CyberWire Daily - Missiles and malware? ShadowBrokers' leaks examined. Syrian info ops. ISIS recruits women for martyrdom. Ransomware, medical device vulnerability updates. Troubled unicorn?

Episode Date: April 17, 2017

In today's podcast, we hear about a big missile fizzle on Pyongyang's Day of the Sun yesterday—there's hopeful but a priori speculation of a cyber op against North Korea's nuclear strike R&D program. Friday's ShadowBrokers' leaks suggest financial service, industrial IoT vulnerabilities. Syrian regime calls hoax on nerve gas attack claims (informed observers are unconvinced). How ISIS recruits women for martyrdom operations. Ransomware update. Medical device makers might learn from mobile device makers. Rick Howard from Palo Alto Networks ponders the first principle of automotive security. And clouds gather over a security unicorn. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K. A missile fizzles on Pyongyang's big day of the sun. Friday's shadow brokers leak suggests financial service and industrial IoT vulnerabilities. The Syrian regime calls hoax on nerve gas attack claims, but informed observers are unconvinced. Medical device makers might learn from mobile device makers.

And clouds gather over a security unicorn. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Monday, April 17, 2017. Yesterday was the Day of the Sun in North Korea, an annual celebration marking the birthday of Kim Il-sung, founder of the Democratic People's Republic of Korea. The festivities were marked by the customary Soviet-style parade of military personnel and hardware. They were also marked by an attempted launch of a missile. That launch failed, with the missile exploding seconds after launch, according to monitors at U.S. Pacific Command. As when other, earlier test shots on 2016's Day of the Sun failed, there's been considerable speculation that the missile was interfered with by U.S. cyber operations.

This time around, the speculation is being carried mostly in the press of three of the other four I's, the U.K., Australia, and New Zealand, and it's again based for the most part on a priori speculation. There is, after all, no shortage of ways a missile shot can go wrong, particularly missile shots using technology developed in as closed, secretive, and self-sufficient a society as North Korea. But there's clearly a fairly widespread wish in many corners of the world that Supreme Leader Kim's ambitions for a long-range nuclear strike capability could be frustrated by quiet cyber

action short of airstrikes or invasion. U.S. and indeed Chinese policy toward the DPRK has hardened recently, with U.S. Vice President Pence and other senior officials saying that the era of strategic patience toward Pyongyang has reached its end. Senior U.S. officials are warning that a North Korean cyber attack against U.S. infrastructure is likelier than a missile strike. U.S. Secretary of Homeland Security John Kelly was among those calling this weekend for greater resilience in the nation's ability to sustain and recover from such an attack. Observers spent the weekend mulling the shadowbroker's latest release of alleged NSA hacking tools. Their consensus conclusions are so far that the leaks suggest exploitation of

vulnerabilities in financial systems and the industrial Internet of Things. Some of the more interesting material in the Shadow Brokers latest pertains to a range of Microsoft vulnerabilities, particularly against Windows Server. Microsoft says, and observers agree, that it's already quietly patched the zero days the leaks indicate. Of course, as always, when exploits are released, there's a heightened risk to unpatched systems. Turning to information operations, Syria's Assad regime, and in all probability its Russian sustainers, have undertaken a social media campaign intended to convince the susceptible that the regime's use of nerve agent against civilian populations never happened, and that if it did, it was a U.S. provocation. So hoax or provocation, the Damascus line is that it's all Washington's fault. The black propaganda is being associated

with the hashtag Syria hoax, and it seems to be gaining traction among the gullible, the disaffected, the suspicious, and the ill-disposed. A study out of Nova Southeastern University looks into ISIS recruitment of women as suicide bombers. The study suggests that the approach is different from that used to induce men to seek martyrdom, but a close reading suggests a common theme. While the sources of disaffection differ, the promise is about the same. Those who don't fit in are proffered meaning and transcendence, redemption through violence. In the ransomware black market, Locky's out, Cerber is big, and Forcepoint announces discovery of newcomer Cradlecore.

Cradlecore is a different animal. Most ransomware is now being monetized in the form of ransomware as a service, but Cradlecore's proprietors are selling the source code. This suggests a force point that the hoods running it either have limited experience or are doing this as a sideline, or some combination of both. The U.S. Food and Drug Administration is being reported in the Wall Street Journal and elsewhere to have criticized Abbott Laboratories, makers of, among other products, St. Jude pacemakers, for having allegedly failed to investigate and resolve potential cybersecurity issues with its implanted devices. It's another incident that prompts concern about the security of the medical Internet of Things.

