CyberWire Daily - Online content and terrorism. Huawei’s shifting strategy. Venezuela’s grid failure is explicable by corruption and incompetence--no hacking or sabotage required. Gnostiplayers are back. AI and evil.

Episode Date: March 18, 2019

In today’s podcast we hear about content moderation in the aftermath of the New Zealand mosque shootings. A shift in Huawei’s strategy in the face of Five Eye--and especially US--sanctions: the US doesn’t like us because we’re a threat to their ability to conduct untrammeled surveillance. Corruption, neglect, and replacement of experts by politically reliable operators seem to have caused Venezuela’s blackouts. Gnosticplayers are back, with more commodity data. And AI has no monopoly on evil--natural intelligence has that market cornered. Joe Carrigan from JHU ISI on the recently announced DARPA funded effort to develop and open-source voting system. For links to all of today's stories check our our CyberWire daily news brief: https://thecyberwire.com/issues/issues2019/March/CyberWire_2019_03_18.html  Support our show Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. Content moderation in the aftermath of the New Zealand mosque shootings. A shift in Huawei's strategy in the face of FiveEye and especially U.S. sanctions. Corruption, neglect, and replacement of experts by politically reliable operators

seems to have caused Venezuela's blackouts. Gnostic players are back with more commodity data, and AI has no monopoly on evil. Natural intelligence has that market cornered. From the CyberWire studios at DataTribe, I'm Dave Bittner with your CyberWire summary for Monday, March 18th, 2019. Facebook has removed 1.5 million copies of video showing Friday's massacre of Muslims at prayer in New Zealand. New Zealand's Prime Minister, Jacinda Ardern, wants social network companies to do more, particularly with respect to blocking extremist, inspirational content.

But blocking content remains an imperfectly solved problem. Either viewers object to something they've seen and report it, or an algorithm flags content as questionable. At that point, human moderators make a determination. Social media platforms have difficulty handling this at scale, even when they're not working with live streams, and there are few good suggestions for how live-streamed video might be moderated. Mobile carriers in New Zealand have blocked sites that carry or carried the shooter's video. The services blocked include 8chan, 4chan, and LiveLeak.

The shooting itself and the attendant radicalization surrounding it is under investigation in New Zealand, of course, but in other countries as well. In the UK, for example, MI5 is looking for connections between the shooter and British extremists. In general, it's being noted that governments, even though as accustomed to cooperation as those of the Five Eyes, do better sharing foreign intelligence

than they do intelligence bearing on domestic terrorist threats. Huawei's lawsuit against the U.S. federal government, alleging that its treatment amounts to an unconstitutional bill of attainder, isn't likely to be any more successful than a similar suit Kaspersky filed late last year. Both companies have been booted from federal networks as security risks, but courtroom success doesn't seem to be the goal, according to the Washington Post. Huawei is appealing to the court of public opinion, particularly allied public opinion. The general lines of that public appeal won't be constitutional. There are a number of op-eds

and news stories out, those appearing in the Globe Times are representative, that argue that the U.S. is really not afraid of being hacked via Huawei gear, but rather that it fears its own surveillance programs will be impeded by wider adoption of Chinese hardware and services. China's premier, Li Keqiang, said Friday that China would never ask Chinese companies to spy on its behalf, this reassurance being offered as part of an international charm offensive that featured a new law that nominally affords foreign companies more protection of their intellectual property. These reassurances are generally welcomed as nice, but fewer taking them at face value.

Venezuela's power grid has partially recovered from last week's outages. Its causes seem to have been rooted in decisions the Chavista regime has taken over the last few years that resulted in displacement of operational expertise by political pliability. Electricidad de Caracas, the country's largest power provider, was acquired by AES in 2000, but AES was forced to sell to Petroleos de Venezuela during nationalizations in 2007. Shortly after the nationalization, power generation and distribution were folded in to Corpoelec. A move to upgrade power generation capacity in 2010 by constructing thermoelectric plants to supplement the country's hydroelectric base generation,

did not proceed happily. The Wall Street Journal notes that no-bid contracts and kickbacks to the politically well-connected became the norm. The Wall Street Journal has followed up reporting last week by the New York Times that suggests poorly maintained facilities were taken out by brush fires. Corpo-Elec stopped clearing fast-growing vegetation from around transmission lines and access roads about three years ago. Maduro's regime has blamed a combination of domestic sabotage and American cyber attack. The wreckers the security services have fingered have been relatively junior managers at Corpo-Elec, like Giovanni Zambrano, who was detained last week by intelligence agents.

