3 octobre 2013 par Philippe Guerrier - itespresso.fr

Assises de la Sécurité IT : l’an passé, Cassidian CyberSecurity avait marqué les esprits en acquérant Netasq puis Arkoon plus récemment. Un an plus tard, les synergies démarrent et l’offre produits évolue.

Cassidian CyberSecurity vient d’effectuer un point sur ses activités après avoir annoncé le rachat de Netasq (solutions de sécurité unifiées) puis d’Arkoon (protection systèmes et réseaux informatiques).

« Il y a un an, nous étions 300 personnes avec un chiffre d’affaires de 50 millions d’euros. Maintenant, nous disposons d’un effectif global de 600 personnes dans trois pays européens et affichons un CA de 100 millions d’euros et  de CA », se réjouit Jean-Michel Orozco, CEO de Cassidian CyberSecurity (rattachée à la branche Défense du groupe EADS).

« L’an dernier, on a embauché 80 personnes sur les trois pays, dont 60 en France », précise le dirigeant, qui souligne les trois points forts d’expertises du nouvel ensemble : Cyberdéfense temps réel, supervision des infrastructures et protection périmétrique.

« On continuera de façon à croître de manière organique et avec des partenariats », précise Jean-Michel Orozco, en citant l’alliance signée avec le groupe Axa en matière « d’offres de risques techniques ».

Destinées à renforcer les compétences globales de Cassidian CyberSecurity, les filiales Netasq et Arkoon gardent une certaine autonomie opérationnelle.

Néanmoins, une jonction a été réalisée : François Lavaste, un manager qui vient de Netasq, va cumuler le poste de président du directoire des deux sociétés. Des mutualisation d’offre et de capacités d’innovation vont être réalisées afin de proposer des solutions de protection des réseaux, des infrastructures et des postes de travail.

A l’occasion des Assises de la Sécurité IT qui se déroulent actuellement à Monaco, le catalogue du nouvel ensemble s’enrichit : Cassidian CyberSecurity dévoile Keelback (« détection et lutte contre les cyber-menaces sophistiquées »), qui comporte une offre de services comprenant des capteurs et des logiciels, une identification et caractérisation des menaces et un service « procurant des capacités de réaction immédiate en cas d’attaques avérées ».

Du côté de Netasq, c’est une nouvelle version logicielle (9.1) pour la gamme de réseaux de parefeux NG-UTM qui est mise en avant. Avec un accès au cloud d’Amazon Web Services.

Pour la contribution d’Arkoon, c’est la solution StormShield sur la sécurisation des postes clients qui a été renforcée (jusqu’à 20 000 agents par serveur, « X4 par rapport à la version précédente ») et son déploiement a été facilité.

Sur le front de la mobilité, Cassidian CyberSecurity commercialise depuis le début de l’année l’application Moeso Smart pour le chiffrement des communications de voix sur IP.

Disponible pour iPhone, Android et BlackBerry, cette solution à vocation à contrer les risques de piratage des conversations vocales par téléphone. Mais elle n’assure pas la confidentialité des messages SMS et e-mails.

Par rapport à Bull (avec son nouveau smartphone Hoox) ou Thales (Teorem) qui privilégient l’approche terminal numérique isolé, Cassidian cherche à se démarquer dans la sécurité mobile. « Pour être efficace, il faut installer la solution logicielle de sécurité sur le téléphone d’usage d’un dirigeant et non sur un terminal dédié qui reste généralement dans sa valise », estime Jean-Michel Orozco.

Cette solution professionnelle, vendue par contrat, est facturée sur un mode d’abonnement mensuel. « Nous avons quelques centaines d’utilisateurs actuellement. Nous allons passer le millier avec les contrats signés avec deux très gros industriels nationaux. »

Ce qui fait dire au CEO de Cassidian CyberSecurity que son groupe dispose du parc de clients le plus significatif en France en matière de chiffrement de la voix via les terminaux mobiles.

Sur le thème fort de l’édition 2013 des Assies de la sécurité c’est à dire la protection des systèmes industriels (SCADA), le groupe de cybersécurité annonce que des projets sont en cours de développement et que des produits « marketables » devraient arriver d’ici fin 2014.

