It was a steamy Friday two Augusts ago when Jason Whisler settled in for a working breakfast at the Coffee Ranch restaurant in the Texas Panhandle city of Borger. The most pressing agenda item for city officials like him that morning: planning for a country concert and anniversary event.
Then Whisler’s phone rang. Borger’s computer system had been hacked.
Workers were frozen out of files. Printers spewed out demands for money. Over the next several days, residents couldn’t pay water bills, the government couldn’t print checks, police officers couldn’t retrieve certain records. Across Texas, similar scenes played out in nearly two dozen communities hit by a cyberattack officials linked to a Russia-based criminal syndicate.
In 2019, ransomware had yet to emerge as one of the top challenges confronting the United States. But the attacks in Texas were a harbinger of the now-exploding threat and offer a case study in what happens behind the scenes when victims come under attack.
Texas communities struggled for days with disruptions to government services as workers in small cities and towns endured cascading frustrations brought on by the cyberattack, according to thousands of pages of documents reviewed by The Associated Press and interviews with people involved in the response. The AP also learned new details about the attack’s scope and victims, including an Air Force base where access to a law enforcement database was affected and a city forced to operate its water-supply system manually.
Recent ransomware attacks have led to gasoline shortages and threatened meat supplies. But the Texas attacks — which, unlike recent prominent cases, were resolved without a ransom payment — make clear ransomware need not hit vital infrastructure nor major corporations to interrupt daily life.
“It was just a scary feeling,” said Whisler, Borger’s emergency management coordinator.
Early on Aug. 16, as most Texans were still asleep, hackers half a world away were burrowing into networks.
As the attack’s impact became apparent, the city manager of Vernon emailed colleagues that the city could get back online by paying a $2.5 million ransom but that was “obviously” not the plan.
“Holy moly!!!!!” came the reply.
The culprits were affiliated with REvil, the Russia-linked syndicate that last spring extorted $11 million from meat-processor JBS and more recently was behind a Fourth of July weekend attack that crippled businesses around the globe.
The August 2019 hackers gained their foothold through an attack on TSM Consulting Services, a Texas firm that provides technology services to local governments. The attackers branched through screen-sharing software and remote administration to seize control of the networks of some of the company’s clients.
Within hours, state and federal officials were hunkered inside an underground operations center normally used for calamities like hurricanes and floods. Gov. Greg Abbott declared a cyber disaster. Texas National Guard cyber specialists were activated.
“Basically, if there’s a municipal function that you would go down to a city hall for, or that you would rely on the police department for, it wasn’t available,” said Andy Bennett, the state’s then-deputy chief information security officer.
In Borger, a city of fewer than 13,000, ransomware demands spat out of printers and flashed on some computer screens. Government files were encrypted, their titles replaced by gibberish combinations of letters and symbols, said city manager Garrett Spradling.
Vital records, like birth and death certificates, were offline. Signs posted on a drive-up window outside City Hall said the city couldn’t process water bill payments but that cutoffs would be delayed.
Because the city had paid for remote offsite backup, Borger could reformat servers, reinstall the operating system and retrieve data. The police department, however, retained its data locally and officers were unable to access previous incident reports, Spradling said.
Jeremy Sereno was working his civilian job at Dell when he was enlisted by the state to help. A lieutenant colonel and senior cybersecurity officer with the Texas Military Department, Sereno helped deploy Texas National Guard troops to hacked cities, where specialists worked to assess the damage, restore data from backed-up files and retake control of locked systems.
One of the first areas of concern was a small North Texas city. The attack locked the “human-machine interface” workers used to control the water supply, forcing them to operate the system manually, Sereno said. Water purity was not endangered.
“That’s what’s considered critical infrastructure, when you talk about water,” he said.
AP is not identifying the city at the urging of state officials, who said doing so could draw new attacks on its water system.
In Graham, the ransomware attacked a police server housing body-camera videos, causing hundreds to be lost. Instead of using mobile data terminals to run checks on people they encountered, officers had to rely on requests to dispatchers at a local sheriff’s office unaffected by the attack, said Chief Brent Bullock.
The impact wasn’t limited to local governments. Sheppard Air Force Base confirmed to AP that its access to a statewide law enforcement database used for background checks was temporarily disrupted.
One complication: TSM’s client list was encrypted, officials said. State officials didn’t immediately know which communities had been victimized.
