Crypto wars updates. Iran vs. US in cyberspace. Big Angler malvertising campaign.

Dave Bittner: [00:00:03:15] High profile news sites are hit by an Angler-driven malvertising campaign. Developments in the cyber law fare ongoing between the United States and Iran. A hacktivist star outs himself and reflects on his career. Apple's ultimate filings in the iPhone case, say the government has shown neither necessity, nor technical comprehension. And some thoughts on business email compromise, wire transfers and lessons from the attempted heist at the Bangladesh Central Bank.

Dave Bittner: [00:00:31:07] This CyberWire podcast is made possible by the generous support of Cylance, offering revolutionary cybersecurity products and services that proactively prevent, rather than reactively detect, the execution of advanced persistent threats in malware. Learn more at Cylance.com.

Dave Bittner: [00:00:51:06] I'm Dave Bittner in Baltimore, with your CyberWire summary for Wednesday, March 16th, 2016.

Dave Bittner: [00:00:56:11] Some high profile sites, many of them news services, have been hit by a malvertising campaign. Among the sites infected are some belonging to the New York Times, the BBC, The Hill, News Week, AOL and MSN. Attackers, using the familiar Angler exploit kit are driving the campaign. Trend Micro, Trustwave and Malwarebytes noticed a spike in malicious traffic over the weekend and have been following the issue. Not all the payloads have been captured, but it seems clear that Angler's serving up ransomware, for the most part to users in the US. Trustwave and Trend Micro report seeing Bedep and TeslaCrypt ransomware. Malwarebytes is showing some of the rogue domains involved in the attacks, which it says, are affecting the Google, AppNexus, AOL and Rubicon advertising platforms. Defense and remediation are presumably underway. Malvertising harms at least three classes of victims, the affected sites, the users of those sites and the advertising platforms.

Dave Bittner: [00:01:50:02] We're still watching for the much-anticipated indictment of Iranian hackers for the 2013 cyber reconnaissance of the Bowman Avenue Dam in Rye, New York. There's speculation that the people facing indictment are the same ones behind Operation Cleaver, the campaign against regional airport security, Cylance broke in 2014. Iran itself hasn't been idle on the lawfare front either. A senior commander in the revolutionary guard says that they obtained 13,000 pages of data from devices carried by US sailors, captured when their riverine command craft was detained in Iranian waters on January 12th of this year. The devices scraped are said to be laptops and GPS systems. It's unclear what sort of information was extracted, but Iran says it's putting the data to good intelligence use. The Revolutionary Guard spokesman points out, airily and primly, that Iran returned the devices themselves (although it didn't have to) and that its extraction and use of the data they contained fall within Iran's rights under several international agreements.

Dave Bittner: [00:02:47:06] The Office of Inadequate Security publishes a long, interesting interview with Ghostshell, as the onetime hacktivist star continues his repentance and expiation tour. Ghostshell's real name is Razvan Eugen Gheorghe, he's 24, and he lives in Budapest. Ghostshell would do a lot of things differently, if he had to do it over again. He wouldn't, for example, join Anonymous, which he characterizes as divided into sincere believers on one side, with compromised hackers and false-flag law enforcement types on the other. He thinks its possible for both hackers and public representatives to rehabilitate themselves into legitimate jobs in IT or journalism. And he expresses guilt over having enriched security companies with the FUD he provided. But the main impression he leaves, is one of weariness, all is vanity and chasing the wind. One interesting bold (if paranoid) prediction, Gheorghe says he thinks the whole dark web will one day be revealed as the world's biggest honeypot.

Dave Bittner: [00:03:42:01] Password protection is an ongoing challenge for every organization and many firms have turned to multi-factor authentication or MFA, as a way of beefing up their barriers against intruders. Chris Webber is a security strategist at Centrify, where they offer a variety of MFA solutions. He says it's important that multi-factor authentication strike a reasonable balance.

Chris Webber: [00:04:01:16] We've got to make sure that the folks that are going to use it, have enough of a benefit from using it, understand their part and actually aren't tripping over it all the time. What we want is the ability to have multi-factor authentication everywhere, with policy and context and rule sets that are smart. And so they say, hey, if I have seen this person do this thing before, because the device I've seen before on my corporate network and the person has entered the appropriate password to get in, that'll be the challenge then, for multi-factor authentication, the likelihood is very strong that that is the actual user, it's supposed to be not a bad guy masquerading like that user. But, if suddenly, something's different and you see that it is that user, it is that device that I've seen before, but it's coming from a weird network, or a strange country, or an odd time of day or maybe it's a totally different device that we've never seen before. Maybe that's the right time to challenge for multi-factor authentication and say, hey, do me a favor, check for a text message on your phone that you should have, that I know about and let's make sure this is really new, or let me give you a phone call and you can authenticate one or two, yes, this is me, or, no, that wasn't me trying to log in.

