CyberWire Daily - Taking a bite out of Apple.

Starting point is 00:00:00 You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Starting point is 00:00:31 Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Starting point is 00:00:44 Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Starting point is 00:01:22 Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. A security researcher has been charged in an alleged multi-million dollar theft scheme targeting Apple. A House committee hearing explores OT security. Fortinet withdraws accidental CVEs. 2023 saw record highs in ransomware payments.

Starting point is 00:02:16 A YouTuber finds a cheap and easy bypass for BitLocker encryption. Political pressure proves challenging for the JCDC. New Hampshire tracks down those fake Biden robocalls. Thank you. And Singh, Vice President of Marketing Network Security at Palo Alto Networks, shares some practical examples of healthcare organizations transitioning to the cloud. And giving that toothbrush story the brush off. It's Wednesday, February 7th, 2024. I'm Dave Bittner, and this is your CyberWire Intel Briefing. Thank you for joining us here today. We are glad to have you with us.

Starting point is 00:03:27 404 Media reports that security researcher Noah Roskin-Frozzi and an alleged co-conspirator Keith Letary have been charged in a sophisticated hacking scheme that targeted Apple, resulting in the fraudulent acquisition of $2.5 million worth of gift cards and electronics. The charges, detailed in court records that were recently made public, accused the duo of exploiting a system connected to Apple's back-end to place over two dozen fraudulent orders, attempting to obtain more than $3 million in products and services from the tech giant. Despite Roskenfrazi's arrest and the serious allegations against him,

Starting point is 00:04:10 Apple had acknowledged his contributions to identifying security vulnerabilities in a security update released on January 22, nearly two weeks after his arrest. This recognition highlights the complex relationship between Roskin-Frazzi's legitimate security research and the criminal activities he is now accused of. The indictment describes a meticulously planned operation that began in December of 2018 and continued until at least March 2019. The defendants allegedly gained initial access through a password reset tool, compromising an employee account of a company which provided customer experience solutions for Apple. This breach allowed them to further access employee credentials and subsequently

Starting point is 00:04:57 Apple's systems. With this unauthorized access, Ruskin, Frazee, and Leteri are said to have manipulated Apple's Toolbox program, which is used to manage product orders. They allegedly altered the monetary values of orders to zero, added expensive products to existing orders without cost, and extended service contracts fraudulently. The indictment also details the use of malicious scripts to maintain access to compromised systems and the deployment of accounts with shipping services under false names to receive the fraudulently obtained goods. Many of the acquired items, including electronic gift cards and high-value electronics like laptops,

Starting point is 00:05:39 were reportedly resold to third parties, converting the stolen digital assets into cash. The court documents suggest a deep familiarity with Apple's internal systems and processes, leveraging this knowledge to conduct the fraud at a grand scale. The case not only underscores the challenges in securing corporate back-end systems, but also the thin line between legitimate security research and criminal activity. The U.S. House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection held a hearing yesterday to discuss the threats to operational technology in critical infrastructure sectors and evaluate the Cybersecurity and Infrastructure Security Agency's role in enhancing OT security.

Starting point is 00:06:26 Chairman Andrew Garbarino emphasized the national imperative of securing OT systems, vital for functions like water and electricity delivery. He highlighted the need for Congress to strengthen CISA support for infrastructure security, especially in light of recent cyber activities against OT devices by Iranian-affiliated actors. Experts testified on the unique challenges of OT security compared to IT security, noting that OT requires specific cybersecurity controls. Drago CEO Robert M. Lee offered this testimony. There are fundamental differences between OT and IT networks.

Starting point is 00:07:06 The biggest difference is the mission or business purpose of these systems. Generally, IT supports how you manage a business, where OT is the reason the business exists. They're the specialized computers and networks that interact with the physical world around us, including things like controlled pumps, chemical levels, and so forth at water treatment facilities. OT security is also unique from IT security. Most of our standards and regulations and best practices simply apply IT security controls to OT without considering whether or not they should be applied. This results in wasted resources and operational disruptions. OT security instead should focus

Starting point is 00:07:40 on unique OT security controls and adopt from IT security only when it makes sense, on unique OT security controls and adopt from IT security only when it makes sense, such as those in the SANS Institute's ICS-5 critical controls. The water sector was identified as particularly vulnerable with a need for dedicated funding to upgrade technology and enhance cybersecurity. Testimonies emphasize the importance of collaboration, the implementation of best practices, and the establishment of cybersecurity standards for critical infrastructure to mitigate risks and protect public health and safety. For more of Robert M. Lee's testimony and additional insights on OT security, be sure to check out the most recent Control Loop podcast right here on the N2K CyberWire network.

