CyberWire Daily - Vigilantes in the IoT. Bad actors find a friend in the ShadowBrokers. BankBot is back in the PlayStore. Pixel-tracking for target recon. A very big Oracle patch.

Episode Date: April 19, 2017

In today's podcast we hear about a new vigilante in the IoT—Hajime—and learn that the security industry doesn't think much of vigilantes. Observers pore over the most recent ShadowBrokers' files and don't like what they see, even though most of the more dangerous exploits have been patched. Still no word on how the ShadowBrokers got their wares, or where WikiLeaks got the contents of Vault 7. BankBot is back in the PlayStore with Trojanized video apps. Attackers are seen using pixel-tracking for target recon. AsTech’s Greg Reber outlines cyber M&A due diligence. Lancaster University’s Awais Rashid describes their effort to assemble a cyber security body of knowledge. And Oracle issues a very big patch. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K. There's a new vigilante in the IoT, and vigilantism still isn't a good idea. The industry pours over the most recent Shadow Brokers files and doesn't like what it sees. BankBot is back in the Play Store with Trojanized video apps. Attackers are seen using pixel tracking for target recon.

And Oracle issues a very big patch. I'm Dave Bittner in Baltimore with your CyberWire summary for Wednesday, April 19, 2017. Vigilantes we could all probably live without are riding through the Internet of Things. Two weeks ago, it was Brickerbot, which Radware caught in a honeypot and described as malware that sought out and permanently disabled, or bricked, IoT devices vulnerable to infection by Mirai because of their default passwords or otherwise slipshod installation. There's now apparently another vigilante working

the Internet of Things, the Hajime botnet. We noted yesterday that Hajime's purpose was unclear since the botnet hadn't been implicated in any denial of service attacks. It seems to be a Mirai competitor that would bullet sway into devices susceptible to Mirai infestation, but then do, well, really nothing in particular. But now, Hajime's purpose may be growing clearer. It's less destructive than Brickerbot, but it's arguably still a misguided freelance attempt to do something about Mirai. Hajime, which has infected at least 10,000 networked cameras, home routers, and other devices, uses a decentralized peer-to-peer network for its own command and control traffic, which makes it relatively resistant to takedown

by service providers. It's accompanied by a cryptographically signed statement, which reads, according to Ars Technica, as follows, quote, signed statement, which reads, according to Ars Technica, as follows, quote, Just a white hat securing some systems. Important messages will be signed like this. Hajime author.

Contact closed. Stay sharp. End quote. Hajime's name is said to mean beginning in Japanese, and researchers take this as an oblique reference to Mirai, whose name means future. Hajime was first noticed in the wild last October by Rapidity Networks. October 2016, of course, is when Mirai famously took down Dyn, and with Dyn, much of the Internet, in eastern North America. Symantec, which has been tracking and doing much of the research on Hajime,

notes that the worm secures the device it hits by blocking access to ports that host many exploitable services. It also takes measures to operate stealthily. And of course, for now at least, it doesn't appear to be capable of initiating a DDoS attack, but that's dependent upon the current restraint of the author, and upon the author's ability to maintain control of Hajime's code. But here's the problem, lest one be tempted to applaud Hajime and its grey-hat author. What it's doing is illegal in most jurisdictions, and it's also unlikely to seriously interfere with Mirai. As Symantec notes, Hajime has no persistence. It lives in a device's RAM and is

washed out with each reboot. So on balance, it would seem that Hajime is part of the problem, not the solution. Industry continues to pour over last Friday's Shadow Brokers leaks, which the brokers claim disclose NSA hacking tools. Consensus holds that some of the attack code does indeed represent a threat, as it's now open to hacker use in the wild. Some observers think the incident should prompt re-evaluation of the U.S. intelligence community's vulnerabilities equity process. If the leaks are genuine, they argue, there's no safe place to keep zero days. But it would seem naive to expect intelligence services anywhere

to forswear productive collection techniques, even in the cause of herd immunity. Rapid7 advises patching and thinking hard about securing end-of-life systems you can't do without. Where the shadow brokers got their wares remains unknown. The same might be said for Wikileaks and Vault7. Presumably, investigation is underway. for WikiLeaks and Vault 7.

Presumably, investigation is underway. We've covered the ongoing acquisition of Yahoo by Verizon and specifically how revelations of major breaches affected the price Verizon was willing to pay, lowering it by hundreds of millions of dollars. Companies are realizing that due diligence in the cyber realm is a critical part of mergers and acquisitions. Greg Reber is CEO of Aztec Consulting. They provide a variety of risk management and security services,

including M&A security due diligent assessments. What we're looking at now is the more and more interest in acquiring companies, being interested in the IT and the information security stance of an acquired company. But what kinds of risks are they inheriting from a cybersecurity or general IT standpoint? When people don't do the kind of due diligence that you're talking about, why do they make that choice? In some ways, they don't know that it's a possibility to find security vulnerabilities before an acquisition, before things actually get to signing. In other cases, they're not incented to do that because they believe they have insurance coverage, reps and warranties coverage, that if something comes out,

