CyberWire Daily - Lazarus Group is back, phishing in English. Extremist content online. Google cleans up SonicSpy. Arrests for HBO hacking are unrelated to "Mr. Smith." Marcus Hutchins is out on. DJI drones get a security makeover. Help desk scams.

Episode Date: August 15, 2017

In today's podcast, we hear that the Lazarus Group is back, and now they're phishing in English. The Daily Stormer gets the boot, but companies and governments continue to struggle with developing appropriate responses to extremist content. Google has swiftly cleaned up SonicSpy, but the malware is still circulating outside the Play store. Indian police make four arrests for HBO hacking, but none of them are related to "Mr. Smith." Marcus Hutchins is out on bail and preparing for an October trial. DJI drones get a peacemaking makeover. Justin Harvey from Accenture on prepping for destructive attacks. Jeff Schumann CEO of Wiretap on vulnerabilities in messaging technologies like Slack and Yammer. And one weird trick to recognizing that a call is a help desk scam. Ready? It's this: they called you. Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. Your patient data depends on incident response plans. Prepare with DeltaRisk's webinar. Domain Tools leverages both human and machine intelligence to expose malicious infrastructure. Learn more in their white paper.     Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K. Lazarus Group is back, and now they're fishing in English. The Daily Stormer gets the boot, but companies and governments continue to struggle with developing appropriate responses to extremist content. Google has swiftly cleaned up Sonic Spy, but the malware is still circulating outside the Play Store.

Indian police make four arrests for HBO hacking, but none of them are related to Mr. Smith. Marcus Hutchins is out on bail and preparing for an October trial. DJI drones get a peacemaking makeover. Plus, we've got one weird trick to recognize that a call is a help desk scam. We'll see you next time. a real solution, and they can help you disentangle them too, especially when it comes to machine learning and artificial intelligence. You can get a free white paper that explains these new but proven technologies at e8security.com slash ai-ml. We all know that human talent is as necessary to good security as it is scarce and expensive, but machine learning and artificial intelligence can help your human analysts scale to meet

the challenges of today's and tomorrow's threats. They'll help you understand your choices, too. Did you know that while we might assume supervised machine learning, where a human teaches the machine, might seem the best approach, in fact, unsupervised machine learning can show the human something unexpected, cut through the glare of information overload, and move from data to understanding. Cut through the glare of information overload and move from data to understanding. Check out e8security.com slash AI-ML and find out more. And we thank E8 for sponsoring our show. I'm Dave Bittner in Baltimore with your CyberWire summary for Tuesday, August 15, 2017.

Palo Alto Networks yesterday released an update on Lazarus Group activity against U.S. defense contractors. The threat actor, by consensus, a cat's paw for North Korean intelligence services, is distributing espionage tools using malicious Microsoft Office documents. The latest Lazarus Group operations exhibit a shift in targeting. They're now prospecting English as opposed to Korean speakers. The documents are poorly crafted and badly proofread, but once they've been opened, they've delivered their payload, so mad proofreading skills probably aren't going to protect the unwary targets. Besides, according to Palo Alto, some of the fishbait text, position announcements, and so on, seem to Palo Alto, some of the fishbait text, position announcements,

and so on, seem to have been copied verbatim from legitimate corporate websites, warts and all, so misspellings are in the source material being spoofed as well. After the weekend's riots and homicide in Charlottesville, various hosting providers, including GoDaddy, Google, Zoho, and Discord, have booted the Daily Stormer neo-Nazi publication from their services. The Stormer says Anonymous has attacked its sites, but Anonymous officially denies doing so, insofar as an anarchist collective can have an official voice. And they say the Stormer is just putting a brave face on its inability to find anyone to host its material. The providers who've cut the Stormer off are citing terms of service violations.

The problem here is of course analogous to what's seen with violent extremist inspiration elsewhere. Few are likely to shed many tears for either the Daily Stormer or Al-Qaeda's Inspire magazine, but it's proven difficult for either governments or corporations to constrain objectionable material without restricting free speech or breaching expectations of privacy. Facebook, for example, is currently receiving criticism from observers who argue that the social medium's attempt to regulate problematic content are silencing the sorts of marginalized communities Facebook ought to be helping. There are few such second thoughts, of course, over content moderation in, for example, China or Saudi Arabia. The Kingdom of Saudi Arabia has announced plans to indict a group of radical Twitter users.

