Election risks—hacking and influence. Chinese industrial espionage spike. Misconfigured project management. Necurs appears briefly. Bogus Fortnite downloads. What they heard in the banya.

Dave Bittner: [00:00:00] Hey, everybody. Dave here with a quick reminder to check out our "Hacking Humans" podcast if you haven't already done so. We're pretty proud of the show, and we think you'll enjoy it. You can find it on our website, thecyberwire.com, or all of the usual places where you find your podcasts. Do check it out. Thanks.

Dave Bittner: [00:00:20] A brief guide to election risks and the difference between hacking and influence operations; an Alaskan trade mission prompts a wave of Chinese industrial espionage; misconfigured project management pages may have exposed Canadian and British government information; Necurs flared up in a short-lived spam campaign against the banks this week; crooks used bogus Fortnite download pages; and final briefs are submitted in Kaspersky's court challenge to its U.S. ban.

Dave Bittner: [00:00:54] Time to tell you about our sponsor Recorded Future. If you haven't already done so, take a look at Recorded Future's Cyber Daily. We look at it. The CyberWire staff subscribes and consults it daily. The web is rich with indicators and warnings, but it's nearly impossible to collect them by eyeballing the internet yourself, no matter how many analysts you might have on staff. And we're betting that however many you have, you haven't got enough. Recorded Future does the hard work for you by automatically collecting and organizing the entire web to identify new vulnerabilities and emerging threat indicators. Sign up for the Cyber Daily email to get the top trending technical indicators crossing the web - cyber news, targeted industries, threat actors, exploited vulnerabilities, malware, suspicious IP addresses and much more. Subscribe today, and stay ahead of the cyberattacks. Go to recordedfuture.com/intel to subscribe for free threat intelligence updates from Recorded Future. That's recordedfuture.com/intel. And we thank Recorded Future for sponsoring our show. Major funding for the CyberWire podcast is provided by Cylance.

Dave Bittner: [00:02:02] From the CyberWire studios at DataTribe, I'm Dave Bittner with your CyberWire summary for Friday, August 17, 2018. Senator Bill Nelson, a Democrat of Florida, has been saying that his state's election system is under ongoing attack. The consensus at week's end, as expressed in The Washington Post and elsewhere, is that the senator's warning is based on a priori probability rather than on specific evidence.

Dave Bittner: [00:02:30] Nonetheless, the states, who under the U.S. system are responsible for conducting elections, remain concerned about the integrity of the ballot. Thirty-six of the 50 states have now deployed Albert sensors on their voting infrastructure. An Albert sensor is a relatively inexpensive hardware module that allows the federal government, specifically the Department of Homeland Security, to observe state systems that manage either voter information or voting devices. It's thought that DHS may be able to develop quick warnings of attempts to intrude into the state systems.

Dave Bittner: [00:03:05] The states also want the feds to loosen up in their threat intelligence sharing. Forty-four states and the District of Columbia took part in the cyber exercise this week, run by the Department of Homeland Security with participation by the U.S. intelligence community. The states appeared to have gained enough insight into the value of threat intelligence to decide they want more of it. Some advocate federal standards for the conduct of elections, perhaps even mandatory standards. This isn't quite federal control of elections, which is a constitutional and cultural bridge most informed observers think is better left uncrossed, but it would arguably give the states at least some useful bench marks to work toward.

Dave Bittner: [00:03:48] MIT's Technology Review has published a useful guide to the electoral attack surface. They divide that surface into quadrants. The first, voter registration systems, assemble and maintain a record of who's authorized to vote. And these systems find their front-line use at polling places where voters check in. These systems tend to be old, creaky, accessed by lots of people and susceptible to hacking. The potential risk here is a technically advanced version of a Chicago tradition of having the dead cast ballots - alleged tradition if you live in Cook County and are the sensitive type. But rest assured, Chicago, we still love you.

Dave Bittner: [00:04:29] The second involves voter check-in. That's where poll workers use tablets instead of paper poll books. These network devices are, in principle, vulnerable to compromise. A voter might be told falsely that they've already voted and can't do so again.

