Ex-FBI employee jailed for taking classified material home

Infosec successful brief In a lawsuit startlingly akin to charges precocious unsealed against one-term US president Donald Trump, a erstwhile FBI expert has been jailed for taking delicate classified worldly location pinch her.

As pinch Trump, Kendra Kingsbury was charged nether nan Espionage Act. In Kingsbury's case, it was 2 counts of unlawfully retaining documents related to nationalist defense, which landed her pinch a 46-month situation condemnation and 3 years of supervised release.

Kingsbury pleaded blameworthy to nan charges, which alleged she took documents location passim nan people of her 12-year employment pinch nan FBI, wherever she held a Top Secret/SCI information clearance.

The Department of Justice said Kingsbury removed a full of 386 classified documents to her home, which included delicate nationalist information accusation that nan DoJ said could person "revealed immoderate of nan government's astir important and secretive methods of collecting basal nationalist information intelligence" successful nan incorrect hands.

Kingsbury stored documents connected aggregate forms of physics media pertaining to a number of intelligence activities – including counter-terrorism and defense against cyber threats, nan DoJ said. 

Kingsbury besides retained accusation related to Al Qaeda successful Africa and individual terrorists associated pinch it, arsenic good arsenic "intelligence gaps regarding dispute overseas intelligence services and violent organizations and nan method capabilities of nan FBI against counterintelligence and counterterrorism targets," per nan DoJ.

As for why she did it, nan DoJ said its investigation only turned up "more questions and concerns than answers."

Officials recovered a number of what they described arsenic "suspicious calls" to telephone numbers associated pinch subjects of counter-terrorism officials – immoderate of whom moreover called Kingsbury back. The DoJ said it's been incapable to fig retired why those calls were placed, and that Kingsbury declined to stock immoderate details.

As for the Florida man, he is expected successful tribunal to conflict nan charges, which he denies, successful mid-August.

Dole admits ransomware crooks picked a peck of worker PII

After experiencing a "cybersecurity incident" that it identified arsenic ransomware successful February, consequence packager Dole is sending letters to labor to fto them cognize immoderate delicate worldly was stolen.

According to information Dole provided to nan Maine lawyer general, a full of 3,885 US labor had information – including names, employment info, SSN, address, telephone number, passport accusation and different delicate specifications – stolen successful nan February heist.

Dole noted nan stolen accusation varies by individual, and that it doesn't judge nan information "was aliases will beryllium taxable to immoderate fraudulent misuse," which successful corpspeak equates to "don't interest – we paid nan ransom and we wholly spot these hackers astatine their word."

Dole hasn't said whether it paid nan ransom, aliases really overmuch nan unidentified perps demanded, but it did opportunity successful its Q1 2023 financial statement [PDF] that nan "direct costs related to nan incident were $10.5 cardinal of which $4.8 cardinal related to continuing operations."

US Army says unsolicited smartwatch message enigma afoot

It goes without saying, but if you get an unsolicited physics instrumentality successful nan mail, don't move it on. That goes doubly for members of nan Armed Forces, who've precocious been getting enigma smartwatches successful nan mail, nan US Army Criminal Investigation Division (CID) said this week.

"These smartwatches, erstwhile used, person auto-connected to Wi-Fi and begun connecting to compartment phones unprompted, gaining entree to a myriad of personification data," nan CID warned.

• Guess what happened to this US agency utilizing outdated software?
• Hold it – different vulnerability recovered successful MOVEit record transportation software
• Toyota admits to yet different unreality leak
• 40% of IT information pros opportunity they've been told not to study a information leak

Investigators opportunity nan watches "may" incorporate malware, but it's difficult to spot nan constituent of nan strategy different – particularly if nan extremity consequence is simply a compromised instrumentality belonging to personification pinch a information clearance. The CID said nan enigma watches could besides beryllium portion of a "brushing" scam successful which sellers nonstop equipment – often inexpensive junk – to random group successful bid to clone affirmative reviews connected ecommerce sites.

Regardless – soldier, sailor, airman, marine aliases civilian – don't move it on. If you are successful nan military, nan CID urges you to study nan devices to your section counterintelligence aliases information manager.

Tsunami of malware hits Linux SSH servers

Miscreants are conducting a run to infest poorly managed SSH servers pinch a assortment of malware, according to researchers astatine nan AhnLab Security Emergency consequence Center (ASEC).

Cybercriminals onslaught SSH because nan protocol allows unafraid login to distant machines – an evidently useful installation for crooks. According to ASEC's researchers, nan instrumentality is often poorly managed and truthful attracts attacks. In March 2023 ASEC spotted attacks connected SSH by threat group ChinaZ that installed various DDoS bots. In 2022, Fortinet detailed different onslaught connected Linux SSH servers, connected that juncture pinch malware called "RapperBot" that brute-forced its measurement into IoT devices.

The existent run detected by ASEC saw crooks instal Tsunami – besides known arsenic Kaiten – malware that allows afloat distant power of an infected computer. This run besides sometimes involves installation of ShellBot – a DDoS botnet developed utilizing nan Perl programming connection – nan XMRig Monero coin miner, and privilege escalation malware successful nan Executable and Linkable Format (ELF) for gaining power of nan targeted system, ASEC researchers wrote successful a report.

MIG Logcleaner v2.0 is besides installed and its sanction explains why – nan malware is utilized to delete aliases modify circumstantial logs wrong files, making it much difficult for analysts to observe and way nan attack.

The root codification for Tsunami is publically disposable and threat groups will modify it and adhd features to fresh their needs. In nan run ASEC explored, nan attackers utilized a version named Ziggy.

While SSH allows admins to remotely log into a system, they request credentials to do so.

"If elemental relationship credentials [like personification IDs and passwords] are utilized successful a Linux system, a threat character tin log into nan strategy done brute unit aliases a dictionary attack, allowing them to execute malicious commands," nan researchers wrote.

This includes scanning nan net for publically exposed Linux SSH servers and utilizing known relationship credentials to tally nan attacks and log in, followed by executing a bid to download nan malware. The attackers were besides seen penning caller nationalist and backstage SSH keys to guarantee continued entree to nan infected system.

Tsunami besides ensures persistence successful nan compromised strategy by penning itself onto nan "/etc/rc.local" record truthful that it continues to tally moreover aft nan strategy reboots.

Once in, Tsunami tin not only tally DDoS attacks but besides different tasks, including collecting strategy accusation and downloading further payloads, each while communicating pinch its command-and-control (C&C) server via nan IRC protocol, a decades-old net chat protocol.

"Additionally, accusation specified arsenic nan C&C reside and nan transmission password are encrypted and saved. Tsunami decrypts and retrieves nan strings it needs during its execution," ASEC wrote. "There are 2 C&C server addresses, and Tsunami randomly selects 1 of them to effort a connection."

To protect systems against specified attacks, nan researchers reiterated nan request for difficult-to-guess relationship passwords that are changed periodically and to support nan strategy patches up to date. Enterprises besides should employment firewalls. ®