CyberWire Daily - Daily: DDoSing ISIS. Political hacks. Inspiration is an info op.

Episode Date: July 21, 2016

In today’s podcast, we hear about patched vulnerabilities in widely used products—the consensus among experts is that you should patch without delay. A new ransomware variant—“HolyCrypt”-is discovered in development. OurMine hacks the Playstation boss’s Twitter account. Hackers get ready to go after US Presidential campaigns (and some have already started). ISIS information ops continue to concentrate on recruiting and inspiration. Pokemon-GO is too Darwinian for some. The University of Maryland's Jonathan Katz describes a TOR alternative. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. wall and outside-in technology draw warnings and fixes. Holy Crypt is the latest bit of ransomware.

A free decryptor is now available for BART. Turkey's crackdown on dissidents in the wake of the weekend's failed coup involves not only purges, but close attention to what's being said online. ISIS tunes its inspiration and works through some jamming. And there's now a fatwa against Pokemon Go. Hackers are expected to turn to the U.S. presidential campaigns, and neither Cozy Bear nor Fancy Bear are likely to be invited to the party. I'm Dave Bittner in Baltimore with your CyberWire summary for Thursday, July 21, 2016.

Consensus among experts at midweek is that several patches and hot fixes are indeed important and should be applied as soon as reasonably possible. The first set of these affect Apple's OS X and iOS systems. Because they involve exploitable vulnerabilities and image handling capabilities, they're being compared to last year's Android stage fright issue. The TIFF image processing bug is thought particularly easy to exploit. Many programs, notably messaging apps, email clients, and browsers, render images without using interaction. If left unpatched, vulnerable devices are susceptible to a buffer overflow condition. Once weaponized, the bugs could permit remote code execution. So the consensus is patch.

Now that Apple has a fix for the responsibly disclosed issues, Cisco's Talos unit has released some detailed information on their vulnerability research, which you can find on their website. Oracle fixed 276 issues with its software on Tuesday. 17 of the high-risk vulnerabilities patched also affect software developed by third parties. Vulnerability researchers at Cisco's Talos unit again were the ones who found and disclosed them. The Oracle Outside-In Technology, OIT, a collection of software development kits, is the locus of the vulnerabilities.

Since OIT is licensed to other companies for use in their own products, the likelihood is high that widely used software is affected. Oracle hasn't said which third-party products are affected, but CSO Magazine notes that Microsoft Exchange, Novell GroupWise, IBM WebSphere Portal, Google Search Appliance, Avira Antivir for Exchange, Raytheon Shoreview, Guidance NCase, and Veritas Enterprise Vault are known to use Oracles outside in technology. Dell has issued a hotfix for its SonicWall software, closing among six issues a backdoor disclosed by Digital Defense.

That backdoor involved a hidden default account in Dell's SonicWall global management system, weakly protected with a weak password. Sonic Global Management System is used for enterprise central monitoring and management of network security devices. And Onapsis details security issues it's found with the widely used business software SAP HANA and SAP Trex. The flaws would permit various forms of privilege escalation within affected systems. AVG finds a new strain of ransomware. They're calling it Holy Crypt, and the version they found seems to be a developmental one. Holy Crypt is written in Python and compiled into a Windows executable.

It's expected that Holy Crypt will use the customary Tor payment channels, but the story is still, as they say, developing. If you're curious about Tor, by the way, we'll learn more about it from the University of Maryland's Jonathan Katz later in this podcast. He'll discuss Tor's limitations and some emerging alternatives. AVG also has some good news. They've developed and are offering for free a decryptor for the recently discovered BART ransomware. So bravo, AVG.

ISIS sites may have come under hacktivist denial of service attack earlier this week. Some familiar tools, including NetStressor, are said to have been used in the incidents. As observers sift through the ISIS HR documents recently compromised and dumped on the Internet, they conclude that ISIS recruiting themes seem to be tailored closely to local concerns. What plays in Tunis may not succeed in Anatolia. ISIS online operations continue to focus on inspiration, and their rivals in al-Qaeda seem to be following a similar pattern. Howling to the lone wolves is likely to remain the jihadist template for information operations for the foreseeable

future. Authorities in Germany see an absence of direct command and control in the recent train attacks, and discounting the role of inspiration downplay the ISIS role. But inspiration, not direction, is what recent history should lead one to expect. Turkey's President Erdogan continues his crackdown in the wake of the failed coup attempt against him. Widespread purges continue, with senior military officials and judges regarded as likely sympathizers within the coup being the most prominent individuals purged. In sheer numbers, however, teachers seem most affected, as thousands have lost their certifications and have been removed from the classroom.