Dave Bittner: [00:04:45] The third attack surface is presented by the voting machines themselves. These tend to be either optical scanning devices that read and record paper ballots or direct-recording electronic systems for which a paper record may or may not be generated. There's been some movement away from the snazzier, more convenient and, alas, more hackable direct-recording electronic systems and back to the paper ballot. But 13 states still use paperless machines, and five of these use nothing but.

Dave Bittner: [00:05:16] Finally, there are the systems that tally and report votes. These tasks are done on what Technology Review calls computers using standard operating systems. It would be more difficult to cook up a desired election result than many seem to think. But widespread hacking of these systems could certainly cast doubt on results. There may be one historical case of this being done. Some suspect that the Russian government deleted essential files from Ukraine's Central Election Commission in ways that mucked up the 2014 vote. But in the U.S., there are generally checks on outcomes done on a precinct-by-precinct basis. Any of these four families of technology, of course, could be hit with irritating malicious encryption or, more probably, distributed denial of service attacks. These are the usual coin of commodity cyberattacks, whether criminal or state-run.

Dave Bittner: [00:06:09] It's worth distinguishing all of these from malicious influence. Call them, respectively, cyberattack and information operations. There's been evidence over the last three years of foreign probing of U.S. state voter databases, and that would be the reconnaissance phase of a potential cyberattack. But most of what gets called election hacking involves influence operations. Here, the famous St. Petersburg and Moscow troll farms sing for their supper, fomenting odd memes and nasty conspiracy narratives aimed at widening pre-existing fissures in their targets' electorates. This is the sort of activity that's put pressure on social media. And that pressure is the one that's prompted a civil libertarian backlash about censorship.

Dave Bittner: [00:06:55] Turning to more traditional forms of shadow conflict, there are fresh signs of Chinese industrial espionage being reported. Recorded Future, late yesterday, blogged that much of the online spying is being staged through Tsinghua University infrastructure. While taking a look at Chinese government cybersurveillance of Tibetan groups, the company observed what it called a novel Linux backdoor called ext4 in use. Their analysis of ext4 led the researchers to discover connection attempts to a compromised Tsinghua University CentOS server.

Dave Bittner: [00:07:31] The operations run through university infrastructure served economic development as well as domestic security goals. Those who might be tempted to think that state-directed espionage looks at national and commercial targets to the exclusion of other subnational governments will be interested to see the interest Chinese intelligence service took in the government of the U.S. state of Alaska. Operators targeted Alaskan state government sites, including the Alaska Department of Natural Resources. Alaskan extraction industries are major exporters to China, selling timber, lead and gold ores, petroleum byproducts and, the biggest category of export, seafood. A noticeable spike in attention to Alaska appeared after a May trade mission the state sent to China. They also showed interest in Nairobi U.N. offices and in the Kenyan ports of authority and in German automotive manufacturer Daimler AG.

Dave Bittner: [00:08:30] The Intercept reports that snafus on the part of both British and Canadian governments have exposed a range of sensitive, if not necessarily highly classified, information to the internet. Various agencies in the two governments misconfigured pages of the popular project management software Trello they were using in a way that enabled the compromise. Among the data exposed were passwords for various government sites.

Dave Bittner: [00:08:56] At midweek, security firm Cofense noted a brief flare-up of phishing attacks against banks that made use of the familiar Necurs botnet. The attacks surged for a few hours Wednesday then subsided. But in that time, Cofense said, some 2,700 bank domains were prospected. The goal of the phishing appeared to be installation of the FlawedAmmyy remote access Trojan, often by a maliciously crafted PDF attached to the email. It's not known why the campaign was as short-lived as it was.

Dave Bittner: [00:09:29] Epic Games, makers of the wildly popular Fortnite, pulled their signature game from Google Play as a business move to avoid Google's 30 percent cut of downloads, understandably because that's a lot of V-bucks by any standard. Cybercriminals have noticed this and are using bogus Fortnite download sites to spread various forms of malware. Google Play's walled garden may be more chain-link than moated stone enclosure, but it does afford some degree of protection. If you want to upgrade your skin from Recon Specialist to Whiteout, well, caveat emptor, and be sure you're downloading the genuine article.

