Careless criminals, Cisco mitigations, and Vault 7 disclosure conditions. A look at the Atlantic Council's Cyber 9/12. Cabin fever and malware infections. Kirk ransomware.

Dave Bittner: [00:00:03:14] Did careless cyber criminals working for the FSB blow the gaffe in the Yahoo! Hack? WikiLeaks offers to share Vault 7 vulnerabilities with vendors, but it wants something in return. A look at the Atlantic Council's recently concluded Cyber 9/12 competition. Does cabin fever increase the risk of being hacked? Enigma Software saw things during last week's unseasonable US weather that suggests it might. And Kirk ransomware is ready to beam into your enterprise.

Dave Bittner: [00:00:36:04] Time for a quick word from our sponsor, Dragos. Want to tell you about their new white paper, Insights Into Building An ICS Security Operations Center. Most SOCs were built by, and for, IT enterprises, but the needs of an OT operator, that's Operational Technology, well, they're different. Sure, there are security lessons OT can learn from IT, but if you operate networked industrial control systems, you have some distinctive mission needs that out-of-the-box SOCs are unlikely to address. The experts at Dragos walk you through the choices you'll be making as you build a security operations center that can keep your industrial infrastructure up and running. Go to Dragos.com and download their ICS SOC white paper now. If you get the SOC right from the beginning, you'll be saved many a future headache. So to get the right people, processes and technology in place, get started at Dragos. That's DRAGOS.com. And we thank Dragos for sponsoring our show.

Dave Bittner: [00:01:41:12] Major funding for the CyberWire Podcast is provided by Cylance. I'm Dave Bittner in Baltimore with your CyberWire Summary for Monday, March 20th, 2017.

Dave Bittner: [00:01:51:02] Amid the speculation about Vault 7's source in unknown, unspecified contractors, some observers are drawing a similar lesson about the Yahoo! Breach: the attribution that resulted in four indictments is thought unlikely to have occurred at all if Russian intelligence services hadn't relied on the services of third-party criminals. The criminals, especially the car buff arrested in Canada, got sloppy and got them all caught. The underworld might have its advantages as a source of deniable labor, particularly if you're not too morally fastidious, but then quality assurance has never been the mob's strong suit.

Dave Bittner: [00:02:27:13] To return to Vault 7, Cisco has been poring over the leaks and has issued warnings about a flaw that figures in those leaks: it affects some 318 switch models. They're working on a patch, but in the meantime they offer mitigations that users should take seriously. Chief among their advice is this: choose SSH over Telnet.

Dave Bittner: [00:02:48:20] WikiLeaks has offered to share vulnerabilities from Vault 7 with software vendors, but it has some conditions it says industry has been disappointingly slow to meet. It's unclear exactly what those conditions are (they're being disclosed directly to the companies in WikiLeaks' communications with them) but the conditions appear to include an undertaking to fix the vulnerabilities in question within ninety days of disclosure. A few outfits, notably Mozilla, seem to have agreed to play ball, but others, notably Google, have done nothing beyond acknowledging receipt of WikiLeaks' offer. WikiLeaks has indicated the consequences of failure to agree to terms. They're going to suggest that laggards are probably CIA stooges dragging their feet because of connections with the US Intelligence Community.

Dave Bittner: [00:03:34:04] The Yahoo! And Vault 7 incidents suggest the complexity and ambiguity common in cyberattacks, where intentions need to be imputed as much as malicious code needs to be attributed. Those conditions of uncertainty were prominently on display this past Friday and Saturday at the American University in Washington, DC, where the Atlantic Council and its partners held their Cyber 9/12 competition. Cyber 9/12 is a contest for student teams that differs from the more familiar capture-the-flag competitions in that its focus is on the development of technically informed policy recommendations.

