CyberWire Daily

Latest Episodes:

The OSINT revolution: How cyber and physical security teams are leveraging open source intelligence. [CyberWire-X] Oct 02, 2022

Show notes

On this episode of CyberWire-X, we dive into the essential role of open-source intelligence in identifying cyber and physical threats and reducing risk across your organization. The CyberWire's CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined in the first half by Hash Table members Dr. Georgianna Shea, CCTI and TCIL Chief Technologist at the Foundation for Defense of Democracies, and Bob Turner, Field CISO – Education at Fortinet. In the second half of the show, CyberWire podcast host Dave Bittner talks with our episode sponsor risk intelligence firm Flashpoint's Chief Intelligence Officer Tom Hofmann. They explore the foundational importance of open source intelligence, which includes social media platforms and geospatial data and insights. Plus, they explore real-life examples of how organizations, from governments to commercial enterprises, are leveraging open source intelligence and technology every day to protect their people, places, assets, and critical infrastructure.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Targeting your browser bookmarks? [Research Saturday] Oct 01, 2022

Show notes

David Prefer from SANS sits down with Dave to discuss how a new covert channel exfiltrates data via a browser's built-in bookmark sync. David goes on to describe how this research will "describe how the ability to synchronize bookmarks across devices introduces a novel vector for data exfiltration and other misuses."

In the research, he shares how he tested his said hypothesis and goes on to describe how the interesting find was tested on multiple browsers including Chrome, Edge, Brave and Opera. In his research, he found that bookmarks are able to keep data and synchronize it, making it easier to infiltrate and extract data from. David shares the rest of his findings, as well as what organizations and browser developers can do to work on this new threat.

The research can be found here:

Bookmark Bruggling: Novel Data Exfiltration with Brugglemark

Learn more about your ad choices. Visit megaphone.fm/adchoices

Espionage, both online and in-person. Sabotage, both kinetic and (maybe eventually) cyber. Waterin holes, deepfakes, and the pushing of naughty words. Sep 30, 2022

Show notes

North Korean operators "weaponize" open-source software. The SolarMarker info-stealer returns. A quick review of Fast Company's WordPress hijacking incident. Deepfakes, and their evolution into an underworld and influence ops tool. Kinetic sabotage in the Baltic raises concerns about threats to infrastructure in cyberspace. Chris Novak from Verizon with a mid-year check in. Our guest is MK Palmore of Google Cloud on why collective cybersecurity ultimately depends on having a diverse, skilled workforce. And the US arrests three in two alleged spying cases.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/189

Selected reading.

ZINC weaponizing open-source software (Microsoft Security Threat Intelligence | LinkedIn Threat Prevention and Defense)

Lazarus Group Affiliate Uses Trojanized Open Source Apps in New Campaigns (Decipher)

North Korea weaponizes open-source software. (CyberWire)

Info-Stealing Malware, SolarMarker, is Using Watering Hole Attacks… (eSentire)

Fast Company hack causes obscene Apple News notifications. (CyberWire)

The Future of Deepfakes. (CyberWire)

Fourth Nord Stream Leak Spotted, NATO Sees 'Sabotage' - The Moscow Times (The Moscow Times)

Russian spy chief: West was behind sabotage of Nord Stream (Reuters)

NATO Formally Blames Sabotage for Nord Stream Pipeline Damage (Wall Street Journal)

NATO: Nord Stream pipeline leaks result of "sabotage" (Axios)

Pentagon chief: Too soon to say who might be behind Nord Stream pipeline attack (www.euractiv.com)

First on CNN: European security officials observed Russian Navy ships in vicinity of Nord Stream pipeline leaks (CNN)

Mysterious Blasts and Gas Leaks: What We Know About the Pipeline Breaks in Europe (New York Times)

NATO issues 'sabotage' warning after gas pipeline explosions (NBC News)

Russia’s Purported Sabotage Of The Nord Stream Pipeline Marks A Point Of No Return (Forbes)