OTTAWA, 01 oct 2013 marine-oceans.com (AFP)

Des dispositifs d'espionnage électronique ont été découverts à l'ancien siège d'une société de haute technologie d'Ottawa appelé à devenir le nouveau quartier-général du ministère canadien de la Défense, ont indiqué mardi des médias locaux.

Le quotidien local Ottawa Citizen a affirmé que des ouvriers, employés par la Défense pour rénover l'ancien siège de l'équipementier des télécoms Nortel, ont découvert les dispositifs.

En revanche, le quotidien n'était pas en mesure de préciser si le matériel d'écoute avait récemment été mis en place ou s'il datait de l'époque où Nortel a été victime d'espionnage industriel, au cours des années 2000.

La découverte a amené le ministère de la Défense à revoir sa décision de quitter l'immeuble du centre-ville, où il est installé actuellement, et déménager dans l'ancien siège de Nortel en banlieue d'Ottawa, a ajouté de son côté la chaîne CTV.

Le ministère n'a fait aucun commentaires.

Le Wall Street Journal avait rapporté l'an dernier que des pirates informatiques utilisant des mots de passe volés à des responsables de Nortel avaient téléchargé des documents techniques et de recherche, ainsi que des courriels d'employés et d'autres notes pendant plus de dix ans.

Le quotidien américain citait une enquête interne de Nortel, qui avait établi que les pirates étaient vraisemblablement basés en Chine.

Des logiciels d'espionnage avaient été dissimulés dans des ordinateurs d'employés, si bien que Nortel ne s'était rendu compte de l'étendue du problème que des années plus tard.

Nortel, anciennement la plus grande entreprise cotée en Bourse au Canada, a fait faillite en 2009.

The Union’s cyber security policy may still be in its infancy and hampered by difficulties, but the EU could yet become a key player in the field – if it plays its cards wisely. While the US has been seriously hit by the scandal surrounding the secret NSA surveillance programmes, the struggle over how to frame internet governance goes on and, more than ever, needs core stakeholders capable of defending freedom, democracy and the rule of law in cyberspace.

The EU’s longstanding commitment to those values in its foreign policy and unquestioned leadership in data protection mean it is well placed to play a significant role therein. At the same time, the EU and its member states have recently accelerated efforts to increase their cyber-defence capabilities so as to secure Europe against malicious cyber-attacks (like those carried out against the office of European Council President Herman van Rompuy in June 2012). To be truly effective, they may have to be able to play, at the same time, the roles of policeman, diplomat and regulator.

Download document

24/09/2013 Par Antonin Billet – bretagne.france3.fr

L'université de Bretagne Sud a ouvert une formation spécialisée cyberdéfense, à Vannes (56). Formés en alternance pour devenir ingénieurs, les étudiants sont assurés de trouver du travail. Leur profil intéresse aussi bien le monde civil que militaire.

La cyberdéfense est devenu un enjeu prioritaire pour les entreprises françaises et le ministère de la Défense. De plus en plus d’objets que nous utilisons quotidiennement : ordinateurs, téléphones portables, tablettes et même des automates industriels sont connectés à internet.

Cette ouverture sur le web est une force mais aussi une fragilité. Les pirates informatiques exploitent les défauts de conception des logiciels pour voler des informations, subtiliser de l’argent voire même détruire des données.

Selon plusieurs estimations, la France a besoin de 1 000 ingénieurs par an pour sécuriser ses systèmes informatiques. Une nouvelle formation vient d’être créée à Vannes (56), par l’université de Bretagne Sud.  Cette formation est unique en France et a été créée en partenariat avec de grandes entreprises françaises et les services du ministère de la Défense consacrés à la sécurité informatique.

Ils sont 27 élèves sur 200 candidats à avoir intégré cette première promotion cyberdéfense de l’ENSIBS. Et tous sont assurés de trouver du travail à la sortie de leur formation où ils obtiendront le titre d'ingénieur, que ce soit dans le civil, mais aussi dans le domaine de la Défense Nationale.

