CyberWire Daily - A hacking keeps you humble.

Starting point is 00:00:00 You're listening to the Cyber Wire Network, powered by N2K. of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life Thank you. JoinDeleteMe.com slash N2K and use promo code N2K at checkout. The only way to get 20% off is to go to JoinDeleteMe.com slash N2K and enter code N2K at checkout. That's JoinDeleteMe.com slash N2K, code N2K. Microsoft's president admits security failures in congressional testimony. Paul Nakasone joins OpenAI's board.

Starting point is 00:01:38 The feds hold their first AI tabletop exercise. CISA reports on the integration of space-based infrastructure. Cleveland City Hall remains closed after a cyber attack. Truist Commercial Bank confirms a data breach. Rockwell Automation patches three high-severity vulnerabilities. University of Illinois researchers develop autonomous AI hacking agents. Aaron Crow, Senior Manager of AWS User Authentication Products, speaks with our own Brandon Karpf about security through MFA and FIDO Alliance Passkeys

Starting point is 00:02:09 and her work on the Digital Identity Advancement Foundation. And can AI run for mayor? It's Friday, June 14th, 2024. Flag day here in the good old U.S. of A. I'm Dave Bittner, and this is your CyberWire Intel Briefing. Music Happy Friday, everybody, and thank you for joining us. It is great to have you here with us. In congressional testimony yesterday, Microsoft President Brad Smith

Starting point is 00:02:53 admitted security failings that enabled Chinese state hackers to access emails of officials in 2023. Smith accepted responsibility for issues cited in a Cyber Safety Review Board report. The report blamed Microsoft for security failures that let Chinese hackers Storm 0558 access 25 organizations' email accounts, including U.S. officials. The hackers used a Microsoft encryption key and exploited flaws in the authentication system to gain global access to exchange online accounts. The CSRB found an inadequate security culture

Starting point is 00:03:30 and gaps in Microsoft's security processes. Smith acknowledged Microsoft's crucial cybersecurity role and the increased cyber threats from geopolitical conflicts. He apologized to those impacted by the Storm 0558 attack and outlined steps Microsoft is taking to enhance security. This includes implementing CSRB recommendations, transitioning to a new key management system, and enhancing token validation processes. Smith added that Microsoft has added security engineers and created the Office of the CISO to ensure security is prioritized. The company's Security Future initiative aims to design and operate products with security in mind.

Starting point is 00:04:16 Following harsh feedback from security experts, Microsoft has delayed its Recall AI feature for further security testing. has delayed its Recall AI feature for further security testing. This feature, intended for co-pilot and Windows PCs, faced privacy concerns for recording users' activities. The rollout will now start with the Windows Insider program for additional testing. OpenAI has appointed former NSA Director Paul Nakasone to its board of directors. Nakasone will join the Safety and Security Committee established to improve model testing and curb abuse. This move follows CEO Sam Altman's temporary ousting

Starting point is 00:04:56 and aims to address security criticisms, including allegations of prioritizing profits over safety. Nakasone's appointment comes as OpenAI faces scrutiny over its security practices and increased efforts to enhance transparency and hire more security engineers. The company has lifted a ban on using its products for military purposes, allowing uses aligned with its values. Nakasone's military experience aligns with tech companies increasingly seeking such backgrounds for navigating

Starting point is 00:05:29 a tougher regulatory environment and advancing government relations. On Thursday, the federal government held its first tabletop exercise focused on artificial intelligence incident response, led by the Cybersecurity and Infrastructure Security Agency under the Joint Cyber Defense Collaborative. The exercise included 50 AI experts from 15 companies and several international cyber defense agencies. This initiative is part of the Biden administration's efforts

Starting point is 00:05:59 to mitigate AI risks as companies like Microsoft push for AI-enabled products. The exercise aimed to understand AI-related cybersecurity incidents, improve information sharing, and enhance collaboration between industry and government. CISA plans to release an AI security incident collaboration playbook by the end of 2024 detailing AI-specific incident response coordination. Participating organizations included the FBI, NSA, and international cybersecurity centers. CISA has released a report emphasizing the growing integration of satellites, spacecraft, and their ground-based infrastructure into our daily lives.

