Економіка

U.S. and British officials on Thursday accused the Russian government of running a yearslong campaign to hack into critical infrastructure, including an American nuclear plant and a Saudi oil refinery.

The announcement was paired with the unsealing of criminal charges against four Russian government officials, whom the U.S. Department of Justice accused of carrying out two major hacking operations aimed at the global energy sector. Thousands of computers in 135 countries were affected between 2012 and 2018, U.S. prosecutors said.

Cybersecurity analysts described the moves as a shot across the bow to Moscow after U.S. President Joe Biden had warned just days ago about “evolving intelligence” that the Russian government might be preparing cyberattacks against American targets.

John Hultquist, whose firm Mandiant investigated the Saudi refinery hack, said that by making the criminal charges public, the United States “let them know that we know who they are.”

In one of the two indictments unsealed on Thursday and dated June 2021, the Justice Department accused Evgeny Viktorovich Gladkikh, a 36-year-old Russian Ministry of Defense research institute employee, of conspiring with others between May and September 2017 to hack the systems of a foreign refinery and install malware known as “Triton” on a safety system produced by Schneider Electric SE.

The refinery wasn’t named, but the British government said it was in Saudi Arabia and had previously been identified as the Petro Rabigh refinery complex on the Red Sea coast.

In a second indictment, dated August 2021, the Justice Department said three other suspected hackers from Russia’s Federal Security Service (FSB) carried out cyberattacks on the computer networks of oil and gas firms, nuclear power plants, and utility and power transmission companies between 2012 and 2017 — a campaign researchers have long attributed to a group sometimes dubbed “Energetic Bear” or “Berserk Bear.”

The Russian Embassy in Washington did not immediately return a message seeking comment.

The three accused Russians in the second case are Pavel Aleksandrovich Akulov, 36, Mikhail Mikhailovich Gavrilov, 42, and Marat Valeryevich Tyukov, 39. None of the four defendants have been arrested, a U.S. official said.

Britain’s Foreign Office said that the FSB hackers targeted the systems controlling the Wolf Creek nuclear plant in Kansas “but failed to have any negative impact.”

“Russia’s targeting of critical national infrastructure is calculated and dangerous,” British Foreign Secretary Liz Truss said in a statement. She said it showed Russian President Vladimir Putin “is prepared to risk lives to sow division and confusion among allies.”

A Justice Department official told reporters that even though the hacking at issue in the two cases occurred years ago, investigators remained concerned Russia will carry out similar attacks in future.

“These charges show the dark art of the possible when it comes to critical infrastructure,” the official said.

The official added that the department decided to unseal the indictments because they determined the “benefit of revealing the results of the investigation now outweighs the likelihood of arrests in the future.”

The 2017 Saudi refinery attack stunned the cybersecurity community when it was made public by researchers later that year. Unlike typical digital intrusions aimed at stealing data or holding it for ransom, the attack appeared aimed at causing physical damage to the facility itself by disabling its safety system. U.S. officials have been tracking the case ever since.

In 2019, those behind Triton were reported to be scanning and probing at least 20 electric utilities in the United States for vulnerabilities.

Two weeks before the 2020 U.S. presidential election, the U.S. Treasury Department imposed sanctions on the Russian government-backed Central Scientific Research Institute of Chemistry and Mechanics. Prosecutors believe Gladkikh worked there. On Thursday, British officials also announced sanctions on the institute.

The Foreign Office said FSB hackers had targeted British energy companies and had successfully stolen data from the U.S. aviation sector. It also accused the hackers of trying to compromise an employee of Mikhail Khodorkovsky, a former oil tycoon who fell afoul of the Kremlin and now lives in London. 
…

Negotiators from the European Parliament and EU member states agreed Thursday on a landmark law to curb the market dominance of U.S. big tech giants such as Google, Meta, Amazon and Apple.

Meeting in Brussels, the lawmakers nailed down a long list of do’s and don’ts that will single out the world’s most iconic web giants as internet “gatekeepers” subject to special rules.

The Digital Markets Act (DMA) has sped through the bloc’s legislative procedures and is designed to protect consumers and give rivals a better chance to survive against the world’s powerful tech juggernauts.

“The agreement ushers in a new era of tech regulation worldwide,” said German MEP Andreas Schwab, who led the negotiations for the European Parliament.

“The Digital Markets Act puts an end to the ever-increasing dominance of Big Tech companies,” he added.

The main point of the law is to avert the years of procedures and court battles needed to punish Big Tech’s monopolistic behavior in which cases can end with huge fines but little change in how the giants do business.

Once implemented, the law will give Brussels unprecedented authority to keep an eye on decisions by the giants, especially when they pull out the checkbook to buy up promising startups.

“The gatekeepers – they now have to take responsibility,” said the EU’s competition supremo Margrethe Vestager.

“A number of things they can do, a number of things they can’t do, and that of course gives everyone a fair chance,” she added.

‘Concrete impacts’

The law contains about 20 rules that in many cases target practices by Big Tech that have gone against the bloc’s rules on competition, but which Brussels has struggled to enforce.

