CyberWire Daily - The CyberWire Daily Podcast 2.8.16

Episode Date: February 8, 2016

In today's podcast, we discuss reports that hacktivists have released personal information gleaned from Justice Department and Department of Homeland Security databases. Anonymous engages a grab-bag of targets. Cyber stocks experience a sell-off. Governments continue their attempts to balance privacy and security. We also hear from the University of Maryland's Jonathan Katz, who explains key escrow. http://thecyberwire.com Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K.

A hacktivist doxes the FBI and DHS. Her Majesty's Revenue and Customs is compromised for fraudulent tax returns. Banking Trojans are looking more like APTs. Anonymous undertakes some operations over the weekend. Cyber stocks sell off. And a question, should China rein in North Korean hackers? This is John Petrick, the CyberWire's editor, in Baltimore, filling in for Dave Bittner with your CyberWire Daily podcast for Monday, February 8, 2016. A hacktivist who, quote, wishes to remain anonymous, unquote, as Motherboard rather primly puts it, releases what he alleges are personal data on some 20,000 FBI employees and about 8,000 U.S. Department of Homeland Security personnel. It's so far unconfirmed whether the contents of the release, which have the look of information culled from staff directories, are genuine. The activist told Motherboard that he made his way into networks at the Justice Department by posing on the telephone to a help desk as a befuddled new employee and gained his credentials that way.

There's no further identification so far of the gentleman who wishes to remain anonymous, but the data dump was accompanied by a pro-Palestinian message. Anonymous was active on several fronts over the weekend, none of them however appear to be on the anti-ISIS front. The activist collective, under its Op Africa banner, is reported to have doxxed government sites in Ethiopia, Sudan, South Sudan, South Africa, Tanzania, Rwanda, Uganda, and Zimbabwe. Their proclaimed goal is exposure of corruption. quote, we're at war, unquote, struck at the very dark heart of evil itself, which is to say they struck at the government of York County, Pennsylvania, posting a manifesto advocating returning sovereignty to the people.

This would be accomplished, they say, by suppressing war, religions, what Anonplus calls politicals, and financial power. The county's websites were restored to normal in somewhat less than two hours. A few lessons about hacktivism of this anarcho-syndicalist stripe are, perhaps, on display here. Much of this activity is probably best viewed as an expressive rather than persuasive gesture, an attempt at purity as opposed to an attempt at conversion or inspiration. Contrast this, for example, with the hacktivism ISIS has succeeded in marshalling, where inspiration and recruitment seem to count for everything. And, of course, hacktivists are drawn inevitably toward relatively small, presumably lightly defended targets. That York, Pennsylvania would have at best a tangential relationship to oppressive

global systems is beside the point. York was hacked probably because York could be hacked, and also probably without undue difficulty or onerous expenditure of resources. One hacktivist tactic, which ESET is calling Hacksposure, will probably see more widespread use this year. The hacking team in Ashley Madison breaches would be examples of Hacksposure. The goal is typically reputational damage, and while extortion or harm to a commercial competitor would certainly be possible, in these two cases at least there appears to be no such economic motive.

Widespread availability of indifferently protected information and the tools to extract and disseminate that information are thought likely to drive an increase in hack exposure. Turning to cybercrime news proper, online hoods appear to have made successful incursions into Her Majesty's revenue and customs. The Sunday Times reports that hackers have made off with UK tax filers' self-assessment records and then used the information to file fraudulent claims for tax repayment. Researchers continue to work on last week's Tesla Crypt ransomware infestation, the one that's been plaguing WordPress sites. All would be well advised to be on their guard and above all to back up their data. In another minor mystery, researchers also wonder who's been subverting Dridex malware

download sites to serve up antivirus software. The presumed white hat hacker's identity is unknown, but people have begun calling him or her Batman. Note that Dridex's criminal proprietors have for some time gone by the direct, if unimaginative, name of Evil Corp. Kaspersky researchers discern a trend in banking malware. It's begun to adopt some of the APT techniques, hitherto principally associated with cyber espionage. The Metal, GC-Man, and Carbonac criminal groups all show signs of using tools from the Spymaster skits, GC-Man remaining apparently the most old school of the three. The goal remains the same, obviously, theft, but the means of gaining access show a growing sophistication.

In documents filed last week with the U.S. Securities and Exchange Commission, Arrow Electronics reported the loss of some $13 million in fraudulent transfers to various Asian bank accounts. An investigation is in progress, and observers speculate that the incident involved a privileged account attack. ERP scan describes a cross-site scripting vulnerability in SAP Afaria. The security firm notes that SAP has published a fix for the problem and it encourages users to apply it. In the marketplace, a broad sell-off that began late last week continues to affect cybersecurity stocks. Observers cite weaknesses in some allied IT sectors as a partial cause, along with concerns about possible overvaluation and, of course, the unsettling story of Norse corporations' apparent implosion. The pullback doesn't appear to have affected plans for IPOs, including Nobifor's aspirations

in this respect, nor has it dampened speculation about the mergers and acquisitions that many think FireEye and Symantec are likely to know. Starring Kaley Cuoco and Chris Messina. The only investigating I'm doing these days is who shit their pants. Killer messaged you yesterday? This is so dangerous. I got to get out of this. Based on a true story. New season premieres Monday at 9 Eastern and Pacific. Only on W.

Stream on Stack TV. Do you know the status of your compliance controls right now? Like, right now. We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. Look at this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's

the gist. Vanta brings automation to evidence collection across 30 frameworks like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker,

a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. In the crypto war seesaw battle between privacy and security, one approach the crops are frequently in debates is key escrow. We sat down last week with the University of Maryland's Jonathan Katz,

who takes us through the concept. Once again, Jonathan Katz joins me. He's a professor of computer science at the University of Maryland and director of the Maryland Cybersecurity Center. They're one of our academic and research partners. Jonathan, there's been a lot of talk about key escrow. Can you walk us through exactly what it is? There are many different ways that key escrow could be implemented, but let me just walk through one way you could do it. Most of cryptography is based on secret keys that are held by the individual who's going to be decrypting the data. So we can imagine that somebody has a key on their phone, for example, that's used to decrypt any messages being sent

to them. Now, what you could do is set things up in such a way that the maker of the phone, say Apple, for example, would have the ability to derive the key on any phone from some master key that would be held by Apple, possibly, or other companies or possibly government agencies as well. And then in case police or other government agencies wanted to get access to the encrypted communication to that phone, they would be able to go to Apple, get a copy of the master key, derive the user's key that they're using on their phone, and that way gain access to their communication.

So it sounds pretty straightforward, but there are various concerns about this, right? That's right. It is very straightforward. The problem is that you need to be very careful about protecting that master key. And anybody who gets access to that master key would then have the ability to break in to the secure communication going to anybody's phone. Now, that master key would have to be protected not only from people outside the organization,

say, outside of the company, Apple itself, but it would also have to be protected from people within the organization, people working for Apple who have access to that master key. And really, it's just a mess. If that key ever becomes exposed in any way, you have no way of ensuring the security of all the phones who are using anything derived from that key. And is it correct that it's a situation where

if this key escrow scenario comes to pass, that people who wanted to hide things, people who wanted to encrypt things, would probably just turn to other ways to do it. That's exactly right. Nothing prevents anybody from downloading other software that's available that would enable them to encrypt using a key that has no connection to the master key being stored by Apple.

And so ultimately anybody who's even mildly technologically savvy would be able to circumvent the whole kiosk to begin with. All right, Jonathan Katz, thanks for joining us. It certainly meant the whole kiosk to begin with. All right, Jonathan Katz, thanks for joining us. A passcode opinion piece argues that China bears a disproportionate responsibility for reining in the nuisance of North Korean cyber operations. The DPRK being almost as isolated in cyberspace as it is in physical space, Kim's hackers typically have recourse to resources physically located on China's side of the border.

And finally, the science is now settled. Criminal nitwits outnumber criminal masterminds by several orders of magnitude. One fugitive from British justice was nabbed after two years on the lam by police who tracked him to a Merseyside address on the basis of the Catch Me If You Can gas grenade he posted to Facebook. And in the U.S., the show-me state is not to be outdone by their transatlantic cousins. Missouri authorities can show you a pretty cage full of burglars who incautiously try to frighten their intended victims from their homes,

not thinking that they might also frighten them into calling police. In this case, the mugshots tell the whole story. And now, a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home,

your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 365 with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers.

I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy.

Learn more at ai.domo.com. That's ai.domo.com.