CyberWire Daily

Latest Episodes:

Daily: Who is Boson Spider? Legit zero-days among Shadow Brokers' leaks. Aug 18, 2016

Show notes

In today's podcast we hear more about the Shadow Brokers, who are confirmed to have dropped some genuine zero-days. Most observers now think there was a compromise at NSA; some suspect Russian intelligence services. North Korea is again scrutinized for SWIFT fraud. Operation Ghoul targets industrial intellectual property in thirty countries. We see continued industry churn (including some layoffs as well as M&A rumors). CrowdStrike's Adam Meyers tells us about the Boson Spider gang, and Ben Yelin from the University of Maryland Center for Health and Homeland Security weighs in on the Shadow Brokers.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Daily: Shadow Brokers warn 'Wealthy Elite'--new cyber cold war? And cybercrooks are still out there. Aug 17, 2016

Show notes

In today's podcast we follow the continuing story of the Shadow Brokers and their claims of having got their hands on Equation Group attack code (as bizarre as their story is, a lot of informed observers think the code they've posted is the real deal). Many see the Shadow Brokers incident as an escalation of a cyber cold war between Russia and the United States. More banking Trojan activity in South America. DNSSEC is exploited in DDoS attacks, and Cerber is still number one in the ransomware-as-a-service market (where Shark is a dodgy upstart). Kensington's Rob Humphrey shares the results of their recently security survey, and Johns Hopkins University's Joe Carrigan weighs in on securing your devices in the real world. And yes, more Pokémon stuff.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Daily: All your attack code are belong us. Guccifer 2.0 suddenly more fluent. Aug 16, 2016

Show notes

In today's podcast we learn about claims made by hackers calling themselves "the Shadow Brokers." They say they've pwned the Equation Group, and obtained NSA attack code which they're now selling for one million Bitcoin. Guccifer 2.0 gets a lot more polished and even leakier. A bogus QuadRooter patch is serving malware in Google's Play Store. Fidelis tells us about Vawtrak's evolution. Someone's watching the Veracrypt audit. Iran looks into possible cyber causes of oil-and-gas facility fires. Fake Pokémon installers have trainers choosing ransomware. No more Pokéstops allowed in Germany's Flughafen. Vikram Sharma from Quintessence Labs outlines the challenges and opportunities of combining cutting edge science with market realities. Hardik Modi from Fidelis Cybersecurity expains changes they're tracking in the Vawtrak banking trojan. And British lawyers get a license to hunt hackers.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Daily: Cryptocoin for DDoS? ISIS info ops more murderous as territory shrinks. Aug 15, 2016

Show notes

In today's podcast we learn that Russian hackers went after Republicans as well as Democrats. An anti-doping whistleblower's account is illegally compromised. ISIS turns to online inspiration to recover jihadist mindshare. The MICROS point-of-sale system hack appears to underlie widespread credit card compromises. Secure Boot's "golden key" exposure is seen as a warning against backdoors. Security industry M &A and IPO notes. Level 3 Communications' Dale Drew tells us about machine-to-machine learning, and how it may improve security. And for some reason researchers develop a proof-of-concept for a DDoS-based cryptocurrency.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Daily & Week in Review: FBI has "high confidence" Russians hacked DNC. Olympic hacks, cyber vigilantes, criminal markets. Aug 12, 2016

Show notes

In today's podcast we learn that the US Intelligence Community discovered the DNC hack sometime last year—much earlier than its public disclosure this Spring. We hear about threats to critical infrastructure, and we follow developments in the cyber criminal markets—ransomware's getting mighty picky, if you ask us. We hear about ISIS's appeal to disaffected petty criminals. The Olympics see both cybercrime and patriotic hacktivism. Quintessence Labs' John Leiseboer discusses redundancy and replication of data, and we interview Robert M. Lee from Dragos Security about ICS SCADA security, and preparing for cyber security jobs. And, of course, we hear more about how Pokémon-GO is driving security people quite nuts.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Daily: Info ops as battlespace prep. It's hard to count Australians. Aug 11, 2016

Show notes

In today's podcast, we hear about cyber and information operations in Eastern Europe that look disturbingly like battlespace preparation. The FBI finds that the scope of the Democratic Party hacks is much greater than initially believed. The Bureau seems ready to ask for more authority to unlock devices, but opponents point to Microsoft's inadvertent leak of Secure Boot keys as an object lesson in why that's a bad idea. USENIX proofs-of-concept include Linux and car-hacking exploits. Samsung Pay is criticized as vulnerable to token skimming. Senior Law Analyst Ben Yelin outlines the FBI's request to expand the reach of National Security Letters. Deputy Director Rick Lipsey explains the mission of the ISAO Standards Organization. New ransomware features disappearing extortion emails. And how do you solve a problem like Pokémon-GO?

Learn more about your ad choices. Visit megaphone.fm/adchoices

Daily: Australia's census clogged. Iran ups its offense? Ransomware and file deletion. Aug 10, 2016

Show notes

In today’s podcast we follow developments in nation-state hacking, from Hainan to Tehran. Australia’s online census is taken offline—the Bureau of Statistics cries DDoS, but observers aren’t so sure. A new strain of ransomware under development in the underworld skips encryption and goes straight for deletion. Issues with Oracle’s MICROS point-of-sale systems may be the root cause of recent store and hotel breaches. Google says, thanks Check Point, we appreciate it, but most of QuadRooter has already been mitigated (they’re working on the rest of it). Joe Carrigan from Johns Hopkins University warns us about side-loading Android apps, and Leemon Baird from Swirld describes a new trust-based peer to peer software platform. And we note that yesterday was Patch Tuesday.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Daily: A look back at Vegas. Rio's rogue Wi-Fi. Cyberwar & actual war. Aug 09, 2016

Show notes

In today’s podcast we look at an APT group that’s been active since 2011. We hear about the Quadrooter Android vulnerability. We take a look back at Black Hat, and look for some sensible perspective on cyber risk. We also read some discussion of the differences between espionage, crime, and warfare. The US Marshalls will auction SilkRoad’s forfeited Bitcoin later this month. Dr. Charles Clancy from Virginia Tech's Hume Center tell us what to expect from 5G cellular technology. And yes, there’s more Pokémon-themed malware in the Play Store.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Black Hat, Part 2 - Trends and Insights from Industry Leaders [Special Edition] Aug 09, 2016

Show notes

The 2016 Black Hat conference is in the books, and we wrap up our coverage with more insights from industry leaders on what trends they’re seeing, and where they think the industry is headed.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Daily: DARPA CTF: Mayhem (win), Xandra (place), Mechphish (show). Blame it on Rio. Aug 08, 2016

Show notes

In today’s podcast we hear about Bifinex’s recovery from its recent heist and the possibly temporary haircut its depositors got. We also follow the related Ethereum hard fork. News on Olympic hacks and risks of hacking from Booz Allen Hamilton's Brad Medairy and Grey Burkhart. Trustwave reports home smart thermostat bugs. Checkpoint discloses Qualcomm Android Quadrooter firmware vulnerabilities. More signs that Fancy Bear was prancing through the DNC. A look back at Black Hat, and notes on DARPA’s AI capture-the-flag challenge. Jonathan Katz explains the Etherium fork.

Learn more about your ad choices. Visit megaphone.fm/adchoices