FBI takes aim at cyber crime infrastructure

FBI Director Christopher Wray at the fourth annual Boston Conference on Cyber Security, held at Boston College this month. (Photos by Lee Pellegrini)

“We don’t want to just keep the cyber criminals at bay, we want to burn down their infrastructure,” FBI Director Christopher A. Wray told an audience of several hundred cybersecurity experts gathered at Boston College on March 4, in an address that focused on the comprehensive, innovative, and broadly collaborative approach needed to combat an increasingly complex and widespread threat.

Wray delivered the keynote address at the fourth annual Boston Conference on Cyber Security, BCCS 2020, organized through a partnership between the FBI and the M.S. in Cybersecurity and Governance Program of BC's Woods College of Advancing Studies to seek better ways to defend against these invasive cyber threats and respond to the vulnerability of U.S. information systems.

Cyber crime continues to grow in scope, complexity, and sophistication, Wray told the gathering, and its impact has deepened, making it a powerful weapon for a range of “threat actors,” from multi-national cyber syndicates to nation-state adversaries.

“We can’t just fight this threat one by one: One bad guy at a time, one syndicate at a time, one victim company at a time,” he said. “We’ve got to tackle the cyber threat as a whole, applying our capabilities, our intelligence, and our partnerships to their full extent."

Wray's remarks to the capacity crowd in Gasson Hall focused on the cyber threat writ large, and the spectrum of ways in which the FBI addresses it.

Concerns he cited include a wider-than-ever gamut of methods continually employed in new ways…like the targeting of MSPs—managed service providers—as a way to access scores of victims by hacking just one provider, a technique pioneered in China but now used by criminal hackers.

In addition, he said, "we face the increasingly blended threat of state-sponsored economic espionage facilitated by cyber intrusions. More than ever, our adversaries’ targets are our nation’s core economic assets—our information and ideas, our innovation, our research and development, our technology."

No nation poses a broader, more severe threat to those assets than the Chinese government, he said. "They’re not just targeting companies related to our defense industry, they’re targeting companies producing everything from proprietary rice seeds to software for wind turbines to high-end medical devices. And they’re not just targeting innovation and R&D—they’re going after cost and pricing information, internal strategy documents...anything that can give them a competitive advantage.”

Nation-state threats from China, Russia, Iran, North Korea and others also include efforts to obtain controlled defense technology and develop the ability to use cyber means to complement any future real-world conflict. But as dangerous as nation-states are, said Wray, the threat also comes from increasingly sophisticated criminal groups, with hackers on a level previously only seen among government operatives.

Befitting the scope of the danger, the U.S. deploys a whole cyber ecosystem against it—and in cross-cutting law enforcement and national security authorities, the FBI is at the center of it, Wray said, citing as an example its work in the 2018 SamSam Ransomware indictment.

"SamSam was sophisticated malicious software used to hack into the networks of hospitals, schools, companies, government agencies, and a number of other entities, and to encrypt their computers. There were more than 200 victims—including the City of Atlanta, the Port of San Diego, and MedStar Health.

"To identify the actors, we needed more than just our own intelligence. We needed information from victims across the country, and intelligence and investigative information from foreign partners and private sector entities who were also tracking SamSam. With all those pieces of the puzzle, we were able to attribute the attack to two Iranians.

"More puzzle pieces helped us determine the actors were working for personal profit, rather than on behalf of the Iranian government. [The Department of Justice] unsealed an indictment in November 2018. And the investigation also enabled the Treasury Department to issue sanctions against two bitcoin exchangers, and for the first time warn the private sector about some of the criminals’ virtual currency addresses.

"Since the indictment and sanctions, we haven’t seen any SamSam activity. Partnerships are what made all of this possible," Wray said.

Today's threats are too diverse, too dangerous, and too all-encompassing for any agency to tackle alone, he said. "We’ve got to figure out how we can match strengths...that's the essence of the most effective partnerships.

"People should be able to say 'there’s no better partner' than the FBI," Wray said.

The themes emphasized in the FBI director's keynote address—the importance of partnerships across fields and disciplines, and sharing of innovation, intelligence, and expertise—were reflected in remarks and breakout sessions throughout BCCS 2020. Inaugurated in 2017 to encourage just this sort of collaboration, the annual conference, said Wray, "has become one of the most unique gatherings of voices, thinkers, and policy makers in the cyber realm. It’s one we’re really proud to be a part of at the FBI.”

Wray's remarks were followed by speakers including Mike Cote, president and CEO of SecureWorks; Helen Dixon, Ireland's commissioner for data protection;  and John C. Demers, U.S. assistant attorney general for national security. Panel discussions focused on emerging technologies, operations, enforcement, as well as actual cyber and national security experiences related to risk, compliance, policy, threat trends, preparedness, resilience, and defensive strategies.

Cybersecurity specialists participating in BCCS 2020 included other FBI representatives as well as experts from the U.S. departments of Defense and Justice, U.S. Securities and Exchange Commission, Bank of America, Cisco Systems, Data Protection Commission-Ireland, Eversource, Federal Reserve Bank of Boston, Facebook, FireEye, Google, IBM Security, Jones Day, Microsoft, Liberty Mutual Insurance, Massachusetts Port Authority, Mintz Levin, National Grid, Oracle, Raytheon, and SecureWorks, among others.

BCCS 2020 co-organizer Kevin R. Powers, founding director of the Boston College M.S. in Cybersecurity Policy and Governance Program, served as master of ceremonies for the event with FBI Boston Division Special Agent Doug Domin, head of the cyber crime program, and Joanna Baltes, curriculum coordinator of BC's M.S. in cybersecurity program.

The conference co-chairs, Woods College Dean Karen Muncaster and FBI Boston Division Special Agent in Charge Joseph R. Bonavolonta, as well as Boston College Executive Vice President Michael Lochhead, also offered welcoming remarks.