The DMA imposes myriad obligations on Big Tech, including forcing Apple to open up its App Store to alternative payment systems, a demand that the iPhone maker has opposed fiercely, most notably in its feud with Epic games, the maker of Fortnite.

Google will be asked to clearly offer users of Android-run smartphones alternatives to its search engine, the Google Maps app or its Chrome browser.

Apple would also be forced to loosen its grip on the iPhone, with users allowed to uninstall its Safari web browser and other company-imposed apps that users cannot currently delete.

In a statement, Apple swiftly expressed regret over the law, saying it was “concerned that some provisions of the DMA will create unnecessary privacy and security vulnerabilities for our users.”

After a furious campaign by influential MEPs, the law also forces messaging services such as Meta-owned WhatsApp to make themselves available to users on other services such as Signal or Apple’s iMessage, and vice versa.

France, which holds the EU presidency and negotiated on behalf of the bloc’s 27 member states, said the law would deliver “concrete impacts on the lives of European citizens.”

“We are talking about the goods you buy online, the smartphone you use every day, and the services you use every day,” said France’s digital affairs minister, Cedric O.

Stiff fines

Violation of the rules could lead to fines as high as 10% of a company’s annual global sales and even 20% for repeat offenders.

The DMA “will have a profound impact on the way some gatekeepers’ operations are currently conducted,” said lawyer Katrin Schallenberg, a partner at Clifford Chance.

“Clearly, companies affected … are already working on ways to comply with or even challenge the regulation,” she added.

The Big Tech companies have lobbied hard against the new rules and the firms have been defended in Washington, where it is alleged that the new law unfairly targets U.S. companies.

With the deal now reached by negotiators, the DMA now faces final votes in a full session of the European Parliament as well as by ministers from the EU’s 27 member states.

The rules could come into place starting Jan. 1, 2023, though tech companies are asking for more time to implement the law. 
…

Seattle-based teenager Avi Schiffmann is doing what he can to help Ukrainian refugees. He has launched a website that helps refugees find safe places to stay, matching refugees with people willing to share their homes. Anush Avetisyan has the story, narrated by Anna Rice.
…

Okta whose authentication services are used by companies including Fedex and Moody’s to provide access to their networks, said on Tuesday that it had been hit by hackers and that some customers may have been affected.

The scope of the breach is still unclear, but it could have major consequences because thousands of companies rely on San Francisco-based Okta to manage access to their networks and applications.

Chief Security Officer David Bradbury said in a blog post that the computer of a customer support engineer working for a third-party contractor was accessed by the hackers for a five-day period in mid-January and that “the potential impact to Okta customers is limited to the access that support engineers have.”

“There are no corrective actions that need to be taken by our customers,” he said.

Nevertheless, Bradbury acknowledged that support engineers were able to help reset passwords and that some customers “may have been impacted.” He said the company was in the process of identifying and contacting them.

The nature of that impact wasn’t clear, and Okta did not immediately respond to an email asking how many organizations were potentially affected or how that squared with Okta’s advice that customers did not need to take corrective action.

On its website, Okta describes itself as the “identity provider for the internet” and says it has more than 15,000 customers on its platform.

It competes with the likes of Microsoft, PingID, Duo, SecureAuth and IBM to provide identity services such as single sign-on and multifactor authentication used to help users securely access online applications and websites.

Okta’s statement follows the posting of a series of screenshots of Okta’s internal communications by a group of ransom-seeking hackers known as Lapsus$ on their Telegram channel late on Monday.

In an accompanying message, the group said its focus was “ONLY on Okta customers.”

Lapsus$ responded to Okta’s statement on Tuesday by saying the company was trying to minimize the importance of the breach.

Some outside observers weren’t impressed with Okta’s explanation either.

Dan Tentler, the founder of cybersecurity consultancy Phobos Group, earlier told Reuters that Okta customers should “be very vigilant right now.”

There were signs that Okta customers were taking action to revisit their security.

Web infrastructure company Cloudflare issued a detailed explanation  of how it reacted to the Okta breach and saying the company did not believe it had been compromised as a result.

FedEx said in a statement that it too was investigating and “we currently have no indication that our environment has been accessed or compromised.” Moody’s did not return a message seeking comment.

Lapsus$ is a relatively new entrant to the crowded ransomware field but has made waves with high-profile hacks and attention-seeking behavior.

The group compromised the websites of Portuguese media conglomerate Impresa earlier this year, tweeting the phrase “Lapsus$ is now the new president of Portugal” from one newspaper’s Twitter accounts. The Impresa-owned media outlets described the hack as an assault on press freedom.

Last month, the group leaked proprietary information about U.S. chipmaker Nvidia to the Web.

More recently the group has purported to have leaked source code from several big tech firms, including Microsoft. In a blog post published Tuesday and devoted to Lapsus$, the software firm confirmed that one of its accounts had been compromised, “gaining limited access.”

The hackers did not respond to a message left on their Telegram group chat seeking comment.

 
…