Starting point is 00:08:23 The National Vulnerability Database erroneously published advisories for two critical command injection vulnerabilities in Fortinet's Fortisim, which were actually duplicates of a previously disclosed vulnerability. Fortinet confirmed that these were mistakenly generated due to an API issue and clarified there are no new vulnerabilities in Fortisim for 2024. The company is working to correct and withdraw the incorrect CVE entries.

Starting point is 00:08:53 The original vulnerability, disclosed last year, allowed unauthenticated remote attackers to execute commands via crafted API requests but has since been patched. Fortinet advises those who have addressed the original vulnerability need not take further action, but should review the latest advisory for confirmation. A new study from Chainalysis reveals that in 2023,

Starting point is 00:09:18 victims paid over $1 billion to ransomware attackers, marking a record high in payments and highlighting the lucrative nature of cyber extortion. Despite international efforts to combat these crimes, including sanctions and law enforcement actions, ransomware groups, many of which are Russian speaking, continue to operate with relative impunity. The high payments, often exceeding a million dollars, reflect both the sophistication of some actors and the sheer volume of attempts by others. Efforts to counteract ransomware have seen some progress, yet the problem escalates, with costly consequences for victims like MGM

Starting point is 00:09:58 Resorts, which faced around $100 million in losses due to a refusal to pay a ransom. The YouTuber Stack Smashing exposed a significant security vulnerability in Windows BitLocker encryption, demonstrating how to bypass the popular encryption tool in under a minute using a sub-$10 Raspberry Pi Pico. This exploit targeted a flaw in systems using an external trusted platform module for storing encrypted keys. By intercepting unencrypted communications between the CPU and the TPM during boot up, the YouTuber successfully extracted the master key from a laptop's LPC bus, which is accessible through an unpopulated connector on the motherboard.

Starting point is 00:10:45 The ATAK, however, is specific to configurations with external TPMs. Devices with CPUs that have an integrated TPM, such as modern Intel and AMD processors, are not affected by this vulnerability due to internal TPM communications being encrypted within the CPU itself. Politico reports that several of the nation's leading cybersecurity experts are stepping back from the Joint Cyber Defense Collaborative, a prominent government initiative led by the Cybersecurity and Infrastructure Security Agency. The JCDC was established in 2021 with the goal of enhancing the United States' defense against cybercriminals and state-sponsored hackers, catalyzed by a series of significant security breaches.

Starting point is 00:11:33 It functions as a threat-sharing platform, enabling swift communication of potential cybersecurity threats between the government and key economic defenders, between the government and key economic defenders, including tech corporations like Microsoft, Amazon, and Google, as well as infrastructure operators and foreign governments. Despite the critical importance of this collaboration, Politico reports that dissatisfaction with JCDC's management and apprehension due to political pressures have led to a notable decrease in participation from external cybersecurity professionals. Contributors, including those from billion-dollar security firms and non-profit

Starting point is 00:12:12 defense groups, have either ceased their involvement or significantly reduced their contributions. This diminished engagement is partly attributed to the broader political climate, particularly backlash from conservatives against CISA over its actions to counter disinformation about the 2020 election, despite JCDC's non-involvement in content moderation. The controversy surrounding CISA has inadvertently implicated JCDC partners, creating a chilling effect within the cybersecurity community. Fears of becoming targets in a perceived political witch hunt have contributed to

Starting point is 00:12:50 the reluctance among cybersecurity experts to engage with government-led initiatives. This development is concerning for U.S. digital defense efforts, especially given recent warnings from Washington's top cybersecurity officials about aggressive Chinese hacking activities aimed at American infrastructure. The collaboration between the private sector and the government, as facilitated by the JCDC, is deemed essential for addressing these sorts of threats. CISA has acknowledged the importance of maintaining strong external partnerships for effective threat detection and is actively seeking ways to ensure that contributors can participate without compromising their safety. The JCDC was conceived as a means to leverage the private sector's technical prowess

