CyberWire Daily - Daily: Patriotic hacktivism in South Asia? US, Russia cyber stare-down continues. IoT devices exploited as proxies. Cyber sector sees market volatility. Cartels launder money through games.

Episode Date: October 13, 2016

In today's podcast, we hear about possible patriotic hacktivism in South Asia. IoT devices are being exploited as proxies, and exploit kits continue to serve up ransomware against poorly managed systems. Market volatility puts cyber stocks on a roller coaster. The US continues to work out its proportional response to Russian election hacking. Russia says it's willing to ride out all that domestic American messiness in the hope of better relations. We welcome our newest Academic and Research Partner, Ran Yahalom, Project Leader at the Malware Lab of the Cyber Security Research Center at Ben-Gurion University. LastPass' Amber Steel shares the results of their recent password security survey. And criminal cartels use in-game currencies for money laundering. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K. devices exploited as proxies. Exploit kits continue to serve up ransomware against poorly managed systems.

Market volatility puts cyber stocks on a roller coaster. The U.S. continues to work out its proportional response to Russian election hacking. Russia says it's willing to ride out all that domestic American messiness in the hope of better relations. And criminal cartels use in-game

currencies for money laundering. I'm Dave Bittner in Baltimore with your CyberWire summary for Thursday, October 13, 2016. Patriotic hacktivism, possibly state-directed, flares again in the long-running antipathy between India and Pakistan. The difficulty of determining which crews, if any, are working under state control again points out the notorious difficulties of attribution. Compromised IoT devices have other roles to play in the criminal underground aside from being stampeded into distributed denial-of-service attacks. Krebs on Security reports that a researcher, who wishes to remain anonymous,

has observed criminals exploiting IoT-looking honeypots as proxies to hide their, that is the criminals, actual location. Concerns about the ease with which internet-connected security cameras can be exploited also arouse continuing concerns about the threat of such networked cameras being used to spy on their owners, users, and passers-by. Criminals continue to use exploit kits to serve up various forms of malware, with ransomware continuing to lead in market share. Cerber, in particular, is being widely distributed. As many observers have noted this week,

this is another object lesson in the importance of patching and other forms of good digital hygiene. The exploit kits enjoying success are exploiting little-known vulnerabilities that people have simply left open. Symantec warns that Locky ransomware is being distributed in malicious Windows script file attachments. More people are wary of exe files than they are of WSFs, but the WSFs can be just as dangerous. In industry news, cybersecurity stocks show unpleasant volatility as traders react to Fortinet's downbeat guidance on security spending trends. Investors looking beyond

short-term declines are seeing long-term opportunities, particularly in Cisco. Barracuda Networks has so far bucked this week's downward trend with share price gains. Analysts attribute the company's performance to a healthy growth in subscriptions. Long-running speculation about Imperva being an acquisition target now center on Silver Lake and Tomabravo rumored to be looking seriously at a takeover bid. In addition to the embarrassing emails WikiLeaks published last week, we can add another online problem for U.S. presidential candidate Clinton's campaign manager, Podesta. His Twitter account was hijacked yesterday to tweet,

I've switched teams, vote Trump. WikiLeaks says there are more docs to come. U.S. federal officials at the Department of Justice, Defense, and Homeland Security I've switched teams, vote Trump. WikiLeaks says there are more docs to come. U.S. federal officials at the Department of Justice, Defense, and Homeland Security continue to evolve plans for protecting state and local election infrastructure. The U.S. continues to mull its response to Russian election hacking. That response, when it comes, whatever it may prove to be, and if it's not in fact underway right now, is promised to be proportional, a concept whose home is just war theory.

Most observers think it likely to feature sanctions. Others wonder what's become of the U.S. naming and shaming strategy, and then answer their own question. Naming and shaming works against an adversary who's concerned about being shamed. Naming and shaming works against an adversary who's concerned about being shamed. The Russian embassy to the U.S., Crocodile, tweets its own take on the state of Russo-American relations, which they say they see as unreasonably damaged due to disorderly and discreditable U.S. domestic politics. As the embassy puts it, in just 129 characters, minus the hashtagging, quote, bilateral relations became collateral damage in domestic debate in US. We are open to restarting dialogue and restoring

normalcy, end quote. So there you have it. UK Foreign Minister Boris Johnson, while acknowledging the less than fully successful state of Russian relations with the UK and her allies, tells Parliament that it would be going too far to characterize those relations as a new Cold War. Security experts tell us to never reuse passwords, to never use personal information or easy-to-guess words in our passwords, and yet, many of us still do. Amber Steele is from LastPass, a password manager company, and she joins us to share the results of a recent password survey they conducted.

