CyberWire Daily

Latest Episodes:

Profiling the Linken Sphere anti-detection browser. [Research Saturday] Jan 11, 2020

Show notes

Multiple e-commerce and financial organizations around the world are targeted by cybercriminals attempting to bypass or disable their security mechanisms, in some cases by using tools that imitate the activities of legitimate users. Linken Sphere, an anti-detection browser, is one of the most popular tools of this kind at the moment.

Staffan Truvé is the CTO and Co-Founder of Recorded Future, he joins us to discuss their new report on the browser.

The research can be found here:

Profiling the Linken Sphere Anti-Detection Browser

Learn more about your ad choices. Visit megaphone.fm/adchoices

Updates on US-Iranian tensions, and especially on hacktivism and possible power grid battlespace preparation. Researchers complain of preinstalled malware said to be in discount Android phones. Jan 10, 2020

Show notes

Amid indications that both Iran and the US would prefer to back away from open war, concerns about Iranian power grid battlespace preparation remain high. Recent website defacements, however, increasingly look more like the work of young hacktivists than a campaign run by Tehran. Phones delivered under the FCC’s Lifeliine Assistance program may come with malware preinstalled. And we’ll take Cybersecurity for six hundred, Alex. Tom Etheridge from Crowdstrike on having a board of directors’ playbook. Guest is Curtis Simpson from Armis on CISO burnout.

For links to all of today's stories check our our CyberWire daily news brief:

https://thecyberwire.com/issues/issues2020/January/CyberWire_2020_01_10.html

Support our show

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyber alert remains high as the US-Iranian confrontation cools. Information ops, wipers, and energy sector targeting. Jan 09, 2020

Show notes

As kinetic combat abates in Iraq, warnings of cyber threats increase. US intelligence agencies warn of heightened likelihood of Iranian cyber operations. These may be more serious than the low-grade website defacements and Twitter impersonations so far observed. One operation, “Dustman” has hit Bahrain, and it looks like an Iranian wiper. And some notes on the Lazarus Group, and a quick look at information ops across the Taiwan Strait. Emily Wilson from Terbium Labs with details from their recent report, “How Fraud Stole Christmas.” Guest is Karl Sigler from Trustwave in the risks of using Windows 7.

For links to all of today's stories check our our CyberWire daily news brief:

https://thecyberwire.com/issues/issues2020/January/CyberWire_2020_01_09.html

Support our show

Learn more about your ad choices. Visit megaphone.fm/adchoices

No major Iranian cyberattacks against the US so far, as both sides appear interested in cooling off. The Cyber Solarium offers a preview of its coming report on US cyber strategy. Jan 08, 2020

Show notes

Iran took some missile shots at two US air bases in Iraq last night, and President Trump barked back in a late morning press conference, but actually both sides seem inclined to move toward de-escalation. No major Iranian cyberattacks have developed, despite some low-grade skid vandalism of indifferently defended sites, but CISA’s warnings seem generally to be taken seriously. And the Cyber Solarium gave a preview of its recommendations for a US national cyber strategy. Caleb Barlow from CynergisTek with insights on potential cyber attacks from Iran.

For links to all of today's stories check our our CyberWire daily news brief:

https://thecyberwire.com/issues/issues2020/January/CyberWire_2020_01_08.html

Support our show

Learn more about your ad choices. Visit megaphone.fm/adchoices

No more Iranian cyberattacks since the minor weekend vandalism, but the US Government advises all to look to their defenses. Fancy Bear is the usual suspect in Austria. A guilty plea by an insider threat. Jan 07, 2020

Show notes

The kittens haven’t scratched much so far, but the US Government and others are warning organizations to be alert to the likelihood of Iranian cyberattacks in retaliation for the combat death, by US missile, of Quds Force commander Soleimani. Fancy Bear is the usual suspect in the case of the Austrian Foreign Ministry hack. Patch your Pulse Secure VPN servers if you’ve got ‘em. ToTok is back in the Play Store. And there’s an executive who turned out to be an insider threat. Robert M. Lee from Dragos with a look back at 2019 ICS security issues. Guest is Tom Tovar from AppDome on mobile API security.

