Tag Archives: malicious software

Chinese woman arrested by Secret Service at Trump’s Mar-a-Lago

FILE PHOTO: U.S. President Donald Trump's Mar-a-Lago estate in Palm Beach, Florida, U.S., March 22, 2019. REUTERS/Kevin Lamarque/File Photo

By Mark Hosenball

(Reuters) – A Chinese woman who passed security checkpoints at President Donald Trump’s Mar-a-Lago resort in Florida carrying a thumb drive coded with “malicious” software was arrested on Saturday for entering a restricted property and making false statements to officials, according to a court filing.

Documents filed by the Secret Service on Monday in U.S. District Court for the Southern District of Florida say that shortly after noon on Saturday, Yujing Zhang approached a Secret Service agent screening visitors to Mar-a-Lago seeking entrance to the club.

Zhang produced two Chinese passports displaying her photo and said she wanted to go to the pool. Secret Service officers could not initially find her name on an access list for the property, according to the Secret Service affidavit filed with the court.

A club manager said that a man named Zhang was a club member, and even though Yujing Zhang did not give a clear answer as to whether the man was her father, the Secret Service affidavit says resort officials allowed her on the property on the assumption she was related to a member.

Resort personnel became suspicious after Zhang appeared to have trouble explaining why she was visiting Mar-a-Lago, according to the affidavit.

Zhang initially said she was there for an event staged by a group called the United Nations Chinese American Association. But resort staff found no such event was scheduled, according to the court filing.

A receptionist then contacted Secret Service personnel who questioned Zhang and concluded she did not have “any legitimate documentation” authorizing her entry to Mar-a-Lago, according to the filing.

After detaining her, investigators found in Zhang’s possession four cellphones, a laptop computer, an external hard drive device and a thumb drive, the Secret Service court filing says. Initial examination of the thumb drive determined it contained “malicious malware,” the Secret Service said.

“While the Secret Service does not determine who is permitted to enter the club, our agents and officers conduct physical screenings to ensure no prohibited items are allowed onto the property,” the Secret Service said in a statement.

Responding to a question on the case, Chinese Foreign Ministry spokesman Geng Shuang told a regular news briefing in Beijing on Wednesday: “I have no understanding of the situation you mention.”

In a court filing on Tuesday, a public defender representing Zhang said she was invoking her right to remain silent.

A Justice Department spokeswoman had no comment on the arrest.

(Reporting by Mark Hosenball; additional reporting by Roberta Rampton in Washington and Cate Cadell in Beijing; Editing by Leslie Adler)

Cyber firms, Ukraine warn of planned Russian attack

Power lines are seen near the Trypillian thermal power plant in Kiev region, Ukraine November 23, 2017. REUTERS/Valentyn Ogirenko

By Jim Finkle and Pavel Polityuk

TORONTO/KIEV (Reuters) – Cisco Systems Inc warned on Wednesday that hackers have infected at least 500,000 routers and storage devices in dozens of countries with sophisticated malicious software – activity Ukraine said was preparation for a future Russian cyber attack.

Cisco’s Talos cyber intelligence unit has high confidence that the Russian government is behind the campaign, according to Cisco researcher Craig Williams, because the hacking software shares code with malware used in previous cyber attacks that the U.S. government has attributed to Moscow.

Ukraine’s SBU state security service said the activity showed Russia was readying a large-scale cyber attack against Ukraine ahead of the Champions League soccer final, due to be held in Kiev on Saturday.

“Security Service experts believe the infection of hardware on the territory of Ukraine is preparation for another act of cyber-aggression by the Russian Federation aimed at destabilizing the situation during the Champions League final,” it said in a statement after Cisco’s findings were released.

Russia has previously denied assertions by Ukraine, the United States, other nations and Western cyber-security firms that it is behind a massive global hacking program, which has included attempts to harm Ukraine’s economy and interfering in the 2016 U.S. presidential election.

The Kremlin did not immediately respond to a request for comment submitted by Reuters on Wednesday.

Cisco said the new malware, dubbed VPNFilter, could be used for espionage, to interfere with internet communications or launch destructive attacks on Ukraine, which has previously blamed Russia for massive hacks that took out parts of its energy grid and shuttered factories.

