The CyberWire Daily Briefing, 4.3.20

Special Section

News for the cybersecurity community during the COVID-19 emergency

Criminals chatter about COVID-19's economic impact on their operations.

Digital Shadows has been looking over the shoulder of the hoods who chat amongst themselves in their dark web souks, and they've summarized the mood of the underworld, at least in its Russian- and English-speaking precincts, as revealed by the chatter. Some of their conclusions are entirely foreseeable. As the emergency cuts brick-and-mortar commerce way back, people are doing much more shopping online, and the criminals see opportunity for carding and other forms of online retail fraud. They're also shifting their direct fraud to follow the market: a number of them see opportunity in demand for face masks, vaccines, and other items people want but can't get (sometimes, as in the case of the vaccines, because such things don't exist).

On the other hand, the gangs are also feeling some economic pain. Opportunities for travel and event fraud have essentially dried up, and the criminals who specialized in these are feeling the pinch. The gangs are also having difficulty completing their theft when it requires an actual physical transfer of goods or cash (as it often does). They depend on dropworkers to close those deals, and they're having trouble getting their dropworkers to actually work. For one thing, the authorities are a lot more alert to people who are out and about with no evident legitimate purpose. For another, the dropworkers themselves are often "afraid to leave the house."

May the pandemic crash the cybercriminal economy fast and hard. Sure that's overly optimistic, but one can hope, right?

Google will provide user location data to governments.

In support of enforced social isolation, Google yesterday decided to make location data in the form of mobility reports available to governments, the Wall Street Journal reports. According to France 24, the data are being collected from one-hundred-thirty-one countries.

Zoom works to close security and privacy holes.

The teleconferencing service is patching vulnerabilities disclosed to it as the company's services see an enormous spike in demand during the COVID-19 emergency's period of enforced social isolation and remote work. The Washington Post says that Zoom's quick response has generally been well-received, even by such normally skeptical critics as the Electronic Frontier Foundation. Errata Security offers some perspective on the bugs, advising users to take sensible security steps and not exaggerate the risk.

The University of Toronto's Citizen Lab takes a look at Zoom's less-than-end-to-end encryption (which CItizen Lab characterizes as "roll-your-own"). The Lab also points to Zoom's apparent ownership of three companies in China that have a total workforce of seven-hundred. They write software for Zoom in a typical labor arbitrage arrangement, but Citizen Lab worries that the Chinese connection could expose Zoom to pressure from Beijing.

More on what's up with cybersecurity conferences.

Another familiar name in the event space is rescheduling physical conferences and standing up a series of virtual events. SecureWorld has, like everyone else, postponed its physical events and instead introduced a series of daily Remote Sessions to help keep the community in touch and exchanging ideas. There's one today, in fact, and you'll find a full list on their website.

Summary

By the CyberWire staff

The Atlantic Council’s Digital Forensic Research Lab reports finding some nine-thousand inauthentic Twitter bots promoting a Saudi and Emirati line against Turkey’s activities in Libya. The bots, which Twitter has taken down, also sought to “politicize” the COVID-19 pandemic.

10x Genomics, a biotech firm working on COVID-19 treatments, disclosed in a Form 8K filed Wednesday with the US Securities and Exchange Commission that it had sustained a ransomware attack. The company says it has restored both access to its data and normal operations, but the attack also involved theft of some unspecified company information.

The World Health Organization has said little about attempts to compromise staffers’ personal email accounts, but has said it believed the attempts were unsuccessful. Reuters quoted sources who suggested the campaign was run on behalf of Iran: “We’ve seen some targeting by what looks like Iranian government-backed attackers targeting international health organizations generally via phishing,” said a source identified as someone at “a large technology company that monitors internet traffic for malicious cyber activity.”

Reuters also consulted Prevailion, which made no attribution but did say they’d captured evidence of compromise suggesting the activity of “a sophisticated hacking group.” Computing says the attacks continue.

In what may be a distinct campaign, WHO has also been said to be the target of DarkHotel, a threat actor thought to operate from East Asia.

DarkHotel is also said to be at work against targets in Japan and China with attacks that Cybersecurity Help says exploit Firefox and Internet Explorer vulnerabilities.

