US elections: CISA calls security success, but reminds all that it’s not over yet. Notes from the cyber underground. Two more indictments in cyberstalking case.

Dave Bittner: Election security, hunting forward, rumor control and the value of preparation. Maze may be gone, but its affiliate market has moved on. An illicit forum has leaked large repositories of personal information online. Joe Carrigan shares thoughts on hospital systems getting hit by ransomware. Our guest is Alan Radford from One Identity, who wonders whether robots should have identities. And two more ex-eBayers are indicted in the Massachusetts cyberstalking case.

Dave Bittner: From the CyberWire studios at DataTribe, I'm Dave Bittner with your CyberWire summary for Wednesday, November 4, 2020. 

Dave Bittner: It looks like any other Election Day, even any other Tuesday. That's what a senior CISA official said yesterday at a virtual press briefing we attended. 

Dave Bittner: Senior officials at the U.S. Cybersecurity and Infrastructure Security Agency - that is, CISA - yesterday tentatively attributed the relative lack of foreign adversaries' action against the U.S. elections to deterrence by denial, but they also credited U.S. Cyber Command's hunt forward operations with having made a significant contribution to election security. 

Dave Bittner: The Washington Post quotes the Cyber Command head and director NSA, General Paul Nakasone, as confirming that his organizations took unspecified action against Iranian actors after the threatening email campaign that tried to fly a false Proud Boys flag was determined to emanate from Tehran. CNN reports that hunt forward operations extended to Russia and China as well. 

Dave Bittner: For two years before yesterday's voting, U.S. Cyber Command deployed, quote, "the whole spectrum of offensive and defensive measures," end quote, against threat actors in Moscow, Tehran and Beijing, CNN reports. The New York Times says CYBERCOM sent squads to Europe, Asia and the Middle East to investigate tactics, techniques and procedures. Deputy Commander Lieutenant General Charles Moore explained, quote, "we want to find the bad guys in red space, in their own operating environment. We want to take down the archer rather than dodge the arrows," end quote. 

Dave Bittner: Cyber Command will continue its efforts indefinitely. General Moore calls election defense a persistent and ongoing campaign, and Fort Meade can be expected to remain engaged. 

Dave Bittner: Returning to CISA, the Homeland Security Agency executed a long-prepared national effort to secure the vote. CISA has for some time expressed the view that public engagement through the media and directly online make an important contribution to cybersecurity. Through Election Day, CISA held a series of six online media briefings, the first at 9:30 a.m. Eastern Time, the last at 11:30 p.m. Eastern Time, providing updates on election security and the perspective their virtual situational awareness room provided. The good news repeated throughout the day is that no major cybersecurity threats surfaced during the voting. 

Dave Bittner: Since spectacular claims of spectacular wickedness are maybe to be expected in the post-election phase, it's worth a quick review of CISA's Rumor Control page to see what the agency thinks are rumors most likely to surface. 

Dave Bittner: Here's one. If results as reported on election night change over the ensuing days or weeks, the process is hacked or compromised, so I can't trust the results. 

Dave Bittner: Well, here's the reality. Election results reporting may occur more slowly than prior years. This does not indicate there is any problem with the counting process or results. Official results are not certified until all validly cast ballots have been counted, including ballots that are counted after election night. This is why the process of counting votes is likely to take days. Certifying them will take longer. 

Dave Bittner: Here's another rumor. Provisional ballots are only counted if there's a close race. The truth is that provisional ballots are counted in every election, regardless of result margins. 

Dave Bittner: This hasn't happened much, if at all, but there's a rumor in circulation to the effect that if the election night reporting webpage is defaced or displays incorrect results, the integrity of the election is compromised. Again, not so. The truth is that a defaced webpage has nothing to do with either counting votes or certifying official results. 

Dave Bittner: And finally, if election night reporting sites experience an outage, then some people think that vote counts will be lost or manipulated - not at all. If we can take away anything from yesterday's commentary at CISA, it's that election night results aren't official, and reports by news media are, if possible, even less official. 

Dave Bittner: Where is CISA getting its rumors and replies? They developed them during the exercises they ran before the election to explore and prepare for the kinds of problems the agency might encounter before, during and after the voting. It's another illustration of the value exercises and wargaming can hold for cybersecurity. 

Dave Bittner: The Maze gang may have taken down its shingle, but the members of its affiliate network haven't been slow to adopt another ransomware strain. ZDNet says they're migrating to the ransomware-as-a-service option Egregor, itself a spinoff of Sekhmet. According to Devdiscourse, CERT-India has published an alert warning organizations in that country to expect a rise in Egregor infestations. 

Dave Bittner: Data from the criminal data clearinghouse Cit0day, itself taken down in mid-September, has, according to ZDNet, leaked online, exposing some 26,000 hacked databases. 

