CyberWire Daily - Bing backend exposed, for a bit. CIA thinks Russian influence ops are top-directed. TikTok Global spin-off may not be enough. Destination automation. Hacks that weren’t, and one big guilty plea.

Episode Date: September 22, 2020

In an unusual lapse, Microsoft briefly left a Bing backend server exposed online--now fixed. Sources say the CIA has concluded that Russian President Putin is personally involved in setting the direct...ion of operations designed to influence the US elections, The deal to spin out TikTok Global to avoid a US ban may not be enough, Europe looks for more control over tech companies. Activision’s hack seems to be a mere rumor. Ben Yelin on section 230 of the communications decency act. Our guest is Ramon Pinero from Blackberry on the challenges of coordinating public services during the pandemic. And a Dark Overlord cops a plea. For links to all of today's stories check out our CyberWire daily news brief: https://www.thecyberwire.com/newsletters/daily-briefing/9/184 Learn more about your ad choices. Visit megaphone.fm/adchoices

Transcript
Discussion (0)
Starting point is 00:00:00 You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.
Starting point is 00:00:31 Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.
Starting point is 00:00:44 Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.
Starting point is 00:01:22 Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. In an unusual lapse, Microsoft briefly let a Bing backend server exposed online. Sources say the CIA has concluded that Russian President Putin is personally involved in setting the direction of operations designed to influence the U.S. elections. The deal to spin out TikTok Global to avoid a U.S. ban may not be enough. Europe looks for more control over tech companies.
Starting point is 00:02:22 Activision's hack seems to be a mere rumor. Ben Yellen on Section 230 of the Communications Decency Act. Europe looks for more control over tech companies. Activision's hack seems to be a mere rumor. Ben Yellen on Section 230 of the Communications Decency Act. Our guest is Ramon Pinero from BlackBerry on the challenges of coordinating public services during the pandemic. And a dark overlord cops a plea. From the CyberWire studios at DataTribe, I'm Dave Bittner with your CyberWire summary for Tuesday, September 22, 2020. Researchers at Wizcase on September 13th found an exposed backend server that exposed data from Microsoft's Bing mobile app. Data is believed to have been exposed between September 10th and 16th,
Starting point is 00:03:19 at which point Microsoft secured the server. The server sustained several meow attacks while it was exposed. ZDNet calls it a rare security misstep for Redmond, but notes that no particularly sensitive personally identifiable information appears to have been compromised. WizKays said they found the following data exposed. Search terms and clear text, including the ones entered in private mode,
Starting point is 00:03:43 location coordinates, the exact time the search was executed, Firebase notification tokens, coupon data, a partial list of the URLs the users visited from search results, device model for the phone or tablet, operating system, and three separate unique ID numbers assigned to each user found in the data. ADID, which appears to be a unique ID for a Microsoft account, device ID, and device hash. Sources tell the Washington Post that a CIA assessment completed at the end of August
Starting point is 00:04:17 concluded that high-level Russian leaders, including President Putin, were directly involved in attempts to influence the U.S. presidential election. The Post reports that President Putin, while interested in disruption and Fischer generally, is seeking to denigrate former Vice President Biden. This is consistent with either a desire to see President Trump re-elected and with an outraged opposition, or a desire to see former Vice President Biden take office in a severely weakened political condition. ByteDance's arrangement to retain a majority controlling stake in TikTok Global, with most of the remaining shares going first to Oracle and second to Walmart, may not pass muster with the U.S. government. According to the New York Times, the administration
Starting point is 00:05:04 has signaled that it wants ByteDance out of the picture as far as control is concerned pass muster with the U.S. government. According to the New York Times, the administration has signaled that it wants ByteDance out of the picture as far as control is concerned, and that the large chunk of ByteDance shares owned by American investors won't cut it. It's not enough to allay concerns about Chinese control of the social platform. A Wall Street Journal article sees U.S. admin aversions about TikTok and WeChat as an instance of a continuing trend toward the fracturing of the Internet along national lines. China's Great Firewall is the best known of such efforts, but other national and supranational groups are moving for various reasons in similar directions. The European Union, Computing reports, is seeking expansive authority to regulate tech companies. Facebook says, according to Vice, that if it has to put up with the restrictive
Starting point is 00:05:51 data handling practices the EU's one-stop shop for the company, Ireland's Data Protection Commission, is seeking to enforce, Facebook may just stop doing business in Europe altogether, leaving some 400 million users wanting their Facebook fix. FedTech preaches automation as the next frontier of a zero-trust cyber-offensive. The Department of Defense, a cutting-edge cybersecurity player, just ordered a new tool that deploys advanced probability-based mathematics to mime decision-making. Automation can detect and classify threats, halt incursions and data transfers,
Starting point is 00:06:28 and free up human analysts for other tasks. As an added bonus, groups that invest in automation end up spending an average of $3.5 million less on breaches, and that's nothing to sneeze at. So, gamers, do you play Activision titles like the popular Call of Duty? Well, there's a rumor floating around that about half a million Call of Duty player accounts have been exposed by parties unknown who've hacked Activision. Now, Activision has consistently denied that it was hacked and that any accounts were lost. The story seems to be spreading in
Starting point is 00:07:04 social media, notably YouTube, but there seems little to it. The claim is that account owners get locked out, lose their progress in the game, and so on. Even though Activision reassures its users that there's nothing to worry about, the company does urge vigilance and sensible precautions against losing control of your account. And finally, remember the Dark Overlord, or the Dark Overlords?
