CyberWire Daily - Careless criminals, Cisco mitigations, and Vault 7 disclosure conditions. A look at the Atlantic Council's Cyber 9/12. Cabin fever and malware infections. Kirk ransomware.

Episode Date: March 20, 2017

In today's podcast we ask whether careless cyber criminals working for the FSB blew the gaffe on the Yahoo! hack. WikiLeaks offers to share Vault 7 vulnerabilities with vendors, but it wants something in return. A look at the Atlantic Council's recently concluded Cyber 9/12 competition. Does cabin fever increase the risk of being hacked? Enigma Software saw things during last week's unseasonable US weather that suggests it might. We welcome David Dufour from Webroot to the show as our newest industry partner. And Kirk ransomware is ready to beam into your enterprise. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K. Did careless cyber criminals working for the FSB blow the gaff in the Yahoo hack? WikiLeaks offers to share Vault 7 vulnerabilities with vendors, but it wants something in return. A look at the Atlantic Council's recently concluded Cyber 912 competition. Does cabin fever increase the risk of being hacked? Enigma Software saw things during last week's unseasonable U.S. weather that suggests it might. And Kirk Ransomware is is ready to beam into your enterprise.

I'm Dave Bittner in Baltimore with your CyberWire summary for Monday, March 20, 2017. Amid the speculation about Vault 7's source in unknown, unspecified contractors, some observers are drawing a similar lesson about the Yahoo breach. The attribution that resulted in four indictments is thought unlikely to have occurred at all if Russian intelligence services hadn't relied on the services of third-party criminals. The criminals, especially the car buff arrested in Canada, got sloppy and got them all caught. The underworld might have its advantages as a source of deniable labor, particularly if you're not too morally fastidious, but then quality assurance has never been the mob's strong suit.

To return to Vault 7, Cisco has been poring over the leaks and has issued warnings about a flaw that figures in those leaks. It affects some 318 switch models. They're working on a patch, but in the meantime, they offer mitigations that users should take seriously. Chief among their advice is this, choose SSH over Telnet. Wikileaks has offered to share vulnerabilities from Vault 7 with software vendors, but it has some conditions it says industry has been disappointingly slow to meet.

It's unclear exactly what those conditions are. They're being disclosed directly to the companies in WikiLeaks' communications with them, but the conditions appear to include an undertaking to fix the vulnerabilities in question within 90 days of disclosure. A few outfits, notably Mozilla, seem to have agreed to play ball, but others, notably Google, have done nothing beyond acknowledging receipt of WikiLeaks' offer. WikiLeaks has indicated the consequences of failure to agree to the terms.

They're going to suggest that laggards are probably CIA stooges dragging their feet because of connections with the U.S. intelligence community. The Yahoo and Vault 7 incidents suggest the complexity and ambiguity common in cyberattacks, where intentions need to be imputed as much as malicious code needs to be attributed. Those conditions of uncertainty were prominently on display this past Friday and Saturday at the American University in Washington, D.C., where the Atlantic Council and its partners held their Cyber 912 competition. competition. Cyber 912 is a contest for student teams that differs from the more familiar Capture the Flag competitions in that its focus is on the development of technically informed policy recommendations. More than 40 teams drawn from 33 universities competed. Each four-person team was assigned the role of junior staffers briefing the U.S. National Security Council with policy

recommendations developed in response to an ambiguous yet yet clearly serious, crisis in Sino-American relations. The scenario went roughly as follows. Set in 2018 and notionally occurring between August 29th and September 5th of that year, the fictional situation described rising tensions between the U.S. and China, already somewhat elevated by Chinese fears that U.S. and China, already somewhat elevated by Chinese fears that U.S. public statements hinted at a retreat from the long-standing One China policy. A major Chinese bank has come under a successful distributed denial of service attack, and there are news reports that the botnets involved exploited deliberately induced

bugs in open-source software. And there's speculation U.S. intelligence services caused vendors to leave those vulnerabilities in place. In the scenario, U.S. investigations suggest the probability that Chinese criminal organizations and maybe North Korean dark soul actors were involved in the attack. The attack, however, seems to be spreading to U.S. financial institutions, one of which has informed the Department of Homeland Security of its intent to hack back against the botnets. The bank will do this under the authorities granted private sector actors by the Cyber Mark and Reprisal Act of 2018. Unfortunately, as was gradually revealed, the hacking back may have affected devices, including medical devices, that use the busybox open source code, and there are reports that this may have caused at least some medical crises,

perhaps a few actual deaths, in China. Such problems are likely to spread to the U.S. and elsewhere. China has communicated its strong outrage both privately and publicly, blaming the U.S. for, in effect, an attempted assassination as part of a larger aggression. And finally, a U.S. Navy unit, USS Blue Ridge, operating in the Western Pacific, has come under cyber attack, with its C-4 ISR systems at least temporarily degraded. Of course, the National Security Council needs to present the president with some options, and doing so was each team's task. They gave a series of 10-minute briefings to panels of judges playing the role of the National Security Council.

