CyberWire Daily - Daily & Week in Review: Bear again, and WikiLeaks (also again). Chinese hackers return, now after infrastructure companies. Debit card hacking epidemic in India.

Episode Date: October 21, 2016

In today's podcast we follow the developing story of intermittent DDoS attacks affecting Internet sites throughout the US East Coast. Hotspot vigilantes try to get Julian Assange reconnected inside Ecuador's London embassy. More election documents appear in WikiLeaks. Russia offers to monitor US elections. NSA's Director talks about labor force issues. The University of Maryland's Jonathan Katz explains an update to a key encryption component of the internet. Guest Kevin Green from DHS describes his work on software assurance programs. And some advice from the Cyber Security Hall of Fame: You want security, convenience, and freedom? Pick two. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K.

DDoS takes down Internet sites throughout the U.S. East Coast. Hotspot vigilantes try to get Julian Assange reconnected inside Ecuador's London embassy. More election documents appear in WikiLeaks. Russia offers to monitor U.S. elections. NSA's director talks about labor force issues and some advice from the Cybersecurity Hall of Fame. You want security, convenience, and freedom? Pick two. Pick two. I'm Dave Bittner in Baltimore with your CyberWire summary and week in review for Friday, October 21, 2016. Multiple outlets are reporting that Dyn, a major DNS provider, has come under repeated denial of service attacks.

This is causing widespread outages along the U.S. eastern seaboard. Many popular sites, including Twitter, Amazon, SoundCloud, Spotify, Netflix, Reddit, Discus, PayPal, and Constant Contact have been intermittently up and down throughout the day. Dine and the affected sites are coping with these sequential waves of DDoS attack, but like our neighbors, we've been observing these issues all day. The story is developing. We'll follow it into next week. Fancy Bear continues its busy romp through Russia's Western targets, not just the U.S. Democratic National Committee and various high numeros in the Clinton campaign. But, according to ESET, more than 1,800 distinct email addresses throughout Europe, the Middle East, North America, and Latin America.

Bitly-based phishing links were evidently used to compromise the Gmail accounts of both Clinton operative John Podesta and former Secretary of State Colin Powell. Motherboard has a nice catch of convincing-looking fish bait. They invite you to look and consider whether you'd bite. catch of convincing-looking fish bait. They invite you to look and consider whether you'd bite. The spoofing is, as former Homeland Security Secretary Chertoff told an audience at Cyber Maryland today, quite persuasive and convincing. U.S. Director of National Intelligence Clapper says that there's really no serious doubt the Russian services are the ones culling and distributing the election season's email sleaze, and ODNI's got the forensics to back up the attribution. Fancy Bear's take continues to be distributed through

DCLeaks and Wikileaks. The latter has released, among other stuff, one of President Obama's pre-presidential email addresses. TechCrunch tried emailing him. It didn't bounce, but no reply yet. emailing him. It didn't bounce, but no reply yet. WikiLeaks' Julian Assange remains in Ecuador's London embassy. Ecuador continues to extend him asylum, but they've cut off his internet. A number of Wi-Fi vigilantes are said to be hanging around outside, offering Mr. Assange the use of their hotspots, but with what success is unknown. The Russian government, through its crocodile tears, has expressed an interest in monitoring U.S. elections, about which they profess concern. There's no U.S. response to this offer yet, but we did hear former Homeland Security Secretary Chertoff comment on Russian

election monitors this afternoon at Cyber Maryland. Quote, I'd like to say come on over and see how a real democracy works, but sometimes you have to be willing to put yourself under the same standards you apply to others. I'm only being semi-facetious when I say, great, come and observe. God bless, come and do that. End quote. So who knows? Will it happen? Probably not. Still, fun to think about. ThreatConnect reports that the same Chinese actors believed to have hacked the U.S. Office of Personnel Management and the Anthem Insurance Network are back, now targeting Franco-American infrastructure companies.

A number of U.S. officials have recently pointed to a marked increase in Chinese government hacking, so this new campaign appears to be either an outlier or a resumption of earlier practices. An ATM hacking wave has hit India. Debit cards are being affected. Major Indian banks are coping with the problem by replacing compromised debit cards. We've been attending Cyber Maryland, which is wrapping up this afternoon. Yesterday morning, NSA Director Admiral Michael Rogers opened the conference with a keynote that called for more efforts in cybersecurity workforce development,

he noted NSA's internship program with particular satisfaction. More public-private cooperation, he thinks the private sector should tell the government what kind of information it needs, the requirements for information sharing in particular should originate in the private sector. Faster acquisition authority, an FY2017 pilot in the U.S. Cyber Command, will, he hopes, prove a successful model for the future, and some serious national introspection about what foreign adversaries in cyberspace mean for American society and the American political system. His emphasis on the importance of workforce development was brought into sharper relief by those who introduced him. A high school junior from Baltimore County's Loyola-Blakefield School and its award-winning cyber program