Dave Bittner: And finally, two more eBayers, both executives, were indicted yesterday on 15 counts related to the alleged stalking, witness tampering and destruction, alteration and falsification of records during the harassment of the EcommerceBytes mom and pop newsletter. James Baugh, formerly eBay's senior director for safety and security, and David Harville, formerly eBay's director of global resiliency, were two former executives named, Silicon Valley Business Journal reports. 

Dave Bittner: To what degree do you anthropomorphize your personal digital assistants? Does there come a point when your automation tools, your assistant in your mobile phone or your robot vacuum cleaner need to have their own online personas and credentials? It sounds like an odd question to ask, but it's the kind of thing the folks who are in the business of managing online identities have to think about. Alan Radford is regional CTO at One Identity. 

Alan Radford: When you look at how much we have in common with technology, it's important to understand that we as an employee have an "owner," quote-unquote, which would be our manager. We have a line of reporting. A robot doesn't necessarily have that. 

Alan Radford: So when we think about identity in the context of a virtual identity, there still needs to be a sense of ownership, but it's a little bit different than that, OK? Ownership, accountability - interchangeable in the robot conversation because somebody's always pulling the strings. If I go off and I do something noncompliant, I might answer for that - OK? - or my boss might answer for it, depending on what happens. If a robot does something noncompliant, well, is it doing something noncompliant because it made the decision to do that, or is it doing it because somebody pulled the wrong strings, or it was configured to do it? And so that sense of ownership still comes into play. 

Dave Bittner: So where do you suppose we're headed then? In terms of these virtual assistants and the need for them to have their own identities, where do you see things going? 

Alan Radford: I see things going in a more holistic sense, you know? When you create these robots, everything the robot needs to do in order to perform its task gets created as well. So you think about - thinking about an employee. Employee gets given some accounts, AD (ph) accounts and so on. They would use those accounts and go do some stuff. When a robot's created, robot also gets given accounts to go and do some stuff. 

Alan Radford: But the way in which robotic architecture works means that, typically, virtual machines get spun up for - in order for the robot to architecturally do what it needs to do. The arms and legs of the robot, if you will, get spun up in the form of VMs around an organization. And that's why we see more and more RPA DevOps pipelines popping up here, there and everywhere. RPA tends to filter into those DevOps pipelines. 

Alan Radford: So I see it going very firmly in the direction of AI, and I think the identity market has a challenge before it, which is to keep up with that rate of change. The rate at which robots are created and destroyed and, indeed, execute their tasks is - I'll use the word infinitely. The pedants out there may disagree, but for the purposes of conversation, it may as well be. Infinitely faster than a human employee can. 

Alan Radford: You know, we don't enlist them in HR. We don't go through employee legislation. They don't have any rights. There's no need to pay them, OK? There's no vacation. There's no sick leave. There's no morale. There's no culture, OK? And increasingly, those workloads that they're taking on leave things by the by, you know? 

Alan Radford: How many of those robots are using cryptography keys? When those robots are destroyed, what happens to those keys? When the robots are destroyed, what happens to the accounts they were using? Does anybody know? 

Alan Radford: And in the conversations that I've been having in industries all around the world - you know, I spent time in Australia, North America, and I'm here (ph) - it's normal to say - do you know what? - I haven't got a clue. It's a normal thing, and that's not just for virtual identities or robots. It's the same for people as well. That's why the identity access management industry is a thing. 

Alan Radford: So it is important to consider that when you look at creating robots, how those robots are handled in your organization, who owns them, how are they governed - being able to answer those fundamentally basic questions if they were a normal employee, that's the grounding force that's going to see us win out over the robots when it eventually comes to that. 

Dave Bittner: That's Alan Radford from One Identity. 

Dave Bittner: And joining me once again is Joe Carrigan. He's from the Johns Hopkins University Information Security Institute and also my co-host on the "Hacking Humans" podcast. Hello, Joe. 

Joe Carrigan: Hi, Dave. 

Dave Bittner: We've been tracking these developing stories about hospital systems who've been hit with ransomware. And I wanted to check in with you, get your take on this. What are your thoughts here, Joe? 

Joe Carrigan: This is interesting. The FBI and the Department of Health and Human Services and the Department of Homeland Security have all been warning people in the medical industry that there is a concerted effort to attack hospitals with ransomware. 

Joe Carrigan: Now, do you remember last month in September when Graham Cluley reported on the - we had a story about the ransomware attack on the German hospital... 

Dave Bittner: Right. 

Joe Carrigan: ...That was inadvertent? And they said, hey, you attacked a hospital. And the people were like, oh, well, here are the keys - bye. And I was like, well, that seems like these guys reached beyond what they were going for, but I don't think that's going to be something that's very common among these ransomware criminals. 

Joe Carrigan: And here, now we have this gang, this Ryuk gang, targeting hospitals. And they're a Russian gang. And it seems to me that this timing is a little bit on the nose, isn't it? You know, they're... 

Dave Bittner: (Laughter) To create more chaos in the midst of an election season? 

