MedStar recovers. More on ransomware, and one weird trick to hiding $2B.

Dave Bittner: [00:00:03:04] MedStar recovers from its ransomware attack and it does so without paying ransom. Cyber rioting in southwest Asia. The Panama Papers are out and they comprise the biggest leak in history and it's 11 million documents big. And what's Vladimir Putin's one weird trick for making $2 billion?

Dave Bittner: [00:00:23:15] This CyberWire podcast is made possible by the generous support of Cylance, offering revolutionary cybersecurity products and services that proactively prevent, rather than reactively detect, the execution of advanced persistent threats and malware. Learn more at cylance.com.

Dave Bittner: [00:00:46:06] I'm Dave Bittner back in Baltimore with your CyberWire summary for Monday, April 4th, 2016.

Dave Bittner: [00:00:52:15] Ransomware, and other cyber threats, continue to vex North American healthcare providers. US and Canadian authorities have issued a joint alert about ransomware and the FBI continues its investigation of last week's MedStar hack. The Canadian Cyber Incident Response Center and the US Department of Homeland Security warned that, "infections can be devastating to an individual or organization and recover can be a difficult process that may require the services of a reputable data recovery specialist."

Dave Bittner: [00:01:22:11] MedStar appears to have largely returned to normal operations and the hospital chain says it's done so without paying the hackers any ransom, let alone the $18,500 the extortionists demanded. Refusal to pay ransom is consistent with the latest guidance from both US and Canadian authorities. MedStar officials said Friday they'd brought their three main patient care systems back online. Those systems include in-patient health records, out-patient health records and the registration and scheduling system. They also said they'd found no evidence of any compromise of patient or employee information.

Dave Bittner: [00:01:57:05] MedStar, like other healthcare providers, has in recent years moved quickly toward implementation of electronic health records. Such EHRs offer many advantages in delivering healthcare, new ease, for example, in avoiding unnecessary or duplicative tests and better tailoring of treatment options to individual cases. But they do carry with them, the risk of hacking that comes with all online systems.

Dave Bittner: [00:02:21:08] Ransomware, of course, is not confined to healthcare systems and new variants of this form of malware continue to appear in criminal markets. You can now buy a ransomware kit for about $100 in the online black market. And the malware on offer features some victim-friendly innovations designed to make ransom payment easier. Security firm Avira reports one such development: the "Rokku" ransomware thoughtfully includes a QR code, so you can use convenient mobile payments to unlock your files.

Dave Bittner: [00:02:52:01] A very big leak is being reported by Süddeutsche Zeitung. In what's being called the biggest online leak in history, some 11 million documents totaling about 2.6 terabytes of data have been winkled out of the Panama-based law firm Mossack Fonseca. Apparently an internal whistle-blower put the documents out to expose illegal currency transactions allegedly facilitated by the law firm. The data are said to indicate money laundering and the massive transfer of funds to offshore private accounts by a number of world leaders and senior government officials. Many countries are involved, some of them surprising, like Iceland and others less so, like Russia. Süddeutsche Zeitung has said that Le Monde, the BBC, and the Guardian are also investigating the story. Prominently mentioned in dispatches is Russian President Vladimir Putin, who's said to have transferred more than a billion dollars to untraceable foreign bank accounts. We'll be following the story already known as "the Panama Papers" in upcoming editions of the CyberWire.

Dave Bittner: [00:03:52:19] Government websites in Hungary sustained a brief denial-of-service attack by unknown, or at least unspecified, foreign actors late last week. Service has been restored and the incident is under investigation.

Dave Bittner: [00:04:04:17] Cyber-rioting flares again in Southwest Asia, as Turkish hacktivists take up the Azeri case in the long-running dispute between Armenia and Azerbaijan over ownership of the contested province of Nagorno-Karabakh.

Dave Bittner: [00:04:18:12] The US Justice Department warns of a coming cyber jihad and tells Americans, they'd best be prepared for it. While jihadis have so far shown more information operations capability than ability to hack, the Justice Department regards their development of such capability as effectively inevitable and doesn't rule out the likelihood of attacks on infrastructure that would be far more destructive than the limited website defacements ISIS and others have so far been able to accomplish.

Dave Bittner: [00:04:44:04] Thus, concerns over the security of the burgeoning Internet-of-things continue to mount. The devices connected in the IoT present a number of security challenges. We'll hear tomorrow from SCADAFence about how some of those challenges are being addressed in manufacturing control systems. Today we get some background to what's involved in securing the IoT. Our guide is Accenture's Malek Ben Salem. We'll hear from her after the break.

Dave Bittner: [00:05:08:06] Finally, let's return briefly to the Panama Papers. Reports from Germany are pointing to Putin's pile of pilfered money, but we'd like to say wow. I mean, Wow! If you can build up a fortune of more than $2 billion on a civil servant's salary, how do you do it? He's probably got a genius for picking stocks, big four-baggers from the pink sheets, or maybe it was just working from home. But in any case, wow. So Vladimir, the world wants to know, what's that one weird trick?

Dave Bittner: [00:05:44:21] This CyberWire podcast is made possible by the generous support of ITProTV, the resource to keep your cyber security skills up-to-date, with engaging and informative videos. For a free seven day trial and to save 30%, visit itpro.tv/cyber and use the code CYBER30.

Dave Bittner: [00:06:09:13] Malek Ben Salem is the R&D Manager for Security at Accenture Technology Labs, one of our academic and research partners.

Dave Bittner: [00:06:16:00] A topic that comes up regularly on the CyberWire is the Internet-of-things and that's an area where you all are doing a lot of research in securing the Internet-of-things, yes?

Malek Ben Salem: [00:06:25:04] Yes, absolutely. One particular area that we're focused on is identity for the Internet-of-things. So identity brings about a challenge within IoT for the reason of scalability. We're dealing with billions and billions of machines and devices and things that have to be authenticated. So finding a mechanism which can be used to establish an immutable machine identity is not the only challenge. The sheer scale of the number of machines that will be connected to the IoT means that identity management mechanisms must address scalability and they must have appropriate governance mechanisms. They also must be able to protect the privacy of machines, so that for example valid group numbers, without having to make the identity of individual machine instances known, can have the right of privacy and can protect the privacy of users and organizations behind those machines.

Dave Bittner: [00:07:32:22] And this is an area that comes up with automobiles, correct?

Malek Ben Salem: [00:07:36:07] Absolutely. So think about a connected car, where you have a number of interconnected machines and perhaps you'd have to replace one part within that car, perhaps from a third-party provider. You'd have to deal with the identity of that thing that you're replacing. How do you authenticate it, is it the same part, is it a different part for the connected system? So that's something also that has to be addressed.

Dave Bittner: [00:08:07:20] So it seems to me like part of the problem is, there are already so many IoT devices out there and it's impractical to go back and update them to address this issue.

Malek Ben Salem: [00:08:19:14] Yes. Again, scalability is really an issue. Identity must be able to scale to give unique and immutable identity within the anticipated billions of connected machines.

Dave Bittner: [00:08:33:15] Malek Ben Salem from Accenture Labs thanks for joining us.

Dave Bittner: [00:08:39:12] And that's the CyberWire. For links to all of today's stories visit thecyberwire.com. And while you're there subscribe to our popular daily news brief. Our editor is John Petrik, I'm Dave Bittner. Thanks for listening.