CyberWire Daily

In today's podcast, we hear about how a Word zero-day is spreading the Dridex banking Trojan. Amazon third-party sellers bitten by reused passwords. IBM catches Mirai mining Bitcoins. Symantec discerns Longhorn tools in WikiLeaks' Vault 7. Tensions over Syria's civil war seem to be behind the Shadow Brokers' return. ISIS is now attempting to recruit women to the Caliphate. Germany considers a cybe...

In today's podcast, we hear that US strikes against Syrian targets and harsh words for Assad are followed by apparent Russian information operations as bilateral tensions mount. Both WikiLeaks and the Shadow Brokers resurfaced late last week. A light Patch Tuesday is foreseen, but observers expect a fix for a Microsoft Office zero-day being actively exploited. Okta files its anticipated IPO. Dalla...

In today's podcast, we hear about how Operation TradeSecret collected intelligence on US trade policy during the run-up to the Sino-American summit at Mar a Lago. BrickerBot is out, a PDoS campaign that looks like nasty vigilante work, so close your Telnet ports and change your IoT device default passwords. The Amnesia campaign is after unpatched DVRs. Sathurbot exploits unpatched WordPress instan...

In today's podcast we hear about Operation TradeSecret, which joins Operation Cloudhopper: both appear to be facets of a Chinese cyberespionage campaign. 20,000 loan applications are exposed by a third-party IT vendor. North Korea's Lazarus Group still has banks in its crosshairs. A study shows that mobile users are in a complicated relationship with their apps. US Congressional hearings into Russ...

In today's podcast, we hear about how Operation Cloudhopper gets to its espionage targets via their cloud and managed service providers. Details are out on the Android version of the Pegasus spyware. Microsoft will upgrade Office security. Notes on the annual SeaAirSpace expo, including an excursus on cyber Marines. Cisco’s Chief Privacy Officer Michelle Dennedy joins us from the Women in Cybersec...

In today's podcast, we hear that Pegasus is now in the Android ecosystem. British authorities warn of possible ISIS cyberattacks on infrastructure. Russia investigates the St. Petersburg metro bombing. New evidence connects North Korea with the Lazarus group. Fancy Bear continues to romp unabated, and Turla seems to have remained quietly active for about twenty years. Zero-days reported for Samsun...

In today's podcast, we hear that WikiLeaks has dumped what it claims are CIA source code files. The leak seems to aim at raising suspicion that attacks attributed to foreign governments are in fact false-flag operations. The International Association of Athletics Federations says it was hacked by Fancy Bear. Two new RATs—remote access Trojans—are discovered in the wild. ISIS takes some cyber hits,...

In today's podcast, we hear about how Fancy Bear left tracks in Bitly, and Fancy Bear did an awful lot of phishing going back to March 2015. Experts take a look at Russian espionage and influence operations, and they draw some disturbing conclusions. The EU seems ready to go anti-encryption—how that will work with the EU's regulatory emphasis on privacy is anyone's guess. The University of Marylan...

In today's podcast, we hear about Apple's patches issued this week—how are your systems? Lastpass is working on a patch for an undescribed bug (said to be a complicated one). What IT staff actually work on. Politico's Eric Geller discusses emerging Trump Administration cyber policy. Emily Wilson from Terbium Labs outlines the data breach timeline.  Learn more about your ad choices. Visit megaphone...

In today's podcast, we pass on what we've heard at ITSEF about Russian hybrid warfare: it aims, experts say, at redressing the loss of the Cold War. Microsoft Internet Information Services (IIS) 6.0 found vulnerable to a buffer overflow attack. Cerber ransomware evolves to evade detection. Bugs found in Siemens ICS products. VMWare patches vulnerabilities. Laptops with sensitive information lost i...

In today's podcast, we hear how Cozy Bear slips through with domain fronting. Shamoon's infection methods are revealed. The crypto wars flare over not-so-lone wolves, but there are some genuine lone wolves out there as well. Medical and dental practices warned against attacks on FTP servers. A networked sterilizer is, well, digitally unhygienic. Docs dot com search functionality temporarily disabl...

In today's podcast, we hear that British police think ISIS not-so-lone wolves may have been howling over WhatsApp. WikiLeaks still disgruntled over its disclosure offer's cool reception. March-Madness is also phishing season. How and why online gamers cheat. GiftGhostBot drains gift-card balances. States mull next steps after the America's JobLink breach. CrowdStrike walks back some claims in its...