They had to call around, said Nancy Rainosek, Texas’ chief information security officer. “There was one place that we contacted and they said, ‘no, no, we’re not hit,'” she said. Days later, “they said, ‘yes, we were.'”
Fortunately for Borger, most city services were restored within days. The city has since invested in additional cybersecurity protections.
“When you complain about having to change your passwords, you complain a lot more when it’s never happened to you and you don’t have anything to relate it to,” Spradling said. “You tend to complain a little less after you’ve had to answer the phone and tell 300 people they couldn’t pay their water bill.”
Even now, Spradling said, officials will go to pull an old report or address record — only to find it isn’t there.
States at disadvantage in race to recruit cybersecurity pros
Austin Moody wanted to apply his cybersecurity skills in his home state of Michigan, teaming up with investigators for the State Police to analyze evidence and track down criminals.
But the recent graduate set the idea aside after learning an unpaid internship was his only way into the Michigan agency.
“I don’t know many people that can afford to take an unpaid internship, especially when it’s in such high demand in the private sector,” Moody said of fellow cybersecurity job seekers. “Unpaid internships in cyber aren’t really a thing beyond the public sector.”
Hiring and keeping staff capable of helping fend off a constant stream of cyberattacks and less severe online threats tops the list of concerns for state technology leaders. There’s a severe shortage of those professionals and not enough financial firepower to compete with federal counterparts, global brands and specialized cybersecurity firms.
“People who are still in school are being told, ‘There’s a really good opportunity in cybersecurity, really good opportunities for high pay,'” said Drew Schmitt, a principal threat intelligence analyst with the cybersecurity firm GuidePoint Security. “And ultimately these state and local governments just can’t keep up from a salary perspective with a lot of private organizations.”
State governments are regular targets for cybercriminals, drawn by the troves of personal data within agencies and computer networks that are essential to patrolling highways, maintaining election systems and other key state services. Notable hits since 2019 include the Washington state auditor, Illinois’ attorney general, Georgia’s Department of Public Safety and computer servers supporting much of Louisiana’s state agencies.
Cities, too, come under attack, and they have even fewer resources than states to stand up cyber defenses.
Aided by industry groups, the federal government and individual states have created training programs, competitions and scholarships in hopes of producing more cybersecurity pros nationwide. Those strategies could take years to pay off, however. States have turned to outside contractors, civilian volunteers and National Guard units for help when their systems are taken down by ransomware and other hacks.
States needed to fill nearly 9,000 cybersecurity jobs as of this summer, according to CyberSeek a joint project of the Computing Technology Industry Association and the National Institute of Standards and Technology. The total is probably higher because the project doesn’t count job listings that states posted only to their own employment portal.
State leaders are reluctant to detail the number of vacancies, worrying that could further entice potential attackers. States’ top security officials have ranked inadequate cybersecurity staffing among their top concerns every year since the National Association of State Chief Information Officers and Deloitte began surveying the group in 2014.
The problem isn’t limited to state governments.
U.S. officials make no secret of their own struggles to hire cybersecurity pros or retain them. The Department of Homeland Security alone has 2,000 cybersecurity job vacancies, and the Biden administration promoted 300 new hires this summer.
The $95,412 average salary of a local or state government cyber employee lagged by $25,000 or more in 2020 compared with the pay in the federal government, the financial services industry and IT services, according to a survey conducted by the International Information System Security Certification Consortium, a trade association.
Information security analysts earned a median salary of $103,590 in May 2020, according to the Bureau of Labor Statistics. Cyberseek puts starting salaries close to $90,000 across all employers.
Homeland Security officials in 2014 recognized that lower pay was keeping their agency at a disadvantage, but it took until this year to publish a rule allowing higher salaries for cybersecurity roles — capped at $255,800, the maximum salary allowed for the vice president.
“The Department desperately needs a more flexible hiring process with incentives to secure talent in today’s highly competitive cyber skills market,” a portion of the rule due to take effect later this fall reads.
Leaders in the field often bemoan the expensive and time-consuming certification requirements and background checks that employers insist on for cybersecurity roles, saying that keeps jobs vacant and discourages women and people of color from working in cybersecurity.
Nicole Beebe, chair of the department of information security and cyber security at the University of Texas at San Antonio, said states’ struggles are more fundamental. Private companies and the federal government aggressively recruit students during college, sending representatives to classes and career fairs.
State agencies are rarely there, said Beebe, who counsels students weighing multiple job offers long before graduation.
“When it’s a hypercompetitive field, you can’t just submit a job posting and think it will get the same traction,” Beebe said.
