In today's podcast we hear that the US has charged a former CIA engineer in the WikiLeaks Vault 7 case. Olympic Destroyer may be back, and preparing to hit chemical weapons investigators and arms control specialists. Updates on the Liberty Life data extortion investigation. Elon Musk says Tesla Motors has an internal saboteur. The US Senate snatches the lifeline out of ZTE's hands. A guilty plea in OPM-breach-related fraud. A possible motive in the Jeopardy champ's email hacking. David Dufour from Webroot with insights on the impact they’re seeing from GDPR. Guest is Lenny Zeltser from Minerva Labs discussing his IT and security “cheat sheets.”
Charges in Vault 7 case. Olympic Destroyer appears to be back. Liberty Life hack. Does Tesla have a rogue insider? US Senate hits at ZTE. Guilty plea in OPM hack-related fraud. Motive: blackmail.
↧
↧
Satellite communications suffer from Thrip(s). Zacinlo rootkit poses as a VPN. Insecure Firebase apps. EU copyright legislation. Kardon Loader. Bithumb robbed. #Opicarus2018. Bitcoin Baron jailed.
In today's podcast, we hear that the Chinese espionage group Thrip is targeting satellite communications operators and others in the US and Southeast Asia. Zacinlo rootkit hides inside a bogus VPN. Developers are leaving Firebase apps insecure. The EU's controversial copyright regulation advances from committee. Kardon Loader malware is in beta. South Korean cryptocurrency exchange Bithumb is looted of more than $30 million. Anonymous is back with Opicarus2018. And the Bitcoin Baron goes to jail. Awais Rashid from Bristol University on why real-world experimentation is vital to cyber security. Guest is Dr. Chris Pierson from Binary Sun Cyber Risk Advisors, weighing in on the claims of sabotage at Tesla.
↧
Playing on Kindness — Hacking Humans
Joe explains the Ben Franklin effect. Dave describes job applicants tricked unto money laundering. A listener tells a tale of being fooled by an appeal to greed. Joe interviews Stacey Cameron from DirectDefense about her physical penetration testing work.
Thanks to our show sponsor KnowBe4.
↧
Malicious apps, a clever botnet, and cryptojacking. Patch notes. EU copyright regulations. Congress still doesn't like the cut of ZTE's or Huawei's jib. Tesla sues a former employee.
In today's podcast we hear about a malicious app that will save your battery, but it will also install a backdoor, steal information, and click on a bunch of ads. A sophisticated and patient botnet, Mylobot, is observed in the wild, but it's not yet clear what it's up to. Cryptojackers exploit a known (and patched) Drupal vulnerability. Vectra finds tunnels. Google adds security metadata to Android apps. Cisco patches. The EU's proposed copyright regulations attract little love. Congress pursues ZTE and Huawei. And Tesla sues a former employee. Ryan LaSalle from Accenture, on the opening of their new Cyber Fusion Center. Guest is Ned Miller from McAfee on their “Winning the Game” report on the gamification of security training.
↧
Phishing plays small ball with depressing success. Chinese cyberespionage up. US IC, JCS, worries about innovation. Guilty plea in US espionage case. Ex-Knesset member suspected of spying. Supreme Court decides location privacy case.
In today's podcast, we hear that phishing scams continue to nibble away at bank accounts and reputations: the State of Oregon is among those suffering. Avoid emails promising you leaked pictures of YouTube stars. Chinese espionage against US targets rises. US Intelligence officials worry that failure to play a long game puts the country at a disadvantage with respect to innovation. The Joint Chiefs mull electronic warfare issues. Reality Winner makes a plea agreement in her espionage case. And from ecstasy tablets to Iranian spying is a short sad road. Ben Yelin from UMD CHHS weighs in on the US Supreme Court decision on location data privacy. Guest is Taavi Kotka, former CIO of the Estonian government, discussing that nation’s innovative digital identity system.
↧
↧
LG smartphone keyboard vulnerabilities — Research Saturday
Researchers at Check Point Research recently discovered vulnerabilities in some LG smartphone keyboards, vulnerabilities that could have been used to remotely execute code with elevated privileges, act as a keylogger and thereby compromise the users’ privacy and authentication details.
The CyberWire's Research Saturday is presented by the Hewlett Foundation Cyber Initiative.
Thanks to our sponsor Enveil, closing the last gap in data security.
↧
Nation-state cyberespionage and cybercrime. Cryptocurrency fraud and theft give alt-coins a rocky ride. Sino-US trade conflict update. GDPR data extortion. Spammy protection racket.