did the honors. Also at Cyber Maryland, we caught up with Joey Munez, technical solutions architect with Cisco. He gave a talk at the conference explaining various types of cyber attacks and how they differ from the way Hollywood often portrays them. I think in general people are just misled. So it can be that the media like you're talking about is misleading them. It could be the vendors saying, hey, buy this magic product and you're going to be safe. And they actually get a false sense of security from that. I think even compliances and some of those regulations, somebody says, oh, we've met this particular regulation, we're safe now, which we're not, because that regulation is X amount of months, years old. So I think in general, as an industry,

a lot of that weeds where if you just kind of jump in, you're not getting the right information. And that's all misleading. Last night's induction ceremonies for the National Cybersecurity Hall of Fame were marked by graceful speeches by those who received the award. Congratulations to all of them. Most of the newest members of the Hall of Fame saw difficult challenges ahead for cybersecurity, even as they acknowledged their colleagues, students, and mentors. We'll note something Dan Gere closed with, giving him the last word.

Referring to a NORAD commanding general's remark from the mid-1950s that the price of security was inconvenience, Gere suggested that our civilization faced a future in which security, freedom, and convenience would increasingly find themselves in tension. His advice? Pick two. Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster

with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data,

and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joining me once again is Jonathan Katz. He's a professor of computer science at the University of Maryland and also director of the Maryland Cybersecurity Center. Jonathan saw an article in Motherboard recently, and they were talking about how the cryptographic key that secures the web is being changed for the first time.

Walk us through what's going on here. Well, this is a key that's used by ICANN, the Internet Corporation for Assigned Names and Numbers. And like the headline of the article said, it's a key that's used to secure routing on the Internet. So every time you type into your browser, say Google.com, that address that you typed needs to get translated into an IP address that allows the packets that you send to reach their destination. an IP address that allows the packets that you send to reach their destination. And this is done through a somewhat complex protocol called DNS, or the domain name system. And in order to prevent attackers from modifying the addresses that you get back and then sending you to the wrong place, the answers you get back from the domain name service can actually be

signed with respect to a public key. And so ICANN were the ones in charge of this public key, and they're now going to be refreshing that key and updating it and issuing a new key. Now, one of the things that struck me in the article is that they're increasing the size of the key from 1024 bits up to 2048. Now, in a world where we consider 256-bit encryption to be pretty secure, going all the way up to 2048, is that just future-proofing or is that overkill? What's going on with that? Well, so here they're actually using RSA technology, the RSA cryptosystem for the signature scheme. And there's a difference in bit security when you talk about key lengths for symmetric key algorithms

and for asymmetric algorithms like RSA. So 256-bit security is lengths for symmetric key algorithms and for asymmetric algorithms like RSA. So 256-bit security is sufficient for symmetric key algorithms, but for public key algorithms, you need a lot more bits in order to obtain comparable security. Going from 1024 bits to 2048 bits is basically giving them protection for several more years. We actually still can't break 1024-bit RSA, but it's getting to the point

where maybe it's a little bit of an uncomfortable security margin, and people are concerned that perhaps within a time span of five years or so, we may be able to break such keys. And so for that reason, they're just being careful and going up to a 2048-bit key.

And is this a transition that's going to be seamless to users? Well, hopefully so. I mean, there's always the risk, actually, that there will be some compatibility issues, but I think they're proceeding slowly enough that those should hopefully get ironed out and users won't see any problems. All right. Jonathan

Katz, thanks for joining us. My guest today is Kevin Green. He's a program manager in the Cyber division of the Department of Homeland Security, Science and Technology Directorate, where he's a leader in the agency's software assurance efforts. I have about 20 years of cybersecurity experience. Of recent years, I've been focusing on software security and software assurance, really developing a strong passion regarding this area because I believe that everything starts with building secure systems and coding

is a huge part of that. I currently support Homeland Security Science and Technology Directorate Cybersecurity Division as a program manager. And my role is really a couple of things. Really, one, be a leader in the community, working with academia, working with industry, as well as government, to really figure out how do we advance software assurance technologies, tools, and capabilities, is really trying to push forward the state of the art in evolving and innovating around creating better capabilities in terms of how we analyze software for potential weaknesses that can expose vulnerabilities

in software. So describe to us, when we're talking about software assurance, what does software assurance mean? Well, software assurance means a lot of different things to a lot of different people. But essentially, it's really, you's really what processes, what methodologies, what practices can you use to gain confidence and trust in using software, making sure software works as intended. So essentially, at a very high level,

