Technology News

China tightens control over cybersecurity in data crackdown

BEIJING (AP) — Tech experts in China who find a weakness in computer security would be required to tell the government and couldn’t sell that knowledge under rules further tightening the Communist Party’s control over information.

The rules would ban private sector experts who find “zero day,” or previously unknown security weaknesses, and sell the information to police, spy agencies or companies. Such vulnerabilities have been a feature of major hacking attacks including one this month blamed on a Russian-linked group that infected thousands of companies in at least 17 countries.

Beijing is increasingly sensitive about control over information about its people and economy. Companies are barred from storing data about Chinese customers outside China. Companies including ride-hailing service Didi Global Inc., which recently made its U.S. stock market debut, have been publicly warned to tighten data security.

Under the new rules, anyone in China who finds a vulnerability must tell the government, which will decide what repairs to make. No information can be given to “overseas organizations or individuals” other than the product’s manufacturer.

No one may “collect, sell or publish information on network product security vulnerabilities,” say the rules issued by the Cyberspace Administration of China and the police and industry ministries. They take effect Sept. 1.

The ruling party’s military wing, the People’s Liberation Army, is a leader along with the United States and Russia in cyber warfare technology. PLA officers have been charged by U.S. prosecutors with hacking American companies to steal technology and trade secrets.

Consultants that find “zero day” weaknesses say their work is legitimate because they serve police or intelligence agencies. Some have been accused of aiding governments accused of human rights abuses or groups that spy on activists.

There is no indication such private sector researchers work in China, but the decision to ban the field suggests Beijing sees it as a potential threat.

China has steadily tightened control over information and computer security over the past two decades.

Banks and other entities that are deemed sensitive are required to use only Chinese-made security products wherever possible. Foreign vendors that sell routers and some other network products in China are required to disclose to regulators how any encryption features work.

Firm hacked to spread ransomware had previous security flaws

For 21 years, the software company Kaseya labored in relative obscurity — at least until cybercriminals exploited it in early July for a massive ransomware attack that snarled businesses around the world and escalated U.S.-Russia diplomatic tensions.

But it turns out that the recent hack wasn’t the first major cybersecurity problem to hit the Miami-based company and its core product, which IT teams use to remotely monitor and administer workplace computer systems and other devices.

“It feels a little like déjà vu,” said Allie Mellen, a security analyst at Forrester Research.

In 2018, for instance, hackers managed to infiltrate Kaseya’s remote tool to run a “cryptojacking” operation, which channels the power of afflicted computers to mine cryptocurrency — often without its victims noticing. It was a less harmful breach than the recent ransomware attack, which was impossible to miss since it crippled affected systems until their owners paid up. But it similarly relied on Kaseya’s Virtual System Administrator product, or VSA, as a vehicle to get access to the companies that rely on it.

A 2019 ransomware attack also rode into computers through another company’s add-on software component to the Kaseya VSA, causing more limited damage than the recent attack. Some experts have tied that earlier assault to some of the same hackers who later formed REvil, the Russian-language syndicate blamed for the latest attack.

And in 2014, Kaseya’s own founders sued the company in a dispute over responsibility for a VSA security flaw that allowed hackers to launch a separate cryptocurrency scheme. The court case does not appear to have been previously reported outside of a brief 2015 mention in a technical blog post. At the time, the founders denied responsibility for the vulnerability, calling the company’s charges against them a “bogus assertion.”

Nearly all of Kaseya’s security problems have as their root cause well-understood coding vulnerabilities that should have been addressed earlier, said cybersecurity expert Katie Moussouris, the founder and CEO of Luta Security.

“Kaseya needs to shape up, as does the entire software industry,” she said. “This is a failure to incorporate the lessons the bugs were teaching you. Kaseya, like a lot of companies, is failing to learn those lessons.”

Many of the attacks relied at least in part on what’s known as SQL injection, a technique hackers use to inject malicious code into web queries. It’s an old technique that Mellen said has been considered a “solved problem” in the cybersecurity world for a decade.

“It points to a chronic product security issue in Kaseya’s software that remains unaddressed seven years later,” she said. “When organizations choose to brush over security challenges, the incidents continue, and, as in this case, get worse.”

Kaseya has noted that it’s long been a target because many of its direct customers are “managed-services providers” that host IT infrastructure for hundreds, if not thousands, of other businesses.

“In the business we’re in, and the number of endpoints we manage around the world, as you might expect, we take security extremely seriously,” Ronan Kirby, president of the company’s European operations, said at a Belgian cybersecurity conference Thursday. “You attack a company, you get into the company. You attack a service provider, you get into all their customers. You get into Kaseya, that’s a very different proposition. So obviously we’re an attractive target.”

Kaseya declined to answer questions from The Associated Press about the previous hacks or the legal dispute involving its founders.

Mark Sutherland and Paul Wong co-founded Kaseya in California in 2000. They had previously worked together on a project protecting the email accounts of U.S. intelligence workers at the National Security Agency, according to an account on the company’s website.