Dave Bittner: [00:04:08:15] More than 40 teams drawn from 33 universities competed. Each four-person team was assigned the role of junior staffers briefing the US National Security Council with policy recommendations, developed in response to an ambiguous, yet clearly serious, crisis in Sino-American relations. The scenario went roughly as follows. Set in 2018, and notionally occurring between August 29th and September 5th of that year, the fictional situation described rising tensions between the US and China, already somewhat elevated by Chinese fears that US public statements hinted at a retreat from the longstanding One China policy. A major Chinese bank has come under successful distributed denial-of-service attack, and there are news reports that the botnets involved exploited deliberately induced bugs in open-source software. And there's speculation, US intelligence services caused vendors to leave those vulnerabilities in place.

Dave Bittner: [00:05:05:21] In the scenario, US investigation suggests the probability that Chinese criminal organizations and, maybe, North Korean Dark Seoul actors, were involved in the attack. The attack, however, seems to be spreading to US financial institutions, one of which has informed the Department of Homeland Security of its intent to hack back against the botnets. The bank will do this under the authorities granted private sector actors by The Cyber Marque and Reprisal Act of 2018.

Dave Bittner: [00:05:33:20] Unfortunately, as was gradually revealed, the hacking back may have affected devices, including medical devices, that use the BusyBox open-source code, and there are reports that this may have caused at least some medical crises, perhaps a few actual deaths, in China. Such problems are likely to spread to the US and elsewhere. China has communicated its strong outrage, both privately and publicly, blaming the US for, in effect, an attempted assassination as part of a larger aggression. And, finally, a US Navy unit, USS Blue Ridge, operating in the Western Pacific, has come under cyber-attack, with its C4ISR systems at least temporarily degraded.

Dave Bittner: [00:06:16:06] Of course, the National Security Council needs to present the President with some options, and doing so was each team's task. They gave a series of ten-minute briefings to panels of judges, playing the role of the National Security Council. Their proposals, developed under realistic conditions of limited time and limited information, were varied and interesting. Those teams that had clear, multidisciplinary capabilities seemed to fare best, but the level of competition as a whole was quite high, and the teams showed commendable levels of background knowledge.

Dave Bittner: [00:06:47:07] The winner, at the end of the two-day competition, was a team from the US Naval War College. Congratulations to them all, not only on being the overall winners, but also on their receipt of the Order of Thor from the Military Cyber Professional Association.

Dave Bittner: [00:07:03:03] Could bad weather increase your risk of malware infection? Security company, Enigma Software, saw some surprising things during winter storm Stella when the in-like-a-lion weather moved through the US Northeast last Tuesday. Compared to average numbers of infections in the days leading up to the storm, New York City jumped 83%, Boston 38%, Philadelphia 15%. But Pennsylvania as a whole outdid the City of Brotherly Love with a 79% spike. New Jersey 88%, Massachusetts 27%, and Connecticut, a whopping 91%. Why the spike is anyone's guess, but Enigma soberly notes that the vectors were email and, wait for it, visits to adult sites. So cabin fever may have some cyber implications. Hartford, we'd never have expected it from you, of all places.

Dave Bittner: [00:07:55:19] And, finally, there's a new strain of ransomware out there. It's being called Kirk, and its decryptor goes by Spock. Avast researchers, who first found it, were struck by the ransomware's obvious affinity with Star Trek themes. It's also interesting in that the extortionists are the first to demand payment in the form of the relatively new cryptocurrency, Monero, as opposed to the customary Bitcoin. So far there are no known victims, but also no known decryption tool. How the ransomware might spread is an open question, but Bleeping Computer notes signs that it may be masquerading as Low Orbital Cannon, a popular network stressor tool. In any case, we've been able to narrow the ultimate cultural source of Kirk to two points of origin, October 6th, 1966, or October 6th, 1967. Check out The Enemy Within and Mirror, Mirror. And if your away team encounters anyone wearing a variant Star Fleet uniform and a goatee, don't click. Just cite the Prime Directive, beam up, and live long and prosper.