Starting point is 00:06:43 My N2K colleague Maria Maria Vermasas, has the story. The U.S. Cybersecurity and Infrastructure Security Agency, also known as CISA, has released a report highlighting the rapid integration of satellites, spacecraft, and their ground-based infrastructure into daily life. Titled, Space Systems Security and Resilience Landscape, Zero Trust in the Space Environment, the document outlines how space systems enable essential services, including healthcare, telecommunications, internet infrastructure, transportation, energy, and financial systems. The report primarily analyzes and defines opportunities for applying zero-trust principles across space infrastructure,

Starting point is 00:07:27 as the U.S. government did make the move towards zero-trust architecture back in 2022. Relying on the NIST cybersecurity framework components and concepts, this new report seeks to analyze where and how the framework can be applied specifically across space infrastructure. across space infrastructure. For more space news, be sure to check out the T-Minus Daily Space podcast right here on the N2K CyberWire network. Rounding out news from CISA, the agency added three new vulnerabilities

Starting point is 00:07:59 to its known exploited vulnerabilities catalog. An Android pixel privilege escalation, a Microsoft Windows Error Reporting Service Improper Privilege Management Issue, and a Progress Telerik Report Server Authentication Bypass. Federal agencies must address these vulnerabilities by July 4th. American financial services company Global Life announced that attackers may have accessed consumer and policyholder data through a breached web portal. The incident was discovered on June 13 during a security review prompted by a state insurance regulator's inquiry. Global Life quickly removed external access to the portal and believes the issue is isolated to this portal, with other systems remaining operational. The company activated its incident response plan and hired external

Starting point is 00:08:51 security experts to assess and remediate the breach. As the investigation continues, the full impact is unknown, but operations have not been materially affected. Cleveland City Hall remains closed due to a cyber incident that has disrupted city systems for six days. Residents can't access services like birth and death certificates or building permits. Local reporters spoke with Anita Vazquez, needing her baby's birth certificate for travel. She was frustrated by the closure, but obtained the document in nearby Lakewood. Cleveland officials say they're working to restore systems and that they've contained the threat. The timeline for City Hall reopening remains unclear.

Starting point is 00:09:38 U.S. commercial bank Truist confirmed a breach in its systems from an October 2023 cyber attack. Truist confirmed a breach in its systems from an October 2023 cyber attack. The threat actor, known as Spider, posted Truist's data for sale on a hacking forum, claiming to have information on 65,000 employees, bank transactions, and IVR funds transfer source code. Truist, formed from the 2019 merger of SunTrust Banks and BB&T, quickly contained the breach, secured systems with outside consultants, and notified affected clients. The ongoing investigation has found no evidence of fraud. Truist denies any connection to the recent Snowflake incidents. Rockwell Automation has patched three high-severity vulnerabilities in its Factory Talk View Site Edition HMI software, identified internally.

Starting point is 00:10:31 Two vulnerabilities involve user authentication issues allowing unauthorized remote access, while the third is a local privilege escalation flaw. The issues are resolved in version 14. The issues are resolved in version 14. Additionally, Rockwell addressed a vulnerability in control logics, guard logics, and compact logics controllers that could cause network-wide faults. CISA has issued advisories on these vulnerabilities. Researchers from the University of Illinois have developed AI agents capable of autonomously hacking websites and exploiting zero-day vulnerabilities, security flaws unknown even to developers. These agents, using a system called Hierarchical Planning and Task-Specific Agents, HPTSA, collaborate like a team, with a planning agent delegating tasks to specialized agents for different vulnerabilities

Starting point is 00:11:26 such as cross-site scripting and SQL injection. Unlike traditional AI hacking methods, HPTSA agents don't need prior knowledge of specific vulnerabilities and can discover new zero days independently. Tested on 15 real-world vulnerabilities, HPTSA successfully exploited 53% in just five attempts, outperforming conventional security scanners. measures in cybersecurity, the age of AI hacking is here, shifting the hacking paradigm towards more sophisticated autonomous threats. Coming up after the break, our own Brendan Karp speaks with Aaron Crow, Senior Manager of AWS User Authentication Products. Stay with us. a couple trying to beat the winter blues. We could try hot yoga. Too sweaty. We could go skating.

Starting point is 00:12:46 Too icy. We could book a vacation. Like somewhere hot. Yeah, with pools. And a spa. And endless snacks. Yes! Yes!

Starting point is 00:12:54 Yes! With savings of up to 40% on Transat South packages, it's easy to say, so long to winter. Visit Transat.com or contact your Marlin travel professional for details. Conditions apply. Air Transat. Travel moves us. Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility

Starting point is 00:13:33 into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's Vanta.com slash cyber for a thousand dollars off. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses

Starting point is 00:14:26 is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io. Thank you. FIDO Alliance Passkeys, and her work on the Digital Identity Advancement Foundation. I am joined today by Erin Crow, Senior Manager of User Authentication Products at AWS Identity.

