CyberWire Daily

Latest Episodes:

Amanda Adams: Pivoting into the tech world. [VP] [Career Notes] Oct 16, 2022

Show notes

Amanda Adams, VP of Americas Alliances at CrowdStrike sits down to share her story as she pivoted into the tech field. She started her career by wanted to be involved with sports, after getting her masters degree Amanda was faced with a difficult choice between working for The Golden State Warriors and Cisco. She ultimately chose Cisco as her path to move forward and has been working in technology ever since. Now she works for a team where she gets to prove her social skills and is focused on partnerships. She say's that working in technology doesn't just have to be working with technology, there are many other ways you can get involved with the field. Amanda says "you can always pivot into the technology industry and support the broader mission by doing that job function." We thank Amanda for sharing her story.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyber confidence: Knowing what you have and where it is. [CyberWire-X] Oct 16, 2022

Show notes

Between multi-cloud deployments, more employees working remotely, and increasing use of SaaS applications, the number of entry points for attackers to infiltrate your systems has exploded. But gaining visibility into all these possible attack vectors is time-consuming and often incomplete or just a snapshot in time.

If the first rule of cyber is to “know what you have,” how can cyber professionals get a comprehensive, current picture of their assets? How can they feel confident that they understand which assets may be more vulnerable and prioritize defenses accordingly?

In the first half of this episode of Cyberwire-X, the CyberWire's CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined by Hash Table member Jaclyn Miller, the Head of InfoSec & IT at DispatchHealth. In the second half of the episode, Cody Pierce, Chief Product Officer at episode sponsor LookingGlass Cyber Solutions, talks with Dave Bittner. Listen to the discussions about answering the foundational cyber questions (What do I have? Is it protected?), why context is critical, and how an adversarial perspective helps you be a better defender.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Noberus ransomware: evolving tactics. [Research Saturday] Oct 15, 2022

Show notes

Brigid O Gorman from Symantec's Threat Hunter team joins Dave to discuss their research on "Noberus Ransomware - Darkside and BlackMatter Successor Continues to Evolve its Tactics." The research states that Noberus ransomware (aka BlackCat, ALPHV) is more dangerous than ever because attackers have been using new tactics, tools, and procedures in recent months.

In the research, Symantec says, "Among some of the more notable developments has been the use of a new version of the Exmatter data exfiltration tool, and the use of Eamfo, information-stealing malware that is designed to steal credentials stored by Veeam backup software." They go over an in-depth look at how its affiliate program operates.

The research can be found here:

Noberus Ransomware: Darkside and BlackMatter Successor Continues to Evolve its Tactics

Learn more about your ad choices. Visit megaphone.fm/adchoices

Phishing for poll watchers. Impersonating Intrusion Truth. Data breach at the LDS Church. SpaceX asks for help paying for Ukraine’s Starlink. Killnet’s potential. The gamer’s attack surface. Oct 14, 2022

Show notes

County election workers find themselves targets of phishing. Impersonating Intrusion Truth. The LDS Church discloses data compromise. SpaceX asks for Starlink funding. Does Killnet have potential to do more damage than it so far has? Deepen Desai from Zscaler on Joker, Facestealer and Coper banking malwares on the Google Play store. Our guest is Maxime Lamothe-Brassard of LimaCharlie to discuss how the cybersecurity is following in the footsteps of software engineering. And the Gamers’ attack surface? It’s big, big, really big, Noobs.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/198

Selected reading.

2022 Election Phishing Attacks Target Election Workers (Trellix)

Suspicious Twitter accounts impersonating research group try to blame the NSA for Chinese hacks (The Daily Dot)

Statement and FAQ on Church Account Data Incident (Church of Jesus Christ of Latter Day Saints)

Exclusive: Musk's SpaceX says it can no longer pay for critical satellite services in Ukraine, asks Pentagon to pick up the tab (CNN)

Killnet: don't underestimate the “script kiddies,” experts say (Cybernews)

Gaming Is Booming. That’s Catnip for Cybercriminals. (New York Times)

Learn more about your ad choices. Visit megaphone.fm/adchoices

What the cybercriminals are up to: improving their tools and carrying out the same old dreary social engineering. Budworm APT sightings. And the state of Russia’s hybrid war. Oct 13, 2022

Show notes

Emotet ups its game. COVID-19 small business grants as phishbait. Google Translate is spoofed for credential harvesting. Research on the Budworm espionage group. Kevin Magee from Microsoft shares why cybersecurity professionals should join company boards. Our guest is Chris Niggel from Okta with a look at identity shortfalls. And Internet outages during missile strikes, and the prospects of Russia’s hybrid war.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/197

Selected reading.

