vice versa) and a long history of those favorites withholding information from other members of Congress. This visit/personal chat may have been innocuous but given its context -- the Section 702 renewal -- it looks shady as hell.

The additional context is the DNI's office believes all is forgiven -- or at least, no longer relevant. Reversing Clapper's promise to hand in something on incidentally-collected US persons' communications, the new Director is saying that's just not going to happen.

The Foreign Policy article notes that it's common for incoming reps and senators to be given a tour and that oversight members routinely visit the NSA as part of their oversight duties, but this Cornyn-only event definitely appears to be the agency making a play for unbridled support from a powerful Senator.

Read the original:
NSA Appears To Be Seducing Sen. John Cornyn With Personal Tours And One-On-One Meetings - Techdirt

Lawyers gather in court for the NSA contractor accused in top secret leak, Reality Winner, on June 27. Richard Miller

Attorney Titus Nichols told reporters outside court Tuesday afternoon that the discussion over the order centered on both sides knowing the rules of engagement regarding any potentially classified information.

That way if there is any type of information that is classified at any level, that everyone knows what the rules of engagement will be, so there is not going to be a risk of accidental release of information and definitely not going to be any intentional release of information thats classified, he said.

Prosecutor Jennifer Solari said during the hearing that a note pad with handwriting in Farsi was being reviewed and translated. Nichols told reporters after the hearing that the defense had not seen the notebook and thus was not able to discuss anything about it at the time.

Prosecutors are also examining two computers, hard drives, a tablet and four phones seized from Winner. They agreed to have all evidence discovery filed by August 25.

Nichols added that Winner was maintaining pretty well and that every conversation he had had with her has been positive, as his client remains in jail awaiting her trial.

Earlier this month,

Terry Pickard reported from Augusta, Georgia, and Daniella Silva reported from New York.

See the original post:
Alleged NSA Leaker Reality Winner Appears in Federal Court, Trial Date Set - NBCNews.com

The seals of the U.S. Cyber Command, the National Security Agency and the Central Security Service are pictured outside the campus the three organizations share in Fort Meade, Maryland. | Getty

By Eric Geller

06/27/2017 12:16 PM EDT

Updated 06/27/2017 05:49 PM EDT

A potent ransomware attack has gripped organizations around the world for the second time in less than two months.

And like the first outbreak in mid-May which claimed hundreds of thousands victims in a game-changing cyberattack Tuesday's outburst is spreading via a Microsoft flaw originally exposed in a leak of apparent NSA hacking tools.

Story Continued Below

The latest malicious software battered companies in Russia, Ukraine and many other countries in Europe, according to cybersecurity researchers, sending law enforcement officials scrambling and sparking fears about how the world would contain the outbreak of the malware, which locks up computer systems and demands ransom payments.

While the U.S. has been largely unscathed to this point, major multinational energy, shipping, banking, pharmaceutical and law firms, as well as government agencies, have confirmed they are fighting off cyberattacks.

Security firm Kaspersky Lab estimated it had seen 2,000 victims, and counting, throughout the day. While the estimate is significantly lower than the massive numbers tied to May's attack which relied on malware dubbed WannaCry some researchers noted technical details of the new malware that might make it harder to kill.

Researchers have also not yet linked the latest attack to any specific hacking group or nation-state, unlike May's digital ambush, which technical specialists and reportedly intelligence officials in the U.S. and U.K. traced to North Korean-backed hackers.

But security specialists have been warning for weeks that the recent WannaCry ransomware virus was only the beginning of these fast-spreading digital sieges.

WannaCry was powered by a variant of apparent NSA cyber weapons that were dumped online, raising questions about whether the secretive hacking agency should sit on such powerful tools instead of alerting companies like Microsoft to the deficiencies in their software.

Experts say hackers have likely been working to tweak the WannaCry malware, potentially allowing new versions to skirt the digital defenses that helped stall the first global assault.

Sign up for POLITICO Playbook and get the latest news, every morning in your inbox.

By signing up you agree to receive email newsletters or alerts from POLITICO. You can unsubscribe at any time.

Indeed, the virus that proliferated Tuesday shares many similarities with WannaCry, but contains some striking differences.

For starters, Tuesday's virus proliferated using the same Microsoft Windows flaw as WannaCry, according to digital security firms Symantec and Bitdefender Labs. But researchers noted the malware is also capable of hopping around using multiple Microsoft flaws, not just the most famous one exposed in the online dump of the purported NSA cyber weapons.

Additionally, like WannaCry, this new malware demands that victims pay a ransom using the digital currency Bitcoin before their files can be unlocked. As of Tuesday evening, 32 victims had paid a ransom, with the number steadily climbing.

Unlike WannaCry, however, the rapidly spreading malware does not merely encrypt files as part of its ransom scheme. Rather, it changes critical system files so that the computer becomes unresponsive, according to John Miller, a senior manager for analysis at the security firm FireEye, which reviewed the malware.

Some researchers identified the infection as a novel variation of the so-called Petya malware, which has been around since 2016. But researchers at Kaspersky believe it is a totally new strain they are dubbing ExPetr.

A sample of the malware initially went undetected by nearly all antivirus software.

The digital weapon cloaks itself as a file that Microsoft has already approved as safe, helping it avoid detection, Costin Raiu, director of global research efforts at Kaspersky, said on Twitter.

The malware was written on June 18, according to a sample that Kaspersky has analyzed.

