CyberWire Daily

In today's podcast we hear that another misconfigured AWS S3 bucket has turned up. This one holds sensitive US Army files. Apple fixes a big flaw in the latest MacOS High Sierra version—the password is…"root." Russia says American aggression in cyberspace is moving it to create its own DNS. Russia and Venezuela exploit the Catalan independence movement for disruptive information operations. Boyuse...

In today's podcast we hear rumors that the third-man in the Shadow Brokers leak might soon become publicly known. ISIS enters its diaspora phase. Monero miner targets Macs. Google Play ejects apps with the Tizi [tizzy] backdoor. Scarab ransomware blasted out in spam campaign. Uber's value takes a hit, post-breach-disclosure. Barracuda Networks taken private. Trend Micro buys Immunio.  Emily Wilson...

In today's podcast, we hear that image-sharing service Imgur disclosed a data breach. It happened sometime ago, but they were quick to get the word out once they were aware of it. Uber faces regulatory attention and possible post-hack headwinds for its aniticipated IPO. Mozilla's working on a Firefox add-on to warn you that a site you're visiting has been breached. There's a minor resurgence of Mi...

The Terdot Banker Trojan is a descendant of the Zeus family of malware, and has evolved to feature serious espionage capabilities. It can compromise transactions, steal accounts and credit card information, and can eavesdrop on and modify traffic on social media and email platforms. While not yet widely spread, it's a threat to consumers and businesses alike. Bogdan Botezatu is a senior e-threat a...

Our guest today is Tiffany Li. She’s an attorney and Resident Fellow at Yale Law School’s Information Society Project. She's an expert on privacy, intellectual property, and law and policy, and her research includes legal issues involving online speech, access to information, and Internet freedom. She’s coauthor of the paper, Humans Forget, Machines Remember: Artificial Intelligence and the Right...

Today's show features an extended interview with Martin C. Libicki. He holds the Maryellen and Richard Keyser chair of cybersecurity studies at the U.S. Naval Academy. His most recent book is Cyberspace in Peace and War. Topics include the differences between cyber war and cyber espionage, the possibilities of a cyber Pearl Harbor or Cyber 9/11, and the risk of nations overreacting to cyber attack...

Our guest today is Jocelyn Aqua. She’s a principal at PwC, where her specialty is regulatory privacy and cybersecurity. Our conversation centers on a recently published report from PWC called Protect Me, what they describe as an in-depth look at what consumers want, what worries them, and what companies can do to earn their trust and their business. Learn more about your ad choices. Visit megaphon...

Cybercriminals offer all sorts of illicit goods for sale on Deep and Dark Web markets. In this episode, Liv Rowley, cybercrime intelligence analyst at Flashpoint, takes us through her team's research into the pricing of certain illegal goods online, including "Fullz", exploit kits, DDoS for hire, RDP servers, card data, bank logs and passports. Supply meets demand in this shady underground ecosyst...

In today's podcast, we hear about more misconfigured S3 buckets (these in Australia). Kaspersky Lab protests its innocence as it releases a study of Equation Group leaks. Notes from the world of crime: dual-purpose Trojans, fake-news-as-a-service, and how the cops are keeping the robbers hopping. Some thoughts on Hidden Cobra, and what it means for ICS operators in particular. More positive notice...

In today's podcast, we get an update on the US Vulnerabilities Equities Process, which now promises more transparency, accountability, and stakeholder representation in handling zero-days. A look at China's equivalent…doesn't. Worries about North Korean hacking. Mole hunting at Fort Meade. BlueBorne bugs in home assistants. More malware in Google Play. David DuFour from Webroot on the importance o...

In today's podcast, we hear that the DHS and FBI have warned that two North Korean malware campaigns are active in the wild. IoT vulnerabilities are disclosed. :Smartphones ship with apparently inadvertent backdoors. Patch Tuesday was a big one, this month. Russian trolls took both sides in the Brexit vote. A pro-tip from the squints: a screenshot from a video game isn't, you know, actually gun-ca...

In today's podcast, we hear that Spain sees foreign influence operations in Catalonia. IBM's X-Force warns of a new banking Trojan. There may be a mole hunt going on in NSA—and somewhere the Shadow Brokers are smiling. Anti-virus companies fix the AVGater vulnerability. Firefox and Google both commit to security upgrades. Johannes Ullrich from SANS Technology Institute and the ISC Stormcast podcas...

