OODA Analysis and Briefs

Home > OODA Analysis and Briefs

Analysis

Paul Pilar Speaks

(Yes, I stole the title from Steve Hayes) ;- ) Under normal circumstances blue-collar IOs like myself would never go up against an NIO, but seeing as how we can both append “former” to our old titles – and we’re thousands of miles apart – I don’t mind taking a crack at Paul Pillar’s Foreign…
Plug the Leaks

DCIA Goss in the NY Times on leaks and leakers: At the Central Intelligence Agency, we are more than holding our own in the global war on terrorism, but we are at risk of losing a key battle: the battle to protect our classified information. […] As a member of Congress in 1998, I sponsored…
Those Were The Days

A number of commentators lament what I’ll call – for lack of a better term – the state of the populace during war time. The lack of sacrifice, the lack of concern (sometimes the presence of scorn) over the endeavor we are engaged in. I thought it might be enlightening, perhaps refreshing, certainly entertaining, to…
Toujours en Avant

InsideDefense (subscription required) has a great new article about the Combatant Commanders trying to address the problem of the sharing and delivery of intelligence data. Assuming all goes well, a more thorough treatment of the issues raised in the item below will be forthcoming soon (I’m likely to be the dimmest bulb in the marquee,…
Ironic or just funny?

Former President Jimmy Carter says: “Under the Bush administration, there’s been a disgraceful and illegal decision _ we’re not going to the let the judges or the Congress or anyone else know that we’re spying on the American people,” Carter told reporters. “And no one knows how many innocent Americans have had their privacy violated…
ADVISE for DHS

A good Christian Science Monitor article that brings up a new program, reminds us of old ones, and points out some serious issues. The comments of the EFF and EPIC folks are arguably the most important. On the one hand the data in use is personal, but at the same time it is for the…
My Kind of Squirrels

Just came across these guys. Looks very promising and blogroll-worthy. Clearly much more serious than I, but then this is what passes for fun in my world. And in case I failed to mention it earlier, check out the musings on defense and security by my friend Mark at The Subtle Stirrup. He’s a real…
The Numbers Are In

In as much as a blog is something of an exercise in self-indulgence, it is nevertheless nice to get a sense of who you are reaching. For those who are keen on knowing who your fellow readers are: Over 85% of you are registered as coming from a .com, which is good because it means…
On Target

On Target I knew there was a reason I shopped at Target so much more than I do a certain other large retail chain. In the past few years, [Target] has taken a lead role in teaching government agencies how to fight crime by applying state-of-the-art technology used in its 1,400 stores. Target’s effort has…
Sense out of Non-Sense

I’m amazed at the stunning lack of understanding about the now widely reported NSA terrorism surveillance program. I expect as much for the yak-o-sphere, but listening to the AG go round and round with the Senate Judiciary Committee made me dizzy. Surely this august panel isn’t this dim? Oh wait, I forgot we were talking…
Why (Media) Exploitation Matters

Eli Lake throws a log on the fire: The House Permanent Select Committee on Intelligence is studying 12 hours of audio recordings between Saddam Hussein and his top advisers that may provide clues to the whereabouts of Iraq’s weapons of mass destruction. The committee has already confirmed through the intelligence community that the recordings of…
Burn the Witch

The director of the CIA has launched a major internal probe into media leaks about covert operations. In an agencywide e-mail, Porter Goss blamed “a very small number of people” for leaks about secret CIA operations that, in his words, “do damage to the credibility of the agency.” According to people familiar with the Goss…
The Point of the Conic Section

Math geeks strike back!
Here we go again . . .

. . . Same old stuff again . . . UPI reports that even during the “long war” recruiting intelligence officers isn’t a cake walk: U.S.News & World Report said Saturday the CIA would not be able to meet a demand by members of Congress and President George W. Bush to expand its human intelligence…
What? You Worry?

