Australia pledges to work internationally to reduce cybercrime

Australia has launched a new International Cyber Engagement Strategy outlining its cyber affairs agenda for the next three years as part of the deliverables of the government's A$230 million Cyber Security Strategy.

Underscored by private sector partnerships the strategy aims to create an environment for digital trade to generate economic growth and opportunities for Australia and Australians while mitigating the risks. It also charts a path to use digital technologies to drive sustainable and inclusive development in the Indo-Pacific region.

The government will allocate an additional A$10 million to the Cyber Cooperation Program to support implementation of the strategy. A$4 million was provided last year.

According to the government, most cybercrime affecting Australians originates overseas, driving Australia to engage internationally to shut down cybercrime safe havens. The strategy aims to foster good cyber security practices in the region and improve regional capacity to respond to global cyber incidents.

"We encourage all Australians to read the International Cyber Engagement Strategy and to recognise the breadth of benefits a stable and secure cyberspace can bring to personal, business, community and international wellbeing," said the Honourable Julie Bishop MP, Minister for Foreign Affairs and the Honourable Dan Tehan MP, Minister Assisting the Prime Minister for Cyber Security, in a joint statement.

The strategy outlines an approach across seven key themes: digital trade, cybersecurity, cybercrime, international security, Internet governance & cooperation, human rights & democracy online, and technology for development, plus coordinated cyber affairs. A Foreign Policy White Paper, currently under development, will reiterate how cyber issues affect Australia's foreign policy. Specifically:

Source: Australia International Cyber Engagement Strategy website. The key themes for the International Cyber Engagement Strategy.

Digital trade

Australia aims to maximise the opportunity for economic growth and prosperity through digital trade. The country will:

- Shape an enabling environment for digital trade, including through trade agreements, harmonisation of standards, and implementation of trade facilitation measures

- Promote trade and investment opportunities for Australian digital goods and services

Cybersecurity

Here, Australia is aiming for a strong and resilient cyber security posture not only for Australia but also for the Indo-Pacific and the global community. The country will:

- Maintain strong cybersecurity relationships with international partners

- Encourage innovative cybersecurity solutions and deliver world leading cybersecurity advice

- Develop regional cybersecurity capability

- Promote Australia's cybersecurity industry

Cybercrime

Australia wants to achieve stronger cybercrime prevention, prosecution and cooperation, with a particular focus on the Indo-Pacific. The country will:

- Raise cybercrime awareness in the Indo-Pacific

- Assist Indo-Pacific countries to strengthen their cybercrime legislation

- Deliver cybercrime law enforcement and prosecution capacity building in the Indo-Pacific

- Enhance diplomatic dialogue and international information sharing on cybercrime

International security

The goal is for a stable, peaceful online environment. The country will:

- Set clear expectations for state behaviour in cyberspace

- Implement practical confidence building measures to prevent conflict

- Deter and respond to unacceptable behaviour in cyberspace

Internet governance & cooperation

Australia will work towards an open, free and secure Internet, achieved through a multi-stakeholder approach to Internet governance and cooperation. The country will:

- Advocate for a multi-stakeholder approach to Internet governance that is inclusive, consensus-based, transparent and accountable

- Oppose efforts to bring the management of the Internet under government control

- Raise awareness across the Indo-Pacific of Internet governance issues and encourage engagement of regional partners in Internet governance and cooperation discussions

Human rights & democracy online

Australia states that human rights apply online, as they do offline. The country will:

- Advocate for the protection of human rights and democratic principles online

- Support international efforts to promote and protect human rights online

- Ensure respect for and protection of human rights and democratic principles online in all Australian aid projects with digital technology components

Technology for development

The priority will be to use digital technologies to achieve sustainable development and inclusive economic growth in the Indo-Pacific. The country will:

- Improve connectivity and access to the Internet across the Indo-Pacific, in collaboration with international organisations, regional governments and the private sector

- Encourage the use of resilient development-enabling technologies for e‑governance and the digital delivery of services

- Support entrepreneurship, digital skills and integration into the global marketplace

Comprehensive & coordinated cyber affairs

To keep to this agenda Australia will:

- Enhance understanding of Australia's comprehensive cyber affairs agenda

- Increase funding for Australia's international cyber engagement activities

- Coordinate and prioritise Australia's international cyber engagement activities


"Our international cyber engagement protects Australians and promotes our interests. It positions us to harness opportunities and increase our cyber resilience. An open, free and secure Internet drives economic growth, enhances our national security and fosters international stability," said Bishop in a foreword to the strategy.

Palo Alto Networks, the security company, announced that it will support the capacity-building efforts of Australia’s International Cyber Engagement Strategy with new business engagement initiatives businesses in the region. The project aims to raise the understanding of cybersecurity as a business risk within C-suites in ASEAN countries.

