CyberWire Daily - Operations TradeSecret and Cloudhopper attributed to APT10. Third party risks. Lazarus Group update. US investigation of Russian influence operations and US surveillance allegations proceeds.

Episode Date: April 6, 2017

In today's podcast we hear about Operation TradeSecret, which joins Operation Cloudhopper: both appear to be facets of a Chinese cyberespionage campaign. 20,000 loan applications are exposed by a third-party IT vendor. North Korea's Lazarus Group still has banks in its crosshairs. A study shows that mobile users are in a complicated relationship with their apps. US Congressional hearings into Russian influence operations and allegations of US surveillance continue. IBM’s Wendi Whitmore joins us from the 2017 Women in Cybersecurity Conference. Palo Alto Networks’ Rick Howard describes the cloud paradigm shift. And tomorrow is OpIsrael; Israeli enterprises say they're prepared. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindelet.com slash N2K, code N2K. Operation Trade Secret joins Operation Cloudhopper. Both appear to be facets of a Chinese cyber espionage campaign. 20,000 loan applications are exposed by a third-party IT vendor. North Korea's Lazarus Group still has banks in its crosshairs.

A study shows that mobile users are in a complicated relationship with their apps. U.S. congressional hearings into Russian influence operations and allegations of U.S. surveillance continue. And tomorrow is Op Israel. Israeli enterprises say they're prepared. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Thursday, April 6, 2017. Fidelis Security released a report this morning on Operation Trade Secret, which they attribute to APT10, the same Chinese outfit that BAE and PwC said earlier this week was behind Operation Cloudhopper. Whereas BAE and PwC devoted their attention to Cloudhopper's effects on businesses and government organizations in the

UK, Fidelis notes that Operation Trade Secret has been prospecting U.S. targets since February of this year, at least. As its name might suggest, Trade Secret is a cyber espionage effort directed principally at gathering information on developing U.S. trade policy. It seems clearly related to Cloudhopper and to another APT10 espionage campaign currently in progress against Japanese targets. campaign currently in progress against Japanese targets. While the companies who've been investigating APT10's activity stop short of calling it a Chinese government actor, it's just being called Chinese or sometimes Chinese language, its operations seem consistent with long-standing patterns of Chinese government cyber activity. The concentration on acquiring trade secrets and gaining economic advantage is consistent with that government's long-standing goals. Cloudhopper has elicited warnings to businesses from authorities in both the UK and Sweden, although the threat is not confined to those countries.

Both Cloudhopper and TradeSecret approach and compromise their targets via those targets' cloud and managed service providers, so they represent an exploitation of third-party attack vectors. A different incident also enabled through a compromised third-party affected Scottrade. Some 20,000 loan applications were exposed by an IT service provider in the course of uploading them to the cloud. The exposure is said to have been due to a misconfigured SQL server. them to the cloud. The exposure is said to have been due to a misconfigured SQL server. Kaspersky and Symantec researchers continue to draw attention to North Korea's Lazarus group. Kaspersky finds increased sophistication on the bank robbers' part. Symantec sees signs of activity in some 30 countries. Lazarus has been traced fairly clearly to North Korea, and it's said to

have steadily learned and increased in sophistication not only since the Sony hack of 2014, but also since 2016's Bangladesh Swift incident. The DPRK's interest in bank robbery is unlikely to abate, given that country's economic straits and the sanctions imposed for its nuclear and ballistic missile ambitions. Risk IQ this morning released a report on mobile users' problematic relationship with their apps.

The average user regularly interacts with about 30 apps and tends to do so carelessly. With so many apps in use, unselective downloading, clicking suspect ads, password reuse, and other problems seem practically inevitable. Risk IQ recommends shifting defenses from consumers to businesses, which may be better equipped to control and mitigate mobile threats. Continuing our discussions throughout this week with people we met at the 2017 Women in Cybersecurity Conference, today we hear from Wendy Whitmore. She's a global partner and lead with IBM's X-Force Incident Response and Intelligence Services.

She started her career in the U.S. Air Force, followed by leadership positions at Mandiant and CrowdStrike. I asked her how she learned to be a leader. So my dad was a coach. My parents were both teachers. My dad was a coach growing up. I spent a lot of time with him on ball fields all over the country, basically, and kind of being surrounded by a bunch of like older brothers if you will right in addition to my actual older brother but all of his teammates and all the guys my dad coached and so I got a chance to really kind of see how he coached a team but how he actually looks to kind of mentor and coach his team members along the way and I think

that had a huge influence on me I then ended up playing a lot of sports myself and so that certainly helped in terms of being in those like tense situations where you know the game is ready to to be won and you need to be the person who makes a clutch play or gets a hit or whatever it may be. I learned a lot through that and then certainly in the military just getting you know tons of training when it came to leadership training, but also just understanding along the way, kind of the importance of mentoring your team members and learning as much from them as you kind of have to offer yourself. What do you think is going on in the environment, in the ecosystem that we're not able to do a better job attracting and keeping women in the field?