Mandiant FireEye M-Trends 2020 Report: Insights from the Front Lines

Notes.

Today's issue includes events affecting China, Japan, United Nations, Turkey, Saudi Arabia, United Arab Emirates, and United States.

Bring your own context.

Thoughts on the value of software as a service.

"So I think that SaaS providers do, for the most part, an excellent job of their portion in the shared responsibility model. They patch quickly. Their patch holistically. They harden their infrastructure. They guard their perimeter. But buying a safe car doesn't make you a good driver. Ultimately, you're responsible for configuring and running that application. And these applications are so powerful, they can run and adapt to almost any conceivable business process. The cloud provider doesn't always know where you're trying to go with the application. So it's possible that people do things, like share data with the public internet or expose or overprivilege APIs that were meant to be internal. And for the most part, you know, speaking about the language barrier, you have the line of business or IT business specialists that are running these systems."

—Brendan O'Connor is CEO at AppOmni,, on the CyberWire Daily Podcast, 3 .31.20.

SaaS may be very good, but it's unreasonable to expect that it should be a set-it-and-forget-it proposition.

CyberWire Pro delivers timely briefings about developing news.

Take a look at CyberWire Pro, our new subscription program designed for security professionals and all others who want to stay abreast of cybersecurity news. CyberWire Pro is a premium service that will save you time and keep you informed.

Aerospace news worthy of attention.

If you're interested in space and communications (technology, policy, business, and operations), take a look at Cosmic AES Signals & Space. Produced in partnership with the CyberWire, Signals & Space offers a monthly overview of news in this sector.

Transition your enterprise to a secured, remote work environment with McAfee.

Most companies aren’t prepared to secure data and assets for a surge of remote employees. Whether your VPN is over capacity, new cloud services are coming on-board, or new devices need protection, we have you covered during this critical time. McAfee is offering 3-month subscriptions for Endpoint Protection, Unified Cloud Edge, and CASB to help you scale security to your remote employees. Learn more about these offers at mcafee.com/workfromhome.

Podcast Summary

Step into our virtual office and enjoy a podcast. It's about twenty minutes long (like your old commute, give or take a couple of red lights). Today's CyberWire Daily Podcast, out as always later this afternoon, features a conversation with our partners at Booz Allen Hamilton, as Michael Sechrist discusses how cybercrime is changing during the coronavirus pandemic. Our guest is Admiral (retired) James Stavridis from Preveil, with an overview of global cyber security threats and realities.

— The cybersecurity community during the COVID-19 emergency

Verizon Says Call Volume Soars as Stay-at-Home Becomes the Norm (Nasdaq) Being cooped up in the house because of the coronavirus pandemic is causing people to figuratively "reach out and touch someone." Verizon (NYSE: VZ) said last week that its wireless network was handling twice as many calls on weekdays as it generally sees on Mother's Day, typica

Do Coronavirus SOCs Look Like Zoom War Rooms? (SDxCentral) When a network breach or another cybersecurity incident occurs, enterprises typically rely on their on-site security operations centers (SOCs) to isolate and stop the threat. But what happens when the SOC analysts are working remotely because of, say, the global coronavirus pandemic?

Companies must gear up to combat rising cyber threats amid covid-19 (Livemint) Nearly 91% of cyber attacks start with an email..Phishing, which uses disguised email as the weapon, has emerged in the form of two broad categories

So bleiben Sie auch im Homeoffice sicher (Netzwoche) Aufgrund der Coronakrise haben viele Unternehmen ihre Mitarbeiter ins Homeoffice geschickt. Da dies schnell und ohne grosse Vorbereitungszeit passieren musste, wurde die IT-Security dabei oft vergessen. Wie man trotz Homeoffice sicher arbeiten kann, sagen ISG, PWC, Eset, G Data und das Nationale Zentrum für Cybersicherheit.

Coronavirus as a double-edged sword for cybercriminals: Desperation or opportunity? (Digital Shadows) Digital Shadows has observed threat actors operating on cybercriminal forums and marketplaces expressing their worries and a sense of desperation as to how the pandemic will affect their established business models. Some are urgently trying to adapt their offerings to survive in this vastly changed landscape.