For links to all of today's stories check our our CyberWire daily news brief:

https://thecyberwire.com/issues/issues2020/January/CyberWire_2020_01_08.html

Support our show

Learn more about your ad choices. Visit megaphone.fm/adchoices

Sequelae of the US Reaper strike against the Quds Force commander. Warnings of Iranian retaliation, with an emphasis on cyberspace. Espionage in Austria, and a second look at an LSE outage. Jan 06, 2020

Show notes

Iran vows retribution for the US drone strike that killed the commander of the Quds Force. The US prepares for Iranian action, and the Department of Homeland Security warns that cyberattacks are particularly likely. Some low-grade Iranian cyber operations may have already taken place. Austria’s Foreign Ministry sustains an apparent state-directed cyber espionage attack, and in the UK authorities are taking a second look at the August outages at the London Stock Exchange. Joe Carrigan from JHU ISI, describing a clever defense against laptop theft.

For links to all of today's stories check our our CyberWire daily news brief:

https://thecyberwire.com/issues/issues2020/January/CyberWire_2020_01_06.html

Support our show

Learn more about your ad choices. Visit megaphone.fm/adchoices

Escalation in the Gulf as a US air strike kills Iran’s Quds commander. Travelex and RavnAir continue their recovery from cyberattacks. Taiwan’s memes against misinformation. Jan 03, 2020

Show notes

The US and Iran trade fire in Iraq, and a leading Iranian general is killed in a US airstrike. A corresponding escalation of cyber operations can be expected. Currency exchange Travelex continues to operate manually as it works to recover from what it calls “a software virus.” There’s speculation that the RavnAir incident may have been a ransomware attack. And Taiwan adopts an active policy against Chinese attempts to influence its elections. Johannes Ullrich from the SANS Technology Center on vulnerabilities in Citrix NetScaler installations. Guest is Derek Manky from Fortinet on what to expect in AI for 2020.

For links to all of today's stories check our our CyberWire daily news brief:

https://thecyberwire.com/issues/issues2020/January/CyberWire_2020_01_03.html

Support our show

Learn more about your ad choices. Visit megaphone.fm/adchoices

A Jira vulnerability that’s leaking data in the public cloud. [Research Saturday] Jan 02, 2020

Show notes

Unit 42 (the Palo Alto Networks threat intelligence team) released new research on a Jira vulnerability that’s leaking data of technology, industrial and media organizations in the public cloud. The vulnerability (a Server Side Request Forgery -- SSRF) is the same type that led to the Capital One data breach in July 2019.

Jen Miller-Osborn is the Deputy Director of Threat Intelligence for Unit 42 at Palo Alto Networks, and she joins us to share their findings.

The research can be found here:

https://unit42.paloaltonetworks.com/server-side-request-forgery-exposes-data-of-technology-industrial-and-media-organizations/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Taking down Thallium. Cloud Hopper: bigger (and worse) than thought. US tightens screws on the supply chain. The bite of winter and the scent of plums. Jan 02, 2020

Show notes

Microsoft takes down bogus domains operated by North Korea’s Thallium Advanced Persistent Threat. The Cloud Hoppercyber espionage campaign turns out to have been far more extensive than hitherto believed. The US wants Huawei (and ZTE) out of contractor supply chains this year. India will test equipment before allowing it into its 5G networks. And the California Consumer Privacy Act is now in effect. Joe Carrigan from JHU ISI with the story of a financial advisor who payed the price for falling for a phishing scheme. Guest is Dave Burg from EY on the global perspective of cyber security risk.

For links to all of today's stories check our our CyberWire daily news brief:

https://thecyberwire.com/issues/issues2020/January/CyberWire_2020_01_02.html

Support our show

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ron Gula and Mike Janke - VC pitfalls and how to avoid them. [Special Editions] Dec 30, 2019

Show notes

In this CyberWire special edition, advice from a pair of seasoned cyber security investors. Ron Gula caught our eye with an article he recently penned titled "Cyber entrepreneur pitfalls you can avoid." In it, he gathers a group of tech investors to get their takes on the dos and don'ts of pitching to venture capitalists. Ron runs Gula Tech Adventures along with his wife Cindi, where they aim to support the next generation of cyber technology strategy and policy. DataTribe's Mike Janke joins the conversation with his experiences guiding hopeful young entrepreneurs through the pitch process.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected