Nel silenzio pressoché generale e nell’indifferenza della comunità di addetti al settore della cyber security, a Perugia si sta svolgendo un processo che inizialmente prometteva di fare molto rumore, essendo coinvolti in prima battuta un procuratore romano e illustri esponenti delle nostre forze di polizia. Un processo che ora, esaurita la sua carica propulsiva, langue in una dimensione che sfida il grottesco, al punto che ci si chiede per quale motivo sia ancora in piedi. Ciò nonostante, è senza dubbio un processo che impone dei seri interrogativi sulla natura, il ruolo e i limiti di un settore tanto strategico quanto poco conosciuto come quello della cyber sicurezza. Stiamo parlando della vicenda che vede protagonista Federico Ramondino, stimato professionista del settore, quello che potremmo definire un “hacker etico”. Ma per spiegare cosa l’abbia portato a processo a Perugia occorre fare un salto indietro di qualche anno.

In principio era l’occhio della piramide

Tutto ha inizio nel 2016. Ramondino ottiene un incarico di consulenza da Enav per analizzare il contenuto di una mail sospetta. L’analisi che segue porta il tecnico a riscontare non solo la presenza di un malware, ma a riconoscere in quello inviato ad Enav lo stesso virus che aveva tentato di infettare qualche anno prima l’Eni. Anche in quel caso, Ramondino era stato chiamato come consulente e aveva già dato un nome al malware con cui adesso si ritrova a dover fare i conti: Eye Pyramyd.

Enav fa partire una segnalazione che arriva al Cnaipic [Centro nazionale anticrimine informatico per la protezione delle infrastrutture critiche], che a sua volta informa la Procura di Roma e, nello specifico, il dott. Eugenio Albamonte. Data la sua esperienza pregressa e le ottime referenze, stavolta è la procura a dare incarico di consulenza a Federico Ramondino, cui viene sostanzialmente chiesto di fare luce sulla natura di un malware che, come si scoprirà di lì a poco, da circa dieci anni esfiltra dati sensibili un po’ ovunque.

La più grande operazione di cyber spionaggio in Italia

Quando Ramondino e gli uomini del Cnaipic si mettono al lavoro per ricostruire la diffusione di Eye Pyramyd si trovano di fronte alla più grande e longeva operazione di cyber spionaggio mai scoperta in Italia. Migliaia i dispositivi infettati, centinaia di professionisti di vario ambito spiati, una quantità difficilmente quantificabile quella dei dati esfiltrati da enti istituzionali, pubblici o infrastrutture critiche: si passa dal ministero dell’Interno e da quello degli Esteri, si arriva al Porto di Taranto e alla Regione Lazio. Una lista lunga che fa temere che dietro questa operazione vi sia l’interesse – e la mano – di qualche Stato estero. Dopotutto, cosa se ne farebbe un privato di questa mole di dati e informazioni trafugate?

Poi il colpo di scena: indagando sulla natura del malware si arriva a individuare due professionisti, fratello e sorella, ingegnere nucleare lui, amministratrice di diverse aziende di stampo familiare lei. Secondo gli investigatori, in particolare, è l’ingegnere ad aver creato e diffuso il malware. Stiamo parlando di Giulio e Francesca Maria Occhionero.

La denuncia di Occhionero

Partono le indagini a carico dei due e nei primi giorni di gennaio 2017, con un’accelerazione improvvisa che lascia interdetti anche alcuni investigatori, il procuratore Albamonte dispone il loro arresto. Giudicati colpevoli in primo grado, Giulio e Francesca Occhionero ottengono rispettivamente cinque e quattro anni, ma entrambi resteranno in prigione poco più e poco meno di un anno. Proprio dal carcere di Regina Coeli in cui si trova ristretto, Giulio Occhionero passa al contrattacco, denunciando presso la procura di Perugia – competente per le vicende che coinvolgono magistrati romani – il pm Eugenio Albamonte e gli agenti del Cnaipic Ivano Gabrielli, Federico Pereno, Francesco Saverio Cappotto. Solo in un secondo momento, nel registro degli indagati finisce anche Federico Ramondino.

Le accuse mosse da Occhionero passano dal complotto ai suoi danni per opera di non meglio specificati settori dei servizi segreti a lui ostili, all’accesso abusivo a sistema informatico. In mezzo viene tirato il Russiagate, l’FBI, le mail di Ilary Clinton. A dover rispondere di fronte alla giustizia, adesso, ci sono le persone che hanno disarticolato la rete spionistica intessuta da Eye Pyramyd.

Il processo di Perugia

Quando inizia il filone perugino della vicenda, procuratore capo è Luigi De Ficchy. Il caso viene affidato alla pm Gemma Miliani e alla giudice Sonia Grassi. Come anticipato, si prospetta un processo rumoroso, ma dopo le indagini preliminari tutto si sgonfia: Le posizioni di Albamonte, Gabrielli, Pereno e Cappotto vengono archiviate nell’autunno del 2018 e quando si finisce in aula, a dover rispondere alle accuse di Giulio Occhionero c’è solo Federico Ramondino, oggettivamente il soggetto più debole, che si trova non solo a dover difendere il lavoro svolto per conto della procura di Roma, ma anche a respingere le accuse che, in filigrana, sembrano volte a dimostrare che la paternità del malware sia riconducibile a lui.

Ad aggravare la sua posizione, una consulenza tecnica che l’accusa affida a Giovanni Nazzaro, ingegnere delle telecomunicazioni, stimato esperto di intercettazioni telefoniche. Una scelta senz’altro curiosa, quella della procura di Perugia. Nazzaro infatti non è un esperto nella materia oggetto del processo, ma soprattutto, l’ingegnere ha forti collegamenti professionali proprio con il Cnaipic.

La cosa non sfugge a Giulio Occhionero che, infatti, sin dall’inizio critica questa scelta, definendo in una mail inviata alla procura di Perugia il consulente come “fiancheggiatore” di Eugenio Albamonte.

La difesa di Ramondino e il fronte dell’accusa spaccato

Il processo comunque comincia e, ben presto, inizia ad arrancare. I media se ne disinteressano, così come la comunità di addetti del settore. Giulio Occhionero, parte civile e promotore di questo processo, non si è mai presentato in aula nonostante i ripetuti inviti in tal senso, preferendo restarsene a Dubai, dove si è trasferito dopo la scarcerazione e dove attende il suo processo di Appello a Roma. In una delle ultime udienze, nel dicembre 2023, la stessa giudice ha tentato di mettere fine a questa storia proponendo un accordo tra le parti che, prese alla sprovvista, hanno deciso di andare avanti.

La prima udienza del 2024 ha visto la difesa di Ramondino impegnata nel controesame del consulente tecnico dell’accusa. L’avvocato Mario Bernardo, supportato da Ramondino, ha smontato punto per punto la consulenza di Nazzaro che, non senza difficoltà, ha difeso il suo lavoro in solitudine, senza una sponda da parte della pm Miliani, che proprio nell’udienza precedente, al termine della stessa, si era lasciata sfuggire una battuta amara che però racconta molto dell’equilibrio ormai fragile del fronte dell’accusa, commentando una lettera inviata da Giulio Occhionero in cui l’ingegnere critica duramente le indagini della procura di Perugia che, secondo lui, si è fatta sfuggire i pesci grossi.

Chissà se qualcosa cambierà nel corso della prossima udienza, attesa per il 28 febbraio. Federico Ramondino e il suo avvocato proseguiranno con il controesame di Nazzaro, nel tentativo di dimostrare che nella sua consulenza vi siano inesattezze e cose non vere. D’altro canto, è ipotizzabile che stavolta il fronte dell’accusa si ripresenti più unito rispetto all’ultima volta.

Un caso che deve fare scuola

Ad ogni modo, quale che sia l’esito del processo e le strategie che le parti metteranno in campo, una cosa è certa: questo processo, per quanto kafkiano e ormai privo di slancio, segna un passo importante. Oggi che quello della cyber security è diventato un settore strategico e in piena crescita, si rende necessario regolamentare in modo chiaro il lavoro dei vari esperti del settore chiamati a fare da consulenti, come nel caso di Ramondino, dallo Stato. Occorre rivedere le garanzie da mettere sul piatto, affinché nessuno che operi per conto delle istituzioni debba poi trovarsi a dover giustificare il lavoro svolto. Il tema è scivoloso e si presa a interpretazioni diverse, ma prima o poi andrà affrontato. O si arriverà al punto che più nessuno vorrà collaborare con una procura con il rischio di vedersi poi risucchiato da un meccanismo che ha a che fare più con giochi di potere che con altro.

L'articolo Cyber spionaggio, caso Occhionero: racconto di una storia italiana proviene da InsideOver.

The criminal world has gone digital. Crime syndicates are sinking their dirty teeth into cybercrime and today it is the fastest growing criminal activity on earth.

Trillions of Dollars are at Stake

Accenture, considered one of the world’s top companies, numbers digital and technology consulting in its stable of services. The firm predicts businesses will lose US$5.2 trillion to cybercrime globally over the next five years.

Cue the mafia and other nefarious organizations. Cyberattacks cost businesses from large to small on average $200,000 annually, according to Hiscock, a commercial liability insurance company. And the little guy is the easiest target.

Most Businesses Woefully Unprepared for Cyberattacks

Small businesses account for almost half of online attacks – 43 percent – but they are woefully unprepared to stave off breaches because only 14 percent have the technology shield to counter the assaults.

“Modern IT infrastructures are more complex and sophisticated than ever and the amount of virtual ground that we’ve got to safeguard has also grown exponentially,” said Jesse Rothstein of security provider ExtraHop. “…(C)yber criminals can launch thousands of digital attacks designed to compromise our operations at every turn, only one of which ever needs to connect to cause serious disruptions.”

But while large companies are the prime organized crime targets, individuals do not escape notice and while the coronavirus pandemic is a plague to most, to syndicates like the mafia it is a blessing, presenting an opportunity to defraud. From March to May in Canada this year, organized crime swindled individuals out of CAN$1.9 million.

The most common method of bilking people is through email or text messages where the recipient clicks on a link to collect the $2,000 a month the federal government offers to those who have lost jobs to the pandemic. The link takes individuals to a phony website asking for financial information, or it could allow the intrusion of malware that can steal, encrypt, delete or hijack data, leading to financial theft.

Cosa Nostra Goes Online

Italy has had its share of cybercrime courtesy of the world’s most infamous crime syndicate.

In May of this year, 91 suspected mobsters were collared by police probing money-laundering and extortion. Authorities were attempting to stop Sicily’s Cosa Nostra from bilking people who were suffering financially due to the coronavirus.

In one conversation recorded by police, a man said “look, we pay cash” for businesses hard hit by the pandemic. The mob was trying to buy legitimate businesses at bargain basement prices so as to illegally launder dirty money gleaned from extortion and drug trafficking.

Gangs also hold businesses for ransom – hence the name ransomware, a malicious software that infects a computer and restricts access until money is paid to unlock it.

In Israel, the chip wear maker Tower – the computer chip used for processors, memory and other information functions – came under ransomware attack and had to shut down some production systems and its IT systems were damaged, the Israeli newspaper Haaretz reported in August. A publicly-traded company with second-quarter earnings of US$310 million, one day of lost work would cost the company an estimated $3.4 million.

Hackers demanded money and Tower’s insurance company said pay up.

Insurance Company Advises Firm To Pay Ransom

“Its insurance company encouraged paying the ransom, which is estimated at several million dollars,” Einat Meyron, who advises companies on cybersecurity and is well acquainted with this attack, as reported by Haaretz. “It definitely wasn’t $250,000, as has been reported in several places.”

The mafia is becoming so pervasive in cyber crime that its involvement is now known as the “New Mafia.” The mafia has hired cybersmart engineers to hack and uncover where shipments of specific goods are being readied for shipment, then sends in drivers in their own trucks to haul the goods away.

