Spies & crooks, together again. Artful spearphishers will eventually learn to proofread.

Dave Bittner: [00:00:01:09] US Cyber Command's chief tells Congress nation-state intelligence services are cooperating with cyber criminals (and he's looking at you, Russia). Ransomware continues to grab up black marketshare, so, everyone: backup your data. Spear phishers are also getting more plausible, but they continue to stumble over proofreading. And Anonymous threatens to intervene in the campaign for the US Presidency.

Dave Bittner: [00:00:28:00] This CyberWire podcast is made possible by the generous support of Cylance, offering cyber security products and services that are redefining the standard for enterprise endpoint security. Learn more at cylance.com.

Dave Bittner: [00:00:43:00] I'm Dave Bittner in Baltimore with your CyberWire summary for Thursday, March 17th, 2016.

Dave Bittner: [00:0:50:00] The convergence among criminals and nation-state espionage services continues to develop, as US Cyber Command chief, Admiral Rogers, warned Congress during budget hearings this week. Rogers, who also serves as Director, NSA, singles out Russia for particular comment, noting that Russia is host to a large, capable, and sophisticated cybercriminal underground. He points out that cooperation with criminals can also provide intelligence services with deniability as well as capability.

Dave Bittner: [00:01:18:00] We do note that Rogers' testimony comes as Congress considers appropriations for the Intelligence Community, and that cyber security remains an issue on which there's a broad range of bipartisan consensus. But lest one be tempted to write such warnings off as mere appropriations-driven fear, uncertainty and dread, consider recent reports that code traceable to China's People's Liberation Army has begun to appear in ransomware, and of stolen digital certificates finding use in both espionage and criminal campaigns.

Dave Bittner: [00:0::00] The Chinese case illustrates the complexity of the issue—it's not clear whether code is being cooperatively lent to criminals as a matter of policy, whether it's being pilfered from the Digital Quartermaster's shelves, or whether former contractors are turning to crime during a contraction in state-sponsored operations.

Dave Bittner: [00:0::00] If US sources are right about state collaboration with Russian cyber mobs, and it looks as if they're on relatively firm ground here, such collaboration isn't without its hazards. Some potential blowback may have appeared in an apparent phishing campaign directed against Russian banks. Sophisticated crooks impersonated FinCERT, the security arm of Russia's Central Bank, and successfully spear phished an undisclosed but apparently large number of Russian banks. They worked with a great deal of preparation, registering the domain fincert.net. That's plausible enough, but FinCERT's actual domain is cbr.ru. They attached a legitimate-looking Word document to the emails, which included a macro that downloaded a file from a remote site. (The downloaded file was also signed with a legitimate, Comodo-issued certificate.) What tripped the crooks up and tipped off their marks, according to Kaspersky Labs, was poor proofreading—in this case, the word "compromise" was misspelled.

Dave Bittner: [00:0::00] The single spelling error aside, the criminals showed remarkable attention to detail throughout. They sent their emails to addresses not easily found by open searches. They formatted their phish bait document to look like FinCERT's newsletter, which, according to Kaspersky, is "relatively closed and inaccessible to the general public." This suggests not only time and thought, but also access to insider information. The FinCERT caper is not alone among ongoing email-based attacks. Trend Micro has been following the Olympic Vision business email compromise campaign, which continues to hit companies in the Middle East and across the Asia-Pacific region.

Dave Bittner: [00:0::00] Ransomware campaigns show no signs of slowing down. The adware-based attack that passed through major media sites and major advertising platforms late last week is spooking the online advertising industry, as it should. Some normally ad-friendly security experts are beginning to think that ad-blockers might now be an important security tool.

Dave Bittner: [00:0::00] The ransomware itself continues to evolve in sophistication even as it increases its black market share. Witness, of course, the aforementioned presence of PLA code in some of the Angler-driven malvertising. Cisco's Talos research unit reports that TeslaCrypt has become, as they say, "unbreakable." This means, at least, unbreakable by the tools recently developed to help people recover their files from the TeslaCrypt sequestration, not necessarily unbreakable in principle. We wish those companies who've had success against ransomware in the past equal success in breaking the apparently unbreakable.

Dave Bittner: [00:0::00] And Fortinet finds that the familiar Nemucode has added ransomware functionality to its tool bag. With respect to ransomware, the best advice remains the old standby: regularly and securely back up your files. If you do that, you can at least recover your data, if not always your device. 

