CyberWire Daily - FBI fights fake news.

Starting point is 00:00:00 You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Starting point is 00:00:31 Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Starting point is 00:00:44 Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Starting point is 00:01:22 Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. The FBI flags fake videos claiming to be from the agency. Okta patches an authentication bypass vulnerability. Microsoft confirms Windows Server 2025 blue screen of death issues. Scammers exploit DocuSign's APIs to send fake invoices that bypass spam filters.

Starting point is 00:02:19 Hackers use smart contracts for command and control. ICS suppliers face challenges convincing customers to secure their environments. Barracuda tracks a phishing campaign impersonating OpenAI. Ex-Twitter makes a controversial change to its block feature. A Nigerian man gets 26 years in prison for email fraud.

Starting point is 00:02:39 On our Solution Spotlight, N2K's Simone Petrella interviews Alex Stamos, CEO at SentinelOne, at the ISC2 Security Congress in 2024. And for a South Dakota plastic surgeon, ransomware was just the beginning of his financial woes. It's Monday, November 24th, 2024. I'm Dave Bittner, and this is your CyberWire Intel Briefing. Thank you for joining us here today. Fighting a bit of a cold myself, but we will carry on. The FBI recently issued a warning about two fake videos circulating online

Starting point is 00:03:40 that falsely claim to be from the agency. One video alleges that the FBI arrested groups tied to the Democratic Party for committing ballot fraud, while the other references Vice President Kamala Harris's husband, Doug Emhoff, suggesting the FBI won't investigate his supposed ties to a government contractor. The first video shows images of people in FBI shirts alongside a voiceover claiming three groups rigged mail-in voting using deceased and elderly citizens' identities. It also includes fabricated quotes from a Bellingcat journalist, Elliot Higgins, suggesting a repeat of past election fraud concerns. Higgins responded on social media, clarifying that the quotes were fake and likely part

Starting point is 00:04:29 of a Russian disinformation campaign. He mocked the video's use of QR codes, noting that the FBI doesn't use such methods, which made the video easier to track as inauthentic. Experts, including Darren Linville from Clemson University's Media Forensics Hub, identified these videos as likely Russian doppelganger content, low-quality, high-volume misinformation. This campaign aims to sow distrust in U.S. elections by promoting false claims of fraud and interference. The U.S. intelligence community has been on alert, noting a recent uptick in foreign disinformation,

Starting point is 00:05:09 including fake videos implying voter fraud, corruption, and election tampering. Okta recently discovered and patched a security vulnerability in its ADLDAP delegated authentication system that allowed attackers to bypass authentication using just a username, if the username was 52 characters or longer. This unusual flaw could be exploited only under specific conditions. The account had to have a previous successful login stored in the system's cache, created by the Bcrypt hashing algorithm, and multi-factor authentication had to be disabled. The vulnerability, which lingered for over three months,

Starting point is 00:05:52 was fixed immediately upon discovery on October 30th. Okta advised customers to review logs for authentication attempts using lengthy usernames dating back to July 23rd, and strongly recommended implementing MFA and phishing-resistant authenticators like Okta Verify FastPass. Security engineer Yan Zhu added that the issue stemmed from Bcrypt's behavior with long inputs, suggesting that hashing usernames with SHA-256 could prevent similar problems. Okta did not confirm any instances of successful exploitation.

Starting point is 00:06:35 Microsoft has confirmed several issues in Windows Server 2025 affecting systems with over 256 logical processors. These bugs can cause installation failures, long startup times, and blue screen of death errors, though they occur inconsistently. To check if your system is impacted, open Task Manager and verify if it shows more than 256 logical processors. Microsoft is working on a fix to be released in an upcoming monthly update. In the meantime, admins can work around the issue by limiting logical processors to 256 or fewer through UEFI settings. Scammers are exploiting DocuSign's APIs to send fake invoices that look authentic and bypass spam filters by originating from genuine DocuSign accounts. Cybersecurity firm Wallarm reports that

Starting point is 00:07:27 attackers create paid DocuSign accounts, modify templates, and use APIs to send realistic phishing invoices, particularly imitating brands like Norton. These invoices may include accurate product pricing, activation fees, or wire instructions to enhance credibility and trick victims into unauthorized payments. This phishing approach is effective because emails from DocuSign accounts are seen as legitimate, making them hard for traditional filters to catch. To protect users against these scams, organizations should verify sender credentials, enforce strict financial approval protocols, and provide employee training on phishing risks. Regularly reviewing invoice

