Tuesday, November 29, 2016

Huawei: Monopoly in Africa


Huawei Technologies Co. Ltd. has a very strong telecommunications foothold in Africa. Many security experts believe that Huawei has been and continues to be associated with the Chinese government information sharing program. Their strong presence in Africa in numerous aspects of cyber technology, is close to becoming a monopoly in Africa. This corner of the market sets the stage for ambiguous domination of cyber technology within the African continent. This information is being supplied for your situational awareness.
  • Huawei Ltd. began their African operations in 1999.
  • In 17 years, Huawei has expanded exponentially with major footholds in Egypt, Kenya, South Africa, North African and Western Africa.
  • Huawei has long been suspected as a corporation in collusion with the government of China and continues to create cyber security suspicion. 

Huawei was suspected by South Sudan of surveillance and forgery in 2014. This was an alleged effort to gain market intelligence and delay of a funding timeline for a rival telecom infrastructure project. There has not been current reporting on these accusations, yet it illustrates the savvy nature of Huawei in creating a near African monopoly on cyber systems, IT infrastructure, cyber products and associated training. Mr. Vincent (Bo) Pang, President of Huawei’s Western European Region, in response to the South Sudan claim, stated that Huawei is trusted across Africa because it is, “in the region for the long haul.” This never a truer statement.

Wapack Labs, Africa Desk will continue to monitor Huawei and their African development.

Publication Date: 27 November 2016
Handling Requirements: Traffic light protocol (TLP) GREEN
Attribution/Threat Actors: Chinese APT
Actor Type: Adversary capabilities have been assessed as Tier IV
Potential Targets: Vodafone, French Thales, Orange & numerous African telecoms
Past Reporting: DOC-4455/4249/2902, Msg-8558


Friday, November 25, 2016

Wanted: Wicked Smaat Cyber Security Operator/Analysts

Wapack Labs seeks two people for opportunities as Cyber Security Analysts with strong network security skills. 

What’s that mean? You should be able to break down TCP/IP, author Python scripts to manipulate network captured data, read PCAP, and correlate events.

  • Have you always wanted to be a cyber intelligence analyst?
  • When you see a ‘wet paint sign’ what do you do? 
  • Can you interface with non-technical type “A” personnel who rely on you to be their expert but may have egos like fighter pilots?
  • Can you break down network security indicators and use that data to compare to, and create intelligence?
  • Do you enjoy (we mean, take immense pleasure in) hunting and stopping bad guys on big networks.

If you’re this person. Please continue reading.

Wapack Labs is looking for a Cyber Intelligence Operator and Analyst to work onsite at a VERY cool customer location in Concord, NH. 

The person selected for this position will be called upon for day-to-day operations of the in-place security solutions and the for the identification, investigation and resolution of security breaches detected by those systems.

This may include involvement in the implementation of new security solutions, participation in the creation and or maintenance of policies, standards, baselines, guidelines and procedures as well as conducting vulnerability audits and assessments. The IT Security Analyst is expected to be fully aware of the enterprise’s security goals as established by its stated policies, procedures and guidelines and to actively work towards upholding those goals.

Position Responsibilities

  • You will be responsible for monitoring security in a large enterprise environment. You’ll will be expected to have an understanding of up-to-date knowledge of the IT security industry including current attack TTPs and how they can be stopped.

  • You will interface with Wapack Labs Intelligence operations with this knowledge, you will be called on to recommend additional security solutions or enhancements to existing security solutions to improve overall enterprise security.

  • The Cyber Security Analyst may be called on to perform deployment, integration and configuration of new security solutions or enhancements to existing security.

  • More… as directed.

Knowledge & Experience

You must have a working technical knowledge of the following:

  • Security solutions including Anti-Virus, Firewall, Malware, Intrusion Prevention, etc.

  • Computer hardware including desktops, laptops, smartphones (preferably iPhone), servers, storage, removal media, printers, faxes, and other storage or communication devices

  • Strong understanding of TCP/IP and other network protocols
  • Strong understanding of Microsoft and Linux Operating Systems

  • Strong network skills from a Security Operations perspective. What’s that mean? You should be able to break down TCP/IP, author Python scripts to manipulate network captured data, read PCAP, and correlate events.

  • Written, oral, and interpersonal communication skills; you will be required to write reports. Your ability to translate technical observations and analysis into actionable reports is critical. If you hate writing, stop here. This job is not for you. (This cannot be emphasized enough. All Wapack Labs positions include writing.)

Personal Attributes

  • No criminal record; a security clearance may be required
  • Proven analytical and problem-solving abilities
  • Ability to effectively prioritize and execute tasks in a high-pressure environment
  • Ability to conduct research into IT security issues and products as required
  • Ability to present ideas in business-friendly and user-friendly language
  • Highly self-motivated and directed
  • Team-oriented and skilled in working within a collaborative environment

Work Hours and Location

  • This is a full time onsite position. You will conform with the client’s normal business hours. 
  • Location: Concord, NH


Education and Certifications

Wapack Labs hires transitioning Veterans, Law Enforcement and First Responders first. Veterans, especially wounded warriors, service connected disabled, or those in an occupational transition program with IT or cyber skills are strongly encouraged to apply. 

BS/BA or equivalent work experience is required. Certifications will be accepted with 3+ years of demonstrated work experience as an operating IT or Information Security team. 

Interested? Shoot us a resume.

