CyberWire Daily - Witch hunts and yard sales. See relationships, not dox. Rebrandings, mergers, acquisitions, and executive moves. Building anti-witch capabilities.

Episode Date: January 10, 2017

California says a nation-state was behind the Anthem hack. The ShadowBrokers hold a yard sale (we'd pass on the malware, but if they had a nice blender out we'd consider it). WikiLeaks says it's interested in relationships, not doxing. The US FDA confirms vulnerabilities in cardiac devices. Hello Kitty gets breached. Yahoo! will become Altaba, and get new leadership. Germany and the UK study ways of increasing cyber capability. The University of Maryland's Jonathan Katz reviews emerging encryption types. Uri Sternfeld from Cybereason explains their free ransomware prevention tool, RansomFree. Russia complains it's the subject of a witch hunt.  Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. stay home with her young son. But her maternal instincts take a wild and surreal turn as she discovers the best yet fiercest part of herself. Based on the acclaimed novel, Night Bitch is a thought-provoking and wickedly humorous film from Searchlight Pictures. Stream Night Bitch January 24 only on Disney+. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer.

Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me. Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code N2K at checkout. That's joindelete.me.com slash N2K, code N2K.

California says a nation state was behind the Anthem attack. The shadow brokers hold a yard sale. We'll pass on the malware, but if they had a nice blender out, we'd consider it. WikiLeaks says it's interested in relationships, not doxing. The US FDA confirms vulnerabilities in cardiac devices. Hello Kitty gets breached. Germany and the UK study ways of increasing cyber capability. And Russia complains it's the subject of a witch hunt.

it's the subject of a witch hunt. I'm Dave Bittner in Baltimore with your Cyber Wire summary for Tuesday, January 10, 2017. California, aided by Mandiant, has concluded that it knows with high confidence exactly who breached the Anthem Healthcare Insurance Company in 2014. They've also concluded with medium confidence that the responsible actor was working on behalf of a nation state. The responsible nation isn't named, but most observers have long thought the Anthem breach was a Chinese government operation.

Noteworthy among the circumstantial evidence pointing to state espionage is the dog that didn't bark. The compromised data doesn't appear to have been sold or transferred to any non-state actors, like identity thieves, carters, fraudsters, or other varieties of conventional criminals. The shadow brokers have resurfaced, the hacking crew with broken English straight out of Hollywood, who say they want to strike a blow against wealthy elite and make a little coin on the side. who say they want to strike a blow against wealthy elite and make a little coin on the side. The brokers have tried since last summer with indifferent success to auction off attack tools they say they obtained by guile or hacking from NSA.

They're now holding what Heimdall Security calls a yard sale. Much of what they've got spread across their virtual front yard consists of Windows malware, especially the unappealingly named Dander Spritz remote administration tool. On Friday, the WikiLeaks task force, a verified Twitter account that represents itself with some plausibility as the official at WikiLeaks support account, deleted a tweet that appeared to indicate plans to build a database of verified Twitter users. There was understandable objection from many Twitter users

who saw the effort as an incipient doxing campaign. The WikiLeaks task force says it was merely interested in building a database that would display relationships, which many find about as disturbing as doxing, albeit in a different way. WikiLeaks says the ill feelings are caused by a misperception, and it blames the dishonest press for scaring people. So the tweet is deleted, but it's unclear if the database project it described has also been abandoned.

The US FDA confirms that St. Jude medical cardiac devices are vulnerable to cyber attack. St. Jude said yesterday that it had a patch and was pushing it out. Vulnerabilities in St. Jude devices were initially disclosed in August 2016 by Muddy Waters, a hedge fund interested in shorting St. Jude stock. The vulnerabilities alleged in the public disclosure were reported to Muddy Waters by its partners in the cybersecurity company MedSec. Litigation between St. Jude on the one hand and the team of Muddy Waters and MedSec on the other continues. The FDA finding is expected to prove relevant to the outcome.

In a rather different kind of threat to the heart, a database of 3.3 million Hello Kitty fans has leaked online. A poorly configured Sanrio database was copied before it was secured. Ransomware continues to be a threat, showing up at or near the top of just about everyone's list of things we can expect to get worse in 2017. But one company is doing their part to help stem the tide. Cyber Reason is an Israeli cybersecurity firm, and they recently released a free ransomware prevention tool called RansomFree. Uri Sternfeld is lead researcher at Cyber Reason. If you look at the damages caused by ransomware from 2014 until the end of 2016, you can see an

exponential growth from about $25 million worldwide in 2014 to more than a billion dollars worldwide. So what we did was to take a few hundred samples of real-world ransomware from about 30, 40 different families and sort of look for the common heuristics, something that will allow us to catch most type of ransomware without prior knowledge, without concentrating on the specific characteristics of each family or even yet unknown families of ransomware. And what we came up with was to concentrate on the low-level file activity of ransomware and detect the file encryption patterns that indicate that this is a malicious tool trying to encrypt files. This is sort of a very unique activity for ransomware as opposed to other types of malware. for ransomware as opposed to other types of malware. And we also managed to distinguish between malicious encryption and the types of legitimate encryption.

