World Password Day, OpIcarus

Dave Bittner: [00:00:03:11] Hiding attack campaigns, you can either keep them quiet or you can skulk in the noise. Industrial espionage hits Switzerland's Defense Ministry. Anonymous proceeds with Operation Icarus. It's World Password day, so, look to your credentials. Speaking of passwords, a buck and a social media like will get you 272 million of them.

Dave Bittner: [00:00:26:02] This CyberWire podcast is made possible by Cylance, offering cyber security products and services that are redefining the standard for enterprise endpoint security. Lean more at cylance.com.

Dave Bittner: [00:00:42:16] I'm Dave Bittner in Baltimore with your CyberWire summary for Thursday May 5th, 2016.

Dave Bittner: [00:00:49:11] Some interesting notes on hiding your attack campaigns are in the news today. Palo Alto Networks is describing Infy malware, which they're also giving the snappy nickname, "Prince of Persia," in evident homage to the popular game franchise. Infy, so-called from a recurring string that appears in its code, has been active for about a decade and has gone largely unnoticed. It's apparently escaped attention because of its low volume, highly-targeted nature. Spread mostly by spearphishing, Infy seems to have prospected carefully selected targets with content tailored to geographical location. The intended victims include foreign governments and companies but also individual Iranians, presumably of questionable loyalty or behavior.

Dave Bittner: [00:01:32:07] Infy may have begun to circulate as early as December 2004, it's been found emanating from a compromised Israeli Gmail account but the command-and-control servers are Iranian. The evidence is circumstantial but signs point to Tehran.

Dave Bittner: [00:01:47:12] It's world password day, not that any of us would have weak or easy to guess passwords of course, but, despite all of our warnings plenty of people are still using authentication that's way too easy to crack. We checked in with Johannes Jaskolski, Chief Security Officer with AT&T.

Johannes Jaskolski: [00:02:03:06] Passwords or passphrases predate our modern age by centuries, right? You'd have Roman guards asking for pass phrases for people to pass through the gates. As we are trying to restrict access to technical resources it's just basically adapted.

Dave Bittner: [00:02:19:08] Keeping track of complex passwords is more effort than some people are willing to put in, so, for some of the bad guys, cracking passwords is just a numbers game.

Johannes Jaskolski: [00:02:28:06] They basically look at a list of commonly used passwords, because databases of users are now so huge that if you pick a relatively common password and you just try it with a large set of user IDs there's a high likelihood that there are several users that will have picked that password. In fact, you can now, on the Life Market, you can buy these databases of user IDs and passwords.

Dave Bittner: [00:02:53:14] Making sure your passwords are sufficiently secure doesn't have to be an ordeal, Johannes Jaskolski has some suggestions.

Johannes Jaskolski: [00:03:00:09] It starts with making sure that your password is complex, you don't want to use a common password, even if it meets the complexity aspect of it. So, if you don't know what a common password is you can just do an internet search on common passwords and you'll find a ton of different lists, and that'll give you an idea of what not to use.

Dave Bittner: [00:03:19:15] So, are passwords on the way out? Many of our mobile devices have fingerprint scanners now, after all, which makes entering passwords seem a bit old fashioned.

Johannes Jaskolski: [00:03:27:18] In my view, the death of passwords has been kind of overstated for dramatic effect in the past. I think it's still an ingredient, but, generally speaking, we are moving towards two things, one is multi-factor authentication, so we are incorporating other authentication factors beyond knowledge based, so that would mean biometrics such as Touch ID, but also recognizing, for example, the device, and issuing devices tokens, so you understand the device that is trying to facilitate the authentication.

Dave Bittner: [00:03:59:18] Johannes Jaskolski is a Director and Chief Security Officer with AT&T, their website is business.att.com.

Dave Bittner: [00:04:09:11] Someone's involved in industrial espionage. Switzerland's Minister of Defense has recently said that his ministry came under cyber attack by unnamed parties back in January. Whoever they were, they seemed to have been after trade secrets.

Dave Bittner: [00:04:23:07] In an unrelated case, Canadian authorities deny visas to two Huawei employees, calling them an espionage risk. Huawei denies any implication in espionage.

Dave Bittner: [00:04:34:01] Anonymous hits Greece's national bank late last week in Operation Icarus, aiming at the global banking cartel. The hacktivists collective calls it "the operation to end all others," and has moved onto its next target, DDoSing the Central Bank of Cyprus. They project a 30 day campaign. Observers wait to see when and whether it will expand. In its OpIcarus video, Anonymous says it's "united as one, divided by zero," which would seem to be an undefined operation, so we shall see.