The Internet is also used to help facilitate and plan various crime operations.

Brazilian Gangsters Running Drug Networks from Jail Cell Computers

In Brazil, the Primeiro Comando da Capital (PCC), Sao Paulo’s mafia corporation is using smart phones so members of its council can call the shots from their prison cells. Sao Paulo prosecutors seized two laptops of senior syndicate members and discovered Excel spreadsheets showing the entire cocaine distribution network for the metropolitan area.

Included was the identity of those marked for punishment – and sometimes death – due to embezzlement or not fulfilling their promised participation in crime.

An Expanding Crime Network

In 2018, 30,000 people were members of the PCC and new recruits were joining each day, reported Rolandburger.com, a respected American-based management consulting firm with 50 offices in 39 countries. The PCC is spreading to other South American countries.

Perhaps Malwarebytes, the ubiquitous anti-virus Internet security company, best sums up today’s evolving criminal use of the internet. “What was once the reserve of hobbyists and enterprising individuals has taken a more sinister turn as the world has become more interconnected.

“In the last decade, cybercrime has evolved from computer viruses that commandeered a select number of PCs to spectacular security breaches and cyberattacks that exceed the imagination. The Internet has allowed criminals to send tentacles out all over the world while sitting in comfort thousands of miles away. A new day has dawned for organized crime.

L'articolo The “New Mafia” Takes Crime Online proviene da InsideOver.

In February, US Attorney General William Barr argued China’s robust buildup of 5G communications networks and technology is one of America’s greatest national security threats. That conclusion came as little surprise for industry experts and intelligence analysts who have honed in on the implications of the new technology. The common takeaway from them is that 5G is here, the US is losing the race to China, and as a result, America might not be prepared for modern-day warfare.

What is 5G?

Put simply, 5G is the next phase of wireless networks. Every four or five years, technology companies rollout new protocols that enable faster data speeds — up to 100 times faster once fully implemented. In the case of 5G, the gap between it and its predecessor, 4G, is longer than that of the previous generation.

While 4G was standardized in 2008 by the International Telecommunications Union (ITU), 4G-enabled devices didn’t hit markets until a few years later. The first 4G iPhone, for example, didn’t arrive until 2012. Although tech companies coordinate with the ITU to develop standards, thus ensuring devices from different manufactures are compatible with each other and a wide range of operators, creating chips to enable the technology is another mission entirely.

All About the Chips

Manufacturers must design or outsource the design for the computer chips, produce them in sufficient quantities, and ensure they don’t drain battery life too fast. That last point is the largest barrier to the speedy deployment of new network protocols like 5G — the first chips of any generation are power hungry. It’s for this reason that Apple often delays its adoption of new network technology for a year or two after Android smartphone producers.

5G brings another benefit in addition to faster data speeds — it allows a greater number of devices to connect at one time. This is crucial for the new Internet of Things (IoT) industry. Everything from microwaves to doorbells and automobiles is connected to the internet these days. 5G allows a greater number of devices to connect because it boasts a higher bandwidth than its predecessor. This can be equated to driving down a two-lane road versus a four-lane highway.

Latency, the amount of time it takes for a device to connect to a cellphone tower and receive a response, is vastly improved. The practical implications for the technology open doors to use cases previously unthought of, such as a jet engine manufacturer that implemented 5G to detect production errors.

As a result, mobile networks will be less congested, thereby enabling stronger coverage for consumers. However, the benefits of 5G are also their weaknesses which present challenges that governments must overcome.

Security Risks

The more devices that connect to the internet, the more opportunities hackers have to force their way into a network, the Brookings Institute reported. Also, due to the nature of 5G technology, networks are different from a hardware standpoint. While previous network protocols featured a centralised hub through which traffic was routed, 5G is built on software routing that is spread across the network.

The over-reliance on software to manage 5G networks presents vulnerabilities that didn’t exist or were minimized with previous iterations of wireless technology.