In today's podcast, we hear that Taiwan continues to receive the PLA's cyber attentions. A look at what the Lazarus Group is up to. Cryptocurrency fraudsters arrested as alt-coin values have a rocky ride. Continuing US hot water for ZTE and Huawei. GDPR-themed data extortion. Business email compromise is up. So are ransomware attacks against US city governments. And when is a ransomware attack not a ransomware attack? When it's just a protection racket. Johannes Ullrich from SANS and the ISC Internet Storm Center podcast on evasive cryptocoin miners.
↧
Romania, UK, warn of Russian cyber ops. International norms of cyber conflict. Bronze Butler's USB drives. Too-smart batteries not smart enough. Industry notes. Game cheater gets jail time.
In today's podcast, we hear warnings of Russian cyber operations from Romania and the UK. Recent attempts at developing international rules of conduct (and conflict) in cyberspace. Bronze Butler's naughty USB drives—not as scary as they sound, but a useful reminder of some sound precautions. FireEye says it never hacked back. Smart batteries may be too smart for their users' good. A new venture fund lends credibility to cryptocurrency and blockchain startups. Overwatch hacker gets jail time in Inchon. Daniel Prince from Lancaster University on cascading failures in complex systems. Guest is Vikram Thakur from Symantec on the VPNfilter router infestation.
↧
DDoS attack on ProtonMail. Rancor cyberespionage campaign. PythonBot serves ads and a cryptominer. EU joint cyber response unit forming. Arrests in BEC campaign. Reality Winner's plea.
In today's podcast, we hear that ProtonMail was hit this morning by an Apophis Squad DDoS attack. Rancor cyberespionage campaign observed in Southeast Asia. PythonBot serves up adware and cryptojacking. WannaCry-themed protection racket is all bark and no bite. EU organizing a joint cyber incident response force. FBI and international partners make arrests in an Africa-based business email compromise racket. Reality Winner's guilty plea. Emily Wilson from Terbium labs with a story of a six-year-old dealing with identity theft. Guest is Paul Aubin from Varonis on the protection of federal systems.
↧
↧
Separating fools from money. — Hacking Humans
Dave shares a story of airport penetration testing with high degree of yuck-factor. Joe explores research on protecting passwords from social engineering. The catch-of-the-day comes courtesy of Graham Cluley's email spam box. Dave interviews Wired's Security Staff Writer Lily Hay Newman on her article tracking Nigerian email scammers.
Thanks to our show sponsor KnowBe4.
↧
Ukraine accuses Russia of preparing a cyber campaign. China eyes Tibetan diaspora. A decryptor for Thanatos ransomware. Nudging away from privacy. Dark web undercover.
In today's podcast we hear that Ukraine has warned that Russia is preparing a coordinated attack against Ukrainian financial and energy infrastructure. China appears to be stepping up surveillance of the Tibetan diaspora. Cisco's Talos unit has a free decryptor for Thanatos ransomware. Facebook's self-audit of data usage proves both more difficult and more skeleton-rattling than hoped. Norwegian consumer watchdogs find that Facebook and Google nudge users away from privacy. An alt-coin sting against drug dealers. Mike Benjamin from CenturyLink on Malspam, and how it differs from run of the mill spam. Guest is Jaime Blasco from AlienVault on the security implications of using open source tools.
↧
Data breaches and data exposure. Privacy legislation. Improperly collected phone call records destroyed.
In today's podcast we hear that Ticketmaster UK's hacking incident will provide an interesting GDPR test case. Data aggregator Exactis left nearly two terabytes of personal and business information exposed on the publicly accessible Internet. NSA destroys telephone call data collected in ways it can't square with applicable law. California hastily passes a data protection law. Ave atque vale Harlon Ellison. And our condolences to the victims of the shooting at the Capital Gazette in Annapolis. Dr. Charles Clancy from VA Tech’s Hume Center, discussing his recent congressional testimony concerning supply chain security. Guest is Dr. Mansur Hasib, discussing his book Cybersecurity Leadership.
↧
VPNFilter malware could brick devices worldwide — Research Saturday
Researchers from Cisco Talos continue to track malware they've named VPNFilter, a multi-stage infection with multiple capabilities, targeting consumer-grade routers. Craig Williams is head of Cisco Talos Outreach, and he joins us with the details.
The CyberWire's Research Saturday is presented by the Hewlett Foundation Cyber Initiative.
Thanks to our sponsor Enveil, closing the last gap in data security.
↧
↧
Adidas data breach. Facebook on data abuse. Investigation of Exactis data exposure continues. Algonquin College hacked. Tenable's IPO. US-Russia summit will talk election influence ops.