La Défense Nationale recrute

A Bruz, près de Rennes (35), se trouve la DGA Maîtrise de l’Information. C’est le centre d’expertise français en matière de guerre électronique. Le site fait une centaine d’hectares, compte une trentaine de bâtiments et 1 250 personnes y travaillent.

Parmi eux, environ 200 ingénieurs spécialistes de la sécurité des réseaux informatiques. Un effectif qui va doubler d’ici 2017, c’est l’un des rares secteurs de la Défense Nationale qui ne connaît pas de réduction de budget. Bien au contraire : de 10 millions d’euros, le budget de recherche et développement va passer à 30 millions d’euros !

September 23, 2013: Strategy Page

Over the last decade Internet security firms (especially Kaspersky Labs and Symantec) have been increasingly successful at identifying the hacker organizations responsible for some of the large-scale hacker attacks on business and government networks. The latest group to be identified is from China and has been called Hidden Lynx. This group appears to contain 50-100 hackers (as identified by their coding style) and is believed to be largely responsible for a large scale espionage campaign (“Operation Aurora) in 2010 and is still active.

The security firms also identify and describe major malware (software created by hackers for penetrating and stealing from target systems. Earlier this year Kaspersky Labs discovered of a stealthy espionage program called NetTraveler. This bit of malware had been secretly planted in PCs used by diplomats and government officials in over 40 countries. Also hit were oil companies and political activists opposed to China. No samples of the NetTraveler from Israel were available for this analysis, but the program apparently did appear in Israel (but may have been prevented from stealing anything). Dissection of NetTraveler indicated it was created by about fifty different people, most of them Chinese speakers who knew how to program in English.

Kaspersky also discovered a similar bit of malware called Red October, because it appeared to have been created by Russian speaking programmers. Red October was a very elaborate and versatile malware system. Hundreds of different modules have been discovered and Red October had been customized for a larger number of specific targets. Red October was found to be in the PCs and smart phones of key military personnel in Eastern Europe, Central Asia, and dozens of other nations (U.S., Australia, Ireland, Switzerland, Belgium, Brazil, Spain, South Africa, Japan, and the UAE). The Red October Internet campaign has been going on for at least five years and has been seeking military and diplomatic secrets. As a result of this discovery Internet operators worldwide shut down the addresses Red October depended on.

Red October does not appear to be the product of some government intelligence agency and may be from one of several shadowy private hacker groups that specialize in seeking out military secrets and then selling them to the highest bidder. The buyers of this stuff prefer to remain quiet about obtaining secrets this way. In response to this publicity, the operators of Red October have apparently shut down the network. The Russian government ordered the security services to find out if Russians were involved with Red October and, if so, to arrest and prosecute them. Russia has long been a sanctuary for Internet criminals, largely because of poor policing and corruption. It may well turn out that the Red October crew is in Russia and has paid off a lot of Russian cops in order to avoid detection and prosecution. To date, the operators of Red October have not been found.

South Korea has been subjected to a growing number of Cyber War attacks over the last few years, some of them quite damaging. In the last year South Korean security researchers concluded that nearly all these attacks were the work of one group of 10-50 people called DarkSeoul. Given the extent of the attacks, the amount of work required to carry them out, and the lack of an economic component (no money was being stolen) it appeared to be the work of a national government. That coincides with earlier conclusions that North Korean, not Chinese, hackers were definitely responsible for several attacks on South Korean networks. The most compelling bit of evidence came from an incident where a North Korean hacker’s error briefly made it possible to trace back to where he was operating from. The location was in the North Korean capital at an IP address belonging to the North Korean government. Actually, very few North Korean IP addresses belong to private individuals and fewer still have access to anything outside North Korea.

Details of DarkSeoul were uncovered using pattern analysis of the hacker code left behind in damaged networks. This is a common technique for discovering who is behind an attack. There were patterns indicating the work of individual programmers and indications that there was only one organization involved in nearly all the attacks conducted since 2009. There was a lot of work involved in building all the software and assembling the resources (hacked South Korean PCs as well as hardware and network time required by the DarkSeoul team), and all this had to be paid for by someone. The likely culprit was North Korea, which has threatened Cyber War attacks but not taken credit for them. This is typical of most North Korean attacks, both conventional and now over the Internet.

