Hackers target ‘Game of Thrones’; data, script stolen — HBO

NEW YORK — U.S. cable channel HBO said on Monday that hackers had stolen upcoming programming, and Entertainment Weekly reported that the theft included a script for an unaired episode of the hit fantasy show “Game of Thrones”.

HBO, a unit of Time-Warner Inc, declined to comment on the specific programming stolen in the hack.

“As most of you have probably heard by now, there has been a cyber incident directed at the company which has resulted in some stolen proprietary information, including some of our programming,” HBO Chairman Richard Plepler wrote in a message to employees, which the company shared with reporters.

The company declined to comment on reports that unbroadcast episodes and scripts were among the data hacked, citing an “ongoing investigation” by unspecified law enforcement officials.

Entertainment Weekly reported that hackers stole 1.5 terabytes of data and had already posted online unbroadcast episodes of “Ballers” and “Room 104,” along with “a script or treatment” for next week’s episode of “Game of Thrones”.

Reuters also received an e-mail on Sunday from a person claiming to have stolen HBO data, including “Game of Thrones”.

The show is now in its seventh season and due to wrap up next year.

source: interaksyon.com

North Korea hacking focused more on making money than espionage – South Korean study

SEOUL — North Korea is behind an increasingly orchestrated effort at hacking into computers of financial institutions in South Korea and around the world to steal cash for the impoverished country, a South Korean state-backed agency said in a report.

In the past, suspected hacking attempts by North Korea appeared intended to cause social disruption or steal classified military or government data, but the focus seems to have shifted in recent years to raising foreign currency, the South’s Financial Security Institute (FSI) said.

The isolated regime is suspected to be behind a hacking group called Lazarus, which global cybersecurity firms have linked to last year’s $81 million cyber heist at the Bangladesh central bank and the 2014 attack on Sony’s Hollywood studio.

The U.S. government has blamed North Korea for the Sony hack and some U.S. officials have said prosecutors are building a case against Pyongyang in the Bangladesh Bank theft.

In April, Russian cybersecurity firm Kaspersky Lab also identified a hacking group called Bluenoroff, a spinoff of Lazarus, as focused on attacking mostly foreign financial institutions.


The new report, which analyzed suspected cyberattacks between 2015 and 2017 on South Korean government and commercial institutions, identified another Lazarus spinoff named Andariel.

“Bluenoroff and Andariel share their common root, but they have different targets and motives,” the report said. “Andariel focuses on attacking South Korean businesses and government agencies using methods tailored for the country.”

Pyongyang has been stepping up its online hacking capabilities as one way of earning hard currency under the chokehold of international sanctions imposed to stop the development of its nuclear weapons program.

Cyber security researchers have also said they have found technical evidence that could link North Korea with the global WannaCry “ransomware” cyberattack that infected more than 300,000 computers in 150 countries in May.

“We’ve seen an increasing trend of North Korea using its cyber espionage capabilities for financial gain. With the pressure from sanctions and the price growth in cryptocurrencies like Bitcoin and Ethereum — these exchanges likely present an attractive target,” said Luke McNamara, senior analyst at FireEye, a cybersecurity company.

North Korea has routinely denied involvement in cyberattacks against other countries. The North Korean mission to the United Nations was not immediately available for comment.

ATMs, online poker

The report said the North Korean hacking group Andariel has been spotted attempting to steal bank card information by hacking into automated teller machines, and then using it to withdraw cash or sell the bank information on the black market. It also created malware to hack into online poker and other gambling sites and steal cash.

“South Korea prefers to use local ATM vendors and these attackers managed to analyze and compromise SK ATMs from at least two vendors earlier this year,” said Vitaly Kamluk, director of the APAC research center at Kaspersky.

“We believe this subgroup (Andariel) has been active since at least May 2016.”

The latest report lined up eight different hacking instances spotted within the South in the last few years, which North Korea was suspected to be behind, by tracking down the same code patterns within the malware used for the attacks.

One case spotted last September was an attack on the personal computer of South Korea’s defense minister as well as the ministry’s intranet to extract military operations intelligence.

North Korean hackers used IP addresses in Shenyang, China to access the defense ministry’s server, the report said.

Established in 2015, the FSI was launched by the South Korean government in order to boost information management and protection in the country’s financial sector following attacks on major South Korean banks in previous years.

The report said some of the content has not been proven fully and is not an official view of the government.

source: interaksyon.com

Evictions, sanctions as US strikes back at Russia over election hacks

HONOLULU/WASHINGTON -- President Barack Obama ordered the expulsion of 35 Russian suspected spies and imposed sanctions on two Russian intelligence agencies over their involvement in hacking US political groups in the 2016 presidential election.

