CyberWire Daily - Daily: Social media collection suggests ISIS in trouble. Russian government cyber activities. US VA wants dark web help.

Episode Date: May 16, 2016

In today's podcast we discuss Germany's attribution of an ongoing cyber espionage campaign: it's Russia, says the BfV. Bank attacks continue, both related to, and unrelated to, the SWIFT funds transfer system (and some seem criminal, some hacktivist in motivation). Russia says it plans to close about 4000 sites for trafficking in extremist ideology and drugs. Markets look forward to the next cyber security bellwether stock to report. And John Leiseboer from Quintessence Labs explains random number generation. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. back. If you're not killing these people, then who is? That's what I want to know. Starring Kaley Cuoco and Chris Messina. The only investigating I'm doing these days is who shit their pants. Killer messaged you yesterday? This is so dangerous. I got to get out of this. Based on a true story. New season premieres Monday at 9 Eastern and Pacific. Only on W. Stream on Stack TV. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers.

I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash N2K and use promo code N2K at checkout. The only way to get 20% off is to go to joindeleteme.com slash N2K and enter code N2K at checkout. That's joindeleteme.com slash N2K, code N2K. ISIS may be fraying online. Germany's BFV says Russia's behind Pond Storm. Russia prepares to shut down some 4,000 sites as nests of extremism and drug trafficking.

The Vietnamese commercial bank mentioned in a Swift-related case says it detected and stopped the attempted fraud. Activists continue doxing and DDoS campaigns against banks. Bug bounties prove tough to price. The VA wants industry's help in the dark web. And how come Vlad gets better Twitter analytics than Jim? Bug bounties prove tough to price. The VA wants industry's help in the dark web. And how come Vlad gets better Twitter analytics than Jim? I'm Dave Bittner in Baltimore with your CyberWire summary for Monday, May 16, 2016. We'd like to open the week with a bit of good news and a reminder that white hats can evolve their products just as well as black hats can. Cryptex ransomware had become resistant to the tool's release to unlock its victims' files,

but Kaspersky has cracked the latest Cryptex version, and the tool to free your data is available as Rano Decryptor. It can be downloaded from Kaspersky Labs' support website. Bravo, Kaspersky! U.S. officials report signs of shrinkage and disarray in ISIS. Intelligence garnered from observation of social media suggests that the self-proclaimed caliphate is having difficulty sustaining effective inspiration online, and that pressure on the ground has induced it to declare a state of emergency in its self-proclaimed capital, Raqqa, Syria. The end game is expected to be tragic and ugly. Signs suggest ISIS may be seeking to

move its center of gravity from the Levant to the Sahara's Mediterranean coast as it shifts operations to Libya and then perhaps Tunisia. Al-Qaeda seems poised for an attempt to displace its rival in Syria itself. Expect a surge in information operations from the base. The Pond Storm Advanced Persistent Threat Group has long been regarded by observers as an agent of Russian security services. One of its victims is now making an official attribution. Germany's domestic intelligence service, the BFV, has asserted that the Russian government is engaged in a long-standing cyber espionage campaign

against a wide range of targets, enemies, or as the BFV puts it, in a way that would seem designed to suggest Kremlin paranoia, suspected enemies. The targets prominently include Germany's parliament. Pondstorm and its Safasi tool have been found in a variety of other places. Researchers at Trend Micro and elsewhere have remarked on pond storm activity in Turkey as well as Germany. Russian authorities are also active domestically, announcing plans to close some 4,000 websites on the grounds that they encourage extremism or facilitate drug trafficking. And in a move widely regarded as a response to government displeasure with its reporting on the

Panama Papers, Russian privately held news business RBC has fired its three senior editors. RBC and its editors had reported extensively on oligarchs' appearance in documents obtained through the Mossack-Fonseco breach. Investigation into the swift-linked Bangladesh bank hack continues. Researchers from BAE are doing much of the groundwork here, with more reports that malware associated with the fraud bears significant similarities to code that appeared during the Sony hack. Last Thursday, reports of another attempted bank raid appeared, and over the weekend, more information emerged. Vietnam's Tien Phong Bank says it's the bank

cybercriminals targeted, but that they were able to detect and stop the attempted fraud. Swift has continued to update its customers on this unfolding security story. For its part, the New York Federal Reserve Bank responded to an inquiry about security from U.S. Representative Carolyn Maloney, a Democrat from New York, with a statement that it stands by its funds transfer procedures and that it relies principally on swift verification for fraud prevention. The Cyber Wire received some commentary from Dave Amsler, president and founder of Raytheon Foreground Security, on what people are calling, for want of a better shorthand name, the Swift Heist. He advocates proactive hunting for threats in a network, especially as criminals grow more adept at evading detection by signatures. Even attacks previously seen can be modified into newly effective forms that evade legacy detection systems. Quote, looking at the recent swift heist, it is clear that adversaries

