CyberWire Daily

Latest Episodes:

Ransomware old and ransomware new, but can you distinguish it from a wiper? Influence operations hearings on Capitol Hill. Nov 01, 2017

Show notes

In today's podcast, we hear about ONI ansomware in Japan that may prove to be a wiper. Ukraine blames NotPetya operators Black Energy for BadRabbit. Pyongyang feels London is picking on it. Fishing Facebook in Nordic nations. Security firms sell certificate authority business. Twitter won't sell any more ads to RT or Sputnik. Johannes Ullrich from SANS Technology Institute and the ISC Stormcast podcast on honeypots. Russell Jones from Deloitte with the results from a recent medical security poll.During hearings on influence operations, Senators wonder why Facebook wasn't suspicious when people paid for their advertising in rubles.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A BadRabbit and Reaper update. EU and cyberwar. DPRK denies WannaCry responsibility. China's cyber espionage shifts. Oracle emergency patch. Buganizer wide open. Influence ops. Heathrow security. Oct 31, 2017

Show notes

In today's podcast, we hear about the state of BadRabbit and Reaper. The EU drafts a diplomatic framework for self-defense in cyberspace. Pyongyang denies UK attribution of WannaCry to North Korea. Threat intelligence types suspect the Sino-US cyber modus vivendi might not be the unqualified success it's been taken to be. Oracle issues an emergency patch. A researcher gets an unauthorized peek at Google's Buganizer. Congress will hear testimony about influence operations in Twitter, Google, and Facebook. Rick Howard from Palo Alto Networks warns that board members might be targets. And USB sticks contain the darndest things.

Plus, the Malware Mash.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Reaper looks like a criminal booter on the Chinese black market. BadRabbit shows some moves. Catch-All malicious Chrome extension. Android currency miners in Google Play. Indictments in Russia probe. Oct 30, 2017

Show notes

In today's podcast, we hear that the Reaper botnet is still quiet, and looking like a booter-for-hire. BadRabbit shows some odd stealth, and some interesting strategic selectivity. A malicious Chrome extension steals everything you put on a website. Currency miners on phones seem to be the kind of crime that doesn't pay, but that's not stopping crooks from stuffing them into Google Play. First indictments in the US probe of Russian election influence operations are out. Emily Wilson from Terbium Labs on third party breaches, what she describes as “Not your breach, still your problem.” And a class action suit is filed over the Equifax breach.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, you might find it valuable, too. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. Interested in the latest research in cyber security? Cylance is revolutionizing cybersecurity with products and services that proactively prevent, rather than reactively detect the execution of advanced persistent threats and malware. Learn more at cylance.com.

Podcast sponsor 1-Recorded Future: http://goo.gl/wphZ1z
Podcast sponsor 2- E8 Security: https://goo.gl/yBBx55
Friday sponsor- Cylance: https://goo.gl/fHR65L

Learn more about your ad choices. Visit megaphone.fm/adchoices

Tracking a Trojan: KHRAT. [Research Saturday] Oct 28, 2017

Show notes

The moniker KHRAT came about because of the identification of a Remote Access Trojan (RAT) with command and control infrastructure found in Cambodia (KH). In the most recent episode of the CyberWire's Research Saturday, Ryan Olson, Director of Threat Intelligence at Palo Alto Networks, talks with us about the capabilities of KHRAT and shares details the feature set it provides to threat actors that use it.

https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/

Learn more about your ad choices. Visit megaphone.fm/adchoices

BadRabbit ransomware and Reaper botnet updates. SATCOM bugs. ICS cybersecurity notes. Moscow's free commercial speech piety. Anonymous is back. Oct 27, 2017

Show notes

In today's podcast, we hear that BadRabbit, still quiet, looks like a TeleBots product. Reaper is still locked and loaded, but is also still quiet. Maritime SATCOM system found to be buggy, and the worse news is that it's beyond its end-of-life. A look back at the annual ICS Cybersecurity Summit that wrapped yesterday in Atlanta. Moscow tells Twitter buying ads is a free speech issue. Justin Harvey from Accenture on monitoring cloud infrastructure. Guest is Michael Sulmeyer, Director of the Cyber Security Project at the Harvard Kennedy School’s Belfer Center for Science and International Affairs. Anonymous is back and poking at the Spanish government.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Dogs that haven't barked. Surveillance authority reauthorization advances in the US Senate. Notes on ICS cybersecurity. Oct 26, 2017

