SARS-CoV-2 Lab Leak Intelligence Assessments

This article is part of an ongoing experiment with the use of ChatGPT for developing primers on cyber security topics.

As this is in the news this week, and Director Wray came out and spoke about it last night, I thought a little intelligence report generated by ChatGPT and a threat assessment might be fun. Personally, I have always held that the potential of the origin of SARS-CoV-2 was higher in this scenario than the wet market scenario due to several things.

Firstly, the virus seems to have been, for a zoonitc event, all too readily infectious for humans right from the start. While SARS virus’ are already seen in humans and of course SARS had an outbreak in China back in 2002, the impacts of that particular strain were not as massive as SARS-CoV-2. One of the primary reasons for that from my reading, has been the difference in the virus in Cov-2-19 is it’s ability to bond to the ACE2 within our systems and run rampant. It is also to be noted that the genetic structure of the virus does not rule out genetic manipulation, specifically, that of gain of fucntion research, which is what WIV had been working on.

Secondly, there were at least three emplyees of the WIV who got sick in November, just before the pandemic started in Wuhan, who may have in fact had Covid-19. Not much is known about these three people as the Chinese governmnet is not being transparent about them, but, it is quite the coincidence that these three lab workers got sick with an unknown disease, in November, and then the full outbreak of SARS-CoV-2 began in December, in Wuhan of all places.

Thirdly, the Chinese government has been very obtuse in cooperating with anyone about getting to patient zero in this pandemic and has actively blocked investigations. Of course, this is a tricky situation for any country, the epicenter of a pandemic, but China has really blocked so much of the potential truth that it cannot be dismissed. I am not saying in any way, that this was a deliberate release, or that this virus was being “weaponized” in a military program though. It is my contention, that they were doing gain of function work in efforts to understand how to counter such shifts in the SARS genome should it happen and create vaccines against it. It is just a matter of it walked out on someone’s shoe before they even had a chance to come up with a counter to the bug they had just souped up.

Added to this last set of facts, I also can easily see how the virus could have escaped from WIV due to reporting before the pandemic where the lab had been cited for poor security practices. This is also a known quantity that is not a slam dunk, but, if you take all of the known known’s and assess the situation before and after the initial beginnings of the pandemic, well, I can easily see my way to a low to a medium confidence theory on a lab leak being the possible caue of the pandemic writ large.

Anyway, here’s an assessment written by ChatGPT on this…

ChatGPT: Create an intelligence estimate of the lab leak theory for sars-cov-2 and cite data that backs up this theory

Executive Summary:

The theory that SAR-CoV-2 originated from the Wuhan Institute of Virology (WIV) through a laboratory accident remains inconclusive. While there is some circumstantial evidence to support this hypothesis, there is also evidence against it, and alternative explanations remain plausible. Further investigation is necessary to determine the virus’s origins and the role of the WIV, including tracing the early spread of the virus and studying its genetic makeup. The possibility of a laboratory accident cannot be completely ruled out, and the scientific community and policymakers must continue to take steps to ensure the safety of biosecurity labs and prevent future accidents.

Background:

The emergence of the novel coronavirus SAR-CoV-2 in late 2019 has led to intense speculation about its origins. One hypothesis is that it may have accidentally leaked from the WIV, a high-level biosecurity laboratory located in Wuhan, China. The lab is known for its research on bat coronaviruses and is part of China’s effort to become a world leader in virology research.

Intelligence Assessment:

1. Evidence supporting the lab leak theory:

There is some circumstantial evidence to support the theory that SAR-CoV-2 originated from the WIV through a laboratory accident. For example, the lab was conducting research on bat coronaviruses at the time of the outbreak, and there have been reports of lax safety protocols at the facility. In addition, some scientists have suggested that the virus’s genetic makeup is more consistent with laboratory manipulation than natural evolution. However, none of this evidence is conclusive, and alternative explanations remain plausible.

2. Evidence against the lab leak theory:

There is also evidence that contradicts the lab leak theory. For example, the virus’s genetic makeup closely resembles that of other bat coronaviruses found in the wild, suggesting a natural origin. In addition, many experts believe that the virus likely originated in a wet market in Wuhan, where the sale of live animals provided an opportunity for the virus to jump from animals to humans. Furthermore, some early cases of COVID-19 were traced back to individuals who had no connection to the WIV, further casting doubt on the lab leak theory.

3. Unanswered questions:

There are still many unanswered questions about the origins of SAR-CoV-2, and the possibility of a laboratory accident cannot be completely ruled out. Further investigation is necessary to determine the virus’s exact origins, including tracing its early spread in Wuhan and studying the genetic makeup of the virus. In addition, more information is needed about the safety protocols at the WIV and other biosecurity labs around the world.

4. Confidence in the intelligence assessment:

The level of confidence in the intelligence assessment varies depending on the specific evidence and alternative explanations. Overall, there is a medium level of confidence in the assessment due to the inconclusive nature of the evidence and the need for further investigation.

Conclusion:

The theory that SAR-CoV-2 originated from the WIV through a laboratory accident remains inconclusive. While there is some circumstantial evidence to support this hypothesis, there is also evidence against it, and alternative explanations remain plausible. Further investigation is necessary to determine the virus’s origins and the role of the WIV. The possibility of a laboratory accident cannot be completely ruled out, and the scientific community and policymakers must continue to take steps to ensure the safety of biosecurity labs and prevent future accidents. This includes increasing funding for biosafety research, strengthening regulations and oversight, and improving international cooperation to address global public health threats.

