CyberWire Daily - Daily: Spies & crooks, together again. Artful spearphishers will eventually learn to proofread.

Episode Date: March 17, 2016

Daily: Spies & crooks, together again. Artful spearphishers will eventually learn to proofread. Malek Ben Salem from Accenture Labs explains how decoy apps are helping secure mobile devices. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K. U.S. Cyber Command's chief tells Congress nation-state intelligence services are cooperating with cyber criminals, and he's looking at you, Russia. Ransomware continues to grab up black market share, so everyone, back up your data.

Spear phishers are also getting more plausible, but they continue to stumble over proofreading. And Anonymous threatens to intervene in the campaign for the U.S. presidency. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Thursday, March 17, 2016. The convergence among criminals in nation-state espionage services continues to develop as U.S. Cyber Command Chief Admiral Rogers warned Congress during budget hearings this week. U.S. Cyber Command Chief Admiral Rogers warned Congress during budget hearings this week. Rogers, who also serves as director, NSA, singles out Russia for particular comment, noting that Russia is host to a large, capable, and sophisticated cyber criminal underground. He points out that cooperation with criminals can also provide intelligence services with deniability as well as capability. We do note that Roger's testimony comes as Congress considers

appropriations for the intelligence community, and that cybersecurity remains an issue on which there's a broad range of bipartisan consensus. But lest one be tempted to write such warnings off as mere appropriations-driven fear, uncertainty, and dread, consider recent reports that code traceable to China's People's Liberation Army has begun to appear in ransomware and of stolen digital certificates finding use in both espionage and criminal campaigns. The Chinese case illustrates the complexity of the issue. It's not clear whether code is being cooperatively lent to criminals as a matter of policy, whether it's being pilfered from the digital quartermaster's shelves,

or whether former contractors are turning to crime during a contraction in state-sponsored operations. If U.S. sources are right about state collaboration with Russian cyber mobs, and it looks as if they're on relatively firm ground here, such collaboration isn't without its hazards. Some potential blowback may have appeared in an apparent phishing campaign directed against Russian banks. Sophisticated crooks impersonated FinCert, the security arm of Russia's central bank, and successfully spearphished an undisclosed but apparently large number of Russian banks. They worked with a great deal of preparation, registering the domain FinCert.net.

That's plausible enough, but FinCert's actual domain is CBR.ru. They attached a legitimate-looking Word document to the emails. That document included a macro that downloaded a file from a remote site. The downloaded file was also signed with a legitimate Komodo-issued certificate. What tripped the crooks up and tipped off their marks, according to Kaspersky Labs, was poor proofreading. In this case, the word compromise was misspelled. The single spelling error aside, the criminals showed remarkable attention to detail throughout. They sent their emails to addresses not easily found by open searches. They formatted their fish bait document to look like FinCert's newsletter,

which, according to Kaspersky, is, quote, relatively closed and inaccessible to the general public, end quote. This suggests not only time and thought, but also access to insider information. The FinCert caper is not alone among ongoing email-based attacks. Trend Micro has been following the Olympic Vision business email compromise campaign, which continues to hit companies in the Middle East and across the Asia-Pacific region. Ransomware campaigns show no signs of slowing down. The adware-based attack that passed through major media sites and major advertising platforms late last week

is spooking the online advertising industry as it should. Some normally ad-friendly security experts are beginning to think that ad blockers might now be an important security tool. The ransomware itself continues to evolve in sophistication even as it increases its black market share. continues to evolve in sophistication even as it increases its black market share. Witness, of course, the aforementioned presence of PLA code and some of the angler-driven malvertising. Cisco's Talos Research Unit reports that TeslaCrypt has become, as they say, unbreakable. This means at least unbreakable by the tools recently developed to help people recover their files from the TeslaCrypt sequestration,

not necessarily unbreakable in principle. We wish those companies who've had success against ransomware in the past equal success in breaking the apparently unbreakable. And Fortinet finds that the familiar NEMU code has added ransomware functionality to its tool bag. With respect to ransomware, the best advice remains the old standby. Regularly and securely back up your files. If you do that, you can at

least recover your data, if not always your device. Some other malware developments are worth noting. Palo Alto says malware authors have found ways around iOS defenses with a tech code they're calling Ace Deceiver. Recorded Future reports upgrades to Hydra, which is a version of the Umbra Loader that features Tor-based support. Hydra's presence in Tor, Recorded Future suggests, will make it more elusive than the ordinary botnet. In the criminal marketplace, Shape Security describes an interesting offering, Centra MBA, an automated tool for credential stuffing that makes such attacks cheap and easy to mount.

