CyberWire Daily

Andrew Wild is CISO at QTS Data Centers. He shares his insights into the changing role of the Chief Information Security Officer, as businesses shift their focus toward risk. Learn more about your ad choices. Visit megaphone.fm/adchoices

Cybersecurity expert and author Scott Schober shares his personal story of being hacked, and how it set him on a mission to help prevent it from happening to others. Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan is Cymmetria's General Counsel. A former trial attorney, Mr. Braverman is an expert in cyber-security law, policy and regulation. He has written policy papers on export controls over cyber technology, active defense and "hacking back." Learn more about your ad choices. Visit megaphone.fm/adchoices

In this edition of the CyberWire Research Saturday, we'll take a look at a more recent intrusion PwC has uncovered, named KeyBoy and highly likely a China-based threat actor. It uses compromised Word documents to gain access. Bart Parys is a lead researcher in PwC's cyber threat intelligence team, responsible for tracking cyber threat actors, their latest toolsets and methodologies.  https://www.p...

In today's podcast we hear some updates on the Triton ICS malware campaign. North Korea amplifies its denials of responsibility for WannaCry. Cryptocurrency markets undergo a strong correction. "Blockchain" remains a word to conjure with. Citing a potential risk to national security, Lithuania's government bans Kaspersky software. ESET thinks Fancy Bear is growing more cunning and evasive. Chris P...

In today's podcast, we suggest a new year's resolution all organizations should make: resolve to configure your cloud services for privacy and security. Another cryptocurrency exchange gets hacked, this one by DNS hijacking. North Korea finally says it had nothing to do with WannaCry, but few are convinced. The Lazarus Group continues to be a prime suspect in cryptocurrency theft. Section 702 near...

In today's podcast, we talk about what the Five Eyes see. Implications of North Korean responsibility for WannaCry. Defense and deterrence go with naming and shaming. The Lazarus Group looks to cryptocurrency theft to redress North Korean financial shortfalls. Copperfield cyber espionage campaign in the Middle East. GDPR approaches, and organizations look to get their data houses in order (and buy...

In today's podcast, we hear that the Five Eyes look at WannaCry and officially see Pyongyang. New US National Security Strategy emphasizes economic power and cybersecurity (and names the adversaries). Hex Men are no super heroes. More Bitcoin theft bankrupts an alt-currency exchange. Android Monero miner can basically melt your phone, it's working so hard. Users leave Lexmark printers open to the...

In today's podcast, we hear how the Zealot campaign uses ShadowBrokers' exploits to install a Monero miner on victim systems. Bitfinex suffers another DDoS attack as Bitcoin valuations remain high. Triton attack on industrial safety systems shows the risk of mixing control with safety. Exposed database of California voters investigated. Thales will buy Gemalto. Johannes Ullrich from SANS and the I...

Online underground markets thrive across the globe, with the Middle East and North Africa being no exception. Researchers at Trend Micro recently too a look inside these digital souks, and while much of what they discovered matches similar online marketplaces, there are unique cultural elements that set these regional trading posts apart. Jon Clay is a cyber security expert from Trend Micro, and h...

In today's podcast, we hear that Ethiopia's government has shut down the country's Internet during a period of unrest. TRITON ICS malware update. The FCC moves away from net neutrality. UK warnings about cable vulnerabilities. When a keylogger isn’t a keylogger. Security companies patch some products. Pyongyang likes Bitcoin. More on the NiceHash Bitcoin caper. Emily Wilson from Terbium Labs on br...

In today's podcast we hear that Anonymous has called for action against US and Israeli government sites. FireEye reports a significant attack against an industrial plant, possibly involving nation-state reconnaissance. A lot of Internet traffic was briefly rerouted through Russia yesterday, possibly deliberately, for unclear reasons. TV troubles. Dale Drew from CenturyLink on measuring against sta...

In today's podcast we hear a reminder about yesterday's Patch Tuesday. Classic Android games are serving malware. Crytpocurrency speculative fever continues to rise. More unwelcome miners are pulling Monero out of streaming video services. Ransomware extortionists are finding Bitcoin prices sometimes rise too fast for comfort. False hit-man spam. A Russian hacking defendant, in Russia, says Putin...

