CyberWire Daily - Notes on the fall of Afghanistan, with its cyber and kinetic implications. US State Department hack reported. ShinyHunters resurface. Further incentive to patch Microsoft Exchange Server.

Episode Date: August 23, 2021

The Taliban consolidates control over Afghanistan, and it’s doing so online as well as on the ground. Reports say the US State Department has come under cyberattack; State says that any such incident was without significant effect. The ShinyHunters say they’ve obtained a great deal of PII from AT&T, but AT&T says that, whatever the crooks have, it didn’t come from AT&T. Rick Howard on orchestration. Carole Theriault on women in cybersecurity - are thing getting any better? And exploitation gives organizations even more incentive to patch Microsoft Exchange server instances. For links to all of today's stories check out our CyberWire daily news briefing: https://www.thecyberwire.com/newsletters/daily-briefing/10/162 Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. The Taliban consolidates control over Afghanistan, and it's doing so online as well as on the ground. Reports say the U.S. State Department has come under cyber attack. State says that any such incident was without significant effect. The shiny hunters say they've obtained a great deal of PII from AT&T,

but AT&T says whatever the crooks have, it didn't come from AT&T. Carol Terrio wonders if things are really getting better for women in cybersecurity. Rick Howard conducts some orchestration with the hash table. And exploitation gives organizations even more incentive to patch From the Cyber Wire studios at DataTribe, I'm Dave Bittner with your Cyber Wire summary for Monday, August 23rd, 2021. As the Taliban consolidates control over Afghanistan, it has established checkpoints and is conducting house-to-house searches to find collaborators with the former regime, the Washington Post reports. According to NBC News, Afghans are purging their social media accounts in an effort to remove all signs of connection with Western nations,

international human rights groups, the Afghan military, or the recently collapsed Afghan government. Among the content that people fear might suggest such connection are items that are commonly shared in social media. Three people in Kabul told NBC News that they had deleted documents and photos from their phones that might provoke the ire of the Taliban, including photos with Afghan officials, pictures of the Afghan flag, and photos with foreign colleagues. Much of the deleted content is most likely hosted on social media platforms

like Facebook. Taliban fighters at checkpoints are demanding that people seeking to pass turn their phones over for inspection. Retired U.S. Army General David Petraeus, former commander of Central Command and former director of Central Intelligence, speaking at the Atlantic Council event this morning, disputed characterizations of conditions in Afghanistan as an intelligence failure. He says, on the contrary, that it was a failure of strategic patience, quoting at length and with approval from an op-ed in the New York Times by former U.S. ambassador to Afghanistan, Ryan C. Crocker, published Saturday. This, Crocker argued and Petraeus agreed, is historically a common American failing.

Petraeus thinks one likely sequel to the Taliban's seizure of power will be the formation of a number of virtual caliphates, similar to the ones ISIS established during its ascendancy, and that this seems to be the likeliest form in which Afghanistan may foster terrorism. If they follow the ISIS playbook, the virtual caliphates will be heavy on inspiration, and they'll quickly exploit ungoverned territory to re-establish themselves. Does the Taliban face obstacles in cyberspace and kinetic space? According to Petraeus, they do. Quote, the Taliban is broke. The lights could literally go out in Kabul, and they are likely to be unable to deliver basic services. End quote. The new regime is

likely to remain heavily dependent on foreign largesse, which is now less likely to materialize. And what of the conduct of the evacuation itself? Various scenarios have been played out by the planners, Petraeus said, and evacuation would have been one of them. But it's quite another matter to do that when a government collapses suddenly, and it's difficult to run noncombatant evacuation for what, in effect, is a very large and imprecisely defined refugee population. He said, quote, now that we've decided to do this, it's been going on very impressively, end quote, but noted that the U.S. has written a very significant blank check with respect to evacuation. Washington must decide who gets into the airport, gets a plane ride out, and where that plane goes. And then,

and this is the hard call, who doesn't get out. Whatever happens, it's likely to figure in future Taliban influence operations. Saturday afternoon, Fox News broke the story that the U.S. State Department had come under cyber attack. State has, as is its policy, neither confirmed nor denied the report, but Reuters said that a knowledgeable source told them, without confirming any incident, that the State Department has not experienced significant disruptions and has not had its operations impeded in any way. A State Department spokesperson said, The department takes seriously its responsibility to safeguard its information

and continuously takes steps to ensure information is protected. For security reasons, we are not in a position to discuss the nature or scope of any alleged cybersecurity incidents at this time. End quote. Restore Privacy said late last week that shiny hunters are claiming on Raid Forum to have stolen a large quantity of customer data from AT&T and teased some of the data in a leak that solicited buyers for the information. AT&T said that wherever the data came from, it wasn't from them.