Nach Angriff auf Nord Stream 1 und 2: Ist Deutschland vor russischen Hackern sicher? (WirtschaftsWoche)

'We all have to be worried': War in Ukraine boosts energy cyberattack risks, says Petrobras executive (Upstream Online)

Finnish intelligence warns Russia ‘highly likely’ to turn to cyber in winter (The Record by Recorded Future)

Ukraine War Goes Hybrid (Energy Intelligence)

New Warnings from Ukraine About Looming Russian Cyberattacks (VOA)a

Russian Cyber Efforts in Ukraine See Muted Results, Says Panel (USNI News)

Ukraine-Russia Conflict: Ukraine Alerts Energy Enterprises to Possible Cyberattack Escalation (Security Boulevard)

Ukraine is Winning the Cyber War (CEPA)

Hitachi Energy MicroSCADA Pro X SYS600 (CISA)

Baxter Sigma Spectrum Infusion Pump (CISA)

ARC Informatique PcVue (Update A) (CISA)

Delta Electronics DOPSoft (CISA)

Delta Electronics DOPSoft (Update B) (CISA)

Former NSA Employee Arrested on Espionage-Related Charges (US Department of Justice)

Major in the United States Army and a Maryland Doctor Facing Federal Indictment for Allegedly Providing Confidential Health Information to a Purported Russian Representative to Assist Russia Related to the Conflict In Ukraine (US Department of Justice)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hackers support Iranian dissidents. Notes on C2C markets. Cyberespionage campaigns. Intercepted mobile calls from Russian troops expose morale problems. Sep 29, 2022

Show notes

Gray-hat support for Iranian dissidents. Selling access wholesale in the C2C market. Novel malware’s discovered targeting VMware hypervisors. The Witchetty espionage group uses an updated toolkit. Deepen Desai from Zscaler has a Technical Analysis of Industrial Spy Ransomware. Ann Johnson of Afternoon Cyber Tea speaks with Michal Braverman-Blumenstyk, CTO for Microsoft Security, about Israel's cyber innovation. And Russian troops phone call revelations.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/188

Selected reading.

Hacker Groups take to Telegram, Signal and Darkweb to assist Protestors in Iran (Check Point Software)

Hackers Use Telegram and Signal to Assist Protestors in Iran (Infosecurity Magazine)

Hackers Aid Protests Against Iranian Government with Proxies, Leaks and Hacks (The Hacker News)

Hackers seek to help — and profit from — Iran protests (The Record by Recorded Future)

Ransomware and Wholesale Access Markets: A $10 investment can lead to millions in profit (Cybersixgill)

Selling access wholesale in the C2C market. (CyberWire)

Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors (Mandiant)

Bad VIB(E)s Part Two: Detection and Hardening within ESXi Hypervisors (Mandiant)

Mandiant has identified new malware that targets VMware ESXi, Linux vCenter servers, and Windows virtual machines. (CyberWire)

Securonix Threat Labs Security Advisory: Detecting STEEP#MAVERICK: New Covert Attack Campaign Targeting Military Contractors (Securonix)

Steep#Maverick cyberespionage campaign. (CyberWire)

Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East (Symantec)

Witchetty espionage group uses updated toolkit. (CyberWire)

‘Putin Is a Fool’: Intercepted Calls Reveal Russian Army in Disarray (New York Times)

Cyber Warfare Rife in Ukraine, But Impact Stays in Shadows (SecurityWeek)

Russian hackers' lack of success against Ukraine shows that strong cyber defences work, says cybersecurity chief (ZDNET)

Failure of Russia’s cyber attacks on Ukraine is most important lesson for NCSC (ComputerWeekly)

Learn more about your ad choices. Visit megaphone.fm/adchoices

DDoS remains commonplace in Russia's hybrid war. Leaked LockBit 3.0 builder used by new gang. Meta takes down Russian disinfo networks. Lazarus Group goes spearphishing. Cloudy complexity. Sep 28, 2022

Show notes

DDoS remains the most characteristic mode of cyber ops in Russia's hybrid war against Ukraine. A leaked LockBit 3.0 builder is being used in ransomware attacks. Meta takes down Russian disinformation networks. Lazarus Group is spearphishing with bogus job offers. Joe Carrigan looks at SNAP benefit scams. Our guest is Crane Hassold of Abnormal Security with the latest in advanced email attack trends. And the cloud…is complicated.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/187

Selected reading.

