CyberWire Daily - Daily: Ransomware: MIRCOP, Cerber, CryptXXX, Bart, TeslaCrypt (& the #95 car). Intel selling security unit?

Episode Date: June 27, 2016

In today's podcast we offer a quick survey of the vast and spreading Ransomware landscape. (And talk about some other bits of cybercrime as well, but if Willie Sutton were alive today, and had an Internet connection, he'd be into ransomware.) Brexit's implications remain under study and speculation, but many see a shift in the tech startup scene in the general direction of Berlin. Most observers have now concluded that the DNC hack was a Russian job (and not the work of a lone hacktivist). Joe Carrigan from the Johns Hopkins University Information Security Institute reminds us why we shouldn't reuse passwords. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2ed, and Barta reported. Some are describing the current wave as a global epidemic.

Point-of-sale malware and checkout skimmers continue to bother the retail and hospitality sectors. Brexit watchers foresee a surge in Berlin's startup ecosystem. Intel is rumored to be exploring the sale of its security unit. Observers think the DNC was hacked by Russian intelligence, and speculation moves on to wonder what the Russians want to do with the U.S. election. More DNC documents are expected soon via WikiLeaks. I'm Dave Bittner in Baltimore with your CyberWire summary for Monday, June 27, 2016. Most of the hacking news to emerge over the weekend

involves developments in ransomware. Circle Sport Levine Family Racing, which races on the NASCAR circuit, revealed that in April they were hit with TeslaCrypt. The attack would have interfered with the No. 95 car's competition in the Duck Commander 500, and so the company paid the $500 ransom to restore their files. Malwarebytes has since helped remediate the attack,

and we now see the big M for Malwarebytes on the hood of number 95. Sentinel-1 reports seeing a new Cryptex variant. The malicious code, as revised, now defeats the free decryption tools that it worked against earlier versions. Avanon this morning released details on a Cerber email phishing campaign that has been discovered targeting Office 365 users. Microsoft began blocking malicious traffic last Thursday, and as always, users should look to their backups and keep their patching up to date. Trend Micro notes some oddly self-righteous behavior from Meerkop. The ransomware comes

with a Guy Fawkes mask bedizened screen, and it accuses victims of having stolen from what Trend Micro primly calls a notorious hacktivist group. The ransom demand is a very steep 48.48 Bitcoin. This is almost $29,000 at current rates, comparable to the higher end of the healthcare ransomware demand seen earlier this year. Meerkop gives the victim a Bitcoin address and tells them to pay up. That's it. The extortionists assume you're familiar with Bitcoin transactions, and they don't bother with the more detailed payment instructions most ransomware masters use. It goes without saying that the victims haven't in fact stolen anything from the hacktivist group without a name, but the accusation seems intended to make the threat scarier, although whether it proves scary

enough to induce people to cough up $29,000 remains to be seen. Perhaps the hacktivist over at Anonymous will look into this appropriation of the Guy Fawkes mask. We've seen the return of the Nekor's botnet back from this month's temporary pause. AppRiver reports having seen Locky being distributed by the bots and speculates that Nekor's masters are preparing for a large-scale criminal campaign. Fishme warns of a new Locky sibling out and active in the wild. Bart, as they're calling it, uses the same downloader as Locky, Rockloader, but unlike Locky, doesn't depend on command and control for

encryption or payment. Instead, it stores files in password-protected zip files, and it uses a victim identifier and a Tor connection to facilitate payment. Its ransom demands are also higher than Locky's, typically three bitcoin, about two thousand dollars. Phishme does have some mitigation tools available. Kaspersky looks at these incidents and others and calls a global ransomware epidemic. We imagine that would be a pandemic. In any case, ransomware appears to be working, which is why it will continue to draw cyberspace's Willie Suttons. That's where the money is.

As always, take precautions by backing up your data and avoiding reuse of passwords. We heard from the Johns Hopkins University's Joe Kerrigan about good password practices. We'll hear from him after the break. The prevalence of ransomware shouldn't induce us to forget the persistence of other forms of cybercrime. Point-of-sale attacks continue, and one self-checkout vendor, Ingenico, offers a helpful side-by-side comparison of real self-checkout card readers with bogus skimmers. Krebs on Security has the photos up on his website, but the short take is this. The criminal's skimmers are wider than the real terminals.

