CyberWire Daily - The CyberWire 1.19.16

Episode Date: January 19, 2016

Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K.

Ukraine blames Russia as cyber attacks down systems at Kiev airport. U.S. authorities urge heightened vigilance around critical infrastructure. Patriotic cyber rioting flares in Southeast Asia. ISIS supporters conduct the first known cyber-attack against a Chinese target. Liability increasingly shapes corporate cybersecurity strategies, and the plaintiff's bar is shaping cyber-insurance coverage. The crackers with attitude poke at the White House science advisor, and if you've got a job in a power plant, here's a word to the wise, knock off the workplace selfies.

I'm Dave Bittner in Baltimore with your Cyber Wire summary for Tuesday, January 19, 2016. Ukraine suffers another wave of cyber attacks out of Russia. This past weekend's attacks took down systems at the Kiev airport. Like the December power grid incidents, the airport hack was associated with black energy malware. Meanwhile, the U.S. Department of Homeland Security encourages U.S. utilities to shore up their security. And in the wake of the hacks in Ukraine, and amid reports of upward trends and attacks against industrial control systems, the Christian Science Monitor's passcode publishes some advice anyone who works in critical infrastructure might take to heart. Quote, no SCADA selfies, end quote.

Too much information appears in the background, and why should you make the hacker's task easier? Especially if your workplace is the kind of space where people display credentials and other critical data. Experts advise against letting the trappings of physical security lull you into a false sense of cybersecurity. Tensions between Russia and its neighbors continue to be attended by patriotic hacktivism, much of it state-inspired, if not state-directed. Ukrainian authorities regard recent incidents in their country as directed by Russia. Hacktivists elsewhere and the near abroad have pushed back at Russia, most recently from Azerbaijan, where hackers recently defaced the website of Russia's embassy in Israel in solidarity with Turkey.

Turkey and Russia have been at loggerheads over intervention in Syria. ISIS sympathizers conduct what appears to be the group's first action against a Chinese target. The website of Tsinghua University was defaced with video and messages calling for jihad. The university confirms that the incident occurred, but has declined further comment. ISIS messaging showed signs of becoming shakier last week. Not only is rivalry with al-Qaeda for jihadi mindshare increasing, but also signs appear that sympathizers are losing patience with the mismatch between the caliphate's aspirational rule of justice increasing, but also signs appear that sympathizers are losing patience with the mismatch between

the caliphate's aspirational rule of justice and the realities on the ground and the territories it controls. From the police blotter, digital currency exchange Cripsy is looted of some 6 million U.S. dollars worth of Bitcoin. Hyatt releases results of its investigation into point-of-sale hacks, mostly in restaurants, that the chain experienced between August and December of last year. Payment card data, including cardholder name, card number, expiration date, and internal verification codes, are said to be at risk. Many of the affected locations are reported to be in the Middle East and Africa.

Security analysts in Australia note a surge in PayPal $0 invoice spam. Interesting, because it fails to trip any of the usual spam filters. More DDoS attacks appear, independently striking a large torrent service and a South Korean entertainment agency. The former attack's motivation and attribution remain unclear. The latter looks like another instance of patriotic hacktivism, motivated in this case by the Korean agency's desire to downplay their K-pop singer's waving of Taiwan's flag at an event. The agency wishes to avoid offending its large Chinese market. Neither incident so far appears to be serving as misdirection for larger campaigns.

Considerations of liability for cyber incidents continue to shape corporate security strategies. The precise nature of such liability remains in flux. The U.S. and the European Union continue to work toward a successor to the safe harbor regime, Thank you. The Securities and Exchange Commission plans to tighten up enforcement of cyber regulations relevant to investor protection. The SEC says it intends to focus on prevention. The Food and Drug Administration proposes standards for the cyber safety and security of medical devices. Nor has the plaintiff's bar been idle in contributing to the development of cyber standards of care. Several noteworthy cases currently being litigated will affect the cyber insurance market as firms sue insurance carriers for failure to pay for damages sustained in what the hacked companies consider covered incidents. And Affinity Gaming, a casino operator, is suing cybersecurity provider Trustwave, alleging failure to contain the breach it was hired to remediate.

In policy news, the French government decides against mandating crypto backdoors. The U.S. government continues to court Silicon Valley for a technical fix to the tension between security and privacy. Observers remain skeptical that such a fix exists. On Friday, the U.S. National Security Agency released its regular transparency report, as required by the U.S. Freedom Act. The full text of the report is available online at IC on the Record. And finally, Motherboard continues its ongoing contact with people claiming to be the crackers with attitude, pro-Palestinian and increasingly anti-Israeli hacktivists who've doxed both U.S. Director of Central Intelligence John Brennan and Director

of National Intelligence James Clapper. The Krakas claimed another virtual victim over the weekend, this one being White House Director of Science and Technology Policy John Holdren. The declared motive remains the same, and the self-proclaimed Krakas remain at large. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora

have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge.

It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joe, let's talk about DDoS attacks. Let's start off, just give us an idea, what is a DDoS attack? A DDoS attack is a distributed denial-of-service attack.

That's what DDoS stands for. It's where a group of computers that are on the Internet are infected with some kind of malware or some kind of bot, and there is a command-and-control server that tells those bots what to do. That command and control server can target a single entity on the Internet with a bunch of requests from the botnet, and that botnet can be huge, can be thousands of computers. So if you imagine one web server trying to respond to thousands of computers at a time, or even millions of computers at a time,

that web server can't handle the load. And thus, people who actually need to access the web server cannot get to the web server, so therefore they are denied the service. So DDoS stands for distributed denial of service, but my understanding is that originally it was not a distributed attack. Is that correct?

Early on, that's right. When bandwidth wasn't as big as it is now, I mean, bandwidth is cheap right now. I have 75 megabits at my house, but back when companies paid huge amounts of money for an ISDN line to run a web server on, it wouldn't take much to flood that. You didn't need to distribute the attack.

You could do it with one attacker. So why would someone launch a DDoS attack against someone? There's lots of reasons. First off, just the fact that you can do it, that leads a lot of people to be able to do it. Then there's always the political reason or the financial motivation. So I'm shutting someone down. Is there any danger of doing real damage or is this more of just a nuisance? It depends on the attack. Generally, you're not trying to gain access to their system, so you're not talking about real damage in terms of leaking data or doing damage to a company's reputation, aside from the fact that you're making their services unavailable to people who legitimately need

them. For example, if I have an e-commerce site and that starts getting hit with a denial of service attack, then my customers can't actually purchase things from me, and that becomes more than a nuisance. All right. Joe Kerrigan from Johns Hopkins University Information Security Institute. Thanks for joining us. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform

secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact.

Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.