CyberWire Daily - Patches, passwords, wipers, and pseudoransomware. New fronts in hybrid war? KONNI, OnionDog, and Israbye.

Episode Date: August 9, 2017

In today's podcast, we hear that Patch Tuesday saw Windows and Adobe fixes. Venezuela's civil conflict gets a hacktivist dimension. Anti-Israeli wiper malware is circulating in the wild, unpolished by nasty. Kaspersky Lab expects to see more pseudoransomware, especially when disruption and not profit is the goal. The KONNI RAT, of unknown origin sniffs at sites associated with North Korea. The HBO hack remains under investigation. Putin turns his attentions to Georgia. Johannes Ulrich from the SANS Technology Institute and the ISC Stormcast podcast on weak two-factor authentications systems. Tim Erlin from Tripwire on their Infosecurity Europe 2017 survey. And familiar password advice gets jettisoned.   Supported by E8 Security, Johns Hopkins University, and Domain Tools. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K. Patch Tuesday sees Windows and Adobe fixes. Venezuela's civil conflict gets a hacktivist dimension. Anti-Israeli wiper malware is circulating in the wild. Kaspersky Lab expects to see more pseudo-ransomware, especially when disruption is the goal.

The Connie Rat of unknown origin sniffs at sites associated with North Korea. The HBO hack remains under investigation. Putin turns his attentions to Georgia. And familiar password advice gets jettisoned. I'm Dave Bittner in Baltimore with your CyberWire summary for Wednesday, August 9, 2017. Yesterday was Patch Tuesday, and both Microsoft and Adobe issued a large number of critical patches to their products. The Adobe fixes addressed problems with Acrobat, Reader, and Flash Player. Most observers recommend that users of Acrobat and Reader devote their attention to updating the software for those two products.

They continue to recommend that you disable and move away from Flash Player, scheduled for final retirement by Adobe in 2020. It's a perennial target of attackers, and as useful as Flash was back in the day, it's reached the end of its useful life. Microsoft's patches, 48 of them in total, affect Windows, Internet Explorer, Edge, the subsystem for Linux, Kernel, SharePoint, SQL Server, and Hyper-V. The vulnerabilities being fixed don't appear to be undergoing exploitation in the wild, but some of the patches are sufficiently important that they

should be applied as soon as possible. Experts concur that CVE-2017-8620, a Windows Search Remote Code Execution vulnerability, is the big one. They think applying it should be a priority. Venezuela's ongoing political and economic crisis has prompted not only fighting, but some credible allegations of government vote fraud in the elections that put in place an extra-parliamentary group charged with rectifying the Constitution. It's also prompted some rebel hacking. According to reports, a hacktivist group associated with the rebels has conducted cyberattacks against sites in that country.

Most, but not all, of the affected services belong to the Venezuelan state. The group claiming responsibility calls itself the Binary Guardians. Researchers at security firm Intezer describe an anti-Israeli, pro-Palestinian wiper malware, IsraBuy, that's currently circulating in the wild. It's not crypto ransomware, since it offers no prospect of file recovery until such time as Israel's disappearance, in their words. Effectively, of course, no prospect of recovery at all. It also doesn't encrypt files. Rather, it replaces their content with anti-Israel messages. The wiper began circulating around the time Israeli authorities imposed

certain restrictions on visits to the Temple Mount and the Al-Aqsa Mosque situated there. Metal detector installation was found particularly objectionable by Muslim worshippers. The restrictions were quickly eased, but the malware continues to circulate. It's not exactly ransomware, despite some gestures in that direction, nor is it pseudo-ransomware like NotPetya, but Israbi does bear a family resemblance to that style of attack. Kaspersky Labs' quarterly report concludes that we should get used to pseudo-ransomware. It's a proven attack method now, given the success of NotPetya,

and it's going to continue to be attractive to both governments and other threat actors of unclear motivation and dubious provenance. Where disruption is the goal, as opposed to theft, pseudo-ransomware has shown that it can answer the bell. TechCrunch calls the technique a wolf in wolf's clothing, and that seems to be a fair assessment. The remote access tool Kani has been linked to the Dark Hotel threat group by researchers at security firm Silance, which has observed Kani activity against North Korean targets since that country's latest rounds of missile tests.

Neither Kani nor Dark Hotel have been attributed yet. Such attribution is of course famously difficult. One attack, Onion Dog, thought by many to have been a targeted attack against South Korean targets, turns out, according to Trend Micro, to have been a Republic of Korea cyber drill. When an organization suffers a cybersecurity breach, whose job is on the line? When an organization suffers a cybersecurity breach, whose job is on the line? That's one of the questions the folks at Tripwire wanted to answer with their InfoSecurity Europe 2017 survey. Tim Erlin is VP of Product Management and Strategy at Tripwire.

