Welcome to Codebook, the loose cannon cybersecurity newsletter that plays by its own rules.
Illustration: Aïda Amer/Axios
Until his run ended in 2001, Robert Hanssen spent 20 years as a Russian mole burrowed deep in the FBI. That made him one of history's most successful inside threats — a class of threat that plagues both government agencies and private companies.
The FBI agent who went undercover to bring Hanssen down, Eric O'Neill, recounts the operation in "Gray Day," which hits bookstores next week. He spoke to Codebook about what Hanssen's tale can teach the rest of us about trusted insiders.
The big picture: It's not just hackers who steal files or funds; sometimes it's inside threats — employees exploiting legitimate access to a network to rob their employers. "They are people who already have the keys to the kingdom," said O'Neill.
The intrigue: While Hanssen was paid by Russia, according to O'Neill he was also motivated by resentment about being passed over for the fieldwork he sought and instead sent to man counterintelligence databases in an office.
Trust, but verify: The FBI knew that someone in the government was leaking secrets to the Russians. But during their investigations, the agency refused to look internally for the mole.
What's needed: There are ways to thread the needle and guard against insider betrayal without destroying trust between management and staff.
The Devin Nunes defamation suit — the one pitting him against Twitter, a conservative pundit and a fake cow — is not an easy case for the California representative to win on any count. But it will be particularly difficult to win against Twitter.
The big picture: Legal experts Codebook spoke to do not think Nunes will be able to show that any of the insults on Twitter were defamation; hyperbolic trash-talking is already exempt from defamation. But there's a second level of difficulty with suing Twitter: the federal code known as Section 230.
Details: "Section 230 in the Federal code essentially says an internet provider is not the publisher," said attorney Mark Jaffe, the Mark in TorMark Law.
The intrigue: In the court documents, Nunes' lawyer tries to make the case that, since Twitter shows liberal bias (an argument favored by conservatives but unsupported by evidence) and moderates posts, it is an information content provider.
1 big fin. Photo: Marisol Bogaard/EyeEm/Getty Images
The financial criminal group FIN7, also called Carbanak, has upgraded its hacking toolkit, according to researchers at Flashpoint.
Why it matters: The group suffered 3 high-profile arrests since January 2018. While FIN7 never stopped thieving, the existence of new tools means the R&D arm of FIN7 — not just those pulling off attacks — has continued unencumbered.
To be sure: No one ever thought the arrests would end FIN7. The group always appeared to have more than 3 members and seemed capable of filling vacancies. There was, however, the outside chance the arrests could halt the group's software production cycle.
The new tools include a new attack interface, dubbed "Astra"; new malware spread by phishing that runs self-deleting SQL database commands, dubbed "SQLRat"; and a versatile backdoor, dubbed "DNSbot."
The big picture: With ransomware attacks, there's often a question if the intention is really to extort money. Some infections are meant as smokescreens to hide other attacks, while others are intended to cause damage under the guise of extortion. Talos finds that coding quirks in LockerGoga, intentional or not, may cause irreparable damage to systems.
Details: New versions of LockerGoga can permanently log users out of their systems, making it impossible to see the ransom note explaining how to decrypt their files.
Also: In another odd quirk, the ransomware does not list a cryptocurrency address to pay the ransom. Instead, it offers an email address to coordinate payment.
Editor's note: This piece was corrected to show Hanssen's run ended early 2001 (not December 2000).
Codebook will return Tuesday. (UCF over VCU, Virginia loses to Wisconsin, Zags win it all.)