CyberWire Daily

In today's podcast we hear how WannaCry ransomware became a pandemic over the weekend. Johannes Ulrich joins us to help sort it out. A temporary lull is feared likely to be more temporary than most would like. Baijiu espionage malware is spreading through GeoCities. Another APT—APT32—is also devoted to espionage, apparently in alignment with the government of Vietnam. Bin Laden's son is working to...

In today's podcast, we hear about the long-expected US Executive Order, with commentary from Politico's Eric Geller. It was signed yesterday, and gives prominence to the NIST Framework, DHS,and OMB. Eternal Blue is used to spread WannaCry ransomware, and the UK's NHS is hard hit. Fancy Bear prances in NATO costume. US Intelligence Community leaders warn the Senate that the Russian cyber threat is...

In today's podcast, we hear that French media sites are recovering from a massive, successful DDoS attack whose source is still under investigation. Android adware harvests and reports PII. Microsoft's quick patching of zero-days included three that are being exploited in the wild by state and criminal actors.  Ben Yelin from UMD CHHS reviews the first 100 (cyber) days of President Trump. Ken Spin...

In today's podcast, we hear that NSA says it warned its French counterparts about Russian cyber ops targeting France's elections. Next up for Fancy Bear? Probably German elections, but in the meantime there's also some phishing with zero-days. The NSA Director also advocates calling out Russia for bad behavior in cyberspace, and says that US Cyber Command is ready and able to hold targets at risk,...

In today's podcast, we hear that haste may make for, not exactly waste, but at least brazen and ineffectual influence operations. Metadata evidence of Fancy Bears paws in En Marche! emails. Moscow snorts "false flags," but UK, German, and US officials say the Bears are there and up to no good. ISIS posts another bit of depravity as inspiration. North Korea is thought to be paying for its advanced...

In today's podcast, we discuss Emmanuel Macron's victory in France's presidential election despite last-minute hacking and leaked emails. (Hacked emails seem not particularly scandalous as the story develops.) Germany and the UK brace for cyberespionage in their own upcoming elections. Intel AMT flaw more serious than expected, will get fixes this week. HandBrake download server proved RAT-infeste...

In today's podcast we hear about elections and election influence operations in Europe, and the difficulty of taming Fancy Bear. Some weekend reading. The Google Docs worm and dynamite phishing incident takes an odd (but implausible) turn. Snake malware seems poised to strike at Mac users. We welcome Johannes Ulrich from SANS and the Internet Stormcenter Podcast. Allan Liska outlines his book on r...

In today's podcast, we hear about how OAuth abuse rushed a worm around Google Docs, and how the good guys swiftly contained the attack. Bondnet discovered mining cryptocurrency. The Blackmoon financial malware gets an upgrade. Carbanak is still out there, trickier than ever. No-phishing season at Gannett. India's national biometric ID system runs into security and legal trouble. Rick Howard from P...

In today's podcast we hear that Shamoon's Trojan servant seems to have got a new comms channel. Sabre discloses possible breach: hospitality and travel sectors affected. Some more things to worry about: ultrasonic beaconing, SIM card fraud, VPN privilege escalation, and another bad app in the PlayStore. (But you can fix all these.) Governments look to social media restrictions to control hate spee...

In today's podcast we hear that Trojanized USB sticks are out in the wild. So are phishing emails complete with backdoors and spyware payloads. Intel reports (and mitigates) a major firmware vulnerability in Core processors. The DarkOverlord and third-party risk. ShadowWali backdoors afflict Japanese enterprises. The LizardSquad may be back, but you still shouldn't listen to them, still less pay t...

In today's podcast, we hear how the NSA is revising its interpretation of Section 702 collection, to the general approval of privacy advocates. WikiLeaks drops another alleged tool from Vault7—this one looks like garden-variety data-loss-prevention beaconing. The UK and France are on alert for influence operations, and the US Congress takes testimony on such marketing-in-battledress. South and Sou...

In today's podcast, we hear that researchers have named the hitherto unnamed country that attempted to hack Israeli targets. Other researchers conclude Shamoon is still under the same management. Roles and missions dispute among Israeli security organizations. Peter Galvin from Thales takes a look at data security in the US Federal sector. VA Tech's Dr. Charles Clancy explains the pros and cons of...

In today's podcast, we hear about the bear tracks analysts are seeing  in Macron's campaign for France's presidency. (They're also appearing in German political parties' think tanks.) Cyber gangs continue to pore over ShadowBrokers' leaks. Verizon and Samsung threat reports see ransomware and nation-state espionage as the trending issues. Amid debate over cyber authorities, Israel says it detected...

