The SIGNAL Blog

Sandia National Laboratories has signed an umbrella Cooperative Research and Development Agreement (CRADA) with Caterpillar Incorporated that covers multiple projects over the next three years. Though Caterpillar is best known for large construction and mining equipment, the CRADA authorizes work in computer and computational science, information and data analysis, mathematics, engineering science and high-performance computing. Technical categories covered by the agreement include simulation design exploration, advanced analytics, multiphysics engineering modeling and simulation, and high-performance computing. Caterpillar is seeking help from Sandia to develop advanced modeling and simulation technologies for virtual product development. Sandia has several technology partnership options that industry, nonprofits, government and academia can use to access the laboratories’ resources.

The malware that infiltrated computer systems across South Korea’s banking and television broadcast industries on March 20 shares similarities with the Shamoon program used last year to wipe clean the hard drives of 30,000 Saudi Aramco workstations, according to experts at General Dynamics Fidelis Cybersecurity Solutions. Investigators at the company’s newly-opened cyber forensics laboratory in Columbia, Maryland, say the malware is not a Shamoon variant, but that the two programs share some characteristics.

Company officials acknowledge the speculation that North Korea launched the attacks but did not comment on the program’s origin. It is not unusual, they say, for a criminal group or nation to use malware that deliberately mimics attacks used by others. Doing so, of course, casts suspicion elsewhere, helping to mask the malware’s true origins. “A number of commercial firms were hit with a somewhat similar attack. It was not Shamoon. But the techniques were somewhat similar,” says Jim Jaeger, the company’s vice president of cybersecurity services.

Cyber lab personnel identified the South Korea malware as “239ed75323.exe,” a malicious file capable of wiping data in disk drives. One of the areas it targets is the disk’s master boot record, without which a computer cannot load its operating system. The program writes a pattern to the disk that repeats the word “HASTATI.” Hastati is an apparent reference to a class of infantry in the armies of the early Roman Republic that originally fought as spearmen and later as swordsmen. The malware did not overwrite the entire disk, so some data can be recovered. The cyber lab experts posted their initial findings in a blog the day after the attacks.

The U.S. National Nuclear Security Administration (NNSA) began working on its Yourcloud solution about two years ago and expects to have the cloud computing solution in place by year's end. You can read more about this in "U.S. Nuclear Agency Enhances Cybersecurity With Cloud Computing
." 

One of the surprises along the way to cloud was that NNSA is not alone in the problems it needs to solve, according to Travis Howerton, NNSA chief technology officer. "When we first started putting this together, I would have thought that we were more unique than we are, but when I traveled around talking to other chief information officers and other leaders in government agencies, or even in the commercial sector, everybody's struggling with the same set of issues," Howerton observes. "In general, what surprised me is how much synergy there is in trying to solve this problem government-wide. We're happy to be part of that overall ecosystem and to share with others what we're doing that may be helpful."

Agency officials spent about a year developing a strategic plan for transformation, which includes three pillars: the NNSA Network Vision (2NV), which modernizes the current computing environment by providing a secure, mobile, agile and adaptive IT infrastructure that will allow the NNSA workforce to perform their duties from any device, anywhere, any time; the Joint Cybersecurity Coordination Center (JC3), which provides the agency a capability for understanding the health of the systems, data and network; and the Cyber Sciences Laboratory (CSL), which establishes a process through which theoretical research in IT and cybersecurity can be rapidly applied to operational computing environments.

The Regional Information Sharing Systems (RISS) Program recently implemented a simplified sign-on capability that enables federal, state and local law enforcement to collaborate.