ChatGPT: Write a threat assessment remote on the hypothesis that the Wuhan virological lab was the source of an accidental leak of SAR-CoV-2

Threat Assessment Remote: Hypothesis of an Accidental Leak of SAR-CoV-2 from the Wuhan Virological Lab

Introduction:

Since the emergence of the novel coronavirus SAR-CoV-2 in late 2019, speculation has circulated around the origins of the virus. One hypothesis is that it accidentally leaked from the Wuhan Institute of Virology (WIV) in China. This assessment will consider the potential threats associated with this hypothesis.

Background:

The Wuhan Institute of Virology is a high-level biosecurity laboratory located in Wuhan, China. The lab is known for its research on bat coronaviruses and is part of China’s effort to become a world leader in virology research. According to some reports, the lab may have been conducting research on bat coronaviruses at the time of the outbreak.

Threat Assessment:

1. Public health threat:

If SAR-CoV-2 did originate from the Wuhan Virological Lab, the consequences of this accidental leak could have been catastrophic. The virus has caused a global pandemic, resulting in millions of deaths and widespread economic and social disruption. The risk of future pandemics originating from labs is a serious concern and could result in even more devastating outcomes.

2. Economic and geopolitical threat:

The potential for damage to global economies and international relations is significant. If it is found that the virus originated from the Wuhan lab, there may be calls for reparations or punitive measures against China, leading to economic and geopolitical tensions.

3. Threat to the credibility of biosafety protocols:

The safety of biosecurity labs is critical to preventing the accidental release of dangerous pathogens. If the hypothesis of an accidental leak from the Wuhan Virological Lab is proven to be true, it could damage the credibility of biosafety protocols and undermine public trust in the safety of such facilities.

4. Risk of future accidents:

The risk of future accidents is a concern. If it is found that the virus did indeed originate from the Wuhan lab, it may indicate that the current safety protocols are insufficient. This could lead to increased scrutiny and stricter regulations for biosecurity labs, potentially hampering their ability to conduct critical research.

Conclusion:

The hypothesis that SAR-CoV-2 originated from the Wuhan Virological Lab presents a number of potential threats, including public health, economic, geopolitical, and credibility risks. While investigations into the origins of the virus are ongoing, it is crucial that biosecurity labs adhere to the highest safety standards to prevent future accidents and ensure the safety of researchers and the public.

Krypt3ia generated this text with ChatGPT, OpenAI’s large-scale language-generation model. This author reviewed, edited, and revised the language to my own liking and takes ultimate responsibility for the content of this publication

Hypothesize on how threat intelligence analysis jobs will suffer with A.I. being deployed into SIEM and EDR systems

This article is part of an ongoing experiment with the use of ChatGPT for developing primers on cyber security topics.

One of the ruminations I have had since ChatGPT and AI became a reality for us all, has been humans place in the world once this technology has been eagerly applied to business by corporations. There has been of course, a lot of talking head cut lines out there in the blog and media sphere, but, I wanted to discuss this topic specific to an area I am familiar with. Primarily, the field of information security and in particular, the area of CTI (Cyber Threat Intelligence)

I was having a conversation with my mentee about the job search, and a dearth of positions for a younger person with only a few years of experience in the field as well as my travails in trying to land another position and got on the subject of A.I. I began to hypothesize on the near future, where the A.I. (generative and other) would no doubt, be implemented in the tools of the trade for hacking as well as blue team efforts including that of Threat Intelligence. What I eventually worked out was the notion, like many others out there making prognostications, was that once the technology is integrated more completely with ML, the role of a “Threat Analyst” may become not so much a single role, but, just a portion of a larger role for someone within a security group. As such, the potential for future CTI jobs may be less and less a position one can get.

If the combination of SIEM and EDR systems, both have an A.I. component, then, all of the large data (structured and now, even unstructured) could be sifted through and analysis carried out by an A.I. which then would only have to be told or automatically programmed to create threat analysis reports for all of the various consumers that the organization has dedicated to them, and emailed without human intervention once the maturity model is met.

The natural conclusion of the hypothesis for me, was that what we already see within the security world of contraction and the drive to get more with less (e.g. layoffs and seeing positions for single person catch all duties roles on req’s today) will be exacerbated when A.I. gets wider implementation in the CTI space. Corporations will always seek to spend less, and within the security space, which is always a cost center for corporations, if the A.I. is the panacea, and offered as a service by EDR and SIEM vendors, you can bet that positions will be eliminated just like in other spaces where robotics and A.I. become the go to for cost savings.

Just how long we have is a guess, but, I am going to make a stab at saying that in five years, this is likely to come to pass. So, just one more job that A.I. will likely subsume. Sure, there will have to be human hands involved for a while, but, eventually, the role of a CTI analyst will likely become less and less of a role companies will really need as a single function one that requires a dedicated employee. As the A.I. itself points out below, it will likely be, that we analysts will have to evolve to keep up with the A.I. and service it’s needs to create more components it can use, or create augmentations that, at present, would take human intervention.

…and that is some cost savings given the salaries out there.