Lower pay at government jobs can be a turnoff, but many students prefer a position that lets them leave work at home, which is not always the case with private companies.
A state or local government role doesn’t compare to the “meat grinder” of constantly responding to new attacks or vulnerabilities on a cybersecurity team for Microsoft or Amazon, said Michael Hamilton, founder of the PISCES Project. The organization connects cybersecurity students to local governments that don’t have employees focused on that work.
“State agencies can be taking on interns, grooming them, showing them that state government is a promising place to work,” he said. “But what I see them doing is just getting into the fistfight with all the others that want to hire these people and losing.”
Sienna Jackson, a 2020 graduate from the University of Texas at San Antonio, accepted a job as an engineer at the defense company Northrop Grumman after interviewing with the company at a conference. She began college as an accounting major but discovered cybersecurity through a classmate.
After an internship with Dell during college, she hoped to find a similarly sized company with a strong training program and other benefits.
Salary and help with moving or housing also mattered for Jackson, who worked several jobs while earning her degree and has to pay back her student loans. She didn’t rule out state government jobs but didn’t see agencies at career fairs on campus or at conferences.
“Once I graduated and was interviewing, I realized I have a lot of options,” she said. “I get to choose where I go and my standards and not just accept whatever job comes my way.”
Moody, the Michigan native, got a scholarship from the Department of Defense that required working for the agency at least a year after graduating. Moody said he understands that state governments don’t have the kind of money that federal agencies or private companies spend on recruiting and generous salaries.
But sending cybersecurity staff to talk to students about their work and its importance to thousands of state residents can make a big impact without costing much, he said.
“A lot of people want to be in a public service role and are open to starting there,” Moody said.
White House blacklists Russian ransomware payment ‘enabler’
The Biden administration sought Tuesday to choke the finances of criminal ransomware gangs, announcing sanctions against a Russia-based virtual currency brokerage that officials say helped at least eight ransomware gangs launder virtual currency.
The Treasury Department sanctions are aimed at kneecapping the economic infrastructure of a ransomware threat that has surged over the last year, crippling corporations, schools, hospitals and critical infrastructure, including a major fuel pipeline. Ransomware payments reached more than $400 million in 2020, the costliest year on record.
The goal is to go after the “financial enablers” of ransomware gangs, Deputy Treasury Secretary Wally Adeyemo told reporters. “Today’s action is a signal of our intention to expose and disrupt the illicit infrastructure using these attacks.”
The blacklisted brokerage is SUEX OTC, a so-called “nested exchange” that conducted transactions from accounts on major, legal global cryptocurrency exchanges. Such operations process a disproportionate amount of illicit transactions, Adeyemo said. In the case of SUEX, officials said, more than 40% of its known transactions have been associated with illicit actors. That’s more than $370 million, according to the cryptocurrency-tracking firm Elliptic.
Through its Office of Foreign Assets Control, the Treasury Department has previously sanctioned ransomware developers and distributors — though periodic retirements and rebrandings of ransomware strains have complicated those efforts. Officials say more such designations are possible.
SUEX is among the biggest and most active of a small group of illicit services that handle most money laundering for cybercriminals including scammers and darknet market operators, another crypto transaction-tracking firm, Chainalysis, said in a blog post. Such firms work closely with law enforcement to track criminal money laundering online.
Although legally registered in the Czech Republic, SUEX has no known physical presence there and operates out of branches in Moscow and St. Petersburg, Russia, where users can cash out their virtual currency, said Chainalysis, adding that it also has operations in the Middle East.
Chainalysis said SUEX claims it can convert cryptocurrency holdings into cash and even real estate, cars and yachts.
Most ransomware gangs operate out of reach of Western law enforcement in Russia and allied states. President Joe Biden has repeatedly told Vladimir Putin that he expects the Russian president to crack down on the gangs, but administration officials say they have seen no signs that Moscow is cooperating.
Chainalysis said SUEX was laundering money from the illicit cryptocurrency exchange BTC-e, which U.S. authorities shut down, perhaps on behalf of administrators, associates or former users. BTC-e’s operator, arrested on holiday in Greece, was sentenced to five years in prison by a French court in December.
“SUEX largely communicated with its clients on the Telegram app and accepted new customers on a system of referrals from trusted intermediaries. This was not the kind of business where a random person on the internet could open an account,” another crypto-tracking firm, TRM Labs, said in a blog post. “Transactions were only completed in-person at SUEX’s offices.”
