CyberWire Daily

Latest Episodes:

Robert Lee: Keeping the lights on. [ICS] [Career Notes] Aug 18, 2024

Show notes

Enjoy this special encore with CEO and co-founder of Dragos Robert Lee, as he talks about how he came to cybersecurity through industrial control systems. Growing up with parents in the Air Force, Robert's father tried to steer him away from military service. Still Rob chose to attend the Air Force Academy where he had greater exposure to computers through ICS. Robert finds his interest lies in things that impact the physical world around us. In his work, Dragos focuses on identifying what people are doing bad and helping people understand how to defend against that. Rob describes the possibility of making a jump to control system security from another area recommending you bring something to the table. Rob talks about the world he would like to leave to his son and his hopes for the future. We thank Rob for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Essential tools with critical security challenges. [Research Saturday] Aug 17, 2024

Show notes

Snir Ben Shimol from ZEST Security on their work, "How we hacked a cloud production environment by exploiting Terraform providers." In this blog, ZEST discusses the security risks associated with Terraform providers, particularly those from community sources.

The research highlights the importance of carefully vetting providers, regular scanning, and following best practices like version pinning to mitigate potential vulnerabilities in cloud infrastructure management.

The research can be found here:

The hidden risks of Terraform providers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Demo-lition derby: iVerify and Google clash over pixel app pitfalls. Aug 16, 2024

Show notes

Google and iVerify clash over the security implications of an Android app. CISA has issued a warning about a critical vulnerability in SolarWinds Web Help Desk. Ransomware attacks targeting industrial sectors surge. Microsoft is rolling out mandatory MFA for Azure. Banshee Stealer is a new macOS-targeted malware developed by Russian threat actors. A popular flight tracking website exposes users’ personal and professional information. San Francisco goes after websites generating deepfake nudes. Daniel Blackford, Director of Threat Research at Proofpoint, joins us to discuss emerging tactics used by threat actors and trends in e-crime tied to nation states. Scammers Use Google to Scam Google.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Daniel Blackford, Director of Threat Research at Proofpoint, joined us while he was out at Black Hat to discuss emerging tactics used by threat actors and trends in e-crime tied to nation states.

Selected Reading

Google to remove app from Pixel devices following claims that it made phones vulnerable (The Record)

Nearly All Google Pixel Phones Exposed by Unpatched Flaw in Hidden Android App (WIRED)

SolarWinds Web Help Desk Vulnerability Possibly Exploited as Zero-Day (SecurityWeek)

Microsoft Mandates MFA for All Azure Sign-Ins (Infosecurity Magazine)

New Banshee Stealer macOS Malware Priced at $3,000 Per Month (SecurityWeek)

Dragos reports resurgence of ransomware attacks on industrial sectors, raising likelihood of targeting OT networks (Industrial Cyber)

CISA Releases Eleven Industrial Control Systems Advisories (CISA)

FlightAware Exposed Pilots’ and Users’ Info (404 Media)

AI-powered ‘undressing’ websites are getting sued (The Verge)

Dozens of Google products targeted by scammers via malicious search ads (Malwarebytes)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Weeding out 'worms' for Window's users. Aug 15, 2024

Show notes

Microsoft urges users to patch a critical TCP/IP remote code execution vulnerability. Texas sues GM over the privacy of location and driving data. Google says Iran’s APT42 is responsible for recent phishing attacks targeting presidential campaigns. Doppelgänger struggles to sustain its operations. Sophos X-Ops examines the Mad Liberator extortion gang. Fortra researchers document a potential Blue Screen of Death vulnerability on Windows. China’s Green Cicada Network creates over 5,000 AI-controlled inauthentic X(Twitter) accounts. Kim Dotcom is being extradited to the United States. Our guest is Rui Ribeiro, CEO at JScrambler, to discuss how the extensive use of first and third-party JavaScript is a blessing and a curse. Wireless shifting can really grind your gears.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today’s guest Rui Ribeiro, JScrambler's CEO, joins us to discuss how the extensive use of first and third-party JavaScript is both a blessing and a curse.