Written to cast more shadows on the NSA terrorist surveillance program, but the bottom line issue is captured in the beginning of this piece in the Washington Post: Fewer than 10 U.S. citizens or residents a year, according to an authoritative account, have aroused enough suspicion during warrantless eavesdropping to justify interception of their domestic…

Briefs

Linux Cryptocurrency Mining Attacks Enhanced via CHAOS RAT

We’ve previously written about cryptojacking scenarios involving Linux machines and specific cloud computing instances being targeted by threat actors active in this space such as TeamTNT. We found that the routines and chain of events were fairly similar even if it involved different threat actors: the initial phase saw attackers trying to kill off competing…
Police in China arrest gang who laundered $1.7 billion via crypto even after Beijing’s crackdown

Police in China arrested 63 people accused of laundering as much as 12 billion Chinese yuan ($1.7 billion) via cryptocurrency, amid Beijing’s intense crackdown on the trading of digital coins. Starting from May 2021, the criminal gang allegedly used the proceeds from illicit sources including pyramid schemes, fraud and gambling and converted it into the…
Bank of England opens applications for ‘proof of concept’ CBDC wallet

The Bank of England (BOE) is seeking a “proof of concept” for a wallet that will be able to hold a central bank digital currency (CBDC). On Dec. 9, the BOE posted a request for applications on the United Kingdom government’s Digital Marketplace, a service where government organizations can solicit work for digital projects. Simple guidelines for…
Hacker Steals $6.9 Million From Arbitrum-Based Defi Protocol Lodestar Finance

Arbitrum-based lending platform Lodestar Finance was exploited on Dec. 10, 2022, according to a tweet from the project’s Twitter account on Saturday. Community reports detail that Lodestar lost roughly $6.9 million from the vulnerability. Another decentralized finance (defi) platform, Lodestar Finance was hacked for $6.9 million in an exploit, a number of reports detail. “[The] protocol…
Crypto Sanctions & Their Impact on the Cryptocurrency Ecosystem – Crypto 2023

Before 2022, sanctions in crypto sounded somewhat extravagant. While governments around the world have been after this industry for quite a while, it still seemed that cryptocurrencies, by their initial promise of privacy, freedom and censorship resistance, wouldn’t become as politicized as the fiat system. Then 2022 showed how naive those expectations were. “It became…
Odesa port reopens after energy network hit

The Ukrainian Black Sea port of Odesa has resumed operations after Russia used Iranian-made drones to attack energy facilities in the city. The port was closed after strikes on Saturday left 1.5 million people and all non-critical infrastructure without power. The Ukrainian president warned that it could take days to restore electricity. Odessa is one…
Peru’s new leader proposes early election amid protests

Amid ongoing political tension, Peru’s new president Dina Boluarte is proposing holidng election sin April 2024 rather than 2 years later as scheduled. A state of emergency has also been declared in the areas of heavy protests. During the protests, two teenagers were killed in clashes between the protestors and the police. Ms Boluarte was…
Fusion energy breakthrough by US scientists boosts clean power hopes

US government scientists have achieved a net energy gain in a fusion reaction for the first time, according to three people with knowledge of the experiment. The development could prove the process could provide a reliable, abundant alternative to fossil fuels and conventional nuclear energy. It is the first time a fusion reaction has produced…
China’s Looming ‘Tsunami’ of Covid Cases Will Test its Hospitals

China has announced that it is abandoning its “zero Covid” policy of lockdowns and quarantines. This decision has raised concerns about the potential strain that a surge of cases could put on the country’s overstretched healthcare system, particularly in the lead up to the Lunar New Year holiday. A top health official has predicted that…
Breakthroughs of the Year

The Atlantic has published its inaugural 10 Breakthroughs of the Year. The achievements span every stage of life and every aspect of life, from our cells to the stars. They include a drug that revives the organs of dead animals; an embryo created without sperm or egg; a telescope to see the universe’s first moments;…
How China is paying for its ascension to techno-dominance

The Atlantic Council has released research into China’s use of money to buy dominance. Insights from the report: China’s yuan suffered its sharpest weekly drop in nearly three years, with the dollar surging to a nine-year high against it. This picture illustration taken May 31, 2017, shows a Chinese 100 yuan banknote featuring Mao Zedong.…
Nuclear energy in a low-carbon future: Implications for the United States and Japan

A new Atlantic Council report on nuclear energy provides insights of interest to the business world. From the report: Nuclear power has received renewed global interest as a secure source of carbon-free energy. In the context of worsening climate change and Russia’s invasion of Ukraine and resultant energy market constrictions, many countries are actively pursuing…
Chinese state-owned conglomerates trade in sensitive technologies with Russia’s defense sector, including to companies involved in Russia’s ongoing war in Ukraine.

