CyberWire Daily - Daily: Social media breach woes, sector analysts & investor sentiment.

Episode Date: May 31, 2016

In today's podcast we hear about the ways in which some old breaches are resurfacing to trouble major social media platforms. Those old breaches are also looking far larger than initially suspected. We learn about "sandjacking" and "bug poaching" as new additions to the lexicon of cyber crime. Analysts continue to think threats will drive cyber industry growth, and venture capital interest seems high, but more selective. Dr. Vikram Sharma from Quintessence explains One Time Pads, and Threat Quotient's Ryan Trost shares the pros and cons of attribution.  Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K.

Tough times for social media as old hacked credentials turn up for sale on the black market. Pondstorm is back, serving Russian interests In Finnish networks North Korea may be implicated In a series of ambitious bank raids In Bangladesh and elsewhere Iran and Saudi Arabia appear to be swapping hacks But whether criminal, hacktivist Or state-directed remains unclear

Dante espionage campaign Remains under investigation In industry news VCs seem interested but selective In the cyber sector. I'm Dave Bittner in Baltimore with your CyberWire summary for Tuesday, May 31, 2016. The past two weeks have been difficult ones for social media. LinkedIn realized that its 2012 breach was orders of magnitude worse than initially believed.

The network began warning customers on May 18 of this year that their passwords may have been compromised. realize that its 2012 breach was orders of magnitude worse than initially believed. The network began warning customers on May 18th of this year that their passwords may have been compromised. Since then, stolen credentials for other social media have turned up for sale in criminal markets. Leaked Source, which maintains a searchable database of compromised credentials, announced Friday that it had added more than 427 million items to its listings, most of them apparently stolen from MySpace. Criminals are selling some 360 million MySpace credentials on the black market for the low, low price of 6 Bitcoin, which is about 3,250 US dollars. The data was lost a few years ago and is now appearing on the black market

in what some think may be the largest compromise of its kind on record. Reddit, not specifically mentioning the LinkedIn compromise but alluding to an uptick in account takeovers, is also requiring its users to reset their passwords. Tumblr is also suffering from the aftermath of an old breach. 65 million email addresses and hashed and salted passwords are up for sale by Peace of Mind, also known as Peace, the same hacker or hackers who are selling LinkedIn credentials. Like the LinkedIn and MySpace breaches, the Tumblr compromise is an old one, dating to February 2013. Why data from three old breaches are surfacing now remains a matter of

conjecture. Symantec offers more evidence of North Korean involvement in Asian bank fraud attempts. Malware used to facilitate theft from the Bangladesh bank and elsewhere is sufficiently similar to that used by the Lazarus group to induce Symantec to finger Pyongyang. Whether or not the DPRK was involved, investigators in Bangladesh have shifted their view of the incident in at least one respect. They now think the theft was facilitated by an insider. Pondstorm, also known as Sophocie, is back in action against targets in Finland. The Russian espionage group is said to have hit media group Sonoma and at least one Finnish member of Bellingcat,

a citizen journalist group watching war news in Ukraine, Syria, and at least one Finnish member of Bellingcat, a citizen journalist group watching war news in Ukraine, Syria, and elsewhere. Cyber tensions rise around the Arabian Gulf. Palo Alto Networks is following an espionage campaign it's calling Oil Rig that's deploying the Helminth backdoor against targets in Saudi Arabia's banking and defense sectors. It's unclear whether Oil Rig is criminal or state-directed, or both, but Helminth's command-and-control infrastructure contains clues pointing towards Iran. For its part, Iranian authorities say they've traced an unspecified cyberattack

on the statistics center of Iran to Saudi IP addresses. They also said that there's been no organized attack by Iran against Saudi targets, but that some Iranians might have hacked the Saudis for emotional, presumably patriotic, reasons. Kaspersky continues to track the Dante cyber espionage group as it works its way through Indian targets. Dante spreads by spear phishing. Kaspersky believes it sees some commonalities between the spread of this relatively new Trojan and the Net Traveler and Dragon OK groups. Chinese-speaking hackers are thought to be running Net Traveler and Dragon OK.

