Malware

see black hat hacker

818 add ransomware

this node originally was for sites that had malware on them, presumably to discourage and mess up visitors, but has been expanded to hacking to track/~ privacy

-=-=-

How Israeli firm’s ‘zero-click’ malware attack poses global security risk | Cybersecurity News | Al Jazeera

10 26

NO LNX GFX

Federica Marsi

Published On 16 Oct 2026

16 Oct 2026

Just visiting a page or refreshing an app can be enough to fall victim to a malware attack in which your personal data is stolen from a laptop or phone, researchers have found. You are not even required to “click” on anything.

An Israeli spyware firm has been found to be behind the first-known instance of “zero-click” targeted advertising in which fraudsters or spies can steal private data and send it to external servers, with Al Jazeera journalists among the victims.

Unanswered questions about Pegasus in India

Three of the individuals targeted with Netwire were also targeted earlier in 2019 in the now infamous NSO WhatsApp hack, a spyware attack in which at least two dozen academics, lawyers, Dalit activists and journalists in India were targeted with Pegasus), a spyware that canextract a user’s private data, including passwords, contact lists, calendar events, text messages, and even voice calls. Some variants of it can even turn on a phone’s camera and microphone to capture activity in the phone’s vicinity.

The individuals were informed about this attack by Whatsapp, who contacted and alerted them that their phones had been under state-of-the-art surveillance for a two-week period in May 2019. This hack was part of a wider attack that targeted at least 100 members of civil society around the world and led to Whatsapp suing the NSO group in a US court.

Following the revelation of the Pegasus attacks in November 2019, NSO defended itself saying that it only sells its technology to “licensed government intelligence and law enforcement agencies. Consequently, several of those targeted in India wrote to the Parliamentary Standing Committee on Information Technology asking whether the government had authorized the use of this spyware. Unfortunately, the Indian government’s Ministry of Home Affairs and the Ministry of Information Technology refused to give a straight answer to this question, only claiming that “no unauthorized interception” had taken place. Subsequently, the government sought to shift the blame on Whatsapp, insinuating that the tech platform had allowed the breach to take place and had not informed it about it. Embarrassingly, Whatsapp responded stating that it actually had informed the country’s nodal cyber response agency when the attacks had first taken place.

Illegally intercepting or accessing computer devices is recognized as a criminal act under international law and India’s Information Technology Act. If the hackers were private actors, it is concerning as to why the Indian government has not yet released details of any criminal investigations against them,despite sufficient evidence of a crime having been committed against its own citizens. The alternative scenario, if it happens to be true, is doubly concerning. State surveillance through the use of spyware not only violates India’s own laws around the interception of private communications but also poses a huge threat to free expression, privacy and freedom of thought.

BJP surveillance measures

While less invasive forms of surveillance have been used by different ruling powers through the decades in India, the BJP’s measures are excessive, to say the least. In December 2018, the Ministry of Home Affairsgave ten agencies blanket legal authority “to intercept, monitor or decrypt information generated, transmitted, received or stored in any computer.” This order was challenged in the Supreme Court to which the governmentresponded with a statement that “the veil of privacy can be lifted for legitimate state interest.” The order continues to be enforced, pending a final judgement by the apex court.

In May 2020, the Ministry of Information and Broadcasting floated and closed a bid for a tool to provide “fact verification and disinformation detection on social media platforms.” According tomedia reports, this was the eighth attempt by this government, since it came into power in 2014, to “explicitly and directly monitor social media”. This latest attempt at mass surveillance is currently being**challenged**in court by the Internet Freedom Foundation. Given the Supreme Court’s 2017 ruling on privacy being a fundamental right, there is hope that this attempt too will be thwarted.

It is important to note that these attempts to monitor citizens’ lives are being made in the absence of a personal data protection law, which if enacted in line with international human rights standards, could offer some protection against these repeated attempts at surveillance. Unfortunately, the data protection bill introduced by the BJP-led government in 2019, which is currently undergoing joint parliamentary review, fails to meet such standards. It seeks to give the government unrestricted access to personal data on vaguely worded grounds of sovereignty, violating key legal safeguards around necessity and proportionality, as enshrined in international law and recognized by the Indian Supreme Court as intrinsic to safeguarding the right to privacy. There are further concerns that this is a backdoor attempt to provide legislative backing to the State’s passive surveillance activities online, which are currently conducted outside the remit of the law, merely through executive action, and thus escape meaningful oversight. Understandably, the bill has faced massive pushback from civil society, and even the United Nations Special Rapporteur on Privacy has expressed concern.

A global trend

These attempts to monitor and police digital spaces are not unique to India alone –digital authoritarianism is on the rise around the world, especially in countries where rising nationalism, combined with weaker rule of law has emboldened governments to crackdown on dissent, increasingly with the aid of technology supplied by dubious corporations eager to make a quick buck.

Spyware, one of the most invasive surveillance tools, has managed to evade regulation at the international level so far, largely because surveillance is a topic that governments are not keen to discuss, mostly due to diplomatic, political and national security reasons. Consequently, the lack of an international framework to regulate its production, sale and use coupled with an increasing interest by repressive regimes in the private lives of their critics, has led to an uptick in the use of spyware, as tracked by Citizen Lab. Concerned by this troubling trend, the UN’s Special Rapporteur on Freedom of Expression released a report, calling on governments to “establish an immediate moratorium on the global sale and transfer of private surveillance technology until rigorous human rights safeguards are put in place to regulate such practices and guarantee that governments and non-State actors use the tools in legitimate ways”. The US State Department has also released guidance to “assist U.S. companies seeking to prevent their products or services with surveillance capabilities from being misused by foreign government end-users to commit human rights abuses.”

These are steps in the right direction, which have taken effect largely due to the tireless advocacy done by civil society organizations who are bravely calling out human rights abuses, pushing for rights-respecting legislation and engaging in strategic litigation. Countries seeking to prevent the decline of democracy must support these groups, in India and elsewhere, by engaging them as trusted partners in the fight to keep the internet equal, open and free.

Written by Ayesha Khan

This postoriginally appeared on Global Voices

===

https://arstechnica.com/information-technology/2019/11/breaking-the-law-how-8chan-or-8kun-got-briefly-back-online/

thesuccessor to 8chan, 8kun,made a somewhat brief appearance on the public Internetthanks to what amounts to an attack on the Internet's routing infrastructure. The site's domain name server, hosted by a servicecalled VanwaNet, offered up an Internet address for the site that was from an unallocated set of addresses belonging tothe RIPE Network Coordinating Centre, the regional Internet registry authority for Europe and the Middle East.And the host for the new site, the Russian hosting company Media Land LLC, advertised a route to that address to the rest of the Internet, allowing visitors to reach the site for a while.

Trying to go “Bulletproof”

After 8chan lost its hosting in August in the wake of the El Paso mass shooting, much of 8chan's content—especially the "pol" channel—had shifted to the social media platform Telegram (known for its anti-censorship policies, which have made it a haven for all flavors of extremism). Telegrampol, for instance, was set up in July. But the fragmented nature of the Telegram channels (and the Telegram architecture) likely kept away many 8chan users; Telegrampol has a total of 633 subscribers.

8kun was an effort to restore a central location for all of 8chan's communities, but it faced the same challenges in hosting that brought down 8chan in the first place—its radioactivity to hosting providers and domain registrars. This is what apparently drove Watkins and company to a rather unusual hosting option: a Russian company known mostly for hosting crimeware.

Media Land is operated by Alexander Volosovyk, known as "Yahlishanda" on criminal underground Internet marketplaces. According to a report by Brian Krebs, Volosovyk is the world's biggest "bulletproof" hosting operator. He has, according to Krebs, avoided takedowns and prosecution by operating carefully within the lines of the law in Russia and other former Soviet states.

Servers hosted by Media Land infrastructure have been tied to the Dridex and Zeus banking trojans in the past, as well as to the command and control networks for other sophisticated malware. Media Land-hosted virtual private servers using legitimately assigned IP addresses have been repeatedly reported for malicious traffic, including hundreds of brute-force Remote Desktop Protocol login attacks.

Media Land used the fake BGP advertisements for more than just 8kun.According to historical DNS records from SecurityTrails, Media Land had been maintaining an advertisement for a block of addresses starting at 185.254.121.200 for over a month, with the records for 8kun.net addresses popping up about two days ago. The hosts tied to the address block hosted a variety of short-lived malware, phishing, and online pharmacy scam sites, among others, with some dating back to September—all of them hosted by Media Land.

Using this sort of fishy routing advertisement is not an uncommon tactic when trying to prevent potential attackers from gathering intelligence on a site's or network's infrastructure. It means that Whois requests and other network tools return no useful information to casual inquiries. That makes targeting the hosting provider somewhat more difficult. Other blocks of unassigned addresses have been used by Media Land repeatedly over the past three years.

Going dim

The Media Land hosting may have been a temporary move by the operators of 8chan/8kun. The site remains live on Tor as a "hidden service." And the site's domain name service provider VanwaNet has advertised itself in the past as a Cloudflare alternative—giving customers the capability (at some point in the future) to create their own content-delivery networks to fight DDoS attacks.