Starting point is 00:13:37 alongside the government's legal and intelligence capabilities to strengthen the nation's cybersecurity posture. The current challenges highlight the delicate balance between political influences and the imperative need for robust apolitical cybersecurity defenses. Our This Is Why We Can't Have Nice Things desk will be following this story. New Hampshire's Attorney General John Formella announced a criminal investigation into a Texas telecom company, LifeCore, suspected of distributing AI-generated robocalls impersonating President Joe Biden, advising Democrats not to vote in the presidential primary. This effort, traced with the help of the Federal Communications Commission and a private industry group, traced with the help of the Federal Communications Commission and a private industry group,

Starting point is 00:14:31 aimed to mislead voters ahead of the January primary, potentially affecting 5,000 to 25,000 people. The calls, which could violate election laws and federal telecom statutes, were part of a campaign to undermine the electoral process, with the state seeking to deter similar future attempts. LifeCore, linked to Walter Monk and Lingo Telecom, were identified in connection with the robocalls, which have drawn bipartisan law enforcement attention to safeguard election integrity. European cybersecurity agencies issued a joint statement addressing vulnerabilities in Avanti Connect Secure and Avanti PolicySecure gateway products following a CISA emergency directive. These commercial VPN solutions have been found susceptible to attacks, allowing unauthorized command execution. Four vulnerabilities have been disclosed with broad exploitation observed. The agencies recommend continuous monitoring,

Starting point is 00:15:26 the use of Avanti's external integrity checker tool, and adherence to guidance from C-Cert's network members and CERT-EU. The upcoming EU Cyber Resilience Act will mandate security by design principles for these kinds of products. The U.S. Department of Health and Human Services Office for Civil Rights fined Montefiore Medical Center in New York City $4.75 million to settle potential HIPAA violations linked to a 2013 incident where an employee sold patient data to an identity theft ring. This fine accompanies a corrective action plan

Starting point is 00:16:05 addressing data security failures that allowed the theft and sale of thousands of patients' protected health information. The investigation revealed Montefiore's failure to adequately assess risks, monitor health information systems, and implement necessary policies for examining system activity.

Starting point is 00:16:23 The settlement includes a comprehensive review and update of Montefiore's privacy and security procedures, enhanced training for staff, and improved monitoring and technical safeguards. Montefiore has taken steps to bolster system security and reinforce patient information protection since the incident. Coming up after the break, Navneet Singh, Vice President of Marketing Network Security at Palo Alto Networks, shares some practical examples of healthcare organizations transitioning to the cloud. Stay with us. Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks.

Starting point is 00:17:30 But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber.

Starting point is 00:18:08 That's vanta.com slash cyber for $1,000 off. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more In today's sponsored Industry Voices segment, my conversation with Navneet Singh,

Starting point is 00:19:15 Vice President of Marketing Network Security at Palo Alto Networks. He shares some practical examples of healthcare organizations transitioning to the cloud. Yeah, so if you look at the past, when applications and data were in the data center, the security teams could figuratively put their arms around the applications and data could really control who goes in and out of the data center in terms of malware, traffic, users. As applications moved to the cloud, the business users started using the cloud for agility, which was great for innovation, but not so great in terms of security

Starting point is 00:19:51 because they felt that the cloud providers themselves are spending billions of dollars on security, so cloud must be inherently secure. So they didn't really consult the security teams and started building applications in the cloud, and that resulted in some problems. So that's why the cloud providers have a shared responsibility model for security. Take an example, the healthcare industry, the largest dental insurer in the nation for Medicaid and children's health insurance programs. It suffered a breach that affected the records of more than 8 million patients. So that's really severe and it affects us.