His offense, one concludes from the Wall Street Journal's coverage, seems to be that he told local media back in February that the grid was on the verge of collapse. Few observers now credit the regime's allegations that the outage was an American hack or electromagnetic attack, those who do are for the most part driven by ideological sympathy. Those who do so, like the Russian or Chinese governments, do so because such accusations are a handy stick with which to beat Washington. More than 50 countries now recognize the Venezuelan National Assembly's declaration that Juan Guaido is the country's interim president. Nicolás Maduro continues to cling to the office, however, and has directed his cabinet to turn in their resignations to effect a profound reorganization of the methods and operation of the Bolivarian government

to shield the homeland of Bolíar and Chavez from any threat. Future outages appear likely. NotPetya's effects continue to appear in victims' bottom lines. The Irish examiner notes that TNT Express Ireland says it sustained 2.2 million euros in losses last year, attributable to its corporate parents' affliction with the pseudo-ransomware. And the Gnostic players are back, dropping a fourth round of stolen records in their favored dark web markets. This time they're offering over 26 million user records, names, emails, passwords, that kind of thing, all for the low, low price of 1.2431 Bitcoin.

That's roughly 4,940 Yankee greenbacks, if you should happen to be in the market. Gnostic players isn't feeling the love. He's been chatting with ZDNet, and ZDNet thinks they've got the real Gnostic players and not some imposter. I got upset because I feel no one is learning, Mr. Gnostic told the publication. I just felt upset at this particular moment because seeing this lack of security in 2019 is making me angry. He's no longer hoping to make a quick buck and retire, and in any case, $4,900 isn't going to get him very far because he's realized that other hackers have gotten there first.

So instead, he's trying to that other hackers have gotten there first. So instead, he's trying to get what he can from extortion. Mr. Gnostic mused, I came to an agreement with some companies, but the concerned startups won't see their data for sale. I did it, that's why I can't publish the rest of my databases or even name them. A lot of the data are probably recycled from earlier breaches. Still disturbing, but in all likelihood, commodity stuff. Finally, at the recent South by Southwest meetings, chess grandmaster Garry Kasparov offered some reflections to Fast Company

about the scope and limitations of artificial intelligence. For all the talk of artificial intelligence's growing capabilities, Kasparov said, quote, humans still have the monopoly on evil, end quote, evil being what Kasparov would characterize as an open system. He doesn't discount the considerable capabilities that artificial intelligence exhibits and will no doubt continue to improve, but he does think it excels in closed systems. So a monopoly of evil? Okay, we've got that going for us. Trainers of AI, take note. You may well find your own vices reflected right back at you. Calling all sellers, Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life.

You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks.

But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber.

That's vanta.com slash cyber for $1,000 off. And now, a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. and joining me once again is joe kerrigan he's from the johns hopkins university information security institute and also my co-host on the hacking humans podcast joe it's great to have

you back hi dave uh we got an interesting story came by and this is about darpa which is building a new open source secure voting system right and they got 10 million bucks to do it. What's going on here? Fill us in with the details, Czar. This came out on March 14th, and exactly two days before, on March 12th, they had on Motherboard, they had an article about researchers finding a critical backdoor in the Swiss online voting system. But this

is not an online voting system. This is an in-person voting system. DARPA has contracted with a company called Galois. Galois. And it's spelled G-A-L-O-person voting system. Okay. DARPA has contracted with a company called Galois. Galois. And that's spelled G-A-L-O-I-S. Okay. French mathematician.