But more than a year after selling Kaseya in June 2013, court records show that Sutherland, Wong and two other former top executives sued the company to recoup $5.5 million in stock buybacks they said they were unfairly denied.

At the heart of the dispute was an attack by hackers who used Kaseya’s VSA as a conduit to deploy Litecoin mining malware that secretly hijacks a victim computer’s power to make money for the hacker by processing cryptocurrency payments.

Kaseya publicly disclosed the attacks in a March 2014 notice to customers. Privately, it was blaming the company’s previous leadership for not warning about “serious vulnerabilities” in Kaseya’s software. It sought to deprive them of the final $5.5 million of the acquisition price to compensate for the loss of business and damaged reputation.

The founders, in turn, blamed the new leadership for scaling back on coding expertise and eliminating a “hotfix” system for rapidly fixing bugs, according to the lawsuit from Sutherland, Wong, former CEO Gerald Blackie and former Chief Operating Officer Timothy McMullen.

They also argued that the SQL injection technique used by the hackers was highly common and “inherent in any computer code” that uses the SQL programming language.

“Ensuring that each and every piece of database access code is immune to SQL injection is essentially impossible,” said their lawsuit. Mellen and Moussouris both rejected that assertion.

“That is a bold statement and provably false,” Moussouris said. “It highlights the fact they lacked the security knowledge and sophistication to protect their users.”

None of the plaintiffs or their lawyers responded to requests for comment. They agreed to dismiss the case in December 2013, just a month after they filed it. It’s not clear how it was settled. Kaseya is privately held.

LinkedIn profiles for Sutherland and Wong list them as retired. Blackie went on to become CEO of another Miami-based provider of remote-control software, Pilixo, where he was joined by McMullen. Pilixo didn’t return a request for comment.

New vulnerabilities affecting Kaseya’s VSA — including the one exploited by the REvil ransomware gang — were discovered this year by a Dutch cybersecurity research group that says it confidentially warned Kaseya in early April. “In the wrong hands, these vulnerabilities could lead to the compromise of large numbers of computers managed by Kaseya VSA,” the Dutch Institute for Vulnerability Disclosure said in a blog post last week explaining the timeline of its actions.

Some of those Kaseya fixed by May, including another SQL injection flaw, but the Dutch group said others were still unpatched when ransomware started hitting hundreds of businesses in early July. Kaseya has said up to 1,500 businesses have been compromised as a result of the attack. Kaseya on Sunday rolled out patches to the vulnerabilities used in the REvil attack.

With Kaseya in the spotlight, a cybersecurity responder assisting clients stricken by the July 2 ransomware attack discovered what he called a glaring Kaseya security omission: a vulnerability in a public-facing customer portal that had been identified in 2015 but left unpatched.

Alex Holden of Hold Security said he notified Kaseya and that the portal was quickly taken down. But the vulnerability troubled him, he said, because it granted unauthenticated users access to a configuration file that is highly protected on Microsoft web servers — one that often contains passwords and can grant access to core functions.

Moussouris said there’s a pattern of ransomware syndicates going after easily detectable software flaws.

“It’s collective technical debt around the world and the ransomware gangs are technical debt collectors,” she said. “They’re coming after organizations like Kaseya” and others that haven’t invested in better security.

___

This article has been corrected to note that news of a court case involving Kaseya and its founders was previously described in a 2015 technical blog post.

___

AP technology reporter Frank Bajak contributed to this article.

EU nations approve a dozen pandemic recovery plans

BRUSSELS (AP) — European Union nations approved the pandemic recovery plans of the bloc’s four biggest economies and eight other member countries Tuesday, a move seen as a bellwether for an economic revival from the unprecedented recession caused by the coronavirus pandemic.

The approval will allow a dozen of the EU’s 27 members to start unlocking funds for the pre-financing of projects that are intended to put Europe on more solid economic footing while also making it greener and more digitally advanced.

The nations include the EU’s economic juggernauts – France, Germany, Italy and Spain – and Austria, Belgium, Denmark, Greece, Latvia, Luxembourg, Portugal and Slovakia.

“EU funding can now start to flow to finance much-needed reforms and investments in each of these countries. But this is only the start,” EU Vice President Valdis Dombrovskis said.

The green light to prepare for the release of funds is a key step in an 800 billion-euro ($950 billion) support program that EU members agreed on in principle last summer when their economies were mired in the worst economic downturn of the bloc’s existence.

Tuesday’s agreement will allow the 12 nations to unlock 13% of pre-financing, perhaps as soon as the end of the month, Dombrovskis said. In the case of France, which is to get some 40 billion euros $47.3 billion from the pandemic recovery fund, that would amount to 5.1 billion euros ($6 billion.)

EU Economy Commissioner Paolo Gentiloni said the action “will boost confidence in the markets, in countries, and allow investments and reforms to start.”

After last year’s economic nosedive, EU economies are set to rebound by their highest levels in decades as coronavirus restrictions ease. They remain at risk, however, due to virus variants that are causing infections to spike again in several countries.