They are, interestingly enough, radical Sunnis who are charged with harming public order by their hardline stance towards Shiites, whom they, like the Saudi regime, regard as heretical. Thus, the tweeters being hit are effectively more Wahhabi than the Wahhabi. A version of the tension between public safety and privacy or free speech, a tension whose equilibrium former U.S. FBI Director Comey used to refer to as ordered liberty, continues to play itself out in the crypto wars running with various degrees of intensity in the Five Eyes. For now, the pro-encryption side seems ascendant in the U.S., the anti-encryption side in at least three of the four Commonwealth

Eyes. Anyone who knows how things stand in New Zealand should drop us a line. There's no question that enterprise collaboration tools like Slack, Yammer, or Microsoft Teams have grown in popularity in recent years, providing a faster, more efficient method than email for sharing ideas and files in the workplace. But what about potential vulnerabilities? Jeff Schumann is CEO at Wiretap, a company that provides monitoring and protection for these enterprise social networks. The reality of it is, is when you have so much information flooding across each one of these messaging channels, I mean, we're talking about millions and billions of interactions happening

across the enterprise industry on a regular basis, you're bound to have bad things happening. And what I think organizations are starting to want to do is get ahead of the problem. They want to leverage the technology in a way that helps them be more preventative around issues that are suddenly propagating throughout the market. I think organizations want to get ahead of it and manage it more effectively and say, hey, look, we know we have a ton of people collaborating. And we know for the most part that 99% are using the technology effectively. But how can we learn from it? How can we perhaps make sure that we can leverage some of the insight gained from looking across millions of interactions to maybe prevent a scenario that has happened at Uber or even Google, which we've seen across the last few days? And so what kind of recommendations do you all have for how best to protect yourself while

still being able to use these kinds of technologies? I look at it very similar to how we've looked at email, right? We've had monitoring and security technologies for email for the past two dozen years. And for the most part, employees use email to get your job done and communicate with partners and collaborate effectively. But now with this new evolution of technology, and we're starting to see new messaging platforms find their way into the enterprise space, we're looking for that same level of comfort that we've had with email. Our recommendation is you want to get ahead of it by putting something in place, whether it's processes or technology that can bring a level of comfort and control

that you're looking for or visibility into how your employees are using the new messaging technologies that can achieve what it was that you were achieving with email. Beyond that, what if you can actually learn from their usage? What if you can be a better company by identifying issues before they've ever become issues and getting ahead of it and getting ahead of perhaps sexual harassment in the workplace or discriminate gender discrimination and so on and so forth what if you can thwart it and end it and protect your reputation before these events ever escalate we have to create value or the providers have to create value for the employees themselves meaning

can we help you be more effective as an employee can we help you communicate more can we give you a bigger voice within the boardroom? Because the conversations that you're having in a public water cooler on a public Slack channel that existed among millions of other interactions weren't raised to the right attention at the right level of your organization. What if a technology stack is able to do that for you? And I think if you start to do that, then you start to bring value back to the employees themselves. And that's when others are willing to look at the privacy matter a whole different way than they do today. The insight you can gain from suddenly really understanding how your employees collaborate and communicate on a regular basis is an incredibly important aspect

of any security technology entering this space. And you have to be able to deliver that behavioral insight back to the organization. You have to actually add value, not just reduce risk. That's Jeff Schumann. He's from Wiretap. Google gets good reviews for cleaning the Play Store of Sonic spy infestations, but the Android malware is still out and active, infecting users from other sources. The three versions of the malware most often seen circulating in the wild are Soniac, Hulk Messenger, and TroyChat. To avoid infection, Android users should avoid apps with a low or even no reputation. They should also keep their devices patched and up to date. And finally,

the easiest bit of advice to follow, stay away from third-party stores and stick with Google Play. Police in India have made four arrests in connection with the release of a pirated Game of Thrones episode. This case is unrelated to the recent hacking of HBO by Mr. Smith. That case remains under investigation. HBO is said to be determined to pay Mr. Smith. That case remains under investigation. HBO is said to be determined to pay Mr. Smith nothing. Perhaps Mr. Smith should have taken HBO up on their earlier attempt to treat Mr. Smith as a bug bounty hunter. Marcus Hutchins, out on bail after his not guilty plea in a Wisconsin court yesterday, is also back online. He's communicating with his many fans and working insofar as he can.

