Patches, passwords, wipers, and pseudoransomware. New fronts in hybrid war? KONNI, OnionDog, and Israbye.

Dave Bittner: [00:00:00:09] The CyberWire podcast is made possible by listeners like you who support us through our Patreon page. You can learn more at patreon.com/thecyberwire.

Dave Bittner: [00:00:13:06] Patch Tuesday sees Windows and Adobe fixes. Venezuela's civil conflict gets a hacktivist dimension. Anti-Israeli wiper malware is circulating in the wild. Kaspersky Lab expects to see more pseudo ransomware, especially when disruption is the goal. The KONNI RAT of unknown origin sniffs at sites associated with North Korea. The HBO hack remains under investigation. Putin turns his attentions to Georgia. And familiar password advice gets jettisoned.

Dave Bittner: [00:00:48:05] A few words from our sponsors at E8 Security. If you've been to any security conference over the past year, you've surely heard a lot about artificial intelligence and machine learning. We know we have. But E8 would like you to know that these aren't just buzz words, they're real technologies and they can help you derive meaning from what an overwhelmed human analyst would see as an impossible flood of data. Go to e8security.com/ai-ml and let their White Paper guide you through the possibilities of these indispensable emerging technological tools. Remember, the buzz around artificial intelligence isn't about replacing humans, it's really about machine learning, a technology that's here today. So see what E8 has to say about it. They promise by the way that you won't get a sales call from a robot. Learn more at e8security.com/ai-ml. And we thank E8 for sponsoring our show.

Dave Bittner: [00:01:49:00] Major funding for the CyberWire podcast is provided by Cylance. I'm Dave Bittner in Baltimore with your CyberWire summary for Wednesday, August 9th, 2017.

Dave Bittner: [00:01:59:10] Yesterday was Patch Tuesday and both Microsoft and Adobe issued a large number of critical patches to their products. The Adobe fixes addressed problems with Acrobat, Reader and Flash Player. Most observers recommend that users of Acrobat and Reader devote their attention to updating the software for those two products. They continue to recommend that you disable and move away from Flash Player, scheduled for final retirement by Adobe in 2020. It's a perennial target of attackers and as useful as Flash was back in the day, it's reached the end of its useful life.

Dave Bittner: [00:02:32:22] Microsoft's patches, 48 of them in total, affect Windows, Internet Explorer, Edge, the subsystem for Linux, Kernel, SharePoint, SQL Server and Hyper-V. The vulnerabilities being fixed don't appear to be undergoing exploitation in the wild, but some of the patches are sufficiently important that they should be applied as soon as possible. Experts concur that CVE-2017-8620, a Windows Search Remote Code Execution Vulnerability, is the big one. They think applying it should be a priority.

Dave Bittner: [00:03:04:03] Venezuela's ongoing political and economic crisis has prompted not only fighting but some credible allegations of government vote fraud in the elections that put in place an extra-parliamentary group charged with rectifying the constitution. It's also prompted some rebel hacking. According to reports, a hacktivist group associated with the rebels has conducted cyberattacks against sites in that country. Most, but not all, of the affected services belong to the Venezuelan state. The group claiming responsibility calls itself "the Binary Guardians."

Dave Bittner: [00:03:39:23] Researchers at security firm Intezer describe an anti-Israeli, pro-Palestinian wiper malware "Israbye" that's currently circulating in the wild. It's not cryptoransomware since it offers no prospect of file recovery until such time as Israel's disappearance, in their words, effectively of course no prospect of recovery at all. It also doesn't encrypt files. Rather it replaces their content with anti-Israel messages. The wiper began circulating around the time Israeli authorities imposed certain restrictions on visits to the Temple Mount and the Al Aqsa Mosque situated there. Metal detector installation was found particularly objectionable by Muslim worshipers. The restrictions were quickly eased but the malware continues to circulate.

Dave Bittner: [00:04:27:10] It's not exactly ransomware, despite some gestures in that direction, nor is it pseudo ransomware like NotPetya, but Israbye does bear a family resemblance to that style of attack. Kaspersky Lab's quarterly report concludes that we should get used to pseudo ransomware. It's a proven attack method now, given the success of NotPetya and it's going to continue to be attractive to both governments and other threat actors of unclear motivation and dubious provenance. Where disruption is the goal, as opposed to theft, pseudo ransomware has shown that it can answer the bell. TechCrunch calls the technique "a wolf in wolf's clothing," and that seems to be a fair assessment.

