CyberWire Daily - Karmen in the black market. Homograph vulnerabilities. Vault 7 and ShadowBrokers updates. Hacks and missiles. Competing for botnets.

Episode Date: April 18, 2017

In today's podcast, we hear about a newish ransomware strain, Karmen, hitting the low-end ransomware-as-a-service market. Homograph vulnerability proof-of-concept revealed. Jihadist infosec service advises good cyber hygiene for terrorists post-Vault 7. The ShadowBrokers try to drag a red herring—actually a bad frog—across their tracks. Hopeful speculation continues that the US hacked North Korea's missile test last weekend. Hajime malware is competing with MIrai for bots, although to what end is unclear. Dr. Charles Clancy from VA Tech’s Hume Center contrasts Vault-7 vs. the Shadowbrokers. Bill Anderson from OptioLabs outlines battlefield mobile device security. And you're not going to get rich by using security cameras to mine Bitcoin. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. Carmen hits the low-end ransomware-as-a-service market. Homograph vulnerability proof of concepts are revealed. A jihadist InfoSec service advises good cyber hygiene for terrorists post-Vault 7. The shadow brokers try to drag a red herring, actually a bad frog, across their tracks.

Hopeful speculation continues that the U.S. hacked North Korea's missile test last weekend. And you're not going to get rich by using security cameras to mine Bitcoin. by using security cameras to mine Bitcoin. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Tuesday, April 18, 2017. Recorded Future reports discovery of Carmen, a low-cost ransomware-as-a-service product being hawked in the dark web market by dev bitox described as a russian-speaking cyber criminal carmen is derived from hidden tear an open source encryption project coded by an unknown author in germany and available to anyone carmen is both cheap 175 with free upgrades and it's devious it will delete its own decryptor if it detects the victim's sandboxing or analyzing it.

DevBitox isn't getting rich. He or she has sold 20 copies and has just five more left in inventory. Some browsers are reported vulnerable to homograph attack in which malicious sites spoof undetectably safe, legitimate ones. The problem is so far a proof of concept by researcher Zudong Zhang, who informed Google and Mozilla of the issue back in January. The problem lies in the rendering of puny code characters in a URL as unicode characters, which opens the possibility that one could be spoofed into browsing over to a malicious site without realizing it.

Chrome, Firefox, and Opera are said to be vulnerable to such homograph attack. Mozilla released a workaround mitigation for Firefox, and Google has fixed it in Chrome Canary 59, with a permanent patch planned this month for Chrome Stable 58. For soldiers on the battlefield, men and women on the ground, the special operations folks, and other forward operating personnel, it's become increasingly common for them to receive feeds of information that may come from drones, for example. Bill Anderson is CEO at Optio Labs, and one of their areas of expertise is securing those battlefield mobile devices. Their device of choice is typically an Android device, a secure Android device.

The challenge is how do we ensure that those mobile devices that the operations teams are running around with are actually secure and they're reliable and they're as productive as can be? And they also don't put personnel in danger. Can you give us an example? What do you mean by danger? You know, who hasn't done this? You know, you're fumbling around with your phone and stick it back in your pocket. And one of your colleagues looks over and says, hey, you know, you got your flashlight turned on. No big deal if you happen to be sitting in an office meeting.

sitting in an office meeting. If you're on the battlefield and it's dark and you turn on the flashlight on your special ruggedized Android phone by accident, that makes you a target. And by the way, there's no simple way of, you know, through software and ensuring that those flashlights are off. That's one of the things we do

is we give the enterprise the controls to be able to say, here are the things you're allowed to do when you're on a mission. So when you're on a mission, you're able to see the secure drone feed, you're able to run the secure drone application, but no Bluetooth, no Wi-Fi, you can't tell your true location through GPS. You can't take updates over the air that would affect the operating system. take updates over the air that would affect the operating system. You can't make noise. So there's a whole bunch of controls that you want to apply that are mission-specific that will keep that guy productive. In our case, the problems that we're looking at is how do we make sure that

the individuals on the battlefield who are actually consuming that information are as safe and productive as possible. I mean, it sounds to me like what we're really talking about here is securing the Android device itself. So the Android device may be the weakest link in the chain? It is invariably the weakest link in the chain. If you were to tell me that there was no malware or weaknesses on my Android phone, I couldn't take your word for that because we have seen them. In fact, we continuously see them. They're there. The Android platform is an incredibly broad, deep, promiscuous networking device with many, many sensors, many, many interacting software systems that are built by different vendors and many vulnerabilities.

And so when you have operations folks running drones, running around on the ground, and you need to make sure that everything works right, you need to go well beyond taking an off-the-shelf device if you really want those guys to be safe. That's Bill Anderson from Optio Labs. Catching up with news about the two recent tranches of leaks that have hit the internet with considerable acclot recently, we turn to WikiLeaks' Vault 7, which purports to disclose CIA cyber espionage campaigns, and the Shadow Broker's Good Friday release of alleged NSA material. The U.S. intelligence community, for obvious reasons, has no official reaction to both incidents,

but the consensus among observers is that both dumps appear to contain material stolen from the IC. Flashpoint has looked at the former set of leaks, and they've paid particular attention to how the jihadist infosec group Horizon is reacting to Vault 7 on the dark web. Horizon is a group roughly aligned with ISIS that offers counsel on how to communicate online without compromising yourself to the civilized world's intelligence and police services. ISIS adherents are being advised that two of their favorite communication tools, Telegram and WhatsApp, may be vulnerable to interception. It seems doubtful that Horizon will have better luck instilling sound OPSEC

