39
ukwatcher 39 points ago +39 / -0

The SolarWind attack compromises the SAML authentication mechanism used for Single Sign On (SSO). This is scary stuff! If SSO is hacked, most of the organisation's applications could be accessible, including email, internal web applications, linked cloud accounts (AWS, Azure..).

1
ukwatcher 1 point ago +1 / -0

Hearing from several people that email sent to gmail is getting permanently bounced.

1
ukwatcher 1 point ago +1 / -0

The orders are being sent to Amazon.com, Inc., ByteDance Ltd., which operates the short video service TikTok, Discord Inc., Facebook, Inc., Reddit, Inc., Snap Inc., Twitter, Inc., WhatsApp Inc., and YouTube LLC. The companies will have 45 days from the date they received the order to respond.

2
ukwatcher 2 points ago +2 / -0

Incognito mode fixes youtube for me.

2
ukwatcher 2 points ago +2 / -0

Various services are broken:

  • youtube returning error

  • gmail returning 502

  • docs returning 500

  • drive not working

24
ukwatcher 24 points ago +24 / -0

https://www.reuters.com/article/us-usa-cyber-amazon-com-exclsuive/u-s-treasury-breached-by-hackers-backed-by-foreign-government-sources-idUSKBN28N0PG

There is concern within the U.S. intelligence community that the hackers who targeted Treasury and the Commerce Department’s National Telecommunications and Information Administration used a similar tool to break into other government agencies, according to four people briefed on the matter.

The people did not say which other agencies, but late Sunday Austin, Texas-based IT company SolarWinds said software updates it released in March and June of this year may have been surreptitiously tampered with in a “highly-sophisticated, targeted and manual supply chain attack by a nation state.”

SolarWinds stopped short of saying the hack at Treasury occurred via them, but two of the people familiar with the investigation said the company was believed to be the channel by which the hackers got in.

A representative for SolarWinds did not immediately return messages seeking comment.

SolarWinds says on its website that its customers inlcude most of America’s Fortune 500 companies, all top ten U.S. telecommunications providers, all five branches of the U.S. military, the State Department, the National Security Agency, and the Office of President of the United States.

Three of the people familiar with the investigation said Russia is currently believed to be behind the attack.

Two of the people said that the breaches are connected to a broad campaign that also involved the recently disclosed hack on FireEye, a major U.S. cybersecurity company with government and commercial contracts.

“The United States government is aware of these reports and we are taking all necessary steps to identify and remedy any possible issues related to this situation,” said National Security Council spokesman John Ullyot.

The hack is so serious it led to a National Security Council meeting at the White House on Saturday, said one of the people familiar with the matter.

The Commerce Department confirmed there was a breach at one of its agencies in a statement. “We have asked the Cybersecurity and Infrastructure Security Agency and the FBI to investigate, and we cannot comment further at this time.”

‘HUGE CYBER ESPIONAGE CAMPAIGN’

The breach presents a major challenge to the incoming administration of President-elect Joe Biden as officials investigate what information was stolen and try to ascertain what it will be used for. It is not uncommon for large scale cyber investigations to take months or years to complete.

“This is a much bigger story than one single agency,” said one of the people familiar with the matter. “This is a huge cyber espionage campaign targeting the U.S. government and its interests.”

Hackers broke into the NTIA’s office software, Microsoft’s Office 365. Staff emails at the agency were monitored by the hackers for months, sources said.

A Microsoft spokesperson did not immediately respond to a request for comment. Neither did a spokesman for the Treasury Department.

The hackers are “highly sophisticated” and have been able to trick the Microsoft platform’s authentication controls, according to a person familiar with the incident, who spoke on condition of anonymity because they were not allowed to speak to the press.

“This is a nation state,” said a different person briefed on the matter.

The full scope of the breach is unclear. The investigation is still its early stages and involves a range of federal agencies, including the FBI, according to three of the people familiar with the matter.

A spokesperson for the Cybersecurity and Infrastructure Security Agency said they have been “working closely with our agency partners regarding recently discovered activity on government networks. CISA is providing technical assistance to affected entities as they work to identify and mitigate any potential compromises.”

The FBI and U.S. National Security Agency did not immediately respond to a request for comment.

There is some indication that the email compromise at NTIA dates back to this summer, although it was only recently discovered, according to a senior U.S. official.