Emotote’s evolution. (ESET)

Fresh Phish: Small Business COVID-19 Grants Designed for Disaster (INKY)

Spoofing Google Translate to Steal Credentials (Avanan)

Budworm: Espionage Group Returns to Targeting U.S. Organizations (Symantec Blog)

Internet outages hit Ukraine following Russian missile strikes (Bitdefender)

Starlink helped restore energy, communications infrastructure in parts of Ukraine - official (Reuters)

Ukraine’s Vice PM Thanks Starlink for Help to Restore Connections After Missile Attack from Russia (Tech Times)

We must tackle Europe’s winter cyber threats head-on (POLITICO)

The conflict in Ukraine makes us rethink cyberwar (The Japan Times)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Caffeine in the C2C market. Refund-fraud-as-a-service. Costs of a nuisance. Staying alert during a hybrid war. Renewed Polonium activity. The Uber case's impact on security professionals. Oct 12, 2022

Show notes

Refund fraud as a service. Costs of a nuisance. Remaining on alert during a hybrid war. Renewed activity by Polonium. Andrea Little Limbago from Interos discussing quantum computing policy. CyberWire Space Correspondent Maria Varmazis speaks with Dr. Gregory Falco on lessons learned from Russia’s attack on Viasat. Reflections on the Uber case's impact on security professionals. And when it comes to phishing-as-a-service, we’ll take decaf.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/196

Selected reading.

The Fresh Phish Market: Behind the Scenes of the Caffeine Phishing-as-a-Service Platform (Mandiant)

Caffeine phishing. (CyberWire)

Refund Fraud as a Service (Netacea)

Amid reports of JP Morgan cyberattack, experts call Killnet unsophisticated, ‘media hungry’ (SC Media)

Hacktivists Force Companies to Respond to Low-Level Cyberattacks (Wall Street Journal)

Nato warns Russian sabotage on Western targets 'could trigger Article 5' (The Telegraph)

US Not Ruling Out Russian Cyber Offensive (VOA)

Ukraine at D+230: Escalation, but unlikely to be sustainable. (CyberWire)

POLONIUM targets Israel with Creepy malware (WeLiveSecurity)

Hacking group POLONIUM uses ‘Creepy’ malware against Israel (BleepingComputer)

Security chiefs fear ‘CISO scapegoating’ following Uber-Sullivan verdict (The Record)

Sullivan verdict sends shockwaves through the security industry (Security Info Watch)

Reflections on the Uber case's impact on security. (CyberWire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

An update on the hybrid war, where Russia turns to missile strikes, physical sabotage, and nuisance-level DDoS. Surveys look at the state of the SOC and the mind of the CISO. Oct 11, 2022

Show notes

Russia's Killnet suspected in DDoS attack on major US airports. Starlink service interruptions reported. Bundesbahn communications network sabotaged in northern Germany. Germany's cybersecurity chief faces scrutiny over alleged ties to Russia. Ben Yelin on the FCC's crackdown on robocalls. Ann Johnson from Afternoon Cyber Tea talking with Sounil Yu from JupiterOne about the importance and evolution of cyber resilience. Overworked CISOs may be a security risk, but in an encouraging counterpoint, another study shows a record of CISO success during the pandemic.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/195

Selected reading.