Their proposals, developed under realistic conditions of limited time and limited information, were varied and interesting. Those teams that had clear, multidisciplinary capabilities seemed to fare best, but the level of competition as a whole was quite high, and the teams showed commendable levels of background knowledge. The winner at the end of the two-day competition was a team from the U.S. Naval War College. Congratulations to them all, not only in being the overall winners, but also on their receipt of the Order of Thor from the Military Cyber Professional Association. Could bad weather increase your risk of malware infection? Security company Enigma Software saw some surprising things during winter storm Stella

when the in-like-a-lion weather moved through the U.S. Northeast last Tuesday. Compared to average numbers of infections in the days leading up to the storm, New York City jumped 83%, Boston 38%, Philadelphia 15%, but Pennsylvania as a whole outdid the city of brotherly love with a 79% spike, New Jersey 88%, Massachusetts 27%, and Connecticut a whopping 91%. whopping 91%. Why the spike is anyone's guess, but Enigma soberly notes that the vectors were email, and wait for it, visits to adult sites. So cabin fever may have some cyber implications. Hartford, we'd never have expected this from you of all places. And finally, there's a new strain of ransomware out there. It's being called Kirk, and its decrypter goes by Spock. Avast researchers who first found it were struck by the ransomware's obvious affinity with Star Trek themes.

It's also interesting in that the extortionists are the first to demand payment in the form of the relatively new cryptocurrency Monero, as opposed to the customary Bitcoin. So far, there are no known victims, but also no known decryption tool. How the ransomware might spread is an open question, but bleeping computer notes signs that it may be masquerading as low-orbital canon, a popular network stressor tool. In any case, we've been able to narrow the ultimate cultural source of Kirk to two points of origin, October 6, 1966, or October 6, 1967. Check out The Enemy Within and Mirror Mirror. And if your away team encounters anyone wearing

a variant Starfleet uniform and a goatee, don't click. Just cite the Prime Directive, beam up, and live long and prosper. solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security,

but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist.

Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son.

But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+.

Cyber threats are evolving every second and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications,

securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. And it's my pleasure to welcome David DeFord to the show. He's the Senior Director of Engineering and Cybersecurity at Webroot. They are our newest industry partner.

David, welcome to the show. Thank you, David. Nice to be here. Let's just start off with some introductions. First of all, tell us a little bit about Webroot. Webroot has been around for about 20 years now, and their focus primarily over the first 10 years of that time was kind of antivirus security, things like that. And in the last 10 years, we've spent a ton of time building a large machine learning knowledge, focusing on threat intelligence, automating security for large enterprises. We usually go to market through OEMs.

A lot of people have WebRoot, don't even know it. And we've still maintained that focus on endpoint solutions, but we've really evolved that into some next generation security to keep up with the market and the threats that are out there. And how about yourself? What was your pathway to coming to WebRoot? Back in the 80s, I was in the US Air Force working on large scale systems, security and things like that. Run the gambit from being a low level system developer through network security,

that type of thing. So if computers went away tomorrow, I wouldn't have a job. And then my main focus over the last several years with WebRoot has been, again, really focusing down on machine learning, integrating automation. I'm a huge proponent of automation and getting people to believe

in letting machine models do that protection for them so we can keep up with the bad guys. And that's really where my focus is now in things that I do here at WebRoot. So take us through a typical day for you. What kind of stuff are you tackling there? Well, a typical day for me, I think if you asked anybody at the company what I do, no one would be able to tell you. There's days when if there's nothing on fire and people aren't running around, I have a lot of equipment here. I play with things like Edison's. I have some routers and IoT devices that people ship to me that I try to bang on. I try to take a look at potential vulnerabilities. I'm looking at how do we take security over the next five years? You know,

with the proliferation of IoT devices, you're not really going to have the success of putting endpoint security everywhere. So we're spending a lot of time looking at moving security into the network. I spend a ton of time building ideas around machine modeling or dynamic agents to help protect smart cities and how we could plug that into the threat intelligence we have here now. So I spend a lot of time ideating, and honestly, I have the best job in the entire company. But then some days I get dragged into the day-to-day because we have some things we've got to figure out programmatically or design-wise in the current solution. All right. It sounds like there's never a dull moment there. David DeFore,

welcome to the show. We're looking forward to speaking to you again soon. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home. Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home,

your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable.

That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.