CyberWire Daily

In today's podcast we hear about the ways in which some old breaches are resurfacing to trouble major social media platforms. Those old breaches are also looking far larger than initially suspected. We learn about "sandjacking" and "bug poaching" as new additions to the lexicon of cyber crime. Analysts continue to think threats will drive cyber industry growth, and venture capital interest seems h...

In today's podcast, we discuss the SWIFT transfer issues now under investigation in a dozen more banks. SWIFT announces a five-point security strategy. Attacks on the private sector are seen as having national security implications. Other cyber threats to business--DDoS and ransomware--place availability of data and networks at risk. We take a look at investor interest in cyber stocks, and we talk...

In today's podcast we hear about security in international banking, some developments in the world of malware, and how presidential impersonation and a big loss cost a CEO his job. Analysts like some of the bigger cyber players (and they're waiting for Palo Alto's results tonight). VCs back three security companies with new funding. The State Department IG's report on email retention and security...

In today's podcast, we hear about the current state of ransomware, why criminals like it, and what can be done about it. Keyloggers are being distributed by malicious USB charging devices. Blue Coat may be headed for an IPO. US cyber operations have been called "cyber bombs," but they may be a lot more like battlespace preparation (and so traditional EW and intelligence). Microsoft Azure Active Di...

In today's podcast, we hear about Turla's return, this time in an espionage campaign against Switzerland's RUAG. The Panama Papers and other hacks prompt reiteration of lots of good, if familiar advice, some of it directed at the US Congress and other small businesses. The TeslaCrypt proprietors seem less remorseful than resourceful, as they shift to CryptXXX. SWIFT plans to announce a security up...

In today's podcast, we hear about attempts by SWIFT to work toward upgraded security with clients. Japan sustains a coordinated looting of ATMs (to the tune of ¥1.44 billion). Operation Ke3chang returns to snoop on Indian diplomatic missions. ISIS returns to inspiration. Business gives advice to government in the UK and the US, and investors see recent cyber stock price corrections as, maybe, a bu...

In today's podcast, we follow moves to upgrade US Cyber Command to a Unified Combatant Command. We follow developments in Operation Groundbait, Phineas Phisher's latest, and the discovery of China's 50-cent-ers. Conficker is still out and active eight years after patching We take a look at industry news, and hear about how TeslaCrypt may be closing up shop. Our expert today is Accenture Labs' Male...

In today's podcast, we learn that the LinkedIn breach is the same old one from 2012, only now two orders of magnitude larger than thought. ESET describes a cyber surveillance campaign, Operation Groundbait, in Ukraine's Donbas region. Phineas Phisher hacks on behalf of Kurdish anti-capitalists. The SEC warns of cyber risks to the financial sector. Cisco reports better than expected results (thanks...

In today's podcast we discuss a breaking story about what's potentially a very large breach at LinkedIn. Banks' interactions with SWIFT (not SWIFT itself, necessarily) concern observers. Malware and scareware appear in the Play Store. China interrogates Apple, Cisco, and Microsoft about security. We hear about ways in which participants in black markets evolve to function more like legitimate ente...

Today we discuss some exploits running loose in the wild. GSA's 18F unit cleans up its Slack implementation and shares its lessons learned from a potential breach. Older Android devices are susceptible to an Accessibility exploit. A million-device clickfraud botnet drains advertising budgets. A new cyber espionage campaign prefers quality to quantity. SWIFT gets security advices. ISIS shifts recru...

In today's podcast we discuss Germany's attribution of an ongoing cyber espionage campaign: it's Russia, says the BfV. Bank attacks continue, both related to, and unrelated to, the SWIFT funds transfer system (and some seem criminal, some hacktivist in motivation). Russia says it plans to close about 4000 sites for trafficking in extremist ideology and drugs. Markets look forward to the next cyber...

In today's podcast, we look back at the week just ending and see new attempts on banking systems. Some involve SWIFT; others involve Anonymous, and some have to do with the FDIC. And what about those fingerprints? Markus Rauschecker from the Center for Health and Homeland Security examines the increased scrutiny the FTC and FCC are putting on mobile device providers. And we interview Dr. Emma Garr...

In today's podcast we discuss a warning from US-CERT and Onapsis against some old but active SAP vulnerabilities. Pawn Storm is back, and active against German political targets. DDoS-for-hire is proving lucrative, as is ransomware. Joe Carrigan from Johns Hopkins University Information Security Institute explains what you should do when you get suspicious-looking email. IBM speaks with us about t...

