CyberWire Daily - Daily: World Password Day, OpIcarus

Episode Date: May 5, 2016

Today we consider various ways of hiding attack campaigns: noisily or quietly, what the approaches have in common is highly selective targeting. Anonymous proceeds with Operation Icarus (against "the global banking cartel").  We observe World Password Day with advice from AT&T's Johannes Jaskolski and Johns Hopkins' Joe Carrigan. Plus, we take a quick look at how one script kiddie values his stolen data.  Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. skulk and the noise. Industrial espionage hits Switzerland's defense ministry. Anonymous proceeds with Operation Icarus. It's World Password Day, so look to your credentials. Speaking of passwords, a buck and a social media like will get you 272 million of them. I'm Dave Bittner in Baltimore with your CyberWire summary for Thursday, May 5th, 2016. Some interesting notes on hiding your attack campaigns are in the news today.

Palo Alto Networks is describing Infi malware, which they're also giving the snappy nickname Prince of Persia, in evident homage to the popular game franchise. Infi, so-called from a recurring string that appears in its code, has been active for about a decade and has gone largely unnoticed. Its apparently escaped attention because of its low-volume, highly targeted nature. Spread mostly by spear-phishing, Infi seems to have prospected carefully selected targets with content tailored to geographical location.

The intended victims include foreign governments and companies but also individual Iranians, presumably of questionable loyalty or behavior. INFI may have begun to circulate as early as December 2004. It's been found emanating from a compromised Israeli Gmail account, but the command and control servers are Iranian. The evidence is circumstantial, but signs point to Tehran. It's World Password Day, not that any of us would have weak or easy-to-guess passwords, of course. But despite all of our warnings, plenty of people are still using authentication that's way too easy to crack. We checked in with Johannes Jaskolski, chief security officer with AT&T. Passwords or passphrases predate our modern age by centuries.

Passwords or passphrases predate our modern age by centuries. You'd have Roman guards asking for passphrases for people to pass through the gates. As we are trying to restrict access to technical resources, it was just basically adapted. Keeping track of complex passwords is more effort than some people are willing to put in. So for some of the bad guys, cracking passwords is just a numbers game. They basically look at a list of commonly used passwords because the databases of users are now so huge that if you pick a relatively common password and you just try it with a large set of user IDs, there's a high likelihood that there are several users that will have picked that password. In fact, you can now, on the live market, you can buy these databases of user IDs and passwords.

Making sure your passwords are sufficiently secure doesn't have to be an ordeal. Johannes Jaskolski has some suggestions. It starts with making sure that your password is complex. You don't want to use a common password, even if it meets the complexity aspect of it. So if you don't know what a common password is, So are passwords on the way out? Many of our mobile devices have fingerprint scanners now, after all, which makes entering passwords seem a bit old-fashioned. In my view, the death of passwords has been kind of overstated for dramatic effect in the past. I think it's still an ingredient, but generally speaking, we are moving towards two things. One is multi-factor authentication, so we are incorporating other authentication factors beyond knowledge base. So that would mean biometrics such as Touch ID,

but also recognizing, for example, the device and issuing devices tokens so you understand the device that is trying to facilitate the authentication. Johannes Jaskowski is a director and chief security officer with AT&T. Their website is business.att.com. Someone's involved in industrial espionage. Their website is business.att.com. Someone's involved in industrial espionage. Switzerland's Minister of Defense has recently said that his ministry came under cyber attack by unnamed parties back in January. Whoever they were, they seem to have been after trade secrets.

In an unrelated case, Canadian authorities deny visas to two Huawei employees, calling them an espionage risk. Huawei denies any implication in espionage. Anonymous hits Greece's national bank late last week in Operation Icarus, aiming at the global banking cartel. The hacktivist collective calls it the operation to end all others, and has moved on to its next target, DDoSing the central bank of Cyprus. They project a 30-day campaign. Observers wait to see when and whether it will expand. In its OpIcarus video, Anonymous says it's united as one, divided by zero, which would seem to be an undefined operation, so we shall see. Finally, Hold Security has an interesting story about someone who really doesn't know the value of his data.

It's a kid, apparently Russian, who's bragging about having 272 million passwords stolen from various sources. He's offered them for sale, and so Hold Security talked him down to a dollar, plus some likes on social media. Hold says the hacker sounded young. You think?

In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures.

Stream Night Bitch January 24 only on Disney+. Do you know the status of your compliance controls right now? Like right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI.

Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant.

It's World Password Day, so we thought we'd look back at a conversation I had back in February with Joe Kerrigan from the Johns Hopkins Information Security Institute, one of our academic and research partners. Joe, let's talk about passwords, specifically password cracking. One of my favorite subjects. I know, I know it is. So before we get into how we crack passwords, let's talk about how passwords are stored and protected. Right. Passwords are usually stored in some kind of hashed system. If they're stored in plain text, then there's no security at all. So we use an algorithm called a hash algorithm that takes that password and turns it into essentially a one-way encryption function. The weakness there

is that I can build a simple lookup table based on the hashes. So if your password is ABC123 and my password is ABC123, then our hashes are going to be the same. I see. So we have a second protection against that called salting. And that is where we take a random string of characters and add it to our passwords. So let's say that random string of characters is, for you, 123. So your password becomes abc123123, and then that gets hashed. And then my password becomes ABC123, and then I have XYZ added to the end of my password. In the password database, the salts get stored with the hashes, and now our hashes look different.

So I can't just say, okay, these two users have the same password anymore. That's what we call a salted and hashed password, and that's the best way to protect a password in a database. All right. So we've got our passwords stored. They've been protected through salting and hashing. But now I want to have at it, I want to start figuring out what the passwords are. How do I go about it? Right. The very first thing you're going to do as a password cracker is you're going to run what's called a dictionary attack on that. And there are programs out there that are specifically designed for doing this. And there are lists out there, very large lists of known passwords. And the thing about people is they're kind of predictable in this. And you can break about 50% of the passwords just with a dictionary attack.

You come at it with your dictionary attack and you're unsuccessful with that. What next? So the next step would be brute force attacks. The same software tools that can run a dictionary attack can also do a brute force attack. There's one called Hashcat that actually runs on graphics processors that makes it very fast. When I'm coming up with a password for myself, is there a way to protect myself against either of these attacks? I use a password manager. What I do is I use random 20-character passwords at a minimum for the websites I visit frequently and the websites I care about. Okay. How do you remember them?

I don't remember them. All right. Go on. If somebody asked me what my Facebook password is right now, I wouldn't be able to tell them. Okay. So how do you log on to Facebook then? So I open up my password safe and I copy the password from the password safe into the Facebook interface. So what if I get access to your password safe? That's an excellent question. In fact, there's now malware

that's out there targeting password safes because they realize that this is a high value target. So are you in effect just sort of shifting it one degree away because you still have a password to get into your password safe, right? Correct, yes. Then that password to get into my password safe is a very long password. I say the longer the password, the better the password. All right. Joe Kerrigan, thanks for joining us. Thank you.

And now a message from Black Cloak. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached.

Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows,

helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.