Starting point is 00:20:39 It affects people who are near and dear to us who go to a hospital, right? So especially in this breach, the sad part was even the children's data got exposed, which is more valuable in the black market, underground market, because it doesn't have much history, much use. So it can be misused more easily. So I shudder to think about it because another effect of health care breaches is hospitals can get shut down. And when I think about it from a personal point of view, I have a middle school going daughter and she had to be admitted to the hospital a couple of years ago. and why she was in pain, or that we had to find a different healthcare facility. Or once she was checked in, because of a ransomware attack, the doctors and nurses would not be able to find her allergies. So all of that could be really devastating. And this is even more devastating for rural areas where there's just one hospital to go to.

Starting point is 00:21:42 So you can see the whole system, just as you talked about the big picture, we are seeing that the cloud is being used very effectively in terms of innovation, but not as effectively in terms of just securing the applications and data. What role do you suppose that the government has to play here?

Starting point is 00:22:04 Yeah, the Biden administration had released the national cybersecurity strategy that happened in 2023. And we recommended the adoption of a zero trust architecture, especially in critical industries. So I saw that that did spark a lot of interest from critical sector industries. They leaned in. They got information about cybersecurity. And we at Palo Alto Network saw an increase in executive briefings from these critical sector industries, including food processing, utilities, the energy sector. So in December, there was a press release from the U.S. Department of Health and Human Services. They released a concept paper that outlined the cybersecurity strategy for healthcare.

Starting point is 00:22:49 So the government is playing a role here. It is affecting change. And the great news is this new concept paper actually had four pillars for action. The first one was publishing voluntary performance goals. Second was really developing incentives for hospitals to improve cybersecurity. Third was greater enforcement and accountability. And the last, really improving coordination within the healthcare sector for sharing and implementing best practices. So I believe that as the government releases more of these strategies, it will have an effect on the healthcare sector in terms of improving cybersecurity.

Starting point is 00:23:32 Can we dig into some of the specifics here? I mean, when we're talking about the cloud, what sort of attacks seem to happen there? Ultimately, attackers don't really care where the data is hosted. Even if you Google an attack, you won't really easily find the information about whether that data was on-prem or in the cloud, or sometimes it's just distributed. Attackers just want to get access to the sensitive data. In some cases, they just want to cripple operations so that the organization pays up for ransomware. In other cases, they ask for money and they extort the victims and say, if you don't pay up, we will release this data publicly on the internet.

Starting point is 00:24:12 So this has been really persistent, especially in the healthcare sector. In fact, healthcare cyber attacks have affected more than 100 million people in 2023, which is one in three U.S. citizens. So, you know, there are many, many examples. We just talked about one example. Another is hackers broke into the network of New York Life Sciences Company to steal clinical test information of nearly two and a half million people in April. So these attacks are real, but there is hope.

Starting point is 00:24:43 We can change. We can make a change and we can keep our data and applications secure. You know, there's this notion, I think, that many people have, and I think this particularly came early on in the cloud migration, that when you move things to the cloud, that you're able to take advantage of the security team that that cloud provider has, and that their team is likely bigger than yours. And so lots of good things can come from that. It's my understanding that you and your colleagues make the point that that may not be good enough.

Starting point is 00:25:17 That's right. And I used to hear exactly what you said, Dave, in the beginning of the cloud adoption. Things are changing now. said, Dave, in the beginning of the cloud adoption, things are changing now. And people are realizing there's a reason why cloud providers have a shared responsibility model. Cloud providers really specialize in providing and securing the infrastructure that is the server. So they keep them physically secure. They make sure they are patched with latest patches. They don't specialize in securing applications and data. In many cases, cloud providers actually partner with vendors who specialize in cybersecurity.

Starting point is 00:25:51 One example is Google Cloud Firewall Plus, which is a partnership between Google and Palo Alto Networks, which stops advanced cyber attacks with IDS and IPS capabilities. stops advanced cyber attacks with IDS and IPS capabilities. So that's the reason why we believe the best scenario is for you to host your applications in the cloud to take advantage of agility, but use specialized cybersecurity vendors for securing them. Well, let's go through some of the take-homes for you here. Some words of wisdom for our listeners.