The company told Restore Privacy, Based on our investigation today, the information that appeared in an Internet chatroom does not appear to have come from our systems. Restore Privacy sees AT&T's characterization of Raid Forum as an Internet chatroom, as an attempt to minimize Raid Forum's importance. That seems unduly puritanical. Raid Forum is basically a chat platform. That it's

been widely used by criminals is beyond dispute, but there seems no reason to try to accord them unusual effect. The shiny hunters have invited AT&T to negotiate the unreleased data's return. Intel 471 offers an interesting review of who the shiny hunters are, including the homage to Pokemon embedded in the gang's name. They describe the shiny hunters' most profitable and most dangerous actions at each stage of the MITRE attack framework. actions at each stage of the MITRE attack framework. Security firm Huntress Labs reported, also at the end of last week, that unpatched Microsoft Exchange servers continue to be prospected for known vulnerabilities. And we note, in a spirit of disclosure, that Microsoft is a sponsor of the CyberWire.

Much of the exploitation has been conducted by Proxy Shell. of the Cyber Wire. Much of the exploitation has been conducted by Proxy Shell. Late this morning, Huntress added that they've discerned a new technique in the attacker's approach. While analyzing one host that was compromised with both Proxy Shell and the lock file ransomware, we uncovered a unique TTP that we had not seen before for proxy shell activity. The configuration file for the Exchange Internet Service was modified to include a new virtual directory, which practically redirects one URL endpoint to another location on the file system. This allows a threat actor to hide a web shell

in other uncommon and non-standard locations outside of the typically monitored ASP directories. If you don't know to look for this, this is going to slip under the radar and the hackers will persist in the target environment, end quote. So the researchers counsel staying alert, that and of course, the importance of patching. Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks.

When it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta

when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak.

Learn more at blackcloak.io. And it is always my pleasure to welcome back to the show the CyberWire's Chief Security Officer and also Chief Analyst Rick Howard. Hello, Rick. Hey, Dave. How's it going? Not bad, not bad. So on last week's CSO Perspectives episode, you discussed automatic orchestration as a first principle strategy. And if I recall correctly, you recommended that implementing it should go pretty high on the priority queue. Now, this week, you brought in two of your experts from

the CyberWire hash table to get their thoughts. Did they agree with you on your take? I think you're anticipating me here, Dave, right? Because you know. Well, I don't want to blow the lead or anything, but my favorite episodes are the ones where your colleagues take you to task. Well, you know, that's exactly how this one went. Okay, very good. So I invited Bob Turner, the Fortinet Field CSO for Education, who, by the way, has just recently taken that gig. He was formerly the CISO for the University of Wisconsin at Madison. And Kevin McGee, the Chief Security Officer for Microsoft Canada.

And, you know, technically, they didn't disagree with the importance of automatic orchestration, but they were pretty emphatic that something else needed to be done first. All right. Well, last week, you focused on some of the technical strategies that you might use to implement orchestration, things like DevOps or security orchestration platforms. You even talked about a SASE architecture. So what is it that Kevin and Bob wanted you to do first? Well, as they say in the biz, Dave, that would be a teaser, right?

So if you want to hear what they had to say, download and listen to the episode. All right. Well, you heard it here first. Go check it out. It's part of CSO Perspectives, part of CyberWire Pro. You can find that over on our website, thecyberwire.com. Rick Howard, thanks for joining us. a partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs

smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. When it comes to women in cybersecurity, it's fair to say that progress has been made. There are more women in the field and in higher positions than ever before. That said, there is still much to be done. Our UK correspondent Carol Theriault shares this commentary. I have worked in the cybersecurity world for probably 24 years.

And there's one thing that I can say about the industry. It is never boring because every day someone somewhere is putting out some information about an attack or a proof of concept or a vulnerability. Dangerous apps, dodgy deep fakes, social engineering attacks. I mean, the list goes on. There's this constant fight between people trying to protect data and information and those trying to steal or take information. And that makes it a truly exhilarating industry to be in. But one of the downsides for me at the time was there wasn't that many women in strong technical roles or leadership roles or board level. It was a very male-dominated environment. And I think it would have been immeasurably better had we had more female input in the mix. I mean, sure, it is way better

now than it was when I first started. Now you will see women head up large teams, present keynotes and research at conferences, develop cyber defenses. But I'll tell you, men still outnumber women by an embarrassing gap. According to ISC Squared in their Women in Cybersecurity report, women represent basically one in three. And compensation is not yet considered equitable. Quote, women in cybersecurity managerial positions earn about $5,000 less than men, indicating there is still an issue that needs to be addressed, unquote. But, and this is a happy but,

there is a shift, according to ISC Squared, of companies hiring more women in high positions. Women also seem to be more educated. This may be down to inequities in compensation. And the way women are dealing with that is by presenting themselves by having more education and more certifications than their male counterparts. Smart move. Because these women that are coming into the industry now will be our future leaders. And I want them to have all the qualities that any good leader has. Experience, wisdom, nous, and a strategic mindset. And you get there by learning, by failing, by risking.

These are all important qualities that help make a good leader to my mind. And why not do it somewhere exciting rather than somewhere where the same thing happens day in, day out. So women, this is a call to you. Join cybersecurity. We need you. This was Carol Theriault for The Cyber Wire. And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. The Cyber Wire podcast is proudly produced in Maryland out of the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technologies.

Thanks for listening. We'll see you back here tomorrow. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.