CyberWire Daily

Latest Episodes:

Infrastructure hacking. No Russo-American agreement in cyberspace. Android malware infestations. Misspelling as OPSEC Jul 10, 2017

Show notes

In today's podcast we discuss some answers to two Russian claims. No, Russia and America won't be linking up in a cyber alliance. And no, no one at the G20 meetings actually bought the line about election hacking retailed there by President Putin and Foreign Minister Lavrov. NotPetya recovery continues. Android infestations in the wild. US power plants warned to be alert for cyberattack. Criminals compromise self-service food kiosks; others phish with official-looking Australian emails as bait. Ben Yelin from UMD CHHS reviews license plate reader laws. ISIS adopts misspelling as a form of OPSEC.

Learn more about your ad choices. Visit megaphone.fm/adchoices

NotPetya still looks like an act of state; intended result or not, companies warn of possible material effect from the attack. Another S3 database found exposed. Jul 07, 2017

Show notes

In today's podcast, we hear that NotPetya still looks like a Russian campaign to Ukrainian authorities, and experts remain skeptical that affected data can be recovered. Companies warn that NotPetya may have a material effect on earnings. WikiLeaks dumps Gyrfalcon and BothanSpy documents from Vault7. Johannes Ulrich from SANS and the ISC Stormcast Podcast on no SQL database security. Andy Greenberg, senior writer at WIRED, on his July 2017 issue cover story on Ukraine cyberwar. And pro wrestling fans now have something in common with registered voters, data.gov.uk, and the National Geospatial Agency.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ukraine says it blocked a second wave of NotPetya attacks. Notes on hybrid warfare and the challenges of sharing data. Will the EU get a right to repair? Jul 06, 2017

Show notes

In today's podcast we hear about the Ukrainian police raid on Intellect Service and their seizure of M.E. Doc servers. Ukraine's Interior Ministry says this stopped a second wave of NotPetya. Affected companies continue to recover from the NotPetya infestation. US Cyber Command prepares to parry hybrid warfare. Spyware campaign hits Chinese-language news services. The EU considers adopting a "right to repair." Joe Carrigan from the Johns Hopkins University ponders always-on cameras. Dan Larson from CrowdStrike on fileless attacks. Medical information-sharing runs into problems in the UK.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Recovering from NotPetya. State-actor seen behind wiper attack. Ukraine mulls criminal negligence charges. Documents behind US Congressional wariness of Kaspersky. Jul 05, 2017

Show notes

In today's podcast, we hear how affected enterprises are restoring services after last week's NotPetya pandemic. Maersk's experience prompts some introspection in the logistics sector. Ukraine prepares to charge ME Doc's maker with criminal negligence for allowing the infection to take hold. NotPetya tied to BlackEnergy and thence to a "state actor" (NATO's not saying it's Russia, but Ukraine is). Awais Rashid from Lancaster University looks at the anatomy of recent attacks. Haiyan Song from Splunk on a recent IDC report, “Investigation or Exasperation? The State of Security Operations.” FSB certificates allegedly express links between FSB and Kaspersky.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Recovery and attribution: Petya/Nyetya/NotPetya. Cyber conflict and collective defense. Online inspiration and online censorship. The EU's regulatory big stick. Vishing Parliament. Jul 03, 2017

Show notes

In today's podcast, we hear that recovery from Petya/Nyetya/NotPetya proceeds—and it's not ransomware. Ukraine says Russia's responsible. US warnings of cyberattacks on nuclear power plants may have been premature. NATO members consider when to invoke Article 5 in cyberspace. Islamist inspiration and other political discontents continue to prompt content screening in Europe. Europe is also in punitive mood with respect to regulation. Kaspersky says it will show the US its source code if that's the cost of doing business. Markus Rauschecker from UMD CHHS describes a novel use of kidnapping insurance. And, hey, Lords and Commons: that's not really Windows support asking for your password.

Learn more about your ad choices. Visit megaphone.fm/adchoices

What's up with Petya/Nyetya/NotPetya? It's a wiper—the extortion is just misdirection. WikiLeaks dumps "OutlawCountry" from Vault7. The ShadowBrokers raise prices. Russia says boo to cybercrime. Jun 30, 2017

Show notes

In today's podcast we hear that Petya/Nyetya/NotPetya is almost certainly a wiper, and not ransomware after all. Ukraine blames Russia, but whoever did it had EternalBlue before the ShadowBrokers leaked it. WikiLeaks Vault7 disgorges OutlawCountry, a Linux attack tool. The ShadowBrokers raise their rates. Emily Wilson from Terbium Labs with research on fraud guides on the dark web. Guests are Drew Gidwani, Director of Analytics at ThreatConnect, and Andy Pendergast, VP of Product & Co-Founder at ThreatConnect, speaking about the findings of a recent SANS Survey on Security Optimization. Russia calls for international cooperation to stamp out cybercrime.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ransomware, nyet; wiper, da. Shipping, manufacturing, and Big Law may share some common risks. WikiLeaks and the ShadowBrokers are back again. Jun 29, 2017

Show notes

In today's podcast we hear that the current Petya/Nyetya/NotPetya outbreak down deep doesn't look like ransomware, but a wiper, and a nasty one at that—probably a cyber warfare campaign. How are these three things alike: shipping, manufacturing, and Big Law? The ShadowBrokers are back, and WikiLeaks' Vault7 disgorges what looks like a creepy stalking tool. Other non-Petya ransomware attacks. Rick Howard from Palo Alto Networks explains the importance of capture-the-flag competitions. And officialdom seems to cling bitterly to Windows XP.

Learn more about your ad choices. Visit megaphone.fm/adchoices

IoT 2017 – Securing the Things: A CyberWire Special Edition [Special Edition] Jun 29, 2017

Show notes

The IoT, or Internet of Things, broadly defined is the collection of physical objects with IP addresses, connected to the internet. From consumer devices like security cameras, DVRs, and smart thermostats to industrial control systems and autonomous cars, the IoT offers potential for both opportunity and vulnerability.

In the first half of this CyberWire Special Edition, we speak with IoT experts Katie Curtin, director of IoT cyber security product management for AT&T, and Chris Poulin, Principal at Booz Allen Hamilton, where he leads internet of things security strategy for their strategic innovation group, as well as their industrial control group.

They provide their take on the current state of the internet of things for consumers, enterprise, industrial control and even self-driving cars.

In the second part of our program, we examine third party risk. Ponemon Institute recently released an independent research report titled, “The Internet of Things - a New Era of Third Party Risk.” Dr. Larry Ponemon is the chairman and founder of Ponemon Institute, and he’s going to take us through some of the report’s findings, but first we’ll hear from Gary Roboff, a senior advisor at Shared Assessments and their Santa Fey group, who were the sponsors of the report.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Petya/PetrWrap/Goldeneye updates. Jun 28, 2017

Show notes

Today we speak at length with Tanium's Chief Security Architect on tracking the Petya ransomware pandemic.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Petya goes WannaCry one better. Westminster email hack. ISIS in Maryland and Ohio websites. Jun 27, 2017

Show notes

In today's podcast we hear that another ransomware pandemic has broken out—this one looks more sophisticated and dangerous than WannaCry. Ukraine is again the center, but it's moving out fast. Notes on the Parliament email hack in the UK. Accenture's Justin Harvey explains destructive malware. IBM's David Jarvis advocates an adoption of a "new collar" recruiting strategy. And ISIS isn't doing much cyber damage, but its hacktivist sympathizers are really tugging on Superman's cape.

Learn more about your ad choices. Visit megaphone.fm/adchoices