Joe Carrigan: Exactly. I mean, this - as we're recording this, it's a few days from the election, and this is going to keep a lot of people very busy. I don't know if this is part of some larger election operation on behalf of the Russian - because we know these Russian cyber gangs operate with some understanding from the government that as long as they don't attack Russian assets, that they're fine to do this. 

Dave Bittner: Yeah. 

Joe Carrigan: And there may be some quid pro quo on that from the Russian government, like, hey, when we need you to do something, you'll do it. 

Joe Carrigan: So University of Vermont is one system that's already been hit with this. Interesting, though, is that the head of their medical center has said he hasn't received a ransom demand... 

Dave Bittner: That is interesting. 

Joe Carrigan: ...While there have been two other groups, health care systems in the U.S. that have been hit, and the criminals have demanded $1 million apiece from them. 

Dave Bittner: You know, it makes me think about kind of the consolidation that we've seen over the past years, a decade or so, with some of these hospital systems. 

Joe Carrigan: Yep. 

Dave Bittner: This affects you and I locally. Of course, you're with Johns Hopkins. Johns Hopkins has a very well-known, well-respected hospital system. And... 

Joe Carrigan: Yes, they do. 

Dave Bittner: ...Our local hospital here, where you and I live in Howard County, a while back became part of the Johns Hopkins system. 

Joe Carrigan: Yes, and it's a good hospital. 

Dave Bittner: Yeah, it's a great hospital. But it strikes me that there's a peril here, a potential peril in that when they hitch their wagon to the larger Hopkins mothership, well, I'm guessing there's some connectivity there between those systems. 

Joe Carrigan: I'm sure there is. There's two sides of this coin. There is the diversity argument that you're making, right? 

Dave Bittner: Right. 

Joe Carrigan: That if we have more people spread out, then when a system gets hit - like one health care system gets hit, it won't be as bad for everybody in the community. But there's also the consolidation argument that by consolidating, we can pool our resources and build a better security program because we have more money to do it, which a smaller health care system may not have. 

Dave Bittner: Right. 

Joe Carrigan: So I don't think that one argument is more valid than the other. But there - you know, I don't know that - you know, I'm not a big fan of large consolidations in any market. I think that can be bad, but that's neither here nor there for a security reason. 

Dave Bittner: Yeah, I guess it's a shame that there can't be more international diplomacy. And who knows what's going on behind the scenes? But for governments to have influence over other governments to say, hey, look; knock it off. 

Joe Carrigan: Right. 

Dave Bittner: You know, medical facilities are out of bounds, just like in war, right? 

Joe Carrigan: Right, exactly. 

Dave Bittner: You know, you don't bomb hospitals, so... 

Joe Carrigan: That's why those hospitals have big red crosses painted on top of them with white backgrounds... 

Dave Bittner: Right. 

Joe Carrigan: ...So that there is no mistake in that you're going to be targeting a medical facility. This is - that's an excellent point, Dave. This is exactly the same thing. These people are actively targeting hospitals and going after them. And maybe we should say to the Russians, you know, why don't you round some of these guys up and stop this from happening? 

Dave Bittner: Yeah, yeah. It just seems - I don't know. I guess in a better world, some things would be out of bounds. But it doesn't... 

Joe Carrigan: Yeah. 

Dave Bittner: ...Seem to be the world that we're in at the moment. 

Joe Carrigan: I don't know how cooperative the Russians would be with that request, though. Probably not very. 

Dave Bittner: No, but, you know, by what other means could we convince them that it's in their best interest to apply pressure to the folks who are doing this? It's one of those things that I suppose the folks who are handling foreign policy in the big picture - I'm sure it is on their radar. But as this becomes a more immediate and proximate thing - right? - like... 

Joe Carrigan: Right. 

Dave Bittner: ...As more and more hospitals get hit, the - our representatives are going to have to respond. They're able... 

Joe Carrigan: Yes. 

Dave Bittner: ...To have no choice. 

Joe Carrigan: Yeah. 

Dave Bittner: As people - as lives are lost, there will be - they will have no choice but to respond to this. And it'll be interesting to see how that plays out in something like this that is happening across borders. 

Joe Carrigan: Yeah, yeah. It's certainly interesting times, Dave. 

Dave Bittner: Yeah, absolutely. All right, well, Joe Carrigan, thanks for joining us. 

Joe Carrigan: It's my pleasure. 

Dave Bittner: And that's the CyberWire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. And for professionals and cybersecurity leaders who want to stay abreast of this rapidly evolving field, sign up for CyberWire Pro. It'll save you time and keep you informed. It walks downstairs alone or in pairs. Listen for us on your Alexa smart speaker, too. 

Dave Bittner: The CyberWire podcast is proudly produced in Maryland out of the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technologies. Our amazing CyberWire team is Elliott Peltzman, Puru Prakash, Stefan Vaziri, Kelsea Bond, Tim Nodar, Joe Carrigan, Carole Theriault, Ben Yelin, Nick Veliky, Gina Johnson, Bennett Moe, Chris Russell, John Petrik, Jennifer Eiben, Rick Howard, Peter Kilpe. And I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.