Dave Bittner: [00:10:09] Finally, the U.S. federal government and Kaspersky Lab have filed their final briefs in the lawsuit Kaspersky has brought against the government's ban of their products. Kaspersky argues that the law Congress passed that kicked their products out of the federal marketplace amounts to an unconstitutional bill of attainder, punishment imposed by legislative fiat as opposed to the due process offered by a court. A judicial panel will begin hearing the case on September 14.

Dave Bittner: [00:10:37] For what it's worth, Bulgaria has recently decided it really doesn't trust Kaspersky either. Among the more interesting claims being made, not in court but in the online coffeehouses where we get so much of our information, is that the company is not to be trusted because Eugene Kaspersky goes to the banya, the sauna, steam bath, weekly and that his banya is also favored by officers of the FSB and the GRU. Kaspersky himself has called this a lot of hooey since he really has no idea who any of the other naked guys are. And indeed, he may have a point. Let those of us who are certain we've never been to the banya with a couple of GRU colonels cast the first venik. But don't give the banshik your password either, comrade.

Dave Bittner: [00:11:29] And now a bit about our sponsors at VMware. Their trust network for Workspace ONE can help you secure your enterprise with tested best practices. They've got eight critical capabilities to help you protect, detect and remediate. A single open platform approach, data loss prevention policies and contextual policies get you started. They'll help you move on to protecting applications, access management and encryption. And they'll round out what they can do for you with microsegmentation and analytics. VMware's white paper on "A Comprehensive Approach to Security Across the Digital Workspace" will take you through the details and much more. You'll find it at thecyberwire.com/vmware. See what Workspace ONE can do for your enterprise security, thecyberwire.com/vmware. And we thank VMware for sponsoring our show.

Dave Bittner: [00:12:29] And joining me once again is Emily Wilson. She's the director of analysis at Terbium Labs. Emily, welcome back. You recently got certified. You have a CFE credential. Tell us what that is and why you went after that.

Emily Wilson: [00:12:45] Yes, my very first credential - and maybe my last. I have to tell you, seven months of prep was a big time commitment, but it was worth it. So I am now a certified fraud examiner. Look out, fraudsters. I'm coming for you.

Dave Bittner: [00:12:59] (Laughter) OK.

Emily Wilson: [00:13:00] It was a good experience and one that I went after because, you know, I find myself seeing part of the fraud life cycle. And I wanted to understand the full fraud life cycle. Right? I'm seeing information on, sometimes, the front end and the back end. I'm seeing data that's being put up for sale, data that's being traded, techniques and tactics that are being discussed, and I see how these frauds are being committed.

Emily Wilson: [00:13:25] And so I understand, what I see most often and what I think is most important. But I wanted to take a step back and put myself in the shoes of someone who's dealing with this kind of fraud every day. And particularly in an industry that is still dealing with, frankly, a lot of actual paperwork, how does this work? How does this apply? How are people thinking about this? And what I found is that all of the same pieces of this that I'm seeing, all of the things that fraud professionals are dealing with every day - these are all the same things.

Emily Wilson: [00:13:54] And so I think there's an opportunity here to begin to bridge that gap between, you know, security and data trade and account exposure and templates and guides and tactics to commit fraud - and bringing that to fraud professionals and saying, if you're wondering where they're going and how they're approaching this and how they're getting around systems, this is how they're doing it. If you want to know how data is being traded and why all of these accounts are being taken over in batches, here's how it's happening. Here's how it works.

Emily Wilson: [00:14:24] You know, fraud professionals are dealing with a lot of different issues - the speed of payments, issues with identity and authentication. You know, they're dealing with good old-fashioned loan fraud and check fraud. And I'm seeing components of that. And now I understand how they're thinking about it, and so we can work together to figure out how we can bring all of this together and how we can, you know, maybe stop some fraud.

Dave Bittner: [00:14:46] Yeah. It's interesting to me how the fraud investigators - it's sort of - it's cybersecurity adjacent, I suppose. I mean, is that a fair way to describe it?