We often speak of attribution when we talk about specific malware exploits, attacks, or campaigns. Attribution is assigning credit or blame to a particular group, individual, or even nation-state. Attribution can be tricky, and not everyone agrees it's valuable. Ryan Trost is CTO at Threat Quotient and suggests attribution can be a valuable tool. Defenders start to learn the moves of the adversary, what they're experts in, what their weaknesses are, and that ultimately allows them to kind of build a profile or a playbook so that as events and incidents are being triaged, they have a faster place to go to look to really kind of expedite the process completely. Once you start to see an alert

and maybe that indicator is associated to a specific adversary group. A security analyst can ultimately look at the profile of that adversary and just have a little bit better of an idea of historically what have they targeted, who have they targeted from an endpoint standpoint, is it a specific person, is it a specific database server, and that will allow them to kind of ultimately just make better decisions with their incident response procedures. It just allows them to react significantly faster. Ryan Trost is sympathetic to those who doubt the value of attribution, but he warns that they shouldn't dismiss it out of hand.

There's so much subjectiveness in attribution. There's so much shared malware and shared infrastructure out there that a lot of people think, oh, it's too diluted. You can't really get a true sense of attribution because nobody can agree on attribution. Even at the highest levels, they can't really agree on attribution too easily. So that's one side of the fence, and they do have a valid point. The other side of the fence is, well, even if it's murky water, it's still hugely beneficial because the more you know about the adversary, the better you can kind of defend yourself. So even if you're not in the business of prosecuting that criminal activity,

as defenders, you still want to start to really organize and structure it so that your IR teams and your incident response efforts can be streamlined based on the intelligence that you've built that profile off of, just the historical knowledge that your team really holds. That's Ryan Trost. He's the CTO and co-founder at Threat Quotient. IBM warns of a new trend in extortion, or at least quasi-extortion. They're calling it bug poaching, and it may be understood as an attempt to force a bug bounty. Hackers intrude into a network, contact the enterprise with evidence that they've done so, and offer to explain the vulnerability they exploited in exchange for payment. The asks are said to be

running at about $30,000. IBM is also reporting an increase in observed cases of sandjacking, in which attackers show an ability to escape iOS sandboxing. In industry news, financial analysts continue to see growing cyber threats driving further growth in the security sector, whatever bearish clouds recent results seem to have cast. A recent influx of venture capital is also taken as a positive sign, although as E-Week sees it, VCs appear to have grown more selective in looking for high payoff technologies. These include, quote, email authenticity, password security, privacy, automation, and segmentation, end quote. Cybersecurity stocks have experienced a general

increase in short interest after last week's results-driven volatility, but there's one interesting exception. Palo Alto, which saw its share price drop after reporting a loss, has also seen a decline in short interest. And finally, lest rogue states feel left out from recent social media turmoil, there are reports that a teenager from Scotland hacked North Korea's Facebook clone, StarCon.net.kp, shortly after the world became aware on Friday that the DPRK had launched its own version of Facebook. How did the young man get in? He used admin and password as his credentials, and, well, there you go. Bob's your uncle.

Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge.

It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default deny approach can keep your company safe and compliant. And joining me once again is Dr. Vikram Sharma. He's from Quintessence Labs. And Dr. Sharma, we had talked previously about quantum technology, and you touched on something called a one-time pad.

Can you tell us a little bit more about that? Absolutely, Dave. As we touched on, the quantum key distribution allows you an absolutely secure method of transporting keys between two locations. What this opens up the opportunity for is something called the one-time pad. This was a cipher that was actually invented 90-odd years ago in the 20s

by a couple of folks in the U.S. Army Signal Corps. And it relies on the idea that if you have a completely random set of keys and you use them only once and the length of the key is as big as the data, you apply this operation called an XOR between the data and the key, the output of that cipher operation

is indistinguishable from white noise and thereby you have no patterns whatsoever that can be leveraged to crack that code, therefore making it even unbreakable by a so-called quantum computer when they do come into practical existence. So is this something that is on the horizon? Is this something that we're going to see being put into use anytime soon? Well, the cipher is already being used in certain circles.

However, the issue is how do you transport that one-time key material securely between two locations? Typically, that's being done manually to date. What the quantum key distribution allows you is an optical means of transporting that key material securely between the two locations. All right, fascinating stuff. Once again, Dr. Vikram Sharma, thanks for joining us. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses

is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives

are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers.

I'm Dave Bittner. Thanks for listening. Thank you. that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.