CyberWire Daily

In today's podcast, we hear that the USS McCain collision appears to unrelated to any cyberattack, but observers warn of ICS security issues as maritime cyber concerns rise. WikiLeaks' ExpressLane Vault7 dump raises concerns in India. Telnet credentials for Internet-of-things devices exposed; security experts work to close this DDoS risk. "Defray" ransomware being distributed with unusually precis...

In today's podcast we hear about how the four C's have come together: clouds, crooks, cheats, and crypotcurrencies. Locky continues to circulate in evolved forms. WikiLeaks dumps some curious alleged liaisonware documents from Vault7. Russian sources report that FSB officers facing treason charges in Moscow may have given up some connected hackers to the Americans. The FBI makes an arrest in the O...

In today's podcast we consider the way in which two potential state cyberattacks are now looking more like, respectively, an accident and a conventional crime. US Government officials double-down on warnings of Kaspersky connection to the Kremlin, and Australia's Government isn't buying Huawei's protests that it's not working for the PLA, either. Ropemaker attacks could inject malicious code into...

In today's podcast, we hear that Ukraine is worried about cyberattacks in conjunction with tomorrow's independence day holiday. The US Navy investigates the possibility of cyberattack in this week's Malacca Straits collision, but that possibility may be fading. Zscaler finds more malicious apps in Google Play. New York State's Department of Financial Services' cyber regulations begin to take effec...

In today's podcast, we hear about maritime hacking worries, with potential risks to navigation, cargo handling, and manifest data. Another misconfigured AWS S3 bucket exposes business data. "Mr. Smith" says he's going to release the Game of Thrones season finale. The UK's NHS may have been breached. Google pulls 500 backdoored apps from the Play store. Fear of robots. Fileless cryptocurrency miner...

In today's podcast, we hear that GCHQ may have known about the FBI's intentions to arrest Marcus Hutchins even before Hutchins departed England for Black Hat. A Chinese oil production field is thought to have sustained some sort of cyber incident similar to those involving NotPetya. US Cyber Command receives elevated status—it's now the tenth Unified Combatant Command. Ukrainian authorities warn t...

In today's podcast, we hear that ransomware strains, old and new, are circulating in the wild. ShadowPad backdoors are tentatively attributed to Chinese espionage operations in the supply chain. A hacker releases the decryption key for Apple's Secure Enclave. Profexor may actually not know much about Fancy Bear's romp through the DNC. Another misconfigured AWS bucket exposes data on voters in Chic...

In today's podcast, we hear that Holyrood is defending itself with some success against email brute-forcing. India's national ID system compromised, again. ShadowBroker-leaked exploits continue to do damage. Hijacked Chrome extensions prove difficult to eradicate. New variants of Locky and other ransomware are out. "Pulse wave" DDoS attacks are observed. Researchers find DDoS-as-a-service for sale...

In today's podcast, we hear about a new draft of NIST SP 800-53. There's been an attempt to brute-force email credentials in Scotland's Parliament. Fancy Bear's romp through high-end hotel Wi-Fi suggests the Equation Group leaks will be with us for some time. "Mr. Smith" remains at large, and still wants to be paid. Trickbot uses unusually convincing counterfeit sites. PowerPoint malware vectors m...

In today's podcast, we hear that the Lazarus Group is back, and now they're phishing in English. The Daily Stormer gets the boot, but companies and governments continue to struggle with developing appropriate responses to extremist content. Google has swiftly cleaned up SonicSpy, but the malware is still circulating outside the Play store. Indian police make four arrests for HBO hacking, but none...

In today's podcast, we hear about online reactions and hacks in response to the Charlottesville rioting and homicide. Operation #LeakTheAnalyst releases another, smaller, set of documents. The ShadowBrokers get some poor customer reviews for their Exploit-of-the-Month Club. Reputation matters in the dark web souks. More HBO leaks (but no new messages). Google ejects SonicSpy-infected apps from the...

In today's podcast, we hear that Mr. Smith turned down HBO's offer of a $250,000 bug bounty. Fancy Bear uses EternalBlue tools against hotel Wi-Fi networks. Argument over who leaked DNC emails last year flares again. New versions of Locky and Mamba ransomware circulate in the wild. The US Department of Defense is ready to use rapid acquisition to buy cyber tools and services. The FBI says a Maryla...

In today's podcast, we learn that EU election monitors say Kenyan presidential voting went off without hacking (the losing opposition disagrees). Germany looks toward securing September's vote. North Korea receives cyber attention from somewhere in the civilized world. Ukraine's postal service sustains a two-day DDoS attack. WannaCry and NotPetya pseudoransomware fallout. Spyware-infected apps fou...