Dave Bittner: [00:05:06:19] The remote access tool KONNI has been linked to the DarkHotel threat group by researchers at security firm Cylance, which has observed KONNI activity against North Korean targets, since that country's latest rounds of missile tests. Neither KONNI nor DarkHotel have been attributed yet.

Dave Bittner: [00:05:25:04] Such attribution is of course famously difficult. One attack, "OnionDog," thought by many to have been a targeted attack against South Korean targets, turns out, according to Trend Micro, to have been a Republic of Korea cyber drill.

Dave Bittner: [00:05:40:07] When an organization suffers a cyber security breach whose job is on the line? That's one of the questions the folks at Tripwire wanted to answer with their Infosecurity Europe 2017 survey. Tim Erlin is VP of Product Management and Strategy at Tripwire.

Tim Erlin: [00:05:56:06] 40% pointed out that they, they believe the CEOs were the first on the, on the firing line if a company was compromised, followed by the Chief Information Security Officer, the CISO, at 21%. And then interestingly other came in at 15% and the CIO came in at 14%, just slightly below other in that case.

Dave Bittner: [00:06:14:00] And do you think this represents sort of shifting attitudes towards these kinds of things?

Tim Erlin: [00:06:19:11] It certainly does. I've been in this industry for close to 20 years at this point and I would certainly say if you go back in time, there would be very few people ten years ago, 15 years ago, who would have said that the CEO is responsible or likely to, to have a material consequence to their job if a breach were to have occurred. So it definitely represents a shift in attitude.

Dave Bittner: [00:06:42:21] And how are we seeing this play out in the real world? Are we seeing consequences for board level folks?

Tim Erlin: [00:06:47:23] Well, we certainly have. We've seen a consequence at Target specifically. We also saw Marissa Mayer, the CEO of Yahoo!, who forfeited her cash bonus following a breach. That breach also affected the acquisition of Yahoo!, as well. So it's not just CEO level effects that breaches have, it also goes beyond that to other material impacts.

Dave Bittner: [00:07:10:23] Were there any surprises that came back from the results of the survey?

Tim Erlin: [00:07:14:05] You know, I think that that CEO piece was-- that result was interesting. I'm not sure I would call it surprising, but interesting. There was another question in the survey around tools and technology and we came out with 75% of security professionals don't believe that buying all the available security tools would fully protect their organizations. That was an interesting result as well, indicating that, you know, solving the problems with cyber security aren't just about implementing technology, it's really about the people and process involved as well.

Dave Bittner: [00:07:44:12] So what are the takeaways for you and with this information gathered from the survey, what kinds-- what kinds of advice do you have for folks?

Tim Erlin: [00:07:51:20] With this survey in particular and the result around accountability and responsibility, I think the key there as a takeaway, if you're, if you're in information security as a practitioner, the job that you have to do on a day-to-day basis should have, needs to have, and often does have board level visibility. So if you're in information security and you believe that you're insulated from, from impacting the business or that your actions don't have that kind of an impact for your organization, your attitude needs to catch up with reality today.

Dave Bittner: [00:08:25:12] That's Tim Erlin from Tripwire. You can find more results from their Infosecurity Europe 2017 survey on their website.

Dave Bittner: [00:08:34:13] Investigation into the HBO hack and extortion continues with both Mandiant and the FBI involved. Many in the security industry see the media as a relatively attractive target for hackers and the entertainment industry has seen enough in the HBO affair to be spooked.

Dave Bittner: [00:08:51:18] Russia has been playing effectively at hybrid war for some time, most intensely in Ukraine. There are however other targets in the Near Abroad, that is in now-independent former republics of the Soviet Union. Tuesday was the ninth anniversary of the Russian war that separated the Georgia provinces of Abkhazia and South Ossetia and effectively joined them to Russia. Russian President Putin marked the occasion by visiting Abkhazia. His visit also comes a week after US Secretary of State Tillerson visited Georgia during a period that's seen renewed talk of Georgian adherence to NATO. This may signal a shift in hybrid war to the Caucasus. Let Georgia look to its networks.