The measures, taken during the last days of Obama's presidency, mark a new post-Cold War low in US-Russian ties which have deteriorated over Ukraine and Syria.

Allegations by US intelligence agencies that Russian President Vladimir Putin personally directed efforts to intervene in the US election process by hacking mostly Democrats have made relations even worse.

"These actions follow repeated private and public warnings that we have issued to the Russian government, and are a necessary and appropriate response to efforts to harm US interests in violation of established international norms of behavior," Obama said in a statement from vacation in Hawaii.

It was not immediately clear whether President-elect Donald Trump, who has repeatedly praised Putin and nominated people seen as friendly toward Moscow to senior administration posts, would seek to roll back the measures once he takes office on January 20.

The Kremlin, which denounced the sanctions as unlawful and promised "adequate" retaliation, questioned whether Trump approved of the new sanctions. Moscow denies the hacking allegations.

US intelligence agencies say Russia was behind hacks into Democratic Party organizations and operatives ahead of the November 8 presidential election. US intelligence officials also say that the Russian cyberattacks were aimed at helping Trump, a Republican, defeat Democrat Hillary Clinton.

Trump has rejected that conclusion and said on Wednesday that "we ought to get on with our lives," when asked about possible tough sanctions for the cyberattacks.

Should Trump seek to overturn Obama's measures, he would likely encounter wide bipartisan Congressional opposition.

US House of Representatives Speaker Paul Ryan, the top Republican in Congress, said Russia "has consistently sought to undermine" US interests and the sanctions were overdue.

Republican Senators John McCain and Lindsey Graham said they intended to lead effort in Congress to "impose stronger sanctions on Russia."

The actions on Thursday were the strongest response by the Obama administration to Russia's cyber activities, however, a senior administration official acknowledged that Trump could reverse them and allow Russian intelligence officials back into the United States once he takes office. He said that would be "inadvisable".

"We believe these steps are important because Russia is not going to stop," one official said. "We have every indication that they will interfere in democratic elections in other countries, including some of our European allies," the official said.

Persona non grata

Obama is seeking to deter Russia and other foreign governments from leveraging cyberattacks in the future to meddle in US politics, former officials and cyber security experts said.

Obama put sanctions on two Russian intelligence agencies, the GRU and the FSB, four GRU officers and three companies "that provided material support to the GRU’s cyber operations.

Obama said the State Department declared as "persona non grata" 35 Russian intelligence operatives and is closing two Russian compounds in New York and Maryland that were used by Russian personnel for "intelligence-related purposes". The State Department originally said the 35 were diplomats.

A senior US official told Reuters the expulsions would come from the Russian embassy in Washington and consulate in San Francisco. The Russian embassy declined to comment on the expulsions.

The Russians have 72 hours to leave the United States, the official said. Access to the two compounds will be denied to all Russian officials as of noon on Friday, the senior US official added.

"These actions were taken to respond to Russian harassment of American diplomats and actions by the diplomats that we have assessed to be not consistent with diplomatic practice," the official said.

The State Department has long complained that Russian security agents and traffic police have harassed US diplomats in Moscow, and US Secretary of State John Kerry has raised the issue with Putin and his foreign minister, Sergei Lavrov.

The US official declined to name the Russian diplomats who would be affected, although it is understood that Russia's ambassador to the United States, Sergei Kislyak, will not be one of those expelled.

The United States also released an analysis report by the FBI and Department of Homeland Security examining forensic evidence officials said linked the cyberattacks to computer systems used by Russian intelligence services.

The report largely corroborates the existing findings of private sector cyber firms that investigated the breach at the Democratic National Committee and elsewhere.

source: interaksyon.com

Obama orders 'full review' of 2016 election cyberattacks

WASHINGTON - President Barack Obama has ordered a review of all cyberattacks that took place during the 2016 election cycle, the White House said Friday as concerns over Russian interference mount.

White House Deputy Press Secretary Eric Schultz said Obama called for the review earlier this week, amid growing calls from Congress for more information on the extent of Russian interference in the campaign.

"We are committed to ensuring the integrity of our elections and this report will dig into this pattern of malicious cyberactivity timed to our elections, take stock of our defensive capabilities and capture lessons learned to make sure that we brief members of Congress and stakeholders as appropriate," said Schultz.

Obama wants the report completed before his term ends on January 20, Schultz said.

"We are going to make public as much as we can," he added. "This is a major priority for the president."

Trump denies Russian role 


The move comes after Democrats in Congress pressed the White House to reveal details, to Congress or to the public, of Russian hacking and disinformation in the election.

