Collection #1 and the threat of credential stuffing. Cryptojacker disables some cloud security tools. Don’t chat with strange bots. Facbebook shutters more Russian coordinated inauthenticity.

Dave Bittner: [00:00:03] Collection No. 1 is big but not the end of the world. Rocke cryptojacker can disable some cloud security services. Beware of Telegram bots. Facebook shuts down a few hundred inauthentic Russian pages, and Sputnik shows up as either a free-speech paladin or another troll farm - take your pick. Former U.S. Secretary of Homeland Security Michael Chertoff joins us to discuss his new book "Exploding Data," and Epic Games closes a vulnerability that exposed data of "Fortnite" players.

Dave Bittner: [00:00:41] I'd like to take a moment to thank our sponsor, Georgetown University. Georgetown offers a part-time master's in cybersecurity risk management that prepares you to navigate today's complex cyberthreats. Ideal for working professionals, the program features flexible options to earn your degree without interrupting your career. Take classes online, on campus or through a combination of both. You decide. Not ready to commit to a full master's program? Explore accelerated options through Georgetown's cybersecurity certificates, which you can complete in as little as six months. To learn more about these programs, you're invited to attend an upcoming webinar on Tuesday, January 29, at noon Eastern time. Visit scs.georgetown.edu/cyberwire to RSVP. That's scs.georgetown.edu/cyberwire. And we thank Georgetown University for sponsoring our show.

Dave Bittner: [00:01:42] From the CyberWire studios at DataTribe, I'm Dave Bittner with your CyberWire summary for Friday, January 18, 2019. Yesterday Troy Hunt, proprietor of Have I Been Pwned, announced to considerable eclat the discovery of a large trove of credentials for sale in a dark web market. A number of people pointed him in the direction of the files. He calls the breach Collection No. 1 after the name the seller assigned to the folders. And it's very big, indeed - some 87 gigabytes of data. Hunt observes that the passwords and email addresses came from an indeterminate number of breaches running back probably 10 years since there are some indications in the material that it derives, in part, from incidents going back to 2008. The hoods offering the material for sale goes by the name Sanixer. Krebs on Security contacted Sanixer and concluded that much of the material is indeed relatively old, gleaned from various sources and possibly worth every cent of the $45 Sanixer is charging, which is to say it's probably not worth very much.

Dave Bittner: [00:02:49] Seven-hundred-seventy-three million unique email addresses and 21 million unique passwords are a lot of credentials, to be sure. But Motherboard is probably right to point out that Collection No. 1 is not the devastating blow to internet users that's been giving some media outlets the yips over the past couple of days. Good job by Mr. Hunt and Have I Been Pwned in finding Collection No. 1 and in offering a measured, non-alarmist assessment. It should serve as a nudge toward better digital hygiene. In particular, Hunt notes that avoiding password reuse and using a password manager are two sound practices. He warns that the principal threat of misuse Collection 1 poses is that of credential stuffing - the rapid checking of as many possible user ID and password combinations across a wide variety of sites.

Dave Bittner: [00:03:40] Palo Alto Networks warned that the Rocke coinjacking malware is able to disable five Tencent Cloud and Alibaba Cloud security products that would otherwise prevent it from operating in infected systems. Tencent and Alibaba's tools are mostly used in China, but the appearance of coinjacking malware that can find and disenable cloud security software is a disturbing harbinger of things to come, especially as more people come to depend upon the cloud for their security.

Dave Bittner: [00:04:11] Security firm Forcepoint has been looking at the encrypted messaging app Telegram and found that the service is susceptible to use by malware that exploits the Telegram bot API for its command and control channels. In essence, the risk to users is that of a man-in-the-middle attack where a bot's messages can be replayed to yield the history of messages sent or received by that bot. Since bots and human users often share a group chat, the risk to users is clear. Forcepoint recommends that if you use Telegram, you neither use bots nor participate in group chats with them.

Dave Bittner: [00:04:48] Facebook made another sweep of coordinated inauthentic sites, pulling down 364 Russian pages yesterday. The pages targeted were judged to not only be inauthentic but also have engaged in information operations. The accounts were linked, Facebook says, to the Russian news agency Sputnik. The sites were involved in two distinct influence campaigns, neither one targeting the U.S. One operation targeted Ukraine, and the second involved Central and Eastern Europe, the Baltics, Central Asia and the Caucasus.