Show notes

In today's podcast, we hear that there's still no sign of the Reaper botnet doing anything. An update on BadRabbit—which for some reason seems to have hopped quietly away from its infrastructure. Other forms of more conventional ransomware, however, remain in circulation, in the wild. It looks as if Kaspersky software might have stumbled across NSA files after all. The US Senate Intelligence Committee has voted to reauthorize Section 702 surveillance authorities through the end of 2025. Ben Yelin from UMD CHHS on states' funding challenges when trying to sure up the security of their voting systems. Bob Ackerman and Dave DeWalt from AllegisCyber, on the occasion of their business announcements, discussing the investment climate for cyber security. And we have notes on ICS from Atlanta.

Learn more about your ad choices. Visit megaphone.fm/adchoices

BadRabbit hopping though Eastern and Central Europe, and Southwest Asia. DUHK risks. Kaspersky on how a laptop was backdoored. Notes from Atlanta's ICS Cybersecurity Conference. Oct 25, 2017

Show notes

In today's podcast, we hear about BadRabbit, a new strain of ransomware that's hopped out of Petya's hutch. The Lazarus Group is said to have taken control of some servers in India. DUHK [duck] warnings. Are industrial control system operators paying sufficient attention to Level 1 and Level 0 threats? Next May will see not only GDPR, but also NIS. Joe Carrigan from JHU reviews a list of security tips suggested by IBM. Guest is Scott Kaine, CEO of Delta Risk on cloud migration security issues.And Kapersky continues to protest its innocence of spying, and offers an explanation of what really happened with NSA leaks.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Reaper botnet update, Election hacking in Kenya, Czech Republic. M&A notes. APT28's phishing. Kaspersky's offer of code review. FBI shots in the crypto wars. Oct 24, 2017

Show notes

In today's podcast, we learn that Hurricane Reaper, the big IoT botnet, remains a digital tropical depression, but plenty of people are warning everyone to stock up on the cyber equivalents of flashlight batteries and bottled water. Czech parliament sites hacked in apparent election-related mischief. Kenya's contentious re-vote approaches. APT28 gets a Bronx cheer for lame CyCon phishing, but don't get cocky, kid. KnowBe4 and Cisco announce acquisitions. Kaspersky seeks to undo reputational damage inflicted by US Government ban. The FBI re-engages in the crypto wars. David DuFour from Webroot on phishing trends. Phil Neray from CyberX reviewing their Global ICS & IIoT Risk Report. If you had a nose job at London Bridge Plastic Surgery, someone's got your before and after pix.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Reaper botnet looming, but not yet landed. CyCon phishing. How to troll for influence. Oct 23, 2017

Show notes

In today's podcast, we share some notes on active malware campaigns, and a warning to be on the lookout for the Reaper botnet, which hasn't yet realized its disruptive potential. Kaspersky opens its source code to independent review, to show it's got nothing to hide. Fancy Bear is phishing for you if you plan to attend CyCon. The difficulty of recognizing trolls, and the dangers of innocent posts getting badly lost in translation. A quick note about the ICS Security Conference. Dale Drew from Level 3 Communications on managing the security of the supply chain. And looking for lulz in all the wrong places.

Learn more about your ad choices. Visit megaphone.fm/adchoices

WireX BotNet with Justin Paine from Cloudflare. [Research Saturday] Oct 21, 2017

Show notes

In August 2017, multiple Content Delivery Networks (CDNs) and content providers were subject to significant attacks from a botnet dubbed WireX. (The botnet is named for an anagram for one of the delimiter strings in its command and control protocol.) The WireX botnet is primarily made up of Android devices running malicious applications and is designed to create DDoS traffic. The botnet is sometimes associated with ransom notes to targets.

Justin Paine is Head of Trust and Safety at Cloudflare, and he joins us to share the WireX story.

https://blog.cloudflare.com/the-wirex-botnet/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected