CyberWire Daily - Vault 7 doesn't show much evidence of false flag operations. The most interesting question the WikiLeaks dump raises is, where did the material come from? RAND studies the zero-day market. The Near Abroad wishes for more US soft power.

Episode Date: March 9, 2017

In today's podcast, we follow the Vault 7 story and the false flags that really aren't there. A call for more stress-testing of software. RAND reports on the market for zero-days. The Near Abroad warns the US that it would like to see more American soft power deployed in their part of the world. Jonathan Katz from the University of Maryland praises Google's Project Wycheproof. VMWare's Tom Corn provides his take on the promise of secure cloud environments.  Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash N2K, code N2K. Vault 7 and the false flags that really aren't there, a call for more stress testing of software, RAND reports on the market for zero days, the Nira Broad warns the U.S. that it would like to see more American soft power deployed A call for more stress testing of software, RAND reports on the market for zero days,

the Nira Broad warns the U.S. that it would like to see more American soft power deployed in their part of the world. I'm Dave Bittner in Baltimore with your CyberWire summary for Thursday, March 9, 2017. As people have continued to sift through WikiLeaks' Vault 7, the consensus is emerging that there's not much that's surprising there, beyond the obvious fact that so much stuff leaked at all. Assuming, we hasten to add, the material is as genuine as it appears to be. One early reaction clearly doesn't have traction. Informed observers seem to be in agreement that the signs people thought they saw in Vault 7 of CIA false flag operations aren't in fact there. What is found in Vault 7 are copious signs of code reuse, and that's not surprising at all. It's economical and makes sense.

Any intelligence service in just about any country would repurpose code it pulled from the wild and use it, providing that code could be adapted to meet mission needs. So, seeing evidence that Cozy Bear and Fancy Bear were really CIA provocations designed to cast blame on the Russians for election hacking is regarded by most observers as being on the fanciful side. The smart money remains on Cozy and F, being the FSB and the GRU. There also seems to be little in the dump to suggest that the CIA is engaging in widespread domestic surveillance. In this respect, as in others, Vault 7 resembles the leaks concerning the Equation Group that appeared last summer.

Emerging security industry consensus holds the interesting question about the Vault 7 dumps to be just how the material leaked, and that, of course, will take some investigation. The leaks do include some commentary on the relative difficulty of bypassing various security products. Some of those products fare better than others, if the leaks are to be believed. Krebs on Security thinks one lesson industries should draw from Vault 7 is that money spent on marketing might be better applied toward stress testing products. Another lesson may be this. If a sophisticated intelligence service with the resources of a developed nation-state is interested in your networks, consumer antivirus products, no matter

how good they may be at frustrating crooks and busybodies, are unlikely to keep that nation-state's cyber operators out. The Vault 7 leaks have drawn attention to how governments handle zero-days, vulnerabilities which are not publicly disclosed and for which no fixes have been made available. Coincidentally, the RAND Corporation has just released an interesting study on the zero-day market. Their study looked at this market from the point of view mostly of a participant in that market, but the study has some implications for defense and security.

The report reached five conclusions. First, declaring a vulnerability as active, that is publicly unknown, or dead, that is publicly known, may be misleading and too simplistic. Some vulnerabilities, particularly those in legacy products that have reached the end of their life, may be, as Rand puts it, immortal. Second, exploits have an average life expectancy of 6.9 years after the initial discovery, but roughly 25% of exploits will not survive for more than a year and a half, and another 25% will survive for more than nine and a half years.

This means, among other things, that software rot, what happens when code isn't maintained and regularly updated, can bring dormant vulnerabilities to the surface. Third, no characteristics of a vulnerability indicated a long or short life. However, future analyses may want to examine Linux versus other platform types, the similarity of open and closed source code, and various groupings of exploit class type. Essentially, don't get cocky, kid.

There's no one kind of vulnerability that can be safely assigned a low priority for checking and fixing. Fourth, for a given stockpile of zero-day vulnerabilities, after a year, approximately 5.7% have been discovered and disclosed by others. And fifth, once an exploitable vulnerability has been found, time to develop a fully functioning exploit is relatively fast, with a median time of 22 days. Since exploits are often reverse-engineered from patches, one moral is, don't delay patching.

