CyberWire Daily

Latest Episodes:

Operation Magnus strikes back. Oct 28, 2024

Show notes

Operation Magnus disrupts notorious infostealers. Pennsylvania officials debunk election disinformation attributed to Russia. TeamTNT targets Docker daemons. Delta sues CrowdStrike. NVIDIA released a critical GPU Display Driver update. Fog and Akira ransomware exploit SonicWall VPNs. A researcher demonstrates Downgrade attacks against Windows systems. Qilin ransomware grows more evasive and disruptive. Pwn2Own Ireland awards over $1 million for more than 70 zero-day vulnerabilities. Our guest is Grant Geyer, Chief Strategy Officer at Claroty, talking about safeguarding our nation's critical food infrastructure. At long last, it’s legal to fix your McFlurry.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Our guest is Grant Geyer, Chief Strategy Officer at Claroty, talking about safeguarding our nation's critical food infrastructure. The FBI recently held an Agriculture Threats Symposium in Nebraska, spotlighting growing concerns over the security of the nation's critical food infrastructure amid rising threats. As cyberattacks and bioterrorism increasingly target agriculture, the event highlighted urgent calls for stronger safety measures to protect the food supply chain.

Selected Reading

Operation Magnus Disrupted Redline and Meta Infostealer Malware (Cyber Security News)

Pennsylvania officials rebut false voter fraud claims from home and abroad (CyberScoop)

TeamTNT Exploits 16 Million IPs in Malware Attack on Docker Clusters (Hackread)

Delta sues CrowdStrike for $500 million in damages caused by massive airline cancelations (The Independent)

NVIDIA GPU Vulnerabilities Allow Attackers To Execute Remote Code on Windows & Linux (Cyber Security News)

Fog ransomware targets SonicWall VPNs to breach corporate networks (Bleeping Computer)

New Windows Driver Signature bypass allows kernel rootkit installs (Bleeping Computer)

Updated Qilin Ransomware Escalates Encryption and Evasion (BankInfo Security)

Researchers Discover Over 70 Zero-Day Bugs at Pwn2Own Ireland (Infosecurity Magazine)

It Is Now Legal to Hack McFlurry Machines (and Medical Devices) to Fix Them (404 Media)

DisMis: Explore our 3-part series on election propaganda. (N2K)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Mission possible? Navigating tech adoption in the DoD. [Special Edition] Oct 27, 2024

Show notes

In this episode, N2K's Brandon Karpf interviews Pete Newell, CEO and Founder of BMNT, about the challenges facing technology adoption within the Department of Defense (DoD). They discuss the concept of “mission acceleration,” focusing on the DoD’s struggle to keep pace with rapid changes on the battlefield and the importance of a human-centered approach to technology adaptation. Newell emphasizes that true innovation in defense is more of a "people problem" than a technology issue, requiring shifts in organizational culture and internal education. Tune in to hear insights on accelerating change in defense through better problem articulation and training.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Stephen Hamilton: Getting the mission to the next level. [Military] [Career Notes] Oct 27, 2024

Show notes

Enjoy this special encore episode where we are joined by Army Cyber Institute Technical Director and Chief of Staff Colonel Stephen Hamilton, as he takes us on his computer science journey. Fascinated with computers since the second grade, Stephen chose West Point after high school to study computer science. Following graduation he moved into the signal branch as it most closely matched his interest in ham radio as no branch related directly to computing. He was pulled from the motor pool to help with another area's computing needs and then worked his way to teaching computer science at. West Point and US Cyber Command. Stephen recommends coding it first to help realize the nuances, and then code it again. We thank Stephen for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

LLM security 101. [Research Saturday] Oct 26, 2024

Show notes

This week, we are pleased to be joined by Mick Baccio, global security advisor for Splunk SURGe, sharing their research on "LLM Security: Splunk & OWASP Top 10 for LLM-based Applications." The research dives into the rapid rise of AI and Large Language Models (LLMs) that initially seem magical, but behind the scenes, they are sophisticated systems built by humans. Despite their impressive capabilities, these systems are vulnerable to numerous cyber threats.

Splunk's research explores the OWASP Top 10 for LLM Applications, a framework that highlights key vulnerabilities such as prompt injection, training data poisoning, and sensitive information disclosure.

The research can be found here:

LLM Security: Splunk & OWASP Top 10 for LLM-based Applications

Learn more about your ad choices. Visit megaphone.fm/adchoices

UnitedHealth breach numbers confirmed. Oct 25, 2024

Show notes

UnitedHealth confirms breach numbers. Patient privacy pains. Amazon vs. APT29. CDK vulnerability threatens user security. Fog and Akira take aim at SonicWall. Level up or log off. LinkedIn in hot water. Open source, closed doors. Watt's the risk? Today, we are joined by Itzik Alvas, Entro Security’s CEO and Co-Founder, discussing their research team's work on non-human identities and secrets management. And Muni Metro hits Ctrl+Alt+Delete on floppy disks!

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today, we are joined by Itzik Alvas, Entro Security’s CEO and Co-Founder, discussing their research team's work on non-human identities and secrets management. You can learn more here.