Ron Watkins, the administrator for 8kun, said in a Twitter post that VanwaTech "has built a fantastic new deepnet CDN that can deliver Tor hidden services at nearly clearnet speed." In addition, the 8kun team has apparently been looking at another Tor-like service called Lokinet, an onion-routing based anonymizing network that is still in development.

Those services may be crucial for the continued operation of the site, considering that the open Internet version of the site was under attack from almost the instant it went live. "We have been under sustained attacks the past few days and doing everything we can to get things stable again," Ron Watkins reported on Twitter earlier today. "The site is still online—albeit limping along—as we reorganize and restructure to deflect attacks coming from many angles."

https://www.wired.com/story/russia-hacker-groups-map/

9/19 andy g

OVER THE LAST half decade or so, Russia's state-sponsored hackers have distinguished themselves as the most active, aggressive, and disruptive teams of online aggressors in the world. They've meddled in elections, blacked out power grids, innovated devious new forms of espionage, hacked the Olympics, and unleashed the most destructive worm in history—a list that makes even China's cyberspies look like tame clerical workers by comparison. Now two cybersecurity firms have created a new visual taxonomy to organize all that digital chaos—and in doing so, perhaps helped crystallize who the distinct players are within the Kremlin's hacking forces.

Two Israeli companies, Check Point and Intezer, today released the results of a broad analysis of code that's been previously attributed to Russian state-sponsored hacking operations. The two firms pulled 2,500 samples from the malware database VirusTotal and used Intezer's automated tools to comb those specimens for code matches or similarities, filtering out false positives like reuse of open source components. The result is a kind of constellation chart for every known Russia state hacking group's tool kit, showing clusters that likely represent independent groups. "The information has previously been really scattered. Now for the first time we have a one-stop shop for Russian APTs," says Yaniv Balmas, Check Point's head of cyber research, using the acronym for "advanced persistent threat," an industry term for sophisticated state hackers. "You can look at this, and it’s all there."

[dynamic graf?]

map's largest clusters of connected nodes show tightly interlinked tools used by familiar Russian hacker groups—from the hackers known as Sandworm (aka Telebots or BlackEnergy), which first rose to notoriety with blackout attacks on the Ukrainian power grid, to the Turla spying team that impressed researchers with tricks like bouncing its command-and-control connections through unwitting satellites. (In some cases, it's worth nothing, different code samples are attributed to a group on the map based on reporting that's not related to code overlaps, such as shared infrastructure—though those links are captured in the map's key, not in its connected dots.)

The map also illustrates a few unexpected—or at least obscure—code connections between Russian hacking teams. It shows, for instance, that the Sandworm group behind BlackEnergy shared code in one instance with another group known as Energetic Bear or Dragonfly, named by Symantec in 2017 as the group responsible for penetrations of US power grid networks—though Check Point and Intezer admit that the matching code, first spotted by McAfee, may have come from a public source rather than actual collaboration. A tool called X-Agent, used by the Fancy Bear hackers best known for attacking the Democratic National Committee and the Clinton campaign, shared some code with another spy group known as Potao, known for espionage operations against Ukraine and other former Soviet-bloc neighbors. More notable, the map shows that both BlackEnergy and the malware of a group known as Cozy Bear or APT29 used code that came from a credential-stealing tool called LdPinch. That may come as a surprise, given that BlackEnergy has been pinned on the Russian military intelligence agency known as the GRU whereas Cozy Bear has been linked to the Russian foreign intelligence service, the SVR. Those two agencies have been known to act independently and even as rivals—such as when they were both discovered carrying out separate intrusions into the DNC's network in 2016

https://www.alternet.org/2020/08/psychology-overload-ux-designer-mary-formanek-breaks-down-how-the-intentionally-malicious-design-of-trumps-campaign-website-manipulates-visitors

salon

beyond a mere source of entertainment, the video-sharing social media appTikTokhas become a hub for quickeducational videos,as users turn its 60-second video format into an opportunity to share interesting and informative lessons. User experience (UX) designer Mary Formanek (@UXWithMary) has become a viral TikTok influencer in this regard, in particular for her series of TikTok explainer videos breaking down politicians’ campaign websites for laypersons who may not know a lot about design.

One recent series of Formanek’s videos that blew up featured her explaining the design principles behind Donald Trump’s 2020 campaign website. In these TikTok videos, Formanek describes how Trump’s campaign uses design principles in a shady way, to manipulate users into getting trapped on donation pages and accidentally donating more money than they might intend. As Formanek explains, this practice — of using design psychology to obfuscate and manipulate rather than illuminate — is known as “dark UX” within the field.

For those unfamiliar, UX — short for user experience — is the general term to refer to the interaction that a user has with a website or product. A UX designer or their team will be tasked with building an easy, efficient and smooth experience for the user.

While UX designers are trained to be on the side of the user, there are ways that the user experience can be manipulated to be in favor of the “product” — in this case, a candidate. When it comes to Trump’s re-election campaign website, this translates into an unscrupulous, even ill-intentioned user experience. Formanek broke down how this worked in an interview with Salon; as always, this interview has been edited for clarity and length.

first, what is dark UX?

It’s pretty much any sort of pattern or practice [of design] that will cause a deceitful effect. It will trick the user into doing something that they don’t want to do, or not even tell the user that they are doing this action.

What’s the history of dark UX? Is this a new thing?

I graduated recently, in 2016, and because UX is [such a] new [field] we don’t have a ton of education on it. I didn’t learn about dark UX patterns until I started doing my own research and came across a couple articles on it, and learned from there. The person who started the ideas of dark UX was Harry Brignull. He proposed [the term] “dark UX” I think in 2010, and pushed the concept from there, and said, “hey, look at these really-not-great things to do; we shouldn’t do these things and this is why they’re bad and shady.”

UX is supposed to be about people, and about the users, and about helping people. This is the exact opposite of what our profession is.

On TikTok, you have aseriesexplaininghow Trump’s re-election campaign website exemplifies dark UX. Inone video, you show how the“donate” checkboxes are automatically clicked for a user, thus automatically consenting them to donate $1,000 monthly. Are there any legal ramifications for this, or is it an ethics violation?

I’m not a lawyer, but in the United States, very rarely have companies got into any legal trouble for doing [dark UX] patterns. One exception is LinkedIn. They did a dark UX pattern called “friends spam” — that’s pretty much where they ask you for your name or your email, and they said that they’re going to do something with it, but they just spam all your friends in your contact list without your knowledge. They were sued for $13 million in 2015 for that.

Another example of a dark UX pattern on Trump’s website is how Trump might be taking advantage of people who are visually impaired. Can you talk more about that?

There are disabilities out there that prevent people from interacting with websites the way that most of us do. Whether they’re blind or they have issues with color contrast or they’re colorblind, they don’t see things the way they’re intended to. So imagine a button would blend into the background, and it wouldn’t make sense at that point [to someone who was visually impaired]. They will often use screen readers, or they will change the website into all text so that they read it like a book. There have been some other TikTok videos of people that are 100% blind going through with a screen reader; there was a popular one about the Starbucks app where she was going through and choosing her drink.

Usually these screen readers go very fast, and it’s how they navigate the site. And so, when I went through Trump’s re-election campaign website with a screen reader, it was confusing.

I will say in my video I did use a screen reader technique that is not normal, because usually you use a keyboard — you don’t use a mouse to hover over things. However, when I was hovering over different states they were not showing the information that was being shown on the screen. So there were things specifically left out, like that things were checked, or what the total was that you were donating. They were broken up into different individual words, so it was like “$100,” “plus,” and then “$50”; it wasn’t “$150.” So that could be considered deceitful — the checkboxes [for money] being checked, without ever telling that person that they are checked, is also deceitful. It just read like you were reading a book, not like you were [being] given options.

And then the other thing that I thought was interesting, in that sort of usability study, was that a donation button was right above the total. So, if you were going through and you’d had your eyes closed, you would click that donation button before even hearing the total, which was not a great practice either.

As youexplained,Trump’s website also has a pop-up that you can’t click out of on the landing page, and you’re forced to go straight to the donation page.There’s a clear lack of choice for the user to browse around. What do you make of that? Is this a common practice?

It’s not common for websites raising money. It is common to have pop-ups and gray out the background, but not to get the user trapped. There usually needs to be a clear indicator that you can get out of that area, whether it’s a cancel or it’s an “X” in the top corner, there has to be some sort of indication that that user can get out. On Trump’s website, and on the example that I was giving you could click out by clicking the gray area.

However, when I user-test things, I test as if I’m my grandmother. If you were to click around somewhere and try to interact with something, it would go away. And I think that’s how they kind of get away with it. But without an “X” or a clear indication [as to how to close that window], then it’s a dark UX pattern, because you are not making it clear to the user that you can leave.

Can you share a little bit about how psychology plays a role in UX and dark UX?

Psychology is huge in our profession. There are about three elements that we really focus on in UX design: research, data, and psychology. Because we are constantly working with people — we’re making systems for people — psychology is one of the key things that we focus on. We look into psychology a lot when we’re doing user testing, when we’re wondering why people aren’t hitting the button that we thought would be super clear when we designed it.

And what do we know about Trump’s website and the psychology behind the design?You call Trump’s website “psychology overload.”