We know that breaches have been dominating the headlines. It feels like every couple weeks we learn that millions more passwords have been breached. But we wanted to really dig into whether people were doing anything about it. You know, we experts in LastPass have continued to warn against password reuse and encourage the use of strong passwords and good password security, but we just don't really seem to see people following that. And so we really wanted to dig deeper into why. What were the reasons behind it? Why are they creating simple, weak passwords? So for the survey, we surveyed 2,000 adults around the world. We looked at their password habits. We asked them about their beliefs around online security. We asked them about their understanding

of what secure password behavior looks like. And then when we collected those results, really what we saw was just a password paradox. At a high level, the results showed that people do understand the risks, both with weak passwords and with reusing passwords. But a large majority, 60 percent, continue to practice those behaviors anyway. And why do we think that is? What's the disconnect? behaviors anyway. And why do we think that is? What's the disconnect? Well, when we really dug into the survey results, what it really showed was that like other areas of our lives, there's a cognitive dissonance when it comes to passwords. So, you know, for example, you know that sugar is bad for you, but you want to reach for that second piece of pie. We kind of do the same thing

with our passwords. We know that we're using them as bad. We know that using short words that are based on dictionary words or words that are personal to us, we know all of that is bad. But we do it anyway because it's easy and because we're not being forced into better behavior. People know that they're not doing it right or they might go out of their way to do it right in a couple situations. So, for example, we saw that people are very concerned about protecting their online financial accounts, which makes sense. You want to protect your money. You want to protect your assets. But the behavior falls off from there. So when it comes to protecting other areas of our online lives, it becomes less important and easier to fall back into bad habits. Some of the statistics here, you were talking about people using the same passwords, which of course we know, but then also similar passwords. And it strikes me that I think a lot of people think that if they're doing minor variations

of a sort of a core common password between the different sites that they use, that maybe that'll protect them. But that's not necessarily the case. In general, we discourage from using similar passwords across sites because it just makes it that much easier for the password to be cracked. If you're significantly changing the password across websites, then yes, in theory, your risk goes down. But you know, what we always say here at LastPass is the best password is actually the one that you can't

remember. Because if you struggle to remember it, that probably means that it contains a mixture of character types. So letters, numbers, symbols, it's in a pattern that's random enough that no one else would really be able to guess it. That's the level of password security that you should be aiming for on every single website. That's Amber Steele from LastPass. You can check out the survey on their website. Widely used consumer IT products continue to arouse security worries among high-value targets in Five Eyes governments. Australia's leadership has sworn off WhatsApp as a security risk. And in the UK, security fears have led Her Majesty's government to exclude iWatches from cabinet meetings.

Industry observers acknowledge that worrying about being spied on by your iWatch may seem paranoid, but on the other hand, it's not exactly a crazy fear. Q would certainly understand. Right, Q? Q? And finally, you probably thought those in-game currencies were only good for spawning dragons, or buying sombreros for Skylanders, or upgrading your Far Cry crossbow. For the win, right? Not so, gamers. It turns out they're being exploited in the real world for less than savory purposes. Trend Micro reports finding a brisk trade in which

criminals, actually criminal cartels, farm and trade in-game currency, selling it to lazy players in exchange for real cash. So gamers, play fair. Buying coins may not be illegal, but it just doesn't seem right. And you may be helping fund some pretty nasty stuff. No sombrero is worth it, however good

you think it might look on Stealth Elf or Ningenie. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks,

like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Thank you. a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. I want to welcome our latest academic and research partner to the show. Ron Yohalem is the project leader at the Malware Lab of the Cybersecurity Research Center at Ben Gurion

University. Ron, welcome to the show. By way of introduction, why don't you tell us a little bit about yourself and the type of research that you do? I'm a PhD student at Ben Gurion University. And what we do here, we have different research involving different types of protocols and malware that operates on different types of protocols, communication protocols, USB protocols, and other such protocols. And my specific area of research is detecting anomalies in those protocols, more specifically detecting attacks that represent anomalies in those protocols. And that's how I got into USB research. During the last year, I've been researching all types of different USB-based

attacks. And my goal is to implement general anomaly detection in the method in order to be able to detect and hopefully maybe prevent USB attacks before they happen. And what is it about USB that makes it such a prime target for attackers? Well, I think the most important thing is that users tend to trust USB devices to do exactly what they think that the device is supposed to do. This trust, it just opens a wide range of attack platforms because the standard doesn't prevent USB devices to change persona. In other words, they can enumerate once they're plugged in. They can initially enumerate as a keyboard and then re-enumerate.

And that's completely compliant to the protocol as a different device. Or they can just, you know, there's no restriction as to what the firmware of a device can do. And I think that's the main problem with a USB device. That's what opens so many avenues of attack. Well, Rania Halem, welcome to the Cyber Wire. We look forward to hearing more about your research. And that's the Cyber Wire. It's Fleet Week here in Baltimore, and let me tell you, it is not easy to record a podcast while the Blue Angels are rehearsing right outside your office. And now, a message from Black Cloak. And now, a message from Black Cloak.

Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire.

We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you.