Dave Bittner: [00:0::00] Some other malware developments are worth noting. Palo Alto says malware authors have found ways around iOS defenses with attack code they're calling "AceDeceiver." Recorded Future reports upgrades to Hydra, which is a version of the Umbra Loader that features Tor-based support. Hydra's presence in Tor, Recorded Future suggests, will make it more elusive than the ordinary botnet. In the criminal marketplace, Shape Security describes an interesting offering: Sentry MBA, an automated tool for credential stuffing that makes such attacks cheap and easy to mount. And Proofpoint warns of the unwelcome return of Carbanak—banks and their customers should take heed. 

Dave Bittner: [00:0::00] Turning to hacktivism, Anonymous takes a break from its dauntless, if curiously well-concealed, campaign against ISIS to announce its plans to hit US Presidential candidate Donald Trump's online presence. The operation is planned for April 1. A10 Networks thinks Trump's campaign unusually well-prepared against such attacks, at least if the attacks are of the denial-of-service variety. The campaign uses a content delivery network service, and such services are designed to blunt DDoS attacks. Anonymous has also threatened to "expose" Mr. Trump, which might suggest the hacktivists have something other than DDoS in mind. 

Dave Bittner: [00:0::00] We close with some final thoughts on a skeptical approach to your email. If something doesn't look right, if the subject is odd, the language peculiar, the content vague, be suspicious. And note how close the Bank of Bangladesh and any number of Russian institutions came to getting looted online. The crooks were just a proofreading error away from success. At one level this is disturbing: we hesitate to even speculate about the number of misspellings or agreement errors we ourselves commit in the haste of composition—our publisher's staff has been having particular difficulties with the word "please" lately. You'd think the suits would have mastered this magic word in all of its forms, but, no. We'll have to call him around 3:00 a.m. tomorrow to make sure that email is really from him—with business email compromise running amok, you can't be too sure, right? So please—that's P-L-E-A-S-E-- watch your p's and q's when emailing.

Dave Bittner: [00:0::00] This CyberWire podcast is brought to you by the Digital Harbor Foundation a non-profit that works with youth and educators to foster learning, creativity, productivity and community through technology education. Learn more at digitalharbor.org.

Dave Bittner: [00:07:11:12] Malek Ben Salem is the R&D Manager for Security at Accenture Technology Labs, one of our academic and research partners. Of course, security on mobile devices is an ongoing challenge and you co-authored a paper on using decoy applications for continuous authentication on mobile devices.

Malek Ben Salem: [00:07:28:07] Yes, the goal was to detect basically any masqueraders getting access to somebody else's mobile device, and so we used decoy apps for that type of detection. The idea is that, as a legitimate owner of the device, you deploy several decoy apps and you know that they're a decoy so you would not touch them. Somebody else who gets access to your device who doesn't know what's on there and who is perhaps trying to steal some information about you, would not know what are the authentic applications and what are the decoy applications, so there is a high likelihood that they click on the wrong app.

Dave Bittner: [00:08:16:08] So I have an app that looks like my banking app for example, something that would contain something that the bad guys would want to go after and then when they click on that app, what happens?

Malek Ben Salem: [00:08:28:00] So mobile banking apps are a great example or a great application for these types of decoy apps. Let’s say you do banking with Wells Fargo, you'll have your regular Wells Fargo mobile banking app, but you'll download another, perhaps a Bank of America app or a Citibank app. The three of them will be sitting on your device, you would know that you're doing mobile banking with Wells Fargo so you'll only click on the Wells Fargo app but the masquerader would not know. When they click on the wrong app, then they get deauthenticated, so they get locked out of the device. We take a picture of the person using the device, we record ambient sound and we send an email alert to the owner of the device.

Dave Bittner: [00:09:23:20] Clever stuff. Malek Ben Salem thanks for joining us. And that's the CyberWire. We wanna welcome two new academic and research partners. Level 3 Threat Research Labs and QuintessenceLabs. You can find out more about all of our research partners at thecyberwire.com/partners. For links to all of today's stories visit the thecyberwire.com. The CyberWire is a production of CyberPoint International, our Editor is John Petrik. I'm Dave Bittner. Thanks for listening.