COVID-19 Part 3: Data Tells the Story (PerimeterX) ATO attacks rise in fashion and home goods during pandemic.

Google Offers User Location Data to Health Officials Tackling Coronavirus (Wall Street Journal) Google will help public health officials use its vast storage of data to track people’s movements amid the coronavirus pandemic, in what the company called an effort to assist in “unprecedented times.”

Google to publish user location data to help govts tackle virus (France 24) Google to publish user location data to help govts tackle virus

Analysis | The Cybersecurity 202: Researchers praise Zoom’s quick pledge to fix a slew of security and privacy problems (Washington Post) The coronavirus crisis fueled the online meeting company's huge rise.

Zoom promises to resolve security and privacy issues in its video-conferencing service (Computing) The company says users are utilising the app in myriad unexpected ways

Everybody seems to be using Zoom. But its security flaws could leave users at risk. (Washington Post) Weddings, funerals, company layoffs, kindergarten classes and official government meetings have all been streamed through Zoom since the coronavirus contagion has shut down group gatherings. But the company’s dramatic growth has come with a crisis of its own: An uproar over security, privacy and harassment concerns.

Move Fast & Roll Your Own Crypto: A Quick Look at the Confidentiality of Zoom Meetings (The Citizen Lab) This report examines the encryption that protects meetings in Zoom and finds that they have made their own encryption scheme and has significant weaknesses.

Zoom's security and privacy problems are snowballing (Business Insider) In the past 48 hours, Zoom has been criticized for leaking emails and photos, not having genuine end-to-end encryption, and more.

()

About them Zoom vulns... (Security Boulevard) Today a couple vulnerabilities were announced in Zoom, the popular work-from-home conferencing app. Hackers can possibly exploit these to do evil things to you, such as steal your password. Because of the COVID-19, these vulns have hit the mainstream media.

Zoombombing: How hackers can take over your video calls (The Telegraph) Video conferencing apps like Zoom have seen increasing numbers of calls hijacked by strangers

‘War Dialing’ Tool Exposes Zoom’s Password Problems (KrebsOnSecurity) As the Coronavirus pandemic continues to force people to work from home, countless companies are now holding daily meetings using videoconferencing services from Zoom.

Automated tool can find 100 Zoom meeting IDs per hour (The Verge) The program can also glean information about those meetings.

Zoom's Security and Privacy Woes Violated GDPR, Expert Says (SecurityWeek) Security concerns revolve around the recent discovery of several vulnerabilities taken with the length of time it has taken Zoom to fix earlier vulnerabilities

A Cyber Approach to Coronavirus Containment (Global Security Mag Online) What lessons can be learned from reviewing how we manage cybersecurity and applying it to an anti-Coronavirus campaign? In recent years, some in the cyber world recognize that there is a lot to learn from the biological world when protecting systems against viruses.

Breach Clarity to waive fees for six months (Finextra Research) If a global pandemic and drastically weakened economy weren’t enough stress for financial consumers, an anticipated long tail of resulting financial crime has begun to emerge.

Israeli spyware firm pitches to be Covid-19 saviour (BBC News) A firm being sued by WhatsApp claims its software can help combat the spread of coronavirus.

Coronavirus: NSO Group attempting to woo west with COVID-19 tracking software (Sky News) According to a demonstration of the company's software seen by Sky News, data on citizens would only be held by the authorities.

()

Facebook launches fact-checking service on WhatsApp in Italy to fight coronavirus hoaxes (Reuters) Facebook Inc. launched a service in Italy to check the accuracy of information on coronavirus circulating on its messaging platform WhatsApp, the U.S. tech firm said on Thursday.

A message from Maryland Governor Larry Hogan to NSA, U.S. Cyber Comman (National Security Agency Central Security Service) Maryland Governor Larry Hogan addresses NSA, U.S. Cyber Command on the importance of their work during the COVID-19 global pandemic.

Cybersecurity Association of Maryland, Inc. Launches Cyber SWAT Team Hotline (Cyber Security Association of Maryland) Cybersecurity companies combine resources to assist Maryland businesses amidst COVID-19 crisis

()

WFH with kids in lockdown (CRN) Dell's Sarah Shields outlines five steps working parents can take to help their children during self-isolation

Cyber Attacks, Threats, and Vulnerabilities

Ransomware strikes 10x Genomics, biotech firm researching possible COVID-19 treatments (CyberScoop) Hackers struck, 10x Genomics, a California-based biotechnology company which makes tools that researchers are using to learn about the coronavirus.