Red [colors], it elevates your heart rate, and it brings attention to it. . . . and if you put black in the background it also gives this very dark perception, and then the red pops out at you. It’s just screaming at you. And that not only elevates your heart rate, but it grabs your attention. From there you’re already kind of stressed. And that’s something that we learn from psychology, so we take that into effect.

Red is also used a lot in restaurants like McDonald’s and fast food, because it also makes people hungry, whereas gyms will use the color blue because it makes people have more energy. And it’s really complicated science, but on Trump’s website, there’s a lot of psychology verbiage. There’s the countdown clock that really puts you into a state that makes you feel uncomfortable. Or capitalizing “you” and “now” on Trump’s website.

What’s the difference between bad design and dark UX?

So bad design and dark UX can be deciphered by intent. If they are doing something intentional, that is considered dark. If you’re doing something on accident, it’s considered bad, and that’s strictly by definition.

Obviously you can’t speak for the design firm who designed Trump’s re-election website, but as a professional UX designer, do you believe that perhaps these designers knew very well what they were doing, psychologically, to manipulate visitors? Or is it possible that it could just be bad UX design?

Yeah, I think it’s a little bit of both, and a third party idea on top of that. I’m currently making a new dark UX video on who to blame.

In my experience, I have found that the blame can be placed on three parties: either the UX designers themselves, the business segment, or whoever is managing the UX team or the marketing team. And the marketing team, I say that because they are focused on revenue and trying to get as many ad spots into places and email sign-ups and all of that.

I put a little bit of blame on the UX team because they probably understand that this is not right. And there is an ethics code that we do have to follow because again we are on the side of the users. We are trying to help people. It is not our job to do bad things. But if the business side is telling us you have to do this thing or you’re going to get fired, they’re going to do that thing and they’re going to know it’s dark UX. There are people that know that these are dark UX patterns, but they don’t care, and they just want the ROI on what they are doing.

zoom video vul allow apple cams to be turned on remotely 420 covid

https://www.alternet.org/2020/03/hackers-are-making-malware-infected-coronavirus-maps-to-harvest-your-personal-information/

https://en.wikipedia.org/wiki/Spyware

https://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/SpywareSpyware - Wikipedia

en.wikipedia.org › wiki › Spyware

:{:(style="border-color:rgb(60, 64, 67) transparent;border-style:solid;border-width:5px 4px 0px;width:0px;height:0px;margin-left:3px;top:7.5px;margin-top:-3px;position:absolute;left:0px"):}:

https://webcache.googleusercontent.com/search?q=cache:KntO87UG2hEJ:https://en.wikipedia.org/wiki/Spyware+&cd=6&hl=en&ct=clnk&gl=us
https://www.google.com/search?q=related:https://en.wikipedia.org/wiki/Spyware+twitter+code+heart+intent+tweet+malware+spy&tbo=1&sa=X&ved=2ahUKEwjN9v7Gss_oAhVDhq0KHSFkAjAQHzAFegQIAhAH

:{:{Spyware:(style="font-weight:bold"):}: is a type of :{malware:(style="font-weight:bold"):}: that aims to gather information about a person or organization, ... This one also has a :{tweet:(style="font-weight:bold"):}: button, a Google :{widget:(style="font-weight:bold"):}:, and those, too, can report back who you are and that you went there." The WSJ analysis ... At least one software package, :{Loverspy:(style="font-weight:bold"):}:, was specifically marketed for this :{purpose:(style="font-weight:bold"):}:.:(style="overflow-wrap:break-word"):}:

:{:(style="background-color:#ffffffff"):}:

https://consortiumnews.com/2019/07/16/consortium-news-target-of-a-malware-attack-as-twitter-takes-down-assange-support-groups-account/

Consortium News Target of a Malware Attack as Twitter Takes ...

consortiumnews.com › 2019/07/16 › consortium-news-target-of-a-ma...

:{:(style="border-color:rgb(60, 64, 67) transparent;border-style:solid;border-width:5px 4px 0px;width:0px;height:0px;margin-left:3px;top:7.5px;margin-top:-3px;position:absolute;left:0px"):}:

https://webcache.googleusercontent.com/search?q=cache:FOlqmiSe1UwJ:https://consortiumnews.com/2019/07/16/consortium-news-target-of-a-malware-attack-as-twitter-takes-down-assange-support-groups-account/+&cd=7&hl=en&ct=clnk&gl=us

:{Jul 16, 2019 -Consortium News wrote via :{Twitter:(style="font-weight:bold"):}: on Monday regarding the cyberattack: ... mother and an activist in her own right, Christine Assange :{tweeted:(style="font-weight:bold"):}:: ... No good guys – no honest :{intentions:(style="font-weight:bold"):}: anywhere. ... those deeply :{hidden:(style="font-weight:bold"):}: in the darkest shadows behind the opaque curtains of ... Take :{heart:(style="font-weight:bold"):}:, we may win this yet.:(style="overflow-wrap:break-word"):}:

https://www.alternet.org/2019/08/the-extortion-economy-how-insurance-companies-are-fueling-a-rise-in-ransomware-attacks/

no lnx

The extortion economy: How insurance companies are fueling a rise in ransomware attacks

Ransomware image via Shutterstock

Written by Renee Dudley / ProPublica August 27, 2019

On June 24, the mayor and council of Lake City, Florida, gathered in an emergency session to decide how to resolve a ransomware attack that had locked the city’s computer files for the preceding fortnight. Following the Pledge of Allegiance, Mayor Stephen Witt led an invocation. “Our heavenly father,” Witt said, “we ask for your guidance today, that we do what’s best for our city and our community.”

Witt and the council members also sought guidance from City Manager Joseph Helfenberger. He recommended that the city allow its cyber insurer, Beazley, an underwriter at Lloyd’s of London, to pay the ransom of 42 bitcoin, then worth about $460,000. Lake City, which was covered for ransomware under its cyber-insurance policy, would only be responsible for a $10,000 deductible. In exchange for the ransom, the hacker would provide a key to unlock the files.

“If this process works, it would save the city substantially in both time and money,” Helfenberger told them.

Without asking questions or deliberating, the mayor and the council unanimously approved paying the ransom. The six-figure payment, one of several that U.S. cities have handed over to hackers in recent months to retrieve files, made national headlines.

Left unmentioned in Helfenberger’s briefing was that the city’s IT staff, together with an outside vendor, had been pursuing an alternative approach. Since the attack, they had been attempting to recover backup files that were deleted during the incident. On Beazley’s recommendation, the city chose to pay the ransom because the cost of a prolonged recovery from backups would have exceeded its $1 million coverage limit, and because it wanted to resume normal services as quickly as possible.

“Our insurance company made [the decision] for us,” city spokesman Michael Lee, a sergeant in the Lake City Police Department, said. “At the end of the day, it really boils down to a business decision on the insurance side of things: them looking at how much is it going to cost to fix it ourselves and how much is it going to cost to pay the ransom.”

The mayor, Witt, said in an interview that he was aware of the efforts to recover backup files but preferred to have the insurer pay the ransom because it was less expensive for the city. “We pay a $10,000 deductible, and we get back to business, hopefully,” he said. “Or we go, ‘No, we’re not going to do that,’ then we spend money we don’t have to just get back up and running. And so to me, it wasn’t a pleasant decision, but it was the only decision.”

Ransomware is proliferating across America, disabling computer systems of corporations, city governments, schools and police departments. This month, attackers seeking millions of dollars encrypted the files of 22 Texas municipalities. Overlooked in the ransomware spree is the role of an industry that is both fueling and benefiting from it: insurance. In recent years, cyber insurance sold by domestic and foreign companies has grown into an estimated $7 billion to $8 billion-a-year market in the U.S. alone, according to Fred Eslami, an associate director at AM Best, a credit rating agency that focuses on the insurance industry. While insurers do not release information about ransom payments, ProPublica has found that they often accommodate attackers’ demands, even when alternatives such as saved backup files may be available.

The FBI and security researchers say paying ransoms contributes to the profitability and spread of cybercrime and in some cases may ultimately be funding terrorist regimes. But for insurers, it makes financial sense, industry insiders said. It holds down claim costs by avoiding expenses such as covering lost revenue from snarled services and ongoing fees for consultants aiding in data recovery. And, by rewarding hackers, it encourages more ransomware attacks, which in turn frighten more businesses and government agencies into buying policies.

“The onus isn’t on the insurance company to stop the criminal, that’s not their mission. Their objective is to help you get back to business. But it does beg the question, when you pay out to these criminals, what happens in the future?” said Loretta Worters, spokeswoman for the Insurance Information Institute, a nonprofit industry group based in New York. Attackers “see the deep pockets. You’ve got the insurance industry that’s going to pay out, this is great.”

A spokesperson for Lloyd’s, which underwrites about one-third of the global cyber-insurance market, said that coverage is designed to mitigate losses and protect against future attacks, and that victims decide whether to pay ransoms. “Coverage is likely to include, in the event of an attack, access to experts who will help repair the damage caused by any cyberattack and ensure any weaknesses in a company’s cyberprotection are eliminated,” the spokesperson said. “A decision whether to pay a ransom will fall to the company or individual that has been attacked.” Beazley declined comment.