In today's podcast we hear a bit about the data breach Adidas disclosed late last week. Facebook answers Congressional questions for the record and adopts a data abuse bounty program. Investigation of the Exactis data exposure incident continues, but the class action lawsuits have already begun. Algonquin College discloses a hacking incident. Tenable with hold an IPO. US-Russian summit will take up election influence ops. FireEye says North Korea is hacking Latin American banks. Joe Carrigan from JHU ISI reviewing a recent Black Hat survey of cyber security industry professionals.
↧
Hybrid warfare. Inveterate DDoS against ProtonMail. Security concerns about Chinese companies. Retail breaches. Agencies scrutinize Facebook data abuse. Infrasound weapons?
In today's podcast we hear that Ukraine has warned of hybrid warfare during UN counter-terrorism meetings. ProtonMail DDoS continues. Security concerns surrounding ZTE, Huawei, and China Mobile. Retail data breaches. A quiz app's backup data are accessed by unauthorized parties. FBI, FTC, and SEC sift through Facebook's answers to questions for the record. A strange set of symptoms among diplomats in China arouses suspicion of infrasound weapons. Rick Howard from Palo Alto Networks on the Cyber Threat Alliance. Guest is Vince Arneja from 5nine on secure cloud implementations.
↧
Catphish and Charming Kittens. Data-sharing receives more scrutiny. European copyright law won't be fast-tracked. ZTE gets some relief. Juggalos and Juggalettes defeat facial recognition tools.
In today's podcast we hear about some catphishing in the IDF's pond. Charming Kitten uses itself as bait. Facebook and Google face scrutiny over sharing users' information with third-parties. The Pirate Bay is back after its hiatus, and it's back to cryptojacking. The European Parliament voted today to reopen debate on its controversial copyright legislation. ZTE receives some perhaps temporary, perhaps more enduring, relief from US sanctions. And confusion to the Muggalos' facial recognition software. Justin Harvey from Accenture with thoughts on quantum computing. Guest is Gadi Naveh from Check Point Software with a look at open source security tools.
↧
When catphishing, it pays to know what bait they'll take. Permission hogs are often misers. Cyber comes to the NTC. Natural intelligence screening for artificial intelligence. The Thermanator.
In today's podcast we hear about catphishing in Berlin and Tel Aviv: whether you're offering payment for a white paper or up-to-date futbol scores, it pays to know the right bait. Android apps may be permission hogs, but it's surprising how often the hogs hoard like misers, never really using them. The US Army pushes cyber into the brigades. How Facebook checks facts. The Thermanator knows which keys you've typed from the heat your hot hand leaves behind. Emily Wilson from Terbium Labs on their recently released white paper on fraud as a supply chain. Guest is Brian Wells from Merlin International discussing how high-performing health care organizations are addressing cyber threats.
↧
↧
No Distribute Scanners help sell malware
Sellers of malware on Dark Web forums often use No Distribute malware scanning tools to help verify the effectiveness of their wares, while preventing legitimate virus scanning tools from adding the malware to their database.
Daniel Hatheway is a Senior Security Analyst at Recorded Future, and he takes us through their recently published research, Uncover Unseen Malware Samples with No Distribute Scanners.
The CyberWire's Research Saturday is presented by the Hewlett Foundation Cyber Initiative.
Thanks to our sponsor Enveil, closing the last gap in data security.
↧
Malware infections down during World Cup matches. UK-Russia tensions. Australian National University hacked. Data breach notes. Calls for cooperation. Tell it to the Marines.
In today's podcast, we hear that if your nation's team was playing a World Cup match, you probably weren't visiting dodgy websites. Concerns mount in the UK that Russia may be readying a long-expected attack on British infrastructure and holding it until the Cup is decided. The Australian National University is hacked in an apparent espionage attempt. Data breaches at Timehop, DomainFactory, and Macy's. Russia calls for international cooperation. The Marines say it wasn't them on that dating app. Malek Ben Salem from Accenture Labs with tips on GDPR compliance.
↧
More Elon Musk impersonators in social media. Cryptocurrency raided. Spearphishing in Palestine. BlackTech espionage group. Apple upgrades. Polar Flow fitness app and oversharing.
In today's podcast, we hear that advance fee scams run by Elon Musk impersonators are using the recently rescued boys' soccer team as phishbait. Bancor wallet robbed of crytpocurrencies. Palestinian police spearphished. BlackTech espionage group using stolen certificates to sign malware. Apple's upgrades are out—one privacy enhancement has a workaround. Microsoft is in the process of patching. And another fitness app, Polar Flow, overshares. Jonathan Katz from UMD on homomorphic encryption standards. Guests are Julie Bernard from Deloitte and John Carlson from the FS-ISAC with results from a recent FS-ISAC survey.
↧
More Pages to Explore .....