Twitter botnet targeted Turkey while politicizing coronavirus (Medium) Network traces back to anti-Turkey operation originally identified last year

Iranian hackers target email accounts of WHO staff with spear-phishing messages amid coronavirus pandemic (Computing) The attacks began on 2nd March and are continuing

()

DarkHotel hackers exploited flaws in Firefox and IE in attacks on China, Japan (Cybersecurity Help) In the attacks the hackers downloaded the Gh0st RAT on victims' machines.

Italian social service website limping to normalcy after cyber-attack (SC Magazine) The INPS website was attacked while about 339,000 applications for the €600 benefits for VAT-registered and self-employed Italians were being processed

()

Twitter discloses bug that cached private files sent or received via DMs (ZDNet) Private files sent via DMs were cached inside Firefox browsers for as long as a week, even after users logged off.

()

LimeRAT malware is being spread through VelvetSweatshop Excel encryption technique (ZDNet) The old tactic is proving fruitful in a new campaign.

Attackers Leverage Excel File Encryption to Deliver Malware (Dark Reading) Technique involves saving malicious Excel file as read-only and tricking users into opening it, Mimecast says.

()

Over 35,500 coronavirus-related websites reported as scam (Atlas VPN) According to Atlas VPN research, cumulatively, scammers created over 35,500 unique websites related to COVID-19 in the last month. Here, they tried to swindle money by selling masks, hand-sanitizers, or even virus testing kits. Our data is projected based on Chad Anderson’s insights, who is a senior security researcher at DomainTools. Chad Anderson claims that …

44M Digital Wallet Items Exposed in Key Ring Cloud Misconfig (Threatpost) Millions of IDs, charge cards, loyalty cards, gift cards, medical marijuana ID cards and personal information was left exposed to the open internet.

Report: Popular Digital Wallet Exposes Millions to Risk in Huge Data Leak (vpnMentor) Led by Noam Rotem and Ran Locar, vpnMentor’s research team recently discovered a data leak by the popular app Key Ring, that compromised the privacy and

Researcher Finds New Class of Windows Vulnerabilities (SecurityWeek) A security researcher has discovered over 25 different potential vulnerabilities in Windows, including some that could lead to elevation of privileges

Firefox, IE Vulnerabilities Exploited in Attacks on China, Japan (SecurityWeek) Vulnerabilities patched earlier this year in Firefox and Internet Explorer have been exploited by an APT in attacks aimed at China and Japan

Coronavirus Trojan Overwriting the MBR (Security News) SonicWall Capture Labs Threat Research team recently found a new malware taking advantage of the CoViD19 pandemic which makes disks unusable by overwriting the MBR.

BEC scams evolve from ‘Nigerian Prince’ to sophisticated malware (SC Magazine) Nigeria continues to be a hotspot for this particular threat (BEC scams), with SilverTerrier growing into a sophisticated threat group

MakeFrame: Magecart Group 7’s Latest Skimmer Has Claimed 19 Victim Sites (RiskIQ) At RiskIQ, we track many different Magecart groups. We continually observe evolutions in the techniques they employ to skim card data and obfuscate the code that they use for that purpose.

B&R Automation Studio (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: B&R Automation Equipment: Automation Studio Vulnerabilities: Improper Privilege Management, Missing Required Cryptographic Step, Path Traversal 2.

Key Ring App Data Leak Exposes 44 Million Images (Infosecurity Magazine) Researchers find user data of 14 million Key Ring app users on five unsecured Amazon Buckets

'Alcohol is soooo good': Trolls are breaking into AA meetings held on Zoom video calls and harassing recovering alcoholics (Business Insider) "Alcohol is soooo good," an intruder said to recovering alcoholics during a Tuesday AA meeting on Zoom.

IRS warns of coronavirus-related scams targeting financial information (TheHill) The Internal Revenue Service (IRS) on Thursday warned Americans that scammers and hackers were likely to take advantage of the coronavirus crisis to target financial information.