At a time when the People’s Republic of China (PRC) has become the subject of heightened vigilance and new trade sanctions, evidence suggests that patterns of data censorship and convoluted corporate networks serve to obscure trade in defense-applicable technology. Whether or not the PRC’s trade data environment is opaque by design, it ultimately conceals the…
Has nuclear fusion experienced a breakthrough, and if so, what will the consequences be?

Reporting in multiple media sites indicate an experimental nuclear fusion reactor has reportedly generated more energy than it consumed for the first time ever. If verified, this would indicate that fusion is a viable method for meeting the world’s growing energy demands, essentially replicating the process that occurs at the heart of our sun. The…
Crypto Hitting ‘Mother Of All Economic Crises’ Threatens North Korea

As the globe confronts the “mother of all economic crises,” cryptocurrency boosters are having a stark realization of their own: this means you, too. It’s quite the irony that a financial universe created to replace the real one is getting dragged down by old-economy dynamics it planned to ignore. Bitcoin and other such curiosities have been falling…
NFTs and Cybersecurity

Like other digital solutions, an NFT (non-fungible token) is exposed to the danger of cyberthreats. As an NFT uses blockchain technology, the cybersecurity problems that might affect an NFT are similar to those that affect a broad range of blockchain technology solutions. Equally, the token is only as (cyber)secure as the technology is secure from…
Taking a closer look at blockchain security

Blockchain appeals to users for its high level of security, particularly in the financial industry. But that security depends on the honesty of more than half of its network, which can be changed by multiple factors. Ning Zhang, assistant professor of computer science & engineering in the McKelvey School of Engineering at Washington University in St.…
How to Recover Assets Lost to Cryptocurrency Theft and Fraud

Investor funds losses continue to mount with the meltdown of numerous cryptocurrency and misuse of investor funds by centralized cryptocurrency exchanges. Investor crypto fraud losses approached an estimated $680 million last year, and have grown exponentially this year. Many investors are falling victim to classic frauds updated for the Web3 age, such as crypto investment…
SEC issues new guidance requiring companies to disclose cryptocurrency risks

The Securities and Exchange Commission released new guidance Thursday, requiring companies that issue securities to disclose to investors their exposure and risk to the cryptocurrency market. The guidance comes about a month after FTX, one of the world’s largest cryptocurrency exchanges, filed for bankruptcy after loan customer funds to a risky trading company that was…
France ramps up Channel migrant patrolling

France has announced that it will increase the number of rescue boats in the English Channel due to the increasing numbers of migrants trying to reach the UK. Two additional vessels are being deployed. In November of 2021, 27 people drowned trying to cross the Channel in a dinghy, an event that caused criticism of…
UK, Italy and Japan team up for new fighter jet

Rishi Sunak announced a collaboration between Italy, Japan and the UK to develop a fighter jet that uses artificial intelligence. The prime minister of the UK said the venture aims to create thousands of jobs in the UK and strengthen security ties between the three countries. The jet is expected to enter service in the…
China’s Xi gets a grand welcome to Saudi Arabia and promises a ‘new era’ in Chinese-Arab relations

Chinese President Xi Jinping was welcomed by Saudi Arabia’s Crown Prince Mohammed bin Salman with a lavish reception in the capital Riyadh on Thursday. The two countries are heading for a number of summits to discuss China’s relations with Arab countries. The reception was at Al-Yamamah Palace. Shortly after arriving, China and Saudi Arabia signed…
NFTs minted on FTX break, highlighting Web2 hosting flaws

The FTX collapse highlighted many flaws in the crypto industry. Now, the effects of the FTX debacle have broken into the nonfungible token (NFT) space with users unable to view their FTX-hosted NFTs. In a tweet, Solana engineer jac0xb.sol pointed out how the metadata of FTX-hosted NFTs now points to a restructuring website that gives out…
Nomad Bridge to Relaunch and Provide “Partial” Refunds via NFTs

Nomad Bridge is set to relaunch and partially compensate the users affected by the $190 million exploit earlier in 2022, according to an announcement on Medium. Users can go through the KYC verification process to receive their compensation through a special NFT, the protocol explained. Cross-chain messaging protocol Nomad is preparing to restart its bridge and…
EU to ‘Level Playing Field’ for Crypto Firms With Uniform Tax Rules

