CyberWire Daily - Daily: DDoS by pingback. Twitter flaw patched. Security system flaws. Apple vs. FBI, continued.

Episode Date: February 19, 2016

Daily: DDoS by pingback. Twitter flaw patched. Security system flaws. Apple vs. FBI, continued. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K.

Twitter closes a password recovery bug and warns that it will cancel your account if you try to exploit it. Google's Project Zero finds a VCN enabled by default in a family of antivirus products. Sucuri warns about the DDoS dangers you'll present your online neighbors if you enable pingback on your WordPress site. Networked home security products may be behaving badly. The dispute between Apple and the FBI strikes observers as moving into uncharted legal waters. And hey, Air Force, life might be short, but seriously, you don't have an affair.

I'm Dave Bittner in Baltimore with your CyberWire summary for Friday, February 19, 2016. Twitter is notifying some 10,000 affected subscribers that a password recovery bug may have exposed their personal information. The problem occurred over a 24-hour period last week. Twitter says it immediately fixed the vulnerability and starchily warns that it intends to permanently suspend any accounts it determines tried to exploit the flaw to steal information. In other patch news, FireEye fixes a whitelisting issue in its NX, FX, EX, and AX products, and Google issues an update for Chrome. Google's Project Zero announces more unfortunate news for Komodo.

Komodo Antivirus, Komodo Firewall, or Komodo Internet Security are accompanied by GeekBuddy, a technical support program that installs a VCN server by default. The server comes with admin-level privileges and an easily guessed default password. Sukori warns that the pingback feature in older WordPress sites is being used to execute Layer 7 DDoS attacks against servers. Layer 7 attacks exhaust server resources at the application layer as opposed to the network layer, which means they don't require as much bandwidth or request traffic to clog their targets. Newer versions of WordPress record the IP addresses from which pingback requests originate, which makes it easier for defenders to identify the malicious command and control servers and then to shut them out. Thus,

layer 7 attacks are becoming less common, but there's an easy way to stop your site from being implicated in this kind of DDoS campaign. Disable pingpacks. That other fashionable form of cybercrime, ransomware, might get a boost from Hollywood Presbyterian's recent decision to pay hackers $17,000, or so various security pundits tell Newsweek. It's difficult to fault the hospital, though, as Malwarebytes points out. After all, they do have to take care of their patients. If you notice a.locky file extension on your system, you have been tagged by the Drydex distributed Locky ransomware, warn the Palo Alto researchers who've been tracking it. And in case you're wondering, it's Locky, not Loki, as some scholars of the poetic Edda, or at least Marvel's Avengers comic books, have speculated. Heimdall's security

can set you straight on this and all other matters as Guardian. Heimdall also warns that Lockheed has been aggressively targeting German-speaking users. Here's why people fear the Internet of Things, says Brian Krebs, as he reports on peer-to-peer networking embedded in Foscam IP security cameras. The cameras chatter a lot to various remote servers, and the peer-to-peer networking functionality is, according to Krebb, difficult to disable, requiring persistence and technical savvy beyond what most ordinary users are likely to have. In the U.S., industry remains on balance,

quite unhappy with the Vossner Cyber Arms Control Accord. The administration has suspended implementation and reopened study and comment, but a variety of technical and industry groups are pressing the Secretary of State to renegotiate the agreement as a whole. The big news today in cyber has both policy and legal implications. We refer, of course, to Apple's ongoing dispute with the Department of Justice over rendering the FBI assistance in gaining access to the San Bernardino jihadists' iPhone. The case is complex and controversial. The Justice Department isn't asking Apple to unlock the phone. Rather, it's asking them to give the FBI a special software tool

that would enable the FBI to bypass security protections and brute force that particular device's password. This sounds too close to a backdoor for comfort to many in the tech industry. On the other hand, say others in industry, the request does seem both limited in scope and within Apple's technical ability to comply. And the request isn't a search warrant. It's a request brought under an old law, the All Writs Act of 1789, the current form of which was passed in 1911. What precedence the decision might set is, according to legal observers, uncharted territory. In any case, Apple's stance is about a year in the making. The company began

pushing back what it characterized as conscription into law enforcement last year. And finally, Ashley Madison reappears in the news. Apparently, the adultery site is unusually popular among members of the U.S. Air Force, or so reports the Air Force Times. So here, as a public service to all Air Force service members, we offer these words, Article 134, Uniform Code of Military Justice. Come on, gang, straighten up, fly right. Thank you. and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now?

Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001.

They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. about my sister. Randy, you cannot marry a murderer. I was sick, but I am healed. Returning to W Network and Stack TV. The West Side Ripper is back.

If you're not killing these people, then who is? That's what I want to know. Starring Kaley Cuoco and Chris Messina. The only investigating I'm doing these days

is who shit their pants. Killer messaged you yesterday? This is so dangerous. I got to get out of this. Based on a true story. New season premieres Monday at 9, Eastern and Pacific. Only on W. Stream on Stack TV. Cyber threats are evolving every second and staying ahead is more than just a challenge.

It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today

to see how a default-deny approach can keep your company safe and compliant. It's a longstanding trend that enterprises are migrating more of their data and services to cloud providers. Law firms are no exception. Bloomberg BNA notes that more than 20 U.S. states' legal ethics organizations have issued guidelines on what counts as reasonable care in adoption of cloud services. We caught up with one of our partners at the University of Maryland

Center for Health and Homeland Security and asked Marcus Roshecker to walk us through some of the cloud's implications for any enterprise user. It seems like everyone wants to go into the cloud these days, and there are some very good reasons for that, economic reasons, productivity reasons. There are some important questions that any business should ask before they enter into an agreement with a third-party cloud provider that's going to be storing their data. So first and foremost, one of the big questions is who's going to own the data once it's up in the cloud? Does the company who generated the data, collected the data, still have full ownership?

Or does the cloud service provider have some degree of ownership there too? Another question to ask is how safe and secure is the data once it's up in the cloud? To a certain extent, a company that chooses to store data in a cloud, especially when it comes to storing data with a third-party service provider, there's a loss of a certain degree of control over the data once you're uploading that to the cloud. So there are really important questions that have to be asked when it comes to safety and security measures. Along with that, a company needs to ask who has access to the data once it's stored up in the cloud,

both from a technical side but also from a personnel side. What employees of the third-party provider have access to the data? Who can view the data, and how can they get to it? Can they get to it? What happens when I want to take my data somewhere else to another third-party provider? Can I easily take my data from the third-party provider? Can I easily take my data from the third-party provider? Can I end my contract easily? Is that data mobile?

Can I take it with me as I see fit? And then finally, who is liable for a service interruption? If for whatever reason I, as a company, or my customers, can't access the data that's stored on the cloud and there are some monetary losses associated with that, who's going to be responsible for reimbursing? Or how is all that going to be dealt with from a liability aspect? These are some very important questions to ask before entering into any agreement with a third-party cloud service provider.

What we end up seeing is that a lot of these issues are going to be settled by contract. So it's very important that when you enter into an agreement with a third-party provider who's offering cloud computing services, that that contract that you have with the cloud provider is reviewed in detail, line by line. Is it also a matter of not putting all your eggs in one basket, or are people coming up with hybrid solutions or both cloud and local redundancy?

Absolutely. When we're talking about storing data online or on a hard drive, on a server somewhere, we're always worried about storing all of our data in one basket, so to speak, and that's never a good idea. You always want to replicate data in various locations through various media. It's a good practice that in addition to storing data in a cloud, you may want to have a backup locally as well or through another cloud provider in a different location so that there are multiple ways of getting to your data. All right, Marcus Roshecker, thanks for joining us.

And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform Thank you. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io. And that's the Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening.

Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role.

Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.