1 big thing: How countries amplify COVID disinformation

Illustration of a hand cursor with crossed fingers.  

2. French authorities reveal Russian cyber espionage campaign


3. How COVID transformed the world of malware


4. Estonia warns of "silenced world dominated by Beijing"


Illustration of a person whose mouth is covered in a mask made by the Chinese flag

5. Odds and ends

Hello, and welcome to the latest edition of Codebook. This week, our thoughts are with those in Texas and elsewhere recovering from the recent storm.

Situational awareness: Federal investigators levied new charges Wednesday morning against North Korean computer programmers accused of wide-ranging cyberattacks, including the Sony Pictures hack and extorting more than $1.3 billion of money and cryptocurrency. Go deeper.

Today's newsletter is 1,316 words, a 5-minute read.

Axios Codebook: Countries amplify COVID misinformation — France exposes Russian campaign — Estonia vs. China

Codebook

A master lock with ones and zeroes instead of the regular numbers.

blue

Decode key cybersecurity news and insights. With Sam Sabin.

Axios Codebook

Standard

1 big thing: The risks and rewards of charging state-backed hackers

Illustration of a flagpole with a flag shaped like a keyboard

2. Chinese hackers secretly repurposed NSA tool

3. Mysterious Mac malware stumps security researchers

4. Ransomware actor nets over $123 million in 2020

Illustration of a surgical mask with eye holes cut out. 

Hello, and welcome to the latest edition of Codebook. This week, we’re thinking about the memory of my Aspen Institute colleague, Savilla Pitt — and encouraging you to spread the word on a new fellowship in technology and the environment that Aspen has created in her name. 

Today's newsletter is 1,401 words, a 5-minute read.

Plus: Malware mystery and big money for ransomware

Axios Codebook: Charging state-backed hackers — Malware mystery — Big money for ransomware

1 big thing: What a hair-raising incident says about U.S. cyber risk

Illustration of a house with cursor arrows lodged in and around it. 

2. Iranian spying operation targets dissidents

3. Researchers discover new malware from Chinese hacking group

Illustration of China’s flag with stars and lines

4. Alleged Israeli antifa hackers breach KKK website

Hello, and welcome to the latest edition of Codebook. This week, we’re thinking about the extraordinary life of former Secretary of State George Shultz, who died Saturday at 100.

Today's newsletter is 1,154 words, a 4-minute read.

Axios Codebook: Cyberattacks, real-world damage — Iranian spies target dissidents — China's new malware

1 big thing: The long tail of the SolarWinds breach

Illustration of a computer mouse with an extremely long cord 

2. Chinese hackers breached U.S. payroll agency via SolarWinds

3. SolarWinds breach snags court filing system

4. Internet blackouts skyrocket amid global political unrest

Hello, and welcome to this week’s edition of Codebook, where we’re heralding the return of “Axios on HBO.” Tune in on Sundays at 6pm ET/PT on all HBO platforms.

Today's newsletter is 1,323 words, a 5-minute read.

Axios Codebook: SolarWinds' long tail — Payroll agency breached — Internet blackouts rise

1 big thing: Perfect cybersecurity is a pipe dream

Illustration of a giant cursor piercing a laptop screen.

2. Platform sharing makes life easy for companies — and hackers, too

3. No silver bullets for cyber defense

4. Tensions between offense and defense in cyberspace

Illustration of fingers pointing across the NSA logo

5. The bottom line: In cybersecurity, we'll never have it all

6. Odds and ends

Hello, and welcome to this edition of Codebook, which will be the last one for now.

It’s been an honor to be delivered to your inbox every Wednesday, and I hope you’ve enjoyed reading Codebook as much as I have enjoyed writing it this past year as part of a unique partnership between Axios and the Aspen Institute.

Please stay in touch at zach.dorfman@aspeninstitute.org, and stay tuned: There’s more coming soon from me on critical issues in national security, cybersecurity and intelligence, including a few long-running investigative projects.

You can keep getting technology news from Axios by subscribing to Login, a daily tech newsletter. 

And with this ultimate Codebook, we offer you a set of big-picture conclusions tied together in 1,371 words — a 5-minute read. 