Thursday, November 24, 2016

Data Breach - Online Accounting Firm

(November 24, 2016) An online Palo Alto headquartered accounting firm has suffered a data breach. Initial findings suggest that as much as 80 Gb of emails and accounting data were sent offsite by key loggers installed on the computers in the company, resulting in the loss of accounting information including, payroll, financial details and credential pairs (user names and passwords) for its clients which included at least three cyber security companies, two online real estate companies, and several smaller online application providers. 

The breach appears to have occurred as the result of a key-logged patient-zero account that stole data from the company for approximately nine months (March - November, 2016). Wapack Labs has identified at least 30 victims. The accounting firm boasts hundreds of clients on their website. 

Analysis continues. 

Wapack Labs contacted the company via the customer service line listed on the website and was referred to the company's CEO. Two unsuccessful attempts have been made to date.

UPDATE: CEO notified 11/24/16.

Wednesday, November 23, 2016

Black Hat Hackers Target Healthcare


A known black hat hacker collective is currently ransoming 500GB of internal documents, including intellectual property belonging to one of the 50 Top Sellers on Amazon, via a Remote Desktop Protocol (RDP). This group is infamous for hacking healthcare systems in the U.S. and other corporate institutions - then selling the data. This information is being supplied for your situational awareness.

  • Recent, successful black hat hackers.
  • Active in hacking institutions, focusing on the U.S. healthcare industry.
  • Company belonging to the 50 Top Sellers on Amazon has been the most recent victim.
Publication date:  19 November 2016
Handling requirements:  Traffic light protocol (TLP) GREEN
Attribution/Threat Actors:  Black Hat Hacker Collective
Actor Type:  Adversary capabilities have been assessed as Tier III*
Potential Targets:  U.S. Healthcare industry, other industries
Past Reporting:  DOC-4055, DOC-4203

#OpNoDAPL – Standing Rock “Officials” Doxed

On 12 November 2016, a member of the Anonymous collective posted a Pastebin link containing the names, addresses, phone numbers and emails of various people and agencies involved with the Dakota Access Pipeline (DAPL) Project.  This protest has been on-going since October 2016, but has recently escalated in surface and underground web networks.  This information is being supplied for your situational awareness.
  • DAPL protests began in October 2016.
  • The Anonymous movement has joined protests against DAPL, and on 12 November 2016 posted to Twitter Personally Identifiable Information (PII) on local Dakota Access Pipeline officials.
  • #OpNoDAPL and other associated pipeline protest sites have sparked protests in San Francisco and Washington DC.

Monday, November 21, 2016

DDoS Attacks And Coup Attempt During October 2016 Montenegro Elections


During the October 16, 2016 elections in Montenegro, the website of the pro-NATO ruling party and several other media and political NGO websites were subject to Distributed Denial of Service (DDoS) attacks. In tandem, misinformation campaigns were conducted across various platforms including social media. Analysis of the event indicate that certain Russian media outlets were involved, and investigations showed that an international group that included Montenegrin, Russian and Serbian nationals were planning a coup that included the assassination of the Montenegrin Prime Minister. It is possible that the Russian government was involved in these activities, which show the possible vectors for a foreign power to influence an election.

The Montenegro elections case shows, as an example, of what happens when Russian interests in an election outcome, and dissatisfaction with a pro-Western agenda, intersect. Furthermore, the Montenegro case shows how this intersection can result in cyber-attacks designed to achieve Russian national interests and how direct attacks can be combined with social media (or fake media) misinformation campaigns designed to affect public opinion.


Friday, November 18, 2016

Facebook and WhatsApp - Part II

In the United Kingdom, Facebook is once again being prevented from sharing data with their subsidiary WhatsApp.  This is signaling future internationally focused privacy law actions against cyber companies; chiefly due to the October 2016 U.S. Federal Communications Commission  (FCC) surrender of Internet control.  These legal decisions could significantly affect future data sharing.    This information is being provided for your situational awareness.
  • 27 September 2016: Facebook was blocked by a German court from collecting user data from WhatsApp.  Facebook, the parent company of WhatsApp, is appealing the order.
  • 1 October 2016: The U.S. FCC relinquished control over the Internet Corporation for Assigned Names and Numbers (ICANN), enabling international regulation of ICANN under the Net Neutrality doctrine.
  • Legal action against Facebook by the UK and Spanish governments is underway, which could set a precedence for future privacy rights actions against cyber companies internationally.

Thursday, November 17, 2016

Morocco: Business in Sub-Saharan Africa

Morocco has recently initiated the Octopus Development Plan: an economic strategy designed to better assist Senegal.  Experts believe the underlying purpose for this plan is to further link banking and communication industries under Morocco and the United Arab Emirates (UAE) conglomerates.  The ability to control, disrupt or influence banking and communications on these networks by extremists or radicals is a major concern.  This information is being supplied for your situational awareness.
  • Morocco is a major investor and developer in the banking and telecommunications industries in Africa.
  • The Octopus Development Plan will further expand their interests in banking and communication is Western Africa.
  • The United Arab Emirates and Morocco own controlling interests in the banking and communications industries in Northern, Western, and Sub Saharan Africa.

Publication Date:                    14 November 2016
Handling Requirements:        Traffic light protocol (TLP) GREEN
Attribution/Threat Actors:     Unknown
Actor Type:                              Adversary capabilities have been assessed as Tier II*
Potential Targets:                    Morocco, West Africa and Sub Saharan Africa
Past Reporting:                        DOC-4360, DOC-4423

* Practitioners with a greater depth of experience, with the ability to develop their own tools (from publicly known vulnerabilities).


The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.