It also comes after President-elect Donald Trump rejected the intelligence community finding of official Russian involvement. 

Confidential emails from the Democratic National Committee and John Podesta, a top advisor to Democratic nominee Hillary Clinton, were steadily leaked out via WikiLeaks in the months before the election, damaging Clinton's White House effort.

On October 7, one month before the election, the Department of Homeland Security and the Director of National Intelligence announced that "the Russian Government directed the recent compromises of emails from US persons and institutions, including from US political organizations."

"These thefts and disclosures are intended to interfere with the US election process," they said.

But in an interview published Wednesday with Time magazine for its "Person of the Year" award, Trump dismissed those findings. Asked whether the intelligence was politicized, Trump answered: "I think so."

"I don't believe they interfered," he said. "It could be Russia. And it could be China. And it could be some guy in his home in New Jersey."

Worried that Trump will sweep the issue under a rug after his inauguration, seven Democrats on the Senate Intelligence Committee called on November 29 for the White House to declassify what it knows about Russian interference.

The seven have already been briefed on the classified details, suggesting they believed there is more information that the public should know.

Then on Tuesday of this week, leading House Democrats called on Obama to give members of the entire Congress a classified briefing on Russian interference, from hacking to the spreading of fake news stories to mislead US voters.

Republicans in Congress have also promised hearings into Russian activities once the new administration comes in.

But some have suggested the Democrats are raising the issue out of bitterness over their sweeping electoral defeat.

Schultz denied politics was behind Obama's order.

"I want to be clear here that this is not an effort to challenge the result of the election," he said.

Russian interference in Germany

Obama's homeland security advisor Lisa Monaco said the cyber interference goes back to the 2008 presidential race, with both the Obama and John McCain campaigns hit by malicious computer intrusions.

"We have seen in 2008 and in this last election system malicious cyber activity. We maybe [have] crossed into a new threshold and it is incumbent upon us to take stock of that," said Monaco.

Russian hacking and election interference have also become a big issue in Germany.

On Thursday Germany's domestic intelligence agency BfV issued a stark warning over a rising Moscow-directed campaign of hacking and misinformation directed at "destabilizing" the country and influencing political discourse.

Last week WikiLeaks published stolen documents on intelligence activities that embarrassed Chancellor Angela Merkel just as she began campaigning for the elections slated for late 2017.

"In the political realm, we detect an increasingly aggressive cyber espionage, warned BfV chief Hans-Georg Maassen.

"The indications of attempts to influence the German parliamentary elections next year are intensifying."

source: interaksyon.com

ThyssenKrupp secrets stolen in ‘massive’ cyber attack

FRANKFURT — Technical trade secrets were stolen from the steel production and manufacturing plant design divisions of ThyssenKrupp AG in cyber attacks earlier this year, the German company said on Thursday.

ThyssenKrupp, one of the world’s largest steel makers, said it had been targeted by attackers located in southeast Asia engaged in what it said were “organized, highly professional hacker activities”.

In breaches discovered by the company’s internal security team in April and traced back to February, hackers stole project data from ThyssenKrupp’s plant engineering division and from other areas yet to be determined.

“ThyssenKrupp has become the target of a massive cyber attack,” the industrial conglomerate said in a statement.

Globally, cyber attacks on banks, retailers and other businesses have led to widespread consumer and financial data losses in recent years. ThyssenKrupp’s disclosure followed last week’s attack on Deutsche Telekom routers that caused outage for nearly 1 million customers.

While revelations of industrial espionage are far rarer, estimates put the costs to businesses in the billions of dollars. China was frequently blamed for such commercial hacking attacks until the United States and China agreed not to hack each other’s businesses (reut.rs/2gewbrH).

German business magazine Wirtschafts Woche reported the attacks hit sites in Europe, India, Argentina and the United States run by the Industrial Solutions division, which builds large production plants. The Hagen Hohenlimburg specialty steel mill in western Germany was also targeted, the report added.

The company declined to identify specific locations which were infected or speculate on likely suspects. It said it could not estimate the scale of the intellectual property losses.

Big-bang counter attack

ThyssenKrupp said it waited to publicize the attack while it identified, then cleansed infected systems in one concerted, global action before implementing new safeguards to monitor its computer systems. “It is important not to let the intruder know that he has been discovered,” a spokesman said.

A criminal complaint was filed with police in the state of North Rhine-Westphalia and an investigation is ongoing, it said. State and federal cyber security and data protection authorities were kept informed at each stage, as well as Thyssen’s board.

Secured systems operating steel blast furnaces and power plants in Duisburg, in Germany’s industrial heartland in the Ruhr Valley, were unaffected, the company said.

No breaches were found at its marine systems unit, which produces military submarines and warships.