Much of the commentary on the report takes it as a given that purchasing and stockpiling zero days is a bad practice. That may be true, but the issue is not entirely clear. In the event-covered section of the CyberWire's website, you can read an account of a lively debate about the vulnerabilities-equities process we heard at SciCon last October. There was intelligent advocacy on both sides of the question. Many organizations have come to rely on virtualization and the cloud as part of their IT infrastructure plans, taking advantage of

the flexibility and scalability the cloud environment can provide. But what about security? Tom Korn is Senior Vice President of Security Products for VMware. What we're ultimately trying to protect is not servers or networks. What we're trying to protect are applications and data. The challenge is where we're trying to protect it. We're trying to protect it from servers and networks. And those are orthogonal planes. When applications were monolithic stacks, the whole application ran on one physical machine. The server was a pretty good proxy for the application. That's not what

an application looks like today. An application is a distributed system of components networked together, right? It's web servers talking to app servers, database servers, it's all kinds of containers connected together. And the best metaphor I think I've come up with to describe the problem is, if you think of a data center as a city, where the buildings are servers and the roads are network. When we had monolithic stack applications a long time ago, it was kind of like having a skyscraper with only one application in it, and the whole application was in there. And when we had that from a security perspective, we had a front door to place guards at. And the two things that really helped us was the fact that those guards could be rest assured that there was no other way to touch any part of that application without going through that door. And secondly, they only had to worry about one application, about one tenant in that

building. So the policies about who should get in or what looks weird about someone who was trying to get in were relatively straightforward. Fast forward to what applications look like today, it's parts of buildings in many different parts of the city. That is an application. And in any building, there are many applications. And in fact, they move in and out all the time. All right, well, that's a very complex model, move in and out all the time. All right, well, that's a very complex model, because trying to determine who gets in or out, or trying to determine what looks weird, or being comfortable that from where I sit, I can see anyone who's touching that is next to impossible. And as a result, most of the security industry is still focused on trying to prevent infiltration into

the data center, or into a given machine. And we are very blind if someone does land somewhere. Can they move around the data center? That is an architectural gap. The real huge promise, I think, of virtualization in cloud is helping solve that problem, helping connect the dots, enabling security to be applied and aligned to what we're really protecting, the applications and data. And that's where we're seeing a lot of the advances in security technology, not just from us, but from other companies, is really focusing on taking

advantage of the cloud to do just that. That's Tom Korn from VMware. Several Eastern European and Southwest Asian countries, the Baltic states, Poland, Ukraine, and Georgia, either members of or desiring closer association with NATO, warned the U.S. about rising Russian assertiveness in Europe, an urge that the U.S. begin to apply some soft power to counter it. By soft power was meant principally larger, more effective, more closely targeted information operations. A number of leak sources, as many have noted, seem over the past couple of years to have been at least objectively aligned, as an old Bolshevik might have put it, with Russian interests.

And there has been no shortage of other more obvious Russian information and influence campaigns, as the Baltic states are particularly keen to point out. European governments are growing particularly sensitive to the prospect of political influence operations. France, for example, has decided to eliminate overseas electronic voting in its own upcoming elections. elections. with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security,

but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber.

That's vanta.com slash cyber for $1,000 off. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film

from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default

deny approach can keep your company safe and compliant. Joining me once again is Jonathan Katz. He's a professor of computer science at the University of Maryland, and he's also director of the Maryland Cybersecurity Center. Jonathan saw this story come by on Google's security blog about Project Witchproof. Give us some of the Maryland Cybersecurity Center. Jonathan saw this story come by on Google's security blog about Project Witchproof. Give us some of the details. What do they have going on here? So this is basically something that Google is putting out that will allow implementers who are developing their own crypto code to kind of check for the most common vulnerabilities

that come up in this code. And this is really important, actually, because what we've seen time and time again is that the underlying crypto, the algorithms themselves and the protocols based on them, tend, for the most part, to be pretty secure and pretty resilient to attack. But nevertheless, a lot of crypto code is vulnerable just because implementers make these common mistakes that occur over and over again. So, like I said, the goal of this project is just to help people find those mistakes in their code and to prevent them from occurring. So what's the practical use of this? You feed your code into this project and it analyzes it?

Yeah, exactly. So this would basically do exactly that. You feed your source code in, and what it has basically is some tests for some 10 or 20 or so of the most common mistakes that people tend to make in their code, and it will let you know if it spots those errors. Now, of course, it's not foolproof, right? There can always be new mistakes that people make, but at least this will catch maybe the most, you know, 95% of the most common errors that people tend to do. And when you're talking about errors, what are we talking about? Are these typos or more, or more, you know, different kinds of implementation errors?

So these are not quite typos. These are more subtle and more things that have to do with the way the underlying cryptographic algorithms are used. Just as one kind of high-level example, there are a lot of cryptographic algorithms that assume that you're using a nonce, which is supposed to be a number that's chosen at random and never repeats. And what this can do is it can check for biases in those nonces that mean that they're distributed non-uniformly or even the potential that nonces might repeat over time, which would destroy the underlying security of the algorithm. This is on Google's security blog. It's Project Wish Proof. Jonathan Katz, thanks for joining us. Katz, thanks for joining us.

And now, a message from Black Cloak. Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire.

We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.