CyberWire Daily - RSA Updates. Microsoft calls for Geneva Convention for cyber. Phishing.

Episode Date: February 14, 2017

Researchers look into a wave of attacks on financial institutions. Microsoft calls for Geneva Convention for cyberspace. We take a look at phishing. The RSA conference is underway, and we’ve got news from the innovation sandbox, and venture capitalists. Trevor Hawthorn from Wombat Security shares insights from their State of the Phish report. Emily Wilson from Terbium Labs outlines nationalism on the dark web. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. Researchers look into a wave of attacks on financial institutions. Microsoft calls for a Geneva Convention for cyberspace. We take a look at phishing, and the RSA conference is underway. And we've got news from the Innovation Sandbox and venture capitalists.

I'm Dave Bittner, not in Baltimore as usual, but in San Francisco, the city by the other bay, with your CyberWire summary for Tuesday, February 14, 2017. We're of course in California covering RSA 2017. We'll offer some observations from the conference a bit later, but for now, here's a quick review of the day's news. Researchers at Symantec and BAE have been looking into a wave of attacks on financial institutions. These attacks appear linked, they believe, to the Lazarus Group. The connection, the researchers perceive, is with the malware discovered in several of the watering hole attacks. The malware in question is Retankba,

and is thought to bear significant similarities to attack tools used against banks by the Lazarus Group, a criminal organization believed by many to be linked to North Korea, and the hack Sony Pictures sustained in 2014. The wave of bank hacking came to light when Polish banks realized they were being compromised through a malware infection on Poland's financial sector regulatory body, the Polish Financial Supervision Authority. Its compromised website was serving as a watering hole. Polish media had initially suspected the campaign to originate with Russian security services. This is now being called into doubt. Attribution is notoriously

difficult, the more so insofar as various intelligence and security services make use of criminal actors and even legitimate contractors to lend a degree of plausible deniability to their cyber-offensive operations. Cyber Reason has been reporting their findings in this regard at RSA, noting an increased tendency of governments – Russia, the United States, and the United Arab Emirates are all mentioned – to use third parties to install and manage cyber-espionage tools. Russia's use of criminal gangs was particularly evident in the hacks of the Ukrainian power grid. But the lesson here is that the old staple of covert and clandestine tradecraft, plausible deniability, has reappeared in cyberspace. It's just in a new key. Along those lines,

Microsoft has called for a Geneva Convention in cyberspace. Such an agreement would go beyond the protection of non-combatants the original Geneva Convention sought to ensure, and would extend to the full range of issues as they might be negotiated for cyber conflict. Microsoft is interested in promoting general international norms of cyber conflict that would have a significant analogy to the international norms that currently govern armed conflict. Trevor Hawthorne is CTO at Wombat Security Technologies, and they recently released their 2017 State of the Fish report. We checked in with him for some highlights. There were some trends that continued on that we've seen the last several years. There's also

some good news. So we are actually starting to see some improvements when it comes to phishing. And so while it's still an ongoing threat, just like a lot of things, just because you may tamp down one particular attack vector doesn't mean that you can completely take the pressure off and shift on to something else. It now is something that you have to kind of maintain. If you've reviewed the report, you know that we sent a lot of phishing emails. And so we have a pretty good idea of what makes people tick. Are people clicking more? Are they clicking less? And one of the trends that the report shows is we saw a 64% increase in organizations measuring end-user risk from 2015 to 2016. And so what that basically says to us is that organizations are starting to actually do something. We're also starting to see more anecdotal evidence.

If you go on to Twitter and you just search for the words phishing training, you're starting to see just a lot more chatter about people talking about their organizations conducting simulated phishing. And this could be from everybody, you know, from the administrators running programs all the way to end users saying, oh, I got caught. You know, they talk about the training. I've even seen a couple of my favorite parody accounts talk about phishing training. So we kind of feel like, okay, you know, I think we're starting to hit this sort of critical mass here. What about, you know about technology versus training?

