CyberWire Daily - Implications of Manchester bombing investigation on policy, Five Eyes relations. British Airways IT outage. Fancy Bear and Malta? ShadowBrokers prep exploit-of-the-month club. Google deals with Chrome, PlayStore issues. Mall boards and ricrolling.

Episode Date: May 30, 2017

In today's podcast, we hear that British Airways suffered a glitch, not a hack, but whichever it was, it amounted to an infrastructure takedown. Fancy Bears may be snuffling at the Government of Malta. The ShadowBrokers may be cashing out. Google kicks Judy adware out of the PlayStore. Researchers find another Android vulnerability, "Cloak-and-Dagger." Anonymous is working on the Houdini RAT. Mall hackers in Liverpool mind their manners. Johannes Ulrich from SANS and the ISC Stormcast podcast on DNS security. And security researchers get rickrolled. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindelet.com slash N2K, code N2K. British Airways suffers a glitch, not a hack, but whichever it was, it amounted to an infrastructure takedown. Fancy bears may be snuffling at the government of Malta. The shadow brokers may be cashing out.

Google kicks Judy Adware out of the Play Store. Researchers find another Android vulnerability, Cloak and Dagger. Anonymous is working on the Houdini rat. Mall hackers in Liverpool mind their manners. And security researchers get rickrolled. Get Rickrolled. as several initial reports over the weekend put it breathlessly. The incident is instructive in that it illustrates the way in which an accident can be easily misinterpreted as an attack. It also illustrates that some glitches can be as damaging as a deliberate cyberattack against infrastructure.

The system outages disrupted flights worldwide, with many passengers either stranded or pushed into buying pricey alternatives. About 75,000 passengers on short-haul flights from Gatwick and Heathrow were most seriously affected, as British Airways found it necessary to suspend flights from London's two principal airports. The airline says the problems arose from a power surge that affected key aspects of its networks, but how that actually happened is so far unspecified. The company took a financial bath from the outage. It's believed to have sustained losses that the Times of London estimates at some 150 million pounds. Flight, baggage, and communication

systems, as well as their backups, were knocked out by the incident. British Airways insists it's a one-off. As CEO Alex Cruz put it in an apology to those affected, absolutely this will not happen again at British Airways. There's been a fancy bear sighting. Fancy may be pawing through Malta's government servers, according to sources in the United Kingdom. The shadow brokers are expected to launch their Exploit of the Month club this week, probably Thursday. The brokers' auction of Equation Group tools has largely fizzled, prompting speculation that the brokers' real motivations have been other than financial.

However, Motherboard now reports Bitcoin moving from the shadow brokers' collection address, which suggests someone's cashing out. In the aftermath of the Manchester bombing, British media point with alarm to the large number of known wolves believed present in the country, more than 20,000. Calls for regulation of encryption rise. Observers wonder whether existing powers have been exercised effectively. There seem no obvious quick fixes for either blocking extremist inspiration

or developing effective counter-messaging, so a reach for enhanced surveillance capabilities will prove strongly tempting, especially given last week's known wolf horrors. Authorities in the UK are unhappy with the degree to which their US partners quickly and anonymously leaked information about the ongoing investigation. US Homeland Security Secretary Kelly calls leaks about the investigation from the U.S. intelligence community outrageous and close to treason. Former Director of National Intelligence Clapper essentially agrees.

Speculation suggests the leakers are unlikely to be senior political appointees, but are more likely to be career intelligence or law enforcement officers. appointees, but are more likely to be career intelligence or law enforcement officers. Google is dealing with three issues this week, two in Android, one in Chrome. Judy Adware has led Google to kick 41 infested apps from the Play Store. Security firm Checkpoint Software discovered and reported the problem. The Korean company responsible for the auto-clicking adware, which you may have unwittingly encountered in the form of the Chef Judy app, is said by news site Neowin to be Kinewine, registered at the Play Store as Enestudio Corp.

The second problem, Cloak & Dagger, is a family of credential-stealing attacks demonstrated by researchers at Georgia Tech and the University of California, Santa Barbara, so far not manifesting itself in the wild but being addressed by Google. The third issue affects Chrome. It's a bug that doesn't trigger Chrome's red circle and dot warning, and that in principle could help an attacker induce an unwary user to download spyware. Google doesn't consider this flaw a security issue, not entirely without reason since the security measure is really the pop-up dialog box warning you against installation, and that box still pops. So the problem will eventually be addressed, but it won't receive emergency attention.

Chris Olson of the Media Trust told the CyberWire that he thinks the Chrome bug deserves more attention. He said, quote, Not only does this flaw expose the lack of control website operators have over their digital properties, but it also violates consumer privacy expectations, end quote. And this, he concludes, can only contribute to further erosion of consumer faith in the security of the internet. Someone claiming affiliation with Anonymous is working on the Houdini rat. Recorded Future predicts Houdini's appearance in some future hacktivist op.

Anonymous has had more fizzle than Kaboom over the last couple of years. May we hope for more fizzle. There are some polite security vigilantes at work in Liverpool, at least according to various tweets and a story in Motherboard. We deprecate vigilantism, but at least these bravos are polite. The message they're said to have left on an electronic billboard at the Liverpool One shopping centre read, We suggest you improve your security. Sincerely, your friendly neighbourhood hackers.

End quote. So nota bene. Hackers and mall rats. Courtesy costs nothing. Still, stay out of other people's networks, kids, right? Right. And finally, you know Yara, the tool that helps security researchers assemble their own rules for malware tracking? Trend Micro primly points out that while Yara's a good thing, it shouldn't be your only thing.

And why not? that while Yara's a good thing, it shouldn't be your only thing. And why not? Because some funsters modified a Yara rule to generate an alert that will pull up a version of a 1987 chart topper by Rick Astley. So don't let your tools drive you to Mr. Astley. We know, we know, you're never going to give up Yara. But at least consider a mix, lest you too be rickrolled. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be.

Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC.

Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Cyber threats are evolving every second and staying ahead is more than just a challenge.

It's a necessity. Thank you. and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. And I'm pleased to be joined once again by Johannes Ulrich. He's the Dean of Research for the SANS Technology Institute, and he also hosts the ISC Stormcast podcast. Johannes, welcome back. You wanted to tell us today about some information about DNS security. Yeah, there's really an important change coming up in how DNS and SSL or TLS certificates intersect.

Over the last couple of years, there has been a lot of talk about weaknesses in SSL and how people should move to TLS. But aside from these fairly subtle and difficult to exploit vulnerabilities in the algorithm, difficult to exploit vulnerabilities in the algorithm, there have been ongoing issues with certificate authorities just issuing certificates they weren't supposed to issue. To help with this, there is a new DNS record that was introduced back in 2013, actually, by RFC 6844 that is supposed to allow for certificate authorities to check whether or not they are supposed to issue a particular certificate. So what's happening here now is that the organization that essentially governs TLS in browsers will make this change mandatory as of September 2017. What this means in practical terms for you that if September this year or later, you're going to ask for a certificate,

the certificate authority will check if you have this certificate authority authorization record in your DNS zone. Now, if you don't have this record, nothing will change, nothing will already happen, but you have the option to add this record, which really provides significant additional security for your TLS certificates. So TLS authorities will only issue certificates if they're authorized to actually issue them,

and they will notify you whenever a new certificate is being issued so this is a really important change to how certificates will work and something you should consider adding before september to your zone to take advantage of it all right good information johannes ul, thanks for joining us. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Thank you. executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team

of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com.

That's ai.domo.com.