Fabian Wosar, chief technology officer for anti-virus provider Emsisoft, said he recently consulted for one U.S. corporation that was attacked by ransomware. After it was determined that restoring files from backups would take weeks, the company’s insurer pressured it to pay the ransom, he said. The insurer wanted to avoid having to reimburse the victim for revenues lost as a result of service interruptions during recovery of backup files, as its coverage required, Wosar said. The company agreed to have the insurer pay the approximately $100,000 ransom. But the decryptor obtained from the attacker in return didn’t work properly and Wosar was called in to fix it, which he did. He declined to identify the client and the insurer, which also covered his services.

“Paying the ransom was a lot cheaper for the insurer,” he said. “Cyber insurance is what’s keeping ransomware alive today. It’s a perverted relationship. They will pay anything, as long as it is cheaper than the loss of revenue they have to cover otherwise.”

Worters, the industry spokeswoman, said ransom payments aren’t the only example of insurers saving money by enriching criminals. For instance, the companies may pay fraudulent claims — for example, from a policyholder who sets a car on fire to collect auto insurance — when it’s cheaper than pursuing criminal charges. “You don’t want to perpetuate people committing fraud,” she said. “But there are some times, quite honestly, when companies say: ’This fraud is not a ton of money. We are better off paying this.’ … It’s much like the ransomware, where you’re paying all these experts and lawyers, and it becomes this huge thing.”

Insurers approve or recommend paying a ransom when doing so is likely to minimize costs by restoring operations quickly, regulators said. As in Lake City, recovering files from backups can be arduous and time-consuming, potentially leaving insurers on the hook for costs ranging from employee overtime to crisis management public relations efforts, they said.

“They’re going to look at their overall claim and dollar exposure and try to minimize their losses,” said Eric Nordman, a former director of the regulatory services division of the National Association of Insurance Commissioners, or NAIC, the organization of state insurance regulators. “If it’s more expeditious to pay the ransom and get the key to unlock it, then that’s what they’ll do.”

As insurance companies have approved six- and seven-figure ransom payments over the past year, criminals’ demands have climbed. The average ransom payment among clients of Coveware, a Connecticut firm that specializes in ransomware cases, is about $36,000, according to its quarterly reportreleased in July, up sixfold from last October. Josh Zelonis, a principal analyst for the Massachusetts-based research company Forrester, said the increase in payments by cyber insurers has correlated with a resurgence in ransomware after it had started to fall out of favor in the criminal world about two years ago.

One cybersecurity company executive said his firm has been told by the FBI that hackers are specifically extorting American companies that they know have cyber insurance. After one small insurer highlighted the names of some of its cyber policyholders on its website, three of them were attacked by ransomware, Wosar said. Hackers could also identify insured targets from public filings; the Securities and Exchange Commission suggests that public companies consider reporting “insurance coverage relating to cybersecurity incidents.”

Even when the attackers don’t know that insurers are footing the bill, the repeated capitulations to their demands give them confidence to ask for ever-higher sums, said Thomas Hofmann, vice president of intelligence at Flashpoint, a cyber-risk intelligence firm that works with ransomware victims.

Ransom demands used to be “a lot less,” said Worters, the industry spokeswoman. But if hackers think they can get more, “they’re going to ask for more. So that’s what’s happening. … That’s certainly a concern.”

In the past year, dozens of public entities in the U.S. have been paralyzed by ransomware. Many have paid the ransoms, either from their own funds or through insurance, but others have refused on the grounds that it’s immoral to reward criminals. Rather than pay a $76,000 ransom in May, the city of Baltimore — which did not have cyber insurance — sacrificed more than $5.3 million to date in recovery expenses, a spokesman for the mayor said this month. Similarly, Atlanta, which did have a cyber policy, spurned a $51,000 ransom demand last year and has spent about $8.5 million responding to the attack and recovering files, a spokesman said this month. Spurred by those and other cities, the U.S. Conference of Mayors adopted a resolution this summer not to pay ransoms.

Still, many public agencies are delighted to have their insurers cover ransoms, especially when the ransomware has also encrypted backup files. Johannesburg-Lewiston Area Schools, a school district in Michigan, faced that predicament after being attacked in October. Beazley, the insurer handling the claim, helped the district conduct a cost-benefit analysis, which found that paying a ransom was preferable to rebuilding the systems from scratch, said Superintendent Kathleen Xenakis-Makowski.

“They sat down with our technology director and said, ‘This is what’s affected, and this is what it would take to re-create,’” said Xenakis-Makowski, who has since spoken at conferences for school officials about the importance of having cyber insurance. She said the district did not discuss the ransom decision publicly at the time in part to avoid a prolonged debate over the ethics of paying. “There’s just certain things you have to do to make things work,” she said.

Ransomware is one of the most common cybercrimes in the world. Although it is often cast as a foreign problem, because hacks tend to originate from countries such as Russia and Iran, ProPublica has found that American industries have fostered its proliferation. We reported in May on two ransomware data recovery firms that purported to use their own technology to disable ransomware but in reality often just paid the attackers. One of the firms, Proven Data, of Elmsford, New York, tells victims on its website that insurance is likely to cover the cost of ransomware recovery.

Lloyd’s of London, the world’s largest specialty insurance market, said it pioneered the first cyber liability policy in 1999. Today, it offers cyber coverage through 74 syndicates — formed by one or more Lloyd’s members such as Beazley joining together — that provide capital and accept and spread risk. Eighty percent of the cyber insurance written at Lloyd’s is for entities based in the U.S. The Lloyd’s market is famous for insuring complex, high-risk and unusual exposures, such as climate-change consequences, Arctic explorers and Bruce Springsteen’s voice.

Many insurers were initially reluctant to cover cyber disasters, in part because of the lack of reliable actuarial data. When they protect customers against traditional risks such as fires, floods and auto accidents, they price policies based on authoritative information from national and industry sources. But, as Lloyd’s noted in a 2017 report, “there are no equivalent sources for cyber-risk,” and the data used to set premiums is collected from the internet. Such publicly available data is likely to underestimate the potential financial impact of ransomware for an insurer. According to a report by global consulting firm PwC, both insurers and victimized companies are reluctant to disclose breaches because of concerns over loss of competitive advantage or reputational damage.

Despite the uncertainty over pricing, dozens of carriers eventually followed Lloyd’s in embracing cyber coverage. Other lines of insurance are expected to shrink in the coming decades, said Nordman, the former regulator. Self-driving cars, for example, are expected to lead to significantly fewer car accidents and a corresponding drop in premiums, according to estimates. Insurers are seeking new areas of opportunity, and “cyber is one of the small number of lines that is actually growing,” Nordman said.

Driven partly by the spread of ransomware, the cyber insurance market has grown rapidly. Between 2015 and 2017, total U.S. cyber premiums written by insurers that reported to the NAIC doubled to an estimated $3.1 billion, according to the most recent data available.

Cyber policies have been more profitable for insurers than other lines of insurance. The loss ratio for U.S. cyber policies was about 35% in 2018, according to a report by Aon, a London-based professional services firm. In other words, for every dollar in premiums collected from policyholders, insurers paid out roughly 35 cents in claims. That compares to a loss ratio of about 62% across all property and casualty insurance, according to data compiled by the NAIC of insurers that report to them. Besides ransomware, cyber insurance frequently covers costs for claims related to data breaches, identity theft and electronic financial scams.

During the underwriting process, insurers typically inquire about a prospective policyholder’s cyber security, such as the strength of its firewall or the viability of its backup files, Nordman said. If they believe the organization’s defenses are inadequate, they might decline to write a policy or charge more for it, he said. North Dakota Insurance Commissioner Jon Godfread, chairman of the NAIC’s innovation and technology task force, said some insurers suggest prospective policyholders hire outside firms to conduct “cyber audits” as a “risk mitigation tool” aimed to prevent attacks — and claims — by strengthening security.

“Ultimately, you’re going to see that prevention of the ransomware attack is likely going to come from the insurance carrier side,” Godfread said. “If they can prevent it, they don’t have to pay out a claim, it’s better for everybody.”

Not all cyber insurance policies cover ransom payments. After a ransomware attack on Jackson County, Georgia, last March, the county billed insurance for credit monitoring services and an attorney but had to pay the ransom of about $400,000, County Manager Kevin Poe said. Other victims have struggled to get insurers to pay cyber-related claims. Food company Mondelez International and pharmaceutical company Merck sued insurers last year in state courts after the carriers refused to reimburse costs associated with damage from NotPetya malware. The insurers cited “hostile or warlike action” or “act of war” exclusions because the malware was linked to the Russian military. The cases are pending.

The proliferation of cyber insurers willing to accommodate ransom demands has fostered an industry of data recovery and incident response firms that insurers hire to investigate attacks and negotiate with and pay hackers. This year, two FBI officials who recently retired from the bureau opened an incident response firm in Connecticut. The firm, The Aggeris Group, says on its website that it offers “an expedient response by providing cyber extortion negotiation services and support recovery from a ransomware attack.”

Ramarcus Baylor, a principal consultant for The Crypsis Group, a Virginia incident response firm, said he recently worked with two companies hit by ransomware. Although both clients had backup systems, insurers promised to cover the six-figure ransom payments rather than spend several days assessing whether the backups were working. Losing money every day the systems were down, the clients accepted the offer, he said.