Dave Bittner: [00:05:11:11] You can learn more at Centrify.com.

Dave Bittner: [00:05:15:06] Apple makes its last filings in the San Bernardino iPhone case before the case opens. The company says, first, that the Government is adept at devising new surveillance techniques and so hasn't shown the necessity of the help it's seeking from Apple. And, second, Apple says that the Justice Department's filings display a misunderstanding of the relevant technology, so fundamental, that it invalidates the Government's case

Dave Bittner: [00:05:36:24] The recent attempt on the Bangladesh Central Bank, foiled, we again note, by some alert proofreading at Deutsche Bank, should prompt enterprise introspection over authorization and security controls.

Dave Bittner: [00:05:47:21] Reflect too, on the current and growing popularity of business email compromise fraud, as an attack vector. All that glitters isn't gold and not every email that displays the CEO's name in the center field is in fact from, you know, Scrooge McDuck, Tony Stark, Daddy Warbucks, J. Jonah Jamison and so on. You get the picture. So stay safe with your emails out there, and just think of the happy possibilities you now have for creative, honorable insubordination, "Boss, I did see that email, but I thought I'd call you at home to double-check. Sure, I know it's 3:00 a.m., but better safe than sorry. Am I right, boss? Boss?" Your boss will understand. Or at least your boss may put some sensible controls in place, after your boss wakes up and has some coffee.

Dave Bittner: [00:06:35:01] This CyberWire podcast is brought to you by the Digital Harbor Foundation, a non-profit that works with youth and educators, to foster learning, creativity, productivity and community, through technology education. Learn more at digitalharbor.org.

Dave Bittner: [00:06:54:21] Joining me is John Petrik, editor of the CyberWire. John, we have the story about the dam in Rye, New York being comprised by Iranian hackers. The US is expected to hand down an indictment of those Iranian hackers. Since there's really no chance that these hackers are going to see justice, why is the US going through the effort of indictment?

John Petrik: [00:07:12:22] Let me offer a little context first. We're not talking here about the Grand Coulee Dam, we're not talking about a big hydroelectric dam, or some kind of massive threat of flooding, or a threat to the electrical grid. It's a flood control dam, it's the Bowman Avenue Dam. This has been traced to Iran, fairly definitively.

Dave Bittner: [00:07:31:15] Is there a sense that the Iranians wanted to be caught? Was this a warning that they wanted us to know that it was them?

John Petrik: [00:07:40:05] That's not clear, there's one Iranian activist group that's claimed credit for the intrusion, but as a number of cybersecurity companies have looked at that say, that's a group that's well-known for talking big, without really having actually done anything. So, did they intend for the US to see it? Senator Schumer, late last week, said that this was a shot across our bow, you know, he was there, speaking in front of the dam, visiting the dam, so on and so forth and Schumer of course, was calling for additional sanctions against Iran, in retaliation for this. But, take Schumer's metaphor seriously, if you take a shot across someone's bow, you're doing that so they'll notice, you want to send a message, you want to get them to pay attention. It's a lot like indicting someone, you can have no extradition treaty to get, right?

Dave Bittner: [00:08:26:14] It's absolutely right. And of course, to be clear, the hackers didn't actually change anything in the functioning of the dam, they didn't throw any switches. It was exploratory.

John Petrik: [00:08:35:04] Yes, far as we know that's true. Your question is, why do we bother indicting people like that, if we don't have any realistic prospect of actually bringing them in front of a US court. It's been longstanding US policy, to do what FBI director, Comey, calls, imposed costs on the creep behind the keyboard. If you can impose costs on individuals, if you can name and shame individuals, you may have some prospect, we think, that is the US government thinks, of altering international behavior. And then there's also always the chance, you might actually get one of these guys, US law enforcement authorities have certainly picked up Russian hackers abroad and places where they could get their hands on them, because as one FBI agent said at a meeting we were at, everybody wants to go on vacation every now and then and if you're living in Russia, maybe you want a honeymoon in some nicer place. And when you do, the famously dogged FBI is probably going to be there waiting for you. So these are some of the reasons why people would expect indictment.

Dave Bittner: [00:09:35:15] Alright, John Petrik, thanks for joining us.

Dave Bittner: [00:09:41:05] And that's the CyberWire. For links to all of today's stories, along with interviews, our glossary and more, visit thecyberwire.com. CyberWire is produced by CyberPoint International. The editor is John Petrik. I'm Dave Bittner. Thanks for listening.