U.S. Treasury office that administers economic sanctions has admitted that they were pwned by a “Chinese threat actor”:
Chinese government hackers breached the U.S. Treasury office that administers economic sanctions, the Washington Post reported on Wednesday, identifying targets of a cyberattack Treasury disclosed earlier this week.
Citing unnamed U.S. officials, the Washington Post said hackers compromised the Office of Foreign Assets Control and the Office of Financial Research and also targeted the office of U.S. Treasury Secretary Janet Yellen.
The department earlier this week disclosed in a letter to lawmakers that hackers stole unclassified documents in a “major incident.” It did not specify which users or departments were affected.
Asked about the paper’s report, Liu Pengyu, spokesperson for the Chinese Embassy in Washington, said the “irrational” U.S. claim was “without any factual basis” and represented “smear attacks” against Beijing.
Yeah. Right. I don’t believe anything that the Chinese have to say at this point. More on that later. Avishai Aviva, CISO, SafeBreach had this to say:
“In this latest breach of the US Treasury workstation, neither the government nor BeyondTrust, the vendor involved, provided sufficient information to understand what happened fully. This is normal for such events. Let’s peel through the layers of obscurity and get a clearer picture of what happened in this breach.
First, looking at the letter from the Treasury to lawmakers, we find this:” “gained access to a key used by the vendor to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users. With access to the stolen key, the threat actor could override the service’s security, remotely access certain Treasury DO user workstations, and access certain unclassified documents maintained by those users.” With all my years of experience, I was scratching my head at this narrative. When reading the BeyondTrust statement on their website – it became more apparent.
BeyondTrust, unironically, provides a secure method for Information Technology (IT) support personnel to provide remote support to end users. This method involves establishing a trusted connection between the support person and the end user. This trusted connection punches through traditional perimeter security controls and gives the support person full access and control over the end-user workstation.
Once inside, the support person can send documents back over that secure channel or masquerade as the end-user and send the same documents directly.
The security controls protecting the US Treasury network have no way of knowing something nefarious is happening, as the trusted connection is, well, trusted.
From the BeyondTrust website, the malicious actors used a critical vulnerability to gain unauthenticated (read as untrusted) access to the same support functionality that the authorized IT support personnel.
This incident boils down to what we refer to as a supply-chain vulnerability leading to a data breach. An Information and Communication Technology (ICT) vendor in the US Treasury supply chain had a vulnerability that was then used to extract data out of the US Treasury end-user workstations and network.
Now that we understand what happened, albeit at a high level, let’s focus on the following interesting detail – Attribution. The letter from the US Treasury indicates that this breach originated from China. It is unusual for an early notice, especially in case of such breaches, to be able to make such clear attributions. Looking through the technical details provided by BeyondTrust, we can see that the vulnerability was associated with four IP addresses. These addresses belong to DigitalOcean, a New Jersey Cloud Service Provider (CSP). This information indicates to me that the malicious actors used this cloud provider as a jumping-off point to infiltrate the BeyondTrust service and exploit the trusted connection to the US Treasury. The clear attribution suggests that the investigation was able to link these four addresses to accounts originating in China.
Last but not least, was there something that the US Treasury could have done to prevent this? The sad answer appears to be yes. Again, referring to the scant technical information BeyondTrust provided, the system administrators at the US Treasury, or the vendor likely to provide support services, failed to configure trusted locations from which the support agents could connect. We refer to this as IP Whitelisting. This failure is a critical risk with any such service. The same issue led to notable breaches in 2023 and 2024. This oversight is why we urge all service vendors, especially trusted ICT vendors, to follow the CISA Secure-by-Default guidance.”
The fact is that there appears to be enough evidence to tie China to this. Thus besides taking action to prevent these incidents from happening as this appears to be the latest attack that has been tied to China. Thus there needs to be action to make such activities something that China is less likely to carry out. And there needs to be action to make it way harder to get into supposedly secure networks.
UPDATE: Will Lin, CEO, AKA Identity adds this:
“This incident highlights two urgent, unsolved security issues today: third party vendor risk management and a lack of real-time visibility into identities. Because technology tools are built to trust valid credentials, the average identity-based breach takes over 200 days to detect.
Kudos to the US Treasury and BeyondTrust for detecting this incident and wishing the best in determining the investigation’s blast radius.”
Other World Computing Launches ThunderBlade X12 and Active Optical Cable, and Announces Thunderbolt 5 Hub General Availability
Posted in Commentary with tags OWC on January 6, 2025 by itnerdOther World Computing today announced its latest innovations: the OWC ThunderBlade X12, a game-changing professional-grade RAID solution – the next step in OWC’s TB5 solutions; and the OWC USB4 40Gb/s Active Optical Cable, for long-distance connectivity without compromising speed or reliability. OWC also announced the general availability (GA) of the OWC Thunderbolt 5 Hub, redefining workflow efficiency with its unparalleled connectivity.
OWC ThunderBlade X12
The OWC ThunderBlade X12 is the answer to Motion Picture Professionals and DITs looking for a production shuttle RAID capable of offering large amounts of storage at blazingly fast sustained speeds in a portable solution. To be more specific, the biggest problem this product solves is the need for a RAID solution compatible with RAID 5 that offers large amounts of storage at blazingly fast sustained speeds to streamline ingestion and backup times on set while also having a small footprint so that can be used as a shuttle drive. Beyond that, it’s also considered a premium editing drive for video editors and VFX artists working with cutting-edge workflows such as multi-cam sequences at 4K and 6K, 8K and 12K RAW video, or stereoscopic 360 VR (Spatial Video). It’s the ultimate shuttle RAID for production use and the premium external editing drive for cutting-edge workflows.
OWC ThunderBlade X12 – Key Features/Functionality:
The OWC ThunderBlade X12 will be available in March.
OWC Active Optical Cable
The OWC Active Optical Cable is the fastest, most powerful, and most reliable solution for cost-effective long-distance connectivity of Thunderbolt 4/3 and USB4/3/2 devices. It provides up to 40Gb/s of stable bandwidth, up to 240W of power delivery, and up to 8K video resolution at up to 15 feet. Featuring universal USB-C connectivity and optical fiber technology, it eliminates the 2-meter distance limit of traditional copper-based Thunderbolt and USB4 cables so devices can be placed further away for noise reduction, provide more convenient access, be hidden for a more aesthetic work environment, or enable more efficient cable management in professional settings.
OWC Active Optical Cable – Key Features/Functionality:
The OWC USB4 40Gb/s Active Optical Cable is now available in two lengths:
OWC Thunderbolt 5 Hub
Now generally available (GA), the OWC Thunderbolt 5 Hub is the perfect compact connectivity solution to solve the big problem of not having enough Thunderbolt 5 ports. Now you can turn a single cable connection from your machine into three Thunderbolt 5 ports and one USB-A port. With up to 80Gb/s of bi-directional data speed – up to 2x faster than Thunderbolt 4 and USB4 – and up to 120Gb/s for higher display bandwidth needs, you will redefine your productivity.
OWC Thunderbolt 5 Hub – Key Features/Functionality:
The OWC Thunderbolt 5 Hub is now generally available for $189.99
OWC will showcase these groundbreaking products and more at the following media events:
Leave a comment »