Plus: Platform risks — No silver bullets — Trade-offs all the way down

FetchError

National

Last week’s stunning indictment of three North Korean hackers laid bare both the advantages and drawbacks of the U.S. government’s evolving strategy of using high-profile prosecutions to publicize hostile nation-state cyber activities.

Why it matters: Criminal charges can help the U.S. establish clear norms in a murky and rapidly changing environment, but they may not deter future bad behavior and could even invite retaliation against U.S. intelligence officials.

Catch up quick: Last Wednesday, the Justice Department charged three alleged employees of North Korea’s Reconnaissance General Bureau with undertaking a massive, multiyear hacking spree.

The hackers conducted some activities — such as sending spear-phishing emails aimed at U.S. government employees and contractors — that are examples of workaday nation-state espionage. But they also took actions far outside these bounds that included:

The creation and use of the destructive WannaCry 2.0 ransomware.

A series of cyber-enabled bank hijackings across the globe wherein the spies tried to steal over $1.2 billion.

The theft of cryptocurrency valued at tens of millions of dollars worldwide.

Between the lines: Pointing the finger in cyberspace can often put the U.S. in uncomfortably hypocritical territory, as all major powers (and many minor ones) engage in cyber spying.

But the U.S. has the unambiguous ethical high ground with this latest indictment: U.S. intelligence agencies don’t hack banks to raise funds for the Treasury Department or seek vengeance over disfavored pieces of popular culture or create malicious cryptocurrency apps to steal from private companies to fund Washington’s weapons programs. 

The fact that the North Korean hackers were behaving, in many instances, like non-state cyber criminals made it easier for the U.S. government to treat them like criminals — and pursue legal action against them.

Context: The North Korea case is an extreme example of other states’ divergent views on the appropriate objectives of cyber operations.

For instance, many states, including some close U.S. allies, regularly commit cyber-enabled economic espionage and theft of trade secrets to benefit their “national champion” companies. 

American officials insist the U.S. does not engage in economic espionage — making it something of an outlier in the intelligence world.

Be smart: North Korea won’t extradite the hackers, and they’ll presumably never stand trial. Yet the act of naming and shaming these individuals may still hold real value for the U.S.

It may strengthen the international consensus against aberrant North Korean behavior (like massive bank theft).

Cyber espionage-related “speaking indictments” also provide a public service, detailing foreign cyber spying operations in an unusually open manner, a benefit to private cybersecurity firms, journalists and the wider interested public.

And these indictments extract costs on the named operatives, potentially complicating the individuals’ plans to, for instance, live in or visit countries that have extradition treaties with the U.S.

Yes, but: It’s unclear what, if any, deterrent effect these types of indictments actually have on foreign governments.

North Korea probably won’t stop robbing banks because the U.S. charged three of its intelligence officials. Their cyber operators rob banks because that’s where the money is, and Pyongyang needs it. 

There are other risks, too, to criminally charging state-backed cyber operators. 

One danger is that America’s adversaries will respond in kind, burning the identities and activities of U.S. intelligence personnel via criminal charges.

There’s next to zero possibility a hostile foreign power will successfully prosecute an American cyber operator it has charged, but some U.S. intelligence operatives still shudder at the possibility that they will become pawns, via this type of legal move by Moscow or Beijing, in a great geopolitical game. 

The bottom line: Evolving norms around spying cut both ways, and as the saying goes: “The enemy always gets a vote.”

The risks and rewards of charging state-backed hackers

The charges could invite retaliation against U.S. intelligence officials.

Security hackers

Privacy

North Korea

Cybersecurity

Last week’s stunning indictment of three <a class="gtmContentClick" data-vars-link-text="North Korean hackers" data-vars-click-url="https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and" data-vars-content-id="381605c7-346e-410e-b9bf-8d35691bfe08" data-vars-headline="The risks and rewards of charging state-backed hackers" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and" target="_blank">North Korean hackers</a> laid bare both the advantages and drawbacks of the U.S. government’s evolving strategy of using high-profile prosecutions to publicize hostile nation-state cyber activities.Why it matters: Criminal charges can help the U.S. establish clear norms in a murky and rapidly changing environment, but they may not deter future bad behavior and could even invite retaliation against U.S. intelligence officials.

