CyberWire Daily - Daily: Recovering from Friday's IoT-botnet driven Internet outages. Industry notes and news of cyber conflict in East Asia and the Middle East. And US-Russian tension in cyberspace remains high.

Episode Date: October 24, 2016

In today's podcast we hear about how, while the Internet has recovered from Friday's DDoS attacks on DNS provider Dyn, its users are suffering a significant hangover. No attribution, but the Jester thinks he's (she's? they're) on the case. Observers see significant potential for more damaging IoT-based attacks to come. Virginia Tech's Dr. Charles Clancy weighs in on quantum computers and encryption. And Hal Martin's lawyer adumbrates his client's defense in the case of the Top Secret Collector's Collection of Top Secret documents. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K.

The internet has recovered from Friday's DDoS attacks on DNS provider Dyn, but its users are suffering from a significant hangover. No attribution, but the jester thinks he's, she's, or they're on the case. Observers see significant potential for more damaging IoT-based attacks to come, and Hal Martin's lawyer foreshadows his client's defense in the case of the top-secret collector's collection of top-secret documents. secret documents. I'm Dave Bittner in Baltimore with your CyberWire summary for Monday, October 24, 2016.

The Internet has largely recovered from Friday's very large denial-of-service attacks, but cyberspace and its inhabitants have clearly arrived at an inflection point as important as the revelation of Stuxnet or the defection of Edward Snowden. A botnet composed of hundreds of thousands of poorly secured devices took out large sections of the Internet in at least three continents, with effects felt worldwide. Thus, the Internet of Things has been effectively weaponized. The Sunday Times put it this way, quote, hackers smell blood after co-opting

the Internet of Things, end quote. Arriving in several waves throughout the day, the distributed denial-of-service attacks produced outages mostly in the United States, Western Europe, and Australia. DNS provider Dyn was the central point of attack, although Dyn itself may not have been the ultimate target. The effect of the attacks cascaded through many popular sites, rendering services including PayPal, SoundCloud, Spotify, Reddit, and Twitter temporarily inaccessible. The DDoS attack, called by many the largest on record, follows the template established by the September 20th attacks against Krebs on Security, in which the Mirai Trojan herded a large number of insecure

Internet of Things devices into a botnet that flooded its target with more requests than the host could handle. The servers used as part of Dyn's enterprise offerings were especially targeted. The compromised devices include, prominently, security cameras and home routers, and it's thought that hundreds of thousands of these were used in the attack. Given that there are so many of these devices in the hands of small businesses and private users, and given that they tend to be poorly patched and protected, it's expected that mopping up the vulnerabilities could take years. Level 3 estimated that Mirai has infected at least 500,000 devices. ESET has also studied the problem using a sample of 12,000 SOHO routers whose owners voluntarily participated. The Bratislava-based company

found, as it told Softpedia, that 15% of the sample had weak passwords and 20% had open telnet ports, both of which are, to say the least, very bad practices indeed. One manufacturer of components used in DVRs and network security cameras says that its products were among those roped into Mirai's botnet. Hangzhou Shomai Technology said that vulnerabilities involving weak passwords in its devices were partially responsible for the disruption. It had issued firmware updates in 2015, and since then has asked customers to change default passwords, but the vulnerabilities persist in older, unpatched devices, and presumably also in those whose factory

default passwords were left in place. No one yet knows who's responsible, but there's plenty of suspicion to go around, most of it centering on either hacktivists or Russian intelligence services. The WikiLeaks-friendly New World Hackers tweeted claims of responsibility for the attacks, but observers remain cautious about buying that attribution. It's possible this could have been hacktivism, given publication of Mirai's source code in the wake of September's attacks. But it's also possible, as former NSA Director Keith Alexander speculated Saturday at PsyCon US, that the operation was a test run by

hostile security services interested in establishing a disruptive capability. Alexander said, quote, I can't think of any reason for doing what happened yesterday other than as a rehearsal, end quote. In any case, there's been no official attribution yet and no overt response beyond the mitigation steps taken to restore normal functionality. There has, however, been an apparent hacktivist response. Late Friday, an older but still accessible version of the Russian Foreign Ministry's homepage was defaced with the following text in English, quote, Comrades, we interrupt regular scheduled Russian foreign affairs website programming to bring you the following important message.

It doesn't matter whether it's you and China, you and North Korea, or you and some random group calling themselves New World Hacking. It's still a pathetic flex. Knock it off. You may be able to push around nations around you, but this is America. Nobody is impressed. Now get to your room before I lose my temper. End quote. This message was signed by an apparent hacktivist styling himself Jester. Jester, if in fact that's him or her or they, has hitherto been best known for defacing jihadist sites and has also been name-checked on Mr. Robot. The Russians aren't happy.