36
ukwatcher 36 points ago +36 / -0

Some more details here:

https://uk.reuters.com/article/us-usa-cyber-amazon-com-exclsuive/exclusive-us-treasury-breached-by-hackers-backed-by-foreign-government-sources-idUKKBN28N0PG

WASHINGTON (Reuters) - A sophisticated hacking group backed by a foreign government stole information from the U.S. Treasury Department and a U.S. agency responsible for deciding policy around the internet and telecommunications, according to people familiar with the matter.

“The United States government is aware of these reports and we are taking all necessary steps to identify and remedy any possible issues related to this situation,” said National Security Council spokesman John Ullyot.

There is concern within the U.S. intelligence community that the hackers who targeted the Treasury Department and the Commerce Department’s National Telecommunications and Information Administration used a similar tool to break into other government agencies, according to three people briefed on the matter.

The hack is so serious it led to a National Security Council meeting at the White House on Saturday, said one of the people familiar with the matter.

1
ukwatcher 1 point ago +2 / -1

Understood, well I suppose it depends on your level of paranoia. However, this has become public is in the mainstream news.

1
ukwatcher 1 point ago +1 / -0

The CSV file is 279MB in size. The first few rows look like this. Can anyone translate?

id,name,sex,ethnicity,hometown,organization,id_card_num,address,mobile_num,phone_num,education 1,"陶凌霞","女","汉族","上海","中共黄浦区委宣传部机关支部委员会",310110198305082041,"松花江路1160弄24号601室",13795206049,null,"硕士研究生" 2,"吕清逸","男","汉族","上海","黄浦区审计局机关党支部",310102195310292031,null,13621647402,null,"大学" 3,"姚茂华","男","汉族","上海","中共黄浦区人民政府办公室第三支部委员会 ",310103192904081218,null,null,null,"普通高中" 4,"王海玲","女","汉族","上海","黄浦区人民法院行装科党支部",310108197401092446,null,null,null,"大学" 5,"杨敷敦","男","汉族","江苏太仓","黄浦区科委第二党支部",310102194212200039,null,null,null,"大专" 6,"许晶彦","男","汉族","上海","中共黄浦区规划和土地管理局机关在职党支部委员会",310103197601282410,"昌里东路395弄50号201室",13601621253,null,"大学" 7,"钱华安","男","汉族","上海","中共黄浦区商务委机关第二支部委员会",310109196508156819,null,null,null,"大学" 8,"宋维福","男","汉族","上海","黄浦区民防办机关支部",310110196309098615,null,null,null,"大学" 9,"王雯","女","汉族","浙江","中共黄浦区环境保护局机关支部",310109196707306824,null,null,null,"大学" 10,"周健强","男","汉族","上海","中共黄浦区规划和土地管理局机关在职党支部委员会",420106197310134412,null,null,null,"大学" 11,"杨海霞","女","汉族","上海","中共黄浦区委宣传部新闻中心支部委员会",310101197711102844,null,null,null,"大学" 12,"张英","女","汉族","上海","中共黄浦区妇女联合会第二支部委员会",31010919240516042X,null,null,null,"普通高中" 13,"张培琳","女","汉族","上海","中共黄浦区委组织部机关退休支部委员会",310103195412071666,null,null,null,"大学" 14,"郑瑞丽","女","汉族","上海","中共黄浦区总工会卢湾工人俱乐部支部委员会",310104195712230020,null,null,null,"中等专科" 15,"王永康","男","汉族","浙江","中共黄浦区税务分局第一退休党支部",310101193101223632,null,null,null,"普通高中" 16,"谢育农","男","汉族","上海","黄浦区卫生局机关党支部",310101195712160414,null,null,null,"大专" 17,"周荣根","男","汉族","上海","黄浦区法院退休第三党支部",310103195411240413,null,null,null,"大专"

1
ukwatcher 1 point ago +2 / -1

It is just a CSV file, which is a text file and is safe to open. However, you will need to know Chinese to understand it. The file is called shanghai-ccp-member.csv.

You can download the entire repository using: git clone https://gitlab.com/shanghai-ccp-member-db/shanghai-ccp-member-db.git

Or save just the CSV file from the gitlab user interface.

view more: ‹ Prev Next ›