Crypsis CEO Bret Padres said his company gets many of its clients from insurance referrals. There’s “really good money in ransomware” for the cyberattacker, recovery experts and insurers, he said. Routine ransom payments have created a “vicious circle,” he said. “It’s a hard cycle to break because everyone involved profits: We do, the insurance carriers do, the attackers do.”

Chris Loehr, executive vice president of Texas-based Solis Security, said there are “a lot of times” when backups are available but clients still pay ransoms. Everyone from the victim to the insurer wants the ransom paid and systems restored as fast as possible, Loehr said.

“They figure out that it’s going to take a month to restore from the cloud, and so even though they have the data backed up,” paying a ransom to obtain a decryption key is faster, he said.

“Let’s get it negotiated very quickly, let’s just get the keys, and get the customer decrypted to minimize business interruption loss,” he continued. “It makes the client happy, it makes the attorneys happy, it makes the insurance happy.”

If clients morally oppose ransom payments, Loehr said, he reminds them where their financial interests lie, and of the high stakes for their businesses and employees. “I’ll ask, ‘The situation you’re in, how long can you go on like this?’” he said. “They’ll say, ‘Well, not for long.’ Insurance is only going to cover you for up to X amount of dollars, which gets burned up fast.”

“I know it sucks having to pay off assholes, but that’s what you gotta do,” he said. “And they’re like, ‘Yeah, OK, let’s get it done.’ You gotta kind of take charge and tell them, ‘This is the way it’s going to be or you’re dead in the water.’”

Lloyd’s-backed CFC, a specialist insurance provider based in London, uses Solis for some of its U.S. clients hit by ransomware. Graeme Newman, chief innovation officer at CFC, said “we work relentlessly” to help victims improve their backup security. “Our primary objective is always to get our clients back up and running as quickly as possible,” he said. “We would never recommend that our clients pay ransoms. This would only ever be a very final course of action, and any decision to do so would be taken by our clients, not us as an insurance company.”

As ransomware has burgeoned, the incident response division of Solis has “taken off like a rocket,” Loehr said. Loehr’s need for a reliable way to pay ransoms, which typically are transacted in digital currencies such as Bitcoin, spawned SentinelCrypto, a Florida-based money services business managed by his friend, Wesley Spencer. Sentinel’s business is paying ransoms on behalf of clients whose insurers reimburse them, Loehr and Spencer said.

New York-based Flashpoint also pays ransoms for insurance companies. Hofmann, the vice president, said insurers typically give policyholders a toll-free number to dial as soon as they realize they’ve been hit. The number connects to a lawyer who provides a list of incident response firms and other contractors. Insurers tightly control expenses, approving or denying coverage for the recovery efforts advised by the vendors they suggest.

“Carriers are absolutely involved in the decision making,” Hofmann said. On both sides of the attack, “insurance is going to transform this entire market,” he said.

On June 10, Lake City government officials noticed they couldn’t make calls or send emails. IT staff then discovered encrypted files on the city’s servers and disconnected the infected servers from the internet. The city soon learned it was struck by Ryuk ransomware. Over the past year, unknown attackers using the Ryuk strain have besieged small municipalities and technology and logistics companies, demanding ransoms up to $5 million, according to the FBI.

Shortly after realizing it had been attacked, Lake City contacted the Florida League of Cities, which provides insurance for more than 550 public entities in the state. Beazley is the league’s reinsurer for cyber coverage, and they share the risk. The league declined to comment.

Initially, the city had hoped to restore its systems without paying a ransom. IT staff was “plugging along” and had taken server drives to a local vendor who’d had “moderate success at getting the stuff off of it,” Lee said. However, the process was slow and more challenging than anticipated, he said.

As the local technicians worked on the backups, Beazley requested a sample encrypted file and the ransom note so its approved vendor, Coveware, could open negotiations with the hackers, said Steve Roberts, Lake City’s director of risk management. The initial ransom demand was 86 bitcoin, or about $700,000 at the time, Coveware CEO Bill Siegel said. “Beazley was not happy with it — it was way too high,” Roberts said. “So [Coveware] started negotiations with the perps and got it down to the 42 bitcoin. Insurance stood by with the final negotiation amount, waiting for our decision.”

Lee said Lake City may have been able to achieve a “majority recovery” of its files without paying the ransom, but it probably would have cost “three times as much money trying to get there.” The city fired its IT director, Brian Hawkins, in the midst of the recovery efforts. Hawkins, who is suing the city, said in an interview posted online by his new employer that he was made “the scapegoat” for the city’s unpreparedness. The “recovery process on the files was taking a long time” and “the lengthy process was a major factor in paying the ransom,” he said in the interview.

On June 25, the day after the council meeting, the city said in a press release that while its backup recovery efforts “were initially successful, many systems were determined to be unrecoverable.” Lake City fronted the ransom amount to Coveware, which converted the money to bitcoin, paid the attackers and received a fee for its services. The Florida League of Cities reimbursed the city, Roberts said.

Lee acknowledged that paying ransoms spurs more ransomware attacks. But as cyber insurance becomes ubiquitous, he said, he trusts the industry’s judgment.

“The insurer is the one who is going to get hit with most of this if it continues,” he said. “And if they’re the ones deciding it’s still better to pay out, knowing that means they’re more likely to have to do it again — if they still find that it’s the financially correct decision — it’s kind of hard to argue with them because they know the cost-benefit of that. I have a hard time saying it’s the right decision, but maybe it makes sense with a certain perspective.”

ProPublica research reporter Doris Burke contributed to this story.

alex Jones, starved of attention since he wasno-platformed by Big Tech, has launched a desperate bid for notoriety, releasing an unhinged (even by Jones's standards) statement blaming the credit-card skimming malware his online store was serving on "a zero-day hack probably carried out by leftist stay behind networks hiding inside US intelligence agencies" (he also blamed it on "big tech, the communist Chinese, and the Democratic party" "globalist forces, "the corporate press, Antifa and rogue intelligence operatives").

:{Jones claims that none of the suckers who buy his rebadged Gwyneth Paltrow quack remedies were affected by the malware.

De Groot spotted the malware infection on the Infowars online store using a powerful malware scanner that he built a few years back and which is specialized in detecting vulnerabilities and infections in online stores built on top of the Magento e-commerce platform.

"I have not detected any other malware on this site in the past 3.5 years," de Groot told ZDNet in an interview today. "The first detection was on 2018/11/12 21:37:07 UTC. It was added in the previous 24h," de Groot said, referring to today's discovery of the malicious JavaScript code.

The malware that de Groot found was hidden inside a modified block of Google Analytics code.

Card skimming malware removed from Infowars online store [Catalin Cimpanu/Zdnet]

http://www.democracynow.org/2015/7/7/headlines/leak_shows_hacking_team_sold_spyware_to_fbi_dea

Leaked documents appear to show an Italy-based private spyware company known as the Hacking Team was selling its products to U.S. law enforcement agencies and repressive governments around the world. The Hacking Team sells software which lets users seize remote control of another person’s computer. Its customers include theFBI, the Drug Enforcement Administration and the U.S. Army, as well as foreign governments including Ethiopia, Sudan, Saudi Arabia and Bahrain. The documents were published to the company’s own Twitter feed following an apparent breach.

---

8th

JUAN GONZÁLEZ: Well, I wanted to ask you about one of those, another story in the news. Leaked documents appear to show an Italy-based private spyware company known as the Hacking Team was selling its products to U.S. law enforcement agencies and repressive governments around the world. The Hacking Team sells software which lets users seize remote control of another person’s computer. Its customers include theFBI, the Drug Enforcement Administration and the U.S. Army, as well as foreign governments including Ethiopia, Sudan, Saudi Arabia and Bahrain. The documents were published to the company’s own Twitter feed following an apparent breach.

BRUCE SCHNEIER: So this is an amazing story. Hacking Team is a company—it’s a cyberweapons arms manufacturer—that sells both to the U.S. government and to repressive regimes all over the world. Hacking Team has been responsible for people dying. I have no doubt about that. And what happened is, some hacker decided to publish all of their documents. We learned some extraordinary things, like the company has secret access into the products it sold to all these countries and didn’t tell them. The company has problems. I mean, it’s one thing to have dissatisfied customers. Hacking Team has dissatisfied customers with hit squads. This is going to be bad. This is a company that I believe has behaved immorally. So I’m really kind of happy to see them on the ropes here.

https://firstlook.org/theintercept/2015/07/08/hacking-team-emails-exposed-death-squad-uk-spying/

Late Sunday, hackers dumped online a massive trove of emails and other documents obtained from the systems of Italian surveillance firm Hacking Team. The company’s controversial technology is sold to governments around the world, enabling them to infect smartphones and computers with malware to covertly record conversations and steal data.

For years, Hacking Team has been the subject of scrutiny from journalists and activists due to its suspected sales to despotic regimes. But the company has successfully managed to hide most of its dealings behind a wall of secrecy — until now.