Companies of any size processing crypto transactions for customers in the European Union will soon need to report these for tax purposes under proposed legislation. The policy, put forward as an addition to a wider package of anti-tax evasion measures, says that even non-European crypto-asset operators will need to report transactions if they have clients who…
Hackers use new, fake crypto app to breach networks, steal cryptocurrency

The North Korean ‘Lazarus’ hacking group is linked to a new attack spreading fake cryptocurrency apps under the made-up brand, “BloxHolder,” to install the AppleJeus malware for initial access to networks and steal crypto assets. According to a joint FBI and CISA report from February 2021, AppleJeus has been in circulation since at least 2018,…
Ethereum change cut cryptocurrency power demand

A change in the way the cryptocurrency Ethereum works may have cut its power consumption by country-sized amounts. The amount of electricity saved is similar to that used by Ireland or even Austria, work published in the data-science journal Patterns suggests. Bitcoin, the largest crypto, is thought to use more electricity than Finland. It has even been…
Swiss Government Wants to Implement Mandatory Duty to Report Cyber-Attacks

The Swiss government has recently made efforts to deem it mandatory for critical infrastructure providers to report cyberattacks to the National Cyber Security Centre. The efforts have resulted in proposed amendments to the Information Security Act. The Swiss Parliament has been tasked with amending the act, which aims to provide more transparency into cyberattacks and…
Russia’s VTB Bank Suffers its Biggest Ever DDoS

Russia’s second largest bank, VTB, has confirmed that it suffered from the largest DDoS attack in its history. The recent attack could have been perpetrated by pro-Ukrainian hacktivists. The bank stated that customer data had not been impacted in the attack and that its systems were operating normally. However, reports suggest that the app and…
Iran carries out first execution over protests

The first execution of a protester convicted over the recent anti=government unrest in Iran has been announced. The protester was hanged on Thursday morning after being found guilty of enmity against God by a Revolutionary Court. He was accused of being a rioter and blocking a main road in Tehran in September, along with wounding…
Russia frees US basketball star in swap with arms dealer Bout

The US and Russia have exchanged US basketball star Brittney Griner for arms dealer Viktor Bout in a prison swap. The arms dealer had been held in an American prison for 12 years. Brittney Griner is on a plane back to the United States. Griner was arrested at a Moscow airport in February for possessing…
Supply Chain Web Skimming Attacks Hit Dozens of Sites

Jscambler has discovered a web skimming campaign that has been active for at least a year. The operation has compromised roughly 40 e-commerce sites, the security vendor states. The campaign is conducted by a group dubbed “Group X” that allegedly exfiltrated the stolen card data to a server in Russia. The hackers used a supply-chain…
Elizabeth Warren led cryptocurrency bill in works, may give SEC most regulatory authority

Senator Elizabeth Warren is working on a sweeping cryptocurrency bill that would give most cryptocurrency regulatory authority to the Securities and Exchange Commission, according to sources close to her. “As Senator Warren has already said publicly, she’s working on crypto legislation and believes that financial regulators, including the SEC, have broad existing authority to crack…
Only a Paltry 1% Or Less of DeFi’s Fund Is Under Insurance Despite the Billions Lost Through Hacks in the Sector

The decentralized finance (DeFi) space has been snowballing in recent months. New protocols and projects are coming up regularly. However, the insurance sector has slowly adapted to this unique ecosystem. Only a few insurers offer coverage for hacking risks associated with DeFi protocols. According to BanklessTimes.com, although billions have been lost through hacks in the…
Into the storm: The murky world of cryptocurrency mixers

Cryptocurrency mixing services are a divisive subject in the industry. Some advocate for the privacy-enabling features of these protocols while others maintain that they are mainly used for illicit means. For platforms like Tornado Cash, the mainstream verdict is “guilty as charged.” The infamous decentralized mixing protocol was sanctioned by the United States Office of Foreign…
DEV-0139 launches targeted attacks against the cryptocurrency industry

Over the past several years, the cryptocurrency market has considerably expanded, gaining the interest of investors and threat actors. Cryptocurrency itself has been used by cybercriminals for their operations, notably for ransom payment in ransomware attacks, but we have also observed threat actors directly targeting organizations within the cryptocurrency industry for financial gain. Attacks targeting…
Cryptocurrency has become a playground for fraudsters

