CyberWire Daily

In today's podcast we hear about how StoneDrill maybe succeeding Shamoon—it's more evasive and at least as destructive. Malwarebytes advises sticking to Google Play to avoid a new Trojan. Russian hackers—apparently mobsters who've copped some of Cozy Bear's MO—are blackmailing US progressive political groups. The University of Maryland Center for Health and Homeland Security's Ben Yelin explains A...

In this CyberWire 2017 RSA Conference special edition, we wrap up our show coverage with insights from experts, about the trends they’re seeing, the products they’re pitching, and where they think we, as an industry, need to go. Guests include: Mark Dufresne, Director, Threat Research and Adversary Prevention, Endgame https://www.linkedin.com/in/mark-dufresne-b3275610a/   James Lyne, Global Head o...

In today's podcast, we hear about warnings from Cisco's Talos unit and others concerning DNSMessenger, a dangerous and evasive RAT. DDoS hits Luxembourg government sites and remains a threat to businesses. The US is said to be running a cyber campaign against North Korea's ballistic missile program. The US Defense Science Board releases its report on cyber-deterrence. Rick Howard from Palo Alto Ne...

In today's podcast, we review some encouraging news about Android apps, Cloudbleed, and Slack's swift bug patching. Amazon finds a typo at the root of Wednesday's internet outages. Symantec opens a venture arm. Yahoo! breach post mortems continue. Decryption tools for Dharma ransomware are out. Prospects look dim, again, for Wassenaar. China calls for the demilitarization of cyberspace. Terbium's...

In today's podcast we hear about how a criminal gang is deploying sophisticated malware against remote banking system customers. Business email compromise continues to appear in the wild—be good to your proofreaders, CEOs. Telegram being used by phone scammers. FCC privacy and caller-ID blocking regulations debated. Vulnerable WordPress plug-in found. Markus Rauschecker from the University of Mary...

In today's podcast, we hear that yesterday's Internet outages were due to errors in Amazon's S3 servers. Dridex has evolved to become more evasive. The Necurs botnet acquires a DDoS capability. Web cache deception attack technique is described. Austrian authorities think they have a suspect in the attempted cyberattack on Vienna's airport. Palo Alto buys LightCyber. Companies continue to grapple w...

In today's podcast, we learn that the BND may have been listening to the BBC, but not in a good way. Cylance reports on Snake Wine, a curiously familiar vintage sniffed in Japanese networks. Singapore's military sustains a phishing campaign without sustaining apparent damage. Google discloses more unpatched Microsoft vulnerabilities, these in IE and Edge browsers. Criminals claim to have exploited...

At the 2017 RSA conference, artificial intelligence and machine learning were on just about everyone’s list of hot topics. Countless companies are offering AI and ML solutions, with many of them claiming “game changer” status. In this CyberWire special edition, we gather a group of experts to help sort through the hype, try to agree on some definitions, demystify the technology, and make the busin...

In today's podcast, we hear how Cloudflare suffered from Cloudbleed. The bug's now swatted, but it will take a lot of people some time to clear up their passwords. Spora ransomware's customer service gives lousy service. TrumpLocker ransomware's just VenusLocker poaching some brand equity. Pen testers say they can break into most networks in under twelve hours. FBI asked again how it gained access...

SHA-1 is broken, for real. Grizzly Steppe threat actors seem to have a lot in common with the Carbanak gang. Bitcoin exchange hit by DDoS. Linux patches an old vulnerability. Reuters says Symantec was in talks to buy FireEye, but the companies backed away from a deal. An arrest in the Deutsche Telekom hack. Dr. Charles Clancy from Virginia Tech's Hume Center explores the designation of election sy...

In today's podcast, we hear about how Patcher ransomware is infesting Macs. Locky, Cryptowall, and Cerber are also still out and about in the wild. NSA seems likely to continue its Vulnerabilities Equities Process. Industry reactions to New York State's coming cybersecurity regulations for financial institutions. A look back at RSA discussions of cyber warfare. Further developments in the study of...

In today's podcast, we hear from Paris that Moscow's not welcome in upcoming French elections. A new version of Mirai is out, spreading through Windows systems. Researchers warn of FTP protocol injection vulnerabilities in Python and Java. A new JavaScript exploit may affect Internet Explorer. New York State's new financial sector cyber regulations take effect next Wednesday. The Johns Hopkins Uni...

