CyberWire Daily - Daily: MedStar recovers. More on ransomware, and one weird trick to hiding $2B.

Episode Date: April 4, 2016

In today's Daily Podcast we hear about MedStar's recovery from ransomware, and a joint US-Canadian warning about the general threat of ransomware. A new strain of ransomware offers victim-friendly QR codes for easy mobile payment of ransom. The "Panama Papers," leaked by a whistle-blower, seem to offer some pretty spectacular stories of international governmental corruption. We talk to Accenture's Malek Ben Salem about securing the Internet-of-things. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. MedStar recovers from its ransomware attack, and it does so without paying ransom. Cyber rioting in Southwest Asia. The Panama Papers are out and they comprise the biggest leak in history and it's 11 million documents big. And what's Vladimir Putin's one

weird trick for making $2 billion? I'm Dave Bittner, back in Baltimore with your CyberWire summary for Monday, April 4, 2016. Ransomware and other cyber threats continue to vex North American health care providers. U.S. and Canadian authorities have issued a joint alert about ransomware, and the FBI continues its investigation of last week's MedStar hack. The Canadian Cyber Incident Response Center and the U.S. Department of Homeland Security warned that, quote, infections can be devastating to an individual or organization, and recovery can be a difficult process that may require the services of a reputable data recovery specialist, end quote. MedStar appears to have largely returned to normal operations,

and the hospital chain says it's done so without paying the hackers any ransom, let alone the $18,500 the extortionists demanded. Refusal to pay ransom is consistent with the latest guidance from both U.S. and Canadian authorities. MedStar officials said Friday they'd brought their three main patient care systems back online. Those systems include inpatient health records, outpatient health records, and the registration and scheduling system. They also said they'd found no evidence of any compromise of patient or employee information. MedStar, like other health care providers, has in recent years moved quickly toward implementation of electronic health records. Such EHRs offer many advantages

in delivering health care. New ease, for example, in avoiding unnecessary or duplicative tests, and better tailoring of treatment options to individual cases. But they do carry with them the risk of hacking that comes with all online systems. Ransomware, of course, is not confined to healthcare systems, and new variants of this form of malware continue to appear in criminal markets. You can now buy a ransomware kit for about $100 in the online black market, and the malware on offer features some victim-friendly innovations designed to make ransom payment easier. Security firm Avera reports one such development.

The Raku ransomware thoughtfully includes a QR code, so you can use convenient mobile payments to unlock your files. A very big leak is being reported by Zdeutsche Zeitung. In what's being called the biggest online leak in history, some 11 million documents totaling about 2.6 terabytes of data have been winkled out of the Panama-based law firm Masac Fonseca. Apparently, an internal whistleblower put the documents out to expose illegal currency transactions allegedly facilitated by the law firm. The data are said to indicate money laundering and the massive transfer of funds to offshore

private accounts by a number of world leaders and senior government officials. Many countries are involved, some of them surprising, like Iceland, and others less so, like Russia. The Deutsche Zeitung has said that Le Monde, the BBC, and The Guardian are also investigating the story. Prominently mentioned in dispatches is Russian President Vladimir Putin, who's said to have transferred more than a billion dollars to untraceable foreign bank accounts. We'll be following the story, already known as the Panama Papers, in upcoming editions of the Cyber Wire. Government websites in Hungary sustained a brief denial of service attack by unknown, or at least unspecified, foreign actors late last week.

Service has been restored and the incident is under investigation. Cyber rioting flares again in southwest Asia as Turkish hacktivists take up the Azeri case in the long-running dispute between Armenia and Azerbaijan over ownership of the contested province of Nagorno-Karabakh. The U.S. Justice Department warns of a coming cyber-jihad and tells Americans they'd best be prepared for it. While jihadis have so far shown more information operations capability than ability to hack, the Justice Department regards their development of such capability as effectively inevitable

and doesn't rule out the likelihood of attacks on infrastructure that would be far more destructive than the limited website defacements ISIS and others have so far been able to accomplish. Thus, concerns over the security of the burgeoning Internet of Things continue to mount. The devices connected in the IoT present a number of security challenges. We'll hear tomorrow from Skate Offense about how some of those challenges are being addressed in manufacturing control systems. Today, we get some background to what's involved in securing the IoT. Our guide is Accenture's Malek Bensalem. We'll hear from her after the break. Finally, let's return briefly to the Panama

Papers. Reports from Germany are pointing to Putin's pile of pilfered money, but we'd like to say, wow. I mean, wow. If you can build up a fortune of more than two billion dollars on a civil servant's salary, how'd he do it? He's probably got a genius for picking stocks, big four-baggers from the pink sheets, or maybe it was just working from home. But in any case, wow. So, Vladimir, the world wants to know, what's that one weird trick? In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn

as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks.

But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. Thank you. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker,

a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Malek Ben-Salem is the R&D manager for security at Accenture Technology Labs, one of our academic and research partners. A topic that comes up regularly on the Cyber Wire is the Internet of Things.

And that's an area where you all are doing a lot of research in securing the Internet of Things, yes? Yes, absolutely. One particular area that we're focused on is identity for the Internet of Things. So identity brings about a challenge within IoT for the reason of scalability. We're dealing with billions and billions of machines and devices and things that have to be authenticated. So finding a mechanism which can be used to establish an immutable machine identity is not the only challenge. The sheer scale of the number of machines that will be connected to the IoT means that identity management mechanisms must address scalability, must have appropriate governance mechanisms,

must be able to protect the privacy of machines so that, for example, valid group members without having to make the identity of individual machine instances known can have the right of privacy and can protect the privacy of users and organizations behind those machines. And this is an area that comes up with automobiles, correct? Absolutely. So think about a connected car where you have a number of interconnected machines and perhaps you'd have to replace one part within that car, perhaps from a third-party provider. You would have to deal with the identity of that thing that you're replacing. How do you authenticate it?

Is it the same part? Is it a different part for the connected system? So that's something also that has to be addressed. So it seems to me like part of the problem is there are already so many IoT devices out there and it's impractical to go back and update them to address this issue. Yes. Again, scalability is really an issue. Identity must be able to scale to give unique and immutable identity within the anticipated billions of connected machines. Malek Bensalem from Accenture Labs, thanks for joining us.

And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io.

And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy.

Learn more at ai.domo.com. That's ai.domo.com.