Adversaries Continue Cyberattack Onslaught with Greater Precision and Innovative Attack Methods According to 1H2022 NETSCOUT DDoS Threat Intelligence Report (NETSCOUT)

Leaked LockBit 3.0 builder used by ‘Bl00dy’ ransomware gang in attacks (BleepingComputer)

Removing Coordinated Inauthentic Behavior From China and Russia (Meta)

Russia is spoofing mainstream media to smear Ukraine, Meta says (Protocol)

Operation In(ter)ception: social engineering by the Lazarus Group. (CyberWire)

How cloud complexity affects security. (CyberWire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ukraine's Defense Intelligence warns of coming Russian cyberattacks against infrastructure. Next moves for Lapsus$? Cashout scams and neglected wallets. Developments in the Optus breach. Sep 27, 2022

Show notes

Ukraine's Defense Intelligence warns of coming Russian cyberattacks against infrastructure. Next moves for Lapsus$? We know it’s a bear market, but take a look at your wallet, crypto speculators, at least now and then. Mr Security Answer Person john Pescatore on next year's most over-hyped term. Ben Yelin explains a thirty five million dollar data privacy settlement. And, finally, developments in the Optus breach.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/186

Selected reading.

Invaders Preparing Mass Cyberattacks on Facilities of Critical Infrastructure of Ukraine and Its Allies (Defence Intelligence of the Ministry of Defence of Ukraine)

Ukraine Says Russia Planning 'Massive Cyberattacks' on Critical Infrastructure (SecurityWeek)

Ukraine warns of Russian cyber attacks targeting critical infrastructure (Computing)

Russia plans “massive cyberattacks” on critical infrastructure, Ukraine warns (Ars Technica)

Ukraine warns allies: Russia plans 'massive cyberattacks' (Register)

Hackers Working With Russia to Coordinate Cyberattacks, Google Says - Tech News Briefing - WSJ Podcasts (Wall Street Journal)

Viasat Hack "Did Not" Have Huge Impact on Ukrainian Military Communications, Official Says (Zero Day)

Who’s next in Lapsus$’ crosshairs? (Digital Shadows)

Report: Sift Uncovers New Cashout Scam Targeting Forgotten Crypto Accounts (GlobeNewswire News Room)

Optus hacker releases 10,000 customers' details and issues new threat (Sky News)

‘Last thing I need’: Optus customer scrambles to protect himself (Australian Financial Review)

An alleged hacker has offered their 'deepest apologies' to Optus. Here's the latest on the data breach (ABC)

Singtel's Optus under further fire for cyber breach; purported hackers claim data deleted (The Straits Times)

‘Not feasible’ to crack properly encrypted data (Australian Financial Review)

Optus hack not 'sophisticated' as claims 10,000 customers have data publicly released (9News)

Everything Happening in This Optus Cyberattack Shitstorm, I Promise (Vice)

Australian cybersecurity minister lambasts Optus for ‘unprecedented' hack (The Record by Recorded Future)

FBI Working With Australian Authorities on Optus Cyberattack (MarketScreener)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Unrest in Iran finds expression in cyberspace. Cyber conflict and diplomacy. Cybercrime in the hybrid war. And there seems to have been an arrest in the Uber and Rockstar breaches. Sep 26, 2022

Show notes

Unrest in Iran finds expression in cyberspace. Albania explains its reasons for severing relations with Iran. Cybercrime in the hybrid war. Rick Howard on risk forecasting with data scientists. Dave Bittner sits down with Dr. Bilyana Lilly to discuss her new book: "Russian Information Warfare: Assault on Democracies in the Cyber Wild West."And there seems to have been an arrest in the Uber and Rockstar breaches.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/185

Selected reading.