Emily Wilson: [00:14:57] Absolutely. It's adjacent. It's running in parallel, and it overlaps. But no one - it's like a Venn diagram no one knows about yet.

Dave Bittner: [00:15:05] Describe to me - you go, you sell this to your boss at Terbium. You say, this is something I want to pursue. What was the value proposition for them?

Emily Wilson: [00:15:15] It's picking up experience in another industry and one that is beginning to recognize - you know, I saw this recently at a fraud conference I was at - one that's beginning to recognize the value of data and the impact of exposed data on the work that they are doing every day. And so it was a chance to say, this is where it's going. This is actually where it already is happening, and the industry is starting to recognize that. They're starting to see it. Right? The dark web is coming up in conversations at fraud conferences in the same way that malware and phishing and ransomware are coming up.

Emily Wilson: [00:15:47] This is starting to be part of the conversation, and I want to be a part of that. I want to understand how people are thinking about it and how they're approaching it. I saw this as an opportunity to do that. And I have to tell you, the community has been very open. This is a collaborative set of professionals who recognize shared problems and are looking for shared solutions. And I think the security community could stand to learn from that.

Dave Bittner: [00:16:10] That's an interesting insight. Emily Wilson, thanks for joining us.

Dave Bittner: [00:16:18] A few words from our sponsor Cylance - they're the people who protect our own endpoints here at the CyberWire. And you might consider seeing what Cylance can do for you. You probably know all about legacy antivirus protection. It's very good as far as it goes. But guess what. The bad guys know all about it, too. It will stop the skids, but to keep the savvier hoods' hands off your endpoints, Cylance thinks you need something better. They've just introduced version 2.3 of CylanceOPTICS. It turns every endpoint into its own security operations center. CylanceOPTICS deploys algorithms formed by machine learning to offer not only immediate protection but security that's quick enough to keep up with the threat by watching, learning and acting on systems behavior and resources. Whether you're worried about advanced malware, commodity hacking or malicious insiders, CylanceOPTICS can help. Visit cylance.com to learn more. And we thank Cylance for sponsoring our show.

Dave Bittner: [00:17:22] My guest today is Marco Rubin. He's senior investment director at the Center for Innovative Technology. That's CIT. Our conversation focuses on CIT's desire to explore and invest in technologies and innovations that improve the security and safety of unmanned aircraft and drones.

Marco Rubin: [00:17:41] We're looking at both consumer-grade drones as well as commercial- and institutional-grade drones. So for example, on the institutional side, we recently made an investment on the equity side, the drone technology out of NASA Langley. And that would be serving both government/military and commercial markets. So that would be an example of the institutional side. We are looking at investment opportunities from the consumer - the mass-market side. But we're primarily focused on, essentially, good investments. And in this area that we're talking about, this convergence of security and these different platforms, it's a fairly nascent area depending upon - you touched exactly the point. It's more developmental on the commercial side and the consumer side than it is on the governmental side. So we have to think of it as a more ruggedized kind of platform on the military side, as you would of - might imagine. It is fairly early for us, so we're just now in the process of defining that. And for us, one of the areas that's kind of exciting is defining what experiments look like for security and autonomy.

Marco Rubin: [00:18:48] So it - right now, I would say we are interested in seeing what other people have to say about what would be an interesting experiment to conduct and mature the infrastructure, the ecosystem. We are - we were just discussing earlier today this idea about an experiment to see what it would mean to create more of a hardened security structure for a commercial drone flying over a heavily populated area, for instance, and what interest would that be, for example, to the insurance industry?

Marco Rubin: [00:19:19] So those are the kind of things that we're starting to think through. And - but quite frankly, there're a lot more smart people out there than are in this building, and we're looking for ideas to drive that. And we've seen some innovators come up with both quiet technologies as well as safer technologies that have fail-safe mechanisms. The beauty of it is, we're starting to see a lot of interesting innovation early on in this area, and it's not just the air segment, too. It's also in ground vehicles. We're also seeing it maritime, where some of the data links to maritime drones - it's a real issue. How do you propagate a signal in water versus air?