News involving crypto and fraud is ubiquitous in the white-collar crime sphere and, perhaps more worryingly, these fraudulent activities in the crypto sector are not limited to a single type of crime. Diverse and distinct yet with one common thread, these crimes involve real money and crypto investors are the victims. Many people have placed their…
‘Team Mysterious Bangladesh’ Hackers Target Indian Education Entity

CloudSEK has released a new advisory addressing a threat actor group called Team Mysterious Bangladesh that has claimed to have compromised the Indian Central Board of Higher Education. The hackers allegedly stolen personally identifiable information such as names, Aadhaar numbers, Indian financial System code, and more information. The group claimed to have gained access to…
Taliban conduct first public execution since return to power

The Taliban has carried out what is believed to be their first public execution since the group’s return to power in Afghanistan last year. A man was killed at a crowded sports stadium in Farah province after he confessed to murder. Dozens of the group’s leaders attended the hanging. The execution came weeks after judges…
Jamaica declares widespread state of emergency to fight violent crime

Jamaica has declared a widespread state of emergency to fight violent crime in a public address by the country’s Prime MInister Andrew Holness. The State of Emergency will be enforced in nine of Jamaica’s 14 parishes after it was declared on Wednesday. The state of emergency allows authorities to make arrests and search buildings without…
US consumer watchdog probes crypto firms over deceptive ads

Several crypto firms are facing a probe from the United States Federal Trade Commission (FTC) over possible deceptive or misleading advertisements relating to cryptocurrencies. According to a Dec. 6 report from Bloomberg, FTC spokeswoman Juliana Gruenwald said the watchdog is investigating “several firms for possible misconduct concerning digital assets.” Gruenwald did not provide further details about which…
UK finalises plans for regulation of ‘wild west’ crypto sector

The Treasury is finalising plans for a package of sweeping rules to regulate the cryptocurrency industry, including limits on foreign companies selling into the UK, provisions for how to deal with the collapse of companies and restrictions on the advertising of products. Ministers will shortly launch a consultation on the new regulatory regime, after the…
Crypto hacking behind N. Korea’s renewed nuclear ambition

Borders were closed and trade was cut off while international sanctions continued throughout the COVID-19 pandemic, further isolating North Korea, one of the world’s most impoverished nations. But its regime has discovered new ways of raking in funds to continuously pursue its missile ambitions and divert sanctions and regulations at the same time — via…
Overshadowed by failures, crypto hacking exacts higher price

The cryptocurrency industry is circling the wagons in defense as hackers siphon more money from the sector each year. Hackers made off with more than $3 billion in digital assets so far this year, according to research firm Chainalysis. In October alone, $718 million was taken in 11 different hacks, making it the worst month in…
FTX crash shows cryptocurrency market needs bank-like regulation

The recent turmoil in the trillion-dollar crypto sector, including FTX’s sudden liquidity crisis and spectacular collapse, has updated the concept of a bank run — made famous in movies like “It’s a Wonderful Life” and “Mary Poppins.” But this time, the run hasn’t been on a bank at all. Instead, many crypto-asset customers had accounts at…
Russian Hackers Use Western Networks to Attack Ukraine

Russian hackers have been identified using presence inside the networks of organizations located in the UK and the US to launch attacks against Ukraine. The campaign was revealed in a recent report by Lupovis, a Scottish security firm. The firm set up a series of decoys on the web to attract Russian threat actors so…
Prolific Chinese Hackers Stole US COVID funds

According to the Secret Service, a prolific Chinese state-sponsored APT group known as APT41 has stolen at least $20 million from US Covid-19 relief funds. The campaign appears to the be the first of its kind and the group targeted Small Business Administration loans and unemployment insurance funds. The Secret Service stated that APT41 is…
FBI Director Raises National Security Concerns About TikTok

Chris Wray, the FBI Director, has raised national security concerns about the popular social media platform TikTok, warning that control of the video sharing app is in the hands of the Chinese government. The FBI Director stated that he was concerned that the Chinese government can control the app’s recommendation algorithm as well as all…
EU, Western Balkans leaders meet amid fears of Russian influence

