CyberWire Daily

The past few month have been all abuzz with excitement about cryptocurrencies and the blockchain. The price of Bitcoin took a rocket ride toward the stars, and stories were coming fast and furious about how the blockchain was going to tranform and revolutionize just about everything.  Jonathan Katz is a professor of computer science at the University of Maryland and director of the Maryland cybers...

In today's podcast, we hear that the Mabna Institute was pretty good at phishing. Facebook's Mark Zuckerberg sends regrets to Westminster. Facebook is under FTC investigation. Cambridge Analytica is in hot water with the FEC. Kaspersky says outing Slingshot was just part of the job. The City of Atlanta is finding it surprisingly hard to recover from SamSam ransomware. Aadhaar may be leaky, again....

In today's podcast we hear that Sixty Russian diplomats are now persona non grata in the US. It's the largest such retaliation so far for the Russian nerve agent attack in Salisbury, England. Fear of a Russian riposte against Western power grids remains high. Cambridge Analytica was raided over the weekend in the continuing Facebook data scandal. Facebook faces more difficulties over Android data...

Researchers at Duo Security recently unearthed a new vulnerability class that affects SAML-based single sign-on (SSO) systems. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a different user without knowledge of the victim user’s password. Kelby Ludwig is a Senior Application Security Engineer at Duo security, and he takes us through...

In today's podcast, we hear that the US has indicted Iranian hackers. Guccifer 2.0 has been fingered as a GRU team. Inquiries into their activities are folded into Special Counsel Mueller's investigation. Atlanta, Georgia, hit with ransomware. A study estimates the direct cost of the Equifax breach to consumers. App stores show a decline in malware infestations. Facebook leaders speak, finally, bu...

In today's podcast, we learn that Kaspersky Lab appears to have burned a US operation. Facebook has some other governments to answer to, now. Facebook CEO Zuckerberg finally discusses the Cambridge Analytics affair in public. Lawsuits and calls for regulation are shouted up. Best Buy shows Huawei the highway. And we have a brief wrap-up of the Billington International CyberSecurity Summit. Joe Car...

In today's podcast we hear that the US Department of Energy says the power grid is preparing for Russian attacks. Teenager finds flaw in hardware wallet. Travel service Orbit suffers a data breach. Laurie Love won't be extradited to the US. Notes from today's Billington International CyberSecurity Summit. And Facebook's truly awful week continues: the Silicon Age is looking right now a lot like th...

In today's podcast, we hear that ICS experts continue to warn of grid vulnerability to hacking. AMD chip flaws called real, but not very serious. Cambridge Analytica under investigation in the UK. Facebook tries without much success so far to disentangle itself from Cambridge Analytica's use of Facebook data. President Putin wins reelection amid accusations of voting fraud. Former French President...

In today's podcast, we hear that tensions between Britain and Russia remain high, as the UK fears a cyberattack. US power utilities are also on alert to an ongoing Russian cyber campaign. Despite a claimed DDoS attack, President Putin is re-elected in Russia. Facebook under fire for Cambridge Analytica data incident. More political bots in Twitter. YouTube tries content moderation. FTC takes on an...

There's been an epidemic of cryptojacking code injections recently, as bad actors attempt to cash in on the cryptocurrency craze through unauthorized cryptomining operations on unsuspecting users.  Marcelle Lee is a threat researcher at LookingGlass, and she takes us through her recently published research, Cryptojacking — Coming to a Server Near You.  Learn more about your ad choices. Visit megap...

In today's podcast we hear that NATO has condemned Russia for a chemical attack in England. The US sanctions Russia for NotPetya and election meddling, and warns of Russian preparations for an attack against US infrastructure. Chinese cyber operations support that country's claims to the South China Sea. Iran shows increased cyber espionage activity. Observers fear a return of Triton/Trisis ICS ma...

In today's podcast, we hear that AMD continues its investigation of the backdoors and other vulnerabilities CTS Labs publicly disclosed. That disclosure remains controversial. BlackTDS offers malware distribution as-a-service on the black market. PinkKite is a small but persistent point-of-sale threat. The SEC charges a former Equifax exec with trading on non-public information of the credit burea...

In today's podcast, we hear that AMD is investigating a report of exploitable flaws in its processors. Vietnamese threat actor OceanLotus gets a look from researchers. Patch Tuesday notes. Britain expels Russian diplomats in retaliation for a nerve agent attack. Russia demands to know what these cyberattacks are that the UK is said to be threatening. A brief history of Russo-British Twenty-first C...

In today's podcast we hear that Britain has given Russia an ultimatum: explain by midnight how your nerve agent got to Salisbury or face the consequences. Russia calls it nonsense. Cyber conflict between the two countries is widely expected. Palo Alto's Unit 42 finds HenBox Android spyware. NCC Labs describes Chinese backdoors used against UK Government and industry targets. President Trump replac...

In today's podcasts, we hear that security firms are warning of Iran's growing cyber capabilities, and Tehran's disposition to use them. Gossips and activists far outdo bots in spreading disinformation. Memcache kill-switch should be approached with legal caution. Slingshot espionage tools active quietly in the Middle East and Africa for six years. Fancy Bear sniffs at Asia. Australia is concerned...

Researcher from Lookout and the EFF have discovered an APT group operating out of Lebanon they've named Dark Caracal. The group is running a global espionage campaign, targeting journalists, military personnel, activists, lawyers, medical professionals and educational institutions.  Mike Murray is VP of Security Intelligence at Lookout, and he's our guide through their research. Learn more about y...

In today's podcast, we hear reports of cyber reconnaissance of Turkish financial institutions: Hidden Cobra is the suspect. The Chinese government appears to have finagled its national vulnerability database to afford misdirection to cyber operations. Cryptomining attempts hit Windows endpoints. Other cryptojacking campaigns afflict vulnerable servers. Memcrash DDoS hits new targets. The US Admini...

In today's podcast, we hear that a kill-switch for Memcrash may have been found (and Memcrash may be dangerous for other purposes than denial-of-service). Researchers in Hungary take a look at the Shadow Brokers' dumps and speculate about the purpose of the "Territorial Dispute" module. The Dutch Tax Authority sustained another DDoS attack last night. India's CERT renders a troubling report to Par...

In today's podcast, we hear that spies like Apache Struts exploits. Server vulnerabilities described. A new cryptojacker steals at least four varieties of cryptocurrency. North Korea may have hacked UN sanctions enforcers. Dutch Intelligence (and Microsoft) warn of cyberwar, but it's not a declared war, which makes response harder. Update to the pack rat defense, with considerations of mens rea. I...

In today's podcast we hear that Fancy Bear sightings continue—Fancy seems to have settled down in Montenegro, and Germany is seeing bears and snakes. Cyber deterrence is much desired but difficult to achieve. Notes from a Russian jail. Reddit purges influence ops trolls. What criminals can learn from your browser. CFIUS puts hold on Broadcom's bid for Qualcomm. The US FDA wants to block its people...

In today's podcast, we hear about a new campaign that targets humanitarian organizations with North Korean phishbait. Memcrash is now being exploited by criminal extortionists. Equifax losses from last year's breach are said to mount. Germany says it detected the compromise of a secure government network before too much damage was done. They don't offer official attribution, but everyone else says...

Researchers at Comodo Security Solutions have been tracking a recently discovered strain of malware named Lebal. The malware uses several clever techniques to attempt to hide itself, and once installed targets credentials and cryptocurrency wallets.  Fatih Orhan is VP of Threat Labs at Comodo, and he takes us through their research. Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that a Memcrash amplification attack took GitHub offline, but only briefly, thanks to Akamai mitigation. Germany continues to fight off ongoing attacks on sensitive government networks. Germany hasn't said so, but everyone else sees Fancy Bears pawprints over this one. Fancy Bear is also said to be snuffling around embassies and other diplomatic targets. Capitol Hill mu...

In today's podcast, we hear that Fancy Bear has been busy in a sensitive German government network. RedDrop Android malware is built for blackmail. Another exposed AWS S3 bucket is disclosed. Intel issues another Spectre fix. The FTC reaches a settlement with Venmo over privacy, security, and availability of funds. The SEC is investigating a number of initial coin offerings. Johannes Ullrich from...

In today's podcast, we hear that Memcrash threatens big DDoS events. Problems with single-sign-on solutions. Thanatos ransomware looks like its masters botched it, but that's not necessarily good news. The Marcher banking Trojan is back and bigger than ever. A new variant of Petya ransomware may be in circulation. What's the point of a false flag if no one's fooled? Dale Drew from CenturyLink on c...