Starting point is 00:15:32 Erin, so great to have you on the show. Thanks so much for having me. I'm really excited to have this conversation today. You shared with us a couple announcements around identity. I wanted to give you an opportunity to kind of talk us through those and why they matter. Can you start first with this enforcement campaign around MFA, multi-factor authentication? Yeah. So back in the fall of 2023, Steve Schmidt made our first announcement that we have new default MFA security controls that are coming. So basically starting with the most privileged users in our customer's account hierarchy, we'll be requiring the use of MFA in order to get into the AWS console. Today, we announced the expansion of that program.

Starting point is 00:16:12 So as we made another announcement in Releasement Passkey, which I can talk about more in a moment, we're now expanding that to our standalone account cases as well that exist outside of the AWS organization's hierarchies. That's fantastic. It's very important. You even said it before we started recording, rising tide raises all ships. outside of the AWS organization's hierarchies. That's fantastic. It's very important. You even said it before we started recording, rising tide raises all ships. Can you, in your own words, describe why this is so important for the overall health and security of our environment, of our community?

Starting point is 00:16:38 Yeah, there are a few reasons I think this is so important. One of the main ones is, if we look back over the last couple of years, there is broad consensus among the industry that we have an increasing problem with credential attacks, especially credential stuffing, credential spraying. MFA is one of the most simple and effective controls that we can actually deploy in order to control those type of attacks with high efficacy. Various industry reports suggest that MFA can prevent between 80-99% of attacks, depending on what you're looking at.

Starting point is 00:17:06 And this is behavior and results that we have been able to confirm internally as well. So we really have an imperative to do more to protect our own accounts online. Sure. And we see it every week. I mean, some large breach occurs and it could have been stopped with MFA or it's usually off of a single factor type of a login situation. How will this be deployed or if it's already being deployed, how is it going to affect the end user? Yeah, so this is already being deployed. We started communicating with our customers that we're going to be in scope for the first waves of enforcement, so to speak, back in the fall. Because we wanted to ensure that especially if customers are larger and they have maybe more complex environments or a

Starting point is 00:17:49 greater number of employees that they need to go deploy against, they would need more time to prepare. So we kind of took that as a tenet as we were starting out, that we were going to have a differentiated approach depending on what type of customer persona that we were working with to make sure that everybody would have their needs met. So we've been going through different rounds of types of communication, not just email, but also CloudWatch entries, personal health dashboard notifications, things of that nature, the blogs as well. There are some other changes too, now that we're actually getting into the period of time that we communicated for enforcement,

Starting point is 00:18:16 which started on May 16th, 2024. The customers will start to see and sign in time. So if you're going to sign into the AWS console, if you're signing in for the first time after your account that's in scope for this enforcement program is turned on, you will see a notice saying you have 30 days in order to register MFA,

Starting point is 00:18:34 and you can skip it for a period of time. But we applied that grace period to everyone to make sure that just in case someone missed that window of notification, they absolutely could not miss it when they go to sign in because we don't want this to be a surprise. We really want to help people along in this journey. Most of our listeners wouldn't be surprised.

Starting point is 00:18:49 We were all here at Cyber, early adopters of MFA, MFA on everything. We're now in the process of, you know, slowly transitioning our tokens and what have you to pass keys. And so, you know, my question to you is the second big announcement you had

Starting point is 00:19:04 was around pass keys. So how is that being implemented and what's you is the second big announcement you had was around pass keys. So how is that being implemented and what's the announcement that you have on the 502, you know, pass key support? I'm so excited for this one. So today we announced pass keys are going to be available on AWS IAM as a second factor of authentication. So in addition to your password, you can now use the touch ID, Windows Hello, a variety of different form factors that are built into billions of mobile devices around the world today to do highly secure authentication. As you probably know,

Starting point is 00:19:31 because you guys are making the switch, PassKeys and FIDO authentication in general is the gold standard of user authentication because it provides phishing-resistant, cryptographically secure authentication. And now it's extremely easy to do. So we've enabled our customers today can go try it out if they'd like. They can go to their security credentials page

Starting point is 00:19:49 and enroll a new passkey today, sync it across another device if they have it, and go from there. Given your knowledge and your background here, can you explain to our listeners kind of why this is the gold standard? Why it is so important and so effective at providing that second factor. Yeah, because although when we talk about different types of credential attacks, a lot of the times we may be looking at cases where someone is not spending a whole lot of time trying to get into the account. They may be acquiring lists online of credentials that they want to go try against various different services, something to that effect. But phishing is also an increasing vector for account takeover.