Long believed to be nonexistent, North Korean cyberwarriors apparently do exist and are not the creation of South Korean intelligence agencies trying to obtain more money to upgrade government Information War defenses. North Korea has had personnel working on Internet issues for over 20 years, and their Mirim College program trained over a thousand Internet engineers and hackers. North Korea has a unit devoted to Internet based warfare and this unit is increasingly active.

What most of these large scale attacks have in common is the exploitation of human error. Case in point is the continued success of attacks via Internet against specific civilian, military, and government individuals using psychology, rather than just technology. This sort of thing is often carried out in the form of official looking email, with a file attached, sent to people at a specific military or government organization. It is usually an email they weren't expecting but from someone they recognize. This is known in the trade as "spear fishing" (or "phishing"), which is a Cyber War technique that sends official looking email to specific individuals with an attachment which, if opened, secretly installs a program that sends files and information from the email recipient's PC to the spear fisher's computer. In the last year an increasing number of military, government, and contractor personnel have received these official-looking emails with a PDF document attached and asking for prompt attention.

The most recent example of the continued effectiveness of spear fishing can be seen in the repeated use of spear fishing by a group of Syrian hackers, calling themselves the Syrian Electronic Army (SEA). This group is loyal to the beleaguered Assad dictatorship in Syria. The SEA has been using spear fishing to hack into media sites. Despite most media companies having in place software and personnel rules to block spear fishing attacks, there are so many email accounts to attack and you only have to get one victim to respond for the SEA to get in (using the login data from the compromised account). The automated defenses are supposed to block the actions of the hacker software that is triggered when the victim clicks on the email attachment, but hackers keep finding exploitable vulnerabilities to the defenses and these make the defenses vulnerable, at least until the vulnerability is detected and patched.

China has been a major user of spear fishing and apparently the Chinese government and independent Chinese hackers have been a major force in coming up with new spear fishing payloads. The methods, and source of many spear fishing attacks, have been traced back to China. In 2010 Internet security researchers discovered a China-based espionage group, called the Shadow Network, which had hacked into PCs used by military and civilian personnel working for the Indian armed forces and made off with huge quantities of data. Examination of the viruses and related bits of computer code indicated that most of this stuff was created by Chinese speaking programmers, and all movement of command and stolen data led back to servers in China. Since China is an ally of the Assad government, the SEA has access to the best spear fishing tools. The Shadow Network had also hacked into PCs used by military and civilian personnel working for the Indian armed forces, and made off with huge quantities of data. This was done via Internet based attacks against specific military and government officials via "spear fishing" (or "phishing").

China's Cyber War hackers have become easier to identify because they have been getting cocky and careless. Internet security researchers have found identical bits of code (the human readable text that programmers create and then turn into smaller binary code for computers to use) and techniques for using it in hacking software used against Tibetan independence groups and commercial software sold by some firms in China and known to work for the Chinese military. Similar patterns have been found in hacker code left behind during attacks on American military and corporate networks. The best hackers hide their tracks better than this.

It's also been noted that Chinese behavior is distinctly different from that encountered among East European hacking operations. The East European hackers are more disciplined and go in like commandos and get out quickly once they have what they were looking for. The Chinese go after more targets with less skillful attacks and stick around longer than they should. That's how so many hackers are tracked back to China, often to specific servers known to be owned by the Chinese military or government research institutes.

The East Europeans have been at this longer and most of the hackers work for criminal gangs, who enforce discipline, select targets, and protect their hackers from local and foreign police. The East European hacker groups are harder to detect (when they are breaking in) and much more difficult to track down. Thus the East Europeans go after more difficult (and lucrative) targets. The Chinese hackers are a more diverse group. Some work for the government, many more are contractors, and even more are independents who often slip over to the dark side and scam Chinese. This is forbidden by the government and these hackers are sometimes caught and punished, or simply disappear. The Chinese hackers are, compared the East Europeans, less skilled and disciplined. There are some very, very good Chinese hackers but they often lack adult supervision (or some Ukrainian gangster ready to put a bullet in their head if they don't follow orders exactly).