Starting point is 00:08:12 details for unexpected charges and following DocuSign's anti-phishing guidelines also help mitigate risks. Security researchers at Checkmarks have identified a novel open-source supply chain attack that combines blockchain technology with traditional attack methods. The malicious package JestFetMock was found on NPM, posing as legitimate JavaScript testing utilities by slightly altering their names, a technique called typosquatting, targeting development environments with elevated privileges, the malware triggers upon download,

Starting point is 00:08:51 calling a smart contract to retrieve its command and control server address. This use of blockchain provides attackers with unique advantages. The decentralized, immutable blockchain infrastructure is nearly impossible to disrupt, and they can dynamically update the C2 address without modifying the malware. The decentralized, immutable blockchain infrastructure is nearly impossible to disrupt, and they can dynamically update the C2 address without modifying the malware. This approach allows attackers to maintain communication resilience, evading defenses even if specific C2 servers are blocked. CheckMarkz stresses that this attack highlights the need for strict security controls and validation of open-source packages,

Starting point is 00:09:26 especially in sensitive development environments. An article in Security Week describes how Siemens and Rockwell Automation are addressing cybersecurity challenges in industrial control systems, where cyberattacks pose significant risks to operational technology. Both companies face obstacles in encouraging clients to update and secure ICS environments, historically designed without cybersecurity in mind. Siemens' product cert team focuses on transparency, advising clients on vulnerabilities via regular security advisories

Starting point is 00:10:02 and automation-compatible formats to supply timely updates. The team underscores the need for patching but acknowledges customer hesitancy due to possible disruptions and financial concerns. Rockwell Automation, on the other hand, emphasizes client engagement through risk-based security justifications and works with OT clients to quantify risks and prioritize high-impact vulnerabilities. Both companies encourage security investments, from basic controls to advanced intrusion detection and endpoint protection. Rockwell advocates for proof-of-concept engagements to demonstrate cybersecurity's value, aiming to gradually build trust and

Starting point is 00:10:46 encourage proactive risk reduction in OT environments. Since the launch of ChatGPT, cybercriminals have leveraged generative AI for more convincing phishing attacks, while businesses worry if their cybersecurity can keep up. Attackers use AI to craft realistic phishing emails, targeting brands like OpenAI to lure users into providing sensitive data. Recently, Barracuda researchers identified a large-scale phishing campaign impersonating OpenAI, urging users to update payment details to maintain subscriptions. Although the attack lacked sophistication, it used tactics like urgency, mimicry of official emails,

Starting point is 00:11:30 and varied hyperlinks to evade detection. Despite AI's potential, studies by Barracuda, Forrester, and Verizon show that AI has not yet changed phishing fundamentally, but enhances its scalability and authenticity. Experts recommend organizations deploy advanced email security, offer frequent security training, and automate response processes to mitigate threats. X-Twitter is updating its block feature, now allowing blocked users to view public posts, followers, and following lists,

Starting point is 00:12:07 though they still can't follow, interact, or send direct messages. This controversial change has raised safety concerns, with many arguing that blocked users should not have any visibility of those who blocked them. Ex-Twitter claims the update promotes transparency, suggesting the block feature could be misused to hide harmful information. However, critics point out that users already have the option to make accounts private. Many believe the new policy could lead to increased harassment and stalking. In response, tech advocate Tracy Chow developed an app to automate blocking, adding a layer of friction for potential harassers. She emphasized that reducing barriers to viewing blocked users' profiles only makes it easier for malicious actors to pursue unwanted interactions. Kolade Ojelade, a Nigerian man residing in the UK, was sentenced in the U.S. to 26 years in prison for a $12 million email fraud scheme targeting the real estate sector.

