CyberWire Daily - More data found exposed in an AWS S3 bucket. EtherDelta's DNS impersonation issue. DPRK says it doesn't hack. FISA Section 702 nears sunset. Wassenaar updated. Kaspersky says its due process rights have been violated.

Episode Date: December 21, 2017

In today's podcast, we suggest a new year's resolution all organizations should make: resolve to configure your cloud services for privacy and security. Another cryptocurrency exchange gets hacked, this one by DNS hijacking. North Korea finally says it had nothing to do with WannaCry, but few are convinced. The Lazarus Group continues to be a prime suspect in cryptocurrency theft. Section 702 nears sunset. Wassenaar seems to have become friendlier to researchers.  David DuFour from Webroot on quantum computing and AI. Guest is Joseph Carson from Thycotic on stolen passwords on the black market. And Kaspersky Lab wants redress in court.  Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. Here's a New Year's resolution all organizations should make. Resolve to configure your cloud services for privacy and security. Another cryptocurrency exchange gets hacked, this one by DNS hijacking. North Korea finally says it had nothing to do with WannaCry, but few are convinced.

The Lazarus Group continues to be a prime suspect in cryptocurrency theft. Section 702 nears sunset. Vossener seems to have become friendlier to researchers. And Kaspersky Lab wants redress in court. seems to have become friendlier to researchers, and Kaspersky Lab wants redress in court. I'm Dave Bittner with your CyberWire summary for Thursday, December 21, 2017. Another big Amazon Web Services S3 bucket misconfiguration has exposed tens of millions of individuals' sensitive personal information.

It's worth stressing again that configuring an AWS S3 database is the database owner's responsibility, not Amazon's, although Amazon has been trying to nudge customers in the direction of better, more privacy and security-conserving configurations. This case involves data maintained by Alterix, a U.S. analytics firm. The bucket holds information on some 123 million U.S. households, which is as close to all of them as to make no difference. This information comes from the credit bureau Experian, the U.S. Census Bureau, and Alterix itself. The exposed database was noticed by UpGuard, the security firm that, along with ChromTech, continues to dine out on its discovery of publicly accessible AWS S3 buckets.

Some of the data, like those from the U.S. Census of 2010, are already publicly available. But the Experian files, of course, were never meant to be public, although they would have been commercially available from the credit bureau. Alterix has said in a statement posted to its corporate blog that they secured the databases as soon as they were made aware of the exposure and that the Experian information that was exposed, quote, is commercially available from Experian and provides some location information, contact information, and other estimated information that is used for marketing purposes. It does not include names, credit card numbers, social security numbers,

bank account information, or passwords, end quote. Some are also drawing comfort from the age of the information. The Experian data is from 2013, but the exposure remains unsettling and should prompt some attention not only to cloud configuration, but to organizations' data supply chains as well. Researchers at Google recently announced that they'd found huge numbers of user account information available on dark web markets. Joseph Carson is chief security scientist at Thycotic, and he joins us with his thoughts

on the findings. What Google's reported is that they're actually identifying that in the black market and places like Deep Web and Darknet, that they have found 1.9 billion stolen passwords and usernames. The more concerning part of it is that they're still indicating that 25% of them still work on an active account. Yeah, do the math there. That's half a billion still active. Those are the numbers. What's your analysis of the reality of those numbers? I mean, I still think the number is quite low, in my honest opinion. And the reason why I say it's low is that it's

not surprising either. We're finding this type of data in those locations. For many years, as data breaches have been disclosed and those data dumps have been made available, hackers have been correlating them anyway. They've been putting them together in order to do large password cracking. Looking forward, what do you think is the solution to this sort of thing? Are we heading into a time where we need to look at passwords differently? I think that there has to be a concept is that, yes, we need to get into not one is how we create and use passwords. That's for sure is, you know, contributing to the major problem.

