CyberWire Daily - Daily: RSA wraps up. Naikon disappears, BlackEnergy is scrutinized, and mobile threats get sophisticated.

Episode Date: March 4, 2016

Daily: RSA wraps up. Naikon disappears, BlackEnergy is scrutinized, and mobile threats get sophisticated. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K.

RSA has wrapped up. Researchers see increasingly sophisticated campaigns targeting mobile devices, more discussion of the Ukrainian grid hack, France's parliament moves to preempt the Apple-FBI dispute from reappearing in France. And as health care threats rise, we learn about that sector's threat models from the University of Maryland's Marcus Roshecker. I'm Dave Bittner, back in Baltimore with your CyberWire summary for Friday, March 4, 2016. RSA wrapped up yesterday.

We're working through the interviews we conducted, and we'll be publishing several special retrospective reports on the conference's trends and tendencies next week. For today, we'll simply note that the Department of Justice seems to be occupying an increasingly lonely position in its dispute with Apple over the jihadist iPhone. Former senior officials from intelligence and homeland security agencies seem to be trending, perhaps surprisingly, toward Team Apple, and even current senior officials from the U.S. Department of Defense

showed strong encryption, and with it the commercial cybersecurity industry, a whole lot of love. Turning from RSA to the big world outside the Moscone Center, we see that Kaspersky reports that the Nikon threat group, active for more than a year in Southeast Asia, seems to have ceased operations, or at least dropped from sight. The U.S. has taken an increasingly aggressive approach to ISIS in cyberspace. Senior U.S. officials have repeatedly promised over the week that American cyberattacks will substantially degrade ISIS capabilities. ISIS appears to be earning money through various forms of currency manipulation. While this isn't exclusively being done online, it certainly touches the Internet at many points. One wonders whether the renewed U.S. cyber offensive against ISIS communications, which according to several reports is having some effect,

will eventually turn to interdiction of monetary remittance systems. The attack on western Ukraine's power grid last December attracts further analysis. The attacks were apparently Russian, but whether state-sponsored, state-inspired or freelance criminal remains up for dispute. Recorded Future compares its sources on black energy and related, or at least correlated, attack traffic, it notes that suspiciously small subnets seem to be an interesting indicator that there's something untoward going on. Tripwire also takes a look at the attack on the Ukrainian grid and draws a general lesson. Most control systems in power generation, power distribution, and elsewhere would prove vulnerable to similar attacks. The Triada Trojan currently afflicting Android devices is,

according to researchers at Kaspersky Labs, as complex as any Windows malware. Kaspersky sees the growing complexity and sophistication of mobile malware as a reflection of criminals diverting their attention toward relatively poorly protected mobile systems. The researchers suggest that increasingly well-protected desktops and laptops may be driving criminals towards softer targets. But this is far from clear, and the phenomenon may well be overdetermined. The dramatic increase in mobile usage would seem equally well accounted for on familiar Willie Sutton-esque grounds.

You'd go after mobile devices because that's where the money is. Cisco updated its switches Wednesday. Among the fixes was removal of weak static credentials. In industry news, observers are struck by a growing degree of cooperation among companies one might normally expect to have a purely competitive relationship. In the continuing dispute between Apple and the FBI over Government OS, Apple has, as we've seen, picked up a surprisingly large number of partisans among former senior U.S. intelligence and security officials. The Department of Justice is hanging tough, but it's occupying an increasingly lonely position.

The French Parliament, however, seems closer to Team DOJ. The National Assembly is moving forward with legislation designed to punish companies who provide encryption that blocks, slows, or otherwise impedes police investigations. A party that's been quiet so far in public debate about the relative merits of the Apple and FBI cases is NSA. Beyond its director's recent encryption-friendly remarks, the agency has stayed on the sidelines. The Intercept speculates that NSA has four reasons for doing so. One, the NSA tried to help but couldn't. Two, the NSA could help but doesn't want to, presumably for fear that helping would disclose capabilities it would prefer foreign governments remain unaware of. Three, the NSA isn't allowed to help. Or finally, the FBI doesn't want the NSA's help, presumably

because the Bureau would prefer setting a precedent. And finally, another online dating site. The service is MateOne, according to Motherboard, and they suffered a breach with a hacker selling 27 million account passwords in a dark web black market. So far, we've not seen reports of blackmail, but there are some technical, not necessarily adulterous similarities with Ashley Madison in the episode. Passwords were poorly constructed and protected, and the service itself was, reports say, a familiar kettle of catfish. Loved-lorn boys and girls, beware. Especially you

boys. Why do you fall for this stuff? Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows

like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge.

It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joining me is Marcus Roshecker from the University of Maryland Center for Health and Homeland Security. They're one of our academic and research partners. Marcus, we hear a lot about safety and security in the healthcare industry, but there's been talk recently that those in healthcare are looking at the wrong threat model,

that they're focused on the protection of patient data rather than patient safety. I think everyone knows by now that the healthcare sector is a prime target for cyber attacks, and they're very vulnerable. But now we're seeing that there's a real risk to overall patient healthcare because of all the medical devices that are being used to help patients, and these devices are connected to the network. So these devices that we're seeing are certainly very helpful in treating patients, but they're also very vulnerable. So there's a real risk there that these devices that are being used are going to be attacked and could ultimately harm the patient.

So are you seeing health care providers responding to these recommendations? We're seeing that the health care industry is taking note of this issue and this risk. Seeing that the healthcare industry is taking note of this issue and this risk, we are also seeing that others are trying to help the healthcare industry address this problem. The Food and Drug Administration, for example, recently came out with guidelines on protecting medical devices. End users of medical devices could turn to these guidelines and use these guidelines to help put forth a better risk strategy and to better protect the devices that they're using. Of course, the problem is that

these guidelines are voluntary, so we'll have to just hope that the users of the medical devices will end up taking note of these guidelines and implementing them. We're also seeing that in the recent Cybersecurity Act of 2015, while everyone talks about the information sharing aspect of that law, there was also a section in there that establishes a healthcare sector working group. This working group is going to be studying the problem in the healthcare sector when it comes to cybersecurity and will hopefully put forth some guidelines and recommendations that the healthcare sector can use to improve its cybersecurity. And part of what the law also

does is require that a voluntary framework, just like the framework that we've seen come out of NIST for this critical infrastructure sector, a voluntary framework will be created for the healthcare sector specifically. This voluntary framework will also put forth standards and guidelines and best practices that should be implemented by the healthcare sector to really get a more comprehensive approach to cybersecurity within the sector. Marcus Roshecker, thanks for joining us. Thanks very much. And now a message from Black Cloak.

Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening.

Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Receive alerts and act with ease through guided apps tailored to your role.

Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.