CyberWire Daily - Daily: DNC hack looks like Russia's work, but Guccifer 2.0 still says no. (Nyet?)

Episode Date: June 21, 2016

In today's podcast we hear about trends in cyber espionage and ransomware. We also learn more about the DNC hack, which looks more like a Russian operation (and Guccifer 2.0 goes a little bit public and looks a lot less plausible as a lone hacktivist). XDedic looks bigger (but may be out of its stolen server-time business). GSA has a new cyber SIN, and the US Secret Service wants cyber triage tools. Israel relaxes its cyber export controls, and Wassenaar reconvenes to rework its cyber arms export control regime. Fidelis Vice President of Cybersecurity Services Mike Buratowski shares their research into the DNC hack, and CyberWire editor John Petrick explains false flags. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.S. CrowdStrike is joined by Mandiant and Fidelis

in attributing the DNC hack to Russian actors. Motherboard interviews Guccifer 2.0, whoever he may be. A bad Santa delivers ransomware to his naughty list. Researchers find real and apparent fish bait. The U.S. General Services Administration moves to facilitate cybercontracting. The U.S. Secret Service wants cyber triage tools, and it wants them pronto. Israel relaxes some cyber export controls, and Vossener reconvenes this week. I'm Dave Bittner in Baltimore with your CyberWire summary for Tuesday, June 21, 2016.

FireEye reports that the Sino-American cyber talks seem to be having good effect. The security company says that Chinese government cyber espionage directed at the United States appears to have fallen off dramatically. That's not the case elsewhere. Some of the Chinese espionage units formerly employed against American targets are showing up in campaigns directed at other countries,

notably Russia, and other target sets, notably in the financial sector. Turning to the week's continuing big story, the successful hack of the Democratic National Committee, CrowdStrike is standing by its attribution of the incident to two Russian government actors, APT-28 and APT-29, in all likelihood the FSB and the GRU. Two other companies, Fidelis and FireEyes Mandiant Unit, have investigated the evidence and reach essentially the same conclusion. The malicious code found in the attack is substantially similar to that used in other attacks by Russian actors.

Against this conclusion, of course, are claims of responsibility by Guccifer 2.0, whom we can now refer to as him. Someone representing himself as Guccifer 2.0 has been in touch with Motherboard. While many observers regard Guccifer 2.0 as a front for the Russian government, that's not so, the gentleman in question tells Motherboard. In fact, he not only doesn't work for a Russian intelligence service, he doesn't even like Russia. What he does like include, in no particular order, Gucci, Marcel Lazar, who's Guccifer 1.0, now in U.S. custody, women, and the freedom of minds. Guccifer 2.0's exchanges with Motherboard were conducted at least partially in Romanian,

and Motherboard says the Romanian native speakers it consulted say 2.0's Romanian isn't really that good. 2.0 did claim his heuristic algorithms were too much for the DNC security, that the Russian stuff in the stolen documents metadata was his personal watermark, that he feared for his life, and that he wanted to fight for the world without the Illuminati. Motherboards toned throughout its account of the exchange strikes our staff as one of polite but open-minded skepticism. We did talk to someone with first-hand knowledge of the investigation, Fidelis Vice President of Cybersecurity Services, Mike Buratowski. Here's his take on the affair.

Some of the stuff that really stood out to us was the complexity and almost grace, if you will, or the elegance of the malware that was there. complexity and almost grace, if you will, or the elegance of the malware that was there. Very complex, had a substantial amount of information in there that your normal script kitty or low-end hacker really wouldn't put in or take the time to really finesse, if you will. So what about Guccifer 2.0, the online entity claiming credit for the attack? So what about Guccifer 2.0, the online entity claiming credit for the attack? It's a little hard to say. I find it intriguing that this person just came on the scene shortly after. Crash strike reported on the actual malware, so it kind of makes you wonder about the motivations. Now, that being said, when we do investigations, it's not uncommon for there to be multiple actors in a particular

victimized company. You may trace a vector back to a particular string of malware, a particular point of entry. However, you find multiple points of entries, and a lot of times the malicious actors don't even know that there's other bad guys in the victimized network. Guccifer 2.0 says that they are a lone wolf in this attack and that CrowdStrike's attribution to Russian intelligence agencies is incorrect. Buratowski and his team at Fidelis say, not so fast. When you look at the totality of the circumstances, you're looking at the targeted victims, what information was stolen,

what was done with the information after it was taken. And when you start doing that, it paints a picture of probability as to who the actor could be. And then something as simple as, well, how complex is the malware? And would an average person or an average group have the capabilities to be that elegant, if you will, in their development of the malware? And when you start putting all those things together in this particular case, it definitely points back to a state-sponsored actor likely being a Russian actor. So, again, pointing to a specific agency, there's nothing

that would cause me to believe that CrowdStrike is incorrect. That's for sure. After the DNC's opposition research on Donald Trump was released, the head of the DNC announced that there was no personally identifiable information included in the hack, which prompted Guccifer 2.0 to release personally identifiable information in the form of donor information. Buratowski warns that there's a good chance there's still more to come. Based on the complexity of the malware that was there, I think there's a fair possibility that there's a substantial amount of information that was taken. I think it's to be determined,

but I definitely would not be surprised if we see a lot more information come out as the campaigns progress. That's Mike Buratowski. He's Senior VP of Cybersecurity Services at Fidelis. We also sat down with the CyberWire's editor, John Petrick, for some perspective on false flags and attribution. We'll hear from him after the break. So ransomware continues its evolution.