We heard from Rod Schultz of Rubicon Labs, who describes this as another challenge raised for technologies built on batteries and software. He thinks the experience of mobile devices, which depend upon advances in those two areas, holds potentially valuable lessons for medical device security and safety. In this particular case, Schultz thinks that advice from the likes of Samsung, Apple, and Google would have been helpful, and that the FDA itself could profit from collaboration with them. Quote, each of those companies has processes and advice that the FDA could solicit to prevent battery, cybersecurity, and other mobile device pitfalls, Schultz observed. We are at the beginning of an

incredible transformation in how medical care is given and received, and the FDA can probably do In industry news, Bloomberg alleges that security unicorn Tanium is firing employees just before their stock options vest. Business Insider, which is also following the story, received a denial from Tanium, which says there's nothing to it. A company representative said, quote, We investigated this allegation and the data confirmed that there is no pattern or practice of terminating employees based on their vesting cliff date, end quote. The Bloomberg story also notes that, quote,

at least nine senior executives have left in the past eight months, including the company's president, chief marketing officer, chief accounting officer, and the chief of operations and finance, end quote. Privately held Tanium, thought to be preparing for an initial public offering, is currently valued at $3.7 billion. a buzzword. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now?

Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks,

like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son.

But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Cyber threats are evolving every second and staying ahead is more than just a challenge.

It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. And I'm pleased to be joined once again by Rick Howard. He's the Chief Security Officer at Palo Alto Networks, and he also heads up Unit 42, which is their threat intel team. Rick, welcome back.

We wanted to touch base today about connected cars and security and what you describe as first principles. At the RSA conference in San Francisco a few weeks ago, I had the opportunity to sit down with a few of the automobile manufacturers and discuss some of the design principles for securing the connected car. It was fascinating, and it reminded me how important design is to building secure solutions. Specifically, what design assumptions do you make about the connected car? So here's what I mean. For instance, do you consider that your connected

car is a mobile network of networks, or is it more like an endpoint, like a laptop or a mobile phone? Or is it more like an operating system like Windows or Linux? Because your choice here will dictate how you secure it. And nobody has come to any agreement about what any of those things are. So let me just talk about some of those implications. So let me just talk about some of those implications. The connected car is similar to a network of networks because everybody that I talk to from the automobile manufacturer says that it has at least two operational networks. They got the entertainment system and the car's functional and safety systems like the

engines and the brakes and the airbags. Now both of these networks must have access to the internet or at least have a way to communicate outside of the car in order to receive updates that's clear how to do that securely is not particularly clear we know that the entertainment system must have direct access to the internet for it to be at any value how the functional and safety system communicate out is not that obvious but if the connected car is a network of networks how do you firewall those two sides away from each other because everybody that i talk to knows that the system network should never communicate with the entertainment system right because that's just asking for trouble so this has not been

resolved yet but if you consider it like a laptop right so laptops have entertainment systems that sit on top of the operating system that communicates the various components of the device. That is a model we all use today, but it is also the model that is routinely breached by bad guys. So if we choose that model, at least we're familiar with it, but we will also get the same problems we have today on the Internet that all endpoints have today, and maybe that's not the best approach. Now, the third one is if the car is more like an operating system. So perhaps we can learn a thing or two about closed versus open architectures like iOS versus Android. In all three design assumptions, we know we have to install some basic security controls. We need to prevent and detect behind the internet connections, whatever they will be. We need

basic controls between the entertainment system and the car's functional systems. We need basic controls from the proximity access points like keyless entry and GPS and OnStar and car-to-car communication for safety of autonomous vehicles and the like. All those things have to be built in there. What became clear to me when I was talking to these folks is that these discussions of the current car communication systems are probably not adequate. The current systems they have probably won't do us any good. If we start to bolt the security on top of what already exists, it's probably not going to work that well. And it might be time to throw everything out and start from scratch, a la Elon Musk and designed the connected car from the ground

up using first principles. So it's going to be very interesting to see how this goes forward. And nothing is set in stone at this point. Yeah, it's interesting to me that the notion that just like, you know, certain brands of cars have reputations for safety. I'm thinking of Volvo, for example. Could cars have reputations for protecting you in the cyber realm? Some brands doing a better job than others. Yeah. And could you market that

as a thing? Right. You know. Yeah. So maybe so. OK. And in most of the automobile manufacturer just now getting their hands around all of that. Yeah. All right. Rick Howard. Good stuff. Thanks for joining us. Thank you, sir. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk.

In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's the Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening.

Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data Thank you. and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.