Most of the infections on Tuesday were in Ukraine, with Russia the next hardest hit, according to Kasperskys analysis. Russia was also a major victim during the WannaCry outbreak. Raiu told POLITICO that Belarus, Brazil, Estonia, the Netherlands, Turkey and the United States were also affected, but that those countries accounted for less than 1 percent of all victims.

A Department of Homeland Security spokesman said the agency was "monitoring reports" of the ransomware campaign and coordinating with international authorities.

Researchers suspect that Ukraine became the nexus of the outburst after companies using a popular tax program unknowingly downloaded an update that contained the ransomware. From there, the virus could have spread beyond those companies using various flaws in Windows.

The ransomware eruption may be responsible for several major cyber incidents that began Tuesday.

The global shipping and logistics firm Maersk which is based in Denmark confirmed that it was dealing with a intrusion affecting "multiple sites and business units." And the Russian oil company Rosneft said it was responding to "a massive hacker attack."

Ukraine's central bank and its capital city's main airport also said they were dealing with cyberattacks. The virus appeared to be hitting the country's government computers as well.

The cyberattack also forced the Ukraine-based Chernobyl nuclear power plant to revert to manual radiation monitoring, according to a Ukrainian journalist citing the country's state news service.

Elsewhere, the German pharmaceutical giant Merck said its network was compromised in the outbreak and that it was still investigating the incident.

A daily briefing on politics and cybersecurity weekday mornings, in your inbox.

By signing up you agree to receive email newsletters or alerts from POLITICO. You can unsubscribe at any time.

But the U.S. has been largely spared so far.

The American Gas Association said in a statement that no U.S. natural gas utilities have reported infections.

However, in Pennsylvania, the Heritage Valley Health System which operates two hospitals and 60 physician offices said it was grappling with a cyberattack. The incident is widespread and is affecting the entire health system, said spokeswoman Suzanne Sakson.

Multinational law firm DLA Piper was also experiencing computer and phone outages in multiple offices, including in Washington, D.C. The company did not respond to a request for comment.

But a photo shared with POLITICO showed a sign outside the firm's Washington office that read, "All network services are down, do not turn on your computers! Please remove all laptops from docking stations and keep turned off. No exceptions."

DLA Pipers secure document storage system for clients also went down, though the firm may have done that as a precaution. A bit stressed at moment as I am unsure if our docs there are safe, one client told POLITICO.

Tim Starks contributed to this report.

Missing out on the latest scoops? Sign up for POLITICO Playbook and get the latest news, every morning in your inbox.

More:
NSA-linked tools help power second global ransomware outbreak - Politico

But the witnesses sidestepped Mr. Grahams question, saying only that they were working on his request. That provoked an angry intervention from the committee chairman, Senator Charles E. Grassley, Republican of Iowa, who banged his gavel and told Mr. Graham, his voice rising, I want you to proceed until you get an answer.

Mr. Graham eventually ended his questioning without getting one. But later in the hearing, Senator Richard J. Durbin, Democrat of Illinois, suggested that the senators emotion at the thought that their government could invade their privacy and use the information against them was just part of the bigger picture.

What about the privacy of the Americans who are not in this room? he asked.

The warrantless surveillance program traces back to President George W. Bushs Stellarwind program, introduced after the Sept. 11, 2001, attacks. Stellarwind permitted the National Security Agency to wiretap Americans international phone calls without the court orders required by the Foreign Intelligence Surveillance Act, or FISA, of 1978.

After it came to light, Congress legalized a form of the program in 2008 with the FISA Amendments Act. It permits the government to collect, from American internet or phone providers and without warrants, the communications of foreigners abroad who have been targeted for any foreign intelligence purpose even when they are talking to Americans.

Privacy advocates want Congress, as part of any bill extending the law, to require warrants before officials may use Americans identifiers, like their email addresses, to search the repository of messages previously collected by the program. But Stuart J. Evans, a top intelligence official at the Justice Department, testified on Tuesday that imposing such a limit would grind the entire FISA process to a halt because investigators need to quickly search a large volume of such queries to process leads, and because such queries are typically undertaken at an early stage, when investigators have not yet found evidence to establish probable cause of wrongdoing.

Several lawmakers also pressed the officials about a decision by Dan Coats, the director of national intelligence, to shelve an N.S.A. effort to estimate how much incidental collection of Americans information the program sweeps up. Bradley Brooker, the acting general counsel to Mr. Coats, said that systematically determining who is using email accounts that are not of foreign intelligence interest would invade peoples privacy and divert resources.

To underscore their message that the program is too valuable to curtail, Mr. Brooker and other officials disclosed several additional examples where the program had been useful. They included detecting an unidentified country that was smuggling goods in violation of sanctions, and finding someone in Western Europe who was talking to a member of the Islamic State about purchasing material to build a suicide belt.

Mr. Ghattas said the government had used the program to investigate Shawn Parson, a Trinidadian social media propagandist for the Islamic State whose network distributed prolific amounts of English-language recruiting pitches and calls for attacks before he was killed in Syria in August 2015.

The F.B.I. had been investigating Mr. Parson since October 2013 based on his online postings, Mr. Ghattas said, and information it shared from that collection with unspecified allies had helped them identify other Islamic State supporters and had potentially prevented attacks in those countries.

Follow Charlie Savage on Twitter @charlie_savage.

A version of this article appears in print on June 28, 2017, on Page A14 of the New York edition with the headline: Up-and-Down Hearing On Surveillance Program.

More here:
NSA Warrantless Surveillance Aided Turks After Attack, Officials Say - New York Times