CyberWire Daily - BadRabbit misdirection? Fancy Bear's wish list. AWS misconfigurations. Data breach notes.

Episode Date: November 3, 2017

In today's podcast, we hear that BadRabbit looks like misdirection. Fancy Bear's wish list is out, and it's very long, and very global. US prosecutors may be preparing to indict half-a-dozen Russian officials in the DNC hack. Malaysia continues to recover from a major series of data breaches. GhostWriter poses a man-in-the-middle threat to AWS users who misconfigure their accounts. And it was Halloween, but the ShadowBrokers weren't much in evidence. Perhaps they were unrecognizable in their Wonder Woman and Mighty Thor costumes? David DuFour from Webroot on recent ransomware trends.  Guests are Sherrie Caltagirone, founder and executive director of the Global Emancipation Network (GEN), and Andrew Lewman, SVP of DarkOwl. They are using the tools of cyber security to help stop human trafficking online.  Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K. Bad rabbit looks like misdirection. Fancy bear's wish list is out, and it's very long and very global. U.S. prosecutors may be preparing to indict half a dozen Russian officials in the DNC hack. Malaysia continues to recover from a major

series of data breaches. Ghostwriter poses a man-in-the-middle threat to AWS users who misconfigure their accounts. And it was Halloween, but the shadow brokers weren't much in evidence. Perhaps they were unrecognizable in their Wonder Woman and Mighty Thor costumes. I'm Dave Bittner with your CyberWire summary for Friday, November 3rd, 2017. Bad Rabbit's odd behavior, sophisticated, noisy, and brief, may have an explanation. It appears the campaign may have been misdirection, or at least that's the way it looks from Kiev. Ukrainian police have told Reuters that the same threat actor behind the ransomware campaign

operated a quiet phishing campaign during Bad Rabbit's activity. The goal, investigators think, was to obtain undetected remote access to financial and other confidential data. think was to obtain undetected remote access to financial and other confidential data. Ukraine believes the actors behind Bad Rabbit to be the same Russian security services responsible for NotPetya. Researchers at cybersecurity firm Webroot rate NotPetya as a nastier piece of work than its rough contemporary WannaCry, which by comparison was a crude and primitive effort. The enduring concern about NotPetya accounts for more than a little of the concern with which Bad Rabbit was immediately greeted.

The AP publishes what it characterizes as a hit list, and by that we mean a long list of hacking targets, not of people marked for assassination, so maybe wish list might be better. It comprises Fancy Bear's persons of interest. It is a long list, casting a wide, indeed global net, and goes far beyond Fancy's notorious interest in the Clinton campaign. Many of the people on the list are the sort who would be prospected in classical espionage operations. Aerospace and defense sector workers are on the list, as are political figures from both major U.S. parties,

Democrats in the majority, but Republicans also represented. The papal nuncio to Kiev and the Ukrainian army officer who wrote that Android gunnery app, Popper D-30, whose compromise CrowdStrike reported last December. Fancy Bear, as longtime listeners will know, is widely believed to be a unit of Russia's GRU, the country's military intelligence establishment. Fancy Bear has also been active recently in Phishing Bellingcat, a journalistic organization that pays considerable attention to Russian affairs. In this case, they've been using Blogspot to mask their credential harvesting efforts U.S. prosecutors have identified at least six Russian government officials

Allegedly involved in the Democratic National Committee hack during the last election cycle Indictments are expected early next year This investigation is distinct from the inquiry being carried out by Special Counsel Robert Mueller Security researchers at Sky High Networks are warning of Ghostwriter, a vulnerability in which misconfigured Amazon Web Services S3 buckets are not only exposed to public view, but can also be exploited in man-in-the-middle attacks. About 4% of the buckets accessed from within enterprise networks are thought to be susceptible to Ghostwriter, Skyhigh says.

The more familiar problem of data loss from AWS S3 misconfiguration also persists. Nearly 50,000 Australians recently had their information exposed. Personal records from employees working in government agencies, banks, and a utility were compromised in a third-party contractor's misconfigured cloud account. Earlier in October, Dow Jones also sustained a breach caused by an unsecured AWS S3 bucket. More than 2 million customers are believed to have been affected. A very large data breach has hit Malaysia, as more personal data of more than 46 million mobile subscribers have been found for sale on the dark web. The breach affected at least a dozen telecom providers. Since the total number of people affected exceeds the population of Malaysia,

the incident is believed to have also affected foreigners living in or transiting through the region. Other data may have been lost as well, from employment site Job Street, perhaps 17 million, and a number of Malaysian government agencies, including the Malaysian Medical Council, the Malaysian Medical Association, Academy of Medicine Malaysia, the Malaysian Housing Loan Applications, the Malaysian Dental Association, and the National Specialist Register of Malaysia. Several million individuals were affected by these breaches as well. Investigation is in progress. There are reports of stolen data being used for phishing and spamming.