Dave Bittner: [00:09:03:13] Time for a moment to thank our sponsor, Palo Alto Networks. You can visit them at go.paloaltonetworks.com/secureclouds. You know, businesses and their data are flocking to the cloud. It's no longer just a convenient place somewhere out there to store things. It's become a viable, integral part of almost all enterprise level organizations. Palo Alto Networks understands this and the fact that your data and applications are distributed across the private cloud, the public cloud, software as a service environments and any number of configurations in between. Make sure your data and apps are secure and protected, wherever they may be. Palo Alto Networks has the broadest, most comprehensive cyber security for private cloud, public cloud and SaaS environments, because secure clouds are happy clouds. So find out how to secure yours. Get started at go.paloaltonetworks.com/secureclouds. And we thank Palo Alto Networks for sponsoring our show.

Dave Bittner: [00:10:05:23] And it's my pleasure to welcome David Dufour to the show. He's the Senior Director of Engineering and Cyber Security at Webroot. They are our newest industry partner. David, welcome to the show.

David Dufour: [00:10:15:16] Thank you, David, nice to be here.

Dave Bittner: [00:10:17:14] Let's just start off with some introductions. First of all, tell us a little bit about Webroot.

David Dufour: [00:10:21:15] Webroot has been around for about 20 years now and their focus, primarily, over the first ten years of that time was kind of anti-virus, security, things like that. And then the last ten years, we've spent a ton of time building a large machine learning knowledge, focusing on threat intelligence, automating security for large enterprises. We usually get a market through OEMs. A lot of people have Webroot, don't even know it. And we've still maintained that focus on end point solutions, but we've really evolved that into some next generation security to keep up with the market and the threats that are out there.

Dave Bittner: [00:10:57:15] And how about yourself? What was your pathway to coming to Webroot?

David Dufour: [00:11:01:12] Back in the '80s, I was in the US air force, working on large scale systems, security and things like that. Run the gambit from being a low level system developer, through network security, that type of thing. So if computers went away tomorrow, I wouldn't have a job. And then my main focus over the last several years with Webroot, has been, again, really focusing down on machine learning, integrating, automation. I'm a huge proponent of automation and getting people to believe in letting machine models do that protection for them, so we can keep up with the bad guys and that's really where my focus is now, in things that I do here at Webroot.

Dave Bittner: [00:11:38:22] So take us through a typical day for you. What kind of stuff are you tackling there?

David Dufour: [00:11:42:13] Well, a typical day for me, I think if you asked anybody at the company what I do, no one would be able to tell you. There's days when, if there's nothing on fire and people aren't running around, I have a lot of equipment here, I play with things like Edisons. I have some routers and IoT devices that people ship to me, that I try to bang on, I try to take a look at, look at potential vulnerabilities. I'm looking at how do we take security over the next five years? With the proliferation of IoT devices, you're not really going to have the success of putting endpoint security everywhere, so we're spending a lot of time looking at moving security into the network.

David Dufour: [00:12:26:24] I spend a ton of time building ideas around machine modeling or dynamic agents to help protect smart cities and how we could plug that into the threat intelligence we have here now. So I spend a lot of time ideating. I honestly have the best job in the entire company. But then, some days, I get dragged into the day to day, because we have some things we've got to figure out, programmatically or design-wise in the current solution.

Dave Bittner: [00:12:52:03] Alright, it sounds like there's never a dull moment there. David Dufour, welcome to the show. We're looking forward to speaking to you again soon.

Dave Bittner: [00:13:00:16] And that's the CyberWire. For links to all of today's stories, along with interviews, our glossary, and more, visit thecyberwire.com. Thanks to all of our sponsors, who make the CyberWire possible. Especially to our sustaining sponsor, Cylance. To find out how Cylance can protect you from cyberattacks, head on over to Cylance.com. The CyberWire Podcast is produced by Pratt Street Media, our editor is John Petrik, our social media editor is Jennifer Eiben, our technical editor is Chris Russell, executive editor is Peter Kilpe, and I'm Dave Bittner. Thanks for listening.