How are we doing in terms of these phishing emails never actually getting to the users? Sure. I've been doing information security primarily on the technical side of the house for a little bit over 20 years now. And every single year that I've gone out to every conference and every talk that I've ever seen, there's always really cool technology. There's a lot of really cool things happening in like endpoint protection now. At the end of the day, if email filtering and spam filtering and that type of thing was an effective control here, we wouldn't be in business and there wouldn't be this now fairly large industry. There wouldn't be a Gartner Magic Quadrant for user awareness if technology was 100% of the problem,

which isn't to say that technology is useless. Obviously, I'm a technologist. I think everybody should have the most advanced email filtering that their budgets will allow. But at the end of the day, the bad guys know that and they know how to get around it. And if I send a properly formatted, non-spammy email that uses either malware that's never been seen before or novel attack, or I use an attack that doesn't involve any malware, you know, there's nothing to sandbox. There's no URL. It could be a, you could be more of a confidence-style attack. You have to rely on the end user to kind of close the gap between technology and where things fail. That's Trevor Hawthorne from Wombat. Their state-of-the-fish report can be found on their website. In industry news, we're hearing that Microsoft has delayed issuing the patches expected for today.

They should be out soon, but just not quite yet. Adobe has patched 13 Flash vulnerabilities. There's also some M&A activity. Convergence Technology has acquired Deep Run. WiseKey has agreed to buy QuoVedas. And Haloc will acquire Eclipse Security. In the startup world, Insights has secured a $13 million Series B funding round. RSA 2017 opened with its annual hunt for the most innovative startups in the sector.

A talented field yielded some creative solutions to vexing security challenges. RSA's 2017 Innovation Sandbox held its competition and selected a winner yesterday afternoon, UnifyID. The ten finalists all offered interesting and compelling presentations, especially in our opinion, the runner-up Envail, but UnifyID bore the prize away. A panel of venture capitalists offered a state-of-the-security sector report. They think that while investors have become more selective, particularly in later stages of funding, the cyber sector remains attractive and there are many deals to be made. One of the VCs, Bob Ackerman from Allegis Capital, characterized the state of the sector like this,

quote, markets initially run on hype and then move to a cycle in which they digest information, end quote. He sees the cyber sector as being currently on the cusp of that shift. If you're an entrepreneur pitching investors, here are some pieces of advice. Avoid buzzwords, know what differentiates you, and bring people who've been at the cutting edge of either the security industry or the intelligence community. Thank you. and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now?

Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001.

They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself.

Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Cyber threats are evolving every second and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker, a cybersecurity solution trusted by businesses worldwide.

ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. about before you and I, the dark web kind of mirrors the real world in many ways. And there's a lot of expressions of nationalism online. Yeah, it's true. You know, we've talked before about the different communities, you have your fraud community, you have your, you know, your drug community, or what have you. But we also see kind of these lines being drawn, these national lines,

right. And this manifests in a few different ways, you know, whether it's a, you know, a Russian speaking forum or a Japanese drug site, you know, but one of the most interesting ways is when you see, you know, clearly expressed do's and don'ts that are set up to prevent certain people from being targeted. So, you know, there's a Russian carding site I'm thinking of in particular where, you know, you go to sign up or you go to log in and it says, you know, don't buy from Russians, don't sell to Russians, don't card Russians, everyone else is fair game. And this isn't just Russia, it's Israel too, right? It's another example. But there are these lines where, you know, again, it's honor amongst thieves, right? We have a code, we don't attack our own people. Everyone else have fun, but we don't attack our own people.

And what happens if someone violates those rules? They just get booted out? It's like any social norm situation, I guess, right? Yeah, I think that's exactly it, right? And I think that these communities are self-reinforcing, right? I think that if you are the kind of person who, you know, wants to be able to card everyone, including your own countrymen, you're probably not going to associate yourself with that group. But what we see are these group manifestos kind of being built where you're building your own subset of a subset of an online community. So are these communities – is it an amplification of the kinds of things you see in the real world? Is it a distillation of the kinds of things you see in the real world? Or does it pretty much parallel the way we all think about our nations and our groups and even our groups of friends, our cities, our neighborhoods, our high schools? I think that in the same way that we see in the real world different manifestations of patriotism and when that crosses into nationalism, I think that you see that right.

On one end, you have someone who doesn't identify themselves in any particular way online. And then maybe you have your country's flag as your profile picture, or maybe you have a username that's in a different language or, you know, has some patriotic undertones. And I think that's the spectrum, right, of then you move over to, you know, someone who's going to say, I'm not going to to card my own people or I'm not going to buy and sell to them. And then I think you have, you know, maybe on the farthest end of the spectrum, people who want to actively work to, you know, advance the goals of their country and want to work in that space. And so I think these are the same behaviors that we see offline. It's just that they're manifesting themselves. The same spectrum is manifesting itself in the online community as well. All right. Emily Wilson, thanks for joining us. And now a message from Black Cloak.

Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io.

And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.