Selected Reading

UnitedHealth: 100 Million Individuals Affected by the Change Healthcare Data Breach (Heimdal)

OnePoint Patient Care data breach impacted 795916 individuals (Security Affairs)

Amazon identified internet domains abused by APT29 (AWS Security Blog)

RDP configuration files as a means of obtaining remote access to a computer or "Rogue RDP" (CERT-UA#11690) (CERT-UA)

AWS Cloud Development Kit flaw exposed accounts to full takeover (The Register)

Arctic Wolf Labs Observes Increased Fog and Akira Ransomware Activity Linked to SonicWall SSL VPN (Arctic Wolf)

Lazarus Group Exploits Chrome 0-Day for Crypto with Fake NFT Game (Hackread)

LinkedIn hit with $335 million fine for using member data for ad targeting without consent (The Record)

Linux creator approves de-listing of several kernel maintainers associated with Russia (The Record)

U.S. CISA adds Cisco ASA and FTD, and RoundCube Webmail bugs to its Known Exploited Vulnerabilities catalog (Security Affairs)

Cybersecurity Isn't Easy When You're Trying to Be Green (Dark Reading)

Goodbye, floppies - San Francisco pays Hitachi $212 million to remove 5.25-inch disks from its light rail service (TechSpot)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A giant FortiJump for cybercriminals. Oct 24, 2024

Show notes

Fortinet confirms a recently rumored zero-day. Officials investigate how restricted chips ended up in products from Huawei. The White House unveils a coordinated AI strategy for national security. Researchers jailbreak LLMs with Deceptive Delight. A new ransomware group exploits vulnerable device drivers. Sensitive documents from a UN trust fund are leaked online. Penn State pays over a millions dollars to settle allegations of inadequate security in government contracts. CISA adds a SharePoint vulnerability to its Known Exploited Vulnerabilities Catalog. A Microsoft report warns of growing election disinformation. On our industry voices segment, Eric Herzog, CMO of Infinidat, discusses merging cybersecurity and cyber storage resilience. China is shocked - shocked! - that its space program has drawn the attention of foreign spies.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our industry voices segment, Eric Herzog, CMO of Infinidat, discusses merging cybersecurity and cyber storage resilience.

Selected Reading

Mandiant says new Fortinet flaw has been exploited since June (Bleeping Computer)

TSMC Cuts Off Client After Discovering Chips Sent to Huawei (Bloomberg)

White House unveils plan for US government to keep its edge on AI development (The Record)

FACT SHEET: Biden-Harris Administration Outlines Coordinated Approach to Harness Power of AI for U.S. National Security (The White House)

New LLM jailbreak method with 65% success rate developed by researchers (SC Media)

Embargo Ransomware Disables Security Defenses (GovInfo Security)

Misconfigured UN Database Exposes 228GB of Gender Violence Victims' Data (Hackread)

Penn State Settles for $1.25M Over Failure to Comply With DoD, NASA Cybersecurity Requirements (SecurityWeek)

CISA Warns Active Exploitation of Microsoft SharePoint Vulnerability (Cyber Security News)

As Election Looms, Disinformation ‘Has Never Been Worse’ (The New York Times)

Microsoft Warns Foreign Disinformation Is Hitting the US Election From All Directions (WIRED)

China’s space programme targeted by ‘audacity’ of foreign agents, anti-spy agency warns (South China Morning Post)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

NotLockBit takes a bite out of macOS. Oct 23, 2024

Show notes

NotLockBit mimics its namesake while targeting macOS. Symantec uncovers popular mobile apps with hardcoded credentials. Avast releases a Mallox ransomware decryptor. Akira ransomware reverts to tactics tried and true. Lawmakers ask the DOJ to prosecute tax prep firms for privacy violations. The SEC levies fines for misleading disclosures following the SolarWinds breach. Software liability remains a sticky issue. Updated guidance reiterates the feds’ commitment to the Traffic Light Protocol. A task force has cybersecurity recommendations for the next U.S. president. Today’s guest is Jérôme Segura, Sr. Director of Research at Malwarebytes, sharing their work on "Scammers advertise fake AppleCare+ service via GitHub repos." Warrantless surveillance, powered by your favorite apps.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today’s guest is Jérôme Segura, Sr. Director of Research at Malwarebytes, sharing their work on "Scammers advertise fake AppleCare+ service via GitHub repos." You can learn more about this research here.

