CyberWire Daily - Daily: Russian cyber ops in Syria. Ransomware evolutions. Apple vs. the US Justice Department.

Episode Date: February 22, 2016

Russian cyber ops in Syria. Ransomware evolutions. Apple vs. the US Justice Department. Johns Hopkins' Joe Carrigan talks about SCADA security, Shodan and the Internet-of-things. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K.

When it comes to Syria, Russia seems to be following the cyber ops template established in Ukraine. Hezbollah says it's compromised Israeli security cameras. template established in Ukraine. Hezbollah says it's compromised Israeli security cameras. Authorities look for a way to combat ransomware as the ex-mod shows a convergence between banking malware and extortion. We take a quick look at insurance, the IOT, and Shodan. The issues at stake in the FBI-Apple dispute come into sharper focus, and John McAfee says he's prepared to ride to the rescue. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Monday, February 22, 2016. Russian support for the Assad regime in Syria's civil war strikes observers as following patterns developed in Russia's incursions into Ukraine. Specifically, Russian forces are conducting a widespread cyber espionage campaign

against the various groups, including, of course, ISIS, who are aligned with Assad. They're also working to shape information on humanitarian disasters in Syria and to cloak, as much as possible, the extent of direct Russian intervention. Hezbollah's Kadman hacking unit claims it's compromised a number of networked Israeli security cameras. Hezbollah is a Shia group aligned with Iran. Israeli authorities haven't confirmed the compromise, but the claim is being widely reported in the Israeli press. Jumlah has joined WordPress as a target for ransomware purveyors. The actors are thought to be the same group behind the ad media campaign that's afflicted WordPress sites. The number of infections observed in Joomla is smaller than

seen in WordPress, but Joomla has a smaller base, and the infection rate is proportional to the size of that base. Rackspace, Sucuri, Malwarebytes, and Heimdall have been tracking the related campaigns. The $17,000 Hollywood Presbyterian paid to cyber extortionists last week continues to draw more sympathy than criticism. Other medical centers come forward to describe their own experiences with ransomware. Federal law enforcement agencies continue to grapple with an approach to this form of crime, even as the android ex-bot Trojan Palo Alto described last week shows a dismaying convergence between ransomware and credential harvesting. Several experts offer advice on surviving a ransomware attack. The first step in every set of recommendations is to regularly, frequently, and securely back up your data.

The JSF asterisk bug checkpoint disclosed in eBay two weeks ago is now being exploited in the wild. The online auction site's attempts to close the cross-site scripting vulnerability appear so far to have been less than fully successful. In industry news, as businesses increasingly turn to cyber insurance as a way of transferring risk, they would be well advised to read their policies carefully. A New York state court found that the owners of several upstate Five Guys restaurants had a policy that specifically excluded electronic data from its coverage. For their part, insurers are looking for sources of better actuarial data to help manage all forms of risk. Some of them see the Internet of Things as a potential mine of such data. We spoke with University of Maryland's Joe Kerrigan about getting data from the IoT, and specifically

about the Shodan search tool. We'll hear from him after the break. The dispute between Apple and the Department of Justice over the FBI's request for assistance in unlocking an iPhone used by the San Bernardino jihadists continues to dominate cyber news. It's emerging that a San Bernardino County IT staffer reset the iPhone's iCloud credentials within hours of its seizure. The Justice Department acknowledged as much in its filing, quote, the owner, San Bernardino County Department of Public Health, in an attempt to gain access to some information in the hours after the attack, was able to reset the password remotely, but that had the effect of eliminating

the possibility of an auto backup, end quote. The county says this was done at the FBI's request, and Apple points out that had they not done so, there's a good chance they would have been able to recover data that had been backed up to iCloud. Both FBI Director Comey and Apple head Cook continue their dispute in public. Comey denies asking for a backdoor, saying the Bureau wants access to one device and one device only. The Department of Justice suggested Friday that Apple is in fact more concerned with marketing than privacy. The company's refusal to comply, Justice said, quote, appears to be based on its concerns for its business model and public brand marketing strategy, end quote. For its part, Apple has said that Justice is asking for things,

quote, not even China, end quote, has asked for, and CEO Tim Cook sent Apple employees an email early this morning in which he outlined the company's position and called for a National Commission on Technology and Intelligence gathering. Both sides to the dispute have their partisans and reactions are mixed. The tech industry generally, although not unanimously, sides with Apple. The general public tends to show more sympathy for the FBI. Among pundits, there's an interesting contrast between Lawfare and The Atlantic.

Lawfare thinks Apple's off-base, going so far as to suggest some points of similarity between the company's stance in favor of privacy and Big Tobacco's invocation of civil liberties and its pushback against health concerns. But an opinion piece in The Atlantic isn't convinced by Lawfare and thinks the FBI is crying wolf. After all, The Atlantic says,

murders were successfully investigated long before there were phones. Antivirus pioneer and libertarian presidential candidate John McAfee is generally sympathetic to Apple, but he thinks he has a middle way he can offer. I will, the security legend says, free of charge to encrypt the information on the San Bernardino phone with my team. That team is the community of hackers McAfee knows at DEF CON and elsewhere. McAfee goes on. We will primarily use social engineering and it will take us three weeks. How in principle this problem might be socially engineered is unspecified, but McAfee says, I would eat my shoe on the Neil Cavuto show if we could not break the encryption on the

San Bernardino phone. We wish him success, but we have to ask, why Neil Cavuto? Neil Cavuto's fine, but was Maria healed. Returning to W Network and Stack TV. The West Side Ripper is back. If you're not killing these people, then who is? That's what I want to know. Starring Kaley Cuoco and Chris Messina. The only investigating I'm doing these days is who shit their pants. Killer messaged you yesterday?

This is so dangerous. I got to get out of this. Based on a true story. New season premieres Monday at 9 Eastern and Pacific. Only on W. Stream on Stack TV. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security,

but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC.

Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution Thank you. and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joining me is Joe Kerrigan from the Johns Hopkins Information Security Institute.

They're one of our academic and research partners. Joe, we have covered recently in the Cyber Wire Shodan, which is the search engine of the Internet of Things, according to themselves. Their claim to fame, of course, is that you can log on there and you can find unsecured baby monitors. Right. Tell us more about this. So it's a search engine where you can go out and find things that are on the Internet

and available for you to connect to. I've spent some time looking at it. It's very interesting. There are other sites out there like it. There's one that's just dedicated to open webcams where you can log on, or just not log on to anything. You just load the web page, and it starts streaming out page after page of open webcams that have been found on the internet. Yeah, I mean, there was the story

about the family whose child came to them saying that they had an imaginary friend. Right, yeah. And it turned out... It's somebody talking to them on the other end of a baby monitor. Right. Super creepy, right? Yeah. Just a little bit. So the lesson there, obviously, is when you get a new

webcam... Password protect it or make sure that it can't be accessed from the Internet or decide if that's really what you need. I've said this before and I continue to harp on it. You need to consider the size of your attack surface. Now, baby monitors and webcams are one thing, but another thing you can find here is SCADA information. SCADA devices on the Internet, unprotected. These are industrial control systems that is

presumably running at some company that's controlling some system that's just available on the internet and you can connect to it and see what it's doing. Potentially life-threatening. Absolutely. And these vulnerabilities really need to be considered when people are putting things on the internet. You really need to understand

how you should be securing these devices whatever they are from the personal level all the way up to the industrial level. You need to understand the risk that you're exposing yourself to and you need to understand how the network traffic flows not only through the internet but through your network

and what the path is to your SCADA system. Joe Kerrigan thanks for joining us. My pleasure. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home. Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io.

And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights,

receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.