Lazarus Group is back, phishing in English. Extremist content online. Google cleans up SonicSpy. Arrests for HBO hacking are unrelated to "Mr. Smith." Marcus Hutchins is out on. DJI drones get a security makeover. Help desk scams.

Dave Bittner: [00:00:01:08] If you are a fan of the CyberWire, the best way you can show your support is by going to patreon.com/thecyberwire and signing up to become a regular supporter. Thanks.

Dave Bittner: [00:00:14:07] Lazarus Group is back, and now they're phishing in English. The Daily Stormer gets the boot, but companies and governments continue to struggle with developing appropriate responses to extremist content. Google has swiftly cleaned up SonicSpy, but the malware is still circulating outside the Play store. Indian police make four arrests for HBO hacking, but none of them are related to "Mr. Smith." Marcus Hutchins is out on bail and preparing for an October trial. DJI drones get a peacemaking makeover. Plus we've got one weird trick to recognize that a call is a help desk scam.

Dave Bittner: [00:00:52:09] We've got a message from our sponsors at E8 Security. They understand the difference between a buzz word and a real solution and they can help you disentangle them too, especially when it comes to machine learning and artificial intelligence. You can get a free white paper that explains these new but proven technologies at e8security.com/ai-ml. We all know that human talent is as necessary to good security as it is scarce and expensive, but machine learning and artificial intelligence can help your human analysts scale to meet the challenges of today's and tomorrow's threats.

Dave Bittner: [00:01:24:12] They'll help you understand your choices too. Did you know that while we might assume supervised machine learning, where a human teaches the machine, might seem the best approach, in fact, unsupervised machine learning can show the humans something unexpected. Cut through the glare of information overload and move from data to understanding. Check out e8security.com/ai-ml and find out more, and we thank E8 for sponsoring our show.

Dave Bittner: [00:01:59:19] Major funding for the CyberWire podcast is provided by Cylance. I'm Dave Bittner in Baltimore with your CyberWire summary for Tuesday, August 15th, 2017.

Dave Bittner: [00:02:10:18] Palo Alto Networks yesterday released an update on Lazarus Group activity against US defense contractors. The threat actor, by consensus a cat's paw for North Korean intelligence services, is distributing espionage tools using malicious Microsoft Office documents. The latest Lazarus Group operations exhibit a shift in targeting: they're now prospecting English as opposed to Korean speakers.

Dave Bittner: [00:02:35:05] The documents are poorly crafted and badly proofread, but once they've been opened, they've delivered their payload, so mad proofreading skills probably aren't going to protect the unwary targets. Besides, according to Palo Alto, some of the phishbait text, position announcements and so on, seem to have been copied verbatim from legitimate corporate websites, warts and all, so misspellings are in the source material being spoofed as well.

Dave Bittner: [00:03:01:01] After the weekend's riots and homicide in Charlottesville, various hosting providers, including GoDaddy, Google, Zoho, and Discord, have booted the Daily Stormer neo-Nazi publication from their services. The Stormer says Anonymous has attacked its sites, but Anonymous officially denies doing so, insofar as an anarchist collective can have an official voice. And they say the Stormer is just putting a brave face on its inability to find anyone to host its material. The providers who've cut the Stormer off are citing terms-of-service violations.

Dave Bittner: [00:03:34:13] The problem here is, of course, analogous to what's seen with violent extremist inspiration elsewhere. Few are likely to shed many tears for either the Daily Stormer or al Qaeda's Inspire magazine, but it's proven difficult for either governments or corporations to constrain objectionable material without restricting free speech or breaching expectations of privacy. Facebook, for example, is currently receiving criticism from observers who argue that the social medium's attempt to regulate problematic content are silencing the sorts of marginalized communities Facebook ought to be helping.

Dave Bittner: [00:04:08:10] There are few such second thoughts, of course, over content moderation in, for example, China or Saudi Arabia. The Kingdom of Saudi Arabia has announced plans to indict a group of "radical" Twitter users. They are, interestingly enough, radical Sunnis who are charged with harming public order by their hard line stance toward Shiites, whom they, like the Saudi regime, regard as heretical. Thus the tweeters being hit are effectively more Wahhabi than the Wahhabi.

Dave Bittner: [00:04:37:20] A version of the tension between public safety and privacy or free speech, a tension whose equilibrium former US FBI Director Comey used to refer to as "ordered liberty", continues to play itself out in the crypto wars running with various degrees of intensity in the Five Eyes. For now, the pro-encryption side seems ascendant in the US, the anti-encryption side in at least three of the four Commonwealth eyes. Anyone who knows how things stand in New Zealand should drop us a line.