The European Union and Western Balkans leaders met in the Albanian capital Tirana for a summit to reassure the region of a future amid fears of increasing Russian and Chinese influence. The leaders of Albania, Bosnia, Kosovo, Montenegro, North Macedonia and Serbia have expressed concern that negotiations have not started or have stalled involving their…
Russian missile strikes force emergency power shutdowns

Ukraine is using emergency shutdowns to stabilize its power grid after Russian missile attacks that occurred on Monday. Many regions in Ukraine were affected and approximately half of Kyiv is expected to remain without electricity for the next few days. Four people were killed in the attacks on Monday. More missiles hit critical infrastructure near…
Rackspace Shuts Down Hosted Exchange Systems Due to Security Incident

Rackspace, a cloud security company, is investigating a recent cybersecurity incident that had implications for its Hosted Exchange environment. The company was allegedly forced to shut down the service temporarily while it investigated the issue and determined the source and scope of the attack. The Hosted Exchange service is designed to make it easier to…
7 ways to advance blockchain in the enterprise

As the technological foundation for cryptocurrency, blockchain has been front and center during the volatile ups and downs of the digital currency age. Yet blockchain has yet to play a prominent role in most enterprises, with only a few established pilot applications and tepid enthusiasm from business. Blockchain adoption hinges on finding the right use cases,…
This Is How the SEC and CFTC Should Regulate the Crypto Markets

Recent turbulence in the cryptocurrency industry has enlivened an ongoing debate about which agency should be the lead federal regulator of crypto going forward: the Commodity Futures Trading Commission or the Securities and Exchange Commission. The answer: Both agencies should continue to exercise their regulatory authority over crypto assets and activities provided by existing law,…
Genesis Owes Gemini Earn Users $900M: Report

Embattled crypto broker Genesis and its parent company Digital Currency Group (DCG) owe users of Gemini Earn $900 million, the Financial Times reported on Saturday, citing anonymous sources. Gemini had used Genesis as its primary lending partner for its high-yield Earn service, which allowed customers to deposit their cryptocurrency in exchange for interest, similar to…
North Korean Lazarus Group Linked to New Cryptocurrency Hacking Scheme

The Lazarus group, a North Korean hacking organization previously linked to criminal activity, has been connected to a new attack scheme to breach systems and steal cryptocurrency from third parties. The campaign, which uses a modified version of an already existing malware product called Applejeus, uses a crypto site and even documents to gain access…
How to keep your cryptocurrency safe after the FTX collapse

The fall of the FTX crypto exchange forced many to reconsider their overall approach to investments — starting from self-custody to verifying the on-chain existence of funds. This shift in approach was driven primarily by the lack of trust crypto investors have in the entrepreneurs after being duped by FTX CEO and co-founder Sam Bankman-Fried…
French Hospital Halts Operations After Cyber-Attack

Over the past weekend, a hospital located in Versailles was forced to cancel its operations due to a cyberattack that rendered the organization’s systems disabled. The hospital was forced to go offline following the cyberattack that occurred at 9pm on Saturday evening. According to Franceinfo, the André-Mignot hospital’s computers were impacted by the cyberattack, with…
Hackers Use Archive Files and HTML Smuggling to Bypass Detection Tools

HP Wolf Security has released its latest Threat Insights Report, which details events occurring in Q3 of 2022. The report states that the security company found that attackers have been increasingly encrypting malware in archives before releasing it in the wild to be used in cyberattacks. According to the report, 44% of malware was delivered…
Digital Giant ABB to Pay $315m in Bribery Case

ABB, a Swiss industrial automation giant, will pay hundreds of millions of dollars to close out a bribery case that allegedly violates the US Foreign Corrupt Practices Act. ABB also produces cybersecurity services and solutions and is accused of paying bribes to a Sought African government official who was also a high-ranking employee at energy…
Google shares details of newly found commercial spyware threats

On Wednesday, tech giant Google released details regarding a recently identified exploitation frameworks that it capable of deploying spyware. Google has dubbed the exploits “Heliconia.” The exploits appear to have ties to Variston IT, a Spanish company. Google’s Threat Analysis Group detailed the exploits, which target n-day vulnerabilities in Chrome, Firefox, and Microsoft Defender. All…