DAVID: A CYBERATTACK HITTING
PRODUCTION OF SEVERAL MAJOR
NEWSPAPERS, "CHICAGO TRIBUNE,"
THE "NEW YORK DAILY NEWS" AND
BALTIMORE SUN AMONG OTHERS.
TO CYBER EXPERT DAVID KENNEDY
WHAT BUSINESSES CAN DO TO
PROTECT THEMSELVES.
FIRST OF ALL, WHAT DO YOU THINK
WAS GOING ON HERE?
>> THANKS FOR HAVING ME ON.
WHAT IS INTERESTING ABOUT THIS
ONE A NUMBER OF DIFFERENT NEWS
ORGANIZATIONS FROM LOS ANGELES
TO CHICAGO, WHERE THEY COULDN'T
PRODUCE NEWSPAPERS BECAUSE OF
THE MALWARE DROPPED ON TO THESE
SYSTEMS AND THIS IS THE TYPE OF
MALWARE KNOWN AS RANSOMWARE,
WHAT IS INTERESTING, THERE WAS
NO DEMAND FOR PAYMENTS.
THIS WOULD INDICATE TRYING TO
DESTROY OR HURT COMPUTER SYSTEMS
INSTEAD OF MAKING MONETARY GAIN
WE SEE FROM NORMAL HACKERS.
THAT IS INTERESTING WHAT IS
GOING ON.
DAVID: THAT IS WHAT STUCK OUT TO
ME.
THERE WASN'T ANY OF THIS,
USUALLY AFTER PEOPLE'S CREDIT
CARDS OR OTHER STUFF THEY CAN
MAKE MONEY OFF OF.
>> EXACTLY.
DAVID: SEEMS LIKE THIS WAS A
SPECIFIC ATTACK.
NEWSPAPERS, I'M AN OLD NEWSPAPER
GUY, THEY'RE HAVING ENOUGH
TROUBLE.
THEY DON'T NEED THIS ON TOP OF
ALL THE OTHER PROBLEMS THEY HAVE
BUT LOOKS LIKE A SPECIFIC ATTACK
AGAINST THESE ORGANIZATIONS,
RIGHT?
>> WHAT'S INTERESTING, IF YOU
LOOK WHAT HAPPENED RECENTLY WITH
THE MARRIOTT STARWOOD BREACH,
THEY HAD BEEN BREACHED FOR
SEVERAL YEARS.
AND NONE OF THAT DATA WAS
ACTUALLY PUBLISHED OR BEING SOLD
ON THE UNDERGROUND MARKET T CAME
OUT A FEW WEEKS AFT WARD IT WAS
ATTRIBUTED TO A CHINA HACK.
A LOT OF TYPES OF ATTACKS WE
SEE, THERE IS NO SPECIFIC
MONETARY GAINS ARE USUALLY NOT
ATTRIBUTED BACK TO ORGANIZED
CRIME AND MOST SPECIFICALLY IN
THIS SPECIFIC ATTACK AGAINST THE
NEWSPAPERS THE MALICIOUS
SOFTWARE WAS IDENTIFIED AND A
KNOWN VARIANCE FROM NORTH KOREA.
I DON'T WANT TO SAY IT IS FROM
NORTH KOREA BUT WE DON'T HAVE A
LOT OF DETAIL THIS TYPE OF
MALWARE IS USED BEFORE IN THE
PAST.
REMNANTS OF CODE WAS USED IN THE
SONY BREACH WHERE THEY DESTROYED
SONY'S INFRASTRUCTURE DURING
THOSE MOVIES.
WE'RE LOOKING TO SEE IF IT WAS
NATION STATES OR INVOLVED AND
THIS IS DAMAGING TO NEWSPAPERS
WHICH GENERALLY LACK A LOT OF
SECURITY.
DAVID: YOU SAY THEY'RE LOOKING.
IS THAT A COMBINATION OF PRIVATE
EFFORTS, COMPANIES THEMSELVES,
AND THE FEDERAL GOVERNMENT?
>> THAT'S RIGHT.
USUALLY WHAT HAPPENS IN THESE
TYPES OF SITUATION AS THIRD
PARTY COMPANY WILL GO IN
CONJUNCTION WITH LAW ENFORCEMENT
TO IDENTIFY WHERE THE ATTACKERS
CAME FROM AND WHO THEY WERE,
LOOKING AT CODE SIMILARITIES.
CAN WE ATTRIBUTE THEM BACK TO
SPECIFIC NATION STATE OR
ORGANIZED CRIME UNIT OR
INDIVIDUAL HACKERS, SO WE CAN
PREVENT THEM IN THE FUTURE.
THAT KICKS OFF ALMOST
IMMEDIATELY WHEN THESE BREACHES
OCCUR.
DAVID: MOIST OF US DON'T WORK
FOR NEWSPAPERS.
NUMBER OF PEOPLE WHO DO IS A
DWINDLING MINORITY.
I WONDER IF THIS KIND OF ATTACK
CAN WE EXPECT TO SEE IT IN OTHER
INDUSTRIES THAT MIGHT AFFECT US?
>> SPECIFICALLY, IF IT WAS
NORTH KOREA, THERE ARE USUALLY
TWO MOTIVES NORTH KOREANS HAVE.
ONE IS MONETARY GAIN.
THEY PLAY HEAVILY TRYING TO GET
AS MUCH MONEY AS POSSIBLE FOR
THE REGIME.
HACKING BITCOIN AND OTHER
CRYPTOCURRENCIES.
TRYING TOKES TORT MONEY --
DAVID: THAT DOESN'T SEEM TO BE
WHAT IS GOING ON HERE?
>> NO.
THE SECOND MOTIVE IS USUALLY
POLITICALLY CHARGED WHERE THEY
CAN SHUT DOWN AREAS WHERE THEY
SHOW THE REGIME IN HIGHER LIGHT
OR DID A BAD PRESS RELEASE
AGAINST NORTH KOREANS OR THE
PRESIDENT, TO RETALIATE IN SOME
WAY, SHAPE OR FORM.
AT LEAST ON THE SURFACE WHAT
APPEARS TO HAPPEN RIGHT NOW
WHICH IS AN INTERESTING ELEMENT
WE'LL CONTINUE TO LOOK FOR.
DAVID: DAVID, WILL WE FIND OUT
EVENTUALLY WHO DID ISN'T IS IT
EASY TO TRACE THE PERP HERE?
>> TO ATTRIBUTION IS REALLY
DIFFICULT TO FIND INDIVIDUALS.
WE LOOK FOR AREAS WHERE THEY MAY
SLIP UP OR CODE NOT SHARED
BETWEEN ANYBODY ELSE OTHER THAN
SPECIFIC GROUPS.
I WOULD SAY IN MOST
CIRCUMSTANCES WE CAN ATTRIBUTE
IT BACK TO A SPECIFIC GROUP OR
NATION-STATE OR SOMEBODY HACKING
THEM.
I THINK WE'LL GET MORE
INFORMATION AS THE TIME COMES
ALONG, BUT MOST CASES IT'S A
VERY DIFFICULT PROCESS, TAKES A
LOT OF TIME AND REQUIRES A LOT
OF ARTIFACTS AND ELECTRONIC
EVIDENCE TO SEE WHAT IS ACTUALLY
OCCURRING.