Starting point is 00:26:23 What are your suggestions here for folks to best protect themselves in the cloud? I would say get familiar with the shared responsibility model. Understand that you're responsible for securing your applications and data, even in the cloud. And then research the vendors who specialize in security. In order to shortlist vendors, you can use analyst reports like Gartner, or you can also ask your peers who've had good experience with implementing cybersecurity in the cloud. And once you shortlist the vendors, in order to really choose the vendor that you will go with, I suggest that you evaluate the vendors on two sets of criteria.

Starting point is 00:27:02 One would be security capabilities, and the other would be cloud ease of use. For security capabilities, really figure out vendors who are innovating, who can stay a step ahead of attackers. And to do that, definitely involve your security teams, even if they've been protecting your data centers because the types of attacks like ransomware

Starting point is 00:27:24 are the same whether the data is hosted on-prem or in the cloud. Second, for cloud ease of use, I would say get your cloud teams involved. The best cybersecurity is not helpful if it's not usable in the cloud, if it's not cloud native. So ask your cloud architects,

Starting point is 00:27:43 ask your cloud developers to evaluate which vendors' capabilities can be easily integrated into that application development and deployment lifecycle. So with those two criteria, once you've evaluated your cybersecurity vendors, you should have a winner. What's your outlook for this coming year?

Starting point is 00:28:01 As we continue through 2024, are you optimistic that we're headed in the right direction here, that people are going to be successful in getting a handle on this? Absolutely. I think as cloud adoption has matured, you can see, we just talked about the government issuing some strategy and concept papers. I absolutely see that sparking an interest in the healthcare providers to better coordinate amongst themselves, to ask the cybersecurity specialists for advice,

Starting point is 00:28:32 for knowing more about what is zero trust, how can they adopt it, what does the roadmap look like, what kind of teams do they need to invest in in terms of cybersecurity. Another great advantage that teams have today is they can use AI to understand more, to really bridge that gap of cybersecurity skills shortage that they have. So I am really optimistic about security overall, including in the cloud. That's Navneet Singh, Vice President of Marketing Network Security at Palo Alto Networks. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity.

Starting point is 00:29:26 That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. With TD Direct Investing, new and existing clients could get 1% cash back. Great! That's 1% closer to being part of the 1%...

Starting point is 00:30:10 Maybe, but definitely 100% closer to getting 1% cash back with TD Direct Investing. Conditions apply. Offer ends January 31, 2025. Visit td.com slash dioffer to learn more. And finally, we got an urgent memo from our corrections desk that yesterday's extremely fun story about a botnet made up of over 3 million IoT toothbrushes is almost certainly not true. Originating from comments made by a Fortinet engineer to a Swiss publication, the story's credibility has been questioned by industry veterans like Kevin Beaumont and Robert Graham.

Starting point is 00:30:58 Further investigation into the original Swiss article revealed no specifics about the toothbrushes, victim, perpetrator, or motive, suggesting the story may be an exaggerated cautionary tale about IoT device security. While smart toothbrushes typically use Bluetooth Low Energy and not all connect via Wi-Fi, the feasibility of such a large-scale hack

Starting point is 00:31:21 remains doubtful without concrete evidence. My personal claims of superhuman resistance to tooth decay are unaffected by these revelations and remain as true as ever. And that's the Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast. Write your comments on the box of an Apple Vision Pro and send it to me, Dave Bittner, chair of The Cyber Wire, Fulton, Maryland.

Starting point is 00:31:57 We're privileged that N2K and podcasts like The Cyber Wire are part of the daily intelligence routine of many of the most influential leaders and operators in the public and private sector, as well as the critical security teams supporting the Fortune 500 and many of the world's preeminent intelligence and law enforcement agencies. N2K Strategic Workforce Intelligence optimizes the value of your biggest investment, your people. We make you smarter about your team while making your team smarter. Learn more at n2k.com. This episode was produced by Liz Stokes.

Starting point is 00:32:31 Our mixer is Trey Hester with original music by Elliot Peltzman. Our executive producers are Jennifer Iben and Brandon Karp. Our executive editor is Peter Kilby, and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Your business needs AI solutions that are not only ambitious, Thank you. measurable impact. Secure AI agents connect, prepare, and automate your data workflows,

Starting point is 00:33:26 helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.

CyberWire Daily - Taking a bite out of Apple.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.