CyberWire Daily - Daily: Brazilian, Chinese groups pledge allegiance to ISIS. Turkey's coup aftermath online.

Episode Date: July 20, 2016

In today’s podcast we review some of the cyber implications and sequelae of the apparent failed coup d’état in Turkey. Signs in the Shumukh al Islam leaks suggest ISIS is making inroads among China’s Uighur minority. A Brazilian jihadist group pledges allegiance to ISIS online, adding to Brazil’s cybersecurity (and more importantly, physical security) concerns for the Rio Olympics. enSilo reports widespread code-hooking issues in security software. A look at ransomware, and an actual sockpuppet surfaces in Canada. Morphisec's Ronen Yehoshua describes a technique they call moving target defense, and Markus Raushecker shares his take on the sentencing of a swatter who targeted Brian Krebs. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K.

Turkey's coup d'etat in its online aftermath. ISIS doxing reveals interest in Uyghur adherents. Brazil can add jihad to its Olympic worries, Taiwan's jackpotters come up lemons, code-hooking vulnerabilities affect major security products, Soak Soak serves up Cryptex, F-Secure catfishes ransomware help desks, and learns that, yeah, they really are serious about customer service.

Serial swatter Mir Islam got a year in prison. Is that enough? And an actual sock puppet represents Phineas Fisher. I'm Dave Bittner in Baltimore with your CyberWire summary for Wednesday, July 20th, 2016. The aftermath of the apparent coup d'etat in Turkey continues to be marked by purges and restrictions on various media. WikiLeaks says it sustained a denial of service attack over the weekend after announcing plans to release a tranche of Turkish government documents. The leak service has now recovered from the DDoS episode. WikiLeaks itself and many observers think the incident was the work of

the Erdogan government, although in fairness the internet will slow under heavy traffic and Twitter says it suffered some sluggishness of its own early this week. Wikileaks has now dumped the promised documents online and has been duly blocked by Turkish authorities. It is, of course, possible to work around the block, even from within Turkey. The material released consists of emails belonging to the ruling AKP party. The emails go back to 2010, to the ruling AKP party. The emails go back to 2010, with the most recent ones dating to July 6, 2016.

WikiLeaks says the leaks have no connection to anyone involved in plotting the attempted coup d'etat. Foreign Policy thinks the events in Turkey show that, quote, the Internet has torn up the playbook for how coups are won and lost, end quote. Many observers note Erdogan's use of FaceTime and suggest that the Internet generally, and some social media platforms specifically, have superseded the easily interdicted press, radio, and television that earlier coups dealt with in well-understood ways. There are reports that cell phone carriers dramatically increased user bandwidth during the incident in ways that defeated some apparent attempts to shut down online services.

Turkey has pulled out of some planned talks aimed at coordinating anti-ISIS operations. Whether this is a matter of policy or the accidental consequence of Turkish officials being busy with other things this week remains to be seen. ISIS itself has been busy elsewhere. Among the information leaked in the recent doxing of leading ISIS forum Shamukh al-Salam is correspondence with a number of Uyghur fighters in China who appear to have hitched their fortunes to the caliphate's bandwagon. Uyghur movements of various stripes have long been the subject of intense surveillance

by Chinese security services. ISIS has also surfaced online in Brazil, where the small and little-known but still to the authorities worrisome extremist group Ansar el-Khalifa has taken to Telegram to pledge fealty to ISIS. This adds a specifically jihadist element to the mix of cyber threats Brazilian authorities are coping with during the run-up to the Olympics. Cyber criminals pose the usual problems they always do to high-profile international gatherings, and hacktivists have also surfaced, most recently in the form of a distributed denial-of-service attack

anonymous-mounted against a court. This action was retaliation for a Brazilian court order blocking WhatsApp, objectionable to the judge because of its strong encryption. A higher court has since overturned this order, and WhatsApp is now available again as normal in Brazil. In vulnerability news, EnSilo warns that there are software code-hooking issues affecting more than 15 security products from leading vendors. EnSilo promises a reported black hat, but they've posted an early version of their findings

in the company's blog. Among the companies whose products are said to be affected are McAfee, Kaspersky, Symantec, Trend Micro, Bitdefender, AVG, Avast, Webroot, Emsisoft, Vera, Citrix specifically Zen Desktop, and Microsoft. The affected classes of products include data loss prevention tools, host-based intrusion prevention systems, anti-exploitation, and antivirus products. Some have already been patched, other patches are in the works. And Silo thinks thousands of products are likely to be ultimately affected,

and that fixing the problems will involve a lot of laborious recompiling of code. In the meantime, a lot of endpoints will be vulnerable to exploitation. We spoke to Morphosec's Ronan Yehoshua about other aspects of endpoint protection, and he described the limitations of what it's reasonable to expect in this area, and an innovation they've developed that they're calling Moving Target Defense. Moving Target Defense is a concept that takes the target and change it in such a way that the hacker doesn't recognize it anymore. And not only that, we do that in a randomized way each time the attacker gets into the system. So even if the attacker would understand

what we do and build an attack to overcome it, next time he will meet the system, it will be totally different. That's why we call it moving target defense. The target constantly changes in front of the hacker. Yehoshua says that one thing attackers usually count on is that once they're inside a system, they know what to expect, what files and applications will likely be found, and where they'll be located. The way that attack, advanced attacks are able to penetrate an organization today that

are so successful is because of the fact that those application operating systems are actually static. They do not change. There's one way they're working. And hackers know that. And they know that when the attack will get to the organization, they will meet the same application, the same operating system that they were designed to exploit.