"You will note throughout this strategy that partnership is the watchword. The Australian government appreciates that, to deliver on our ambition to increase regional cyber capacity, we need innovative partnerships with the private sector.

"Palo Alto Networks will conduct technical and other cybersecurity training for ASEAN businesses in partnership with industry and this will complement the initiative to translate our very own Australian Signals Directorate’s world-leading, ‘Essential Eight mitigation strategies’," said Bishop.

"In order for the market to reach its full potential, we must combat cybercrime and help close digital divides in the region. This is a joint effort, requiring businesses and governments to share information and collaborate. That’s why Australia’s new international Cyber Engagement Strategy emphasises partnering with the private sector, and companies like Palo Alto Networks, who are at the frontline of helping businesses understand and mitigate the cyberthreats they face," said Dr Tobias Feakin, the first Australian Ambassador for Cyber Affairs.

"Cybersecurity is a culture that every organisation needs to build, strengthen and foster across all levels of the business. It is essential that leaders ensure cyber risk is considered among their organisation’s overall risk management strategy. Palo Alto Networks aims to educate and empower business leaders to make informed decisions on managing cyber risks so that they can run their organisations securely while preventing material impact to them from successful cyberattacks," added Sean Duca, VP and Chief Security Officer, APAC, Palo Alto Networks.

Palo Alto Networks describes behaviour of XBot Android trojan

Palo Alto Networks has recently discovered 22 Android apps belonging to a new Trojan family called Xbot. This Android Trojan is regularly updated and is capable of multiple malicious behaviours.

Xbot tries to steal victims’ banking credentials and credit card details via phishing pages crafted to mimic Google Play’s payment interface as well as the login pages of seven different banks’ apps. In Asia Pacific, only users in Australia have been targeted, along with Android users in Russia elsewhere in the world. Importantly, of the seven bank apps Xbot seen to imitate, six belong to some of the most popular banks in Australia.

While this malware does not appear to be widespread, Palo Alto Networks researchers observed the author making regular updates and improvements indicating that this malware could soon threaten Android users across the world.

Apart from stealing banking and credit card details, this malware can also remotely lock infected Android devices. It can encrypt the user’s files in external storage such as SD cards and demand a US$100 PayPal cash card as ransom. In addition, Xbot can also steal all SMS messages and contact information, intercept certain SMS messages, and analyse SMS messages for mTANs (mobile transaction authentication numbers) from banks.

Xbot primarily uses a popular attack technique called activity hijacking by abusing some features in Android. It is important to note that the apps Xbot mimics are not themselves being exploited. Starting with Android 5.0, Google adopted a protection mechanism to mitigate this attack but other attack approaches used by Xbot are still affecting all versions of Android. Xbot was implemented in a flexible architecture that could be easily extended to target more Android apps.

While Android users running version 5.0 or later are so far protected from some of Xbot’s malicious behaviours, all users are vulnerable to at least some of its capabilities. As the creator appears to be putting considerable time and effort into making this Trojan more complex and harder to detect, it’s likely that its ability to infect users and remain hidden will only grow, and that the attacker will expand its target base to other regions around the world.

Palo Alto Networks recommends using preventive security measures that automatically detect unknown malware and generate protection sets before an enterprise or device is compromised.  Customers can also refer to IPS signature (13997) for details about Xbot C2 traffic information. 

Interested?

Read the blog post about XBot from Palo Alto Networks

posted from Bloggeroid

Your jailbroken iOS device may be compromised

In cooperation with WeipTech, a technical group consisting of users from Weiphone, Palo Alto Networks, the security company, has identified 92 samples of a new iOS malware family that is currently active.

The malware, named KeyRaider, targets jailbroken iOS devices and is distributed through third-party Cydia repositories in China. In total, it appears this threat may have impacted users from 18 countries including China, Singapore, Japan, South Korea, and Australia. Some victims have reported that their stolen Apple accounts show abnormal app purchasing history and others state that their phones have been held for ransom.

Palo Alto Networks estimates that the 225,000 valid Apple accounts with passwords stored in on a server is the largest Apple account theft caused by malware. The malware steals Apple account usernames, passwords and other sensitive information by intercepting iTunes traffic on the device. The data is used to download applications from the official App Store and make in-app purchases without actually paying. According to Palo Alto Networks, around 20,000 users are abusing the 225,000 stolen credentials.

Source: Palo Alto Networks blog.
Phone held for ransom.

Palo Alto Networks and WeipTech have provided services to detect the KeyRaider malware and identify stolen credentials. 

WeipTech has provided a query service in their website for potential victims to query whether their Apple accounts have been stolen. 

Palo Alto Networks has also protected its customers. The company also suggests that all affected users change their Apple account password after removing the malware, and that they enable two-factor verification for Apple IDs.

Interested?

The Palo Alto Networks blog post lists a method to check if an iOS device is infected (search for the phrase 'protection and prevention')