If we look at over the years about password and even passphrase and other types of best practices, If we look at over the years about password and even passphrase and other types of best practices, when those best practices were introduced, we were only using between one to five maybe accounts. So reuse of passwords is quite limited. Now move forward to today that everything we use, everything on social media, any type of service that we get, they all come with different accounts. And the average person today has more than 30 different accounts and passwords that they need to protect. And we've got into really severe cyber fatigue, which has caused many people to reuse passwords. One account gets compromised, like we've seen over the years, and it's very common that almost every person that's using the Internet today has been a victim of cybercrime that it only takes one of those accounts to be compromised in order to then make the rest of the accounts that they have expose and compromise not

just on their own personal internet accounts but those accounts and passwords are the same passwords that they're using for their own internal business work and work life so we're're finding that how we create and use passwords is, and also the evolution of the number of accounts that we have, is definitely contributing and escalating the problem greater. And we really need to get into better capacity and get better understanding about what is the right best practice to deal with many accounts and to also reduce the cyber fatigue. And so what do you imagine being a solution that could be simple? A solution that could be simple is definitely something that means

that humans are not creating passwords. Passwords are a combination of multiple things that they have or who they are. So definitely there has to be some type of good mechanism at actually creating a password that is tied to a human's, you know, whether some elements of biometrics, some things that they have and those combinations, but security itself needs to be definitely multi-factor and multi-attributes that applies to it. Anything else, so that means that at least access to their digital identity and access to the accounts that then provide, for example, password management functionality, that means that this is the access to the vault that actually then manages your digital footprint

for you. And that would be something like managing your passwords and rotations and complexity and additional factors. You don't need to know what's happening in the background. You just need to know how to interact and how to gain access. So definitely password vaults, digital identities and multi-factor authentications all have a part to play. But we need to find definitely a way that makes them simpler to be used by people. Therefore, that it's not something as complex. It's just as easy as click and access. And the biometrics or the attributes that you have make up that security control.

That's Joseph Carson from Thycotic. Turning to matters of national and international policy, in the U.S., Section 702 of the Foreign Intelligence Surveillance Act, which authorizes collection of electronic communications by the National Security Agency, will sunset in 10 days if it's not renewed. The intelligence community generally regards Section 702 as an essential authority for intelligence collection. Congressional efforts underway to reauthorize or at least extend the authority are controversial facing skepticism from elements on both the left and the right recent alterations to the Vassaner cyber arms control agreement continue to

receive generally positive reviews as protections for security researchers are incorporated into the framework a major challenge in cyber arms control is the dual use problem many tools have both perfectly legitimate indeed essential framework. A major challenge in cyber arms control is the dual-use problem. Many tools have both perfectly legitimate, indeed essential uses, and illegitimate, dangerous application as attack tools. Earlier iterations of the Vossner Agreement had tended to err on the side of prohibition, much to the discomfiture of the security community. The dual-use problem isn't of course unique to cyber. Switches used in photocopiers can be used in nuclear weapons trigger mechanisms. Fermenters can be used to

brew beer, but also bacteria for biowar applications. And ballpoint pen ink and mustard gas share some common precursor chemicals. Expect more work on Vossner. North Korea has gotten around to denying involvement in WannaCry, calling the attribution absurd. Pyongyang's statement is more measured than normal. As reported by the DPRK's official news agency, KCNA, the foreign ministry said today, As we have clearly stated on several occasions, we have nothing to do with the cyber attack Absurd or not, the allegations are widely credited. North Korea is also drawing suspicion in a number of other cases, especially those involving theft by the country's Lazarus Group. Facebook and Microsoft have been cooperating in takedowns of various Lazarus Group accounts

and infrastructure. The group is believed to be concentrating on theft of Bitcoin and other cryptocurrencies in an attempt to redress the chronic financial pinch an underdeveloped economy and wide-ranging sanctions have imposed on North Korea. Pyongyang's operatives are suspected in the altcoin theft that bankrupted the South Korean-based UBIT exchange earlier this week. Attacks on cryptocurrencies continue, and another operation, crypto-to-crypto exchange EtherDelta, was taken offline yesterday after being hacked. Specifically, attackers seized control of EtherDelta's DNS server

and redirected traffic to the site, including traffic by customers wishing to trade, to their own malicious server that hosted a bogus copy of EtherDelta's website. Bleeping Computer thinks that EtherDelta appears to have regained control of its DNS server. In any case, the telltale signs of the bogus site, a missing chat button and a missing Twitter feed, seem to have been restored, but so far EtherDelta hasn't given an all-clear,