For the last few days, I have been reading through the hacked files, which give remarkable insight into Hacking Team, its blasé attitude toward human rights concerns, and the extent of its spyware sales to government agencies on every continent. Adding to the work of my colleagues to analyze the 400 gigabyte trove of hacked data, here’s a selection of the notable details I have found so far:

Demo for Bangladesh “death squad”

In May, a Hacking Team representative traveled to Dhaka, Bangladesh, to demonstrate the company’s spy technology at the headquarters of a brutal paramilitary security agency that is known for torture and extrajudicial killings. The Rapid Action Battalion (pictured above) — described by Human Rights Watch as a “death squad” that has perpetrated systematic abuses over more than a decade — wanted to see “a practical demonstration” of Hacking Team’s surveillance equipment “in the ground settings of Bangladesh,” according to the company’s emails. Last month, a reseller for Hacking Team in Bangladesh reported that he had submitted the bid papers for the deal and was “pushing RAB to select our offer through our personal relationship.”

DEA mass surveillance in Colombia

Hacking Team supplies its technology to the DEA, which one email shows is apparently using the spyware to launch surveillance operations from the U.S. embassy in Bogota,Colombia. More notably, the email suggests that, in addition to the Hacking Team technology, the DEA is also using other spying equipment at the embassy in Colombia to perform dragnet Internet surveillance. Last month, a Hacking Team field engineer had a meeting with DEA agents in Cartagena and noted that he was told the agency had “bought another interception tool (something that will receive all the traffic for Colombian’s [sic] ISPs).”

Impressing dictator’s spies

In October 2014, in Doha, Qatar, Hacking Team demonstrated its technology for two officers from the Belarus intelligence agency Operations and Analysis Center, or OAC. The Belarus government is an authoritarian regime that been accused by Human Rights Watch of suppressing “virtually all forms of dissent,” cracking down on journalists, activists, opposition politicians, and anyone else deemed to have deviated too far from the orthodoxy of despotic president Alexander Lukashenko, known as “Europe’s last dictator.” Nevertheless, these issues don’t seem to have put off Hacking Team’s attempts to make a sale. “The prospect confirms to be impressed by our solution,” noted a Hacking Team employee after the meeting with the two officers. “They will evaluate to proceed with the Sales Department to arrange a dedicated meeting.” It is unclear from the emails whether the sale went ahead or if efforts to finalize it are still ongoing.

Sales throughIsraelicompany

One of Hacking Team’s key corporate partners is Nice Systems, an Israel-based company with close links to Israeli military and intelligence agencies. (CEO Barak Eilam, for instance, was formerly an officer with an “elite intelligence unit” in the Israeli Defense Forces, according to his biography. Eilam’s LinkedIn profile links him to Unit 8200, Israel’s signals intelligence corps.) The leaked Hacking Team documents show that Nice has been working on closing a large number of deals for the company across the world, winningcontracts in Azerbaijan and Thailand and pushing for sales in Brazil, Colombia, Guatemala, Honduras, Israel, Kuwait, Finland, Georgia, Greece, India, Turkmenistan, Uzbekistan, Kirghistanand elsewhere.

Hacking Team had not responded to a request for comment on this story at time of publication. On Tuesday, a spokesperson for the company told theInternational Business Times: “We don’t have anything to hide about what we are doing and we don’t think that there is any evidence in this 400GB of data that we have violated any laws and I would even go so far as to argue that there is no evidence that we have behaved in anything but a completely ethical way.”

Top clients

According to the hacked files, Hacking Team’s top sales in recent years have come from governments and law enforcement agencies in these countries, in descending order of sales: Mexico, Italy, Morocco, Saudi Arabia, Chile, Hungary, Malaysia, UAE, the United States, Singapore, Kazakhstan, Sudan, Uzbekistan, Panama, Ethiopia, Egypt, Luxembourg, Czech Republic, South Korea, Mongolia, Vietnam, Spain, Ecuador, Oman, Switzerland, Thailand, Russia, Nigeria, Turkey, Cyprus, Honduras, Azerbaijan, Colombia, Poland and Bahrain.

Attempts to break U.K. market

Police agencies in the United Kingdom have trialed Hacking Team’s technology, and have been attempting to purchase it for years, but have been hindered by apparent concerns about the legality of the technology.

In May 2011, through a U.K.-based corporate partner, Hacking Team arranged a secretive meeting with several interested British agencies. The company was told by the partner that attendees would possibly include London’s Metropolitan Police, the government’s Home Office, domestic intelligence agency MI5, customs officials, the Serious Organised Crime Agency and others.

After this meeting, in September 2013, the London police force told Hacking Team that it was “now ready to progress” with a trial of the spying tool. In December, the same year it then invited Hacking Team to formally submit a bid for a spy technology contract, a confidential document outlined that the force wanted to obtain “‘Software’ that can be covertly introduced to a third parties device and will allow us to ‘Look, Listen and Follow’ the third party. The Authority will receive, record and playback the ‘Product’ retrieved from the third party on a ‘System’ that shall be scalable, using proven technology that has in-built security measures appropriate to this task.”

But the deal with the London cops, worth £385,000 ($591,000) to Hacking Team, was abruptly halted in in May 2014 following “internal reviews on how we wished to move this area of technology forward,” according to an email from the police, although the force left the door open for a future deal, adding: “Of course in the months/years to come this could change and if that is the case then we would welcome your organization’s participation.”

Since then, Hacking Team has continued to try to crack the U.K. market. It tried — and apparently failed — to set up a deal with Staffordshire Police after an officer contacted the company seeking technology to “access WiFi points to check users” and infect devices to covertly collect data.

Hacking Team discussed whether it could sell its technology disguised under a different name, “hiding” its full functionality.

And in January this year, it began negotiating a contract with the British National Crime Agency. The meeting was a success, with an officer for the agency telling Hacking Team that a demonstration of the covert surveillance technology “was extremely well received and proved to be a real eye opener for what can be achieved.”

In April, the same officer told Hacking Team he wanted a quote for basic spyware that would log keystrokes, noting that he could “then grow the system accordingly as we would then have the base platform.” Hacking Team was interested in this proposal and discussed internally whether it could sell its technology disguised under a different name, “hiding” its full functionality. The deal appears to have since stalled, with the British agency telling Hacking Team in late May it was “unable to arrange” a meeting.

Plotting denials

Hacking Team’s emails reveal its deceitful attempts to positively spin news reports that have exposed the company’s technology being used against journalists and activists in repressive countries. In October 2012, for example,Bloomberg and Citizen Lab revealed the company’s technology had apparently been used to target a pro-democracy activist in the United Arab Emirates, who was tracked down and beaten by suspected agents of the state. But instead of accepting responsibility and taking firm action against its customer, Hacking Team chose to issue a series of denials.

A technical analysis of the malware used against the activist showed it contained the acronym “RCS,” a reference to Hacking Team’s flagship spyware called Remote Control System. Hacking Team’s public relations guru Eric Rabe scrambled to find a way to muddy the waters, suggesting to his colleagues that they could identify another software with RCS in its name and pin the blame on that. He proposed the company could announce that “The initials RCS are, of course, the initials of a Hacking Team product, Remote Control System, but are also commonly used in software code for the term (WHAT?) Frankly they could mean anything.”

In other emails in the trove, Hacking Team employees appear to confirm that their spy tool did target the UAE activist. While discussing a *Slate* piece I wrote on the incident in October 2012, Hacking Team developer Marco Valleri says that in the UAE case, malware was “downloaded” to infect the activist’s device from “our old demo server.” Moreover, as my colleague Lee Fang has reported, the hacked data shows Hacking Team’s technology has been sold to the UAE since at least 2011. The pro-democracy activist was targeted by it in July 2012.

Enemies list

A presentation prepared by Hacking Team for a surveillance conference in South Africa later this month shows the company complaining about the “chilling effect” that it claims regulation of surveillance technology is having on the ability to fight crime.

The presentation singles out the organizations Hacking Team views as its main adversaries, noting that it is a “target” of groups such as Human Rights Watch and Privacy International and warning that “democracy advocates” are putting pressure on governments.

Separately, the company’s emails show CEO David Vincenzetti’s reaction to criticism from activist groups, who he says are “idiots” good at “manipulating things and demonizing companies and people.”

In one email sent last month, Vincenzetti seems to have unwittingly foreseen the future, jokingly warning staff about the ramifications of the company’s sensitive information leaking online.

“Imagine this: a leak on WikiLeaks showing YOU explaining the evilest technology on earth! :-)” he wrote. “You will be demonized by our dearest friends the activists, and normal people will point their fingers at you.”

Back to basics

In January 2011, Barr had moved on to his research into Anonymous—research that would eventually do his company in. Over at HBGary, Hoglund continued his pursuit of next-gen rootkits. He had hit on a new approach that he called "Magenta."

This would be a "new breed of Windows-based rootkit," said a Magenta planning document, one that HBGary called a "multi-context rootkit." The Magenta software would be written in low-level assembly language, one step up from the ones and zeroes of the binary code with which computers do their calculating. It would inject itself into the Windows kernel, and then inject itself further into an active process; only from there would the main body of the rootkit execute.

Magenta would also inject itself routinely into different processes, jumping around inside the computer's memory to avoid detection. Its command-and-control instructions, telling the rootkit exactly what to do and where to send the information, wouldn't come from some remote Internet server but from the host computer's own memory—where the control instructions had been separately injected.

"This is ideal because it’s trivial to remotely seed C&C messages into any networked Windows host," noted Hoglund, "even if the host in question has full Windows firewalling enabled."