Starting point is 00:13:20 Extradited to the U.S. in April of this year, Ojelade pleaded guilty to wire fraud and identity theft. His scheme involved phishing to compromised email accounts of real estate firms. He monitored email exchanges about high-value transactions, then intercepted them to send altered payment instructions from spoofed accounts. This tricked buyers and companies into wiring funds to accounts he and his associates controlled. Prosecutors estimated that though the actual losses were around $12 million, the intended losses exceeded $100 million. Alongside his prison sentence, Ojelade was ordered to pay over $3.3 million in restitution and faces deportation upon release. The FBI emphasized the lasting financial impact of his crimes on individuals and businesses. Coming up after the break, our own Simone Petrella interviews Alex Stamos,

Starting point is 00:14:21 CISO at Sentinel-One. Stay with us. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist.

Starting point is 00:15:05 Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home?

Starting point is 00:15:59 Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. Alex Stamos is CISO at SentinelOne. Our own Simone Petrello recently caught up with him at the ISC-2 Security Congress 2024.

Starting point is 00:16:44 They talked about lessons learned in 2024 and what that means for 2025. So we're here at the ISC2 Security Congress for 2024, and I know you are going to be chatting with the audience both in person and virtually here in a bit. But one of the things I wanted to start with was, you know, 2024, where the landscape kind of started. And what, in your opinion, were some of the more significant breaches or attacks of 2024 that are shaping the way that we think about the cybersecurity industry? Yeah, we've had kind of a crazy year. So the keynote today is I'm pulling three incidents out. Not all kind of traditional breaches.

Starting point is 00:17:24 You know, one of them is. But three incidents I think really shaped the cybersecurity landscape and I'm pulling different lessons out. So those three things are I'm talking about the Cyber Safety Review Board's report of the Chinese intrusion into Microsoft and the follow-on Russian intrusion into Microsoft, but especially the

Starting point is 00:17:47 lessons to learn of what happened with China and Microsoft, which actually happened last year, but the report came out this year and has a lot of lessons for us. The multiple security incidents that came out of the Snowflake multiple breaches, not of Snowflake themselves, but other customers. And then the massive CrowdStrike outage, which has had real massive repercussions for the security industry and for CISOs that deploy security products. Well, I think it's a great segue because as a CISO, now on vendor side, but also having been within the corporate side as well. What are some of the things that you think you're taking away as a CISO when you think about those events?

Starting point is 00:18:32 Yeah, so I'll take those in order. So the Microsoft one, I mean, I recommend all CISOs to read, if you haven't yet, the Cyber Safety Review Board's report about Microsoft. Now, the technical specifics are very specific to Microsoft, right? These are bugs that are specific to how did Microsoft build their authentication system for Office Online and how were their keys stored and stolen by the Chinese and then eventually used to read the email of people who worked for the U.S. government. It was eventually, you know, this is not a breach that was discovered by Microsoft. It was discovered by folks who worked for the government

Starting point is 00:19:07 and then told Microsoft that it happened. But the lessons that everybody can learn, even though the bugs are specific to Microsoft, are a couple. One, half-finished security projects will kill you, right? If you look at, like, step-by-step of what happened inside of Microsoft, almost everything in there, Microsoft knew about, and they were working on it. They just weren't

Starting point is 00:19:30 done yet, right? And, you know, one of the things I'm going to have do, you know, for a little audience participation in the keynote today is I'm going to have everybody raise their hand if they don't have partially finished projects on their risk register, right? And I expect nobody to raise their hand. This is just true for any CISO, is we have things that we know are weaknesses that we've been working on, and perhaps for years, right? Sometimes it's easy to get to 80% done, 90% done. It's like a Windows progress bar. You can get to 99%, but actually finishing, turning off that last server, getting rid of that last key, is impossible because you have some dangling dependency. And one of the lessons there is

Starting point is 00:20:12 the attackers don't care if you're 99% done. If that key works, if that server's up, they'll use it, right? And so that's one of the lessons I think that's really important there is like, sometimes you have to push through that last 1% because that residual risk is so big. I'm sure Microsoft wishes that they had pushed through whatever it is that last little bit that kept them from turning off that old 2016 encryption key would have saved a lot of pain for them. It sounds like the adage, like kind of, if everything's a priority, then nothing is a priority. Yeah, exactly. Another lesson there is like, we've built really flat, homogenous networks, right? You know, cloud computing is great in a lot of ways, but what's happened is the, you know, the biggest beneficiary has been Wall Street, right? Is that Wall Street has forced CIOs to kind of squeeze out all of the excess cost of running IT. And so you have IT budgets at public companies. They've gotten rid of all the fat, and now you have a small