TRM Labs CEO Esteban Castaño said SUEX is what is known as a “parasite exchange.” They are difficult to detect by the legitimate exchanges whose infrastructure they exploit because they open accounts using fraudulent or stolen credentials to meet know-thy-customer requirements and then fly under the radar.
Chainalysis said SUEX deposit addresses hosted at large exchanges have received over $160 million in Bitcoin alone from cybercriminals since the brokerage opened in early 2018, including nearly $13 million from ransomware operators including Ryuk, Conti and Maze. Ethereum and Tether are among other cryptoassets SUEX handled.
The Treasury Department said it is also updating guidance for ransomware victims that it first issued last year. The advisory strongly discourages victims from paying ransomware, reminding them that some transactions are against the law, and urges victims to report attacks to law enforcement.
“The reality is that the thing we know about this ecosystem is the way that we prevent ransomware attacks is by making sure that we get law enforcement engaged as soon as possible,” Adeyemo said.
Indonesia says no evidence of alleged Chinese intel hack
Indonesian authorities have found no evidence that the country’s main intelligence service’s computers were compromised, after a U.S.-based private cybersecurity company alerted them of a suspected breach of its internal networks by a Chinese hacking group, an official said.
The Insikt Group, the threat research division of Massachusetts-based Recorded Future, said it discovered the hack in April when it detected malware servers operated by the “Mustang Panda” group communicating with hosts inside Indonesian government networks.
The activity targeted the Badan Intelijen Negara, or BIN, intelligence agency as well as nine other Indonesian government agencies, Recorded Future said.
“We assess that this activity is very likely linked to the Chinese state-sponsored threat activity group Mustang Panda based on our continued tracking of Chinese state-sponsored cyberespionage activity,” the company said in an e-mail to The Associated Press.
Chinese government offices were closed Monday for the Mid-Autumn Festival and could not be reached, but authorities have consistently denied any form of state-sponsored hacking and said China itself is a major target of cyberattacks.
Recorded Future said its experts traced the hack back to as early as March, and the last observed date of the intrusion was Aug. 20.
“We have not seen additional activity targeting BIN since that date,” the company said.
After being notified by Recorded Future, BIN investigated the suspected breach together with other agencies and related stakeholders, but found “our server is safe and under control, there is no indication that it was hacked by suspected Chinese hackers,” said Wawan Hari Purwanto, a deputy chief and spokesman for the agency.
BIN coordinates information sharing and operations for Indonesia’s other intelligence agencies, as well as conducting its own operations. Because of its work, Purwanto said BIN’s computers are an attractive target for hackers, and the agency conducts regular checks and maintenance on its systems as a precaution.
He said BIN cooperated with Indonesia’s National Cyber and Encryption Agency, the Ministry of Communication and Information Technology and other government agencies to ensure “our network is safe and free from hacking.”
The Cyber and Encryption Agency referred all questions to BIN.
Purwanto dismissed the Insikt Group’s findings and urged people not to worry that the agency’s data had been compromised.
“BIN calls on people to not believe the rumors of hacking of BIN and other government institutions, and to keep checking, rechecking and crosschecking information circulating on internet and social media,” he said.
JAKARTA, Indonesia (AP)
CEO of Epic speaks up on NFTs
Google illustrations has just upped the tech giant’s game
Ford to add 10,800 jobs making electric vehicles, batteries
Far-right cryptocurrency follows ideology across borders
NEOM: A $500 Billion smart-city to be built in Saudi Arabia
5 Reasons Why… Telecoms is Important in Society
Advantages and drawbacks of Voice Recognition Technology
Telecom Sales Strategies that will Bring You Success in 2020
- Cryptocurrency4 weeks ago
Billionaire John Paulson bets against cryptocurrency’s climb
- Technology4 weeks ago
Microsoft’s Windows 11 launches on October 5 with explicit hardware list
- News3 weeks ago
Australian court rules media liable for Facebook comments
- Cybersecurity4 weeks ago
Biden’s Zero Trust order unites Big Tech under national security
- Ethical Tech4 weeks ago
Texas is one step closer from passing a law against tech giants
- MedTech3 weeks ago
TestCard launches at-home ‘Test and Treat’ UTI service
- Telecoms4 weeks ago
Deutsche Telekom and Vodafone’s zero tariff defies net neutrality
- Cybersecurity2 weeks ago
3 former US officials charged in UAE hacking scheme