And finally, Tuesday was, of course, Halloween, which the shadow brokers have told is being brokers' favorite holidays when they trick-for-treats wealthy elites. But where are brokers being these days, we are asking? They are last heard from two weeks ago when they announced a big, big sale, like the boss is on vacation and we are all go crazy. They'd be picking on good researcher Matt Swish and praising good reporter Marcy Wheeler. But no new exploits, not so much Twitter, but brokers say Kaspersky should sue Wall Street Journal for libel.

And did brokers mention new low, low prices? Oh, come on, guys. Everybody knows you're not in it for the money. But these days, their offerings look like a remainder table at a shopping mall bookstore. Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be.

Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation

to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and

wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives.

Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io. And I'm pleased to be joined once again by David DeFore.

He's the Senior Director of Engineering and Cybersecurity at WebRoot. David, welcome back. You've been seeing some evolution in the way ransomware is working. That is correct, actually. We're seeing it become more sophisticated in the way ransomware is working. That is correct, actually. We're seeing it become more sophisticated in the way that it's distributed, the way that it's used in the industry. And by industry, I mean the bad guys and how they're propagating it. And I think we've spoken before about how we're seeing a growth in worms again, and those worms now are able to deploy and use ransomware as well.

But a couple of key things about the ransomware that we're seeing here at WebRoot is the prevalence of dynamic key shifting, where the first iterations of ransomware, you could typically, once the key was out there, you could use that key across multiple instances of that ransomware to unlock it. But the bad guys have gotten pretty smart and they're able to dynamically generate keys based on system information. So if you want to be able to unlock

a specific encrypted instance, you have to be able to actually go out, pay that Bitcoin typically to be able to get the unique key generated for your system. And additionally, we're seeing some growth in the quality assurance of ransomware in terms of the purveyors of ransomware solutions, if we may call them that, are wanting to ensure they have high quality ransomware with really actually high quality customer support. Because what's happening is the low quality solutions sometimes may not decrypt properly.

So people don't get their data back. And once that becomes known on the Internet that if you are infected by a certain strain and that strain does not decrypt, people do not pay the ransom. So to maximize their ROI investment on the ransomware they've generated, they're spending a lot of time doing QA and providing really good quality customer support to ensure that they have a good reputation for the ransomware. They want their ransomware to have a quality name so people will pay that ransom. Yeah, there's a little, I guess, bitter irony there, huh? Yes, exactly. So that's really what we're seeing right now. It is becoming more sophisticated in terms of the way it executes. Previously, you would see single or not highly threaded instances. Now, ransomware instances are becoming very threaded in the way they are encrypting files and the speed

at which they can encrypt the device and things of that nature. So there's a lot of sophistication going on in the growth and the spread and the quality of the ransomware itself. And I think it was in 2010, we saw the first real instance of ransomware. And right now, I think in 2016, 2017, we're approaching 500 different strains of unique ransomware out there. So back up your files, right? Yes, definitely back up your files. And another little scary tidbit. Last year, we saw about a billion dollars in cost, people paying an expense for dealing with ransomware.

This year, we see it trending towards about $5 billion, and that's only going to grow. Yeah. All right. David DeFore, as always, thanks for joining us. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data,

and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. My guests today are Sherry Calcageroni and Andrew Luhmann. Sherry is the Executive Director of the Global Emancipation Network, a nonprofit that uses technology to try to put an end to global human trafficking. Andrew is vice president at DarkOwl, one of their technology partners. Human trafficking is an enormous problem. Estimates are between 20 and 45 million people are being trafficked around the world today. And yes, that is a 100% margin of error. So basically what we can take from that is that the data that we have is completely unreliable.