They have to be in order to accommodate the skimmer with the plastic overlay. PandaLabs says it's found about 200 terminals infected with the Punky POS. Panda Labs says it's found about 200 terminals infected with the Punky POS. The malware is known to have been in the wild since the spring of 2015, and it underwent an upgrade in April of this year. Most of the affected systems are in U.S. restaurants and bars. Other non-ransomware vulnerabilities and exploits are also being reported. Ben-Gurion University of the Negev Cybersecurity Research Center and Telecom

Innovation Laboratories in Berlin report that a flaw in Widevine EME CDM enables viewers to bypass protections on content streamed through Chrome. Other researchers are discussing some obfuscated JavaScript malware, a Facebook comment tagging scam, being distributed through Chrome. a Facebook comment tagging scam being distributed through Chrome. And the scary-sounding Android exploit Godless now strikes many observers as less dangerous than initially thought. Users in India, however, ought to be on their guard. The malware seems endemic there. In industry news, as analysts and investors continue to think through

the implications of last week's Brexit vote, there's little consensus as of yet, but a number of people think Europe's tech startup center of gravity is likely to move to Berlin over the next couple of years. Intel is rumored to be in talks with bankers to arrange the sale of its security unit. Intel Security was formerly known as McAfee, and it's retained that name for some of its offerings. Last week's talks about revisions to the Vossen or Cyber Arms Control Agreement are reported to have developed in a more industry-friendly direction. Industry skepticism about the very possibility of controlling software exports remain, however,

and we'll be following developments closely. Finally, at this point few people are buying Guccifer 2.0's claims to be a disinterested hacktivist who doesn't much like Russians. The emerging consensus is that the DNC hack was indeed the work of Russian intelligence services, despite a flat Kremlin denial of involvement that goes beyond the non-denial denial issued by Russia's embassy in Washington last week. SecureWorks says that Fancy Bear, that is probably the GRU,

has also been prospecting military spouses, looking for leads on U.S. military deployments and operations. It's also been looking into journalists critical of Russia and activists of unspecified but presumably unfriendly interests. Much speculation circulates that President Putin wishes to influence U.S. elections. Did we mention that this is speculation? It's speculation. More stolen documents are expected soon via WikiLeaks, so stay tuned. Miller Lite. The light beer brewed for people who love the taste of beer and the perfect pairing for your game time.

When Miller Lite set out to brew a light beer, they had to choose great taste or 90 calories per can. They chose both because they knew the best part of beer is the beer. Your game time tastes like Miller time. Learn more at MillerLite.ca. Must be legal drinking age. Do you know the status of your compliance controls right now? Like, right now.

We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC.

Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data,

and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joining me once again is Joe Kerrigan. He's from the Johns Hopkins University Information Security Institute. Joe, we've seen in many of these recent large-scale, high-profile hacking cases where gobs of passwords have been released out into the public that people are still reusing their passwords across multiple services. This is a bad idea for a lot of reasons. Right. A lot of times people reuse passwords for the sake of convenience, and they might even use the same passwords on all the sites they access. It's a profoundly bad idea because even if your provider gets breached, which happens

all over the place, we see that happen every day, we hear about it all the time, or even if your password is salted and hashed, and you're using a password that can be guessed or eventually is guessed, if you're using that on all your sites, for example, your email site, where that information may have also been leaked, well, guess what? Now your email account is also compromised. And yet people continue to do this. And I think the reason is that it's easy, it's convenient,

and strong passwords can be hard to remember. Absolutely. Strong passwords are hard to remember. And as I've said before on this podcast and to many other people, I use a password manager to help me do that. I remember one very long password, and I don't remember any other ones. And all of my passwords to access any of these sites are all different random 20-character passwords.

But I think it's that extra step that gets in the way. It is the extra step. And even as I'm sitting here advocating for this, I'm telling you this, and I'm thinking to myself, every time I need to log into one of my accounts, I sigh and I go, there's a part of me that says, I have to enter that password. I'm going to mistype it at least twice. I know it's going to take some time. But then there's another side of me that says, I have to enter that password. I'm going to mistype it at least twice. I know it's going to take some time. But then there's another side of me that goes, hey, shut up. You need to do this

because this is what makes your password secure and keeps all the money from disappearing from your bank accounts. Yeah, no, it's important stuff. All right, Joe Kerrigan, once again, thanks for joining us. My pleasure. And now a message from Black Cloak.

Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io.

And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.