CyberWire Daily

Latest Episodes:

“Static expressway” tactics in credential harvesting. Emotet is back. Black Basta linked to Fin7. RomCom hits Ukrainian targets and warms up against the Anglo-Saxons. Cyber cooperation? Nov 03, 2022

Show notes

Leveraging Microsoft Dynamics 365 Customer Voice for credential harvesting. Emotet is back. Black Basta ransomware linked to Fin7. A Russophone gang increases activity against Ukrainian targets. Betsy Carmelite from Booz Allen Hamilton on adversary-informed defense. Our guest is Tom Gorup of Alert Logic with a view on cybersecurity from a combat veteran. And Russia regrets that old US lack of cooperation in cyberspace–things would be so much better if the Anglo-Saxons didn’t think cyberspace was the property of the East India Company. Or something like that.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/212

Selected reading.

Abusing Microsoft Customer Voice to Send Phishing Links (Avanan)

Emotet botnet starts blasting malware again after 5 month break (BleepingComputer)

Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor (SentinelOne)

RomCom Threat Actor Abuses KeePass and SolarWinds to Target Ukraine and Potentially the United Kingdom (BlackBerry)

Russia cyber director warns no U.S. cooperation risks "mutual destruction" (Newsweek)

Learn more about your ad choices. Visit megaphone.fm/adchoices

OpenSSL indeed patched. CISA is confident of election security. Killnet attempted DDoS against the US Treasury. XDR data reveals threat trends. BEC and gift cards. And that’s one sweet ride. Nov 02, 2022

Show notes

OpenSSL patches two vulnerabilities. CISA and election security. Killnet attempted DDoS against the US Treasury. XDR data reveals threat trends. Business email compromise and gift cards. Tim Starks from the Washington Posts’ Cybersecurity 202 has the latest on election security. A visit to the CyberWire’s Women in Cyber Security event. And consequences for Raccoon Stealer from the war in Ukraine.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/211

Selected reading.

OpenSSL patched today. (CyberWire)

OpenSSL Releases Security Update (CISA)

OpenSSL releases fixes for two ‘high’ severity vulnerabilities (The Record by Recorded Future)

OpenSSL patches are out – CRITICAL bug downgraded to HIGH, but patch anyway! (Naked Security)

Threat Advisory: High Severity OpenSSL Vulnerabilities (Cisco Talos Blog)

OpenSSL Vulnerability Patch Released (Sectigo® Official)

Clearing the Fog Over the New OpenSSL Vulnerabilities (Rezilion)

OpenSSL vulnerability CVE-2022-3602 (Remote Code Execution) and CVE-2022-3786 (Denial of Service) Check Point Research Update (Check Point Software)

Undisclosed OpenSSL vulnerability: Free scripts for target scoping (Lightspin)

Discussions of CISA’s part in elections and the JCDC. (CyberWire)

U.S. Treasury thwarted attack by Russian hacker group last month-official (Reuters)

XDR data reveals threat trends. (CyberWire)

What happens to a gift card given to a scammer? (CyberWire)

How Russia’s war in Ukraine helped the FBI crack one of the biggest cybercrime cases in years (MarketWatch)

Learn more about your ad choices. Visit megaphone.fm/adchoices

OpenSSL patched today. The risk of misconfiguration. Cyberespionage (and the risk of mixing the personal with the official). Assistance for Ukraine's cyber defense., And a quick look at DNS threats. Nov 01, 2022

Show notes

OpenSSL is patched today. The misconfiguration risk to US government networks' security and compliance. Hacking Ms Truss's phone. Assistance for Ukraine's cyber defense. Joe Carrigan looks at the latest round of apps pulled from the Google Play Store. Our guest is Matias Madou of Secure Code Warrior on why cultivating a positive culture among security and developer teams continues to fall short. And a quick look at DNS threats.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/210

Selected reading.