In today's podcast, we hear that analysts are predicting a surge in North Korean hacking after China embargoes coal. ViperRAT catphishes the IDF. Magic Hound and Shamoon both use malicious macros to infect victim systems. TASS says no one really knows who hacked OSCE. Sputnik teases with a WikiLeaks tease. RSA Security's Zulfikar Ramzan offers insights from the conference. UMD Center for Health an...

In today's podcast, we talk about hybrid warfare, with disinformation, cyber espionage, and spyware infestations—we also hear calls for norms of cyber conflict. BugDrop is active in Ukraine, and researchers see some cut-and-paste oddness slip from Fancy Bear's paws. A new X-Agent variant is out: this one infects Macs. Ransomware thumbs its nose at security products. A look at RSA trends as the con...

In today's podcast, in addition to notes from RSA, we hear some fresh accusations of Russian government hacking from Ukraine. Threat actors adapt. ASLR bypass exploit demonstrated. Yahoo!'s acquisition by Verizon appears likely to be deeply discounted. From RSA, notes on coming industry consolidation. Dale Drew from Level 3 Communications offers a strategy for choosing security vendors. James Lyne...

In today's podcast we consider the difficulty of distinguishing nation-state hacks from criminal capers. It's not always clear, and sometimes it's a distinction without a difference. But in any case, many call for international norms of cyber conflict. Waterholes and catphish. Ben Yelin reviews President Obama's security legacy. Steve Grobman from Intel Security on the challenges of changing cours...

Researchers look into a wave of attacks on financial institutions. Microsoft calls for Geneva Convention for cyberspace. We take a look at phishing. The RSA conference is underway, and we’ve got news from the innovation sandbox, and venture capitalists. Trevor Hawthorn from Wombat Security shares insights from their State of the Phish report. Emily Wilson from Terbium Labs outlines nationalism on...

In today's podcast, Hamas appears to have improved its cyber attack capabilities. Egypt is believed to be ramping up Internet surveillance. ISIS sympathizers are being targeted with Android malware delivered over Telegram. The US increasingly integrates cyber into kinetic military operations. Russia is suspected of hacking the Italian Foreign Ministry. Malek Ben Salem from Accenture Technology Lab...

In today's podcast we hear about patching: the good, the bad, and the ugly. But mostly the good. Dridex is back. Brussels airport hacker turns out to be a literal script-kiddie, with the emphasis on the "kiddie." Moscow treason trials shut down Russian cooperation with Western law enforcement. Robert Lord from Protenus returns to share their Breach Barometer Report results. Ben Yelin from the Univ...

In today's podcast we review some updates on the Martin NSA-contractor case. Fileless malware hits banks worldwide. DDoS tools undergo refinement. Researchers take a look at ransomware developments. It's been an active week for the cyber sector in mergers, acquisitions, and venture funding. There's a new industry consortium for IoT security, and an autonomous vehicle consortium issues a manifesto...

In today's podcast, we hear that ISIS-affiliated hackers deface UK National Health Service sites with propaganda. Turkish Islamists DDoS Austria's parliament. Poorly crafted, but troubling, Mac malware seems linked to Iran. Criminals follow the money into the cloud. Salient buys Triple I, Malwarebytes picks up Saferbytes, and Sophos buys Invincea. Pala Alto Networks' Rick Howard walks us through t...

In today's podcast, we hear about brokerages in Taiwan being extorted with threats of DDoS. Polish banks compromised in watering hole campaign. Criminals turn from JavaScript to less obviously suspicious kinds of files. Cyber vigilantes poke at unsecured printers and dark web hosting. China ratchets up its efforts to control its Internet. The US shares classified intelligence on Russian influence...

In today's podcast, we hear about how criminal markets offer ransomware-as-a-service under the guise of education. The UK's NHS and Licking County Ohio deal with separate ransomware attacks. The Slammer worm tried a comeback after fourteen years—so patch those known vulnerabilities. Crooks scammed slot machines, possibly by defeating their pseudo-random number generation. Norway tracks Fancy Bear....

In today's podcast, we hear reports that Cellebrite forensic tools have been dumped online. The IRS warns that W-2 fraud is being combined with business email compromise. Cisco router vulnerabilities are under discussion. A Windows zero-day can produce the blue screen of death. Recent surveys prompt a review of enterprise security spending priorities: the perimeter is down, the endpoint is up, and...

In today's podcast, we hear about how criminals are recruiting company insiders, and how the black market trades insider information for illicit speculation. Cisco studies the costs and causes of data breaches, and the security industry offers reactions. Jonathan Katz from the University of Maryland describes searchable encryption. Vadim Vladimirskiy from Nerdio explains IT as a Service. The Inter...