Dave Bittner: [00:05:05:04] Finally, Hold Security has an interesting story about someone who really doesn't know the value of his data. It's a kid, apparently Russian, who's bragging about having 272 million passwords stolen from various sources. He's offered them for sale, and so, Hold Security talked him down to a dollar, plus some likes on social media.

Dave Bittner: [00:05:25:11] Hold says the hacker sounded young. You think?

Dave Bittner: [00:05:33:22] This CyberWire podcast is made possible by Wide Angle Youth Media, a non-profit that provides free media education to Baltimore youth to tell their own stories and become civic leaders. Learn, watch and connect at wideanglemedia.org.

Dave Bittner: [00:05:54:09] It's World Password day, so we thought we'd look back at a conversation I had back in February with Joe Carrigan from the Johns Hopkins Information Security Institute, one of our academic and research partners. Joe, let's talk about passwords, specifically password cracking.

Joe Carrigan: [00:06:08:16] One of my favorite subjects.

Dave Bittner: [00:06:09:21] I know, I know it is. Before we get into how we crack passwords, let's talk about how passwords are stored and protected.

Joe Carrigan: [00:06:16:12] Right, passwords are usually stored in some kind of hashed system, if they're stored in plain text then there's no security at all. So, we use an algorithm called a hash algorithm that takes that password and turns it into essentially a one way encryption function. The weakness there is that I can build a simple look up table based on the hashes, so, if your password is ABC123 and my password is ABC123, then our hashes are going to be the same.

Johannes Jaskolski: [00:06:46:17] We have a second protection against that called salting, and that is where we take a random string of characters and add it to our passwords. Let's say that random string of characters is, for you, 123, so your password becomes ABC123123, and then that gets hashed, and then my password becomes ABC123 and then I have XYZ added to the end of my password. In the password database the salt gets stored with the hashes and now our hashes look different. So, I can't just say, okay, these two users have the same password anymore. That's what we call a salted and hashed password and that's the best way to protect the password in a database.

Dave Bittner: [00:07:27:14] Alright, so we've got our password stored, they've been protected through salting and hashing, but now I want to have at it, I want to start figuring out what the passwords are, how do I go about it?

Joe Carrigan: [00:07:37:23] Right, the very first thing you're going to do, as a password cracker, is you're going to run what's called a dictionary attack on that. There are programs out there that are specifically designed for doing this, and there are lists out there, very large lists, of known passwords, and, the thing about people is, they're kind of predictable in this. You can break about 50% of the passwords just with a dictionary attack.

Dave Bittner: [00:08:02:24] You come at it with your dictionary attack and you're unsuccessful with that, what next?

Joe Carrigan: [00:08:07:06] The next step would be brute force attacks, the same software tools that can run a dictionary attack can also do a brute force attack, there's one called Hashcat that actually runs on graphics processors that makes it very fast.

Dave Bittner: [00:08:19:12] When I'm coming up with a password for myself is there a way to protect myself against either of these attacks?

Joe Carrigan: [00:08:25:11] I use a password manager, what I do is, I use random 20 character passwords, at a minimum, for the websites I visit frequently and the websites I care about.

Dave Bittner: [00:08:35:19] Okay. How do you remember them?

Joe Carrigan: [00:08:37:17] I don't remember them.

Dave Bittner: [00:08:38:11] Right, go on.

Joe Carrigan: [00:08:39:01] If somebody asked me what my Facebook password is right now I wouldn't be able to tell them.

Dave Bittner: [00:08:42:15] Okay, so how do you log onto Facebook then?

Joe Carrigan: [00:08:44:14] I open up my password safe and I copy the password from the password safe into the Facebook interface.

Dave Bittner: [00:08:49:12] So what if I get access to your password safe?

Joe Carrigan: [00:08:51:00] That's an excellent question. In fact, there's now malware that's out there targeting password safes because they've realized that this is a high value target.

Dave Bittner: [00:09:01:10] Are you in effect just shifting it one degree away? Because you have your password to get into your password safe, right?

Joe Carrigan: [00:09:08:09] Correct, yes. Then that password to get into my password safe is a very long password. I say the longer the password the better the password.

Dave Bittner: [00:09:15:10] Alright. Joe Carrigan, thanks for joining us.

Joe Carrigan: [00:09:17:09] Thank you.

Dave Bittner: [00:09:21:01] And that's the CyberWire. For links to all of today's stories, along with interviews, our glossary and more, visit thecyberwire.com. Thanks to all of our sponsors who make the CyberWire possible. If you'd like to place your product, service or solution in front of people who want it, you'll find few better places to do that than The CyberWire. Visit thecyberwire.com/sponsors to find out how to sponsor our broadcast or daily news brief. The CyberWire is produced by Pratt Street Media, the editor is John Petrik and I'm Dave Bittner. Thanks for listening.