()

London Hit by Quarantine Text Scam (Infosecurity Magazine) Richmond residents warned over fraudulent quarantine fine notification texts

Security Patches, Mitigations, and Software Updates

Zoom Rushes Patches for Zero-Day Vulnerabilities (BankInfo Security) The day after security researcher Patrick Wardle disclosed two zero-day vulnerabilities in the macOS client version of Zoom's teleconferencing platform, the company

Twitter Data Cache on Mozilla Firefox (Twitter) We recently learned that the way Mozilla Firefox stores cached data may have resulted in non-public information being inadvertently stored in the browser's cache.

Google Squashes High-Severity Flaws in Chrome Browser (Threatpost) Google is rolling out the newest Chrome browser version, 80.0.3987.162, in the coming days.

Cyber Trends

An Interview with Bruce Schneier, Renowned Security Technologist (The Politic) Bruce Schneier is an internationally renowned, award-winning public-interest technologist who serves as Chief of Security Architecture at Inrupt, a company working to bring Sir Tim Berners-Lee’s distributed data ownership model into the mainstream. Mr. Schneier is a fellow at the Berkman Klein Center for Internet & Society at Harvard University; a Lecturer in Public Policy at the Harvard…

Marketplace

Security resellers should look to the long-term risk management pitch (MicroscopeUK) Coronavirus might have sparked spending around securing remote workers, but longer term there are more strategic conversations to be had around risk management.

Voatz disputes claims it was 'kicked off' HackerOne (SearchSecurity) HackerOne, providers of a bug bounty platform that allows hackers to fix the bugs of software companies for monetary rewards, has cut ties with mobile voting platform Voatz.

Cybereason Continues its Global Expansion by Launching Regional Middle East Operations (Newswire Today) Cybereason, creators of the leading Cyber Defense Platform, today announced it has launched operations in the Middle East to help enterprises future proof their networks from the ever-evolving threat landscape

Illusive Networks Welcomes Karl J. Mattson to Board of Advisors (Yahoo) Illusive Networks®, the leader in deception-based cyber defense solutions, today announced that security expert Karl Mattson has joined its board of advisors. He brings more than two decades of information security experience, including from his recent role as senior vice president and chief information

Products, Services, and Solutions

Telos and ST Engineering Form Strategic Partnership to Deliver World-Class Cybersecurity, Governance, Risk and Compliance Solutions Throughout Asia and the Middle East (Telos Corporation) Agreement expands the footprint and reach of Telos Ghost® and Xacta® into Asia and the Middle East.

Splunk's new APM solution unlocks real-time observability for cloud infrastructure (Help Net Security) Splunk releases SignalFx Microservices APM, the only APM solution that provides customers complete observability into modern, cloud-native environments.

()

Okta launches Lifecycle Management Workflows to make building identity-centric processes easy (TechCrunch) Okta, the popular identity and access management service, today used its annual (and now virtual) user conference to launch Lifecycle Management Workflows, a new tool that helps IT teams build and manage IFTTT-like automated processes with the help of an easy to use graphical interface. The new ser…

Protecting democracy, especially in a time of crisis (Microsoft on the Issues) Today, Microsoft announces the expansion of its Defending Democracy Program to help democratic processes become more resilient in light of increased cyberthreats, with the relese of Election Security Advisors, which helps secure election systems from cyberattacks, expansion of the AccountGuard threat notification service, and an extension of Microsoft 365 for Campaigns to include state-level campaigns.

()

Technologies, Techniques, and Standards

Hidden Threat – Vulnerability Analysis using the news graph (Vulners Blog) When you face to face a new vulnerability, what is the thought that comes first? Of course, respond as quickly as possible. However, speed is just one of the conditions for an effective fight again…

Cryptography: Why Do We Need It? (Electronic Design) This first article in the “The Cryptography Handbook” addresses the escalating need for cryptography in this ever-more connected world.

How to Protect Your Identity on Social Media (Law Technology Today) Social Media is an integral part of life. It's a way of connecting with other people and sharing con...

Design and Innovation

Okta says it's doing away with passwords entirely (SiliconANGLE) Identity management software provider Okta Inc. said today it’s doing away with passwords with a new feature that will be rolled into its cloud platform.