Dombrovskis expressed optimism.

“As business confidence grows, investments pick up and people begin to spend more on. The economy is forecast to rebound somewhat faster than previously expected.”

Other EU members are expecting approvals of their recovery plans later in the summer although Hungary could pose a potentially divisive problem.

The EU’s executive commission is currently working past a Monday deadline to vet Hungary recovery plan amid allegations Budapest might not meet all the requirements to tap into the funds. Critics have said that corruption safeguards might be insufficient in the Hungarian plan.

Electrify America to double EV charging stations by 2025

SILVER SPRING, Md. (AP) — Electrify America, an electric vehicle charging network funded with money paid by Volkswagen as punishment for its emissions cheating scandal, says it plans to more than double its number of charging stations throughout the United States and Canada.

The expansion will include 1,800 fast-charging stations and 10,000 individual chargers to be installed by 2025 and is part of Electrify America’s previous commitment to invest $2 billion over 10 years on EV infrastructure, education and access in the U.S.

Automakers have ramped up production of electric vehicles that can go farther and charge faster, but are concerned that consumers interested in EVs may wait to buy until there’s better, faster charging infrastructure.

The latest generation of EVs, many with ranges around 300 miles (480 kilometers) per charge, can accept electricity at a much faster rate than previous models could, but most charging stations can’t keep up with the vehicles’ advanced technology.

There are about 42,000 public charging stations in the U.S., but only about 5,000 are considered direct-current fast chargers, according to the Department of Energy. The rest require roughly eight hours to fully charge longer-range batteries.

The higher cost of fast-charging stations is an issue President Joe Biden’s administration will have to take into account as it develops incentives to encourage companies and governments to build more charging stations. The administration’s goal is to have 500,000 charging stations nationwide by 2030.

Electrify America’s expansion plan increases its presence in established U.S. regions as well as adding new states such as Hawaii, North Dakota, South Dakota, West Virginia, Wyoming and Vermont. The additions bring its network to 49 states and the District of Columbia, Electrify America said. It also plans to add a new electric vehicle charging highway to the “upper Midwest” but did not say specifically where it would be.

Since its first charging station opened in May 2018, the Reston, Virginia-based company said it has installed an average of four stations per week.

FCC gives state prisons tech options to quash cellphones

COLUMBIA, S.C. (AP) — Federal regulators are giving state prisons across the country more technological options to combat contraband cellphones, which prison officials have long said represent the greatest security threat behind bars.

The Federal Communications Commission had been set to discuss “taking steps to combat contraband wireless devices in correctional facilities” during a meeting Tuesday, but officials said at the beginning of the discussion that they had already adopted a ruling on the issue and wouldn’t be going over it.

In a comment posted online, FCC Chairwoman Jessica Rosenworcel said the commission’s action “sets up a streamlined system for corrections department officials to use certified contraband interdiction systems to identify where contraband phones may be in use and request that wireless carriers have them deactivated.”

The ruling responds to “last year’s appropriations legislation directing us to adopt rules to require wireless carriers to disable contraband devices upon proper identification,” she wrote.

The move stops short of addressing out-and-out cell signal jamming, something prisons officials say would help them render contraband phones useless to inmates, who use the devices for unfettered, unmonitored communication.

But Rosenworcel said the commission is open to taking further action, noting that the FCC will seek comment on further rule updates and “the potential for other systems to help us combat the proliferation of contraband phones,” to the extent federal law allows.

South Carolina Corrections Director Bryan Stirling has been at the forefront of an effort by corrections directors across the country to call for the ability to use more technology to crack down on contraband cellphones, thousands of which are confiscated in prisons every year, smuggled inside hollowed-out footballs, whisked in by corrupt employees and sometimes even dropped by drone.

He and other state prisons directors have advocated for the ability to jam the signals entirely, therefore rendering the illicit phones useless, but that’s not allowed under current federal law. Last week, Stirling told The Associated Press he was encouraged by the commission’s willingness to discuss the dangers of the devices, which are smuggled into institutions by the thousands.

CTIA, a wireless industry group, opposes jamming, saying it could thwart legal calls. But, according to a 2020 FCC document, CTIA “recently reported to the Commission that it has been working successfully, along with its members companies” on “ceasing service to contraband devices pursuant to court orders they have obtained.”

There’s been other evolution on the issue. In 2008 and again in 2019, South Carolina got federal permission to conduct jamming tests at two maximum-security prisons. Congress has considered jamming legislation, but no bills have been signed into law. The FCC has held a field hearing in South Carolina and met with members of Congress, prisons officials and stakeholders from the wireless industry.

Noting dangers like extortion schemes made possible by contraband phones, Rosenworcel also pushed prisons officials to continue their other efforts to root out the problem devices.

“The incentive to bring these devices into prisons and jails will not simply go away with better contraband interdiction systems in place,” she wrote. “These underlying problems need to be addressed.”

___

Meg Kinnard can be reached at http://twitter.com/MegKinnardAP.

Technology News

Footer