Dave Bittner: [00:19:57] What are your specific concerns when it comes to security? Can you describe some of the issues there?

Marco Rubin: [00:20:02] There's - the FAA likes to define airspace - both controlled and uncontrolled airspace - and definitionally, you know, it's the government, if I - memory serves me correctly there - they have a series of class A through E airspaces, which are definitionally for controlled airspaces. And then there's a whole different category for what you had described as an uncontrolled airspace. And so when you're talking about controlled versus uncontrolled airspace, you have different regulatory structures in place.

Marco Rubin: [00:20:29] And one area the government's really interested in is creating a national sovereign airspace. So imagine you want to be able to fly from point A to B, and what does that mean if you're flying over from here to Leesburg to another location? You'd like to have a uniform air-control system. And with that comes the implications on how design for liability.

Marco Rubin: [00:20:52] So to your point, do you want a safe vehicle that has not only security but high reliability in the design - and, you know, there's a real question about deconfliction. You know, when you get a drone - to your point - you know, it can be easy to operate. And what happens when a commercial or professional drone operator or even a helicopter, quite frankly, is at a crime scene or an incident, and you have a just John Q. Public operating a drone in the area, and you get into all sorts of potential collision-avoidance scenarios?

Marco Rubin: [00:21:24] So one of the big topics right now is exactly that in airspace. How do you manage deconfliction? How do you avoid aircraft A from colliding into aircraft B? And what is the mechanism, both policy and technical, that that happens? And then, quite frankly, how do you avoid a malicious attack so it isn't deliberately done?

Dave Bittner: [00:21:42] Right.

Marco Rubin: [00:21:43] And it starts getting to be very complex. And then the last thing you want to have happen, of course, is you don't want to have city X create its own little municipal rules because they don't want a particular aspect of drone operation over their airspace, so that's the whole idea behind kind of this sovereign airspace concept - so, you know, create essentially one set of rules to fly from point A to B. And that's what - in my view, what would be really interesting is to get some of the great minds out there in cyber and start thinking about, hey, what are some experiments we can do in a control setting, which is what these - some of these platforms that we have here are in the center of excellence and this IIP win that we had with the FAA, which is, hey, we can now test air, ground, sea and actually, I would even argue, space. There's a question of, how is it - you know, to what extent is the satellite considered an autonomous vehicle - a low earth orbiting satellite, for instance.

Dave Bittner: [00:22:42] Right.

Marco Rubin: [00:22:42] And to what extent is there vulnerability from a malicious attack or - you know, so the same sort of thought process that you see in other systems applies here. And I think it's kind of an early frontier. And I know some of the three-letter agencies are concerned about that. You know, how do you take a commercial low earth orbiting satellite system and know that the com links are robust and not vulnerable to an attack?

Dave Bittner: [00:23:04] Right.

Marco Rubin: [00:23:06] And so, you know, you can go a little bit crazy with some of the scenario analysis, but the point is, I think there's an opportunity to start defining that in kind of a controlled way. So I'm hoping that we can kind of get that message out to the public that says, hey, you know, we're going to look at these things through our autonomous center of excellence and announce a good time to start getting engaged with us.

Dave Bittner: [00:23:27] That's Marco Rubin from CIT, the Center for Innovative Technology. If you think you've got something to contribute, they would love to hear from you. You can check out their website at cit.org. And that's the CyberWire.

Dave Bittner: [00:23:44] Thanks to all of our sponsors for making the CyberWire possible, especially to our sustaining sponsor, Cylance. To find out how Cylance can help protect you using artificial intelligence, visit cylance.com. And Cylance is not just a sponsor. We actually use their products to help protect our systems here at the CyberWire. And thanks to our supporting sponsor VMware, creators of Workspace ONE Intelligence. Learn more at vmware.com.

Dave Bittner: [00:24:10] The CyberWire podcast is proudly produced in Maryland out of the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technology. Our CyberWire editor is John Petrik, social media editor Jennifer Eiben, technical editor Chris Russell, executive editor Peter Kilpe, and I'm Dave Bittner. Thanks for listening.