Dave Bittner: [00:05:21] The campaign against Ukraine resembled the activity St. Petersburg's famous troll farm the Internet Research Agency conducted against U.S. populations during recent elections. The other campaign is described as a content amplification effort tied to themes pushed by Rossiya Segodnya, which is Russian for Russia Today. Much of the content amplification is said by the Atlantic Council's Digital Forensic Research Laboratory to have pushed stories generally favorable to authoritarian political figures. Sputnik is a subordinate brand of Rossiya Segodnya, whose formal mission statement says the news service's purpose is to secure the national interests of the Russian Federation in the information sphere. Sputnik says, well, that's not their mission, but come on. Sputnik also says rather brassily that, well, sure, some of the accounts were their peoples; and yeah, they didn't always give their true names but that - what Facebook did to them is just wrong. It's just censorship straight up, says Sputnik, and a violation of free speech. In fairness to Sputnik, it does seem reasonable to conclude that they and their sister brands probably know a thing or two about censorship and violations of free speech. At any rate, we say bravo, Facebook.

Dave Bittner: [00:06:42] And finally - winner, winner, chicken dinner - GameDaily reports that Epic Games has patched the Fortnite flaw that exposed some 200 million gamers' data. Check Point found the cross-site scripting problem and disclosed it responsibly to Epic Games - not even making them rifle through a bunch of random loot boxes for the information. The flaw could have placed at risk credit card data, personal information and voice chat audio. In principle, the game's entire user base might have been affected. And the lesson here, again, is to use multi-factor authentication and strong passwords, which you promise yourself you'll never reuse.

Dave Bittner: [00:07:18] Monday is Dr. Martin Luther King Jr. Day here in the U.S. And we'll mark the federal holiday by taking a day away from publishing. Both the CyberWire's daily news briefing and our daily podcast will return as usual next Tuesday. And tomorrow marks officially the third anniversary of the CyberWire's daily podcast's public launch. You can check out that episode on our website, thecyberwire.com, for a walk down memory lane. And thanks to all of you for reading and for listening.

Dave Bittner: [00:07:52] And now a word from our sponsor Virtru. Virtru is a data privacy company that protects your organization's data wherever it goes. Using a data-centric security approach, Virtru brings persistent protection and control to the platforms where your data is stored and shared, including Microsoft Office 365 and Google G Suite. Now, I know what you're thinking. What makes this different from any other data protection tool? Well, have you ever tried to protect data from inside your perimeter? It's hard. But Virtru makes it easy by not only encrypting at the data-object level but also by giving you the ability to track where your data is shared, revoke access, maintain audit visibility and host your own keys. So you don't have to trust third-party services to keep your data safe. Virtru helps protect thousands of companies data, including HBO, WeWork and the Associated Press. And for a limited time, they're providing our listeners a free copy of Forrester's 14-page report on "The Future of Data Security and Privacy." Get your copy at virtru.com/cyberwire today. That's virtru.com/cyberwire. And we thank Virtru for sponsoring our show.

Dave Bittner: [00:09:17] And I'm pleased to be joined once again by Malek Ben Salem. She's a senior R&D manager for security at Accenture labs. Malek, it's great to have you back. We wanted to talk today about some vulnerabilities with power grids and specifically ways to use botnets against them. What do we need to know here?

Malek Ben Salem: [00:09:35] Yeah. So we've heard about the Mirai botnet - right? - that has showcased how IoT devices can create huge disruptions to our networks. Similar things could happen by leveraging those types of botnets - IoT device botnets against power grids. There is some awareness there, but we've never done the research about exactly what could happen to those power grids if we launch a large-scale attack using IoT devices against them.

Malek Ben Salem: [00:10:09] So the research shows that, you know, three things could happen or three types of attacks could be launched. Number one is attacks that can result in frequency instability. So an abrupt increase or decrease in the powered events, potentially by synchronically switching on or off many high-wattage IoT devices, can result in an imbalance between the supply and demand. And this imbalance results instantly in a sudden drop in the system frequency. So if you think about an adversary who's exploiting a vulnerability in an air conditioner device that is Wi-Fi connected, they can create this sudden increase of demand on a hot summer day that could result in this type of frequency instability.

Malek Ben Salem: [00:11:06] A second attack is an attack that could cause the line failures and resulting cascading failures. So in this case, the imbalance between the supply and demand after the attack is not significant, but the frequency of this system is stabilized by the primary controller or the generator. But because of the way power is transmitted in the power grid, we can see the failure cascade throughout the network. And that could result in an entire blackout. And then the third type of attack is an attack that just increases the operating costs of the power grid. By creating that new demand for power, this forces the power grids' administrators to use some reserve generators. And those reserve generators are usually - you know, cost more. They usually have higher prices than, you know, the normal generators that are committed as part of the day-ahead planning.

Malek Ben Salem: [00:12:17] The adversary does not require a large botnet size. So for the critical frequency drop, all they need to get a hold of is about 200 to 300 bots that have - that consume on average 1,000 megawatts. So you can think of, you know, a water heater or an air conditioner. Two-hundred to 300 of those can create that type of critical frequency drop. For a line failure and cascades attack, all they need is four to 15 bots. And for increasing the operating costs for the power grid, all they need is about 30 to 50 bots.

