CyberWire Daily - A black market for insider information. Cisco studies data breaches. The Internet as a threat actor's R&D infrastructure.

Episode Date: February 2, 2017

In today's podcast, we hear about how criminals are recruiting company insiders, and how the black market trades insider information for illicit speculation. Cisco studies the costs and causes of data breaches, and the security industry offers reactions. Jonathan Katz from the University of Maryland describes searchable encryption. Vadim Vladimirskiy from Nerdio explains IT as a Service. The Internet seems to serve, again, as an R&D resource for threat actors. This time it's ISIS and commercial drones, but there's a lot out there for sale and trade.  Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. Criminals recruit insiders and the black market trades insider information. Cisco studies the cost and causes of data breaches. The internet as an R&D resource for threat actors, and happy Groundhog Day.

I'm Dave Bittner in Baltimore with your CyberWire summary for Thursday, February 2, 2017. The iPyramid campaign, whose alleged perpetrators are now facing prosecution in Italian court, is thought to have been aimed at gaining illicit trading advantages, and the people behind that spyware aren't alone in looking for inside information. Many criminals, however, are attempting to recruit insiders directly in various dark web forums. Researchers at Red Owl and Insights have just released a report on recruitment of insiders by criminal traders. They describe such recruiting as active and growing, with dark web forum discussions of

it nearly doubling from 2015 to 2016. An effective black market that enables rogue insiders to readily monetize what they know about their companies. It's not always direct reporting either. Some of the more sophisticated criminals are inducing compromised insiders to install spyware into corporate internal networks. Some criminals appear to be selling the information to their members as opposed to using it directly themselves.

The information on offer can be used for trading stocks, commodities, and foreign currencies. The promise is that you, the member, will know what's happening before the rest, the old promise of trading tipsters ever since stocks began being traded. Red Owl and Insights take a detailed look at one forum with the demonic name Kick-Ass Marketplace, whose impresarios do a good imitation of an aggressive retail discount site, advertising accounts, dumps, CVVs, and more, and inviting potential forum members to apply for an interview today. The insider trading racket is lucrative, at least according to the crooks managing the

kick-ass market. They say their members make more than $5,000 a month on illegal trades. Take that with a proverbial grain of salt, but there may be something to it, since the forum managers charge a one-Bitcoin cover fee for membership. That's just under $1,000. Another interesting report released this week is Cisco's 2017 Annual Cybersecurity Report. It focuses on breaches, why they occur, and what their true costs are. Breaches have become so lucrative an opportunity for criminals that we're seeing,

Cisco says, a tremendous resurgence in classical compromise techniques, especially adware and spam. Spam in particular has surged to levels not seen since 2010, some 65% of worldwide email traffic, according to Cisco. Cisco is also seeing the sort of professionalized black market red-owl in insights found when they looked at insider recruitment. In particular, Cisco is struck by the way attackers mirrored the middle management of their targets. The effects of a breach on a business can be considerable. 22% of companies that suffered a breach lost customers as a result, and almost half of the ones who did lost more than a fifth of their customer base. Some organizations find the process of running an IT operation daunting and expensive

and choose to outsource their IT. Vadim Vladimirsky is CEO of Adar Incorporated, provider of Nerdio streaming IT services. There are these core five things that every business that relies on any kind of IT leverages, and they are the servers that generally host the data, they're the desktops, which is the end user sort of mission control, that's where they run their applications and write their emails and things like that. But then there's, in every environment, there's typically a messaging and collaboration and productivity suite,

something like email and Skype for Business or Google Apps, as well as the office product, the Google Docs, to actually generate documents and spreadsheets. And then the other two services are backup and disaster recovery. And then finally, security. And obviously, security has been very much at the forefront recently, but having good data protection measures, things like antivirus and spam filtering and firewalls and a host of other services is very important.

So those are the core five technologies that are really common across all environments. And what IT as a service does is it allows you to create a packaged, integrated, comprehensive view of all of these technologies where they can be all managed together, they can play nicely with each other. When one gets upgraded, the other things don't break. And just gives you a very nice, comprehensive, cohesive view of the fundamental IT components of any small and mid-sized businesses organization. And so, you know, beyond these offerings, if I have additional things that I need to run, you know, within my system, there's possible integration with other tools as well? Absolutely. I mean, any good IT system starts with a foundation, but just the foundation doesn't provide much value.

