CyberWire Daily - Daily: Crypto wars updates. Iran vs. US in cyberspace. Big Angler malvertising campaign.

Episode Date: March 16, 2016

Crypto wars updates. Iran vs. US in cyberspace. Big Angler malvertising campaign. CyberWire editor John Petrik joins us to discuss the expected indictment of Iranian hackers by the US government. Chris Webber from Centrify shares tips for multi-factor authentication. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K.

High-profile news sites are hit by an Angler-driven malvertising campaign, developments in the cyber lawfare ongoing between the United States and Iran, a hacktivist star outs himself and reflects on his career, Apple's ultimate filings in the iPhone case say the government has shown neither necessity nor technical comprehension, and some thoughts on business email compromise, wire transfers, and lessons from the attempted heist at the Bangladesh Central Bank. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Wednesday, March 16, 2016. Some high-profile sites, many of them news services, have been hit by a malvertising campaign. Among the sites infected

are some belonging to the New York Times, the BBC, The Hill, Newsweek, AOL, and MSN. Attackers using the familiar Angler exploit kit are driving the campaign. Trend Micro, Trustwave, and Malwarebytes noticed a spike in malicious traffic over the weekend and have been following the issue. Not all the payloads have been captured, but it seems clear that Angler's serving up ransomware, for the most part to users in the U.S. Trustwave and Trend Micro report seeing BDEP and TeslaCrypt ransomware. Malwarebytes is showing some of the rogue domains involved in the attacks, which it says are affecting the Google, AppNexus, AOL, and Rubicon advertising platforms.

Defense and remediation are presumably underway. Malvertising harms at least three classes of victims, the affected sites, the users of those sites, and the advertising platforms. We're still watching for the much-anticipated indictment of Iranian hackers for the 2013 cyber reconnaissance of the Bowman Avenue Dam in Rye, New York. There's speculation that the people facing indictment are the same ones behind Operation Cleaver, the campaign against regional airport security, silence broke in 2014. Iran itself hasn't been idle on the lawfare front either.

The senior commander in the Revolutionary Guard says that they obtained 13,000 pages of data from devices carried by U.S. sailors captured when their Riverine command craft was detained in Iranian waters on January 12th of this year. The devices scraped are said to be laptops and GPS systems. It's unclear what sort of information was extracted, but Iran says it's putting the data to good intelligence use. The Revolutionary Guard spokesman points out, airily and primly, that Iran returned the devices themselves, although it didn't have to,

and that its extraction and use of the data they contained fall within Iran's rights under several international agreements. The Office of Inadequate Security publishes a long, interesting interview with Ghost Shell as the one-time hacktivist star continues his repentance and expiation tour. Ghost Shell's real name is Razvan Oygen-Giorgu. He's 24 and he lives in Budapest.oshel would do a lot of things differently if he had to do it over again. He wouldn't, for example, join Anonymous, which he characterizes as divided into sincere believers on one side with compromised hackers and false flag law enforcement types on the other. He thinks it's possible for both hackers and public representatives to rehabilitate themselves into legitimate jobs in IT or journalism.

And he expresses guilt over having enriched security companies with the FUD he provided. But the main impression he leaves is one of weariness. All is vanity and chasing the wind. One interesting, bold, if paranoid prediction, Giorga says he thinks the whole dark web will one day be revealed as the world's biggest honeypot. Password protection is an ongoing challenge for every organization, and many firms have turned to multi-factor authentication, or MFA, as a way of beefing up their barriers against intruders.

Chris Weber is a security strategist at Centrify, where they offer a variety of MFA solutions. He says it's important that multi-factor authentication strike a reasonable balance. We've got to make sure that the folks that are going to use it have enough of a benefit from music and understand their part and actually aren't tripping over it all the time. What we want is the ability to have multi-factor authentication everywhere with policy and context and rule sets that are smart. And so they say, hey, if I have seen this person do this thing before, if it's a device I've seen before on my corporate network, and the person has entered the appropriate password to get in, I don't need to challenge them for multi-factor authentication. The likelihood is very strong

that that is the actual user it's supposed to be, and not a bad guy masquerading like that user. But if suddenly something's different, and you see that it is that user and it is that device that I've seen before, but it's coming from a weird network or a strange country or an odd time of day, or maybe it's a totally different device that we've never seen before, maybe that's the right time to challenge for multi-factor authentication and say, hey, do me a favor, check for a text message on your phone that you should have that I know about, and let's make sure this is really you, or let me give you a phone call, and you can authenticate one or two, you know, yes, this is me, or no, that wasn't me trying to log in.

