CyberWire Daily - The CyberWire 12.30.15

Episode Date: December 30, 2015

Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K.

A look at ISIS online community, possibilities and limitations of social media as sources of intelligence. Microsoft addresses flash player issues in IE and Edge, national cyber laws and policies considered, and industry analysts forecast a very big 2016 for cybersecurity. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Wednesday, December 30, 2015. Baltimore with your Cyber Wire summary for Wednesday, December 30, 2015. Officials in the U.S. and U.K. continue to warn of ISIS intentions to attack critical infrastructure,

even as they deprecate the caliphate's technical capabilities to do so. ISIS remains far more active in social media than elsewhere in the cyber domain. War on the Rocks has an account of ISIS Twitter usage. It's the familiar story of a factitious community's appeal to the disaffected. Recruits find fellowship and transcendence as they're drawn into ISIS chatter. Prosecutions of ISIS adherents in London and Texas highlight both the possibilities and limitations of monitoring social media for clues to terrorist activity. Such monitoring is proving useful in investigation and prosecution, but when authorities attempt prediction, the signal-to-noise ratio is frustratingly low. New accounts of U.S. intelligence collection against foreign targets appear. The most recent cases under discussion involve monitoring Israeli official communications during nuclear

negotiations with Iran. The operations are said to have had collateral collection of U.S. parties to electronic conversations, notably some members of Congress as their side effect. The Wall Street Journal provides historical context, describing Cold War rules that continue to govern aspects of foreign intelligence collection. Windows 10's recovery feature sends user encryption keys back to Microsoft. Several observers offer suggestions for working around what's generally unwelcome functionality. Devotees of Apple mobile devices continue to enjoy the safety of the company's App Store, but some users are bypassing those protections, even with non-jailbroken iOS devices,

downloading unvetted apps from rogue marketplaces using what Proofpoint calls dark-side loaders. Microsoft has issued an emergency advisory for Edge and Internet Explorer that addresses vulnerabilities recently discovered in Adobe Flash Player. In industry news, FBR Capital forecasts very high demand for cybersecurity products and services in 2016. It also foresees a wave of mergers and acquisitions in the sector. U.S. cyber legislation remains controversial as its implications are digested. India deliberates information sharing and internet sovereignty. Businesses worldwide consider the effects of China's new security laws, but when it comes to baked-in surveillance,

no government on earth can hold a candle to North Korea's Red Star operating system. Do you know the status of your compliance controls right now? Like, right now? Like right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist.

Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. Thank you. give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default deny approach can keep your company

safe and compliant. Joining me now is Andre Protas. He's the technical director of the security research team at CyberPoint International. Andre, I want to talk about DDoS attacks. So let's just start with the basics. What does DDoS stand for, and how do I know if a DDoS attack is happening? Distributed denial of service. Generally, a DDoS attack is when multiple nodes will attack one single node and try to exhaust that node's resources. So that exhaustion can be either a memory or resource exhaustion.

So doing a lot of requests for the same web page, that might take a long time to load. Or it might just be simple bandwidth exhaustion. So doing a lot of requests for the same web page that might take a long time to load, or it might just be simple bandwidth exhaustion. And the idea of a DDoS is that it's coming from so many different IP addresses in different locations that you can't just simply block one IP address and then not have the attack continue. Because it comes from a lot of different locations, it's kind of like a death by a thousand cuts. Are there ways to mitigate that sort of attack? The most common DDoS that is really out there is one that's for web servers. So somebody wants to take down yahoo.com or one of the major websites. What they'll do is a DDoS and they'll have a bunch of different nodes, whether they're people firing up software or they're a botnet or one of these other large node systems.

They're going to start exhausting the resources of that site by making very large requests to that web server. So what a lot of people will do is they'll use content distribution networks, CDNs for short. There's a couple example companies like Cloudflare that would do that. And what that does is it no longer puts your website is not being served by one single node now. It's almost distributed in itself. So when people go to Yahoo.com, they're not actually going to a Yahoo server. They're going to an Akamai server in the U.K. if they're nearby, or they're going to a Cloudflare server in San

Francisco if that's where they're at. So it pushes the content out on the web so that it kind of fights distribution with distribution. And so how do DDoS attacks end? Is it a matter of the attacker giving up or moving on to a different target? Yeah, generally. So they just get bored and walk away. Sometimes they might get bored and walk away. Sometimes they might get caught. So whenever they're actively attacking, there's always that threat that they might get caught themselves. They're the ones that are issuing commands.

So they might close the attack so that they kind of close their exposure. So help me understand, how does a DDoS attacker organize themselves to be able to come at you from so many different directions? Yeah, generally for those single attacker with multiple nodes is a botnet. So they'll harvest a whole network of bots either by going after vulnerable websites or doing drive-by exploitation and basic malware installation. and basic malware installation. So they can get up to, you know, 10, 20, 30,000 nodes pretty easily and then create those different networks and then, you know, task them all. You know, on Thursday next week, I want you all to go attack a certain website.

Fondre Protos, Technical Director of the Security Research Team at CyberPoint International. Thanks once again for joining us. And now a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home. Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io.

And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive

alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.