Starting point is 00:21:17 number of people providing services to a huge number of internal customers. And the ratios of the number of system ends or DevOps op engineers versus the number of containers or end systems is spectacular. Thousands and thousands of machines per admin. And that's great until a bad guy gets their hand on one of those systems, right? And so like one of the things we'll be talking about in the keynote is like friction is not necessarily a bad thing,

Starting point is 00:21:41 especially at the administrative level, is that we got to embrace friction a little bit more. Microsoft in this situation built keys that worked across every single one of their customers. And so if they had built a little less of a homogenous system, they would have had natural firebreaks in there and it would have cost them more. It would have been a little more difficult in some ways,

Starting point is 00:22:01 but it also would have meant that it would not have been so easy for the Chinese government to penetrate their systems. And again, that there's specifics that are specific to Microsoft, but you see the same pattern at every company of, well, why not just make everything flat and easy because it's so much easier and simpler for us. And I, I think like it, that's a natural progression of where cloud has taken IT architectures. But the reality is we just got to see that there is a natural benefit to friction, especially at the administrative level. Do you think that that's a friction that we also should be embracing as a cybersecurity community and industry too? Because your third example is CrowdStrike. And that's an example where it behooves a frictionless environment to have one primary yes you know provider but

Starting point is 00:22:46 when it's tied to something that it's so fundamental to what we actually rely on yeah i mean that's a great example of you know the fact that it is very likely for a company to have one edr product means that if it breaks if it either fails because it misses something it misses it everywhere and if it breaks it breaks all your systems at once now you know CrowdStrike in particular made specific you know they made specific architectural decisions that was extremely risky and I think you know they certainly are not going to make the same mistake again and I think most companies would not make that mistake but you still could see failures from products where you can have, you know, every EDR product is at

Starting point is 00:23:26 some kind of conflict or something. And certainly they all miss things, right? And I do think that has raised up the question for people of like, hey, should we, you know, maybe go 50-50 with security products? Certainly a number of companies have decided, great, our primary and our business continuity sites are going to run different security features. I know like one of those airlines that was involved, they had like an operation center that was this beautiful operation center that had, you know, rows and rows of computers where these professionals work very, very tirelessly to, you know, move airplanes around and move crews around and like deal with, oh no, there's a hurricane coming. So we've got to reroute everything.

Starting point is 00:24:07 And they work incredibly hard to do that. And they had CrowdStrike on all the machines and then they have an identical operation center 30 miles away and has its own generators and its own power grid, but they're also running CrowdStrike. So it doesn't matter that everything was physically separate.

Starting point is 00:24:20 Within seconds of this entire building blue screening, the second machine, you know, operation center blue-screened, they will not make that mistake again, right? That second operation center is going to have different security products, different firewalls, different switches. Now, you can't get rid of Windows. Microsoft has a monopoly there. But what you can do is you can run on a different Azure tenant. You have a different Intune tenant. You can run N-1 patching for Windows. And so I think this is, again, where having non-homogenous networks of embracing friction, of having your primary and your BCP site be quite different from an IT perspective, it's a big pain. This is where system integrators might come into handy, where you end up paying a system integrator to run your BCP site for you and to make it as different as possible is going to be worthwhile.

Starting point is 00:25:01 is going to be worthwhile. I'm going to go like slightly off script, but it's hard for me to think about this conversation and not think about the impact that this kind of has on the workforce for 2024, 2025. So ISC2 has released their workforce study. It's kind of the first year that things have stagnated from a cybersecurity professionals globally standpoint. It's actually been decreasing a bit in the United States.

Starting point is 00:25:26 Are we getting to the point that a lot of these friction points should also kind of be a reminder to get back to the principles of, we also need to spend enough time having redundancy in the humans that we actually have performing this work? Right.

Starting point is 00:25:39 Yeah, no, I think so. And I think the CrowdStrike outage proved that. I mean, that's one of the things all these people learned was, it's great to have one admin per 10,000 boxes until you have to reboot 10,000 machines. You know, some of those airlines, you know, weeks later, I was still seeing blue screens in airports and it's because they don't have the people to go out there with USB keys. We'll leave the burnout conversation for another day. Yes. Right. But, but it's, it is a legitimate issue of like when things go wrong, yes, one to 10,000 is a ratio that totally works and everything's working perfectly.