that's the really going principles that I use in terms of software assurance. So take us through some of the programs that you all are working on. Fundamentally, the program at CSD, Cybersecurity Division at S&T, was really rooted in a program that is called Software Quality Assurance, which was designed to really improve the methods and capabilities in terms of how we test software. So we're talking static analysis, dynamic analysis, and binary analysis, really trying to fund research to improve those critical areas and make tools better. We also have CBER programs, and CBER is Small Business Innovation Research, which allows us to work with small businesses to create research and create some novel capabilities around software crawl assurance tools. I have two major programs that have just been awarded. One is called STAMP,

Static Tool Analysis Modernization Project. And the motivation behind that came from, I was watching TV with my wife. It was something I'm sure you're familiar with, HGTV, Home Garden TV. And there's the two brothers, the property brothers, one who find neglected homes and you have the other who kind of takes funds and renovate the homes. I kind of said, wow, I can do that with open source static analysis too. So that's kind of how Stamp came about. So what we're doing with Stamp is we're taking a collection of open source static analysis tools and we're going to modernize them. So there's four steps really, very high level four steps is we're going to create a next generation of test cases

that allows us to baseline and measure the performance of static analysis tools and phase two is doing a tool study so we understand that allows us to baseline and measure the performance of static analysis tools. And phase two is doing a tool study so we understand, you know, the strengths of the tools, the weaknesses in tools, the gaps are. And that helps us generate what we call a modernization framework, allows us to identify the areas where we need to modernize open source static analysis tools. And the fourth element is something I think is very unique and very interesting is called a consumer report for these tools and the deal the idea you know the goal behind that is really to provide those who are using these tools those who are going to purchase these tools an idea of what what are the strengths and what are weaknesses of the tools what are the

sweet spots what does what do the tools do. What it also will do is it shows where the overlap is in the tools so that folks want to pair different static analysis tools together. They have an idea of which tools they need to pair together to best match their software assurance needs. The other one is called ASTAM. It's called Application Security Threat and Attack Modeling. The motivation behind that is because we can't continue to patch. I mean, we've seen this with a lot of these security breaches that are happening. We look at malware, what malware does. Malware looks for vulnerable systems, unpatched systems. So we can't continue to patch. So ASTAM came about because the window of exposure

is continuing to continue. It seems like it's getting wider and wider. So the goal behind ASTAM is really to mimic the behavior of an attacker. An attacker does reconnaissance and looks for vulnerable systems 24-7. Hackers don't sleep. So ASCEND provides an on-demand capability to automate red teaming, penetration testing. But it also does something what I think is very important, helps create countermeasures and mitigation mechanisms to block potential exposures in attack service until administrators, organizations had the time to go and patch systems. And the fourth and final is something which is very dear to me. It's called the Software Assurance Marketplace. And ideally, it's a collaborative research infrastructure where software assurance

researchers, tool developers, software developers can come and improve their software assurance capabilities. For instance, if a tool developer wants to improve their software assurance capabilities. For instance, if a tool developer wants to improve their tool, today we host over 600 software packages and test cases, and they become targets for a tool developer to launch their tool against. And the purpose of that is it helps a tool developer understand what their tool is good at, right? tool developer understand what their tools is good at, right? So the Swamp provides a way for tool developers to improve their tool over a period of time with something called continuous assurance. One of the unique value propositions of Swamp is, you know, the Swamp is in the classroom and helping reinforce the principles of secure coding and helping students improve their coding practices. Right now, the Swamp is in a classroom

and has been integrated in Bowie State, which is located in Bowie, Maryland. It's an HBCU. They are using it for their computer science courses, and it's really helping students learn and helping reinforce good coding practices. And I think that's a great value proposition. That's something I'm very excited about. And so if someone wants to collaborate with you, someone wants to get involved with these programs, what's the best way for them to do that? So the best thing to do is to visit our website, www.dhs.gov,

and under the Science and Technology Directorate, you can look for the cybersecurity division. You could get all information about all the latest research and R&D projects and ways to engage our cybersecurity division. Also, every year we have something called our R&D showcase and technical workshop. It's an opportunity for our PIs and researchers to brief the community on the research and on the progress of their research. It's also an opportunity for the community to engage our researchers on their research projects. So it's a great event, and I think it's great for folks to see some of the great work that we're doing. My thanks to Kevin Green for joining us.

Kevin hosts a podcast of his own called Welcome to Cybersecurity Insights and Perspectives, which you can find on iTunes. And now a message from Black Cloak. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached.

Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.