Nothing like Magenta existed (not publicly, at least), and Hoglund was sure that he could squeeze the rootkit code into less than 4KB of memory andmake it "almost impossible to remove from a live running system." Once running, all of the Magenta files on disk could be deleted. Even the best anti-rootkit tools, those that monitored physical memory for signs of such activity, "would only be of limited use since by the time the responder tried to verify his results Magenta will have already moved to a new location & context."

Hoglund wanted to build Magenta in two parts: first, a prototype for Windows XP with Service Pack 3—an old operating system but still widely installed. Second, if the prototype generated interest, HBGary could port the rootkit "to all current flavors of Microsoft Windows."

Shortly thereafter, Anonymous broke into HBGary Federal's website, cracked Barr's hashed password using rainbow tables, and found themselves in a curious position; Barr was also the administrator for the entire e-mail system, so they were able to grab e-mail from multiple accounts, including Hoglund's.

A world awash in rootkits

The leaked e-mails provide a tantalizing glimpse of life behind the security curtain. HBGary and HBGary Federal were small players in this space; indeed, HBGary appears to have made much of its cash with more traditional projects, like selling anti-malware defense tools to corporations and scanning their networks for signs of infection.

If rootkits, paranoia monitors, cartoons, and fake Facebook personas were being proposed and developed here, one can only imagine the sorts of classified projects underway throughout the entire defense and security industry.

Whether these programs are good or bad depends upon how they are used. Just as Hoglund's rootkit expertise meant that he could both detect them and author them, 0-day exploits and rootkits in government hands can be turned to many uses. The FBI has had malware likeCIPAV(the Computer and Internet Protocol Address Verifier) for several years, and it's clear from the HBGary e-mail leak that the military is in wide possession of rootkits and other malware of its own. The Stuxnet virus widely believed to have atleast damagedIranian nuclear centrifuge operations is thought to have originated in theUS or Israeli governments, for instance.

But the e-mails also remind us how much of this work is carried out privately and beyond the control of government agencies. We found no evidence that HBGary sold malware to nongovernment entities intent on hacking, though the company did have plans to repurpose its DARPA rootkit idea for corporate surveillance work. ("HBGary plans to transition technology into commercial products," it told DARPA.)

And another document, listing HBGary's work over the last few years, included this entry: "HBGary had multiple contracts with a consumer software company to add stealth capability to their host agent."

The actions of HBGary Federal's Aaron Barr also serve as a good reminder that, when they're searching for work, private security companies are more than happy to switch from military to corporate clients—and they bring some of the same tools to bear.

When asked to investigate pro-union websites and WikiLeaks, Barr turned immediately to his social media toolkit and was ready to deploy personas, Facebook scraping, link analysis, and fake websites; he also suggested computer attacks on WikiLeaks infrastructure and pressure be brought upon journalists like Glenn Greenwald.

His compatriots at Palantir andBericoshowed, in their many e-mails, few if any qualms about turning their national security techniques upon private dissenting voices. Barr's ideas showed up in Palantir-branded PowerPoints and Berico-branded "scope of work" documents."Reconnaissance cells" were proposed, network attacks were acceptable, "target dossiers" on "adversaries" would be compiled, and "complex information campaigns" involving fake personas were on the table.

Critics likeGlenn Greenwaldcontend that thisnexus of private and public security power is a dangerous mix."The real issue highlighted by this episode is just how lawless and unrestrained is the unified axis of government and corporate power," hewrote last week.

Especially (though by no means only) in the worlds of the Surveillance and National Security State, the powers of the state have become largely privatized. There is very little separation between government power and corporate power. Those who wield the latter intrinsically wield the former.

Therevolving doorbetween the highest levels of government and corporate offices rotates so fast and continuously that it has basically flown off its track and no longer provides even theminimal barrierit once did. It's not merely that corporate power is unrestrained; it's worse than that: corporations actively exploit the power of the state to further entrench and enhance their power.

Even if you don't share this view, the e-mails provide a fascinating glimpse into the origins of government-controlled malware. Given the number of rootkits apparently being developed for government use, one wonders just how many machines around the globe could respond to orders from the US military. Or the Chinese military. Or the Russian military.

While hackers get most of the attention for their rootkits and botnets and malware, state actors use the same tools to play a different game—the Great Game—and it could be coming soon to a computer near you

http://arstechnica.com/tech-policy/2011/02/black-ops-how-hbgary-wrote-backdoors-and-rootkits-for-the-government/3/

...

Its domain name, www.nofoodtaxes.com, was formerly registered to Goddard Claussen public relations, based in Washington, D.C. The website's domain registration has since changed to Domains By Proxy, Inc., which allows registrants to remain anonymous.

https://firstlook.org/theintercept/2015/05/05/nsa-speech-recognition-snowden-searchable-text/

http://www.alternet.org/news-amp-politics/latest-outrageous-example-pentagon-dea-and-private-companies-conspiring-track

NEWS & POLITICS

The Latest Outrageous Example of the Pentagon, DEA and Private Companies Conspiring to Track Everything You Do

Guess what the malware software is really for?

By Bill Blunden / AlterNet May 8, 2015

Yet another report has surfaced describing how tools created by the companies selling software that can damage and hack into people's computers are being deployed by U.S. security services. While the coverage surrounding this story focuses primarily on federal agencies it’s important to step back for a moment and view the big picture. In particular, looking at who builds, operates, and profits from mass surveillance technology offers insight into the nature of the global panopticon.

A report published by Privacy International as well as an article posted by Vice Motherboard clearly show that both the DEA and the United States Army have long-standing relationships with Hacking Team, an Italian company that’s notorious for selling malware to any number of unsavory characters.

Federal records indicate that the DEA and Army purchased Hacking Team’s Remote Control System (RCS) package. RCS is a rootkit, a software backdoor with lots of bells and whistles. It’s a product that facilitates a covert foothold on infected machines so intruders can quietly make off with sensitive data. The aforementioned sensitive data includes encryption keys. In fact, Hacking Team has an RCS brochure that tells potential customers: “What you need is a way to bypass encryption, collect relevant data out of any device, and keep monitoring your targets wherever they are, even outside your monitoring domain.” Note: Readers interested in nitty-gritty details about RCS can check out the Manuals online.

It’s public knowledge that other federal agencies like the FBI and the CIA have become adept at foiling encryption. Yet this kind of subversion doesn’t necessarily bother high tech luminaries like Bruce Schneier, who believe that spying is “perfectly reasonable” as long as it’s targeted. Ditto that for Ed Snowden. Schneier and Snowden maintain that covert ops, shrouded by layers of official secrecy, are somehow compatible with democracy just so long as they’re narrow in scope.

But here’s the catch: RCS is designed and marketed as a means for mass collection. It violates the targeted surveillance condition. Specifically, a Hacking Team RCS brochure proudly states:

“’Remote Control System’ can monitor from a few and up to hundreds of thousands of targets. The whole system can be managed by a single easy to use interface that simplifies day by day investigation activities.”

Does this sound like a product built for targeted collection?

So there you have it. Subverting encryption en masse compliments of Hacking Team. The fact that there’s an entire industry of companies just like this should give one pause as there are unsettling ramifications regarding the specter of totalitarian control.

Corporate America is Mass Surveillance

Throughout the Snowden affair there’s a theme that recurs. It appeared recently in a foreword written by Glenn Greenwald for Tom Engelhardt’s book Shadow Government:

“I really don’t think there’s any more important battle today than combating the surveillance state [my emphasis]. Ultimately, the thing that matters most is that the rights that we know we have as human beings are rights that we exercise.”

There’s a tendency to frame mass surveillance in terms of the state. As purely a result of government agencies like the CIA and NSA. The narrative preferred by the far right is one which focuses entirely on the government (the so-called "surveillance state") as the sole culprit, completely ignoring the corporate factions that fundamentally shape political decision making.

American philosopher John Dewey once observed that "power today resides in control of the means of production, exchange, publicity, transportation and communication. Whoever owns them rules the life of the country," even under the pretense of democratic structures"

There are some 1300 billionaires in the United States who can testify to this fact. As can anyone following the developments around the secretive Trans-Pacific Partnership.

Dewey’s observation provides a conceptual basis for understanding how business interests drive the global surveillance apparatus. Mass surveillance is a corporate endeavor because the people who inevitably drive decisions are the same ones who control the resources. For example, the backbone of the internet itself consists of infrastructure run by Tier 1 providers like Verizon and Level 3 Communications. These companies are in a perfect position to track users and that’s exactly what they do.

Furthermore when spying is conducted it’s usually executed, in one form or another, by business interests. Approximately 70 percent of the national intelligence budget end up being channeled to defense contractors. Never mind that the private sector’s surveillance machinery dwarfs the NSA’s as spying on users is an integral part of high tech’s business model. Internet companies like Google operate their services by selling user information to the data brokers. The data broker industry, for example, generates almost $200 billion a year in revenue. That’s well over twice the entire 2014 U.S. intelligence budget.