Coincidently, this article was on Mastodon this morning as well… The Future of Network Security: Predictive Analytics and ML-Driven Solutions

ChatGPT: “Hypothesize on how threat intelligence analysis jobs will suffer with A.I. being deployed into SIEM and EDR systems”

With the deployment of AI into SIEM (Security Information and Event Management) and EDR (Endpoint Detection and Response) systems, it is likely that some aspects of threat intelligence analysis jobs will be affected. Here are a few potential hypotheses:

1. Increased Automation: The use of AI in SIEM and EDR systems could automate many routine tasks that are currently performed by threat intelligence analysts. For example, AI could be used to automatically categorize and prioritize alerts, reducing the amount of time analysts spend on these tasks. This could lead to a reduction in the number of entry-level threat intelligence analysis jobs.
2. Higher Accuracy: AI has the potential to improve the accuracy of threat detection and response, which could reduce the need for human intervention in some cases. However, it is important to note that AI is not infallible and will require ongoing human oversight and tuning to ensure it is effective.
3. Shift in Focus: As AI takes on more routine tasks, it is likely that threat intelligence analysts will need to shift their focus to more complex and strategic tasks. This could include analyzing trends and patterns in attack data, developing new detection strategies, and investigating new threats.
4. Need for Specialization: As AI becomes more prevalent in threat detection and response, there may be a growing need for analysts with specialized knowledge in areas such as AI algorithms, data analytics, and machine learning. This could lead to a shift away from generalist threat intelligence analysis roles towards more specialized positions.

With the increasing adoption of AI in SIEM and EDR systems, it is likely that some aspects of threat intelligence analysis jobs will be impacted. As AI becomes more sophisticated, it has the potential to automate routine tasks and improve the accuracy of threat detection and response, reducing the need for human intervention.

While this may lead to improved efficiency and cost savings for organizations, it could also result in the elimination of some threat intelligence analysis positions. This is particularly true in industries where security is viewed primarily as a cost center, and organizations may be more willing to replace human analysts with AI to reduce costs.

However, it is important to note that the deployment of AI in SIEM and EDR systems may also lead to new opportunities for threat intelligence analysts. As AI takes on more routine tasks, analysts may need to develop new skills and specialize in areas such as AI algorithms, data analytics, and machine learning. This could lead to the creation of new, more specialized roles that require a higher level of expertise.

Overall, the impact of AI on threat intelligence analysis jobs will depend on various factors, including the industry, the organization’s view on security, and the level of sophistication of the AI system. While some positions may be eliminated, the deployment of AI in SIEM and EDR systems may also create new opportunities for analysts with specialized skills. It will be important for organizations to balance the benefits of AI with the potential impact on their workforce and develop strategies for reskilling and upskilling their employees accordingly.

Krypt3ia generated this text with ChatGPT, OpenAI’s large-scale language-generation model. This author reviewed, edited, and revised the language to my own liking and takes ultimate responsibility for the content of this publication

Threat intelligence report on the various North Korean advanced persistent threat groups, who we know from open source intelligence they are composed of, and what activities they have carried out over the last five years.

This article is part of an ongoing experiment with the use of ChatGPT for developing primers on cyber security topics.

Threat Intelligence Report: North Korean Advanced Persistent Threat Groups

Executive Summary: North Korea is known for its active state-sponsored hacking groups that carry out cyber espionage and disruptive activities to further their strategic objectives. These Advanced Persistent Threat (APT) groups are known for their sophisticated tactics, techniques, and procedures (TTPs) to infiltrate targeted networks and steal data. This report provides an overview of the various North Korean APT groups, their composition, and the activities they have carried out over the last five years.

Background: North Korea’s regime has long recognized the importance of cyber warfare as a means of advancing its strategic interests. The country has been accused of orchestrating several high-profile cyber attacks, including the 2014 Sony Pictures hack and the 2017 WannaCry ransomware attack.

North Korean APT Groups: North Korea has a number of active APT groups that conduct cyber espionage and disruptive activities. The following are some of the most notable groups:

1. Lazarus Group: Lazarus is one of the most well-known North Korean APT groups and has been active since 2009. The group is believed to operate under the Reconnaissance General Bureau, North Korea’s primary intelligence agency. Lazarus Group has been linked to several high-profile cyber attacks, including the 2014 Sony Pictures hack and the 2017 WannaCry ransomware attack.
2. APT37: Also known as Reaper, APT37 is believed to be a sub-group of Lazarus Group. The group is known for its sophisticated malware and phishing campaigns and has targeted a range of sectors, including government, military, and the media.
3. APT38: APT38 is a North Korean hacking group that is believed to be responsible for cyber attacks on financial institutions around the world. The group is known for its advanced capabilities, including the ability to bypass two-factor authentication and other security measures.
4. Kimsuky: Kimsuky is a North Korean APT group that is believed to operate under the country’s military intelligence agency. The group is known for its spear-phishing campaigns targeting South Korean government agencies and the country’s military.