had gained significant access within those networks. End quote. Thus enterprises should look within as well as without. Other unrelated attacks have continued to hit banks. The Turkish hacktivist group Bazkurtlar, people seem to think they're hacktivists anyway, released data they appear to have obtained from the commercial bank of Ceylon. Bazkurtlar is thought to have been responsible for earlier similar attacks on the UAE's InvestBank and the Qatar National Bank. And Operation Icarus continues its DDoS campaign against the world financial system, as Anonymous hits banks in France, the UAE, the Philippines, Tunisia, and Trinidad and Tobago. In the marketplace, analysts continue their efforts to interpret the cybersecurity investment

rollercoaster. Cisco's results, to be announced later this week, are awaited with particular interest. Bug bounties grow in popularity. How these bounties are priced, however, remains a matter of some controversy. The market that sets the price is complex and necessarily it would seem far from transparent. Passcode notes this has led to a complicated mix

of satisfied and dissatisfied bug hunters. The U.S. Department of Veteran Affairs, the familiar VA, issued a request for information last week that asks companies what they can do to help the VA scan the dark web for evidence of compromised and stolen data. Twitter's decision late last week to end the U.S. intelligence community's access to data miner social media analytics isn't playing well in the press. Wired calls it, quote, a move that left many scratching their heads, end quote. And the Wall Street Journal notes with strong disapproval that Russia today still gets its data miner feeds. So what's up with that? It's okay to send data in near real time to Vladimir Vladimirovich,

but not to Jim Clapper? Come on, Twitter. Where's the love? Transat presents a couple trying to beat the winter blues. We could try hot yoga. Too sweaty. We could go skating. Too icy. We could book a vacation. Like somewhere hot.

Yeah, with pools. And a spa. Like somewhere hot. Yeah, with pools. And a spa. And endless snacks. Yes! Yes! Yes! With savings of up to 40% on Transat South packages, it's easy to say, so long to winter. Visit Transat.com or contact your Marlin travel professional for details. Conditions apply. Air Transat. Travel moves us. Do you know the status of your compliance controls right now?

Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security

questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Cyber threats are evolving every second, and staying ahead is more than just a challenge it's a necessity that's why we're thrilled to partner with threat locker a cyber security solution trusted by businesses worldwide threat locker is a full suite of solutions designed to

give you total control stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joining me is John Lezabor. He's the CTO at Quintessence Labs, one of our academic and research partners. John, I know random numbers are an area of research for you at Quintessence Labs. Give us an idea, how do random numbers come into play when we're talking about cybersecurity?

Almost all cryptographic operations rely on randomness for their security properties. All cryptographic algorithms, including cryptographic random number generators themselves, are deterministic. This means that given the same input and internal state, their outputs will always be the same. This is very important for operations like encryption and digital signatures. So for example, if the outputs were not deterministic, then we could never decrypt encrypted data and we could never verify a digital signature. However, if we want to use cryptography

to share information with confidentiality, integrity and non-repudiation, it's essential that session keys, identity keys, initialization vectors, nonces, other parameters that are used in cryptographic algorithms and protocols are unique, and they must be unpredictable as well. This is where random numbers come to play. So random numbers provide this uniqueness and unpredictability. All right, so from a practical point of view, what are the options when it comes

to generating random numbers? There are two forms of random number generators in general use. One's called pseudo-random number generator, the other is a true random number generator. So pseudo-random number generators, also known as deterministic random bit generators, are entirely predictable. The randomness of the outputs of a pseudo-random number generator is entirely dependent on the seed material of the input. The seed material must be unpredictable and must be truly random. So although it's a predictable source, it must be fed with an unpredictable source

to give it its randomness qualities. So the uncertainty in the output of a pseudo-random number generator decreases with every few new number drawn from it. The uncertainty is highest when the RNG is seeded or reseeded, decreases with every few new number drawn from it. The uncertainty is highest when the RNG is seeded or reseeded, but after that, the uncertainty, or the entropy content as we call it, decreases. On the other hand, true random number generators,

also known as non-deterministic random bit generators, produce unpredictable output. The most unpredictable true random number generators have what we call full entropy output. Generally, true random number generators are preferable to pseudo random number generators for security purposes. In practice, pseudo random number generators may be used because the environment or platform or some other characteristic of where the application or device is being used, is unable to support a true random number generator. However, when this is the case, the pseudo-random number generator must be seeded

and preferably reseeded with a high entropy unpredictable source of randomness, such as is produced by a true random number generator. When the environmental platform is able to support a true random number generator, there's no excuse to not use one. All right, John Leesivabor, thanks for joining us. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home. Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives.

Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses

that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.