We don't have a repeatable method of coming up with these numbers again. So one of the things that we're trying to do at Global Emancipation Network is to bring together all of the disparate data sources that exist in trafficking. So sometimes that takes the form of like a sex ad on Backpage, or sometimes it's, you know, a visa blacklist where we are looking at labor trafficking. So there's many different stakeholders who own the data. Sometimes it's government actors like law enforcement agencies or groups in the United States like Department of Homeland Security. And other times it's other nonprofits like ourselves who are actually interacting with victims. So it really runs the gamut then who has the data. But the biggest problem that we're trying to counter then is to break down all of these silos and to allow

the data to exist in one single location where we can run data analytics across it and begin to look at trafficking as the data problem that it really is. Because when we do that, when we're working collectively on the problem as a data problem, then we can sort through it using these cybersecurity and data analytics methods to find traffickers, find victims, and really study those trends on recruitment and whatnot that allows us to scale our efforts. I see. And so, Andrew, what part in all this are you all at DarkOwl playing? So, DarkOwl is a startup that has been crawling all the dark nets out there and collecting and collating the data. And this helps investigations and research and analytics into what are the attributes of the traffickers, the nicknames, the techniques they use and provides a large database for them to work off of to help with sherry's comment there about needing more content in one place to do successful analytics on give

us an idea why don't i start with you andrew give us an idea of what is it like on the dark web i mean these people are they're trying to not be found and yet in a way they have to be able to find each other right so there's the fundamental conflict they have to resolve in that they're trying to keep themselves private from law enforcement, but also public enough that people can find them to buy their services. So they've, you know, there's a lot of lingo use, they hang out in forums you wouldn't normally see on typical websites you visit. They talk in code, both about how to actually get, quote, the product, the people from one country to another, to the destination, to the buyer. And at the same time, they have to advertise,

you know, I have the following people available for services, whatever those services might be. So Sherry, in terms of having to sort of wrap your hands around this, this shift to the dark web, this shift to online, is this a recent development and how does this affect your efforts, your ability to try to stop these sorts of things? Well, one of the things that we have really working in our favor is that the majority of trafficking online actually exists on the open web. It's anything that you or I could type into our web browser. And that makes it a lot easier for us to collect that information.

But what Andrew and I have been trying to do then in our collaboration in terms of the dark web then is to look at polycriminality elements. And what that really means is that these transnational organized criminal elements, they are just looking at ways of making money. They don't really care if they're moving drugs or weapons or sadly people. It's all sort of the same to them. And so by tracking some of those other elements, we can also learn a lot about human trafficking. And so, Andrew, from your point of view, from a technical point of view, how does this sort of data compare or differ from other types of data that you all are normally looking for? It's unfortunately similar in that whether you're

talking about a drug dealer trying to sell drugs to people around the world or whether they're trying to sell trafficked children or laborers, it's all sort of the same mentality from their part. Increasingly, there used to be specialization where certain criminal organizations or gangs would specialize in one thing like drugs or firearms or identities and humans now they're sort of all blurring because as sherry said it comes across as it's just a product we don't care we don't ask what's in the box anymore um so to speak we can get it from point a to point b you know technically a lot of what we're seeing is they're moving to peer-to-peer chat, like direct chat or heavily encrypted chat. And there's none of those apps out there for legitimate reasons.

But, of course, criminals will take it and use it to coordinate with people in country, their customers, and potential buyers. So, Sherry, after 9-11, there was the popularization of the saying, if you see something, say something. For those people who are in the cybersecurity world, is there a way that they can help out what you're doing? Are there things that they should keep an eye out for where if they see things, are you interested in getting reports from people or what kind of help are you looking for? Absolutely. Actually, that's one of the things that makes me the most passionate leading Global Emancipation Network is really watching the light bulb turn on for these people who usually work in these tech heavy fields like cyber intelligence or cybersecurity. And that they realize that it doesn't matter

if they're hunting hackers during their day job, you can take those exact same skill set and their training and apply it to hunting traffickers. It's just another adversary. And so actually a lot of our volunteers on our staff come from that background in particular. So it translates really well. One of the things that we say, and you're right, it's if you see something, say something, but you need to know what you are looking for, right? Traffickers tend to use a coded lexicon that means certain things to people who know what it means. For example, most of the trafficking things that we see, they fall under two categories. One are age-related, and that's

advertising an underage victim, which automatically qualifies for trafficking. And then others are around movement. And those are things that indicate that someone has just arrived in town or they're about to go to another location, things like that. So if there is anyone out there who usually works in these cybersecurity spaces and wants to get more heavily involved in tracking a new kind of adversary, we absolutely would welcome them. And please get in contact with us. And if you want to find out more about the Global Emancipation Network, their website is globalemancipation.ngo. Our thanks to Sherry Kakajaroni and Andrew Luhmann from Dark Owl for joining us. And that's The Cyber Wire.

We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.