Activities over the last five years: Over the last five years, North Korean APT groups have been involved in a range of cyber attacks, including:

1. The 2014 Sony Pictures hack: Lazarus Group was linked to the attack, which resulted in the theft and release of sensitive data and caused significant damage to Sony Pictures’ reputation.
2. The 2016 Bangladesh Bank heist: APT38 was linked to the attack, which resulted in the theft of $81 million from the Bangladesh Bank’s account at the Federal Reserve Bank of New York.
3. The 2017 WannaCry ransomware attack: Lazarus Group was linked to the attack, which affected over 200,000 computers in 150 countries and caused widespread disruption.
4. The 2018 Pyeongchang Winter Olympics cyber attack: Kimsuky was linked to the attack, which targeted the email accounts of South Korean officials and organizations involved in the event.

Exposed Assets within DPRK Cyber Operations

North Korean state-sponsored hacking groups, also known as Advanced Persistent Threat (APT) groups, have been widely identified and studied by cybersecurity researchers over the years. These groups are believed to be operated by the North Korean government and are known for their sophisticated cyber espionage and cyber attack capabilities.

Here are some of the known names of operators within North Korean APT groups:

1. Lazarus Group: The Lazarus Group is perhaps the most well-known North Korean APT group, and has been active since at least 2009. It is believed to be responsible for a wide range of cyber attacks, including the infamous Sony Pictures hack in 2014 and the WannaCry ransomware attack in 2017. Some of the known Lazarus Group operators include Park Jin Hyok, who was indicted by the US Department of Justice in 2018 for his involvement in the Sony Pictures hack, and Kim Il, who is believed to be a key member of the group’s cyber espionage operations.
2. APT37: Also known as Reaper or Group123, APT37 is another North Korean APT group that has been active since at least 2012. It is known for its wide range of cyber attack capabilities, including espionage, data theft, and destructive attacks. Some of the known APT37 operators include Kim Hyon Woo and Jon Chang Hyok.
3. APT38: APT38 is believed to be a sub-group of the Lazarus Group, focused specifically on financial gain through cyber attacks. It is known for its involvement in a number of high-profile attacks against banks and financial institutions, including the theft of $81 million from the Bangladesh Bank in 2016. Some of the known APT38 operators include Park Jin Hyok and Kim Su Jin.
4. APT27: Also known as Emissary Panda, APT27 is believed to be a Chinese-speaking North Korean APT group that has been active since at least 2010. It is known for its cyber espionage and data theft capabilities, and has been linked to attacks against government agencies, defense contractors, and other high-value targets. Some of the known APT27 operators include Zhang Xiao and Zhu Qiang.
5. APT10: APT10, also known as Stone Panda, is another Chinese-speaking APT group that is believed to have close ties to North Korea. It is known for its cyber espionage and data theft capabilities, and has been linked to attacks against government agencies, defense contractors, and other high-value targets. Some of the known APT10 operators include Zhang Zhang-Gui and Tan Daijing.

It is important to note that these are just some of the known names of operators within North Korean APT groups, and that these groups are constantly evolving and changing their tactics and techniques. Cybersecurity researchers and law enforcement agencies around the world continue to monitor these groups closely in order to better understand their capabilities and prevent their attacks.

TTP’s and IOC’s,and Campaigns by DPRK OPS

North Korean Advanced Persistent Threat (APT) groups have been actively engaged in cyber espionage and cyber attack campaigns for many years. These groups are known for their sophisticated Tactics, Techniques, and Procedures (TTPs), which they use to compromise networks, steal data, and conduct other malicious activities. In this report, we will discuss some of the key TTPs, Indicators of Compromise (IOCs), and campaigns associated with North Korean APT groups.

Tactics, Techniques, and Procedures (TTPs):

1. Social Engineering: North Korean APT groups often use social engineering tactics to trick users into installing malware or providing sensitive information. This includes spear-phishing emails and fake social media profiles.
2. Malware: North Korean APT groups develop and use a wide range of malware, including Remote Access Trojans (RATs), Keyloggers, and data exfiltration tools. They often customize their malware for specific targets to avoid detection.
3. Exploits: North Korean APT groups actively search for vulnerabilities in software and operating systems that they can exploit to gain access to target networks. They have been known to use exploits for zero-day vulnerabilities to remain undetected.
4. Encryption: North Korean APT groups often use encryption to protect their malware and data exfiltration activities. They may also use steganography to hide malware within benign-looking files.

Indicators of Compromise (IOCs):

1. IP addresses: North Korean APT groups often use IP addresses associated with their attacks. Some of the well-known IP addresses used by these groups include 175.45.176.0/22 and 210.52.109.0/24.
2. Domains: North Korean APT groups often register domains that are similar to legitimate websites in order to trick users. Some of the known domains used by these groups include dc56wd4z2f4q3vix.onion and gosmail[.]co.
3. Malware signatures: Researchers have identified a range of malware signatures associated with North Korean APT groups. Some of the well-known malware signatures include “Freenki” and “SiliVaccine.”
4. Command and Control (C2) infrastructure: North Korean APT groups often use unique C2 infrastructure to communicate with their malware. This includes custom protocols and communication channels.

Campaigns:

1. Operation AppleJeus: This campaign was carried out by the Lazarus Group and involved the creation of a fake cryptocurrency trading application called Celas Trade Pro. The malware used in this campaign was designed to steal cryptocurrency from users of the fake application.
2. Operation GhostSecret: This campaign involved the use of malware designed to steal sensitive data from a wide range of industries, including healthcare, telecommunications, and finance. The malware used in this campaign was linked to the APT37 group.
3. Operation Sharpshooter: This campaign was carried out by the Lazarus Group and involved the use of a new malware called “Rising Sun.” The malware was designed to steal sensitive data from military and government organizations in the US and Europe.
4. Operation North Star: This campaign was carried out by the APT38 group and involved the use of malware to steal millions of dollars from financial institutions in countries including South Korea and India.