40% pointed out that they believe the CEOs were the first on the firing line if a company was compromised, followed by the Chief Information Security Officer, the CISO, at 21%. And then interestingly, other came in at 15%, and the CIO came in at 14%, just slightly below other in that case. And do you think this represents sort of shifting attitudes towards these kinds of things? It certainly does. I've been in this industry for close to 20 years at this point. And I would certainly say if you go back in time, there would be very few people 10 years ago, 15 years ago, who would have said that the CEO is responsible or likely to have a material consequence to their job if a breach were to have occurred. So it definitely represents a shift in attitude. And how are we seeing this play out in the real world? Are we seeing consequences for board level folks? Well, we certainly have. We've seen a consequence at Target specifically. We also saw Marissa Mayer, the CEO of Yahoo, who forfeited her cash bonus

following a breach. That breach also affected the acquisition of Yahoo as well. So it's not just CEO level effects that breaches have. It also goes beyond that to other material impacts. Were there any surprises that came back from the results of the survey? You know, I think that that CEO piece was that result was interesting. I'm not sure I would call it surprising, but interesting. There was another question in the survey around tools and technology. And we came out with 75% of security professionals don't believe that buying all the available security tools would fully protect their organizations. That was an interesting result as well, indicating that solving the problems with cybersecurity aren't just about implementing technology. It's really about the people and process involved as well.

So what are the takeaways for you with this information gathered from the survey? What kinds of advice do you have for folks? With this survey in particular and the result around accountability and responsibility, I think the key there as a takeaway, if you're in information security as a practitioner, the job that you have to do on a day-to-day basis should have, needs to have, and often does have board-level visibility. So if you're in information security and you believe that you're insulated from impacting the business or that your actions don't have that kind of an impact for your organization, your attitude needs to catch up with reality today. That's Tim Erlin from Tripwire. You can find more results from their InfoSecurity Europe 2017

survey on their website. Investigation into the HBO hack and extortion continues, with both Mandiant and the FBI involved. Many in the security industry see the media as a relatively attractive target for hackers, and the entertainment industry has seen enough in the HBO affair to be spooked. Russia has been playing effectively at hybrid war for some time, most intensely in Ukraine. There are, however, other targets in the near abroad, that is, in now-independent former republics of the Soviet Union. Tuesday was the ninth anniversary of the Russian war that separated the Georgia provinces of Abkhazia and South Ossetia and effectively joined them to Russia.

Russian President Putin marked the occasion by visiting Abkhazia. His visit also comes a week after U.S. Secretary of State Tillerson visited Georgia during a period that's seen renewed talk of Georgia adherence to NATO. This may signal a shift in hybrid war to the Caucasus. Let Georgia look to its networks. Finally, remember all that advice about making strong passwords and changing them frequently? It started back in 2003 with NIST Special Publication 800-63, specifically with Appendix A, which advised such password-building practices as irregular capitalization,

including at least one numeral, and throwing in some special characters, perhaps in lieu of a letter. And it also advised changing passwords frequently. Well, it turns out it was all a big mistake and an unfortunate misunderstanding. The author of Appendix A, retired NIST expert Bill Burr, and we hasten to say that he is one of the good guys, now regrets his advice, most of which NIST jettisoned back in June. The advice drove people to lazy practices and tended to lead them to devise passwords that are hard for people to remember

but easy for machines to crack. So the advice now, the current state of thinking, is to base your password on some idiosyncratic short phrases you'll find it easier to lodge in your human mind, but that would be Fuddle Skynet. Correct horse battery staple. That one's taken, but something like that. like that. winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more.

Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist, Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI.

Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking

and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home. Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak.

Learn more at blackcloak.io. And I'm pleased to be joined once again by Johannes Ulrich. He's the Dean of Research at the SANS Technology Institute, and he also hosts the ISC Stormcast podcast. You know, we talk about two-factor authentication and how, in general, it is a good idea. You have some thoughts on how to make sure you're picking the right one. Yes, there are many, many different options when it comes to two-factor authentication, and not all of these options are really equally strong. For example, NIST recently published some widely discussed guidance that SMS messages should not really be used for two-factor authentication.

The problem here is that it's not all that difficult for a criminal to convince a phone company to redirect phone calls for a specific number to a new phone. So that can be used to gain access to these SMS tokens. The strongest token that you can probably have are these hardware tokens that you actually keep in your keychain. Problem here again is that this just doesn't scale. How many of these tokens are you going to carry around with you and they're also somewhat expensive so what you really have to do is based on the risk that you think this particular application is exposed to you have to pick the right two-factor authentication mechanism sms that may be fine for a lower value account. You have soft tokens like you

typically implement via Google's authenticator application. They're not bad, but again, they can be copied without the user really realizing that they're being copied. In particular, if the user does store the secret for these tokens in an insecure manner. And then, yes, you do have the hard tokens that are the most secure, but also most expensive and most cumbersome technology. So anywhere on this scale, you have to pick the right one. And also, don't forget how you're going to deal with a lost second factor. That's often a weakness, just like

password recovery is often a weakness for traditional password authentication. What about biometric factors like Touch ID on iOS? Touch ID on iOS is a great way for authentication, but its application is a little bit limited in the sense that it only works with native applications. I haven't really seen a good biometric authentication for web applications, for example, and they probably at this point pose the largest risk. Yes, there are ways to bypass some of this biometrics with like these replicated fingerprints and the like. But overall, they do provide a meaningful second factor. Just there are no APIs to use for web-based applications.

Overall, would you say that having any form of two-factor is better than nothing at all? Yes, definitely. Two-factor is better than just a username and a password. Just remind your users that it's still two factors. So having a second factor doesn't mean that you necessarily should get sloppy on your passwords. All right, Johannes Ulrich, thanks for joining us. Cyber threats are evolving every second, and staying ahead is more than just a challenge.

It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant.

And that's the Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.