Starting point is 00:20:26 And that could be highly sophisticated using more like reverse proxy man-in-the-middle type attacks. It could be just as simple as sending someone a link and getting their password, which is where phishing either with the OTP or the password itself comes into play. That doesn't work with FIDO2 authentication because the credentials are specific to the domain in which they are registered and they can't be used for other domains or they can't be used by a disingenuous domain.

Starting point is 00:20:51 They resist those types of attacks in addition to the other more conventional credential attacks that are stopped by any form of MFA. So when we're talking attack surface management, I mean, implementing these things in any environment, but especially in critical environments like the ones that most organizations manage in AWS, right? Critical to managing that attack surface. Have you conceptualized the degree to which these two announcements, right? The MFA enforcement campaign and the pass keys will actually reduce

Starting point is 00:21:24 the attack surface for organizations within the AWS environment? We think that there's going to be different ways that customers engage with this technology. We think that for the most part are really large customers that are operating in regulated environments. They may not adopt passkeys right away because they're often under other obligations to use even higher assurance forms of authentication like traditional FIDO2 hardware authenticators. So the degree to which we see that play into our largest enterprise security strategies

Starting point is 00:21:52 remains to be seen and may also be something that we see with further evolution of FIDO passkeys as well. For our smaller customers, maybe like individual developers and users that are more casually using AWS or even small businesses that don't want to go purchase or can't go purchase a lot of security keys or tokens or other hardware and it's an operational burden for them to manage, I think that this is going to have a lot of impact because suddenly they have with no need to manage or install additional application software, acquire hardware. Again, like the gold standard of authentication, literally right at their user's fingertips, in some cases, surface scan or something to that effect.

Starting point is 00:22:30 So I think that this is going to be deeply impactful, especially in segments of the population that have traditionally been less likely to use MFA. And you said it yourself, the proliferation of Touch ID and Face ID and all these other technologies. It makes it actually quite accessible, it seems like, to pretty much every business. Yeah, I would absolutely agree with that. I think that there is a flavor of FIDO2 that can work for just about everyone, which is part of why we were so passionate about getting this release out to our customers.

Starting point is 00:22:59 Yeah, it's about time for us to move beyond the password, right? Yeah, I think so. So you're also sharing, and it's not every day that we get to talk to someone who's personally passionate and excited, fired up about identity, but also the work that you're doing to make the community more secure. If you're comfortable, can we just kind of share how you got into this? I personally love your story. I think our audience would get a lot of value out of hearing the path that you took to becoming, you know, one of the foremost experts in identity. I would be happy to. I thank you. I started off actually as a temporary customer service agent, taking Kindle phone calls in the holiday season

Starting point is 00:23:40 of 2012. And I did a bunch of different jobs in between then and now to gain different skills and just kind of move through the company. Like for example, I used to take customer emails for Jeff Bezos and handle those question mark summaries and emails. If you're laughing, you must have heard of them. And a couple of different roles before in about 2017, I landed in my first security role as a program manager and I initially wasn't like I didn't have in mind that I wanted to go have a security career at that time although I very much do now I was looking for how do I get exposure to skills as a program manager that would allow me to take other types of program management jobs and continue moving on like that but

Starting point is 00:24:19 I landed on my first project with account recovery and kind of redesigning the process for account recovery for Amazon customers. And I was just so compelled by the impact of that type of work and the problems that we were working on that it really stuck with me. And then from there, it just kind of built on. I had this really great boss that was extremely supportive of my development and wanted me to continue to grow, not just as a professional in general, but also as a domain expert within identity. And he recommended that I go to this conference called Identiverse, which is one of the largest identity industry events

Starting point is 00:24:54 that I have attended, I think, every year since, and introduced me to someone who ended up putting me in touch with the rest of the community via a bootstrapping party. It's like basically an event where everyone was getting together at somebody's house because this community is full of a lot of like old friends, like people that have been friends and part of this community for

Starting point is 00:25:13 literally decades. And I, so I went to this party and everyone was just so incredibly welcoming. I didn't have any context about people who are like, who was there, who anyone was, despite the fact that, you know, the people that wrote Sackmole and the foundations of the internet itself were all there and all very humble. And they just really embraced me in that community. And I think that I can't separate my passion about identity and the dedication that I've had to my career from that community, because I think I'm highly motivated by the relationships that are built here. People are all so passionate about making the internet a safer place. And that's a mission that really resonates with me. And that shows up in your personal life as well, right? You're also the

Starting point is 00:25:58 co-founder of the Digital Identity Advancement Foundation. I'd love to give you an opportunity to talk about that foundation, the work you're doing there, some of the opportunities that folks within the community might have to engage with that foundation as well. Yeah, absolutely. The Digital Identity Advancement Foundation

Starting point is 00:26:16 is an organization that is dedicated to help bridging the gap between the opportunities that one has to go and build that community and say the financial constraints of attending conferences, of attending these different events, which can all add up, especially for newer professionals, students, et cetera, people that aren't being sponsored by big companies like I was to go to my very first event and not only make those connections, but reap the educational benefits of doing it as well.