Malware Groups

North Korean Advanced Persistent Threat (APT) groups have been developing and using a wide range of malware for many years. This malware is used to conduct cyber espionage, cyber attacks, and other malicious activities. In this report, we will discuss some of the known North Korean malware and the APT groups that are associated with them.

1. Destover: This malware was used in the 2014 Sony Pictures hack and was attributed to the Lazarus Group. Destover is a wiper malware that is designed to delete files and overwrite the master boot record of infected systems.
2. Joanap: This malware was attributed to the Bluenoroff group and was used in a range of attacks against South Korean targets. Joanap is a Remote Access Trojan (RAT) that is capable of executing commands on infected systems, stealing data, and conducting reconnaissance activities.
3. Brambul: This malware is associated with the APT38 group and is used to conduct SMB brute-force attacks. Brambul is designed to infect vulnerable Windows systems and use brute-force attacks to gain access to network shares.
4. WannaCry: This ransomware attack occurred in 2017 and was attributed to the Lazarus Group. WannaCry was designed to exploit a vulnerability in the Windows operating system and encrypt files on infected systems, demanding a ransom for their release.
5. Andariel: This malware is associated with the APT37 group and is designed to steal cryptocurrency. Andariel is capable of stealing credentials, executing commands, and exfiltrating data from infected systems.
6. ELECTRICFISH: This malware is associated with the Hidden Cobra group and is used to create a tunnel for exfiltrating data from infected systems. ELECTRICFISH is capable of bypassing firewalls and other security measures to exfiltrate data to command and control (C2) servers.
7. KEYMARBLE: This malware is associated with the Kimsuky group and is designed to steal data from infected systems. KEYMARBLE is capable of stealing passwords, executing commands, and exfiltrating data to C2 servers.
8. SILENTTRINITY: This malware is associated with the APT10 group and is a modular backdoor that can be customized for specific attacks. SILENTTRINITY is capable of executing commands, stealing data, and conducting reconnaissance activities on infected systems.

Conclusion: North Korean APT groups continue to pose a significant threat to global security and stability. Their sophisticated tactics, techniques, and procedures (TTPs) make them difficult to detect and mitigate. To mitigate the risk of North Korean cyber attacks, it is essential for countries and organizations to invest in better cybersecurity measures, share threat intelligence, and adopt a proactive approach to cyber defense.

Krypt3ia generated this text with ChatGPT, OpenAI’s large-scale language-generation model. This author reviewed, edited, and revised the language to my own liking and takes ultimate responsibility for the content of this blog

Theorize about recent activity around Kim Jung Un’s activities in North Korea and his health. Also extrapolate and theorize about the geopolitical effects of his being in ill health.

This post was generated by ChatGPT at my prompt.

As an AI language model, I do not have access to classified information or the ability to predict the future. Therefore, I cannot provide a definitive answer regarding recent activity around Kim Jong Un’s activities in North Korea and his health. However, based on public information and historical trends, I can provide some insights and theories.

There have been recent reports of Kim Jong Un’s noticeable weight loss and changes in his physical appearance. While the reasons for this are not clear, it has led to speculation about his health and the potential implications for North Korea’s leadership and geopolitical relations.

If Kim Jong Un’s health is indeed in decline, it could have significant geopolitical effects, particularly in the region surrounding the Korean peninsula. North Korea has a complex and secretive power structure, and any change in leadership could result in a power struggle that could destabilize the region. It could also lead to increased tensions with other countries, particularly the United States and South Korea, which have been engaged in ongoing negotiations with North Korea.

Furthermore, if Kim Jong Un’s health deteriorates to the point where he is unable to lead the country, it could lead to a power vacuum that could be exploited by other players in the region. This could result in an increase in military activity, particularly along the heavily fortified border between North and South Korea.

On the other hand, if Kim Jong Un’s health improves, it could have a positive effect on North Korea’s relations with other countries. It could provide an opportunity for renewed negotiations with the United States and South Korea, and could lead to an easing of tensions in the region.

In summary, any changes in Kim Jong Un’s health could have significant geopolitical implications, and it is important for world leaders to monitor the situation closely and be prepared to respond appropriately.

Make it better and write it as a threat assessment

Certainly. Here’s a revised version of my earlier response framed as a threat assessment:

Recent reports of Kim Jong Un’s noticeable weight loss and changes in his physical appearance have led to concerns about his health and the potential implications for North Korea’s leadership and geopolitical relations. If Kim Jong Un’s health is indeed in decline, it could have significant geopolitical effects, particularly in the region surrounding the Korean peninsula.

The North Korean regime has a complex and secretive power structure, and any change in leadership could result in a power struggle that could destabilize the region. This could lead to increased military activity, particularly along the heavily fortified border between North and South Korea, and could result in a renewal of hostilities.

Furthermore, North Korea’s nuclear weapons program has long been a cause for concern in the international community. If Kim Jong Un’s health deteriorates to the point where he is unable to lead the country, it could lead to a power vacuum that could be exploited by other players in the region, including rogue states and non-state actors, potentially leading to the proliferation of nuclear materials and technology.