You can learn more at Centrify.com. Apple makes its last filings in the San Bernardino iPhone case before the case opens. The company says, first, that the government is adept at devising new surveillance techniques and so hasn't shown the necessity of the help it's seeking from Apple. And second, Apple says that the Justice Department's filings display a misunderstanding of the relevant technology so fundamental that it invalidates the government's case. The recent attempt on the Bangladesh Central Bank,

foiled, we again note, by some alert proofreading at Deutsche Bank, should prompt enterprise introspection over authorization and security controls. Reflect, too, on the current and growing popularity of business email compromise fraud as an attack vector. All that glitters isn't gold, and not every email that displays the CEO's name in the sender field is in fact from, you know, Scrooge McDuck, Tony Stark, Daddy Warbucks, J. Jonah Jameson, and so on. You get the picture. So stay safe with your emails out there, and just think of the happy possibilities you now have for creative, honorable insubordination.

Boss, I did see that email, but I thought I'd call you at home to double-check. Sure, I know it's 3 a.m., but better safe than sorry. Am I right? Boss? Boss? Your boss will understand. Or at least your boss may put some sensible controls in place after your boss wakes up and has some coffee. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility

is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done

five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Thank you. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joining me is John Petrick, editor of the Cyber Wire. John, we have this story about the dam in Rye, New York, being compromised by Iranian hackers. The U.S. is expected to hand down an indictment of those Iranian hackers.

Since there's really no chance that these hackers are going to see justice, why is the U.S. going through the effort of indictment? Let me offer a little context first. We're not talking here about the Grand Coulee Dam. We're not talking about a big hydroelectric dam or some kind of massive threat of flooding or a threat to the electrical grid. It's a flood control dam. It's the Bowman Avenue Dam. This has been traced to Iran fairly definitively. So is there a sense that the Iranians wanted to be caught? Was this a warning that they wanted us to know that that was them? That's not clear. There's one Iranian hacktivist group that's claimed credit for the intrusion. But as a number of cybersecurity companies have looked at that, say, that's a group that's well known for talking big without really

having actually done anything. So do they intend for the US to see it? Senator Schumer late last week said that this was a shot across our bow. You know, he was there speaking in front of the dam, visiting the dam, so on and so forth. And Schumer, of course, was calling for additional sanctions against Iran and retaliation for this. But take Schumer's metaphor seriously. If you take a shot across someone's bow, you're doing that so they'll notice. You want to send a message. You want to get them to pay attention. It's a lot like indicting someone you have no extradition treaty to get, right?

That's absolutely right. And, of course, to be clear, the hackers didn't actually change anything in the functioning of the dam. They didn't throw any switches. It was exploratory. Yeah, as far as we know, that's true. Your question is, why do we bother indicting people like that if we don't have any realistic prospect of actually bringing them in front of a U.S. court? It's been longstanding U.S. policy to do what FBI Director Comey calls impose costs on the creep behind the keyboard. If you can impose costs on individuals, if you can name and shame individuals, you may have some prospect, we think, that is the U.S. government thinks,

of altering international behavior. And then there's also always the chance you might actually get one of these guys. We've certainly picked up U.S. law enforcement authorities. We've certainly picked up Russian hackers abroad in places where they could get their hands on them because, as one FBI agent said at a meeting we were at, everybody wants to go on vacation every now and then. And if you're living in Russia, maybe you want to honeymoon in some nicer place. And when you do, the famously dogged FBI is probably going to be there waiting for you.

So these are some of the reasons why people would expect indictment. All right, John Petrick, thanks for joining us. And now a message from Black Cloak. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk.

In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. you can channel AI and data into innovative uses that deliver measurable impact.

Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.