“In a world of interconnected networks, devices, and applications, every activity is a potential attack vector. This vulnerability is only heightened by the nature of 5G and its highly desirable attributes,” Tom Wheeler, former chairman of the US Federal Communications Commission, and David Simpson, former chief of the Public Safety and Homeland Security Bureau, wrote for Brookings.

A lack of cybersecurity investment by US businesses and a “cumbersome” FCC process to establish new rules hindered attempts to  be proactive about locking down new 5G technology.

Private hackers are only one concern. The greater threat is state and state-backed cyber warfare. China, North Korea, Iran, and Russia have all made successful attempts to infiltrate US networks. The threat is serious enough that the Pentagon, no longer content with playing defence against hackers, authorised US Cyber Command to go on the offensive against foreign governments. Cyber Command has largely focused on disabling communications systems and eliminating cyber warfare capabilities of adversaries.

5G Turns Political

“We have evidence that Huawei has the capability secretly to access sensitive and personal information in systems it maintains and sells around the world,” said US National Security Adviser Robert O’Brien in February.

The allegation was the latest in a year-long battle between the US government and Chinese tech conglomerate Huawei. Specifically, the Trump administration accused the business of building backdoors into their network equipment. Together, Huawei and China-based ZTE have built 40% of the world’s 5G network infrastructure.

American officials decided to ban Huawei and ZTE, citing national security, barring American businesses from using them to build their 5G networks with Chinese equipment. In May, he extended the order for another year. Trump and Secretary of State Mike Pompeo have also engaged in a concerted campaign to compel allies to ban the companies in their states under threat of reducing intelligence cooperation.

“Our economic future is at stake,” Barr said in February. “The risk of losing the 5G struggle with China should vastly outweigh other considerations.”

For America, the 5G war with China is a race to own the technology and dominate the industry to lock out Beijing, but the US is presently losing. American companies simply don’t offer the technology that Huawei does, and certainly not at its low prices. Instead, US networks have to look to European-based Ericsson and Nokia, both of which have picked up substantially more contracts following international backlash against Huawei.

To be clear, allegations against Huawei and ZTE have thus far been unfounded. Technology experts have never uncovered supposed backdoors. However, with US–China relations broken down and recent Beijing-backed cyber espionage attempts, the Trump administration is unlikely to relent.

Beijing’s Hacking Highlight’s US Trust Issues 

On May 13, the US Federal Bureau of Investigation and Department of Homeland Security alerted healthcare companies that China is attempting to hack COVID-19 research data. 

“These actors have been observed attempting to identify and illicitly obtain valuable intellectual property (IP) and public health data related to vaccines, treatments, and testing from networks and personnel affiliated with COVID-19-related research,” the agencies wrote. “The potential theft of this information jeopardizes the delivery of secure, effective, and efficient treatment options.”

Beijing’s actions do little to inspire confidence in Washington and will only hurt its tech companies seeking to export their 5G technology. Even if Huawei and ZTE are innocent, their government is not and that has transformed 5G networks into a political issue.

Finally, as a Barr said, 5G network deployment represents the first time America has lagged behind on the global stage. That realisation, that China has access to faster, more reliable networks before the US, hurts perhaps more than threats of cyber warfare because US President Donald Trump’s motto is “make America great again.”

5G Delayed

All of these factors mean that 5G networks and equipment will be delayed in the US. While some operators have branded their latest offerings as “5G,” the truth is that they are usually downscaled version. True 5G uses a technology known as “millimetre wave,” but access to this coverage is highly limited.

Instead operators are making smaller improvements and simply labeling it as 5G. AT&T, for example, has even rebranded a subsegment of its 4G network to call it “5GE.”

For a true network progression to 5G in the US, the political issues between Washington and Beijing need to be resolved or American companies must begin developing their own infrastructure solutions. Even then, the new security risks of 5G mean that companies and consumers must take greater precautions as they connect their devices to the new generation networks.

L'articolo Why Has 5G Become a Political Issue proviene da InsideOver.