Starting point is 00:26:43 So the Digital Identity Advancement Foundation today has an award structure. We have two different awards, the Kim Cameron Award, which is dedicated to honoring the legacy of Kim Cameron by supporting especially those very new professionals in going and attending key events like Identiverse, Authenticate, European Identity Cloud Conference. And then a second award, which is dedicated to Vittorio Bertocchi, who passed away of pancreatic cancer in October of last year, who was a giant in the standards community. And the internet, as we know it today, works the way it does because of something that he influenced, which is a great legacy. And that award in particular supports people that are interested

Starting point is 00:27:24 in being the next standards architects or people who are already professionals in that track. Let's say you are an individual contributor who is working independently. It can be quite expensive to try to go to all the different identity standards events to go have these in-person face-to-face sessions where so much work gets done on outstanding questions about the standards. We give people an opportunity to come up with a plan of study where they can tell us, here's the events that I want to go to, here's the standards I'm trying to influence, and here's why it matters. So we can help financially support them in that journey. Now, those awards are the current structure that we have. This is the first year that we

Starting point is 00:27:58 were operating under this banner, and we're closing off our second award cycle now. We were actually able to send some folks to Identiverse and EIC already and then Authenticate in the fall. In the future, we expect that we're going to expand to other types of programs as well. Maybe try to learn how we can engage with the universities and others so we can have a more diverse influence. It's important and fantastic work. For any of our audience who might be interested, where could they go to learn more? Yeah, you can go to the www.digitalidadvancement.org. We have a lot of information there about how you could get involved and contribute to, we call it DIAF for short.

Starting point is 00:28:37 We also post information and updates about our award cycle so people can know who are the attendees that are going to these events and hopefully go say hello to them as well. It's great to hear about. Across the board, Erin, it's been a pleasure having you on. And truly, thanks for the good work that you're doing around identity, both at AWS, but also DIA. It's great. Great to have you on. Thank you. Thank you so much for having me. That's Erin Crow, Senior Manager of AWS User Authentication Products, speaking with N2K's Brandon Carr. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker,

Starting point is 00:29:31 a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. And finally, from our What Could Possibly Go Wrong desk, Victor Miller is running for mayor of Cayenne, Wyoming,

Starting point is 00:30:18 and he has a unique campaign promise. If elected, an AI bot named VIC, which stands for Virtual Integrated Citizen, will make the decisions. Miller, calling himself VIC's meat puppet, will attend meetings and sign documents. VIC, which is based on ChatGPT, will handle policy recommendations and voting, leveraging its ability to analyze vast amounts of data quickly. Miller's candidacy has raised legal questions as AI bots are not allowed to run for office. Despite this, Miller is on the ballot. Wyoming Secretary of State Chuck Gray

Starting point is 00:30:54 has expressed concerns, emphasizing that only qualified electors, in other words, real people, can run for office. Miller created VIC after experiencing frustration with local government processes, and he believes AI can improve transparency and efficiency. Despite potential challenges, Miller is excited about the future and Vick's potential to transform local governance. If he wins, Miller may unlock a secret weapon against corruption, a mayor that can't be bribed, only rebooted. check out our daily briefing at thecyberwire.com. Be sure to check out this weekend's Research Saturday

Starting point is 00:31:46 and my conversation with James from SpyCloud Labs. We're discussing unpacking InfoStealer malware, what we've learned from reverse engineering Luma C2 and atomic macOS Stealer. That's Research Saturday. Check it out. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity Check it out. We're privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector,

Starting point is 00:32:27 from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. N2K makes it easy for companies to optimize your biggest investment, your people. We make you smarter about your teams while making your teams smarter. Learn how at N2K.com. This episode was produced by Liz Stokes. Thank you. I'm Dave Bittner. Thanks for listening. We'll see you back here next week. Your business needs AI solutions that are not only ambitious, Thank you.

CyberWire Daily - A hacking keeps you humble.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.