Even if it's an older site, they say they no longer actively maintain and have commented on Facebook to that effect. Their specialists are working on the hacks, says the foreign ministry, and if the Americans are behind it, quote, that would be far from pleasant, end quote. Vice President Biden is singled out for mention in dispatches with the suggestion that even if this is mere patriotic hacktivism, the U.S. government would bear responsibility for inciting it and putting in train a cyber

machine of destruction. IoT-driven DDoS campaigns make for a depressing view of the near future. Someone has evidently devoted some thought about how to accomplish this on a large scale. Security expert Bruce Schneier warned last month that, quote, somebody is learning how to take down the Internet, end quote. As he put it in a September 13th blog post, quote, Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. year or two, someone has been probing the defenses of the companies that run critical pieces of the internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves and what would be required

to take them down. We don't know who is doing this, but it feels like a large nation-state. China or Russia would be my first guesses, end quote. The economic consequences of the interruptions were far from trivial, even over this relatively short span of time. For small businesses who in a normal day might make half a dozen online sales using PayPal, the outage hurts. The Sydney Morning Herald notes several of the businesses who lost revenue in Australia during the disruption. They included Ticketmaster, Woolworths, and several banks.

Many observers note the potential for far more serious harm. And finally, turning from Mirai to legal matters closer to home, Hal Martin, the former NSA contractor accused of removing classified material to his house in a Baltimore suburb, foreshadowed one aspect of his defense Friday. There is nothing to indicate that Hal Martin is a traitor, his lawyer told the magistrate who ruled that Mr. Martin would be held in jail pending trial. Instead, he's a, quote, voracious learner committed to being excellent at his work, end quote, which efforts at self-betterment and professional advancement

led him to bring stuff home to get better at his job. Quote, what we see is an individual who is a collector, end quote. That's certainly one way of looking at it. But kids, and we know there are kids out there, since Admiral Rogers told us during Cyber Maryland last week that he had a bunch of you interning for him at NSA, please, don't try this at home. to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta.

Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber.

That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joining me once again is Dr. Charles Clancy.

He's the director of the Hume Center for National Security and Technology at Virginia Tech. Dr. Clancy, it seems like there's some progress being made when it comes to quantum computing, and that could lead to some troubles with encryption. Certainly. With the introduction of Shor's algorithm several years ago, there was the path such that if a quantum computer were fully realized that encryption standards such as RSA that are based on the difficulty of factoring a large composite number into the product of two primes could be exploited in a faster than exponential complexity. This means that many of the encryption algorithms that we rely on today on the Internet

would be vulnerable to exploitation and the keys could be cracked and data could be decrypted. So this has been sort of a concern that's been on the back burner for the last, I don't know, probably 15 years, ever since IBM first demonstrated an implementation of Shor's algorithm that factored the number 15 into the primes 3 and 5. But given the sort of slow progress made in quantum, it hasn't really been a primary issue. But in the last two or three years, the whole area of quantum has really begun to pick up steam, and so it sort of renewed the concerns. So have we seen a shift of people moving towards post-quantum encryption now?

Indeed, there are a number of post-quantum encryption algorithms that are being developed. We have the notion of quantum key distribution, but there are deployment challenges there. Particularly, you need to pass individual photons of light between a source and a destination. The current telecommunications infrastructure of much of the world isn't well-suited for doing things like that. But I think we've got a little bit of time before we need to worry too much about it. IBM has recently come out saying that they believe they could build a 50 to 100 qubit quantum computer that operates in a general-purpose capacity in the next decade.

quantum computer that operates in a general-purpose capacity in the next decade. And in order to really have a chance at implementing Shor's algorithm, we need something that's got more in the 4,000 to 5,000 qubit stage, which is probably still quite a ways away in terms of actual physical realization. Another important distinction to understand is there is another product on the market, the D-Wave platform, which is a quantum annealing machine that will be coming out with their 2,000-qubit system this next year. And that has lots of really interesting applications in the machine learning domain, among others, but it's really not designed to do Shor's algorithm.

In fact, researchers have shown that implementations of Shor's algorithm on the D-Wave platform do not achieve a quantum speed-up. They still exist in this exponential regime, and therefore algorithms such as RSA will not be affected. So while there are these new machines coming out that appear to have lots of qubits,

they're not designed to tackle problems such as encryption, and the ones that would be capable of that are still pretty far out in terms of their viability. Dr. Charles Clancy, thanks for joining us. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives

and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts,

and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.