Dave Bittner: [00:13:00] Now, is this a worst-case scenario? I guess I'm wondering, what is the practicality of this? Is this - I mean, obviously they're considering this in a theoretical kind of way. But how practical would this actually be to execute?

Malek Ben Salem: [00:13:15] So if you think about the limited size that's needed - 300 to 500 bots - and if you think about how vulnerable the IoT devices that we deploy are - you know, we know that a lot of them are, you know, widely accessible, remotely accessible, are using still, you know, default passwords - these types of attacks, I think, are feasible. You know, and we may see them any time. What we need to do is to do a lot of work on securing those devices. They're growing in numbers now. So we know that a lot of these, you know, air conditioners are now Wi-Fi enabled, right? And even the older appliances can be remotely controlled by adding Wi-Fi-enabled peripherals, such Tidal and Aquanta to them. In terms of number of devices, while today we don't have enough devices out there that are high-wattage devices - right? - but very soon we'll have enough of them for adversaries to be able to conduct these types of attacks.

Dave Bittner: [00:14:30] All right. Malek Ben Salem, thanks for joining us.

Dave Bittner: [00:14:37] Now, I'd like to share some words about our sponsor Cylance. AI stands for artificial intelligence, of course, but nowadays it also means all image or anthropomorphized incredibly. There is a serious reality under the hype, but it can be difficult to see through to it. As the experts at Cylance will tell you, AI isn't a self-aware Skynet ready to send in the Terminators. It's a tool that trains on data to develop useful algorithms. And like all tools, it can be used for good or evil. If you'd like to learn more about how AI is being weaponized and what you can do about it, visit threatvector.cylance.com and check out their report "Security Using AI For Evil." That's threatvector.cylance.com. We're happy to say that their products protect our systems here at the CyberWire, and we thank Cylance for sponsoring our show.

Dave Bittner: [00:15:36] You know Michael Chertoff as a former federal judge and the second U.S. secretary of homeland security. Nowadays, in addition to being a founding principle of his namesake Chertoff Group, he's also a member of the advisory board for the Global Cyber Innovation Summit, which we're looking forward to this spring in Baltimore as media partners. Secretary Chertoff joins us today to discuss his recently published book "Exploding Data: Reclaiming Our Cyber Security In The Digital Age." He joined us by telephone from his office in Washington, D.C.

Michael Chertoff: [00:16:08] I remember in the wake of the Edward Snowden episode, there was a lot of concern about government surveillance and the way government was accessing and using data. And as I reflected on it, I thought that people actually did not understand that the private sector collects and uses data much more substantially than the government does and with much less restraint. And the government largely does it because we're dealing with protection of life, whereas in the private sector its often simply for commercial purposes. So it seemed to me that I needed to lay out for the public - for the educated public, exactly what is going on with that and the way it's transformed our society and to suggest that we need to maybe reset our laws and our policies so that it fits with the current technological situation.

Dave Bittner: [00:17:02] And one of the things you go through in the book is something you refer to as these different states of data collection. You call them Data 1.0, 2.0 and 3.0. Can you give us an overview? What were you getting at here?

Michael Chertoff: [00:17:15] Sure. I was trying to explain that - and maybe this is the lawyer in me - our laws have tended to deal with evolving technology by first trying to fit the technology into the old categories. And then finally people say, you know what? The old categories just don't work anymore. We've got to rewrite the categories. So 1.0 is the kind of data collection that occurred when people either spoke or wrote - so you got a letter, or you had a book or something of that sort. And at that period of time, the way we looked at the issue of privacy was in terms of property. You had a right to have your books and possessions in your house protected against arbitrary searches. And all of the laws around what the government could do and couldn't do or what private people could do or couldn't do was based on your property rights.

Michael Chertoff: [00:18:06] About 150 years ago, as we developed photography and then afterwards you got telephony, we began to experience government and the private sector using that to collect data in a way that was much different than had been the case previously. So for example, there's a famous case where someone took a photograph of their girlfriend and, without her permission, put it on bags of flour to be sold commercially. Or we had wiretap, which for the first time could take place not by invading your home but by simply tapping on to an outside telephone wire. So when people raised objections, the initial reaction was, well, if you don't have a property right or your property wasn't invaded, you have no complaint. But eventually the courts and the legislature said, you know what? Protecting property is not really what it's about anymore. It's about protecting your right to own your own image for commercial exploitation. And it's about the right to have a confidential conversation. So that was what I call 2.0. 3.0 is what we have now, where the amount of data we generate and the ability to store and collect it is so vastly greater than before that even things that in the past occurred in public, which we felt were kind of trivial, now are part of a mosaic that can be put together that can really have an intrusive effect on the way you live your life. And I think that's what we need to focus on now.