then there'll be an insurance that kicks in, which is, this is a very nascent market for that type of insurance. There's a lot of misunderstanding about what is covered and what is not. But it's a risk distribution. They're taking their own risk of acquiring a company and moving it to an insurance company. But in a lot of cases, and there are more and more case studies, then reps and warranties insurance is not mature enough to really cover vulnerabilities that are in either the IT

infrastructure or software package. There is an industry now for searching for open source components in software packages that result in licensing issues. If someone is selling a software package that has open source components in it as their own, then they are subject to lawsuits for that breach of contract. A lot of people are talking about the growth of cyber insurance and that whole market is taking off and expected to be billions more in the next three or four years. The cybersecurity vendors offering guarantees kind of goes hand in hand with that because for a small or medium-sized company, if a security vendor is offering a million dollars in breach insurance. That may cover their whole breach costs. For a larger company, it may cover their deductible.

So we definitely see this kind of working hand-in-hand with the cyber insurance market and also the digital due diligence and M&A transactions. It's going to help drive how the reps and warranties market matures. That's Greg Reber from Aztec. In other cybercrime news, the hoods behind the bankbot financial malware continue to find ways of getting trojanized apps into Google's Play Store. Researchers at the firm Securify found that the criminals first passed bankbot through the guise of weather forecasting apps, GoodWeather and WorldWeather. Now they've infiltrated the Play Store with

malicious video apps, Funny Videos 2017 and Happy Videos. So beware, even if you're the grouchy type disinclined to watch the sort of cheerful, amusing, and life-affirming content, the Trojanize app's promise. Checkpoint warns that pixel tracking, a familiar marketing tool used to track email opens, is being exploited by criminals performing target reconnaissance to improve their phishing success. Physical security can affect cybersecurity, and here's another example in which it has. An express poll unit was stolen last week from a car belonging to a precinct manager in Cobb County, Georgia, USA. The stolen election device can't be used to commit voter fraud, but it does contain a copy of the state's voter file. In patch news, Oracle releases 299 files, a record for the company.

Among the problems addressed is the Solaris vulnerability the Shadow Brokers disclosed. Finally, lest we appear smug over the Shadow Brokers' leaks or Mom and Pop's vulnerability to Hajime, we hereby decline to throw the first stone at any user. It can be difficult for anyone to keep up with the many small, insignificant, and otherwise easily overlooked, smart-in-a-dim-sort-of-way devices quietly gurgling around in their home or small business network. And dumping an end-of-life system can be a more tangled affair than one might hope. Still, all of us would do well to take basic cyber hygiene as seriously as possible. Configure as securely as you're able, patch, wean yourself from superannuated, unsupported software, and hope that vendors and their developers up their game.

Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. Do you know the status of your compliance controls right now? Like, right now.

We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001.

They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. In a darkly comedic look at motherhood and society's expectations, Academy Award-nominated Amy Adams stars as a passionate artist who puts her career on hold to stay home with her young son.

But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, Thank you. your company safe and compliant.

And I'm pleased to be joined once again by Professor Avas Rashid. He heads up the Academic Center of Excellence in Cybersecurity Research at Lancaster University. Professor, welcome back. An area of research for you that you wanted to share with us was putting together a cybersecurity body of knowledge. What can you tell us about that? As we know, cyber attacks are a regular feature in the news these days. They're on the rise. There are lots of estimates that they cost hundreds of billions of dollars to global economies. But there is a long recognized skills gap within the cybersecurity sector. And it is also, you know, the skills gap

is compounded by the fact that our foundational knowledge on this topic is rather fragmented. And, you know, we are a relatively new field. Mature disciplines such as mathematics, physics, chemistry, they have long-established foundational knowledge and clear learning steps from people learning about these subjects in schools to universities through to professional development programs. So the key thing that we are aiming to do here is to develop a cybersecurity body of knowledge that will provide the foundational resource that can be used for educational programs at various levels. And so how do you imagine it coming together and then

being shared with the rest of the world? So this is really the interesting thing about this project, is that this will be a resource for the community by the community. While I'm leading the project and a few other colleagues are involved as the lead scientists in this project, ultimately we will be engaging the wider community internationally to decide what should be the scope of such a body of knowledge, what should be, for lack of a better word, the top level knowledge areas that should be covered by the body of knowledge. And then we will be inviting leading international figures around the world from academia and industry to actually author descriptions of those knowledge areas.

And then the wider community will actually review and critique those descriptions before they are somehow cast in stone. The key point to bear in mind is that it will never actually be cast in stone in the sense that such a body of knowledge can effectively never be completely finished. The technology moves at a fast pace, the security threats move at a fast pace. So there will have to be a regular cycle of updating it. But what we are doing here is a first step in what we hope will be a long-term thing that the community collectively will do. All right, Professor Avas Rashid, thanks again for joining us. And now a message from Black Cloak.

Did you know the easiest way for cyber criminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365, with BlackCloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team

of editors and producers. I'm Dave Bittner, thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.