Dyad Cryptor, an EDA2 strain, is out, as we've heard, courtesy apparently of the Russian cyber mob. Sophos Labs are reporting, through dark reading, that a new variety of JavaScript ransomware, RAA, is out. It's a departure from the familiar extortion norm in that being composed in JavaScript, it doesn't depend upon the victims running a macro for infection. Phishing is, of course, a common way of distributing malware, ransomware, and other malicious code. Apple users are currently being phished with a credential-stealing malware packaged in an email alerting them to a virus in the iTunes database. There's no such virus, but if you bite on the fish bait, you may cough up your Apple ID.

An email that looks like fish bait but is actually legitimate is circulating from LogMeIn, which is asking some customers to reset their passwords in the wake of the recent credential leaks from LinkedIn, MySpace, and others. See the accounts in HelpNet Security and the Internet Storm Center for notes on what makes legitimate communication with customers look fishy. Exdedic, the underground market that sold server time on compromised RDP servers, may be larger than initially believed. Kaspersky sees some evidence from data released on Pastebin that Canadian and German servers joined Brazil, China, the U.S., and the U.K. in the top 10, but these indicators await confirmation in further investigation. In industry news, the U.S. General Services

Administration's efforts to create a new special item number for cybersecurity products, an SIN, in its IT schedule are being regarded skeptically by industry. The GSA's schedules are designed to facilitate purchases of common products and services government-wide, but some observers are dubious that the GSA will be able to keep pace with the rapid evolution of technology in the field. The U.S. Secret Service wants a quick turnaround on its own solicitation for cyber triage tools. They want tools that can be rapidly deployed for network remediation. The Secret Service hopes to issue 30 awards in each of two pools, single user licenses and malware scanning services.

Contracts are expected to have one-year periods of performance. The Israeli government, whose Unit 8200 has incubated a number of security startups, has moved to relax some of its controls on cyber exports. Internationally, Vassaner is back. Meetings resumed in Vienna yesterday on revising the controversial and in the U.S. delayed cyber arms export control regime. This round of talks will conclude tomorrow. This round of talks will conclude tomorrow. Another round of negotiations is scheduled for September, leading up to a planned December plenary session in which the parties hope to reach final agreement.

And finally, Guccifer 2.0, please feel free to come visit us. We promise there are no Illuminati here. Not much Gucci either, alas, but we hope you can overlook that. And when you come, will you bring Satoshi Nakamoto with you? We'll leave the light on. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security,

but when it comes to our GRC programs, we rely on point-in-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC.

Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data,

and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default deny approach can keep your company safe and compliant. Joining me once again is John Petrick. He's the editor of the Cyber Wire. John, we're continuing to follow this story about the hacking into the DNC. How would you categorize this? Is this a false flag situation with the Russians or covert operations? How do we label this one? There are three companies that have been investigating this. CrowdStrike is the first. They've since been joined by Fidelis and Mandiant. CrowdStrike is the first. They've since been joined by Fidelis and Mandiant.

And CrowdStrike's conclusion, which has been echoed by the other two, is that the hack of the DNC is really a job by the Russian intelligence services, by both the FSB and GRU, possibly. So people are wondering if this is so, because there's this guy calling himself, herself, themselves, Guccifer 2.0, that says, it's me. I did it. I'm a lone hacker. I hacked the DNC for my own purposes. CrowdStrike doesn't know what they're talking about. There's no Russian involvement whatsoever.

So other people have been saying, and CrowdStrike has suggested this too, is that Guccifer is a false flag. That is, Guccifer is really just a front for Russian intelligence services, that is for the FSB and the GRU. So what's a false flag? Literally, a false flag operation is when one country conducts some sort of combat operation or demonstration purporting to be members of another country, either a targeted country or an uninvolved country. It comes from the days of sale when you might raise somebody else's flag on your warship to deceive the quarry you're approaching. I don't know if this is really a false flag operation. It's a case of

the assumption of a false identity, if that's what it turns out to be. Speaking of false identities, what are some examples of that? What are other false identities people assume? Well, some of it comes down to a form of branding or even criminal branding. For example, there's a new ransomware campaign that's come to light this week. It's being called Died Kryptor. That roughly is Russian for Grandpa in Kryptor. And it's a riff on the Russian Santa Claus. They've got a bad Santa logo and everything associated with the ransomware that pops up on your screen.

So because we're a family show, maybe it's worth saying this to any of the children who listen to us in Chelyabinsk or Krasnodar or Yekaterinburg. Died Moroz is still okay. Santa's okay. Died Moros dobry. A Died Kryptor? One yet.

Wow, John, your Russian's pretty good. People are going to start to talk. You know, the GRU does have its false flags, doesn't it? There you go. Thanks for joining us, as always. Thanks for joining us as always. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home?

Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland

by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.