“With a network like this you could do anything,” Williams told Reuters.

CONSTITUTION DAY ATTACK

The warning about the malware – which includes a module that targets industrial networks like ones that operate the electric grid – will be amplified by alerts from members of the Cyber Threat Alliance (CTA), a nonprofit group that promotes the fast exchange of data on new threats between rivals in the cyber security industry.

Members include Cisco, Check Point Software Technologies Ltd, Fortinet Inc, Palo Alto Networks Inc, Sophos Group Plc  and Symantec Corp.

“We should be taking this pretty seriously,” CTA Chief Executive Officer Michael Daniel said in an interview.

The devices infected with VPNFilter are scattered across at least 54 countries, but Cisco determined the hackers are targeting Ukraine following a surge in infections in that country on May 8, Williams told Reuters.

Researchers decided to go public with what they know about the campaign because they feared the surge in Ukraine, which has the largest number of infections, meant Moscow is poised to launch an attack there next month, possibly around the time the country celebrates Constitution Day on June 28, Williams said.

Some of the biggest cyber attacks on Ukraine have been launched on holidays or the days leading up to them.

They include the June 2017 “NotPetya” attack that disabled computer systems in Ukraine before spreading around the globe, as well as hacks on the nation’s power grid in 2015 and 2016 that hit shortly before Christmas.

VPNFilter gives hackers remote access to infected machines, which they can use for spying, launching attacks on other computers or downloading additional types of malware, Williams said.

The researchers discovered one malware module that targets industrial computers, such as ones used in electric grids, other infrastructure and in factories. It infects and monitors network traffic, looking for login credentials that a hacker can use to seize control of industrial processes, Williams said.

The malware also includes an auto-destruct feature that hackers can use to delete the malware and other software on infected devices, making them inoperable, he said.

(Writing by Jim Finkle and Jack Stubbs; Editing by Mark Heinrich)

Security firms warn of new cyber threat to electric grid

An electricity station with high-tension electricity power lines is seen in Galapagar, Spain, January 20, 2017.

By Jim Finkle

(Reuters) – Two cyber security companies said they have uncovered a sophisticated piece of malicious software capable of causing power outages by ordering industrial computers to shut down electricity transmission.

Analysis of the malware, known as Crash Override or Industroyer, indicates it was likely used in a December 2016 cyber attack that cut power in Ukraine, according to the firms, Slovakian security software maker ESET and U.S. critical-infrastructure security firm Dragos Inc.

The discovery may stoke fears about cyber vulnerabilities in power grids that have intensified in the wake of the December Ukraine attack, and one a year earlier that also cut power in that nation.

Ukraine authorities have previously blamed Russia for the attacks on its grid. Moscow has denied responsibility.

Dragos founder Robert M. Lee said the malware is capable of causing outages of up to a few days in portions of a nation’s grid, but is not potent enough to bring down a country’s entire grid.

The firm has alerted government authorities and power companies about the threat, advising them of steps to defend against the threat, Lee said in an interview.

Crash Override can be detected if a utility specifically monitors its network for abnormal traffic, including signs that the malware is searching for the location of substations or sending messages to switch breakers, according to Lee, a former U.S. Air Force warfare operations officer.

The sample of Crash Override that was analyzed by Dragos is capable of attacking power operators across Europe, according to Lee.

“With small modifications, it could be leveraged against the United States,” he said.

Reuters reviewed an ESET technical analysis of the malware provided by the security firm, which they planned to release publicly on Monday. An ESET spokeswoman said the firm’s researchers were not available for comment ahead of its release.

ESET said in its report that it believed the malware was “very probably” used in the 2016 attack in Ukraine, noting it has an activation time stamp of Dec. 17, the day of the outage.

Crash Override is the second piece of malware discovered to date that is capable of disrupting industrial processes, according to Lee.

The first, Stuxnet, was discovered in 2010 and is widely believed by security researchers to have been used by the United States and Israel to attack Iran’s nuclear program.

Malware has been used in other attacks on industrial targets, including the 2015 Ukraine power outage, but in those cases human intervention was required to interfere with operations, Lee said.

(Reporting by Jim Finkle in Toronto; Editing by Tom Brown and Richard Pullin)