and digital hygiene into the terrorist pool than legitimate enterprises have. Turning to the other big release, the Shadow Brokers dump is thought by many to be bad news and worse optics for the U.S. intelligence community. Both Swift and Microsoft are reassuring users that their systems are now safe against the exploits the Shadow Brokers' documents describe. Many observers note Microsoft's quietly proactive pre-leak patches last month. Motherboard notes an oddity that many others have overlooked. The Shadow Brokers' password to access their stolen files is a typographic squeal associated with bad boy meme Pepe the Frog. Thus do the brokers associate themselves with the alt-right,

continuing their fitful but long-standing pose as hacktivists motivated by a touch of profit. Pepe has appeared before in Russian information operations, and so here again many will find evidence of Moscow's involvement in the doxing. Reactions to both Vault 7 and the Shadow Brokers have shown concern about U.S. intelligence services' ability to conduct cyber espionage, which is a reasonable enough concern if one is a potential foreign target of collection. But the surprise that intelligence services collect foreign intelligence does seem either naive or disingenuous, or some mix of the two. Such collection is obviously what intelligence services do. Speculation continues that the U.S. hacked North Korea's weekend missile tests.

The source of this hopeful talk seems to be former U.K. Foreign Secretary Sir Malcolm Rifkind. The Lad Mag Maxim, of all places, has put on its patriotic epaulets and is swaggering in the face of Supreme Leader Kim. While any thinking person in the civilized world would be likely to welcome cyber disruption of Pyongyang's nuclear delivery research and development, it's important to stress that this appears to be a priori speculation. Nonetheless, the possibility bears watching. A quick congratulatory shout out to the University of Maryland, Baltimore County, for taking home the Alamo Cup from last week's National Collegiate Cyber Defense Competition in San Antonio, Texas. Bravo Zulu, Cyberdogs!

Finally, we return to the world of online crime. Mirai apparently has a competitor. Hajime has been found in the wild by security researchers from DDoS protection shop BackConnect. Hajime has been competing for bots with Mirai for about six months, although to what end remains unclear, since the botnets it's been assembling haven't so far, according to BackConnect, been used to conduct denial-of-service attacks. BackConnect finds Hajime much more sophisticated than Mirai, especially with respect to its

command and control. So what's Hajime up to? It's not clear. But it's probably not mining bitcoins. Arata Security has posted an analysis of recent claims that Mirai is being used to do exactly that, and Arata Security thinks this is unlikely. By their calculations, if all of the 2.5 million devices McAfee estimated were infected with Mirai were set to work mining cryptocurrency, they'd be earning the botmasters 25 cents a day.

And Arata Security sniffs at this amount as a joke. Well, if you're as rich as Arata, maybe you don't need the cash, but over the course of a year, that would pull in $91.25, don't need the cash, but over the course of a year, that would pull in $91.25, which is a zero-labor alternative to the lemonade stand we ourselves were considering. Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges faster with agents,

winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks.

But get this. More than 8,000 companies, like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1, dollars off. puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Cyber threats are evolving every second and staying ahead is more than just a challenge. Thank you. Designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely.

Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. And I'm pleased to be joined once again by Dr. Charles Clancy. He's the director of the Hume Center for National Security and Technology at Virginia Tech. Dr. Clancy, welcome back. We wanted to talk today about the Vault 7 and the Shadow Brokers releases of information. And really, you wanted to contrast the two of them. I think it's important to understand when you hear about all these leaks of cyber capabilities from now both NSA and CIA, that there's a difference between leaking tactics, techniques, and procedures, or so-called TTPs, versus the actual tools themselves,

the actual code behind zero-day exploits, for example. So if you look at a lot of the data that's been released so far, particularly in the Vault 7 leaks, it's been mostly documents, PowerPoint, that really talk about how the CIA does what it does. And based on that, some security companies have been able to fingerprint certain TTPs and attribute, with some degree of confidence, a wide range of hacks across the world to the Vault 7 TTPs and attribute, with some degree of confidence, a wide range of hacks across the world to the Vault 7 TTPs. Shadowbrokers, on the other hand, is more than that. It includes a lot more of the source code, which has an even greater devastating impact because now you're not just fingerprinting attacks and building defenses against the techniques and

procedures that are being used, but you actually can build specific malware identifiers and hashes that can be used to detect and block the actual exploits themselves. There's a lot of debate ongoing right now as to the total impact. I think the folks that are in the trenches and the intelligence agencies who are working these problems would claim that there is a huge impact in national security as a result collectively of these leaks. But at the same time, there are plenty of unpatched computer systems out in the world. And there's lots of opportunity to be had just doing basic run-of-the-mill phishing attacks against unpatched Windows computers, which remains the largest threat surface that hackers, whether you're part of an intelligence agency or organized crime,

leverage today. While these releases of information are certainly interesting and damaging, you know, sometimes the old-fashioned ways are the easiest ways in. Indeed. So for those that are looking to have a good defense against these sorts of things, please just keep your software up to date, have antivirus installed, and basic cyber hygiene will win out most of the time. All right, Dr. Charles Clancy, thanks for joining us. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home. Black Cloak's award-winning digital executive protection

platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening.

Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.