From the Valley to D.C., Big Tech players like Facebook, Google and Amazon are under more scrutiny than ever as new technology develops and privacy and antitrust concerns grow in lockstep with companies’ ambitions.

Technology

President Biden has made the COVID-19 crisis and a post-Trump return to national unity and traditional democratic ideals his top priorities. From vaccinations to stimulus to schools, Biden is seeking bipartisan compromise while showing a willingness to use executive authority and bare Democratic majorities in the U.S. House and Senate to implement his policies. Republican leaders are navigating deep party divisions over if and how to move beyond former President Trump.

Politics & Policy

China is becoming the most formidable rival America has faced, and the risk of confrontation with Russia, North Korea or Iran still looms. Authoritarians are rising, the chaotic Afghanistan exit revealed the limits of U.S. power, and the pandemic, climate change and other critical challenges continue to pose grave threats.

World

Threat actors using the Sodinokibi ransomware made “at least” $123 million in 2020, stealing roughly 21.6 terabytes of data, according to a new report by IBM researchers.

The backdrop: Sodinokibi was the most-used ransomware observed by the researchers, accounting for 22% of all incidents in 2020. Cyber criminals using Sodinokibi demanded $42 million for a single ransom, writes IBM.

Why it matters: In 2020, ransomware actors “shifted tactics to not only encrypt data and render it impossible to access,” write the researchers. “They also stole it, and then threatened to leak sensitive data if a ransom was not paid.”

By the numbers: The Sodinokibi ransoms “peaked in June or July 2020 and then rose again after a brief lull in August and September, potentially related to threat actor availability, vacations, and alternate employment obligations,” write the researchers.

Nearly two-thirds of Sodinokibi victims agreed to pay the requested ransom, writes IBM — but more than 40% of their victims still had their data leaked.

By far, the most Sodinokibi victims — 58% — were based in the U.S., with the U.K. coming in second at 8%.

The most targeted entities were companies in the manufacturing, professional services and wholesale sectors. “Nearly all” ransomware attacks on the retail sector made in 2020 were made via Sodinokibi, writes IBM.

But the threat actors using Sodinokibi have also been perfectly happy to hold governments hostage, being responsible for almost half of all ransomware attacks on government entities in 2020, per the IBM researchers.

Ransomware actor netted over $123 million in 2020

Sodinokibi was the most-used ransomware observed by IBM researchers.

Ransomware

Threat actors using the Sodinokibi ransomware made “at least” $123 million in 2020, stealing roughly 21.6 terabytes of data, according to a <a class="gtmContentClick" data-vars-link-text="new report by IBM researchers" data-vars-click-url="https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89" data-vars-content-id="b3699280-4d59-4a7d-8533-85f8e9f0b877" data-vars-headline="Ransomware actor netted over $123 million in 2020" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89" target="_blank">new report by IBM researchers</a>.The backdrop: Sodinokibi was the most-used ransomware observed by the researchers, accounting for 22% of all incidents in 2020. Cyber criminals using Sodinokibi demanded $42 million for a single ransom, writes IBM.

China, Russia and Iran — drawing on one another’s online disinformation — amplified false theories that the COVID-19 virus originated in a U.S. bioweapons lab or was designed by Washington to weaken their countries, according to a nine-month investigation by AP and the Atlantic Council’s DFRLab.

Why it matters: Through a series of overlapping, if slapdash, efforts, America's global adversaries benefited from mutually reinforcing counter-narratives propagated online that aimed to falsely place responsibility for the pandemic on the U.S. and often to sow doubt on its actual origin within China. 

The extensive use by these countries of each other's COVID-19 disinformation shows just how international — and mutually reinforcing — these online networks have become.

The investigation was “based on a review of millions of social media postings and articles on Twitter, Facebook, VK, Weibo, WeChat, YouTube, Telegram and other platforms,” says the AP.

Details: Although seemingly less coordinated than other such efforts, extensive anti-American COVID-19 disinformation efforts first popped up in Russia, according to the AP/ DFRLab report.

A Russian military media outlet was the first identified publication that ran a story advancing the claim that COVID-19 was American, not Chinese, in origin.

In the first few months of 2020, “more than 70 articles appeared in pro-Kremlin media making similar bioweapons claims in Russian, Spanish, Armenian, Arabic, English and German,” writes AP.