We run through some of the high points of May's Patch Tuesday. We get updates on Viking Horde Android malware and Bucbi ransomware. Venture capital seeks out IoT security investments as Pwnie Express and Bayshore Networks attract funding. Quintessence Labs' Dr. Vikram Sharma explains emerging quantum technologies. And IBM will train Watson to deal with cyber security issues.  Learn more about your...

In today's podcast we hear about the Panama Papers database. We also discuss updates concerning the Bangladesh Bank heist investigation. New ad-fraud malware, Viking Horde, shows up in the Google Play Store. In ransomware news, CryptXXX is no longer so easily decrypted, Bucbi exploits RDP vulnerabilities, and Triumfant shares what they've learned about Locky. We also talk to Accenture's Malek Ben...

In today's podcast we follow the progress of anti-banking DDoS hacktivism Operation Icarus. The Panama Papers are released in the form of a searchable database. Some apparently big compromises look a bit recycled. Victims' willingness to pay keeps the ransomware black market primed. Investor disappointment depresses security company valuations. We talk with the University of Maryland's Ben Yelin a...

Today we hear about what's going on with proof-of-concept exploits. Ransomware continued its run this week, but DDoS shouldn't be forgotten, either--it's good for both business interruption and misdirection. Thoughts on those 270 million email credentials. A couple of big security companies post Q1 results, and Adrian Turner, CEO of Australia's Data 61, explains the future of that nation's domesti...

Today we consider various ways of hiding attack campaigns: noisily or quietly, what the approaches have in common is highly selective targeting. Anonymous proceeds with Operation Icarus (against "the global banking cartel").  We observe World Password Day with advice from AT&T's Johannes Jaskolski and Johns Hopkins' Joe Carrigan. Plus, we take a quick look at how one script kiddie values his stole...

In today's podcast we look at studies of how ISIS actually operates online. Apparently they do so much the way crooks do—by abusing legitimate services. But when it comes to encryption, the jihadists seem to be rolling their own. Ransomware updates and warnings—the FBI reminds victims not to pay. The group that hit the Qatar National Bank may be preparing release of another bank's information. Inf...

In today's podcast we look quickly at the current state of the cyber war between the US and ISIS. Anonymous is out to punish banks with DDoS for "crimes against humanity," and criminals continue to hone their ransomware game. The US security clearance system seems set to move toward FICO-like scoring. Joe Carrigan from Johns Hopkins University explains why medical records are so valuable on the cy...

In today's podcastwe hear some encouraging examples of responsible disclosure. Ransomware is still out and about. IBM seems to see a futurein blockchain technology. Bob Hansmann from Forcepoint shares highlights from their threatreport. Ben Yelin tracks the Snowdenremedies. And Craig Wright again claims he's Bitcoin'sSatoshi Nakamoto—the BBC and the Economist seem readyto take him at his word. Lea...

Today we hear about potential backdoors (or maybe PUPs). Cash-stealing malware reported in Google Play. Third-party developers leave their credentials lying around GitHub. Triumfant watches Locky morph—five times a day. Dale Drew from Level 3 talks about point-of-sale risks. Verizon tells us all about their Data Breach Report. The Panama Papers may soon be released in full. Investors worry about t...

In today's Podcast, we hear about ISIS attempts at inspiration online—their technical capabilities are low, but they continue to hit information ops hard. A Bavarian nuclear plant finds a malware infestation—spooky, but apparently without effect. Observers expect more hacks like the one on the Bangladesh Bank, and the Platinum threat group looks state-sponsored. The security industry may be showin...

In today's Podcast, we hear reports of success in the cyber war against ISIS. Inquiry into the Bangladesh Bank hack continues; the threat actors behind it may have additional capers in the works. Android malware flourishes, and so does a vigorous underground extortion market. The FBI says it doesn't know what vulnerability was exploited to open the San Bernardino iPhone, and that it doesn't want a...

In today's podcast we hear more about possible other instances of fraudulent messaging in the SWIFT financial transfer network. We discuss an active Android ransomware campaign that appears to be using old Hacking Team exploits. US DNI Clapper thinks the acceleration of encryption, post-Snowden, really hasn't been a very good thing, and calls for a balance between privacy and security. The US cont...