Selected Reading

NotLockBit Ransomware Can Target macOS Devices (SecurityWeek)

Millions of iOS and Android Users at Risk as Popular Apps Expose Cloud Keys (Hackread)

Mallox Ransomware Flaw Let Victims Recover Files Without Ransom Payment (Cyber Security News)

Akira ransomware pivots back to double extortion, C++ code (SC Media)

Lawmakers ask DOJ to prosecute tax prep firms for sharing customer data with big tech (The Record)

SEC fines four companies $7M for 'misleading cyber disclosures' regarding SolarWinds hack (TechCrunch)

The struggle for software liability: Inside a ‘very, very, very hard problem’ (The Record)

US Government Pledges to Cyber Threat Sharing Via TLP Protocol (Infosecurity Magazine)

Task force unveils cyber recommendations for the next president (CyberScoop)

The Global Surveillance Free-for-All in Mobile Ad Data (Krebs on Security)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Zero-day exploited in the wild. Oct 22, 2024

Show notes

A zero-day affects Samsung mobile processors. A critical vulnerability is discovered in the OneDev DevOps platform. German authorities warn against vulnerable industrial routers. The Bumblebee loader buzzes around corporate networks. Ghostpulse hides payloads in PNG files. A Michigan chain of dental centers agrees to a multimillion dollar data breach settlement. A White House proposal tamps down international data sharing. Fortinet is reportedly patching an as-yet undisclosed severe vulnerability. In our Threat Vector segment, host David Moulton speaks with Nathaniel Quist about cloud extortion operations, the rise of ransomware attacks, and the challenges businesses face in securing public cloud environments. Russian deepfakes spread election misinformation.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Threat Vector Segment

In this segment of the Threat Vector podcast, host David Moulton, Director of Thought Leadership at Palo Alto Networks, speaks with Nathaniel Quist, Manager of Cloud Threat Intelligence at Cortex & Unit 42. David and Nathaniel discuss recent cloud extortion operations, the rise of ransomware attacks, and the challenges businesses face in securing public cloud environments. You can hear the full discussion here and catch new episodes of Threat Vector every Thursday on your favorite podcast app.

Selected Reading

Google Warns of Samsung Zero-Day Exploited in the Wild (SecurityWeek)

Critical OneDev DevOps Platform Vulnerability Let Attacker Read Sensitive Data (Cyber Security News)

Critical Vulnerabilities Expose mbNET.mini, Helmholz Industrial Routers to Attacks (SecurityWeek)

Hackers Use Bumblebee Malware to Gain Access to Corporate Networks (GB Hackers)

CISA Adds Sciencelogic SL1 Unspecified Vulnerability to KEV Catalog (Cyber Security News)

Pixel perfect Ghostpulse malware loader hides inside PNG image files (The Register)

Dental Center Chain Settles Data Breach Lawsuit for $2.7M (BankInfo Security)

Biden administration proposes new rules governing data transfers to adversarial nations (The Record)

Fortinet issues private notifications to FortiManager customers to patch an undisclosed flaw (Beyond Machines)

Russian Propaganda Unit Appears to Be Behind Spread of False Tim Walz Sexual Abuse Claims (WIRED)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

On the run, caught on arrival. Oct 21, 2024

Show notes

An alleged Australian scammer wanted by the FBI gets nabbed in Italy. The Internet Archive has been breached again. Researchers discover vulnerabilities in encrypted cloud storage platforms. Cisco confirms stolen files but insists it’s not a data breach. A Chinese disinformation group targets Senator Marco Rubio. Malicious chatbot prompts can hide inside harmless ones. The DoD wants to offer senior cyber executives part-time roles as military reservists. Six years out, the specter of Spectre remains. Russian prosecutors seek prison for REvil operators. Guest Pete Newell, Founder and CEO of BMNT, talks with N2K's Brandon Karpf about challenges associated with technology adoption and change in the DoD. Microsoft uses clever deception to reel in phishers.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Guest Pete Newell, Founder and CEO of BMNT, talks with N2K's Brandon Karpf about challenges associated with technology adoption and change in the DoD.

Selected Reading

Australian wanted by FBI over alleged $46 million scam arrested in Italy (The Sydney Morning Herald)

Internet Archive breached again through stolen access tokens (Bleeping Computer)

Severe flaws in E2EE cloud storage platforms used by millions (Bleeping Computer)

Cisco Confirms Security Incident After Hacker Offers to Sell Data (SecurityWeek)

Report: China’s Spamouflage disinformation campaign testing techniques on Sen. Marco Rubio (The Record)

This Prompt Can Make an AI Chatbot Identify and Extract Personal Details From Your Chats (WIRED)

Wanted: Weekend Warriors in Tech (Wall Street Journal)

Spectre flaws continue to haunt Intel and AMD (The Register)

Russia's case against REvil hackers proceeds as government recommends 6.5-year sentences (The Record)

Microsoft creates fake Azure tenants to pull phishers into honeypots (Bleeping Computer)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Aarti Borkar: Make your own choices. [Product] [Career Notes] Oct 20, 2024

Show notes

Enjoy this special encore episode where we are joined by the Head of Product for IBM Security Aarti Borkar, who shares her journey which included going after her lifelong love of math rather than following in her parents' footsteps in the medical field. In following her passions, Aarti found herself studying computer engineering and computer science, and upon taking a pause from her studies, she found a niche working at IBM in a mix of databases and networking. In her current position, Aarti describes her favorite discussion topics very often involve being around the use of AI for converting security into predictive domains. Aarti reminds us that you should pause and see if you are on the right path. Staying on a path just because you started there can be a bad idea. And, we thank Aarti for sharing her story.

Learn more about your ad choices. Visit megaphone.fm/adchoices