Okay. It's named after. Basically what they're doing is they're developing two systems for voters. And the one that's covered most in this article is about the one that generates ballots for voters. So you're going to walk in. There's going to be an electronic representation of the ballot in front of you. Okay. And you're going to walk in, there's going to be an electronic representation of the ballot in front of you, and you're going to make your votes on the electronic machine, and then the machine will print out a paper representation of what you voted.

There will be no barcodes on this, because that's one of the concerns that people have, is that if the counting machine is going to read a barcode on how I voted, humans can't read that. So if I present the user, the voter, with how they actually voted and then tamper with their votes in the barcode and that's what gets tallied, that's no good. Yeah. Right? So this doesn't have a barcode. It actually reads the ballot the same way the user does. It looks at the boxes that the user checked and tallies up the votes. Okay. So then when the user takes the ballot over to the scanner, the scanner will scan the ballot and print out a receipt with a cryptographic token on it. Oh, right. And that

cryptographic token can then be used to say that, yes, your votes were included and they were included properly in the tally. So it's sort of your receipt is this cryptographic token. Right. And what do you check that against? You check it against a website that will be published after the election. So after the fact, you can go and use this cryptographic token. Right. To verify that what they have you down for is what you.

Well, you can't actually see who you voted for. Oh, okay. Because that actually provides someone with a means to coerce somebody else. So I can say, Dave, you better vote for my candidate in the next election or I'm going to beat you up. Now give me your receipt and let me see who you voted for. Right, right, right. So they don't show you that. Okay.

But they do show you that your votes were tallied properly. Hmm. But I don't know how they go about proving it. It probably has something to do with the cryptographic system that's involved. And the fact that this is open source, that's a good thing, yes? That's a great thing. They're going to be taking it to DEF CON. They're going to be sending it out to universities. The biggest problem I've always had with these electronic voting machines is that they are not open source. People have found vulnerabilities in these that were easily exploitable,

and the manufacturers of these systems didn't do much about it. They're private companies. They're private companies, exactly. And Galois will not be manufacturing these voting machines either. They're just going to release the standard. And this is kind of an issue I have with this entire project, is they're going to release the standard out to other companies to produce the voting machines with the software and with allegedly the hardware. So this is where if this system breaks, this is where it's going to break.

Yeah, but it seems as though people manufacture it. So what they're doing here is trying to get as many eyes on this as possible. I guess part of what they're after is to try to reestablish trust in these systems. Right. Yeah. Certainly after some of our recent elections, I think some of that's been eroded. Right. I've told stories about when we had the Diebold machines here in Maryland.

Yeah. Right. And somebody looked at my ticket that I handed them and he sent me to a voting machine that nobody else had used while I was there and nobody else was using while I was there. And each one of those individual Diebold machines was its own ballot box. So how do I know that they didn't just reset that machine when I was done? So I like the idea where they have one vote counting machine in an election site, and everybody's, it's like the old ballot box.

It's essentially an electronic ballot box. And not only that, but there actually is a paper record of the ballot in the ballot box. Yeah. A physical paper record. Yeah. All right. Well, it's an interesting program. Well, certainly it's going to get a lot of attention as it moves its way through the process.

Yep. But we'll keep an eye on it. Yeah, it seems like a good thing. Joe Kerrigan, thanks for joining us. My pleasure, Dave. Thank you. is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default deny approach can keep your company safe and compliant. And that's the Cyber Wire.

For links to all of today's stories, check out our daily briefing at thecyberwire.com. And for professionals and cybersecurity leaders who want to stay abreast of this rapidly evolving field, sign up for Cyber Wire Pro. It'll save you time and keep you informed. Listen for us on your Alexa smart speaker too. The CyberWire podcast is proudly produced in Maryland out of the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technologies. Our amazing CyberWire team is Elliot Peltzman, Puru Prakash, Stefan Vaziri, Kelsey Vaughn, Tim Nodar, Joe Kerrigan, Carol Terrio, Ben Yellen, Nick Volecki, Gina Johnson, Bennett Moe, Chris Russell, John Petrick, Jennifer Iben, Rick Howard, Peter Kilpie, and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Thank you. AI and data products platform comes in. With Domo, you can channel AI and data

into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.