CyberWire Daily - Daily: Hacking and hybrid warfare. Industry notes (including Wassenaar's next round).

Episode Date: August 22, 2016

In today's podcast we continue to follow the Shadow Brokers, and we take a quick look into the shadowy world of hybrid warfare. No fresh leaks in this incident, but someone seems to be using seized Silk Road Bitcoin wallets to bid on leaked files. Election hacking worries persist, and concerns about secret ballots appear. Some users want a general strike against Tor. Point-of-sale malware and what to do about it. Industry notes. A new Wassenaar round will revisit cyber arms control next month. John Leiseboer from QuintessenseLabs addresses data redundancy and replication, and Michael Marriott from Digital Shadows tells us about the shady deer.io online market. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K.

The shadow brokers in the shadowy world of hybrid warfare. Is someone using seized Silk Road Bitcoin wallets to bid on leaked files? Election hacking worries persist and concerns about secret ballots appear. Some Tor users want to call a general strike against the anonymizing network, point-of-sale malware and what to do about it. And a new Vossner round will revisit cyber arms control next month. I'm Dave Bittner in Baltimore with your CyberWire summary for Monday, August 22, 2016. The security community continues to follow the Shadow Brokers incident with close attention.

Speculation continues to point to Russian intelligence services as the source of the compromise, which is now generally regarded as genuine. One of those suggesting Russian involvement is Edward Snowden, who is, one recalls, still resident in Moscow. The Intercept reports finding strings in documents Edward Snowden took with him when he defected to Russia that are identical to some strings in the documents the shadow brokers have released, ostensibly as lost leaders for their auction. No further leaks have

appeared, and so far no one has ponied up the half-billion dollars the shadow brokers are somewhat implausibly asking for. There has been some bidding on the unreleased files, but nothing approaching the asking price. ZDNet reports seeing Bitcoin wallets seized from Silk Road in the bidding, which leads some to speculate that the U.S. government is in on the auction. The compromise has prompted considerable discussion of hybrid warfare, cyber deterrence, retaliation, and government disclosure policy. Those who have commented on disclosure policy see the incident as tipping the balance in favor of disclosure as opposed to hoarding. Other observers see tension in NSA's dual responsibility for SIGINT collection and for information assurance. We heard from Will Ackerley, CTO and co-founder of secure email

solution provider Virtru. Noting that the shadow brokers leaked exploits affected firewalls, he commented that, quote, most often data is stored on devices or transmitted without its own protections, end quote. Once an attacker is in your network, Ackerley says, the unprotected information there amounts to a sitting duck. He thinks the Shadow Brokers episode will accelerate movement away from network or device security and toward data security. Quote, the ultimate goal is to protect data from inception and only unlock it during consumption, end quote. The shadow brokers incident also continues to stoke concerns about election hacking.

Statements from U.S. election officials seek to reassure voters, but their efforts to do so seem to have achieved little beyond a mood of resignation. Observers point out that properly secured electronic voting may inevitably be in tension with voters' expectations of a secret ballot. Some users are calling for a general strike against Tor to protest the service's investigation and ouster of a high-profile Tor activist. The idea would be to take the anonymous service offline for a day. Journalist Jacob Appelbaum, who had been an important participant in the Tor project, was removed from his position following the project's investigation of allegations of misconduct. Eddie Bauer, late last Thursday, disclosed a malware infestation in its point-of-sale

system that exposed cards used in transactions between January 2nd and July 17th of this year. The infections appear to be part of the large campaign that's affected the hospitality industry. Chris Weber, security strategist at Centrify, sees the incident as a cautionary tale in the importance of securing privileged accounts. It's too easy to pivot from a single account and move through an entire network. Quote, this is because that privileged account, often a systems administrator or service account, has deep access to everything inside a network. Weber advocates policies of least privileged access, tighter controlled over shared accounts, and more closely secured remote access.

A growing trend has been the proliferation of malware as a service, providing those who are so inclined the opportunity to do their deeds at a much lower cost of entry, both financially and when it comes to technical skills. Michael Marriott is a research analyst at Digital Shadows, where they've been tracking the Deer.io marketplace. So it's a one-stop shop that many cyber criminals use to advertise and sell their goods. used to advertise and sell their goods. For eight rubles a month, which is under a dollar, you can get ready-made templates, secure hosting, anonymity, and payment processes to advertise and sell your goods. And we estimate, it's hard to be precise, but there are about 1,000 shops offering a variety of different goods and services on Deere.io.

And what kind of things are being sold here? So there's a whole host of different services. There's the site that Tessa88 was advertising. So these would be massive data dumps, such as the LinkedIn and MySpace ones. But there's also a lot of bot-registered social media accounts, which, although are not illegal, breach the terms and conditions of many sites. There's stolen and hacked accounts. There's dedicated servers.

