CyberWire Daily - Daily: Confidence building. Offensive cyber ops. M&A notes.

Episode Date: April 18, 2016

In today's Daily Podcast we follow up with corrections to last week’s reports of Russian attacks on Sweden’s air traffic control system. The US and Russia hold talks on reducing tensions in cyberspace. The US cyber offensive against ISIS picks up its pace. Older JBoss servers are at risk of ransomware. Some M&A news in the cyber sector. And there are fresh accounts of how the Hacking Team was hacked last year. Plus, Joe Carrigan from the Johns Hopkins University Information Security Institute warns us not to trust that free airport WiFi. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K. The Swedish air traffic control outage may have been due to solar flares, not Russian attack. The U.S. and Russia meet in Geneva to work out confidence-building mechanisms for reducing tensions in cyberspace. The cyber war against ISIS picks up its pace. Cisco warns of JBoss server vulnerabilities. Details are published purporting to describe

how the hacking team was hacked. In industry news, we hear of some new acquisitions, and we learn of a strange marketing wheeze. and we learn of a strange marketing wheeze. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Monday, April 18, 2016. Sweden's Civil Aviation Administration, the LVF, is now saying that the disruptions that country's air traffic control system sustained back in November were the result of unusual solar activity. sustained back in November were the result of unusual solar activity. That makes the incident a natural phenomenon and not, as earlier suspected, Russian jamming conducted in conjunction with cyber operations as a coordinated attack. Some ambiguity remains, but for now at least, the verdict appears to be sunspots. Russian cyber operators were frisky enough late last year,

just ask utility customers in western Ukraine, but the possibilities of mistaken intentions and erroneous attribution in cyberspace are real problems. Senior U.S. and Russian officials are meeting in Geneva this week to develop confidence-building measures analogous to those that evolved during the Cold War. The U.S. is increasing the scope and tempo of cyber operations directed against ISIS. Sources in the Department of Defense have told the Daily Beast and other media outlets that they have moved beyond the initial phase of blocking and disrupting ISIS online command and control into a spyware campaign designed to identify individuals and networks engaged

in the conduct of ISIS's war against its many enemies. Much of this information is said to be fed to targeting cells planning lethal attacks on ISIS leaders and units. The U.S. is also said to have moved Marine Corps EA-6B electronic warfare aircraft into the area of operations. The venerable EA-6B Prowler, now operated only by the Marines, has received upgrades making it an effective airborne platform for cyber operations, as well as more conventional electronic warfare. German intelligence officers, RT surprisingly reports, are looking at the Snowden leaks and answering the question, who stands to gain, with Russia.

answering the question, who stands to gain, with Russia. They don't suggest that Snowden was a Russian agent, but they do think the leaks were managed in such a manner as to do maximal damage to relations between the U.S. and its allies. RT's full name is Russia Today, and the story amounts almost to an admission against interest. Maybe. Researchers at Portswigger have reported finding an XSS filter bypass vulnerability in Microsoft's Edge browser.

The flaw is thought to reside in code imported from Edge's ancestor, Internet Explorer. A patch is not yet out. Port Swigger says it disclosed the issue to Microsoft, but has received no timeline for patching. Cisco's Talos Group has again warned of the risks facing users of out-of-date JBoss servers. JBoss ransomware is active in the wild, and K-12 schools are thought particularly vulnerable. Someone using the alias Phineas Fisher has published an account on Pastebin of how he hacked Hacking Team last July. Hacking Team was much derided at the time for an executive's password choice, the ridiculously easy-to-guess password, with the

letter A in password changed to the number 4, in a bit of low-security cunning. But this isn't, says Mr. Fisher, the way he got in at all, and his drawing attention to the password was misdirection. Instead, he found an exploitable vulnerability in an embedded device. Speculation is that it may have been a switch, and he worked his way in from there. Once in, he was able to exploit unencrypted backups. All in all, the hack seemed to not have been a trivial one, and needed much more than skid skills to accomplish. Hacking Team also looks, retrospectively, a bit less ill-defended than originally suggested. By the way, the alias Phineas Fisher is an homage to another lawful intercept shop, Gamma Group,

one of whose products is the FinFisher surveillance tool. You can read his interesting account of the exploit in his Pastebin post. We have a link on the CyberWire Daily News Brief. Softpedia thinks a bit about the Tor browser exploit the U.S. Federal Bureau of Investigation deployed a few months ago to reel in some child pornographers, and Softpedia thinks the episode suggests that the bureau is sitting on a Firefox Zero day. The online publication predicts a wave of FBI MoMozilla litigation over Firefox security. Three acquisitions in the security sector are being discussed as the week begins.

Magic Leap, a U.S. virtual and augmented reality startup, has bought Israeli security shop BitNorth. Their intention, they say, is to ensure that their products ship with the best possible security built in. AlertLogic has bought Click Security, augmenting its analytics and threat intelligence capability. And finally, French company Orange Cybersecurity has acquired Lexi, a threat intelligence services shop. We close with an adventure in marketing and a riddle. When is a catastrophic data loss not a catastrophic data loss? Answer, when it's a hoax. Italian funster Marco Marsala, who also owns a web hosting company, posted this message to Stack Overflow's

server fault forum last week, saying he accidentally deleted his whole company with some wayward bash script. But it turns out the whole thing was a gag, a marketing stunt to promote his business. But it turns out the whole thing was a gag, a marketing stunt to promote his business. How that might work as marketing is unclear. But what fun, huh? Did you find Mr. Marsala's gag funny? Neither did Stack Overflow. They've communicated their displeasure. Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword.

It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security,

but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber. That's vanta.com slash cyber for $1,000

off. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures.

Stream Night Bitch January 24 only on Disney+. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive

data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default deny approach can keep your company safe and compliant. Joining me once again is Joe Kerrigan from the Johns Hopkins University Information Security Institute, one of our academic and research partners. Joe, we were both traveling recently. We came back from the Women in Cybersecurity Conference, and my flight was delayed. I was sitting in the airport in Dallas and wondering if I should jump on the airport Wi-Fi. Good idea or not? I think it's a bad idea. And I'm just going to say that any of these public Wi-Fi access points, particularly if they're unencrypted, are generally a bad idea. There could be anything else on the network.

You may not even actually be connecting to a Wi-Fi access point that's controlled and operated by an airport or by some trusted entity. It could just be a rogue access point that looks like an airport or a Starbucks or whatever McDonald's Wi-Fi access point. So all of my data in that case could be flowing through to some bad actor and they're analyzing it, pulling out, you know, my personal information. And to me, it looks like I'm on just a regular public Wi-Fi. Yeah, if you're not paying attention, it would look like you could be subjected to a man in the middle attack very easily.

So what's a way around it? Are there ways I can, even with public Wi-Fi, I can do what I need to do and be secure about it? You can increase or reduce your risk by using a commercial VPN product. VPN is Virtual Private Network. It creates a tunnel connection to their service, and this would be a service that you trust. I use one. It costs about $30 a year. The encrypted tunnel is from my computer to their computer, and then they access the Internet on my behalf. So that connection is fully encrypted, so even the traffic going over the public Wi-Fi, no one can see inside of it.

That's correct. All right. Good advice. Joe Kerrigan, thanks for joining us. My pleasure. And now, a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected

lives. Because when executives are compromised at home, your company is at risk. In fact, over one third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows,

helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.