Starting point is 00:26:08 And when it hits the fan, uh, you know, not having that kind of slack space is a problem. And I, I do think, um, we have cut, uh, too quickly. People have, I think, made assumptions around automation and hyper automation and orchestration systems and such that aren't necessarily accurate and i do see this all the time with companies that in you know uh before i took the ceasar role at 10.01 i was supervising the dfr team and working with companies from a consulting perspective and i would deal with breaches all the time where they did not just have the right security people they didn't have the it capacity to deal with a breach, right? It's like, oh, we've got to rebuild laptops. We don't have the people.

Starting point is 00:26:46 We've got to rebuild our, you know, our Oracle database and our production systems. We don't have the people because we barely have enough people to keep things taking over normally because we've cut to the bone. And so I do think, and you will pay out the nose when you call PwC or Deloitte on a Friday evening at 6 p.m. to help you recover from a ransomware incident. They will charge you the maximum amount possible.

Starting point is 00:27:09 And in the end, the CFO will not see that savings over the five-year period that they thought they would get from cutting all those IT folks. So I do think CIOs need to be thinking, looking at the big picture of what it is like when you go down to having 95% of the people necessary to run during normal operations. Because over a five-year period, nobody just has normal operations. Something bad will happen every six months and you need to have the slack space to be able to handle that. Yeah, hard to keep that long-term perspective

Starting point is 00:27:34 in mind sometimes. So when you're trying to justify your budget in front of the CFO, who's like, well, it's been two years, nothing's happened, so. You're like, oh, you're gonna penalize me for doing a good job? Yes, yeah.

Starting point is 00:27:43 Yeah, I mean, I can make something happen, right? Like, it's definitely not the kind of, yeah. It'll be interesting to see what happens when you do that. Yes, exactly. Okay. Well, I think it's a great ending point to make because it's a little bit more of a boost to get us from those 88 to 89 to 99% completed projects, maybe, you know, more towards 100. So we don't have those awful risk registers.

Starting point is 00:28:06 Alex, thank you so much for taking the time. I think it's going to be a fantastic talk and appreciate you sharing your knowledge with everyone here in the ISC2 community. Thank you. That's our own Simone Petrella speaking with Alex Stamos from SentinelOne. Thank you. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant.

Starting point is 00:29:26 And finally, Dr. James Breit, a South Dakota plastic surgeon, was fined half a million dollars by the U.S. Department of Health and Human Services Office for Civil Rights following a ransomware attack from seven years ago, which impacted his clinic's servers and affected over 10,000 patients. Although Breit paid $53,000 to hackers to regain access, he claims no patient data was compromised. However, OCR found his clinic in significant non-compliance with HIPAA requirements, citing failures in risk assessment and cybersecurity measures, leading to hefty penalties and mandated improvements. OCR's enforcement reflects an increasing emphasis on HIPAA security rule compliance in the healthcare sector, particularly as ransomware incidents have surged. OCR Director Melanie Fontes-Raynor emphasized that lack of proactive security measures makes healthcare

Starting point is 00:30:18 providers attractive targets for cybercriminals. Breit's case contrasts with assurances from agencies like CISA and the FBI that reporting incidents won't lead to punitive investigations. OCR's actions suggest otherwise, as fines and corrective action plans often follow self-reported breaches. While these measures aim to boost healthcare resilience, they highlight tensions between regulatory bodies' enforcement priorities and the goal of encouraging transparency in cyber incident reporting. And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast.

Starting point is 00:31:10 Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com. Thank you. N2K makes it easy for companies to optimize your biggest investment, your people. We make you smarter about your teams while making your teams smarter. Learn how at n2k.com. This episode was produced by Liz Stokes. Our mixer is Trey Hester with original music and sound design by Elliot Peltzman. Our executive producer is Jennifer Iben.

Starting point is 00:32:02 Our executive editor is Brandon Karp. Simone Petrella is our president. Peter Kilby is our publisher. And I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.

CyberWire Daily - FBI fights fake news.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.