The number of people purged is said to be approaching 50,000. The government is also watching social media closely. Individuals who have tweeted either hostility toward the government or disrespect toward President Erdogan have been arrested. Other attempts at narrative control are underway. Turkey's government continues to seek to block WikiLeaks, but the more than 300,000 emails that have been dumped remain widely available. Hacktivist Phineas Fisher claims to be the one who hacked the ruling AKP party. Pokemon Go continues to give security teams, players, and advertisers fits. Its wild popularity continues to choke the bandwidth its proprietors have been able to give it, but they're working hard to scale up.

It's also unwelcome in Saudi Arabia, where religious scholars have revived their earlier fatwa against Pokemon. It's objectionable not as one might have supposed for any Shinto background, but rather because of the Darwinian undertones the scholars perceive in the way the Pokemon evolve. This suggests to some observers not so much simply killjoy disapproval of Pikachu and the others, but some haziness about what Darwinian theory actually says about evolution. It's a political year in the U.S. and a political season of that year, so hackers are turning their attention to the presidential campaigns. This week, their ministrations were directed largely to the Republicans.

The Democrats will take center stage in cyberspace when their own convention opens. Avast set up a bogus Wi-Fi hotspot in Cleveland this week outside the Republican Convention and found that many delegates and others connected to read email, browse the web, and especially play Pokemon Go. Avast wanted to make the point that unsecured public Wi-Fi is risky. That, and encourage people to sign up for security services like those boys and girls from Prague sell. We're sure, of course, that no one listening to this show would ever use free public Wi-Fi, right? I mean, we wouldn't, would we? Not even for a Charizard?

Anyway, the Republican convention was affected this week. Expect the same when the Democrats meet next week. It's a safe bet Fancy Bear and Cozy Bear won't be invited to the podium. won't be invited to the podium. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs,

we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off.

Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach

can keep your company safe and compliant. And joining me once again is Jonathan Katz. He's the director of the Maryland Cybersecurity Center, also professor of computer science at the University of Maryland. Jonathan, there are lots of good reasons for people to want to be anonymous online or protect their identities. There are lots of legitimate reasons. People can be living under oppressive regimes or things like that. And a lot of people have relied on Tor to be able to do those sorts of things. But there are some problems with Tor that have been discovered recently.

Is that correct? Yeah, that's right. I mean, basically what Tor provides, for those who are unfamiliar with it, it's a system that allows a client to connect to a server in sort of an anonymized manner, and the way Tor achieves that is by routing the connection from the client to the server through several intermediate hops in the network. So you might bounce, rather than connecting directly from the client to the server through several intermediate hops in the network. So you might bounce, rather than connecting directly from the client to the server, you would bounce, say, between three or four intermediaries until your connection, until your package

would go to the server. And this is meant to make it more difficult for an attacker to then track the source and destination of the communication. Nevertheless, it's been shown that certain information can still be extracted by a dedicated attacker. For example, timing information about when your packets leave your computer and then are received by the server. Even though an attacker can't see all the bounces that that's taking in the network, it can still correlate the outgoing time and the incoming time at the server, and from that figure out who's communicating with whom.

And so there's a new system some researchers have come up with that they say improves on this technique. That's right. So actually, it's been known for a long time that there is sort of an alternate technique that you can use to try to achieve anonymity. It's called a mixnet. And the basic idea of a mixnet is to take several communications from several clients at once, and then randomly permute them, and have that occur several times in sequence before those packets from all the different clients are routed to their respective destinations.

And this will prevent the kind of timing attacks I mentioned earlier, because you sort of ensure that several clients are all communicating at once and having their messages all delivered at once. And so it prevents exactly that attack that I talked about earlier. Now, the issue is that in the past, these systems have been relatively inefficient, and to the best of my knowledge, have not been deployed widely, certainly not as widely as Tor, and this new research proposes a more efficient implementation of these mixnets. So this new system, how exactly does it work? Well, the reason mixnets have historically been kind of slow is that they require the intermediate servers who are doing this mixing to prove correctness of their mixing or their shuffling as it's

sometimes called and traditionally that's been done using expensive public key operations and what this new system has shown is how to do that using much cheaper symmetric key operations and only relying on a single expensive public key step once per epoch of communication. And when you say expensive or cheap, is that expensive in terms of processor power? It's actually both in terms of computational effort and also communication.

All right. Jonathan Katz, thanks for joining us. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached.

Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role.

Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.