Iran’s War Within (Foreign Affairs)

Iran’s Hijab Protests Have Lit a Fire the Regime Can’t Put Out (World Politics Review)

‘Something big is happening’: the Iranians risking everything to protest (the Guardian)

Dissident: 'Iranian women are furious' over headscarf death (AP NEWS)

OpIran: Anonymous declares war on Teheran amid Mahsa Amini’s death (Security Affairs)

IDF official says military foiled ‘dozens’ of Iran cyberattacks on civilian sites (Times of Israel)

Analysis | 'Our Conflict With Iran Is Unparalleled', Say Israel's Elite Cyber Unit Commanders (Haaretz)

US Issues License to Expand Internet Access for Iranians (VOA)

US Treasury carves out Iran sanctions exceptions for internet providers (The Record by Recorded Future)

Iran and Albania: diplomacy and cyber operations (CyberWire)

Ukraine dismantles hacker gang that stole 30 million accounts (BleepingComputer)

The SBU neutralized a hacker group that "hacked" almost 30 million accounts of Ukrainian and EU citizens (SSU)

Les détails personnels de stars, dont Sir David Attenborough et Sarah Ferguson, ont été divulgués après le piratage d'un magasin bio par des escrocs russes (News 24)

London Police Arrested 17-Year-Old Hacker Suspected of Uber and GTA 6 Breaches (The Hacker News)

UK teen suspected of Uber and Rockstar hacks arrested (Computing)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Adam Marrè: Learning to be a leader. [CISO] [Career Notes] Sep 25, 2022

Show notes

Adam Marrè, CISO from Arctic Wolf sits down to share his story of rising through the ranks. After 9/11 he decided he wanted to make a difference in the world and so he chose to go into the FBI, there he learned the skills that got him to where he is today. In his time at the FBI, he was able to do what he loved which was working with computers while gaining more knowledge on cybersecurity and became computer forensic certified. Ultimately he needed a change in the end and decided to leave the FBI, He was able to learn the leadership skills he needed to move past that career path and follow a new dream. He is now able to share his passion with the world and help people understand security to help protect themselves as well as helping people finding success in their careers and in their lives. We thank Adam for sharing his story.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Keeping an eye on RDS vulnerabilities. [Research Saturday] Sep 24, 2022

Show notes

Gafnit Amiga, Director of Security Research from Lightspin joins Dave to discuss her team's research "AWS RDS Vulnerability Leads to AWS Internal Service Credentials." The research describes how the vulnerability was caught and right after it was reported the AWS Security team applied an initial patch limited only to the recent Amazon Relational Database Service (RDS) and Aurora PostgreSQL engines, excluding older versions.

They followed by personally reaching out to the customers affected by the vulnerability and helped them through the update process. The research states "Lightspin's Research Team obtained credentials to an internal AWS service by exploiting a local file read vulnerability on the RDS EC2 instance using the log_fdw extension."

The research can be found here:

AWS RDS Vulnerability Leads to AWS Internal Service Credentials

Learn more about your ad choices. Visit megaphone.fm/adchoices

Privateers seem to be evolving into front groups for the Russian organs. Unidentified threat actors engaging in cyberespionage. Catphishing from a South Carolina prison. Sep 23, 2022

Show notes

The GRU's closely coordinating with cyber criminals. An unidentified threat actor deploys malicious NPM packets. Gootloader uses blogging and SEO poisoning to attract victims. Metador is a so-far unattributed threat actor. Johannes Ullrich from SANS on Resilient DNS Infrastructure. Maria Varmazis interviews Anthony Colangelo, host of spaceflight podcast Main Engine Cutoff, about the iPhone 14 “Emergency SOS via Satellite” feature. And having too much time on your hands while doing time is not a good thing.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/184