Most businesses have accounting software, ERP software, creative suite-type products. It's a stable platform that has all the fundamentals taken care of. And then the organization can go in and add their own line of business applications, add their own data, and run any platform, any software application on top of an IT as a service platform like Nerdio. And is there a particular you know range of sizes of business that this is most suitable towards you know what we found is that the organization's in you know 10 to about four or five hundred employees generally see the most value out of and a comprehensive IT as a platform you know for smaller companies, there are lots of really small business-oriented tools

that are not as comprehensive as private cloud may be. And then for larger companies, they tend to have much more hybrid type of deployments where they have their own data center, they have some applications that absolutely have to stay on premise and they don't want to move them out into the cloud. So what we found is sort of the mid to large size of the S and the low end of the M market, you know, is where this makes the most sense and delivers the most value.

That's Vadim Vladimirsky. He's the CEO of Adar Inc. They provide the Nerdio streaming IT services. It's long been noticed that the Internet provides threat actors with a ready-made research, development and acquisition capability of a caliber formally accessible only to nation-states. This is why, FUD or no FUD, security experts fret constantly about how the bad guys are ahead of us, that the good guys are being out-innovated, and so on. Some ISIS documents recently captured in Mosul may help flesh out how this works. They indicate that the caliphate is

taking an interest in adapting commercial drones as weapons. This latest bit of information warrants a look back at a 2008 Naval Research Advisory Committee study that predicted exactly this development, in pretty much exactly this form. The committee, which was working on a topic posed by the U.S. Marine Corps, concluded, quote, credible threats to marine capabilities and gaps can be developed from imaginative combinations of commercial products. These products can be acquired via the web and And we're seeing this played out almost a decade later. the world. Commercial technologies pose a real threat, an enduring threat to marine forces, end quote. And we're seeing this played out almost a decade later. You can go to nrac.navy.mil for that report that remains surprisingly topical.

As Russia's FSB purge continues, defense intellectuals continue to apply their game theory tools to analysis of U.S.-Russian great power competition. It's almost as if we're reliving the Cold War, but then today is Groundhog Day. And of course, if you haven't already heard by now, and we hope you've been following the story as closely as we have, early this morning, Puxatawney Phil saw his shadow when he emerged from his den on Gobbler's Knob. That's six more weeks of winter. We hear it starts for us in Baltimore this weekend.

Thanks a lot, Pennsylvania. And for the rest of you, happy Groundhog Day. Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be.

Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta.

Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, Thank you. That's vanta.com slash cyber for $1,000 off. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. 24 only on Disney Plus. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach

can keep your company safe and compliant. compliant. Joining me once again is Jonathan Katz. He's a professor of computer science at the University of Maryland and director of the Maryland Cybersecurity Center. Jonathan, you were one of the authors of a paper that was recently released called All Your Queries Are Belong to Us, The Power of File Injection Attacks on Search on searchable encryption. Tell us about searchable encryption. Well, searchable encryption allows a client to upload encrypted files. You can think about emails as an example, to upload these encrypted files to a server. And normally, if you just encrypted your files and uploaded them, the server would have no idea about anything stored in those files, and in particular would be unable to search for keywords in those files.

But searchable encryption is a specifically modified form of encryption that makes sure that the client can still issue queries and do searches over their encrypted files without revealing too much information to the server. So what's the status of the research when it comes to searchable encryption? So one of the things that's been really interesting here is that if you imagine trying to leak nothing to the server while still allowing the client to do searches, it turns out to be very hard and even in some senses impossible. So what a lot of researchers have been doing over the past few years

is designing systems that leak just a little bit of information, kind of you can imagine the minimal amount possible, while still allowing the client to perform searches. And what's been interesting here is that it's sort of unclear, and it's sort of been a little bit of a cat and mouse game to figure out the implications of that leakage. And so one of the things our paper was showing, actually, is that some of the schemes that have been proposed in the literature are actually very vulnerable. And even though they only admit a very small amount of leakage to the server, an attacker

could exploit that and learn lots of information. So let's dig in on that a little bit. What can you tell us about the attack? Well, in our particular case, we were looking at a server who was malicious and wanted to learn information about the different search terms that were being queried by the client. And what we observed is that the server can actually act as a sender, as a legitimate sender, sending a legitimate sender, sending emails to the client, whether under its own name or whether just by opening up a fake email account and sending emails. And the point is that when the client then encrypts those emails and uploads them to the server, if the client ever searches for a keyword that happens to also be in one of those files,

then that information is going to be leaked to the server, and that allows the server to figure out something about the query that the client is issuing. And so what we showed basically is different trade-offs in which the server could inject different number of files to the client, and without the client even noticing that anything was going on, eventually learn all the client search terms. So really what this shows is that we don't really have a good handle yet on what the implications of this leakage are in the real world. And obviously we need more work

to try to find the right balance between efficiency of the scheme and the leakage that they have. All right, interesting stuff. Jonathan Katz, thanks for joining us. And now a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home?

Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers.

I'm Dave Bittner. Thanks for listening. Thank you. you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.