His mood seems upbeat, at least as he presents himself online. He noted, for example, that getting arrested by the FBI was on his to-do list for his black hat trip, but he's not going to be permitted to leave the USA before his October trial, he's surrendered his passport and is wearing a GPS tracker, and he's not permitted to access the server from which the US government alleges he worked on Kronos. Drone maker DJI says it's installing a local mode for users sensitive about the company's data collection practices. The US Army, no longer a customer, was one such user until a directive from G3 told all

units to stop using DJI gear at once. It remains to be seen whether DJI's modifications will mollify the gatekeepers at the Aberdeen Proving Grounds. And finally, major IT and security companies are offering tips on how to recognize a help desk scam. You know, those calls that come into you at home letting you know that there's a problem with your computer and that the caller can that there's a problem with your computer, and that the caller can fix it if you give them your credentials, allow them remote access, and pay them a fee.

Here's the tip. They called. No legitimate company will charge you for help, nor will they ask to take control of your computer, nor, in fact, will they call you out of the blue, offering help if you haven't called them first. So that's news you can use. It's galling when they're calling, so for it, don't be falling. Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword.

It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. to learn more. time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SOC 2 and ISO 27001. They also centralize key

workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures.

Stream Night Bitch January 24 only on Disney+. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover

they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. BlackCloak.io. And I'm pleased to be joined once again by Justin Harvey. He's the Global Incident Response Leader at Accenture. Justin, welcome back. You know, we've had these attacks like WannaCry, and we've talked about companies potentially being ready for these sorts of destructive attacks. And today you wanted to take us through some of the things that companies can do to help themselves prepare for the

possibility of these sorts of things. Yeah, the last few weeks, the last few months, I think have been a real game changer in the cyber defense market and actually around the world because we're seeing large scale takedowns of organizations that have essentially been brought down. All of their operations are down because they've been hit by some sort of destructive attack. And the first point I want to make here is that ransomware and destructive malware are very close together. The only difference is ransomware gives you the ability to recover those files. Destructive malware, of course, deletes it. Ransomware quickly becomes destructive malware in the event that there's no key or the

ability to get a key. The way that organizations can prepare for this are a few fold. Clearly, being able to have a strong business continuity and disaster recovery plan. But I think just like with all things human, none of us really, well, at least I don't really like doing the things that I should, right? Working out or doing the more menial rote tasks in our lives. And companies are suffering from the same thing. They've said a BCDR plan has really only been exercised maybe once a year, maybe once every couple of years. And they do scenarios where, okay, imagine if there is an earthquake and it takes a couple of machines off, we lose a data center. Well, imagine all of your data centers being down at the same time. And so we're going to start to see a revolution of unique

BC and DR strategies. And I know that they're out there. So I think that companies can help recover quicker by storing their data more in a warm format or even hot in utilizing technologies like the cloud. They can have better preventative controls by segmenting their network. We have seen that the insides of companies are really soft. There is very little access control. I think that companies have got into this mindset that they have these tall walls on their perimeter, and therefore they don't need the traditional type of intrusion detection, intrusion prevention, firewalls, and monitoring in place inside the environment. But it only takes one machine to be infected with either ransomware or destructive malware in order to propagate.

As we've seen with Petya slash not Petya, it goes by many names these days, we saw that this strain was particularly troublesome because first it used Eternal Blue. So if your machines were still running SMB V1 or hadn't been patched, it was able to get through that. But it was also masquerading or stealing the credentials, the identity of the victim, and then blasting that out. So if anyone had domain administrator privileges and were hit by this version of the destructive malware, then of course it could rip through the environment. So that also speaks to having more fine-grained controls around domain administrative privileges. And if you're out there and you're a sysadmin or you have domain admin and you're

just reading your email on that account, I would say you might want to think about moving more toward service-based accounts rather than having that on your regular username. All right. Good advice as always. Justin Harvey, thanks for joining us. Thank you. solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. products platform comes in. With Domo, you can channel AI and data into innovative uses that

deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.