Dave Bittner: [00:19:36] And do you suppose we have the tools that we need to focus on that, or is it going to require a similar sort of evolution?

Michael Chertoff: [00:19:43] I think we're beginning to see the changes. So, for example, the Supreme Court used to say that if you followed someone around in public, they had no right to privacy; they're in public, so you have no complaint - if it was a government agency, for example. But in a recent Supreme Court case, the court said, well, you know, if you actually use modern technology to follow someone 24/7, we're getting to the point now that we might require a warrant or some deeper level of permission. Likewise, in the old days when you arrested someone, you could search anything they had on their person. And you didn't need a warrant. But in a recent case, somebody had a cellphone. And the police arrested them, and then they accessed the cellphone and all the data on the cellphone. And the court said, you know, that goes further than simply patting a person down for weapons or making sure they're not going to destroy evidence; you need to have permission for that. So I think you're seeing the court begin to change the rules. And I think now in Congress, and particularly if you go out to California in the legislature, they're now beginning to focus on whether we need to reset our laws.

Dave Bittner: [00:20:56] Yeah, that's where I was going to go next with you. Do you suppose that we have the political will to go through with something like this?

Michael Chertoff: [00:21:02] Actually, this is one of those rare issues which, I think, you might get bipartisan agreement. California has been, you know, kind of out ahead on dealing with the issue of privacy and control of data. But I can say even dealing with Congress, I've heard both Republicans and Democrats express some concerns about the commercial exploitation of data and how it's used and how long it can be used. And while I don't want to predict there will actually be any action, I do think there's interest.

Dave Bittner: [00:21:35] One of the chapters in the book deals with cyberwarfare, and it seems to me like that's been a tough thing to have a really firm definition of. It seems as though politicians are reticent to draw lines in the sand - to say, if you cross over this, we're going to consider that to be cyberwarfare. I'm curious. What are your views on that?

Michael Chertoff: [00:21:58] Well, I do think you have to be careful using the phrase cyberwarfare. Because once you say that there's actually been an act of war, then your response may not just be limited to cyberspace. It may be unlimited. It may be - extend to the physical world. On the other hand, we clearly have cyber conflict. We've seen attacks on critical infrastructure, particularly if you look at Russia and the Ukraine. For several years now, the Russians have really attacked the civilian infrastructure in the Ukraine. We've seen what we call information operations - attempts to sow discord and undermine confidence in democracy as part of an overall strategy to weaken the Western alliance and to promote, let's say, Russian agendas. We've seen very significant theft and compromise of technology by the Chinese as they use cyberspace as a way of competing with Russia in the economic sphere. Now, I wouldn't say these are necessarily at the level of an act of war, which to me implies either loss of life or very, very substantial damage. But I do think it's conflict. And I do think we need to begin to develop some clear rules of the road in terms of how we deter and respond to those kinds of acts of conflict.

Dave Bittner: [00:23:19] And what are your recommendations? What do you suppose needs to be done as we look towards the horizon in terms of meeting this challenge with dealing with our data privacy?

Michael Chertoff: [00:23:29] Well, I think one thing where, I have to say, the Russia - sorry - the Europeans are somewhat ahead of us is by understanding that the idea of keeping information secret or confidential is going to be increasingly difficult, if not impossible, largely because much of the information generated about us is not what we put on the internet. But it's what others put on about us or locational data or what we buy at the store or what our Fitbit is communicating back in terms of what we're doing. So instead of trying to close the door when the horses already left a long time ago, I think, as the Europeans have done, we need to focus on, what is your right to control your personal data after it's been generated even if it's in the possession of someone else? So if someone has collected your data whether you've agreed to it or not, and they want to use it for a purpose other than that, which was, let's say, the original intent, then, I think, they need to ask you for permission. And it needs to be real permission and not something buried in a hundred pages of legalese. The Europeans have a regulation that now begins to do that. It's a - somewhat overly bureaucratic. But the point is, the focus needs to change on who controls the data as opposed to how do I keep it secret.

Dave Bittner: [00:24:51] That's former Secretary of Homeland Security Michael Chertoff. The book is titled "Exploding Data: Reclaiming Our Cyber Security in the Digital Age."

Dave Bittner: [00:25:04] And that's the CyberWire. Thanks to all of our sponsors for making the CyberWire possible, especially our supporting sponsor, ObserveIT, the leading insider threat management platform. Learn more at observeit.com.

Dave Bittner: [00:25:17] The CyberWire podcast is proudly produced in Maryland out of the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technology. Our CyberWire editor is John Petrik; social media editor, Jennifer Eiben; technical editor, Chris Russell; executive editor, Peter Kilpe. And I'm Dave Bittner. Thanks for listening.