Dave Bittner: [00:09:34:18] Finally, remember all that advice about making strong passwords and changing them frequently? It started back in 2003 with NIST Special Publication 800-63, specifically with Appendix A, which advised such password building practices as irregular capitalization, including at least one numeral and throwing in some special characters perhaps in lieu of a letter. And it also advised changing passwords frequently. Well, it turns out it was all a big mistake and an unfortunate misunderstanding. The author of Appendix A, retired NIST expert Bill Burr, and we hasten to say that he is one of the good guys, now regrets his advice, most of which NIST jettisoned back in June. The advice drove people to lazy practices and tended to lead them to devise passwords that are hard for people to remember but easy for machines to crack. So the advice now, the current state of thinking, is to base your password on some idiosyncratic short phrases you'll find it easier to lodge in your human mind, but that would befuddle Skynet. Correct Horse Battery Staple. That one's taken but something like that.

Dave Bittner: [00:10:45:20] A quick word about our sponsor, next month's Cybersecurity Conference for Executives. The Johns Hopkins University Information Security Institute and COMPASS Cyber Security will host the event on Tuesday, September 19th in Baltimore, Maryland, on the Johns Hopkins Homewood Campus. This year's theme is emerging global cyber threats but the conference's mission remains the same. COMPASS and The Johns Hopkins University want to raise awareness and help you reduce your risk of a data breach. Register and get more details at thecyberwire.com/jhucompass. Learn more about the current and emerging cyber security threats to organizations and how executives can better protect their enterprise's data. A distinguished group of experts from a range of legal, technical, policy and engineering disciplines will lead what promises to be a lively conversation. Check out the details at thecyberwire.com/jhucompass. And we thank the Cybersecurity Conference for Executives for sponsoring our show.

Dave Bittner: [00:11:48:18] And I'm pleased to be joined once again by Johannes Ullrich, he's the Dean of Research at the SANS Technology Institute and he also hosts the ISC Stormcast podcast. You know, we talk about two factor authentication and how in general it is a good idea. You have some thoughts on how to make sure you're picking the right one.

Johannes Ullrich: [00:12:06:08] Yes, there are many, many different options when it comes to two factor authentication and not all of these options are really equally strong. For example, NIST recently published some widely discussed guidance that SMS messages should not really be used for two factor authentication. The problem here is that it's not all that difficult for a criminal to convince a phone company to redirect phone calls for a specific number to a new phone so that can be used to gain access to these SMS tokens. The strongest token that you can probably have are these hardware tokens that you actually keep on your keychain. The problem here again is that this just doesn't scale. How many of these tokens are you going to carry around with you and they are also somewhat expensive? So what you really have to do is, based on the risk that you think this particular application is exposed to, you have to pick the right two factor authentication mechanism. SMS, that may be fine for a lower value account. You have soft tokens, like you typically implement via Google's authenticator application. They're not bad but again they can be copied without the user really realizing that they're being copied, in particular if the user does store the secret for these tokens in an insecure manner. And then, yes, you do have the hard tokens that are the most secure but also most expensive and most cumbersome technology. So anywhere on this scale you have to pick the right one and also don't forget how you are going to deal with a lost second factor. That's often a weakness just like password recovery is often a weakness for traditional password authentication.

Dave Bittner: [00:14:01:12] What about biometric factors like touch ID on iOS?

Johannes Ullrich: [00:14:06:09] Touch ID on iOS is a great way for authentication but its application is a little bit limited, in the sense that it only works with native applications. I haven't really seen a good biometric authentication for web applications for example and they probably at this point pose the largest risk. Yes, there are ways to bypass some of these biometrics with like these replicated fingerprints and the like, but overall they do provide a meaningful second factor, just there are no APIs to use for web based applications.

Dave Bittner: [00:14:42:16] Overall would you say that having any form of two-factor is better than nothing at all?

Johannes Ullrich: [00:14:46:15] Yes, definitely two-factor is better than just a user name and a password. Just remind your users that it's still two-factor, so having the second factor doesn't mean that you necessarily should get sloppy on your passwords.

Dave Bittner: [00:15:02:15] Alright, Johannes Ullrich, thanks for joining us.

Dave Bittner: [00:15:07:03] And that's the CyberWire. For links to all of today's stories along with interviews, our glossary and more, visit thecyberwire.com. Thanks to all of our sponsors who make the CyberWire possible, especially to our sustaining sponsor Cylance. To find out how Cylance can help protect you using artificial intelligence, visit cylance.com. The CyberWire Podcast is produced by Pratt Street Media. Our editor is John Petrik. Social media editor is Jennifer Eiben. Technical editor is Chris Russell. Executive editor is Peter Kilpe. And I'm Dave Bittner. Thanks for listening.