A moving target defense, on the other hand, does pretty much exactly what the name implies. Yehoshua explains the technique. We take the memory structure of the target, and we use polymorphism in order to randomize it and change it. And then once the attack meets the target, suddenly it finds a totally different structure than it was designed in advance to exploit. So that's why we call it a moving target defense. The target constantly moves in front of the hacker.

And now, instead of chasing after the hacker, trying to understand what they do, those hackers need now to chase after unpredictable moving targets. It's a clever innovation, but Yehoshua warns it's not a silver bullet. The attack surface is very wide. An organization will need to protect itself with several layers. What we recommend is, you know, you keep your antivirus there. That will probably stop in a very efficient way most of the usual known attacks. And then implement exploitation technique mitigation like ours. And then if you want to really close everything around your endpoint,

you may install another layer. And the whole discussion there in the market today is, it's not what is the right product, because there's no one product that can do all. It's rather what is the right stack, what is the right combination of products the enterprise needs to have on its PC. That's Ronan Yehoshua. He's the CEO at Morphosec. Ransomware continues to be effective against a wide range of victims, and not all of them, or even most of them, are in the healthcare sector.

The SoakSoak botnet is delivering Cryptex ransomware through compromised business WordPress sites. The attackers are exploiting the RevSlider plugin. Extortionists using ransomware have long imitated certain legitimate business practices, especially customer service ones. F-Secure catfished several ransomware help desks to rate their services. They conclude that extortionists need good help desks. If you can't convince the customers you can actually restore their files,

they've got little incentive to pay up. And finally, speaking of catfish naturally turns our thoughts to sock puppets. Vice Canada has a video interview with an actual sock puppet controlled by the famous hacktivist Phineas Fisher. Mr. Fisher agreed to be interviewed, but only if they would permit him to appear visually in the form of a sock puppet. He looks kind of like Kermit, only paler and with sort of a dinosaur haircut or scale cut. We're not sure.

Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta

when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely.

Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. And I'm joined once again by Marcus Roshecker. He's with the University of Maryland Center for Health and Homeland Security. Marcus, interesting article on Krebs on Security, Brian Krebs' security-focused news and information blog, online publication, about the serial swatter, stalker, and doxer, Mir Islam, who got one year in jail for his crimes. Brian Krebs was actually doxed and swatted by this guy. Let's just start off. Explain to us, what is doxing and swatting? Yeah, so unfortunately, doxing and swatting are happening more and more frequently. Doxing basically is when an individual publishes private information

about somebody online. A lot of times you'll see public figures or celebrities being doxed by an individual where that public figures or that celebrity's private information, such as home address, phone numbers, perhaps even social security numbers and other information, gets published online for anyone to see. Swatting is also very serious. It's where an individual tricks police or law enforcement into responding to a phony incident like a hostage crisis or an active shooter incident or a bomb scare, where police are then responding to a residence or a business based on this threat that was provided to them. Remember, in this case, this threat is completely phony, totally made up. But police, of course, don't know that they're responding to a phony, totally made up, but police, of course, don't know that they're responding to a phony

threat. They think it's a real threat that they're responding to, and when they descend on a house, the individual inside is completely innocent and is completely surprised by this police presence, and it can be a very, very stressful and even dangerous situation for everyone involved. Now, in the article, certainly Brian Krebs was making the point that Mr. Islam is only getting, he will only be serving about a year in federal prison after time served. He had a 24-month sentence, but they counted time served, so he's only going to be in for another year or so. And according to Brian Krebs, you know, that's a pretty short sentence for someone who had doxed and swatted up to 19 people. I think Brian Krebs is right in that it's a pretty lenient sentence considering what happened or what might have happened for these

really serious actions here. But I think the court is also always somewhat limited in their sentencing because of the federal sentencing guidelines that exist, which provide a court with a time range within which a court may sentence an individual, perhaps even that Mr. Islam was suffering from a certain degree of mental illness that may have played into the court's decision on sentencing. If we want to prevent these kinds of actions in the future, I think, you know, one of the big pieces needs to be deterrence. And if these sentences are not strong enough, the deterrence factor might not be as effective as it could be. So we'll see. Unfortunately, I think we'll see more of these kind of types of incidents and we'll see what other courts may do in terms of their sentencing for those cases. All right, Marcus Roshecker, thanks for joining us. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home?

Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers.

I'm Dave Bittner. Thanks for listening. Thank you. you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.