A previous cyber attack caused physical damage to an unidentified German steel plant and prevented the mill’s blast furnace from shutting down properly.

The country’s Federal Office for Information Security (BSI) revealed two years ago that the attack caused “massive damage”, but gave no further technical details and the location of the plant has remained shrouded in mystery.

Subsequent media reports identified the target as a ThyssenKrupp facility, but the company has denied it was hit.

The industrial conglomerate, along with Airbus parent EADS, were the targets of major attacks by Chinese hackers in 2012, according to a Der Spiegel report.

The company, a big supplier of steel to Germany’s automotive sector and other manufacturers, is looking to form a joint venture of its European steel operations with India’s Tata Steel to combat over-capacity in the sector.

source: interaksyon.com

Lenovo website breached, hacker group Lizard Squad claims responsibility

Chinese computer and smartphone firm Lenovo Group Ltd said its website was hacked on Wednesday, its second security blemish days after the U.S. government advised consumers to remove software called “Superfish” pre-installed on its laptops.

Hacking group Lizard Squad claimed credit for the attacks on microblogging service Twitter. Lenovo said attackers breached the domain name system associated with Lenovo and redirected visitors to lenovo.com to another address, while also intercepting internal company emails.

Lizard Squad posted an email exchange between Lenovo employees discussing Superfish. The software was at the center of public uproar in the United States last week when security researchers said they found it allowed hackers to impersonate banking websites and steal users’ credit card information.

In a statement issued in the United States on Wednesday night, Lenovo, the world’s biggest maker of personal computers, said it had restored its site to normal operations after several hours.

“We regret any inconvenience that our users may have if they are not able to access parts of our site at this time,” the company said. “We are actively reviewing our network security and will take appropriate steps to bolster our site and to protect the integrity of our users’ information.”

Lizard Squad has taken credit for several high-profile outages, including attacks that took down Sony Corp’s PlayStation Network and Microsoft Corp’s Xbox Live network last month. Members of the group have not been identified.

Starting 4 p.m. ET (2100 GMT) on Wednesday, visitors to the Lenovo website saw a slideshow of young people looking into webcams and the song “Breaking Free” from the movie “High School Musical” playing in the background, according to technology publication The Verge, which first reported the breach.

Although consumer data was not likely compromised by the Lizard Squad attack, the breach was the second security-related black eye for Lenovo in a matter of days.

The U.S. Department of Homeland Security said in an alert last Friday that the Superfish program, which came pre-installed on nearly a dozen Lenovo laptop models, makes users vulnerable to a type of cyberattack known as “SSL spoofing”, in which remote attackers can read encrypted Web traffic, redirect traffic from official websites to spoofs, and perform other attacks.

Lenovo has since released software to remove Superfish while pledging to never install it on future shipments.

source: interaksyon.com

J-Law, Rihanna nude pics nabbed in massive Hollywood hack

LOS ANGELES | Nude photos purportedly showing many top stars, including Oscar-winner Jennifer Lawrence and pop star Rihanna, bounced around social media Sunday, in an apparent massive hacking leak, US media reported.

“It’s so weird and hard how people take your privacy away from you,” Lawrence said in a tweet.

The actress’ agent, meanwhile, vowed to take legal action.

“This is a flagrant violation of privacy. The authorities have been contacted and will prosecute anyone who posts the stolen photos of Jennifer Lawrence,” her representative told TMZ entertainment website.

Word of the images began spreading early Sunday, amid reports that the photos had been obtained by hacking iCloud accounts, Mashable and other media reported.

Among the celebrities whose pictures allegedly were stolen and posted online were Avril Lavigne, Amber Heard, Gabrielle Union, Hayden Panettiere and Hope Solo, according to Mashable.

Media reports said among the other starlets targeted were Hillary Duff, Jenny McCarthy, Kaley Cuoco, Kate Upton, Kate Bosworth, Keke Palmer and Kim Kardashian.

Former Nickelodeon star and singer Victoria Justice said the images claiming to show her unclothed body were anything but the real deal.

“These so called nudes of me are FAKE people. Let me nip this in the bud right now. *pun intended*” she tweeted.

A spokesperson for actress and pop star Ariana Grande told BuzzFeed that images said to be of her, are “completely fake.”

But horror movie actress Mary Elizabeth Winstead, whose intimate photos were leaked, acknowledged her frustration.

“To those of you looking at photos I took with my husband years ago in the privacy of our home, hope you feel great about yourselves,” she tweeted.

“Knowing those photos were deleted long ago, I can only imagine the creepy effort that went into this. Feeling for everyone who got hacked.”

source: interaksyon.com