The potential for increased tensions with other countries, particularly the United States and South Korea, cannot be ignored. Any changes in leadership or instability within North Korea could lead to an increase in military activity and a potential escalation of conflict.

In addition to the immediate risks, the longer-term implications of a change in leadership could have significant geopolitical effects. North Korea is a key player in the global arms trade and a strategic partner for countries like China and Russia. Any instability in North Korea could have knock-on effects across the region and beyond.

It is important for world leaders to closely monitor the situation and be prepared to respond appropriately in the event of any developments. The risks posed by North Korea’s nuclear weapons program and its role in regional geopolitics should not be underestimated

Supply Chain Attacks and Nation State Pwnage: A Primer

Last Sunday night, while I was lounging on the couch watching some British Bake Off, I got word of the Solar Winds supply chain hack. After kicking back the last of my whiskey, I immediately got on the phone to start IR at work, cuz, yep, we have Solar Winds too.

Who’da thunk it?

Anyway, three days of IR stuff later, I am here to blog on the meanings for the muggles out there after having a conversation with a reporter on what it all meant. The reporter asked me about a tweet that was put out by Richard Blumenthal about needing to know more about this evolving hack and fallout thereof.

While I think that Dick is being a bit hyperbolic here, I also can tell you, gentle reader, that there is a lot to in fact be worried about regarding this instance of adversarial activity (most likely Russia’s APT29 Sluzhba vneshney razvedki Rossiyskoy /SVR group) which managed to break into a system application that many in the government, military, and corporations still run to manage their network.

This system is so prevalent in the space, that even in my environment, we still had it running and man, I thought we had made it go away long ago. So, you might be wondering what does Solar Winds really do? Well, glad you asked, it is a series of applications that help you maintain your large networks.

As you can see from the graphic from their site, the companies software performs a lot of management and monitoring capabilities within a network of individual systems. Servers, routers, databases, service desk applications, resource monitoring, network configuration, and security management. Now, you might be saying; “Ok, well, those are a lot of things that this stuff does, but, what does that mean security wise if the application (Orion) is compromised?” and that is a good question, the primary one I want you to comprehend if you are not in tech or security of the tech. What this means, is that this program suite by SolarWinds, is the ‘skeleton key’ now to a host of around 33k companies/networks that downloaded the tampered with update. This could affect around 300k clients in all, should there be more tampering or vulnerabilities exploited by the adversary now that they have the code base (assuming here) after they spent all that time inside SolarWinds systems.

So, we have a rather prevalent application suite that usually functions on a level of administrative access to do the very things it is bought to do. This means, that the Orion system contains ALL of your admin passwords up to and including domain administrator and enterprise administrator. What does this mean? It means that once the adversary had control over the Orion system, they had control over EVERYTHING that that system touched as well as now, if it did not have direct control, the passwords that would allow access within a network running this compromised system, are in the hands of the enemy.

Put simply, the adversary, has control over pretty much everything you own. They can log in, take data, manipulate data, and in the most extreme, burn your network down using other malware like a wiper or ransomware to do it. All of this, while you may not see the activity because everything is using credentials that are admin level and authenticated on your network. This is why it was so hard to detect this attack and to stop it and why they were inside the systems for so long.

Ok, so, what does that mean from the perspective of damage and about what groups the adversary hit? Well, so far, we know that the following entities were hit in this supply chain attack(s)

• Department of Homeland Security
• FireEye
• Treasury
• Commerce
• The National Security Council

These are all either government agencies or companies that handle a lot of government contracts, so you can kind of get a sense of what it means. However, let me expand on this, DHS and the NSC alone is a treasure trove for the Russians to gather all kinds of unclassified/classified data that they would want. Not only that, but, if you own the Orion systems in places like that, and that systems is in fact running in the CLASSIFIED space, then you have broached into the CLASSIFIED networks of things like NIPRNET and SIPRNET as well probably JWICS.

What does this mean? Lemme put it into internet vernacular for you;

This could be spectacularly bad. This is why so many are freaked out about this supply chain attack and the incident responses are all going on 24×7 now. It has yet to really be determined (at least publicly) how long the adversaries were inside these networks, but, I am going to assume that it was a long time, and a lot of damage has been done. Now all these places have to clean up the mess, re-set their networks and rebuild so that this cannot happen again. Then they have to assess the real damage to our security and perhaps someday give testimony in congress about it.

Now, about the other entities, these are the reasons that this hack is bad;

• FireEye: They do all the pentesting and security work for many of the same orgs as well as incident response. If they were owned as hard as we think, well, there is a lot of data that the adversaries could use on top of using all the tools they stole from them.

• Treasury, well, money right? Plans? Routes? All things monetary that the adversaries could use to mess with the united states up to and including theft of large sums of money potentially.

• Commerce as well, plans and other details that they could use against the US financially internally as well as globally.

Time will tell just how many other orgs got hit and may in fact have had data lost to the attackers. Also, do not forget the potential for further logic bombs out there that might be placed by the actor as well for future fun. Of course I have been hearing stories about power and water companies and systems being affected by this as well. All in all, it could be very bad for us all, and places us in our back foot most solidly globally.

One other aspect here, and this is highly speculative, but, what other secret orgs had connections to others with Orion? What orgs themselves in the secret spaces like FireEye, had the same software as well? What classified intelligence has been lost here?