So if I'm a user of Ransom Free, how will it affect the use of my computer? Well, it simply runs in the background. Usually you won't feel anything. usually won't feel anything. One of the techniques we use is to create multiple tiny canary files throughout the drive. Most of them are hidden from the user, so there's no problem. It simply sits in the background and monitors file activity and doesn't do anything unless it detects a malicious encryption process. And so if it does detect a malicious encryption, what happens next?

So it does several things. The first is to immediately suspend and quarantine the suspected offender. Then it pops up an alert for all the users which are currently logged on on the machine, alert for all the users which are currently logged on on the machine, alerted them to the activity and allowing them to first see any affected files, including files created or deleted or renamed. And then the user is able to either allow the suspected process if they suspect this was a false positive, which is usually unlikely, or they can choose to block the threat,

which will not only terminate the threat, but also automatically prevent the same threat from ever running again. That's Uri Sternfeld from Cyber Reason. In the aftermath of last year's two big disclosures of massive data breaches, Verizon may still walk away from its acquisition of Yahoo's core assets, but Yahoo is acting as if it's a done deal. The company has announced that it will be renaming itself Altaba, and so Yahoo, one of the famous names from the dot-com era, will disappear from the tech marketplace.

A number of senior Yahoo leaders, including CEO Marissa Meyer, will be resigning. As many note, it's still not clear that Verizon will continue with its acquisition plans. Another big aerospace and defense integrator divests itself of a commercial cybersecurity unit. Northrop Grumman is selling its Blue Vector subsidiary to LLR Partners. Financial terms of the sale weren't disclosed, but LLR Partners said that it has committed $50 million to Blue Vector to support the acquisition and future growth plans. Germany and the UK are looking at ways of building their cyber capabilities.

Germany is especially concerned about fending off Russian influence operations in the elections the Federal Republic will hold later this year. The UK is conducting a more comprehensive review of its capabilities. Those would likewise include defensive measures against information operations. But Her Majesty's government is also interested in developing enhanced cyber-offensive capabilities. Those who find themselves generally opposed to such capabilities see the beginning of an attempt at control of the media, and opponents of the recently enacted Snoopers Charter are challenging enhanced surveillance powers in court. As the U.S. president-elect comes around to the

view that Russia took an interest in U.S. elections, members of Congress and others do some woofing about the possibility that the U.S. is falling behind the opposition in its ability to wage cyber warfare. Historians of the Cold War will be put in mind of the missile gap presidential candidate Kennedy charged the Eisenhower administration with allowing. For his part, Russia's President Putin decries all of this furor over hacking, mostly in the U.S. but elsewhere too, as a witch hunt. It's not our place to advise the Russian government, and if we wanted to do so, we'd write

a letter to the editor of RT. But it does seem that losing the broomstick and the black conical hat would be a good idea, Vladimir Vladimirovich. Do you know the status of your compliance controls right now? Like, right now? We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist.

Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity.

That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default-deny approach can keep your company safe and compliant. Joining me once again is Jonathan Katz. He's a professor of computer science at the University of Maryland and also director of the Maryland Cybersecurity Center. Jonathan, I was hoping today you could take us through

and help us understand some different types of encryption. And I wanted to start with attribute-based encryption. So this is something that's been developed over the past 10 years or so in the cryptography community. And let's step back, actually, and just talk about regular public key encryption. In a regular public key encryption scheme, anybody has the ability to encrypt, and only a designated receiver who has the matching private key can decrypt. Attribute-based encryption allows you to do public key encryption with a more complicated access control, essentially. And what this allows you to do is to derive private keys

that are policy-specific. So they have a particular policy embedded in them that dictates whether or not somebody can decrypt. So, for example, that allows now anybody to, again, encrypt, like in a regular public key encryption scheme, but only people whose keys match a particular policy specified by the sender can decrypt. And so there's another type of encryption called functional encryption. Can you take us through that? Yeah, so functional encryption actually is even a generalization of attribute-based encryption. You still have the same idea of private keys being tied to policies, but now rather than either the policy allowing you to decrypt everything or to get nothing, the policy can

now specify an arbitrary function. And with that private key, you can learn that function of the plain text. So just as an example of that, you might imagine you have different people having different levels of clearance. And a sender can encrypt a document marking each paragraph with a particular classification level. And then depending on a particular key that a recipient has, they would only be able to see the particular paragraphs of the plain text that they had the rights to be able to see. And are both of these in regular use, or are they still in the developmental stages? So they're still in the developmental stages,

but actually the schemes we have now for simple access policies are relatively efficient, and I think there are some companies now trying to commercialize them. And I think these kind of schemes can be very useful in large organizations for exactly managing this kind of control to data. You can imagine having an encrypted operating system, for example, where every file is encrypted using attribute-based encryption, and then you give keys to particular users that allow them to decrypt only the files that they should have the rights to access. So I think we'll see perhaps some

developed real-world use of these systems in the next five years or so. Interesting stuff. Jonathan Katz, thanks for joining us. And just a reminder that we'd like to hear from you if you have any questions for any of our academic or research partners. You can send those questions in to questions at thecyberwire.com, and we will pass them on and try to get them answered on the air. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home?

Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io. And that's The Cyber Wire. We are proudly produced in Maryland by our talented team of editors and producers. I'm Dave Bittner. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable.

That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com. That's ai.domo.com.