From a historical vantage point it’s imperative to realize that high tech companies are essentially the offspring of the defense industry. This holds true even today as companies like Google are heavily linked with the Pentagon. For decades (going back to the days of Crypto AG) the private sector has collaborated heavily with the NSA’s in its campaign of mass subversion: the drive to insert hidden back doors and weaken encryption protocols across the board. Companies have instituted “design changes” that make computers and network devices “exploitable.” It’s also been revealed that companies like Microsoft have secret agreements with U.S. security services to provide information on unpublished vulnerabilities in exchange for special benefits like access to classified intelligence.

In a nutshell: contrary to talking points that depict hi-tech companies as our saviors, they’re more often accomplices if not outright perpetrators of mass surveillance. And you can bet that CEOs will devote significant resources towards public relations campaigns aimed at obscuring this truth.

A parting observation: the current emphasis on Constitutional freedom neglects the other pillar of the Constitution: equality. Concentrating intently on liberty while eschewing the complementary notion of equality leads to the sort of ugly practices that preceded the Civil War. In fact there are those who would argue that society is currently progressing towards something worse, a reality by the way that the financial elite are well aware of. When the public’s collective misery reaches a tipping point, and people begin to mobilize, the digital panopticon of the ruling class will be leveraged to preserve social control. They’ll do what they’ve always done, tirelessly work to maintain power and impose hierarchy.=

has monsanto hacked/scrubbed Wayback machine? desmog archived UN core conf gone

http://web.archive.org/web/20130427025053/http://www.core-online.org/events/biotech+seminar.htm

http://searchmagnified.com//?dn=web.archive.org&pid=7POA7W8JW | 9:18:48 Jan 9, 2013

Got an HTTP 302 response at crawl time

Redirecting to...

http://searchremagnified.com/?dn=web.archive.org&pid=7POA7W8JW

also http://web.archive.org/web/20021111104250/http://www.core-online.org/events/60th

dissent mag ar't on FB boy kings 7/20/14

- URL

- hxxp://www.dissentmagazine.org/wp-includes/js/jquery/jquery.js?ver=1.7.2

- Infection

- JS:Includer-BEV [Trj]

could be coincidence but 2x on 6/16/14 i want to pages that have been pulled and get malware

climate progress fdn (bksh bm, c boyden gray) and ___

could be that old pages just accumulate malware? cd be reason shut down? hmmn

You attempted to reach truth-out.org, but instead you actually reached a server identifying itself asmembers.truth-out.org. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of truth-out.org.

You should not proceed, especially if you have never seen this warning before for this site.

http://www.alternet.org/print/civil-liberties/fbi-monitored-anti-war-website-six-years-error-documents-reveal

taibbi

What is the current listing status for www.nhatky.in?

Site is listed as suspicious - visiting this web site may harm your computer.

What happened when Google visited this site?

Of the 36 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-10-09, and the last time suspicious content was found on this site was on 2013-09-25.

Malicious software includes 2 exploit(s).

This site was hosted on 1 network(s) including AS19066 XXX(WIREDTREE).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, www.nhatky.in did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

Yes, this site has hosted malicious software over the past 90 days. It infected 2 domain(s), including stormfront.XXXorg/,xossip.XXXcom/.

http://cypressnorth.com/web-programming-and-development/what-to-do-if-your-site-appears-as-malware-on-google/

Google Chrome has blocked access to this page on www.americanprogress.org.

Content from www.bestblogsite.org, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your computer with malware.

Malware is malicious software that causes things like identity theft, financial loss, and permanent file deletion. 9/16/13

The registrations are private, meaning that outsiders cannot learn the identities of the registrant(s). Sherman won’t discuss the matter except to confirm that he registered one URL, theloudestvoiceintheroom.com, on Oct. 8 and none of the other domain names associated with his book or Roger Ailes. An inquiry is pending at Random House, the book’s publisher.

A similar domain-registration pattern has cropped up around the pending book of “Fox Mole” Joe Muto, the former Fox producer who wrote unflattering things about his then-employer on Gawker. Those posts earned Muto a book deal that made news last May. Last week, someone registered Molebookaboutfox.com, JoeMutobook.com, among others. Muto says he neither he nor his publisher registered those domains.

Whoever registered the domains appears to have a solid understanding of the terms that people use to search for books on the Internet. Someone who hears about Sherman’s Ailes biography at dinner with friends, for example, may well head home and pump “Gabriel Sherman book” into Google. That search could well yield GabrielShermanbook.com as a prominent search result. All of this makes GabrielShermanbook.com a great place to plant information that counterprograms Gabriel Sherman’s revelations about Roger Ailes.

Lawrence Wright, the author of the Scientology-documenting book “Going Clear,” knows how this marvel of info-democracy works. According to the Daily Beast, Wright bought up 30 domain names related to his book, just to head off search debunkment. Check it out — he missed one.

http://wXXXww.globalops.com/index.htm 404 XXX You attempted to reachwww.globalops.com, but instead you actually reached a server identifying itself as*.gloXXXbalsiu.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version ofwww.globaloXXXps.com.

You should not proceed, especially if you have never seen this warning before for this site.

waybCK FOILED ON GLAXO GUY

http://www.gsk.com/about/bio-troy-cet.htm

Page cannot be crawled or displayed due to robots.txt.

See www.gsk.com robots.txt page. Learn more about robots.txt.

[https://nuclearspin.[split]](https://nuclearspin.org/index.php/Burson-Marsteller:_XXXCorporate_Crimes)

org/index.php/Burson-Marsteller:_Corporate_Crimes broken on purpose

The site's security certificate is not trusted!

You attempted to reach nuclearspin.org, but the server presented a certificate issued by an entity that is not trusted by your computer's operating system. This may mean that the server has generated its own security credentials, which Chrome cannot rely on for identity information, or an attacker may be trying to intercept your communications.

You should not proceed, especially if you have never seen this warning before for this site.

Proceed anyway Back to safety

Help me understand

http://celdf.org/-1-51 SLUDGE points to http://"DUB3" corporate-water-availability-risk.com/ ATTACK PAGE

sorta ll http://www.american-business-conferences.com/c15/corporate-water-availability-risk-management-2010/

htTEEp://DUBYA.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&ved=0CDQQFjAC&url=%2Finterstitial%3Furl%3Dhttp%3A%2F%2Fwww.hamiltonfranks.com%2Findex.php%253Foption%253Dcom_content%2526view%253Darticle%2526id%253D55%2526Itemid%253D67&ei=f-LaUenLF4mjqgHDnYCICw&usg=AFQjCNFp86fkn1jfxvTJhNhd0bgPbsIC9g&bvm=bv.48705608,d.aWM&cad=rja MALWARE hamiltonfranks.com looking for info on cheny irahn arms sale

freepers: Realclearpolitics.com Blocked as "Attack Page"

Spybot S&D | 2/1/13

Posted on Friday, February 01, 2013 6:37:02 AM by pabianice

Warning when logging into RCP:

Reported Attack Page!

This web page at www.realclearpolitics.com has been reported as an attack page and has been blocked based on your security preferences.

Attack pages try to install programs that steal private information, use your computer to attack others, or damage your system.Some attack pages intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.

TOPICS: Chit/Chat; Computers/Internet

KEYWORDS: attackpage; blacklisted; dncbrownshirts; hijackthis; malware; realclearpolitics; swatting; websitewarning

Surprising.

1 posted on Friday, February 01, 2013 6:37:03 AM by pabianice

[ Post Reply | Private Reply | View Replies]

To: pabianice

Safe Browsing

Diagnostic page for www.realclearpolitics.com

What is the current listing status for www.realclearpolitics.com?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 2 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 1399 pages we tested on the site over the past 90 days, 14 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-02-01, and the last time suspicious content was found on this site was on 2013-01-31.

Malicious software includes 12 trojan(s).

Malicious software is hosted on 8 domain(s), including 15regafendil.info/, fastnitehost.info/, fastnitehost.org/.

9 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including yieldmanager.com/, yahoo.com/, openx.net/.

This site was hosted on 3 network(s) including AS16509 (AMAZON), AS10439 (CARINET), AS15169 (Google Internet Backbone).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, www.realclearpolitics.com appeared to function as an intermediary for the infection of 1 site(s) including bloglovin.com/.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Next steps:

Return to the previous page.

If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google’s Webmaster Help Center.

2 posted on Friday, February 01, 2013 6:39:16 AM by pabianice (washington, dc ..)

[ Post Reply | Private Reply | To 1 | View Replies]

To: pabianice

Firefox gave me the same warning when opening Free Republic yesterday.

3 posted on Friday, February 01, 2013 6:39:36 AM by WhistlingPastTheGraveyard (Some men just want to watch the world burn.)

[ Post Reply | Private Reply | To 1 | View Replies]

To: pabianice

Yep. Google blocking it as malware when linked from there. Google has been in full-blown censorship mode for some months.}:

Malware

Unanswered questions about Pegasus in India

BJP surveillance measures

A global trend

FURTHER READING

Trying to go “Bulletproof”

Going dim

https://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/Spywarehttps://en.wikipedia.org/wiki/SpywareSpyware - Wikipedia

Consortium News Target of a Malware Attack as Twitter Takes ...

Demo for Bangladesh “death squad”

DEA mass surveillance in Colombia

Impressing dictator’s spies

Sales throughIsraelicompany

Top clients

Attempts to break U.K. market

Plotting denials

Enemies list

Back to basics

A world awash in rootkits

Page cannot be crawled or displayed due to robots.txt.