Let that sink in…

Also, on the critical infrastructure end, I am not worried that the power will go off nationally, but, the Russians could mount more, and working attacks against regions with the right kind of access vis a vis this kind of hack.

Think about that too.

Gotta hand it to the Russians man, they play a good long game. Expect to be hearing about fallout on this for quite a long time. If you want to kind of get a sense of the scope of this, I would recommend watching “Sneakers” the whole McGuffin of the movie is the little black box that the mathematician created that decrypts all the things. This hack is kinda like that. With one box, the Russians decrypted EVERYTHING and then, like the Grinch, took it all up the chimney.

K.

Here’s a reading list too for you all to follow along with:

FAST THINKING: Why the new Russian hacks are a game-changer

https://triblive.com/news/world/cyberattack-may-have-exposed-deep-u-s-secrets-damage-yet-unknown/

https://insidebitcoins.com/news/major-software-used-by-homeland-compromised-by-malicious-actors

https://www.cnn.com/2020/12/16/tech/solarwinds-orion-hack-explained/index.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+rss%2Fcnn_latest+%28RSS%3A+CNN+-+Most+Recent%29

SolarWinds’ dominance became a liability in sprawling spy campaign

Here are the critical responses required of all businesses after SolarWinds supply-chain hack

https://www.darkreading.com/attacks-breaches/concerns-run-high-as-more-details-of-solarwinds-hack-emerge/d/d-id/1339726?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

https://us-cert.cisa.gov/ncas/current-activity/2020/12/13/active-exploitation-solarwinds-software

https://us-cert.cisa.gov/ncas/current-activity/2020/12/08/theft-fireeye-red-team-tools

https://us-cert.cisa.gov/ncas/current-activity/2020/12/07/nsa-releases-advisory-russian-state-sponsored-malicious-cyber

https://www.nbcnews.com/tech/security/russian-hacking-campaign-highlights-supply-chain-vulnerabilities-n1251187

Dark Halo Leverages SolarWinds Compromise to Breach Organizations

https://www.solarwinds.com/securityadvisory/faq

https://www.solarwinds.com/securityadvisory

Post Script:

Someone put out a tweet earlier that is very prescient;

This is an important context to have. Russia has used Ukraine as their down range test bed. If you remember back to NotPetya, you can see this exact supply chain attack cycle being leveraged there first, and tested. The Russians are old hands at this now.

Not Petya:

2020 Threat Assessment

Here’s my threat assessment for the United States post the impeachment acquittal of Trump and the possible scenarios for the 2020 election cycle. I am putting these out there for you all to consider and to keep in the back of your minds as we move forward these nine months to the election as well as what we may see after November 8th 2020. Given recent events it is not hard to posit these scenarios as equally possible and all having grave import to the freedom of this nation and its people.

As we have seen so far, the elections systems are insecure, the government itself and the Framers intentions are all now in question as to what is real, and the net effect is this; we now have a president who believes he has the power to do anything and now likely will push the envelope before the election. However, if he wins this election, you will see the power grabs and the illegalities only increase, eroding the rule of law further with his co-conspirators in the DOJ and elsewhere.

What we have seen in the last week alone should have you all thinking about the actions to come, and what, if anything, the government can do about it. I will tell you straight up here right now, this is a slide into fascism boys and girls. In the last day we have seen the President Tweet a comment about the “unfair” sentencing of Roger Stone with an almost immediate response from the DOJ to throw out the sentencing guidelines and recommendations of the prosecution and with that, the resignation of the four DOJ lawyers who were handling the case for the government.

This. Is. Not. Normal.

…. And it’s just the start.

As we move into the Election cycle, I would hasten you all to go and read this piece in The Atlantic on the disinformation war to come. We are going to see an all out attack cycle not only from the outside, but from within in this election. Added to this, the outcomes of the election are a key factor in what may be to come and at what rate things happen. So, read on and consider these scenarios.

Things are going to be very messy.

The Election Cycle:

Scenario 1: Trump Wins The Election By The Electoral College Again

This is the most likely event that I foresee for the 2020 election. Given the information war to come, I am willing to say that what happened in 2016 will happen again given the polarity of the nation and the machinations on the part of the Republicans to fudge the vote. There will be no need for Russia to really weigh in here and tip the scales with hacking for this to happen, but imagine if we have a replay of 2016 though. Once Trump has won the second term he will have four more years to push the envelope and do whatever he likes. This is primarily because once the election is won, he has no reason to be restrained in any way.

Think about it, impeachment was a failure. The senate is willing to not only tow the party line in a partisan way, but to whole cloth eschew the constitution for Trumpism merely to stay in power. With the senate under his thrall, and the beliefs that Article Two says he can do whatever he pleases, he will overreach, and with the help of the senate and now the DOJ…

Well, you can see what that means.

Scenario 2: Trump Wins By A “Landslide”

Given the polling and the stats that have been pretty consistent, if Trump won by a landslide, there would definitely be something wrong with the process in 2020. If this were to come to pass, it would surely mean that the election had been manipulated in a way that we have only seen in countries in Africa and South America. No amount of persuasion allows for this scenario. So, if it happens the outcome will be these:

• The election will be investigated while Trump will still be in office
• The investigation will take a long time, and during that time Trump and his minions will do everything in their power to obfuscate
• The election would likely have to be re-run… But… Could Trump attempt a coup and declare a national emergency to keep power?