However, “it was China — not Russia — that took the lead in spreading foreign disinformation about COVID-19’s origins, as it came under attack for its early handling of the outbreak,” says the report. 

By March 2020, Chinese state media outlets, as well as diplomats on social media, were pushing the conspiracy theory that COVID-19 was a biological weapon created by the United States at Fort Detrick in Maryland and brought to China during the 2019 Military World Games, which were held that October in Wuhan.

That month, “an anonymous petition appeared on the White House’s now-defunct ‘We the People’ portal. It urged U.S. authorities to clarify whether the virus had been developed at Fort Detrick and leaked from the lab. The petition was lavishly covered by China’s state media, despite getting only 1,426 signatures,” writes AP.

By May, Chinese state media broadcast “a slick documentary about Fort Detrick set to spooky music that has been viewed on its YouTube channel more than 82,000 times” and “played on China’s Bilibili platform 378,000 times.”

Chinese diplomats also began extensively posting COVID-related disinformation on Twitter, which is banned in China itself.

On popular social networks within China like Weibo, viral posts drew from Russian and Chinese disinformation to spread the false “U.S. bioweapons” theory of COVID-19.

Of note: Instead of using botnets or Russian IRA-type troll farms, the Chinese relied on their vast network of state-affiliated news outlets, as well as Chinese government accounts on social media, to propagate these false theories, writes DFRLab.

Iranian leaders, meanwhile, also began to push out false claims — Russian and Chinese in origin — that COVID-19 was a U.S. bioweapon designed to target Washington’s enemies.

The Iranians’ false allegations “were, in turn, amplified by Russian media and picked up in China, where they fueled further speculation,” writes AP.

An Iranian disinformation network active on Facebook, Google and Twitter also “activated a network of websites and covert social media accounts to accuse the U.S. of engineering the virus and praise[d] the leadership and benevolence of China,” writes the AP.

Yes, but: The DFRLab report also explores how a separate, earlier stream of disinformation — revolving around the false assertion that COVID-19 was purposefully leaked from a Chinese lab — spread online through U.S.-based far-right networks like QAnon and eventually bled into right-wing media more broadly. 

“The traditional view about conspiracy theories is that they exist along the fringes of the information space, apart from the mainstream and official communications. However, in the United States, these conspiracy theories have permeated all layers of discourse, particularly being embraced by elements of mainstream media and individual conservative policymakers during the Trump administration,” writes DFRLab.

Chinese government disinformation pushing the false “U.S. bioweapons thesis” about COVID-19 followed this earlier U.S.-based conspiracy theory that COVID-19 was a Chinese bioweapon — paralleling and inverting it.

How countries amplify COVID disinformation

China, Russia and Iran amplified false theories that the COVID-19 virus originated in a U.S. bioweapons lab.

Coronavirus

Health Care

Elon Musk

Social Media

China, Russia and Iran — drawing on one another’s online disinformation — amplified false theories that the COVID-19 virus originated in a U.S. bioweapons lab or was designed by Washington to weaken their countries, according to a nine-month investigation <a class="gtmContentClick" data-vars-link-text="by AP" data-vars-click-url="https://apnews.com/article/pandemics-beijing-only-on-ap-epidemics-media-122b73e134b780919cc1808f3f6f16e8" data-vars-content-id="bdd7f45a-4212-497c-8c77-c00b4c7c2379" data-vars-headline="How countries amplify COVID disinformation" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://apnews.com/article/pandemics-beijing-only-on-ap-epidemics-media-122b73e134b780919cc1808f3f6f16e8" target="_blank">by AP</a> and the <a class="gtmContentClick" data-vars-link-text="Atlantic Council’s DFRLab" data-vars-click-url="https://www.atlanticcouncil.org/wp-content/uploads/2021/02/Weaponized-How-rumors-about-COVID-19s-origins-led-to-a-narrative-arms-race.pdf" data-vars-content-id="bdd7f45a-4212-497c-8c77-c00b4c7c2379" data-vars-headline="How countries amplify COVID disinformation" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.atlanticcouncil.org/wp-content/uploads/2021/02/Weaponized-How-rumors-about-COVID-19s-origins-led-to-a-narrative-arms-race.pdf" target="_blank">Atlantic Council’s DFRLab</a>.Why it matters: Through a series of overlapping, if slapdash, efforts, America&#x27;s global adversaries benefited from mutually reinforcing counter-narratives propagated online that aimed to falsely place responsibility for the pandemic on the U.S. and often to sow doubt on its actual origin within China.