Effectively Preparing for the OpenSSL 3.x Vulnerability (Akamai) O

How The OpenSSL 3 Vulnerability Will Really Affect Your Environment (Nucleus Security)

New Critical Flaw in OpenSSL: How to Know if You're at Risk (Rezilion)

Experts warn of critical security vulnerability discovered in OpenSSL (Application Security Blog)

The impact of exploitable misconfigurations on network security within US Federal organizations (Titania)

Liz Truss's personal phone hacked by Putin's spies (Mail Online) O

Truss phone was hacked by suspected Putin agents when she was foreign minister, the Daily Mail reports (Reuters)

Liz Truss phone hack claim prompts calls for investigation (BBC News)

Russian spies hacked Truss's personal phone (Computing)

Government urged to investigate report Liz Truss’s phone was hacked (the Guardian)

Ministers creating ‘wild west’ conditions with use of personal phones (the Guardian)

Suella Braverman admits sending official documents to personal email six times (The Telegraph)

Ukraine War: UK reveals £6m package for cyber defence (BBC News)

DNS Threat Report — Q3 2022 (Akamai)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Copper smelter hit with malware. Notes from the hybrid war. Disinformation, not direct manipulation of results, the principal threat to US elections. Ransomware in Australia’s ForceNet. Threat trends. Oct 31, 2022

Show notes

Leading European metals producer is hit with malware. Cooperative defense in cyberspace. A Ukrainian ally describes its exposure to Russian cyberattacks. Former UK Prime Minister Truss's phone may have been compromised. CISA sees a complex threat environment, but no specific threat to US elections. The Australian Defence network sustains ransomware attack. The three finalists in the DataTribe Challenge share insights on the competition. Rick Howard previews the new season of CSO Perspectives. And a look at threat trends.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/209

Selected reading.

Aurubis says it was hit in wider cyberattack on metals industry (Reuters)

Copper Giant Aurubis Shuts Down Systems Due to Cyberattack (SecurityWeek)

Inside a US military cyber team’s defence of Ukraine (BBC News)

Ukraine's cyber power shows value of public-private partnership (Nikkei Asia)

Latvian President: Only the West’s Weakness Can Provoke Russia (Foreign Policy)

Latvia’s cyberspace faces new challenges amid war in Ukraine (The Record by Recorded Future)

Worries build about winter cyber threats in Ukraine (POLITICO)

Liz Truss's personal phone hacked by Putin's spies (Mail Online)

Truss phone was hacked by suspected Putin agents when she was foreign minister, the Daily Mail reports (Reuters)

Liz Truss phone hack claim prompts calls for investigation (BBC News)

Russian spies hacked Truss's personal phone (Computing)

Government urged to investigate report Liz Truss’s phone was hacked (the Guardian)

Ministers creating ‘wild west’ conditions with use of personal phones (the Guardian)

'Complex threat environment' ahead of midterm elections, top cybersecurity official says (Reuters)

CISA chief sees no "specific or credible threats" to election infrastructure (CBS News)

For cyber experts, disinformation overshadows cyberthreats in midterms (Washington Post)

Australian Defence Department caught up in ransomware attack (ABC)

Cyber-attack on Australian defence contractor may have exposed private communications between ADF members (the Guardian)

Cyber Threat Reports (Deep Instinct)

Deep Instinct releases its 2022 Interim Cyber Threat Study. (CyberWire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jenny Brinkley: A cybersecurity rollercoaster. [Security] [Career Notes] Oct 30, 2022

Show notes

Jenny Brinkley, Director of AWS Security at Amazon Web Services (AWS), sits down to share her empowering story working through the ranks, and even co-founding her own company. While she did not have a typical upbringing in the industry, she credits her parents for ending up where she is now, as they told her that she could do anything and she decided as she was growing up that she could. She had the opportunity to co-found a small startup before selling it to AWS. She says that working in her position is like a rollercoaster, as no one thing is like the other, saying her highs are high and her lows are low. Being a woman in cybersecurity, she is working to empower more women in the field, Jenny says, "I think that we're living in such an interesting time where empathy, kindness, compassion, honesty, partnership in the security space, I mean, heck for any industry, but really for security and cyber security roles today, it's, it's the life blood and to be underestimated, especially as a female or because, you know, my background doesn't follow a cookie cutter pattern of what individuals think of when they think of individuals in security roles." We thank Jenny for sharing her story.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bugs and working from home. [Research Saturday] Oct 29, 2022

Show notes

Fede Kirschbaum from Faraday Security sits down with Dave to discuss their research on "A vulnerability in Realtek's SDK for eCos OS: pwning thousands of routers." The team at Faraday found a vulnerability that made it to DEFCON 30, labeling it high severity. With more and more people working from home for their companies, the research team went looking for where there may be vulnerabilities as employees are working from home.