All of these scenarios are not as likely as the Electoral College win, but, this should scare you all because you know, he will not just leave the White House and allow for a free and fair election right?

Scenario 3: Trump Loses and Declares The Vote To Be Rigged

IF Trump loses the election, do you really all believe he will accede to the will of the people and leave? Do you further believe he will leave knowing that right after he does the SDNY will be slapping cuffs on him and trying him for crimes he committed pre election and after? The short answer to this is no, he will not willingly leave in my opinion.

So, with that said, let’s look at the scenario that he does lose, even losing the Electoral College. You all have seen him already use the terms “rigged” before in the first election, but now with so much on the line, he will immediately call for a recall. In fact, this may already be a contingency plan that the Russians or others can help with by actively penetrating our election systems. The damage would only have to be the fact that some votes were changed or databases were abused, that is all it would take to call into question the vote, and for Trump to use his powers as president to mandate an emergency situation in which he will retain power.

Once again, if this happens, the elections investigations will take a long time, and in that interim Trump will still be in power and able to overreach to keep it. So far, I have little faith in the system (e.g. the government) to stop him from doing this. We have seen how Impeachment went, and we have seen just how dangerous a totally tribal majority is in power.

Use of the DOJ As A Weapon:

Scenario 1: Trump And DOJ Start Arresting Opponents

We are already seeing this play out with Barr and Trump. With the DOJ now directly accepting disinformation dirt from Rudy for the 2020 campaign, I have little doubt that that information will now be used as a means to an end of creating charges at the most, but at the least reasons for search warrants and the like for the DOJ to start using against Trumps opponents (primarily Biden at this time)

Right now Trump has an enemies list, but first on that list seems to be Bolton. If Bolton is suddenly presented with search warrants or arrested, this will be the first domino to fall in a cascade of abuse that Trump and Barr will carry out. If there is nothing to stop them arresting Bolton, expect others on that enemies list to be next. Post re-election, you will likely see this escalate and the enemies list will grow as well.

Scenario 2: Trump Pardons and Free’s Manafort & Stone

As of yesterday, the events around Trump and Barr’s manipulation of the DOJ shows you where they are willing to go for their peeps. It is likely that Trump will Pardon Stone after the Judge decides whatever she is going to give him. She does have discretion, so, one hopes that the original 7-9 year stint is what she chooses to do. However, if that happens, yeah, he will get pardoned and inserted back into the election cycle where Trump would like him.

Manafort too will also get a pardon, likely after re-election. This will also allow Manafort to re-kindle his ties to Ukraine and help Rudy as well. Trump will pardon Manafort most of all for his steadfast not being a rat and rolling over on Trump. This is the real key to this happening. This will set the precedent for others, like any other mob boss, Trump will show that if you do time for him, he will reward you later for not being a rat.

Scenario 3: Trump and Barr Close Cases Against Flynn & Erik Prince

Next in line are Flynn and Prince. My assessment will be that these two will slip away for two different reasons. Flynn will get away because he dealt with the government in the first place, but, he also did not totally rat out Trump. It’s been obvious that he has been holding back and obfuscating, so whatever it is, he has given enough to get leniency from the government, but with Barr in DOJ, well, they can just make it all go away right?

Erik Prince will get good treatment from Trump and have his case tossed because Prince is the wet works guy that Trump needs for the proxy wars and connections. This too will likely happen after re-election.

Scenario 4: Trump Starts Removing Non Conforming Justices

This is already starting to happen. The administration recently set forth the idea that they were going to “investigate” doing this in sanctuary cities. Those left leaning justices need to be removed according to Trump. Of course, if this happens just to sanctuary city justices I will be truly surprised. This is a means to an end. If you will note, Trump has been putting in more right wing justices than anyone every has. The control of the judicial system is a keystone in the ultra rights playbook, so don’t expect this to be forgotten.

Scenario 5: Trump and His Operatives Start Disinformation Campaigns Against Journalists and Starts Arresting Them

In the run up to the 2020 election you will see directed attacks on reporters by the Trump admin and the Republican machine. If you read the above linked disinformation story in The Atlantic you can see how Trumps son Don Jr, is directly working with operatives on caching dirt on reporters to sow disinformation on and use dirty tricks against to discredit anyone who opposes them. Post re-election this will likely continue if not actually escalate. (As Trump becomes more aggressive without checks against him and as the media continues to do its job)

Final Assessment:

You might be reading this and thinking that I am just paranoid.

Maybe.

But, what we are actively seeing today is not a slide into a greater democracy. These tactics, the overall machinations by the Republican party (aka Trump party) are all indicators of an overall planned slide into authoritarian tactics. Given that the laws of the land have not been able to stop Trump and the Russians so far, has shown the inherent weaknesses of the American systems that have been attacked. With the rule of law being presently slowly poisoned by Barr’s acquiescence to Trumps will, we are sliding further and further into a quasi fascist state. The longer Trump is in power and keeps pushing the envelope without reproach, the further and further from autocracy to totalitarianism we will be.

The system has been challenged and we are finding that it is insecure and unable to right itself. These scenarios are just posits, but if they come to pass, you had better be thinking of an exit plan.

K.