Yeah, that's a great question. I mean, so it's some numbers that I think we keep hearing throughout the week at this conference. You know, there's an average of think around 48 to 50% of women in the workforce in general, and between eight to 11% in cybersecurity. So we're starting with a much kind of smaller grouping, right, a smaller percentage. And then if you look at the retention issue or progressing through the ranks that becomes more challenging over time because just of general attrition rates for one and then you know I look back like so in terms of the solutions again I think it relates to increasing the awareness at the lowest levels at elementary school junior high really kind of letting kids of all ages and all genders know that these solutions exist or these opportunities exist. But then you look at like when I was in college, you know, maybe my,

my major might've been say a hundred people and maybe there were 10 women in the field. And then as you know, we got to upper graduate level courses that got smaller and smaller and that's normal, unfortunately, but I think we need to increase the pipeline kind of on the front end one and then two just I think in addition to gender it's just diversity as a whole I think we there are studies now that show how much more effective teams are when they have people of different genders different ethnicities different what have you just different opinions because you come up with more creative solutions, you have different approaches to the problems and new solutions. And so as a whole, those are things that are shown to be really effective and that we need to continue promoting. You know,

from my experience, I haven't seen, you mentioned getting, it might be getting worse. From my perspective, I definitely have not seen that. I've seen the opposite in that when I first started, there were very few women in both when I was in the Air Force in this field, when I started early days of consulting. And now you're really seeing a lot more women in the field, a lot more women moving into leadership roles. So from my kind of perspective, which may be more limited and whatnot, but it's definitely, I think, been a positive growth. That's Wendy Whitmore from IBM. You'll hear more from her in our upcoming Cyber Wire Women in Cybersecurity Conference Special Edition.

U.S. congressional hearings into surveillance and Russian influence operations continue. It's been reported that Representative Devin Nunes, chair of the House Intelligence Committee, will recuse himself from the investigation, at least for now, over access the White House gave him to evidence suggesting the previous administration conducted surveillance of the Trump presidential campaign and subsequent transition. Congress departs for a two-week recess tomorrow. And speaking of tomorrow, April 7th is scheduled for Op Israel, the cyber-action anonymous mounts every spring to bring down Israeli networks in furtherance of the Palestinian cause and other causes.

Op Israel has essentially always fizzled, never succeeding in rising above the nuisance level. But this, of course, is in a large measure because Israeli enterprises prepare for it. A number of Israeli security experts go so far as to advise treating it as a training and cyber spruce-up opportunity. Calling all sellers. Salesforce is hiring account executives

to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Head to salesforce.com slash careers to learn more. In our DRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting,

and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. The film, which was nominated Amy Adams, stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. January 24, only on Disney+. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely.

Visit ThreatLocker.com today to see how a default deny approach can keep your company safe and compliant. and compliant. Joining me once again is Rick Howard. He's the Chief Security Officer at Palo Alto Networks, and he also heads up Unit 42, which is their threat intel group. Rick, we wanted to touch base today about some trends that you saw coming from the RSA conference, specifically related to cloud security. Yeah, thanks.

This got me thinking. I was listening to an interview with the CEO of Securiosis. I think that's how you say it. His name is Rich Mogul. And he was talking about these tidal forces moving everything to the cloud, or as my CTO near Zuck likes to say, to somebody else's computer. And I agree with Rich when he points out that the cost of owning and operating your own mail servers, your file servers, your enterprise resource

planning servers, your customer relationship management systems, ticketing systems and HR systems, just to name a few, is cost prohibitive since none of those skills are what you should be doing for your primary business anyway. So Rich says that, you know, SaaS, one of the components of cloud computing, wipes out major chunks of capital investments. I would add IIS and PAS does that too. But, you know, I take his point. The world of cybersecurity is changing right before our eyes. This is the reason that this thing caught my eye. We are literally right in the middle of a paradigm shift as everybody races to the cloud and embraces DevOps as a deployment philosophy. What I like about this is we don't normally notice

these things. We don't usually see these things coming and mostly don't realize the new paradigm is in place until well after it is established. I see that as a unique opportunity for all organizations in general but also for security teams specifically. Because if we act now, okay, we can change our organization's process before our competitors do, okay, and before the cyber adversaries learn how to leverage these new attack services, and before we're ready to defend them. So here's the advice. If you are not seriously considering how to move your already established perimeter defense security best practices to SAS and IAS and PAS environments, it's not too late.

You still have time, but you need to start soon. I think the good news is that the general principles of securing these new environments are no different than what you're used to doing in the old perimeter defense days. It's how we do it's a bit different, but what we are trying to do the same thing. Network defenders are trying to put multiple prevention and detection controls down the adversary's cyber kill chain in order to beat the adversary's offensive playbook, right? So as you plan your move to these environments, seek security vendors products who can accomplish the same things you used to use them in the perimeter security vendors products who can accomplish the same things you used to use them in the perimeter defense piece so you can do it in the cloud.

You need complete visibility. You need the ability to reduce the attack surface. You need a way to prevent all known threats and the ability to discover new threats and convert them into protections down the kill chain in the most efficient manner. Now, what's scaring everybody away from this is they think they have to invent new things. And what I'm here to tell you, these technologies exist already. So my advice to all my fellow network defenders is to be bold here. Get in front

of this paradigm shift in the process. Maybe greatly improve your organization's security posture as you go down the line. All right. Good advice. Be bold. Be bold. That's right. Go bold or go home. All right. Rick Howard, always a pleasure. Talk to you soon. Thank you, sir. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses

is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home,

your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows,

helping you gain insights, receive alerts, and act with ease through guided apps tailored to your