and it's possible the hoods may simply have upgraded their impersonation. Sector information source CoinMarketCap ranks EtherDelta as the world's 85th largest altcoin exchange. It's an interesting one in that it handles a wide variety of cryptocurrencies, and in that it's a coin-to-coin site only. You can't trade fiat money, that is conventional state-backed currency on it, but you can go from Bitcoin to Ether to Monero. There's no firm attribution yet, and investigation is in its early stages,

but there's plenty of eye-rolling in the general direction of Pyongyang. There are also continuing efforts by criminals to install cryptocurrency miners on non-cooperating machines. The latest wave, and it's a fairly big one, has been rolling since Monday, as WordPress sites are subjected to brute force attacks

aimed at installing Monero miners on users. Security company WordFence, which specializes in WordPress security, says the attackers are using a combination of common password lists and heuristics based on the domain name and contents of the site that it attacks. The hackers appear to have netted so far more than $100,000, although the precise amount they've mined is unclear. Some observers complain that the U.S. has provided no real evidence of North Korean involvement in cyber attacks, and that U.S.

attributions shouldn't be accepted at face value. But the other four Five Eyes appear to agree, and Facebook and Microsoft seem to be taking down DPRK operators in the Lazarus Group. There are concerns surfacing now that Pyongyang will seek to disrupt the upcoming Winter Olympics, scheduled to be held in South Korea this coming February. Those worries involve more betting on form than on any solid trackside tips, but we'll surely hear more of them as we get closer to the games. Some of the same observers see the same issue in the U.S. government's ban on Kaspersky security products. The Department of Homeland Security may well have to show some of the evidence that moved it to issue the ban. Kaspersky Lab is suing the department

in U.S. federal court, alleging that Kaspersky Lab is suing the department in U.S. federal court, alleging that Kaspersky's been deprived of due process. The proceedings will be followed with much interest. is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more.

Salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SOC 2 and ISO 27001. They also centralize key

workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. And now a message from Black Cloak. Did you know the easiest way for cybercriminals

to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. And joining me once again is David DeFore. Learn more at blackcloak.io. And joining me once again is David DeFore.

He's the Senior Director of Engineering and Cybersecurity at Webroot. David, welcome back. You know, we've been seeing in the news a lot lately stories about quantum computing. And today you wanted to address quantum computing, particularly when it comes to artificial intelligence. What do we need to know about this? Well, you know, David, again, thanks for having me. Quantum computing is fascinating. I think anyone who's reading about it, you know, it's coming every day.

We see new advances that are going to make it more available because it's very expensive right now in terms of trying to build and generate a quantum computer. You're not going to have it under your desk anytime soon. But with the processing speed that becomes available, it's somewhat mind-blowing what we're going to be able to see in terms of advancements around analyzing large amounts of data, which would help improve things like AI, and specifically in the field of AI machine modeling. You and I have talked ad nauseum about the difference between AI and machine learning. And so I think the AI component, as we simplify the ability to build quantum computers, you'll see vast improvements in the way AI performs in terms of interactions with people. I think more importantly, at first,

what you would see is vast improvements in the ability for machine models to be able to do work for us in that machine learning field. Now, do you suspect with these quantum computers coming online that will lead to a lower cost and processing power? I think initially, no, but over time, yes. Obviously, when new things come out, they cost a lot of money and you see large universities or groups of universities building them or, you know, large nation organizations funding those those types of machines. So I think initially it'll be very expensive. But but as with all technology over time, it will it will come down market. And then so eventually, I guess part of the point you're making is that this technology will be available to the bad guys as well. It will. And I'm willing to bet that what we're going to see initially will be some use for good, but I bet a lot of use for breaking older encryption techniques and just things that could take raw computing power to use in terms of attack. I think you'll see some of that in

the initial versions of quantum computing. Unlike the internet when it first came out and computers when they first came out, there were a lot of applications available, you know, that we hadn't really explored. And we were using them for more science research. But I think a lot of times now we think, how do we weaponize computer processing power? And I think that you're going to see a lot of that initially with quantum computing. David Dufour, thanks for joining us. Thank you, David. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker,

a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default deny approach can keep your company safe and compliant. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable.

That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.