US Airport Websites Hit by Suspected Pro-Russian Cyberattacks (SecurityWeek)

Hackers knock some U.S. airport websites offline (Washington Post)

Hackers took down U.S. airport web sites, Department of Homeland Security confirms (USA TODAY)

Pro-Russian hackers claim responsibility for taking down US airport websites (Computing)

US airports' sites taken down in DDoS attacks by pro-Russian hackers (BleepingComputer)

Pro-Putin goons target US airport websites with DDoS flood (Register)

Russian Sanctions Instigator Lloyd’s Possibly Hit by Cyber-Attack (Infosecurity Magazine)

Lloyd's of London reboots network after suspicious activity (Register)

Colorado.gov Back Online After Cyber Attack (GovTech)

Defending Ukraine: SecTor session probes a complex cyber war (IT World Canada)

Ukrainian officials reportedly say there have been 'catastrophic' Starlink outages in recent weeks (Business Insider)

Frontline Ukraine troops are reportedly enduring Starlink outages (Engadget).

Elon Musk’s foray into geopolitics has Ukraine worried (The Economist)

Elon Musk needs to clarify Ukraine's reported Starlink outages: Kinzinger (Newsweek)

Attack on German Rail Network ‘Targeted, Professional,’ Police Say (Bloomberg)

An act of sabotage shut down parts of Germany's rail system for hours this weekend (NPR.org)

Germany rail chaos could have been caused by Russia, says MP (The Telegraph)

Sabotage blamed for major disruption on Germany’s rail network (The Telegraph)

No sign that foreign state was behind German rail sabotage, police say (Reuters)

Germany Won’t Rule Out Foreign Country Role in Rail Sabotage (Bloomberg)

Germany's cybersecurity chief faces dismissal, reports say (Reuters)

German cybersecurity chief investigated over Russia ties (ABC News)

German Cybersecurity Chief to be Sacked Over Alleged Russia Ties: Sources (SecurityWeek)

„Wir müssen wachsam bleiben“ (Tagesspiegel)

1 in 5 Chief Information Security Officers (CISOs) Work More Than 25 Extra Hours Per Week (Tessian)

2022 Devo SOC Performance Report (Devo)

2022 Deloitte-NASCIO Cybersecurity Study (Deloitte Insights)

Cybersecurity Survey of State CISOs Identifies Many Positive Trends (PR Newswire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

CyberWire’s space correspondent, Maria Varmazis, interviews Anthony Colangelo. [Interview Selects] Oct 10, 2022

Show notes

This interview from September 23rd, 2022 originally aired as a shortened version on the CyberWire Daily Podcast. In this extended interview, CyberWire’s space correspondent, Maria Varmazis, interviews host of spaceflight podcast “Main Engine Cutoff,” Anthony Colangelo about the upcoming Apple iPhone 14 “Emergency SOS via Satellite” feature & what it means for satellite communications in the consumer sector.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Moving Faster - Securely. Why Your Org Should Add Security to your DevOps Program [Security Sandbox] Oct 10, 2022

Show notes

In today’s episode, our sandbox heads to the deployment pipeline for a conversation on the who/what/when/and why of a DevSecOps program and how it adds value to your business. And your main questions- – how you can encourage buy-in and adoption. Joining me today are Marcin Swiety, Relativity’s Senior Director of Global Security and IT, and Raphael Theberge - Director of Security Integrations. So, grab your DORA metrics, your source controls, and staging environments, and let’s dive in.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Pentest reporting and the remediation cycle: Why aren’t we making progress? [CyberWire-X] Oct 09, 2022

Show notes

The age-old battle between offensive and defensive security practitioners is most often played out in the penetration testing cycle. Pentesters ask, “Is it our fault if they don’t fix things?” While defenders drown in a sea of unprioritized findings and legacy issues wondering where to even start.

But the real battle shouldn’t be between the teams; it should be against the real adversaries. So why do pentesters routinely come back and find the same things they reported a year ago? Do the defenders just not care or does the onus fall on the report? Everyone really wants the same thing: better security. To get there, the primary communication tool between consultant and client, offensive and defensive teams — the pentest report — must be consumable and actionable and tailored to the audience who receives it.

In the first half of this episode of Cyberwire-X, the CyberWire's CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined by Hash Table members Amanda Fennell, the CIO and CSO of Relativity, and William MacMillan, the SVP of Security Product and Program Management at Salesforce. In the second half of the episode, Dan DeCloss, the Founder and CEO of episode sponsor PlexTrac, joins Dave Bittner discuss the politics around pentest reporting and how better reports can support real progress.

Learn more about your ad choices. Visit megaphone.fm/adchoices