And Proofpoint warns of the unwelcome return of Carbonac. Banks and their customers should take heed. Turning to hacktivism, Anonymous takes a break from its dauntless, if curiously well-concealed, campaign against ISIS to announce its plans to hit U.S. presidential candidate Donald Trump's online presence. The operation is planned for April 1st. A10 Networks thinks Trump's campaign unusually well-prepared against such attacks, at least if the attacks are of the denial-of-service variety. The campaign uses a content-delivery network service, and such services are designed to blunt DDoS attacks.

Anonymous has also threatened to expose Mr. Trump, which might suggest the hacktivists have something other than DDoS in mind. We close with some final thoughts on a skeptical approach to your email. If something doesn't look right, if the subject is odd, the language peculiar, the content vague, be suspicious. And note how close the Bank of Bangladesh and any number of Russian institutions came to getting looted online. The crooks were just a proofreading error away from success. At one level, this is disturbing. We hesitate to even speculate about the number of misspellings or agreement errors we ourselves commit in the haste of composition. Our publisher's staff has been having particular difficulties with the word please lately.

You'd think the suits would have mastered this magic word in all of its forms, but no. So we'll have to call him around 3 a.m. tomorrow to make sure that email is really from him. With business email compromise running amok, you can't be too sure, right? So please, that's P-L-E-A-S-E, watch your P's and Q's when emailing. I'm, like, so worried about my sister. Randy, you cannot marry a murderer. I was sick, but I am healed. Returning to W Network and Stack TV.

The West Side Ripper is back. If you're not killing these people, then who is? That's what I want to know. Starring Kaley Cuoco and Chris Messina. The only investigating I'm doing these days is who shit their pants. Killer messaged you yesterday? This is so dangerous. I got to get out of this. Based on a true story.

New season premieres Monday at 9 Eastern and Pacific. Only on W. Stream on Stack TV. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. and ISO 27001.

They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. In a darkly comedic look at motherhood and society's expectations,

Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Stream Nightbitch January 24 only on Disney+. worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default deny approach can keep your company safe and compliant.

Malek Ben Salem is the R&D manager for security at Accenture Technology Labs, one of our academic and research partners. Of course, security on mobile devices is an ongoing challenge, and you co-authored a paper on using decoy applications for continuous authentication on mobile devices is an ongoing challenge and you co-authored a paper on using decoy applications for continuous authentication on mobile devices yeah the goal was there to make detect basically any masqueraders getting access to to a mobile somebody else's mobile device and so we use decoy apps for that type of detection. The idea is that as a legitimate owner of the device, you deploy several decoy apps and you know that they're decoy, so you would not touch them. Somebody else who gets access to your device who doesn't know what's on there and who is perhaps trying to steal some information about you,

would not know what are the authentic applications and what are the decoy applications. So there is a high likelihood that they click on the wrong app. So I have an app that says, you know, it looks like my banking app, for example, something that would contain something that the bad guys would want to go after. And when they click on that app, what happens? So mobile banking apps are a great example or a great application for these types of decoy apps.

Let's say you do banking with Wells Fargo. You'll have your regular Wells Fargo mobile banking app. But you'll download another, perhaps a Bank of America app or a Citibank app. The three of them will be sitting on your device. You would know that you're doing mobile banking with Wells Fargo, so you'll only click on the Wells Fargo app. But the masquerader would not know. When they click on the wrong app,

then they get deauthenticated, what we call deauthenticated, so they get locked out of the device. We take a picture of the person using the device, we record ambient sound, and we send an email alert to the owner of the device. Clever stuff. Malik Ben-Salem, thanks for joining us. And we send an email alert to the owner of the device. Clever stuff. Malik Ben Salem, thanks for joining us.

And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home. Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers.

I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. Thank you. AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.