And then we also see, yeah, the more big cybercrime elements, like DarkSide Global, which is Tess's. Is Deer.io right out in the open? Can anybody just go start shopping around in this marketplace? Sure, yeah. No, it's just on the Surface web. They've got a great interface. You can use the search bar to search for particular items that you may want.

And while it should be clear that Deer.io is not criminal in and of itself, what it's doing is just making it so much easier for these cybercriminals, which constitute about 99% of it is grey or black goods for sale. And so this is a Russian-language site. Do we know, is it actually being hosted in Russia? And if so, are the authorities simply turning a blind eye to it? It's hosted and there are a few different elements to that. It uses Voxility, which is, I believe, based in Romania.

It has been shut down previously or blacklisted by the Russian Internet monitoring authorities, if you will, for a brief period a couple of months ago. In Ukraine, a man was arrested for hosting a shop on one of these sites. But as I'm aware, there haven't been any prosecutions within Russia itself. So what do you think this speaks to in terms of this trend that we're seeing of cybercrime as a service? We've seen this before already with DDoS as a service, ransomware as a service. What I think is different about Deer.io is that all these support services that we see fragmented across various different places on the open, dark and deep web, they're all bundled together in one place. And this serves to lower the barriers to entry.

It's this trade-off between OPSEC and advertising that deters many cyber criminals from going about their day-to-day business. How much do you advertise, get your name out there become a media hit um and then through that you get more and more business but you've got the risk of overexposing yourself and leaving yourself vulnerable to competitors or law enforcement and what this is doing is sort of taking that away so if somebody's got some site they can pay very, very little money for to host, then actually they can sell things which are pretty low level, not that expensive, but those niggling illegal goods that previously wouldn't have really been feasible to sell because of all the backend hosting and templates, payments, etc.

So I think that's a really important point to bring up. That's Michael Marriott from Digital Shadows. In industry news, Cisco continues to reposition itself as a security provider. Dell talks about plans for SonicWall. And the aforementioned Virtru closes a $29 million Series A round led by Bessemer Capital. The next round of the Vossener cyber arms control talks is scheduled for September. The talks are expected to narrow the scope of intrusion software that controls industry found objectionable. The Bureau of Industry and Security at the U.S. Department of Commerce withdrew its draft rule implementing the Vossener framework in 2015 after industry objections

that the rule would essentially criminalize legitimate vulnerability research. A new draft rule is expected to be issued after the upcoming round of talks, probably in the spring of 2017. Finally, we're pleased to say that we have nothing whatsoever to say this afternoon about either Pokemon or the Incredible Hulk. Actually, we're a little sorry we don't have any more Hulk speak to share with you. Perhaps the Shadow Brokers will release some fresh communique and we'll hear more from Natalia Romanova. Did you know that the Shadow Broker is an information dealer in the Mass Effect video game?

And why do threat actors like action role-playing so much? Maybe the question answers itself. In any case, Crash Bandicoot was unavailable for comment. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this.

More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity.

That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. And I'm joined once again by John Liesbauer.

He's the CTO at Quintessence Labs, one of our academic and research partners. John, I know you wanted to share some information with our listeners about the standards when it comes to cryptographic and key management. What do we need to know about that? Common standards help enable interoperability. that? Common standards help enable interoperability. It's important, though, that the standards we use are properly defined, unambiguous, and vendor independent. There are standards for almost every technical field. For cryptography and key management, there are standards from organizations such as the IETF, Oasis, OSI, the IEEE, NIST, ANSI, the payment card industry, and plenty of others. There's no problem finding a standard in the cyber security world. Two of the most more important interoperability-focused standards, though,

for cryptography and key management would be TKSIS-11, which is public key cryptography standard number 11, and KMIP, or K-M-I-P, the Key Management Interoperability Protocol. Both of these standards are currently managed by OASIS, the Organization for the Advancement of Structured Information. And so, digging into those, I mean, how do we deal with them, and what part do they play in cryptography and security? TKSIS 11 is a standard for cryptographic application programming interface.

It defines a vendor-independent API forming cryptographic operations such as encryption and digital signatures and also key generation. PK-11 turned 25 this year, so it's quite an old standard. It was originally managed by RSA as an industry standard that moved to Oasis just over three years ago. P11 is widely used in cryptographic products, from smart cards to hardened security modules

and database encryption to web servers. Similar standards to P11 would be Microsoft CMG, or CAPI in the old days, the OpenCell API and the Java JCE interface. In fact, both OpenSSL and JCE support cryptographic providers that present a PK-11 interface. The other standard I mentioned, KMIP, specifies a protocol for the exchange of key management messages between key management clients and servers.

It specifies operations such as create, register, and get for objects like symmetric keys, key pairs, and certificates. It's a relatively new standard. It was first published in 2010. All right, interesting stuff. John Lisebar, thanks for joining us. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home?

Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com.

That's ai.domo.com.