For Chinese hackers that behave (don't do cybercrimes against Chinese targets) the rewards are great. Large bounties are paid for sensitive military and government data taken from the West. This encourages some unqualified hackers to take on targets they can't handle. This was seen recently when one group of hackers were caught trying to get into a high-security network in the White House (the one dealing with emergency communications with the military and nuclear forces). These amateurs are often caught and prosecuted. But the pros tend leave nothing behind but hints that can be teased out of heavy use of data mining and pattern analysis.

September 22, 2013 eucom.mil

U.S. ARMY GARRISON GRAFENWOEHR, Germany — Learning through partnership is key to most joint training exercises and Combined Endeavor 2013 is no different.

The world's largest command, control, communications and computers (C4) exercise, Combined Endeavor, brings communications experts from 40 coalition partnership nations to one location for the primary purpose of building coalition information sharing operations.

For 18 years, Combined Endeavor has enhanced joint multinational partnership solutions in the C4 realm by promoting information dominance. One delegation member said he was looking forward to gaining more insight through CE13 and building partnerships in the process.

Read more

18.09.2013 Par Jean-Pierre Stroobants - Le Monde.fr

L'enquête sur le piratage à grande échelle dont a été victime, apparemment pendant deux ans, l'opérateur belge de téléphonie Belgacom fait des vagues et soulève déjà de nombreuses questions. La direction de la société et le gouvernement belge ont confirmé lundi 16 septembre "un piratage très intrusif". Si les soupçons s'orientent vers l'Agence nationale de sécurité américaine (NSA), la presse a révélé, mercredi 18 septembre, que le président du conseil de la société, Michel Moll, est depuis 2010 conseiller de l'entreprise chinoise Huawei, laquelle a été soupçonnée - à tort, selon elle – de se livrer à de l'espionnage industriel aux Etats-Unis.

La Sûreté de l'Etat, les services belges de renseignement, manifestent également des inquiétudes quant aux activités de ce groupe, fournisseur d'équipements et producteur de smartphones. La Belgique a ouvert une enquête sur ces éventuelles pratiques l'an dernier.

Interrogé par le quotidien néerlandophone De Morgen, M. Moll a expliqué qu'il avait donné des conseils stratégiques à Huawei, mais aucun concernant l'Europe et la Belgique. Il souligne, en outre, qu'il n'a exercé aucune fonction commerciale et que, de toute manière, Huawei et Belgacom ne sont pas concurrents. M. Moll refuse de révéler le montant de sa rémunération et nie toute implication dans des pratiques d'espionnage.

Suite de l'article

16 September 2013 defenceWeb (Reuters)

Belgium said on it was investigating suspected foreign state espionage against its main telecoms company, which is the top carrier of voice traffic in Africa and the Middle East, and a newspaper pointed the finger at the United States.

Federal prosecutors said in a statement that the former state telecoms monopoly Belgacom had filed a complaint in July about the hacking of several servers and computers.

"The inquiry has shown that the hacking was only possible by an intruder with significant financial and logistic means," they said.

"This fact, combined with the technical complexity of the hacking and the scale on which it occurred, points towards international state-sponsored cyber espionage." The prosecutors declined to say which foreign state they suspected, Reuters reports.

Documents leaked by the former U.S. intelligence contractor Edward Snowden have revealed a vast National Security Agency (NSA) electronic surveillance program that has tracked enormous quantities of both Americans' and foreigners' email and telephone data.

This has mostly been done by agreement with telecommunications or internet providers or foreign government intelligence agencies.

However, the Brazilian television network Globo this month alleged that the NSA had tapped into the computer systems of companies including Google Inc. and the Brazilian state oil firm Petroleo Brasileiro, as well as France's Foreign Ministry and the Belgian-based international banking cooperative SWIFT, which handles international financial transactions.

The Belgian daily De Standaard said the NSA had been monitoring international telephone traffic through Belgacom for two years. It said the hackers had been primarily interested in Belgacom's subsidiary BICS, a wholesale provider of international phone lines and biggest voice carrier in Africa and the Middle East.

