Microsoft: Russian Hackers Targeted Companies Through IoT Hardware

The ever-growing network of the internet of things (IoT) can make life more convenient by automating your home and delivering data wherever you are. However, all those internet-connected devices can also provide a massive attack surface for online criminals. We’ve already seen malware that targets IoT hardware, but now Microsoft says it has uncovered a coordinated hacking campaign focused on government, political groups, and charities via devices like printers and VoIP phones.

Microsoft’s Threat Intelligence Center says a new wave of IoT hacks began in April of this year. It points the finger at a group known as Fancy Bear or Strontium, which is best known as the perpetrator of high-profile hacks supporting the Russian government. Naturally, Fancy Bear is linked to Russian military intelligence (GRU). Fancy Bear stole files from the Democratic National Committee in 2016 — those documents later appeared on Wikileaks, helping to damage Hilary Clinton’s presidential campaign. Later, it conducted the NotPetya ransomware attack on Ukraine and other countries.

The new hacking operation takes aim at popular internet of things devices because they often escape normal security scrutiny. According to Microsoft, the hackers went after three popular devices: a VOIP phone, an office printer, and a video decoder. In many cases, these devices connect to the internet but have a default password or outdated security patches. That makes them an ideal entry point for an attacker to gain access to a larger network. From there, Fancy Bear used access to steal high-value data from other computers.

Microsoft only spotted this attack because it has insights into so many corporate networks via Windows software. It detected around 1,400 intrusions via IoT hardware. About 20 percent of the infiltrations have been at non-government organizations, think tanks, and other political organizations. The remaining 80 percent focused on government, military, technology firms, and other entities. The campaign even targeted Olympic organizing committees and anti-doping agencies, both of which have been problems for Russian interests.

Microsoft offers a raft of suggestions for improving IoT security, which starts with securing approval before plugging in new IoT devices. Unauthorized hardware can circumvent many security measures on a network, as NASA found out recently. Microsoft also suggests setting up secure networks specifically for IoT hardware and monitoring the connections for unusual activity. You can see the full list in Microsoft’s blog post.

Continue reading

Russia Might Issue Fines for Using SpaceX Starlink Internet Service

You can get Starlink internet in a few places, but Russia doesn't want any of its citizens going through the SpaceX system as it expands. In fact, the country has floated the idea of fining people for using Starlink or other foreign satellite internet services.

Russia to Build 8-Core RISC-V CPUs for Laptops, Government Systems

Russia is investing in homegrown RISC-V CPUs, with eight-core chips at 2GHz expected by 2025.

Google, Apple Cave to Russian Government Pressure, Remove Navalny Voting App

That means citizens who have not already downloaded the app will find it much harder (or impossible) to get it, and the opposition's efforts to gain ground against Putin's United Russia party could suffer.

Huawei 2.0: Invading Ukraine Could Cost Russia the Modern Semiconductor Market

The United States is threatening to use export controls to sanction Russia if it invades Ukraine. The Biden Administration would presumably use some of the same tools the Trump Administration previously deployed against Huawei.The Ultimate BanhammerThe United States maintains a list of individuals, corporations, governments, and non-governmental organizations (NGOs) that are subject to export restrictions.…