In today's podcast we hear assessments of WikiLeaks' latest Vault 7 files—compromised supply chain or damp squib? NATO worries about Russian information operations. ISIS continues to push jihadist inspiration online, claiming the London killer as one of the Caliphate's soldiers. Facile attribution can mislead, as seen in a surprising arrest. Comments on America's Joblink Alliance breach. Acalvio's...

In today's podcast we offer a rundown of recently announced threats and vulnerabilities in stores and documents: Play Store, App Store, and MS Office. Some crooks move to the cloud. GoDaddy buys Sucuri. The US is rumored to be preparing a North Korean indictment for the Bangladesh Bank heist. Social media look for bad bots. Level 3's Dale Drew describes botnet evolution. LookingGlass' Eric Olson e...

In today's podcast, we hear that laptop flight restrictions spread as security services continue to grapple with ISIS inspiration operations. The Necurs botnet returns, but now it's swapped pump-and-dump scams with penny stocks for its usual ransomware payloads. MajikPOS is active in the North American wild. Joe Carrigan from the Johns Hopkins University Information Security Institute reviews less...

In today's podcast, we hear about the claim that "the Turkish Crime Family" is holding iPhones hostage. WikiLeaks grumbles that it has few takers for its Vault 7 bugs. Germany raises its state of cyber alert, pre-election. The US expects more Russian cyber and influence operations. A Russian bank says it was framed (and maybe it was). UMD's Jonathan Katz provides technical details on the recent SH...

In today's podcast we ask whether careless cyber criminals working for the FSB blew the gaffe on the Yahoo! hack. WikiLeaks offers to share Vault 7 vulnerabilities with vendors, but it wants something in return. A look at the Atlantic Council's recently concluded Cyber 9/12 competition. Does cabin fever increase the risk of being hacked? Enigma Software saw things during last week's unseasonable U...

In today's podcast, we hear about observers who look around and think they may be seeing Cold War Two in cyberspace. (But this is no bipolar conflict.) Investigation into Vault 7 continues as people wonder where WikiLeaks gets its leaks. The quiz app Wishbone has been breached—take it as a teachable moment with the children. Fileless malware gets quieter as researchers get close to the cyber gang....

In today's podcast we hear about the return of the the Lazarus Group (or maybe it never really left). A Dun & Bradstreet database is compromised—more than thirty-three million are said to be affected. British travel association ABTA suffers a breach. Notes on identity theft. Netherlands voter information sites hit with DDoS—Turkish hacktivists (or government operators) suspected. The University of...

In today's podcast, we look as influence operations in the UK and in Europe: the former emanate from Russia, the latter from Turkey. Third-party social media apps increase your attack surface. Petya ransomware is stolen and improved by rival crooks. Google purges bad apps from the Play Store. Patch Tuesday notes. A convicted leaker offers some unexpected wisdom for prospective whistleblowers. Lawy...

In today's podcast, we hear about how the Apache Struts bug has bitten in Canada. FireEye sees financial cybercrime approaching state espionage exploits in sophistication. The US Air Force leaves sensitive personal information exposed in a backup database. Investigation into WikiLeaks' Vault 7 continues. Okta files for its IPO. Ben Yelin from the UMD Center for Health and Homeland Security reviews...

In today's podcast, we review some speculation about Vault 7 that holds the leaker was an insider. (But there's no specific insider named, yet—the investigation is still in its early stages.) Supply chain security issues are raised by both Vault 7 leaks and discovery of pre-loaded malware in some Android devices. Bitcoin won't get its own ETF, yet. Japanese companies willingness to "pay to make it...

In today's podcast, WikiLeaks offers to enter the responsible disclosure game, but be warned: there are legal problems should you accept classified information. Some AV companies tout their reviews in Vault 7. Speculation about how CIA hacking notes leaked turns to an insider threat. HackRead warns that Playstation credentials may have been compromised. The Apache Struts vulnerability is being exp...

In today's podcast, we follow the Vault 7 story and the false flags that really aren't there. A call for more stress-testing of software. RAND reports on the market for zero-days. The Near Abroad warns the US that it would like to see more American soft power deployed in their part of the world. Jonathan Katz from the University of Maryland praises Google's Project Wycheproof. VMWare's Tom Corn pr...

In today's podcast we talk over the latest news, rumors, gossip, and common sense surrounding WikiLeaks and its Vault 7 dump of hacking tools and other spy stuff. And wait a minute—do angels really weep? After all, they're supposed to be pure intelligence. But you came here for the hacking, not the angelology, and there's a lot of stuff dancing around in Vault 7. Research Scientist Jim Walter from...