The research states that the team was "seeking and reporting security vulnerabilities in IoT devices, which led to the finding of an exploitable bug in a consumer-grade router popular in Argentina." They also stated in the research that it was escalating quickly and shares about how protecting home networks is important while working remotely.

The research can be found here:

A vulnerability in Realtek´s SDK for eCos OS: pwning thousands of routers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Another DDoS attack against NATO governments. The US 2022 National Defense Strategy is out. Notes on ICS security. Oct 28, 2022

Show notes

Cyberattacks against Poland’s and Slovakia’s parliaments. The US 2022 National Defense Strategy is out. Insights from SecurityWeek’s ICS Cyber Security Conference. The importance of zero-trust in industrial environments. Malek Ben Salem from Accenture on machine language security and safety. Our guest is Nick Schneider of Arctic Wolf to discuss why he believes 2023 will see a resurgence of ransomware. And CISA issues four more ICS Advisories.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/208

Selected reading.

Computer networks of parliaments in Poland and Slovakia paralyzed by cyberattacks (Euro Weekly News)

Slovak, Polish Parliaments Hit By Cyber Attacks (Barron's)

Slovak parliament suspends voting due to suspected cyberattack (Reuters)

"Also from Russia" - cyber attack on parliaments in Poland and Slovakia - Today Times Live (Today Times Live)

2022 National Defense Strategy (US Department of Defense)

2022 NDS Fact Sheet | Integrated Deterrence (US Department of Defense)

Discussing cyberattacks vs system failures. (CyberWire)

Zero-trust in ICS environments. (CyberWire)

SANS 2022 Survey: The State of OT/ICS Cybersecurity in 2022 and Beyond | Nozomi Networks (Nozomi Networks)

CISA Releases Four Industrial Control Systems Advisories (CISA)

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Malware Mash! [Bonus] Oct 28, 2022

Show notes

Enjoy this CyberWire classic.

They did the Mash...they did the Malware Mash...

Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA releases voluntary CPGs. Trojans and scanners. Cyber venture investing, and some insights into corporate culture. "Opportunistic" cyberops in a hybrid war. Oct 27, 2022

Show notes

CISA releases cross-sector cybersecurity performance goals. Trojans are spreading through scanners. Cyber seed rounds are an exception to a general downtrend in venture investment. Whistleblowing and corporate culture. Storing enterprise secrets. Robert M. Lee from Dragos explains the TSA Pipeline Security Directive. Our guests are Jenny Brinkley from Amazon AWS and Lisa Plaggemier from the National Cybersecurity Alliance with a collaborative educational project. Cyberattacks seen as opportunistic and disconnected from strategy.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/207

Selected reading.

Cross-Sector Cybersecurity Performance Goals (CISA)

CISA unveils voluntary cybersecurity performance goals (Federal News Network)

Sending Trojans via Scanners (Avanan)

DataTribe Insights - Q2 2022: Economic Storm Makes Landfall (DataTribe)

Ukraine: Russian cyber attacks aimless and opportunistic (SearchSecurity)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Amid widespread unrest, Sudan shutters its Internet. A new PRC influence campaign targets US elections. Software supply chain security. And cybercrime in wartime. Oct 26, 2022

Show notes

Sudan closes its Internet as the country sees protests on the first anniversary of a coup. A Chinese influence campaign targets US elections. A software supply chain security study, and a look at vulnerability scanning tools. Documenting cyber war crimes in Ukraine. CISA issues eight ICS Advisories. Andrea Little Limbago from Interos on the effects of water scarcity on data centers. And if you’ll indulge us, we’ve got some pretty exciting CyberWire news.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/206