STATE NOT NAMED

The government of Belgium, which has a majority stake in Belgacom, condemned the intrusion and the violation of a public company.

Prosecutors said the intruder had used malicious software and advanced encryption techniques with the aim of gathering strategic information, and had not sabotaged Belgacom's data or sought to cause direct economic damage.

Belgacom itself said it had carried out work over the weekend to improve security and remove an unknown virus from its internal systems, adding that at the moment there was no indication of any impact on customers or their data. It said it had filed a complaint against an unknown third party.

Globo's revelations were based on leaked U.S. documents provided by Guardian journalist Glenn Greenwald, who has worked with Snowden to expose the extent of U.S. spying.

James Clapper, the U.S. Director of National Intelligence, responded last week by saying U.S. agencies did collect information about economic and financial matters, which was used to combat terrorist financing and predict problems that could lead to financial crises or disrupt financial markets.

"What we do not do," Clapper said in a statement, "is use our foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of - or give intelligence we collect to - U.S. companies to enhance their international competitiveness or increase their bottom line."

September 10, 2013: Strategy Page

Recent NSA (National Security Agency) leaks confirmed that a lot of the most successful American Internet hacking was not directed at individual PCs but rather at the special computers used to run the Internet. It’s long been feared that most damaging attacks on the Internet don’t need a lot of money or people, just the right information about how these specializes computers work. However, that information is extremely expensive, and consists primarily of previously unknown flaws in Internet software, especially software used to run routers and other core elements of the Internet. And it gets worse as an increasing number of vulnerabilities are found in routers, server software, and other aspects of the hardware that runs the Internet. By attacking these systems, rather than PC users, it's more likely that attacks could shut down large sections of the Internet as well as steal any data moving within the Internet. The NSA leaks also revealed that the NSA had, as long suspected, secretly arranged to have access to most encryption systems so that criminals and terrorists (and anyone else) could not communicate free of any chance of government (or non-government) eavesdropping.

Meanwhile NSA has openly warned of the router vulnerability, which apparently they discovered while exploiting these vulnerabilities to spy on others. The router approach is more efficient in many respects because you can grab everything that passes through a router, which usually handles all Internet traffic for a network. The Internet is basically run by these routers, which business and home users also need to provide Internet access (especially wi-fi) for multiple PCs. But the routers come in many sizes, with very powerful ones used to play traffic cop for thousands of users, or hundreds of other routers. The NSA has apparently become quite adept at exploiting routers to capture huge quantities of data from computer networks it seeks information about.

The NSA has been in the forefront of providing security solutions for American government, military and private networks for decades. For example, the NSA is working with the Department of Defense to increase Internet defenses by putting more of their computer operations in a cloud system, and spending a lot more on protecting the cloud from attacks. Cloud computing is a system where data and software are supplied to PCs or laptops via a network connection from a large and well-protected number of servers (PCs customized to provide information on the Internet). Usually, it's via the Internet, but it can be a local, closed (to the Internet) system as well. The main point here is that you can devote all your security resources to the collection of computers that run the cloud. You don't have to worry so much about the users PCs or laptops, because time they use the cloud, their software (word processor, spreadsheet, whatever) and data is loaded from the cloud. When they save data to the cloud, it is checked for malware (viruses, worms and other stuff hackers use to infect and take control of your computer.)

NSA began, after World War II, as a communications security organization, dedicated largely to creating ciphers to protect American communications, and decoding the ciphers other nations use. Now, the NSA is in the lead developing better network security for the Department of Defense and all American computer networks.

Currently the NSA and Department of Defense have over seven million computers, printers and other devices connected to 15,000 networks (most of them local) and many of these are also connected to the Internet. The military cannot compete with civilian (especially financial) firms for the best network security people, and as a result are more vulnerable than any other large organization. The U.S. Department of Defense is the largest organization on the planet, and a major target for hackers. By shifting to cloud based Internet security system, it should make it harder for enemy intruders to get in.

A cloud based system is, in theory, more secure from attack. But in practice, it remains uncertain how much more secure, if at all the cloud is. What is certain is that the current system of trying to protect individual PCs or local networks is not working out too well.