In today's podcast, we hear how Vault 8 has succeeded Vault 7 among WikiLeaks dumps (but it's still all CIA all the time from Mr. Assange and company). GCHQ expresses concerns about Kaspersky anti-virus products. Media reports suggest that NSA is in the middle of a big mole hunt. Equifax begins to tally up the costs of its breach. The US Intelligence Community reiterates its conclusion that dog bi...

Dr. Adrian Nish is head of cyber threat intelligence at BAE Systems. His team has been tracking a new cyber-enabled bank heist in Asia. Some of the tools used are reminiscent of the Bangladesh Bank attack from February 2016. The full report can be found here. Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that there's no honor among thieves, or botnet herders, either. Reaper still seems quiet. Macro-less malware is a problem, Microsoft warns. Researchers show you can hack an airliner's avionics. The maritime shipping sector worries that Maerk's experience with NotPetya isn't just a one-off. Ether—the cryptocurrency—is disappearing into the aether (at least this once). Ju...

In today's podcast we hear some industry news today, briefly, before we get to the cloak-and-keyboard stuff. Fancy Bear has some new dance steps. OceanLotus and Sowbug, threat actors, not plants or insects, as you might be forgiven for thinking, snoop on ASEAN and Latin America, respectively. Notes on international law and the future of cyberwar from CyCon. Joe Carrigan from JHU on the difficultie...

In today's podcast we hear more on the Paradise Papers, where the optics are looking more Inferno than Paradiso. Off-year elections in the US are on today amid general concerns about, well, somebody doing something to them. Trollhunting sometimes brings down the wrong targets. Notes on the future of cyber conflict from CyCon 2017. The Internet's co-inventor says it's time to hold coders accountabl...

In today's podcast, we hear about the Paradise Papers, a trove of documents obtained from a Bermuda law firm thatcontain details not only about wealthy tax avoiders, but about investments as well. Kaspersky says that its antivirus software did, after all, copy files that weren't viruses. (But they were still bad files.) US Senate Majority Leader McConnell says tech companies should help the US ret...

In this episode of the CyberWire’s Research Saturday we are joined by Jordan Wright, Senior Research and Development Engineer at Duo Security. He’s the author of the research report, “Phish in a Barrel,” which describes his work gathering and examining thousands of phishing kits from around the web. Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that BadRabbit looks like misdirection. Fancy Bear's wish list is out, and it's very long, and very global. US prosecutors may be preparing to indict half-a-dozen Russian officials in the DNC hack. Malaysia continues to recover from a major series of data breaches. GhostWriter poses a man-in-the-middle threat to AWS users who misconfigure their accounts. And it was Hall...

In today's podcast, we hear that, while the Manhattan truck-ramming terrorist claims ISIS, ISIS hasn't claimed him. Notes on conventional cybercrime, with some resurgent banking Trojans and mobile malware. Apple patches iOS against KRACK vulnerabilities. WordPress issues another fix for SQL injection bugs. US Deputy Attorney General Rosenstein takes up the pro-access banner in the crypto wars, but...

In today's podcast, we hear about ONI ansomware in Japan that may prove to be a wiper. Ukraine blames NotPetya operators Black Energy for BadRabbit. Pyongyang feels London is picking on it. Fishing Facebook in Nordic nations. Security firms sell certificate authority business. Twitter won't sell any more ads to RT or Sputnik. Johannes Ullrich from SANS Technology Institute and the ISC Stormcast po...

In today's podcast, we hear about the state of BadRabbit and Reaper. The EU drafts a diplomatic framework for self-defense in cyberspace. Pyongyang denies UK attribution of WannaCry to North Korea. Threat intelligence types suspect the Sino-US cyber modus vivendi might not be the unqualified success it's been taken to be. Oracle issues an emergency patch. A researcher gets an unauthorized peek at...

In today's podcast, we hear that the Reaper botnet is still quiet, and looking like a booter-for-hire. BadRabbit shows some odd stealth, and some interesting strategic selectivity. A malicious Chrome extension steals everything you put on a website. Currency miners on phones seem to be the kind of crime that doesn't pay, but that's not stopping crooks from stuffing them into Google Play. First ind...

The moniker KHRAT came about because of the identification of a Remote Access Trojan (RAT) with command and control infrastructure found in Cambodia (KH). In the most recent episode of the CyberWire's Research Saturday, Ryan Olson, Director of Threat Intelligence at Palo Alto Networks, talks with us about the capabilities of KHRAT and shares details the feature set it provides to threat actors tha...