Research and Development

()

Academia

Online courses are disrupted by hackers as Columbia transitions to Zoom video conferencing platform (Columbia Daily Spectator) Professor Brendan O’Flaherty’s Tuesday afternoon lecture for Principles of Economics was hacked by three individuals who disrupted the class for about six minutes, playing audio containing racial slurs and inappropriate content, hurled insults at the professor, and later called a participant a racial slur, according to a course recording obtained by Spectator.

Legislation, Policy, and Regulation

()

China Rejects U.S. Intelligence Claim It Hid Virus Numbers (Bloomberg) Beijing says response to outbreak was open, transparent. U.S. intelligence community concluded China played down threat.

U.S. Intelligence: China Covered Up Extent of Coronavirus Outbreak (Intelligencer) China’s reporting on COVID-19 cases is intentionally incomplete, the intelligence community reportedly told the White House in a classified report.

Managing Escalation Under Layered Cyber Deterrence (Lawfare) Without a firm grasp on the potential for escalation, the United States will be unable to contain the fallout when assertive operations are conducted.

TRACED Act: Robocall Mitigation FAQ (Neustar) Understand how the TRACED Act affects government enforcement of robocalls, what constitutes an illegal robocall, and the limitations of current measures.

Litigation, Investigation, and Law Enforcement

Federal judge declines to postpone April 7 presidential primaries in Wisconsin (Washington Post) The decision came amid worries that holding elections during the coronavirus pandemic could risk public health and curtail access to the polls.

Class Action Lawsuit Filed Against Marriott Over New Data Breach (SecurityWeek) A class action lawsuit has been filed against Marriott over the recently disclosed data breach that impacted as many as 5.2 million customers.

()

RealPage Can Sue Insurer For $6M Phishing Scheme Loss (Law360) Texas-based property management software company RealPage Inc. can sue a Pennsylvania insurance company over its alleged violation of a Texas law in order to recover $6 million in losses stemming from a $10 million phishing scheme, a Texas federal judge has found.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

National Cyber League (NCL) Spring Season (Various locations, Mar 19 - May 15, 2020) The National Cyber League (NCL) is a defensive and offensive puzzle-based, capture-the-flag style cybersecurity competition. Its virtual training ground helps high school and college students prepare and test themselves against cybersecurity challenges that they will likely face in the workforce. All participants play the games simultaneously during Preseason, Individual Game and Team Game. NCL allows players of all levels to enter. Between easy, medium and hard challenges, students have multiple opportunities to really shine in areas as they excel. Registration for the Spring Season closes March 20, 2020.

InfoSec World (Lake Buena Vista, Florida, USA, Mar 30 - Apr 3, 2020) Join your peers and our experts at InfoSec World 2020 Conference & Expo on March 30 – April 1 to not only address the disruptive technologies and threats on the horizon, but to create a plan for managing the people, processes and tools for how your organizations react and cope with these intrusive circumstances.

CyberTechLive (Online, Apr 7, 2020) CybertechLive - Virtually connect with top speakers, generate business leads and tap into the Cybertech network.

SecureWorld Houston (Houston, Texas, USA, Apr 15, 2020) Join your fellow InfoSec professionals for high-quality, affordable cybersecurity training and collaboration. Earn 6-12 CPE credits through 30+ educational elements, learning from nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with local peers.

OFFZONE 2020 (Moscow, Russia, Apr 16 - 17, 2020) This year, cybersecurity specialists, researchers and enthusiasts will meet at the Loft Hall #2. As usual, the focus will be not on business, but on practical issues, fresh research results, and the most relevant cyberthreat experience. As in previous years, the conference will have an additional dimension — an enthralling story-line lived out by the participants in the course of 2 days. The first OFFZONE located visitors in a disaster survival bunker. The second conference brought participants together to revive lost computing power, knowledge and technology. And this year, visitors to OFFZONE 2020 will be connected to unique artificial intelligence that accumulates all their skills and experience. Does the program really selflessly help people or pursue its own goals? Find out at OFFZONE 2020!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Twitter bots suppressed. Biotech company's ransomware incident. WHO updates. COVID-19 and cybersecurity.