CyberWire Daily - Germany's BSI sees no problem in Kasperky software. Equifax, TransUnion, suffer from third-party malvertizing code. ISIS expected to change its inspiration. Notes on the dark web.

Episode Date: October 13, 2017

In today's podcast, we hear that German authorities say they see nothing bad up with Kaspersky software, but they're in the Western minority on this one. ISIS messaging looks as if it's shifting toward a hejira narrative. Hyatt discloses a significant credit card breach. Equifax and its competitor TransUnion both remove third-party malvertizing code from their websites. Malek Ben Salem from Accenture Labs with a new vulnerability in software defined networks. Guest is Jeff Schilling, CSO of Armor Cloud Security with insights on Russian state actors. And the dark web is in many ways a lot like the regular web, down to seasonal sales, customer reviews, and cat pictures.  Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. German authorities say they see nothing bad with Kaspersky software, but they're in the Western minority on this one. ISIS messaging looks as though it's shifting towards a different narrative. Hyatt discloses a significant credit card breach.

Equifax and its competitor TransUnion both remove third-party malvertising code from their websites. And the dark web is in many ways a lot like the regular web, down to seasonal sales, customer reviews, and cat pictures. customer reviews, and cat pictures. I'm Dave Bittner in Baltimore with your CyberWire summary for Friday, October 13, 2017. Germany's BSI, their principal information security organization, has said it's found no evidence confirming claims in the U.S. and Israel that Kaspersky software has been exploited for espionage by Russian intelligence services. This hasn't induced German security companies to slow down their marketing of their own products, as made in Germany and, most importantly, not Kaspersky.

But in Germany, at least, the pressure on Kaspersky is coming from the private and not the public sector. at least, the pressure on Kaspersky is coming from the private and not the public sector. RT touts Kaspersky's recent deal to share threat intelligence on cybercrime with Interpol as more evidence that the Russian security firm is on the up-and-up and that U.S. strictures against the company's products are so much protectionist anti-Russian gamesmanship. Most other observers, however, are taking the reports that Kaspersky AV software was able to inspect and report on files resident in the systems it protected more seriously. Terrorism experts are predicting the next wave of ISIS inspiration as the caliphate continues to vanish from its core territories. Any expectations that the reality of battlefield

defeat would mute or at least humble the jihadist group are, More on the Rocks argues, bound to be frustrated. The old inspirational narrative of a just state ruled by godly men will indeed fade, but we can expect it to be replaced by one framed in terms of hijira, which is to say strategic retreat after glorious, dead-ender resistance to the infidel. The Prophet himself conducted the first Hijra in 622, when he and his followers left Mecca for Medina to escape persecution. The Prophet, of course, returned, and ISIS can be expected to announce that its own return and ultimate triumph are equally sure things.

Hyatt discussed yesterday that 41 of its hotels in 11 countries around the world, China being most heavily affected, had suffered a breach that exposed credit card data. The breach was discovered in July. Investigation just concluded. The chain is notifying affected customers directly. If you used a card at a Hyatt between March 18th and July 2nd of this year, you should be alert for fraudulent charges. This is the second breach Hyatt has sustained within the

past two years. An earlier breach was disclosed in December of 2015. There's more bad news for Equifax. Not only was it reported that their massive breach lost driver's license information, among other personal data the company held, but its website was infected with bogus, malicious links. The floundering credit bureau yesterday said it had taken down some third-party code it was using to track website performance. The code was serving up malvertising, directing users to a bogus and malicious Flash Update site. Equifax says that its own systems weren't penetrated in this incident,

which is no doubt true enough, and after all, if it's true, what else are they going to say? But at this point, there seems little the company can do to recoup the loss of trust it suffered. Equifax isn't alone in its industry either, with respect to suffering a bogus flash malvertising infestation. Rival credit bureau TransUnion was also afflicted. Malwarebytes found that TransUnion's Central American site was exhibiting the same problem, and that's not, as Malwarebytes deadpanned, something users want to have. TransUnion issued a statement similar to Equifax's. They've addressed the issue, and their systems weren't hacked.

issued a statement similar to Equifax's. They've addressed the issue, and their systems weren't hacked. New York State's Attorney General Eric Schneiderman is investigating the Equifax breach. Schneiderman has also announced that he's opened an investigation of the security incident Deloitte suffered. Finally, we spent yesterday at Cyber Maryland, where the annual conference closed with an overview of the dark web from Terbium Labs' always interesting dark web expert Emily Wilson, who you've heard here on the Cyber Wire regularly.