Starting point is 00:07:30 It's hard to distinguish the fallen cyber angels when they're working together, and in any case, their name is probably hashtag Legion. Anywho, one Dark Overlord, Nathan Francis Wyatt, 39 years old and a British subject, One dark overlord, Nathan Francis Wyatt, 39 years old and a British subject, took a guilty plea yesterday to U.S. federal charges of conspiring to commit aggravated identity theft and computer fraud, The Washington Post reports. He was involved in the theft of medical records, client files, and personal information from companies. The dark overlord demanded between $75,000 and $300,000 worth of Bitcoin to return the information.
Starting point is 00:08:12 The companies didn't pay, although they incurred costs associated with restoring data and operations. Mr. Wyatt received five years and was ordered to pay $1.5 million in restitution to his victims. In fairness to Mr. Wyatt, he's said to have shown signs of remorse during his allocution and sentencing, telling the court, quote, I can promise you that I'm out of that world. I don't want to to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more.
Starting point is 00:09:10 Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001.
Starting point is 00:09:43 They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off.
Starting point is 00:10:17 And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak.
Starting point is 00:10:53 Learn more at blackcloak.io. Among the many things the global COVID-19 pandemic has brought to the fore is the need for fast, secure, trusted communications between government agencies at all levels with their constituents. Ramon Pinero is Vice President of Services at BlackBerry, where he works directly with public safety organizations across the country to ensure officials have the tools and support necessary to communicate across teams and with citizens in real time.
Starting point is 00:11:31 I think that we find ourselves in a unique place, certainly better where we were before, which is when I am from California and the way I grew up is where public safety was really being delivered to normal people in the way of interrupting my Saturday morning cartoons. I'd be eating cereal and be watching cartoons. And all of a sudden, I'd see an emergency broadcast message occur on the screen. It would blare and interrupt what I was watching. And to that end, I really was the extent of it, right? There was some letters that scrolled across the screen
Starting point is 00:12:07 that said, hey, in an emergency, you're gonna hear a loud tone and you better heed our warning. And that was really about it. Now though, and I think that with the advent of different technologies and with greater public awareness, the community at large expects
Starting point is 00:12:23 a more comprehensive message, more rapid and more real time information about any threat that faces them around public safety. So that could be anything from hazardous vapor or material leak, right? Let's say that there's a plume near my house or an earthquake or quite topical COVID-19 guidance, right? I live in a county that was hot. It was a hot spot here in Northern California. And the way in which my county communicated with me was very rapidly through my mobile device and sending me messages about safety guidelines.
Starting point is 00:13:01 You know, just yesterday I was on my way home and we were having some heavy rains here and sure enough, up on my phone popped an emergency alert message that said, you know, we're under a flood advisory. And so is that the kind of thing that we're talking about today in the modern age? That's right. And so that flood advisory, and we can automate all of these workflows, if you will, but that flood advisory is important because not only is it providing you with the awareness of where to avoid the flood, if you will, the community really wanted to know, and some systems were utilized quite effectively around how do I, what's my escape route, right? When should I evacuate? And such that if I'm not receiving that message anymore,
Starting point is 00:13:57 these phone calls are going straight to, you know, Office of Emergency Services, to your municipality saying, hey, you didn't warn me this was happening. What do I do? So there's quite an expectation that's been built up in the public. There's a county here in Northern California, Contra Costa County. They exercise their systems every Wednesday. And if for one reason or another, a Wednesday gets skipped, right, or they suspend, they really hear it from the community. Hey, we didn't hear it. We didn't hear the system this Wednesday. Is everything okay? Right. And that's music to our ears because that means that
Starting point is 00:14:29 the community is invested. They know what to do when they hear a warning. And the Office of Emergency Services in that particular county is kind of ready to go when the next crisis occurs. That's Ramon Panero from BlackBerry. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide.
Starting point is 00:15:15 ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default deny approach can keep your company safe and compliant. And joining me once again is Ben Yellen. He is from the University of Maryland Center for Health and Homeland Security and also my co-host over on the Caveat podcast. Hello, Ben.
Starting point is 00:15:53 Hi, Dave. Article from Wired. This is an editorial written by David Chaverne. Caught my eye and thought it'd make for good discussion between you and I. caught my eye and thought it'd make for good discussion between you and I. It's titled, Section 230 is a government license to build rage machines. That's a provocative title there. Ben, can you take us through what they're going at here? Yeah, it certainly grabs your eye, doesn't it, as soon as you see that headline?
