Overnight Cybersecurity: Hackers claim credit for PlayStation outage

Welcome to OVERNIGHT CYBERSECURITY, your daily rundown of the biggest news in the world of hacking and data privacy. We’re here to connect the dots as leaders in government, policy and industry wrap their arms around cyberthreats. What lies ahead for Congress, the administration and the latest company under siege? Whether you’re a consumer, a techie or a D.C. lifer, we’re here to give you …

THE BIG STORIES:

–ROUND UP THE USUAL SUSPECTS: The hacking group Phantom Squad has taken credit for downing Sony’s PlayStation Network for most of the day on Monday. “#psn #offline #off for some users. We are back for some action!” the group tweeted on Monday. Sony has not yet issued a statement on the causes behind the outage. The network is now restored. Phantom Squad threatened last month to knock out both Xbox Live and the PlayStation Network by flooding the networks with phony traffic until they crash, a technique known as a distributed denial of service (DDoS) attack. “We are going to shut down Xbox live and PSN this year on christmas. And we are going to keep them down for one week straight #DramaAlert” the group tweeted in December, shortly before claiming responsibility for brief service disruptions in Xbox’s network. Tweeting from an eponymous account, the group said it is taking action because the makers of the devices aren’t doing enough to adequately safeguard their networks. The threats echo another case of holiday gamer “hacktivism.” Last year, the more well-known hacking group Lizard Squad took down the same two networks on Christmas Day, allegedly to force XBox and PlayStation to upgrade their cybersecurity. To read our full piece, click here.

{mosads}–FIRST OF ITS KIND: Researchers have uncovered more evidence tying Russia to what they say is the first major blackout caused by hackers. On Dec. 23, the power went out in roughly half the homes in Ukraine’s Ivano-Frankivsk region. Within a week, the Ukrainian government said the malware behind the assault was linked to Russia, but offered no specifics. In recent days, security experts have uncovered those details. Cybersecurity firm Eset identified the malware used in the attack as part of the BlackEnergy family. BlackEnergy has been linked in recent months to a series of suspected Russian cyberattacks on Ukrainian news outlets during the 2015 local elections. It’s also believed the malware was used in 2014 for Russian intelligence-gathering operations on Ukrainian government targets. Tensions have been running high between Ukraine and Russia since Moscow annexed Crimea last year and began supporting pro-Russian separatists in Ukraine. Eset said the western Ukraine power company hit by the digital assault was not the only one that hackers were trying to compromise using BlackEnergy. “Currently we know of several electricity distribution companies in Ukraine … that have been targeted by cybercriminals,” the company said in its post. “Additionally, BlackEnergy was also detected at electricity companies earlier in 2015,” it added. “It is possible that the cybercriminals were then at the preparatory stage of the attack.” The successful attack, which left roughly 700,000 homes temporarily without power, is being billed as the first-ever instance in which hackers caused a major blackout. To read our full piece, click here.

AN UPDATE ON CYBER POLICY:

–SHUT IT DOWN, I SAID. Public interest groups are launching an 11th-hour campaign to kill a Republican-backed bill aiming to reduce asbestos lawsuit fraud that could receive a vote Thursday.

The advocates, led by the Environmental Working Group (EWG) Action Fund, claim the so-called Furthering Asbestos Claim Transparency (FACT) Act would expose more of Americans’ personal data to cyber criminals.

“The FACT Act would create conditions that are ripe for scam artists and identity thieves to prey on all victims of asbestos exposure who have filed claims with trusts established to ensure compensation for harm caused by asbestos corporations,” they said in a letter sent to House members Tuesday.

The bill’s proponents, such as Rep. Blake Farenthold (R-Texas), have roundly rejected the argument.

They insist the measure is a necessary step to better track payouts from asbestos trusts set up to compensate workers and family members injured by a company’s manufacturing of asbestos. Additionally, they say, nearly all people filing claims with asbestos trusts have already filed asbestos lawsuits, which require them to disclose similar personal data.

To read our full piece, click here.

LIGHTER CLICK:

–OF ALL THE GIN JOINTS IN ALL THE WORLD. We’re journalists, which means we probably have a quiet drinking problem, and we’re tech journalists, which means we like robots (well, one of us does), so this robotic drinking companion is right up our alley. Tune in next week for the hacking reports.

Read on, here.

A FEATURE IN FOCUS:

–COVERT OPERATION. In the summer of 2015, the FBI used a hacking tool to identify users of a child pornography site, ultimately charging two men.

Although the case received some media attention at the time, the scope of the FBI’s hacking apparatus appears to have been much more extensive than originally estimated.

Citing court documents and interviews with legal parties involved in the case, Motherboard reports that the agency hacked over 1,000 computers to bring down one of the largest child pornography sites on the dark Web.

“This kind of operation is simply unprecedented,” Christopher Soghoian, principal technologist at the American Civil Liberties Union (ACLU), told Motherboard.

Read on, here.

WHO’S IN THE SPOTLIGHT:

–THAI POLICE. Unknown hackers have crippled multiple Thai police websites to protest the trial of two Myanmar migrant workers who were sentenced to death last month for murdering a pair of British tourists.

A 37-minute video posted to the Facebook page of the hacking group Anonymous on Sunday questioned how the case was handled and cast doubt on the competency of the Thai police force.

The group claimed 14 sites were disabled. Nine were still unavailable on Tuesday, according to Reuters.

Some of the hacked sites contained displays of the words “Failed Law,” “We Want Justice” and the hashtag #BoycottThailand, as well as the name of a Myanmar-based hacking group known as “Blink Hacker Group.”

A Thai court sentenced Zaw Lin and Win Zaw Tun to death on Dec. 24, in a case that has drawn allegations of police incompetence, mishandling of evidence and torture.

The verdict has sparked protests in Myanmar that forced the Thai embassy in Yangon to close, as well as outcry on social media. Protesters believe the two defendants are being used as scapegoats.

To read our full piece, click here.

IN CASE YOU MISSED IT:

Links from our blog, The Hill, and around the Web.

Harman International, maker of the popular JBL speakers, has agreed to buy automotive cybersecurity firm TowerSec. (The Hill)

Britain’s biggest bank, HSBC, said Tuesday that hackers aren’t responsible for a mobile and online banking outage that has now lasted two days. (The Hill)

The Air Force wants to simulate cyberwar in a virtual environment. (Fierce Government IT)

A Q&A examining whether the encryption debate is a proxy fight for a larger problem. (Motherboard)

A security flaw in smart home technology sold by Comcast could allow would-be burglars to disable door and window alarms using radio-jamming attacks, research shows. (The Security Ledger)

If you’d like to receive our newsletter in your inbox, please sign up here: http://goo.gl/KZ0b4A