We'll summarize the takeaways she left us. The dark web works in repeatable and understandable ways. You can measure and track it. The fraud trade is alive and well, and it too operates in predictable ways. When AlphaBay was taken down, the fraudsters went their way as if nothing had happened. If you weren't breached, but information about you was, it's still your problem. She was at pains to emphasize that the dark web isn't all criminal,

or even predominantly criminal. Nonetheless, a lot of criminal activity is conducted there. Contraband, especially drugs, are sold there, and personal information useful for fraud, especially credit card numbers and financial credentials, are also widely traded. In Wilson's view, the bad stuff is organized much the way the good stuff is. The dark web is still part of the internet, and even its criminal precincts have the typical internet features. Customer reviews, advertising, cat pictures, and even special offers.

Those special offers on contraband are even structured like sales and timed seasonally, just like legitimate sales. Drug sales get their holiday boost around Halloween and New Year's Eve. Credit card numbers get the special offer Act Now treatment around Black Friday. So even in the cyber underground, sometimes the boss is on vacation and we've all gone crazy. Crazy for low prices. Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges

faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now?

Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC.

Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking

and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. And now a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk.

In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And joining me once again is Malek Bensalem. She's the Senior Manager for Security Research and Development at Accenture Labs. Malek, you wanted to describe today a new attack surface involving software-defined network controllers. What's going on here? Thanks, David. Yes, so probably most of our listeners know that software-defined networking has been slowly changing the networking industry.

We certainly see it as Accenture with some of our clients who are adopting the software-defined networking paradigm, typically referred to as SDN. Just to remind the listeners is that SDN basically is a new networking paradigm that separates the control layer or the logical programmable control plane that manages the physical devices, which we refer to enable several new innovative use cases, such as traffic engineering, data center virtualization, dynamic network segmentation, or even some security use cases, such as fine-grained access control and quarantining of compromised devices. and quarantining of compromised devices. Now, a lot of people get excited about these new capabilities that SDN introduces, and they forget about the new attack surface that is brought by the SDN technology and the SDN controllers, which is expected since now we're controlling the network through software. The SDN controller is an application, is a piece of software, so it has its own bugs. So that introduces a new attack surface.

conditions to happen, for harmful race conditions that can be exploited by an attacker to launch an attack against the network, to compromise a service, to even crash a service or even crash the entire network. Now, what has been demonstrated at Usenik security is a way of launching this attack where the attacker does not need to have access to the SDN controller itself to compromise the SDN controller itself. They don't need to have access to the network. All they need to have is a compromise device to launch the network into certain states that can cause a system crash, basically, for the SDN controller. And a system crash in that case means a denial of service attack against the network. So how do we protect against this sort of thing? A couple of things that can be done. These are new research areas. One of them, obviously, is to introduce more safety checks into the SDN controller software and its applications.

Perhaps have some deterministic execution runtimes for the functions that check the network variables and access the network variables. But also, there may be a new opportunity for research around using anomaly detection to identify suspicious state update events in the network. Interesting stuff, as always. Malik Ben-Salem, thanks for joining us. Thank you. solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. My guest today is Jeff Schilling. He's the Chief Technology Officer at Armour, a managed cloud security provider. Previous to joining Armour, he was the Director of the Global Incident Response Practice for Dell SecureWorks.