The U.S. faces a range of health care flashpoints — unaffordable drugs, opioids, vaping — as we debate whether to adopt universal care. For now, the Affordable Care Act is the law of the land, but Republicans want to issue it a final death blow.

Health

At a hearing on SolarWinds last Friday before the House Oversight and Homeland Security committees, U.S. representatives seized on a statement by SolarWinds’ former CEO that in 2017 an intern had mistakenly posted a password, “SolarWinds123,” on the public-facing internet that could have provided a malicious actor with full access to the company’s update server. 

Why it matters: Last week’s congressional hearings — and the confused and confusing response to the hack by some policymakers, industry mavens and government agencies — underscored the inherent tensions in “achieving” cybersecurity in a world of cross-cutting, and often mutually exclusive, goals. 

Though the compromised password was just one theory for how the Russian intelligence services may have compromised SolarWinds — and there is no evidence that this was, indeed, how they accomplished their initial intrusion — an incredulous member of Congress pounced on the idea that such a potentially monumental cybersecurity failure could have originated in such a banal human error. 

Human errors provide a good, easy-to-understand framing for complex problems, particularly attractive to politicians and private actors alike insofar as it individualizes responsibility — on the shoulders of a single intern, no less, with SolarWinds — while avoiding the deeper structural issues at play in cybersecurity.

For sure, individual mistakes can and do sometimes have massive systemic effects. One of the greatest intelligence coups in U.S. history, the Venona Project, was born from a World War II-era mistake by Soviet officials wherein some keys to “one time pads” — among the most secure forms of coded communications — were used twice, allowing U.S. cryptanalysts to crack Soviet ciphers. 

Human failure has also led to massive compromises in the digital era, with deadly real-world effects. 

For instance, in 2004, a CIA officer attempted to send an encrypted digital message to one of the agency’s assets within Iran — but, in a kind of “carbon copy” from hell, mistakenly included information in the transmission that “could be used to identify virtually every spy the CIA had in Iran,” reported James Risen in his 2006 book "State of War." 

Tragically, this particularly Iranian asset was actually a double agent, and Iranian security services rounded up the CIA’s Iranian network as a result of this single botched message.

The big picture: Though human error is an always-present cybersecurity threat — you can’t stop everyone from clicking on a malicious link — there are deeper, thornier issues at work. And these cannot be solved, if they indeed are solvable, without trading some important goods for other ones.

Platform sharing makes life easy for companies — and hackers, too

The ubiquity today of managed service providers, companies that outsource platforms for IT management and other core network functions, guarantees that firms have less insight into and control over the software running on their systems.

The ease of not building these capabilities in-house (if doing that is even possible) — saving employee time, increasing interoperability, and perhaps most importantly, positively benefiting the bottom line — is potentially partially offset by what may be increased risk brought on by the use of these services.

The use of such providers can make one’s own networks more opaque, and by using these platforms, firms are also importing whatever flaws may lay quietly dormant within them — as happened, disastrously, with SolarWinds. 

Moreover, compromises via software supply chains like SolarWinds are particularly pernicious because it is so difficult to pinpoint their origin, and once they spread from company to company, or from platform to platform, rooting out hackers can be a logistical and counterintelligence nightmare. 

Private companies are outsourcing work to other private companies, which are themselves providing services to government agencies, who themselves may not realize just how exposed they are, even on unclassified networks. 

The bottom line: The imperatives of commerce in an era of cutthroat competition, and the need for the smooth functioning of large, complex bureaucracies in the digital era, will inevitably lead to greater cybersecurity risks — even if organizations or government agencies attempt to institute "zero trust" security models.

There will never be a “silver bullet” in cyber defense — and if there were, it would likely be deemed entirely unpalatable, thanks to deeply held norms and assumptions shared among U.S. cybersecurity institutions and actors. 

For instance, the National Security Agency cannot monitor all private U.S. internet service providers as part of some massive early detection system against cyber threats.  

Even assuming such an arrangement would be possible or desirable, given the potentially vast civil liberties violations, there might be more pedestrian reasons for opposing it.

Lawful interception systems that concentrate power also concentrate risk: If a foreign power secretly gained access to such a system and burrowed in, it could be cataclysmic.

Between the lines: Private digital networks are inherently fragmented and opaque to outsiders — precluding any type of one-size-fits-all upstream response. 

Greater transparency from the private sector help might ameliorate some of these problems, but it won’t solve them. 

At last week’s congressional hearings, for example, Microsoft president Brad Smith suggested imposing legal duties on private companies to report breaches, which could help stanch the spread of some compromises by facilitating important information-sharing.

But this is still an effort at mitigation and not outright prevention. 

Other proposals floated occasionally — like the notion that private companies should be able to “hack back” against attackers in their networks — are fanciful at best and delusional at worst.

 Tensions between offense and defense in cyberspace

The United States' offensive cyber operators will aim to manipulate the broader IT environment. Defenders within the public and private sectors, in turn, have their own prerogatives. These needs will always be in tension — and are most likely unresolvable. 

The big picture: While the NSA does important defensive work, this reliance on, and facilitation of, insecurity is a core part of the NSA’s work. 

Indeed, according to an NSA document leaked in 2013, the NSA carried out a secret “SIGINT Enabling Project,” the objective of which was to engage "the US and foreign IT industries to covertly influence and/or overtly leverage their commercial products' designs … [to] make the systems in question exploitable through SIGINT collection.” 

Nothing underlines the tension in the NSA’s work more clearly than the evidence that it pushed what it knew to be a flawed encryption standard upon the National Institute of Standards and Technology (NIST), so that NIST in 2006 would (unknowingly) validate it as safe for general use — all while NSA was able to crack it.

Moreover, the NSA and the CIA need to keep vulnerabilities of all sorts secret in order to exploit them against intelligence targets. Expecting them not to do so would be folly.

The government’s “vulnerabilities equities process” provides some formal (though largely secret) framework for determining whether to disclose known bugs to outside parties.

But this is a decision made within government regarding its own prerogatives, which may not align perfectly with the welfare or wishes of the wider public. 

There are other cases where the government and the public interests might not align. 

Let’s stipulate that legislators wanted to, for instance, require Microsoft products to meet certain security standards for general public use. 

What if those standards interfered with important collection programs for the CIA or NSA, whose targets abroad were running Windows? Whose needs should be prioritized if national security is deemed to be at stake? And who should get to make that determination?

Between the lines: Many U.S. intelligence officials view the very porousness and insecurity of the digital domain as an immense structural opportunity and advantage. They see good reasons to exploit these avenues for collection in the country’s intelligence activities abroad (and sometimes at home). Yes, but: Such activities do not mitigate risk or online insecurity. In fact, they almost certainly increase it more broadly. Some argue that this trade-off may be worth making. But it's a trade-off nonetheless.

The bottom line: In cybersecurity, we'll never have it all

“The notion of the perfect whole, the ultimate solution, in which all good things coexist, seems to me to be not merely unattainable — that is a truism — but conceptually incoherent; I do not know what is meant by a harmony of this kind. Some among the Great Goods cannot live together. That is a conceptual truth. We are doomed to choose, and every choice may entail an irreparable loss.”

Berlin was talking about moral choices — like the “goods” of liberty and equality, which were often mutually exclusive. 

In cybersecurity, such “goods” — which are often rooted in deeper prerogatives of national security, individual privacy and the system of free enterprise — also sometimes work at inherent cross-purposes. We cannot maximize them all simultaneously.

My thought bubble: The pursuit of cybersecurity, along with the managed maintenance of desirable cyber insecurities, must be overseen by policymakers. They owe the public a fuller account of their ethical and practical calculus. 

Perfect cybersecurity is a pipe dream

"Achieving" digital security is likely impossible. We should be sharpening how we balance the trade-offs instead.

At a hearing on <a class="gtmContentClick" data-vars-link-text="SolarWinds" data-vars-click-url="https://www.cnn.com/2021/02/26/politics/solarwinds123-password-intern/index.html" data-vars-content-id="d3698981-2079-481d-aa36-b1432e4b732e" data-vars-headline="Perfect cybersecurity is a pipe dream" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.cnn.com/2021/02/26/politics/solarwinds123-password-intern/index.html" target="_blank">SolarWinds</a> last Friday before the House Oversight and Homeland Security committees, U.S. representatives seized on a statement by SolarWinds’ former CEO that in 2017 an intern had mistakenly posted a password, “SolarWinds123,” on the public-facing internet that could have <a class="gtmContentClick" data-vars-link-text="provided a malicious actor with full access" data-vars-click-url="https://www.reuters.com/article/global-cyber-solarwinds/hackers-at-center-of-sprawling-spy-campaign-turned-solarwinds-dominance-against-it-idUSKBN28P2N8" data-vars-content-id="d3698981-2079-481d-aa36-b1432e4b732e" data-vars-headline="Perfect cybersecurity is a pipe dream" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.reuters.com/article/global-cyber-solarwinds/hackers-at-center-of-sprawling-spy-campaign-turned-solarwinds-dominance-against-it-idUSKBN28P2N8" target="_blank">provided a malicious actor with full access</a> to the company’s update server. Why it matters: Last week’s <a class="gtmContentClick" data-vars-link-text="congressional hearings" data-vars-click-url="https://www.axios.com/solarwinds-senate-hearing-takeaway-cd78c24e-58c3-4e33-bf33-33fe195d24ff.html" data-vars-content-id="d3698981-2079-481d-aa36-b1432e4b732e" data-vars-headline="Perfect cybersecurity is a pipe dream" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.axios.com/solarwinds-senate-hearing-takeaway-cd78c24e-58c3-4e33-bf33-33fe195d24ff.html" target="_self">congressional hearings</a> — and the confused and confusing response to the hack by some policymakers, industry mavens and government agencies — underscored the inherent tensions in “achieving” cybersecurity in a world of cross-cutting, and often mutually exclusive, goals.

The COVID-19 pandemic transformed the world — and the afflictions of malware evolved with it, writes the security company Malwarebytes in its 2021 State of Malware report.

Why it matters: “The story of malware in 2020 … is a story of how the tools and tactics of cybercrime and cybersecurity changed against a backdrop of enormous changes to ordinary life,” says the report.

One big trend was the “staggering rise” in the use of stalkerware, writes Malwarebytes, with the company detecting a 1,677% increase in spyware on its Android product from January through June 2020.

The use of other monitoring apps rose 780% over the same period on Android, says the report.

“As the world locked down in April 2020, a tool that was once the preserve of nation states and cybercriminals became something otherwise ordinary people used on each other,” writes Malwarebytes about the spyware epidemic. 

Some industries saw a sharp increase in malware detections in 2020, while others saw significant decreases.

For instance, the agriculture industry saw a 607% increase in detections, while detections in the food and beverage industry rose by 67%.

Meanwhile, detections in the education field fell by 17%, in the health care field by 22%, and the automotive industry by 18%. 

Of note: 2020 saw the advent of a new ransomware named Egregor, which was used in “attacks against Ubisoft, K-Mart, Crytek, and Barnes & Noble,” says the report.

How COVID transformed the world of malware

One big trend was the “staggering rise” in the use of stalkerware.

Animated illustration of a health cross with 0s and 1s running across, some sequences are highlighted as malware.

The COVID-19 pandemic transformed the world — and the afflictions of malware evolved with it, writes the security company Malwarebytes in its <a class="gtmContentClick" data-vars-link-text="2021 State of Malware report" data-vars-click-url="https://resources.malwarebytes.com/files/2021/02/MWB_StateOfMalwareReport2021.pdf" data-vars-content-id="eae1c796-7ce3-498a-b8e7-17326bde9c02" data-vars-headline="How COVID transformed the world of malware" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://resources.malwarebytes.com/files/2021/02/MWB_StateOfMalwareReport2021.pdf" target="_blank">2021 State of Malware report</a>.Why it matters: “The story of malware in 2020 … is a story of how the tools and tactics of cybercrime and cybersecurity changed against a backdrop of enormous changes to ordinary life,” says the report.

Zach Dorfman of the Aspen Institute

Stories