CyberWire Daily - The CyberWire 1.13.16

Episode Date: January 13, 2016

Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. Thank you. And the crackers with attitude, they're back.

I'm Dave Bittner in Baltimore with your Cyber Wire summary for Wednesday, January 13, 2016. Declarations of war aside, Anonymous continues to find easier targets in the civilized world than it has in ISIS, the hacktivist collective protests wailing with an attack on Icelandic government sites. The U.S. government, in the form of ICS-CERT, says it's providing support to Ukraine's investigation of the recent attack on that country's power grid. Former senior U.S. intelligence officials reiterate warnings that the U.S. power grid is comparably vulnerable. ICS expert and Applied Control Solutions managing partner Joe Weiss told the Cyber Wire about one regulatory gap he thinks should be addressed.

This affected low-voltage transmission and electric distribution. Low-voltage transmission and electric distribution are excluded from the NERC critical infrastructure protection standards. You can hear more of our conversation with Joe Weiss on this Friday's Cyber Wire Week in Review. Researchers at Digital Bond Labs describe what observers characterize as a relatively easy new way of remotely burning out variable speed industrial motors. Such a capability has obvious implications for attacks on infrastructure. ISIS is reported to have added some new secure

messaging apps. The Amok agency and Al-Rai apps joined Telegram in the ISIS toolkit. Some New Year predictions warn of growing ISIS cyber attack capability, but U.S. President Obama's State of the Union address counterwarned against aiding ISIS by giving them too much credit. The president is also said to be meditating an executive order that would mandate certain measures federal agencies would take in response to large-scale cyber incidents, catastrophic incidents in some characterizations. Some observers continue to worry that U.S. defensive and offensive cyber policy lacks what they see as structure or focus. As the crypto wars between security officials and privacy advocates continue to gutter,

some recent developments may perhaps inform the debate. Researchers at Penn State claim to have made significant progress on an algorithm that could prove useful in identifying terrorist actors, and police forces turn to threat scoring as an aid to investigation. Such measures carry their own, if different, controversies, but they do suggest that the issues at stake aren't confined to encryption policy. And former USDCI and NSA Director Hayden's characterization of NSA's capabilities is also interesting in this respect. He told the S4X16 conference that the agency, quote,

steals other people's stuff in the cyber domain, end quote. It's the duty of every country's intelligence services, he explained, then added, quote, as a former director of NSA, I like to think we're number one, end quote. He also distinguished legitimate intelligence operations from, for example, economic espionage. Symantec described an upgrade to information-stealing malware Android Bankosi, which can now bypass the protection of one-time passwords

generated through two-factor authentication systems. It does so by establishing a bogus identity within the infected device. Zscaler takes a look at a bad neighborhood. Sundown, Neutrino, and Angler exploit kits are gurgling around the address space registered under Alexander Muljin-Servanojic. Some disclosures provoke controversy. A researcher claims to find a backdoor in older versions of Fortinet's 40OS. Fortinet denies it's a backdoor and calls it a management authentication issue they've already patched. and calls it a management authentication issue they've already patched. N2 security firms, BugSec and Synet, say they've found a design feature of next-generation firewalls that's inherently vulnerable to exploitation.

At issue is the next-gen firewall's inspection of apps as opposed to ports. To do this, they allow a TCP handshake regardless of packet destination, and this is what BugSec and Synet find objectionable. Next-generation firewall companies vigorously deny that the feature amounts to a flaw. The vendors counter that, as Palo Alto puts it, firewall policy is never violated, and that the rules in place preclude the handshake from creating problems. Brazil's cyber black market is booming, according to a widely circulated trend micro study.

That black market, as usual, mirrors features of legitimate markets, including training programs in the criminal labor market's illegitimate, invisible hand. Last year's hacking team leaks are reported to have helped put Kaspersky on the track of a Microsoft Silverlight Zero Day. This week's Patch Tuesday marked the end of support for older versions of Windows and Internet Explorer. It also featured a number of critical patches to both Microsoft and Adobe products. In industry news, CEOs and CISOs are finding their distinctive perspectives on cybersecurity reciprocally illuminating. Canadian M&A has an interesting three-part series on cyber considerations during all phases of mergers and acquisitions.

Distil Networks acquires Scrape Sentry, whose capabilities are seen as both competing and complementary. Accounting firm Horn LLP buys Halbert and establishes a cyber practice. PSS acquires Tetra Concepts, and Checkpoint is in initial talks over a possible acquisition of CyberArk. In Crime and Punishment, the dread pirate Ross Ulbricht is appealing his Silk Road sentence, this time on grounds related to the judicially proven corruption of some federal officers involved in his case. And finally, remember the crackas with attitude who counted coup against some of U.S. Director of Central Intelligence Brennan's private accounts?

against some of U.S. Director of Central Intelligence Brennan's private accounts? They're back, or at least as Motherboard sensibly observes, someone pretending to be the cracker is back, and they're tugging on Superman's cape. This time they've taken on U.S. Director of National Intelligence Clapper, redirecting calls to a pro-Palestinian number and defaming Clapper in social media with rude schoolyard demotics. The office of the Director of National Intelligence is aware of the incident and has initiated appropriate investigations.

One would think the crackers are on increasingly thin ice. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks,

like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Thank you. the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joining me is John Petrick, editor of the Cyber Wire. John, a term that comes up regularly in the Cyber Wire is SCADA. What is SCADA? SCADA, that's S-C-A-D-A, stands for Supervisory

Control and Data Acquisition. And it refers to automated industrial control systems, and especially those kinds of automated industrial control systems that are used to control large scale processes or processes that are distributed across a wide geographic area. So SCADA is the kind of thing that we've seen with the Ukraine hack recently? Would SCADA processes or processes that are distributed across a wide geographic area. So SCADA is the kind of thing that we've seen with the Ukraine hack recently? Would SCADA be applied to that? Yeah, power grids are an example of an industrial system that's geographically widely distributed. SCADA is really a subset of industrial control systems, or ICS. And an industrial control system is one that controls industrial processes, obviously, as the name implies.

So motion control systems for industrial robots and process control systems that regulate variables like pressure, flow, temperature, things like that, those are all examples of industrial control systems. And SCADA systems, which typically control process over those large, widely distributed areas. That's a kind of ICS. All right, John Petrick, thanks very much. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives.

Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Thank you. data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com.

That's ai.domo.com.