Mr. Schilling is also a retired U.S. Army colonel, having served 24 years active duty. His last military assignment was the director of the U.S. Army's Global Security Operations Center under the U.S. Army Cyber Command. Our conversation began with the Russian cyber threat, specifically their effect on the last U.S. national election. I think that at the end of the day, they were in a win-win situation when it came to the U.S. election. You know, if the Russians truly wanted to disrupt and undermine the confidence in our election process and raise doubt to basically disrupt our national policy making. And I would say if I were to sit back and grade how effective they've been on that, I'd say they've been very effective. To me, it just feels like they were really just hoping to create chaos in our national system and keep us from doing international policy development, because I think that there are a lot of policy initiatives, both that would be led by a

Democratic-led government as well as a Republican-led government that would not admit the national interests of the Russians. And today, what we have is essentially a paralyzed government the Russians. And today, what we have is essentially a paralyzed government that's torn with mistrust on both sides. And I'd say that they've been pretty effective. So what do you suppose an appropriate response would be from the United States and from the rest of the world? You know, that's probably the hardest question, I think, to answer because, you know, the U.S. is always conducting cyber operations, is always ongoing. Every developed country, every G20 level country that has an organized government and organized military is conducting some level of cyber operations. Cyber operations are best conducted in, you know, when it doesn't get any press, when it doesn't get any traction. So obviously there should be a counteroffensive going on that's happening behind closed doors.

It may not necessarily just be cyber in related. You know, we have many elements of national power, whether it's economic, the whole dime principle, the diplomatic, informational, military and economic national power. You know, we should be using all those elements to put pressure on Russia to basically at least roll back their activities and their operational tempo against us. The second piece, you know, that we really need to do as a nation is we need to come come together and put this behind us. You know, no matter what element of the political spectrum that you live on, at the end of the day, this was an attack on the whole American election process and governing process. And I think that we need to stop paralyzing ourselves, is put this behind us and move forward and go on with some of the policy-making decisions that we need to make

that right now the government is paralyzed in making. So looking forward, how do we as a nation, and both the government side and the private sector side, what are some of the best actions we need to take to protect ourselves from these sorts of things in the future? Well, I think the first thing that we need is just basically a mindset. You know, we need people to get into a cybersecurity mindset, everybody. You know, we have tons of customers that come to us because we provide cloud security.

You know, I talk to prospective customers all the time as well as I go to conferences. And I would say that less than 10% of business owners and people that conduct business really, really deeply care about making sure they're doing the right things with cybersecurity. They just see it as an expense on the P&L. They see it as an L on the P&L. And they really don't put a lot of investment. They put the minimal amount of investment to be compliant. So I think that's the first thing is we need a complete mine reshape. And God knows we've had the global incidents that should have given us that mine reset, but we still see events happen like some of the recent major hacks and data breaches that we have are still ongoing.

One more thing I wanted to ask you about, you know, from your experience inside the Army's SOC and with U.S. Army Cyber Command, can you give us a little window as to what it's like in there? What do you wish people knew about the men and women who are keeping those operations running? First off, those are the two hardest jobs I've ever worked in my 28-year career. jobs I've ever worked in my 28-year career. You know, when I was working one incident response, when I was at Joint Task Force Global Network Operations, where I ran the DOD Security and Operations Center, I worked for almost 28 days straight, probably 16 to 17 hours a day, doing a global response to a nation state actor. And so those troops work incredibly hard. And the other thing is that I will tell you, our nation's secrets are secure on our classified networks, but there's so much good information on our unclassified networks that that's really where

the department struggles. You know, someone asked me back in 2010, you know, when I was running the Army Cyber Command's Security and Operations Center, they actually called it the Army Cyber Information Intelligence Operations Center. What do you think we should do to get the initiative back from the threat? And that's really how I ended up where I was, because no one had ever asked me that question. They just always asked me how bad it is and what I knew. And I really think that the cloud and moving our data centers to the cloud is our opportunity to get ahead of the threat. And that's a whole nother podcast that we should do sometime because I can tell you that there is very, you know, from 2010, I would say to about 2015, I was the only guy on a security panel saying that we needed to move to the cloud.

You know, now in 2015 to 2017, now I would say about half of security folks are now saying, you know what, you know, this is starting to make sense. I have a better ability to build a defendable architecture in the cloud. But, you know, we're still not there. I can tell you that if anybody wants to know who's winning the cyber war, I will tell you that's classified, but I can tell you the good guys are winning. That's Jeff Schilling from Armour. We'll have an extended version of this interview available exclusively for our Patreon subscribers. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers.

I'm Dave Bittner. Thanks for listening. Thank you. hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.