Dave Bittner: [00:05:07:08] There's no question that enterprise collaboration tools like Slack, Yammer or Microsoft Teams have grown in popularity in recent years, providing a faster, more efficient method than email for sharing ideas and files in the workplace. But what about potential vulnerabilities? Jeff Schumann is CEO at Wiretap, a company that provides monitoring and protection for these enterprise social networks.

Jeff Schumann: [00:05:30:00] The reality of it is, is when you have so much information flooding across each one of these messaging channels - I mean, we're talking about millions and billions of interactions happening across the enterprise industry on a regular basis - you're bound to have bad things happening, and what I think organizations are starting to want to do is get ahead of the problem. They want to leverage the technology in a way that helps them be more preventative, around issues that are suddenly propagating throughout the market.

Jeff Schumann: [00:05:58:01] I think organizations want to get ahead of it, and manage it more effectively and say "Hey look, we know we have a ton of people collaborating and we know for the most part that 99 percent are using the technology effectively, but how can we learn from it? How can we perhaps make sure that we can leverage some of the insight gained from looking at it across millions of interactions to maybe prevent a scenario that has happened at Uber, or even Google, which we've seen across the last few days?"

Dave Bittner: [00:06:24:21] And so what kind of recommendations do you all have for how best to protect yourself while still being able to use these kinds of technologies?

Jeff Schumann: [00:06:33:03] Well, I look at it very similar to how we've looked at email. We've had monitoring and security technologies for email for the past two dozen years and, for the most part, employees use email to get your job done and communicate with partners and collaborate effectively. But now with this new evolution of technology, and we're starting to see new messaging platforms find their way into the enterprise space, we're looking for that same level of comfort that we've had with email.

Jeff Schumann: [00:07:00:13] Our recommendation is you want to get ahead of it by putting something in place, whether it's processes or technology that can bring a level of comfort and control that you're looking for, or visibility into how your employees are using the new messaging technologies, that can achieve what it was that you were achieving with email. Beyond that, what if you can actually learn from their usage? What if you can be a better company by identifying issues before they've ever become issues, and getting ahead of it and getting ahead of perhaps sexual harassment in the workplace or gender discrimination, and so on and so forth? What if you can thwart it, and end it and protect your reputation before these events ever escalate?

Jeff Schumann: [00:07:38:15] We have to create value, or the providers have to create value for the employees themselves, meaning can we help you be more effective as an employee? Can we help you communicate more? Can we give you a bigger voice within the board room because the conversations that you're having in a public water cooler, on a public slack channel that existed among millions of other interactions, weren't raised to the right attention at the right level of your organization?

Jeff Schumann: [00:08:01:12] What if a technology stack was able to do that for you? And, I think, if you start to do that, then you start to bring value back to the employees themselves and that's when others are willing to look at the privacy matter a whole different way than they do today. The insight you can gain from suddenly really understanding how your employees collaborate and communicate on a regular basis is an incredibly important aspect of any security technology entering this space, and you have to be able to deliver that behavioral insight back to the organization. You have to actually add value, not just reduce risk.

Dave Bittner: [00:08:36:24] That's Jeff Schumann, he's from Wiretap.

Dave Bittner: [00:08:41:20] Google gets good reviews for cleaning the Play store of SonicSpy infestations, but the Android malware is still out and active, infecting users from other sources. The three versions of the malware most often seen circulating in the wild are Soniac, Hulk Messenger, and Troy Chat.

Dave Bittner: [00:08:59:12] To avoid infection, Android users should avoid apps with a low, or even no reputation. They should also keep their devices patched and up-to-date. And finally, the easiest bit of advice to follow: stay away from third-party stores and stick with Google Play.

Dave Bittner: [00:09:15:03] Police in India have made four arrests in connection with the release of a pirated Game of Thrones episode. This case is unrelated to the recent hacking of HBO by "Mr. Smith." That case remains under investigation. HBO is said to be determined to pay "Mr. Smith" nothing. Perhaps "Mr. Smith" should have taken HBO up on their early attempt to treat "Mr. Smith" as a bug-bounty hunter.

Dave Bittner: [00:09:38:22] Marcus Hutchins, out on bail after his not-guilty plea in a Wisconsin court yesterday, is also back online. He's communicating with his many fans and working insofar as he can. His mood seems upbeat, at least as he presents himself online. He noted, for example, that getting arrested by the FBI was on his to-do list for his Black Hat trip. But he's not going to be permitted to leave the USA before his October trial. He's surrendered his passport and is wearing a GPS tracker, and he's not permitted to access the server from which the US Government alleges he worked on Kronos.

Dave Bittner: [00:10:13:21] Drone-maker DJI says it's installing a "local mode" for users sensitive about the company's data collection practices. The US Army, no longer a customer, was one such user until a directive from G3 told all units to stop using DJI gear at once. It remains to be seen whether DJI's modifications will mollify the gatekeepers at the Aberdeen Proving Grounds.