In today's podcast, we hear that Patch Tuesday saw Windows and Adobe fixes. Venezuela's civil conflict gets a hacktivist dimension. Anti-Israeli wiper malware is circulating in the wild, unpolished by nasty. Kaspersky Lab expects to see more pseudoransomware, especially when disruption and not profit is the goal. The KONNI RAT, of unknown origin sniffs at sites associated with North Korea. The HBO...

In today's podcast, we hear about a security incident at EirGrid, a misconfigured server in Texas, and a demonstration of photovoltaic system hacking prompt power grid security concerns. Update on the Mandiant employee hack. "Mr. Smith" holds HBO for ransom (but says, no, he's really a good guy). Shipping industry looks for GPS backup capability, and shippers not hit by NotPetya enjoy an increase...

In today's podcast, we hear that the US Army bans, immediately, all use of DJI commercial-off-the-shelf drones. We discuss two known unknowns and offer some background on Defense acquisition practices. Amazon will begin scanning AWS customers' buckets for publicly accessible data. Dale Drew from Level 3 Communications offers his view on hacking back. White hat hackers offer recommendations for ele...

In today's podcast, we hear that security researcher MalwareTech has been arrested as the alleged author of the Kronos banking Trojan. Carbanak hoods release "Bateleur" into the wild, phishing in chain restaurant waters. A long DDoS attack in China seems aimed at extortion. German elections prepare for Russian influence operations, but the novelty may have worn off Moscow's line. US states and DHS...

In today's podcast, we hear that WikiLeaks has dumped "Dumbo" project documents. Separation of agencies as a way of rendering leaks less likely. HBO's hack is getting bigger, apparently. Group IB outs members of the United Islamic Cyber Force to Interpol. Cerber goes after Bitcoin. WannaCry ransom payments are being moved, perhaps laundered. Lawsuits loom over NotPetya as more companies warn the m...

In today's podcast we following up on some of the stories we've been tracking: the latest on Operation #LeakTheAnalyst, firmware spyware in down-market phones, Sweden's big breach, and Ukraine's new cyber friends. BrickerBot is back, offering Indian routers and modems unwelcome help. The US Senate considers IoT security legislation, and the US Justice Department issues a framework with guidelines...

In today's podcast, we hear about the HBO hack, and the exposure of episodes and scripts Operation #LeakTheAnalyst targets individual security researchers. Election hacking: machines, databases, and public opinion are all targets. The UK's Home Secretary wants Silicon Valley to rethink strong encryption. Russia, like China, is clamping down on virtual private networks. The BTC-e Bitcoin exchange i...

Black Hat 2017 has wrapped up, and by all accounts it was another successful conference, with an active trade show floor, exciting keynotes and engaging, informative educational sessions on a variety of topics. There was business being done, with hopeful entrepreneurs and investors alike looking to identify the next big thing in cyber security. In this CyberWire special edition, we’ve rounded up a...

In today's podcast we hear that US investigators are looking for a disgruntled former insider in the ShadowBrokers case. Operation #HackTheAnalyst claims to have doxed a threat intelligence analyst. Electrical utilities look to their defenses. Trickbot gets wormy. NotPetya continues to have material effect on its corporate victims' earnings. Sweden's government shaken by its data breach. ISIS lose...

In today's podcast, we learn that WikiLeaks has dumped Vault7 documents attributed to the CIA. Russian catphish are said to have nibbled at French President Macron's campaign. North Korea mines Bitcoin. Malware warnings include a banking Trojan and two malicious Android apps. NotPetya's effect on TNT is said to have hit small businesses hard. MedSec has no regrets, and says it would short St. Jude...

In today's podcast we hear there's a new catphish out in the wild: meet Mia Ash. WikiLeaks throws shade by dumping UMBRAGE from Vault7. Germany braces for hacking by Russia, China, and Iran—especially by Russia. Google kicks unwelcome intercept tool Lipizzan out of the PlayStore. WhatsApp scammers phish for banking credentials. Business disruption kills small businesses in ransomware attacks, not...

In today's podcast we hear about a Symantec study that shows APTs use some pretty buggy tools. Juche may not extend to the Internet, at least for Pyongyang's leaders. Iran's CopyKitten is characterized as unsophisticated but nonetheless effective. Mac users awakened by Fruitfly—the FBI is investigating. Adobe tells us to begin saying our goodbyes to Flash. Jonathan Katz from UMD on recent experime...