In today's podcast, we hear that Berlin says Beijing's been catphishing, and that Beijing says no way. Banking Trojans in Google Play look for Polish accounts. Spider malware spins out of the Balkans. Transferring risk doesn't mean you can ignore it. The SEC calls cease-and-desist on another ICO. That venti in Buenos Aires may have come with a CoinHive miner. Rick Howard from Palo Alto Networks on...

In today's podcast, we hear that al Qaeda is working on ISIS-style inspiration. The MoneyTaker gang has been raiding banks quietly for about a year and a half. HP fixes an inadvertent keylogger in its laptops. 4iQ finds a huge database of aggregated credentials from many breaches for sale on the dark web. Bitcoin and other cryptocurrencies attract scams and hackers. Why? That's where the money is....

Zberp is a stealthy banking trojan with an unconventional process injection technique. A hybrid of the ZeusVM and Carberp malware, Zberp uses a variety of techniques to prevent detection while it gathers information from infected systems.  Limor Kessem is an executive security advisor for IBM, and she's our guide. Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we learn that FireEye is warning of patient reconnaissance on the part of the (probably) Iranian APT34. The Electronic Ghosts of the Caliphate have so far failed to say "boo," except maybe in South Jersey. Flaws discovered in mobile banking apps. Bike-sharing service leaked data. Bitcoin's bubble. Microsoft patches its Malware Protection Engine. Chris Poulin from BAH on closing...

In today's podcast we consider warnings of a hacktivist intifada as the US prepares to recognize Jerusalem as Israel's capital. How Ethiopia's surveillance was discovered. Criminals flock to cryptocurrency sites with everything from DDoS to miners to theft. Keylogger found infesting WordPress sites. Android app development tools get quick fixes. Apple updates MacOS High Sierra again. What Uber may...

In today's podcast, we learn that the Satori botnet flashed into existence yesterday with 280,000 bots. Is there a router zero-day out there? Insecure cryptocurrency apps aren't deterring speculators. How much energy does Bitcoin use? About as much as Denmark. Ethiopia's government is said to be using spyware against journalists. Iran's Charming Kitty espionage group is looking at media, academics...

In today's podcast, we hear how an international police operation took down Andromeda, and possibly the criminal mastermind known as Ar3s. Mirai is back, and so are warnings about Reaper. There's a PayPal phishing expedition in progress (don't let yourself be a wild-caught sucker). A new variant of the familiar tech support scam features a bogus blue screen of death. Germany's Interior Minister co...

In today's podcast, we hear about an NSA employee who was charged Friday with "willful retention of national defense information." This appears to be the individual whose computer was equipped with Kaspersky security software, and scanned either by that security product or by a backdoor, depending on whom you believe. A look back at the other three alleged NSA leakers: Snowden, Martin, and Winner....

Bad actors are using Fast Flux Networks with quickly-changing IP addresses and domain names to help hide their activities. Or Katz, Principal Lead Security Researcher at Akamai, takes us through their recently-published white paper, "Digging Deeper — An In-Depth Analysis of a Fast Flux Network." Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that former National Security Advisor Flynn pleads guilty to lying to the FBI. Another misconfigured AWS account is found. Cobalt is either careless or engaged in misdirection. Election trolling and mutual suspicion between Russia and the US. Kaspersky says his company didn't, doesn't, and won't spy for the Russian government as US agencies begin to purge their systems...

In today's podcast we learn that British shipping giant Clarksons was breached but refuses to pay hackers extortion. The US House may be reaching consensus on surveillance authorities. INSCOM mops up Red Disk leak. The US Defense Department may have more work to do countering insider threats. HP denies reports of spyware in its PCs. Apple fixes High Sierra. Credit services think through the implic...

In this CyberWire special edition, we take a closer look at finding your career in cyber security. Just how important is that degree? Does it make sense to invest in certifications? What are employers really looking for when they’re searching for qualified cyber security talent? And why is it critical that you not just hunt down a sexy, high paying job, but build yourself a fulfilling career? Shar...