Dave Bittner: [00:10:38:13] And finally, major IT and security companies are offering tips on how to recognize a "help desk scam." You know, those calls that come in to you at home letting you know that there's a problem with your computer, and that the caller can fix it if you give them your credentials, allow them remote access, and pay them a fee. Here's the tip. They called. No legitimate company will charge you for help, nor will they ask to "take control of your computer". Nor, in fact, will they call you out of the blue offering help if you haven't called them first. So that's news you can use. It's galling when they're calling, so for it, don't be falling.

Dave Bittner: [00:11:20:10] Now I'd like to tell you about an upcoming webinar from our sponsor Delta Risk. With threats to the healthcare industry at an all time high, IT and information security professionals in hospitals, health care provider firms and insurance firms have more concerns than ever about patient data and business continuity. In the 45 minute webinar, Preparing for Cyber Risks to Health Care Operations: Be Ready, not Sorry, experts from Stanford Children's health, Delta Risk and Huntzinger Management Group will discuss essential elements of how to respond to a cyber attack and properly prepare a business continuity plan.

Dave Bittner: [00:11:55:10] Save the date for August 23rd at 1pm Eastern Time by visiting deltarisk.com/resources/webinars. Delta Risk LLC, a Chertoff Group company, is a global provider of cybersecurity services to commercial and government clients. Learn more about Delta Risk by visiting deltarisk.com and reserve your seat for this interactive discussion, and we thank Delta Risk for sponsoring our show.

Dave Bittner: [00:12:26:13] I'm pleased to be joined once again by Justin Harvey, he's the global incident response leader at Accenture. Justin, welcome back. You know, we've had these attacks like WannaCry, and we've talked about companies potentially being ready for these sorts of destructive attacks, and today you wanted to take us through some of the things that companies can do to help themselves prepare for the possibility of these sorts of things.

Justin Harvey: [00:12:47:24] Yes. The last few weeks and months, I think, have been a real game changer in the cyber defense market and actually around the world, because we're seeing large scale take-downs of organizations that have essentially had all of their operations brought down because they've been hit by some sort of destructive attack. And the first point I want to make here is that ransomware and destructive malware are very close together. The only difference is ransomware gives you the ability to recover those files. Destructive malware, of course, deletes it.

Justin Harvey: [00:13:24:11] Ransomware quickly becomes destructive malware in the event that there's no key or the ability to get a key. The way that organizations can prepare for this are clearly being able to have a strong business continuity and disaster recovery plan. But, I think, just like with all things human, none of us really, or at least I don't, like doing the things that I should, working out or doing the more menial rote tasks in our lives, and companies are suffering from the same thing.

Justin Harvey: [00:13:57:20] They've said a BCDR plan has really only been exercised maybe once a year, maybe once every couple of years, and they do scenarios where they say, "Okay, imagine if there is an earthquake and it takes a couple of machines off. We lose a data center." Well, imagine all of your data centers being down at the same time, and so you're going to start to see a revolution of unique BC and DR strategies and I know that they're out there, so I think that companies can help recover quicker by storing their data more in a warm format, or even hot, and utilizing technologies like the cloud.

Justin Harvey: [00:14:35:24] They can have better preventative controls by segmenting their network. We have seen that the insides of companies are really soft; there is very little access control. I think that companies have got into this mindset that they have these tall walls on their perimeter and therefore they don't need the traditional type of intrusion detection and prevention, firewalls and monitoring in place inside the environment. But it only takes one machine to be infected with either ransomware or destructive malware in order to propagate.

Justin Harvey: [00:15:13:04] As we've seen with Slash, this strain was particularly troublesome because at first it used EternalBlue so if, you know, machines were still running S&B V1 or hadn't been patched, it was able to get through that. But it was also masquerading or stealing the credentials, the identity of the victim and then blasting that out. So, if anyone had domain administrator privileges and were hit by this version of the destructive malware then, of course, it could rip through the environment. So that also speaks to having more fine grain controls around domain administrative privileges. And if you're out there and you're sis admin or you have domain admin and you're just reading your email on that account, I would say you might want to think about moving more toward service-based accounts rather than having that on your regular username.

Dave Bittner: [00:16:12:00] All right, good advice as always. Justin Harvey, thanks for joining us.

Dave Bittner: [00:16:17:09] And that's the CyberWire. Thanks to all of our sponsors who make the CyberWire possible especially to our sustaining sponsor Cylance. To find out how Cylance can help protect you using artificial intelligence, visit cylance.com. Thanks to all of our supporters on Patreon, we really do appreciate it.

Dave Bittner: [00:16:33:07] The CyberWire podcast is produced by Pratt Street Media. Our editor is John Petrik, social media editor is Jennifer Eiben, technical editor is Chris Russell, executive editor is Peter Kilpe and I'm Dave Bittner. Thanks for listening.