In today's podcast, we follow the story of Fancy Bear (a.k.a. Pawn Storm, a.k.a. APT28) and France's elections. Why clever phishing continues to succeed, and what's up with 0Auth abuse. Information operations distinguished from simple "hacking." Another point-of-sale compromise suggests identity management issues. The University of Maryland's Jonathan Katz explains a JSON encryption vulnerability....

In today's podcast, we hear that Fancy Bear has as expected been spotted snuffling around the French Presidential election. Denmark and Bulgaria also report bearish activity. Sino-US pressure on North Korea may foreshadow an uptick in the cyber op-tempo. Power failures prompt worries about the grid's fragility. Milkydoor's Trojanized Android apps pose a BYOD threat to businesses. Webroot is fixing...

In today's podcast we hear that cyberattack worries mount with international tensions over North Korea. France's first-round presidential elections conclude with two outsiders headed for the finals. WikiLeaks' and ShadowBrokers' leaks find their way into the criminal wild. US shows renewed interest in prosecuting WikiLeaks' Assange. Locky ransomware is back from the dead. SMSVova spyware kicked ou...

In today's podcast we hear that cyber gangs are busily at work reverse-engineering the last ShadowBrokers' document dump. But the Russian ones at least are probably getting some state help. Insider threats and mole hunts. BrickerBot's author plays a dangerous vigilante game—operating technology may be particularly at risk. Hollywood's best depictions of hacking. Ben Yelin describes a weaponized an...

In today's podcast we hear about snakes in the PlayStore's walled garden (one of them with a helpful flashlight, and another one with a plumber's cap and a mustache, which must look pretty odd on a serpent). A look at how cyber gangs communicate—they do it a lot like the rest of us. Source code distribution and the jokers who make annoying use of it. More troubling reports about an IPO-ready unico...

In today's podcast we hear about a new vigilante in the IoT—Hajime—and learn that the security industry doesn't think much of vigilantes. Observers pore over the most recent ShadowBrokers' files and don't like what they see, even though most of the more dangerous exploits have been patched. Still no word on how the ShadowBrokers got their wares, or where WikiLeaks got the contents of Vault 7. Bank...

In today's podcast, we hear about a newish ransomware strain, Karmen, hitting the low-end ransomware-as-a-service market. Homograph vulnerability proof-of-concept revealed. Jihadist infosec service advises good cyber hygiene for terrorists post-Vault 7. The ShadowBrokers try to drag a red herring—actually a bad frog—across their tracks. Hopeful speculation continues that the US hacked North Korea'...

In today's podcast, we hear about a big missile fizzle on Pyongyang's Day of the Sun yesterday—there's hopeful but a priori speculation of a cyber op against North Korea's nuclear strike R&D program. Friday's ShadowBrokers' leaks suggest financial service, industrial IoT vulnerabilities. Syrian regime calls hoax on nerve gas attack claims (informed observers are unconvinced). How ISIS recruits wom...

In today's podcast, we hear that the ShadowBrokers are fed up with all of you peoples. The Callisto Group spearphised the UK's Foreign Office last year. The US DCI calls out WikiLeaks as a hostile intelligence service. Lawful intercept shops alleged to be willing to deal with pariah regimes. University of Maryland’s Jonathan Katz discusses Google’s unfulfilled promise of end-to-end encryption in g...

In today's podcast we hear about how Ewind adware infests cloned apps in the Android ecosystem. Influence operations rise to prominence amid increased Russian and Islamist activity against Western targets. Accused Russian traitor makes jailhouse denunciation of Russia's coziness with cyber organized crime. Finspy found distributed via Word zero-day. And suppose you're doing a nickel in Ossining or...

In today's podcast, we discuss April's Patch Tuesday, with news and tasks for Windows, Adobe, and SAP admins. Cyber threats to healthcare include ransomware, breaches, and device hacking. NATO and non-NATO partners establish an information operations center in Helsinki to contest Russian influence in cyberspace. Analysts continue to pick over the latest from the ShadowBrokers. Emily Wilson from Te...

The 2017 Women in Cybersecurity conference was held in Tucson Arizona, and the CyberWire was on hand to cover the event. We spoke with a variety of cyber security professionals, at different stages of their careers. We covered some of their career journeys and professional insights on our daily podcast, and in this special edition learn why a women in cybersecurity conference is more important tha...