Starting point is 00:16:22 So what he's talking about is Section 230 of the Communications Decency Act. That statute protects what are called interactive computer services, like search engines, but also like social media companies, from Facebook and commits a murder, Facebook can't be held accountable for that because they're not held accountable for their editorial decisions. The rationale for this is, you know, to allow these companies to do proper content moderation without worrying about legal liability. So they can make their own interpretation of which content to ban and which content to allow. And that, you know, at least in theory, will foster a more robust free speech community online. What this article is getting at, which I think is a very serious problem, is because companies like Facebook don't face this threat of legal liability, they make decisions really to drive their own profits, which for them means getting page views.
Starting point is 00:17:31 And to get page views, you want to steer people to sensationalize stories, which is what, at least it's alleged here, that their algorithm does. And that's leading people to, frankly, some bizarre, conspiratorial, false information. And it's really corrupting our political discourse. You'll see these anecdotes of interviews on the street where people will talk about conspiracy theories, and they're always sourced back to Facebook. My Facebook friend posted this, and I posted it to my 300 followers, and all of a sudden it goes around the world. And what this op-ed is saying is that's not healthy for our democracy. Facebook should not be shielded from this liability.
Starting point is 00:18:21 If they are going to have this freedom to make editorial decisions, they should be held accountable for the resulting harm. And I certainly think there's merit in that, whether you ultimately agree or disagree with the conclusion. What's the flip side of that? If Facebook does have legal liability, how would that possibly change the way the service runs? Well, I mean, I think what they would say is they would constantly fear lawsuits. It would affect, they would ban more accounts. They would stifle free speech because they'd always be worried about
Starting point is 00:18:57 liability. And, you know, they'd be so worried about content moderation decisions that they might as well, you know, not have a platform in the first place. So they wouldn't have that public arena to foster the marketplace of ideas. There is certainly something to that. And again, that's why the law was justified in the first place. But I think you have to strike a balance here. It's one thing to allow them leeway in good faith
Starting point is 00:19:23 to moderate content as they see fit, to make their own decisions about what is and is not appropriate on their website. But, you know, I think a company like Facebook, which has as large of a reach as it does and permeates so deeply into the fabric of our society, needs to be held to account in some way for its role in corrupting our democracy with false information. Yeah, and it does seem like Facebook is a, the way that the Facebook algorithm works, as you said, in order to drive engagement, it just amplifies this stuff. Right, right. It doesn't play a passive role in spreading these conspiracy theories. It plays an active role. And it's not just true for Facebook. You see it with things like YouTube where I've observed this phenomenon where particularly like to watch other people play video games. Right. And because of the way the YouTube algorithm works, that leads them to some pretty dark political videos. Things like white nationalism and the alt-right movement.
Starting point is 00:20:40 Just because a lot of people who have been into gaming have felt they're isolated and are looking for a community, they've been attracted to those types of videos and the algorithm kind of does its thing. And that's not good for any of us. So I don't think there is an easy solution here because overturning Section 230 would have its own complications. I don't think that's an easy answer.
Starting point is 00:21:04 But I think the first step is recognizing this problem, that there is a phenomenon of misinformation out there, and that these companies are playing an active role in spreading this information, even if they're claiming that, you know, it's not our fault, we're doing our best, etc., etc. And it turns out they have a financial incentive to do so. It turns out they certainly do. I mean, I think it all comes down to the bottom line, and they know that they can make money with views,
Starting point is 00:21:32 whether those views are for legitimate news stories or whether they're for conspiratorial nonsense. It's still about making money. And in a lot of industries in this country, we put regulations on people that stop them from maximizing their profits because they do harm to the public good. I'm sure if we had no environmental standards,
Starting point is 00:21:56 for example, more companies would be extremely profitable because they could just dump all their coal or whatever in our river streams. But we've decided as a society to put some guardrails on that. And perhaps it's time to apply that sort of logic to online disinformation. Because I really do think it's becoming a larger and larger problem. All right. Well, good insights as always. Ben Yellen, thanks for joining us.
Starting point is 00:22:26 Thank you, Dave. And that's the Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. And for professionals and cybersecurity leaders who want to stay abreast of this rapidly evolving field, sign up for Cyber Wire Pro. It'll save you time, keep you informed, and it's hypoallergenic. Listen for us on your Alexa smart speaker, too. The Cyber Wire podcast is proudly produced in Maryland out of the startup studios of DataTribe,
Starting point is 00:23:09 where they're co-building the next generation of cybersecurity teams and technologies. Our amazing Cyber Wire team is Elliot Peltzman, Puru Prakash, Stefan Vaziri, Kelsey Bond, Tim Nodar, Joe Kerrigan, Carol Terrio, Ben Yellen, Nick Vilecki, Gina Johnson, Bennett Moe, Chris Russell, John Petrick, Jennifer Iben, Rick Howard, Peter Kilby, and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Thank you. where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows,
Starting point is 00:24:14 helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.