Selected Reading

Zero-click Windows TCP/IP RCE impacts all systems with IPv6 enabled, patch now (Bleeping Computer)

Texas sues General Motors over car data tracking (POLITICO)

Google: Iranian Group APT42 Behind Trump, Biden Hack Attempts (Security Boulevard)

Doppelgänger operation rushes to secure itself amid ongoing detections, German agency says (The Record)

Palo Alto Networks Patches Unauthenticated Command Execution Flaw in Cortex XSOAR (SecurityWeek)

A new extortion crew, Mad Liberator, emerges on the scene (The Register)

Beware, Windows users. Newly-spotted CVE-2024-6768 vulnerability can cause blue screen (MSPoweruser)

CyberCX Unmasks China-linked AI Disinformation Capability on X (Cyber CX)

Kim Dotcom is being Megauploaded to the US for trial (The Verge)

Want to Win a Bike Race? Hack Your Rival’s Wireless Shifters (WIRED)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A health bot’s security slip-up. Aug 14, 2024

Show notes

Researchers at Tenable uncovered severe vulnerabilities in Microsoft’s Azure Health Bot Service. Scammers use deepfakes on Facebook and Instagram. Foreign influence operations target the Harris presidential campaign. An Idaho not-for-profit healthcare provider discloses a data breach. Research reveals a troubling trend of delayed and non-disclosure of ransomware attacks by organizations. Patch Tuesday roundup. Palo Alto Networks’ Unit 42 revealed a significant security risk in open-source GitHub projects. Enzo Biochem will pay $4.5 million to settle charges of inadequate security protocols. Our guest is Stephanie Schneider, Cyber Threat Intelligence Analyst at LastPass, joins us to discuss the ongoing Snowflake account attacks driven by exposed legitimate credentials. Mining for profits on Airbnb.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Guest Stephanie Schneider, Cyber Threat Intelligence Analyst at LastPass, joins us to discuss the ongoing Snowflake account attacks driven by exposed legitimate credentials and how enterprises can boost their defenses against these types of attacks.

Selected Reading

Critical Vulnerability Found in Microsoft’s AI Healthcare Chatbot (Infosecurity Magazine)

UK Prime Minister Keir Starmer and Prince William deepfaked in investment scam campaign (Bitdefender)

FBI told Harris campaign it was target of 'foreign actor influence operation,' official says (Reuters)

3AM ransomware stole data of 464,000 Kootenai Health patients (Bleeping Computer)

Report reveals lag in disclosure of ransomware attacks in 2023 (Security Brief)

Fortinet, Zoom Patch Multiple Vulnerabilities (SecurityWeek)

Chipmaker Patch Tuesday: Intel, AMD Address Over 110 Vulnerabilities

Adobe Patches 72 Security Vulnerabilities Across Multiple Products (Cyber Security News)

Microsoft Fixes Nine Zero-Days on Patch Tuesday (Infosecurity Magazine)

ICS Patch Tuesday: Advisories Released by Siemens, Schneider, Rockwell, Aveva (SecurityWeek)

Are your GitHub Action artifacts leaking tokens? (SC Magazine)

Enzo Biochem to pay $4.5 mln over cyberattack, NY attorney general says (Reuters)

Airbnb host adds ‘no crypto mining’ rule after tenant installs 10 rigs (Protos)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

From dispossessor to disposed. Aug 13, 2024

Show notes

The FBI is the repossessor of Dispossessor. The NCA collars and extradites a notorious cybercriminal. A German company loses sixty million dollars to business email compromise. DeathGrip is a new Ransomware-as-a-Service (RaaS) platform. Russia blocks access to Signal. NIST publishes post-quantum cryptography standards. DARPA awards $14 million to teams competing in the AI Cyber Challenge. On our Solution Spotlight, N2K President Simone Petrella talks with Lee Parrish, CISO of Newell Brands, about his book "The Shortest Hour: An Applied Approach to Boardroom Governance of Cyber Security". AI generates impossible code - for knitters and crocheters.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Solution Spotlight, N2K President Simone Petrella talks with Lee Parrish, CISO of Newell Brands, about his book "The Shortest Hour: An Applied Approach to Boardroom Governance of Cyber Security" and security relationship management. Coming tomorrow, stay tuned for a special edition with Simone and Lee’s full conversation.

Selected Reading

FBI strikes down rumored LockBit reboot (CSO Online)

Suspected head of prolific cybercrime groups arrested and extradited (National Crime Agency)

Orion SA says scammers conned company out of $60 million (The Register)

DeathGrip Ransomware Expanding Services Using RaaS Service (GB Hackers)

Swiss manufacturer investigating ransomware attack that shut down IT network (The Record)

Russia Blocks Signal Messaging App as Authorities Tighten Control Over Information (SecurityWeek)

Post-Quantum Cryptography Standards Officially Announced by NIST – a History and Explanation (SecurityWeek)

Need to know: NIST finalizes post-quantum encryption standards essential for cybersecurity (N2K CyberWire)

NIST Releases First 3 Finalized Post-Quantum Encryption Standards (NIST)

DARPA Awards $14m to Seven Teams in AI Cyber Challenge (Infosecurity Magazine)

The AI scams infiltrating the knitting and crochet world - and why it matters for everyone (ZDNET)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Solution Spotlight: Simone Petrella talking with Lee Parrish, CISO of Newell Brands, about his book and security relationship management. [Special Edition] Aug 13, 2024

Show notes

On this Solution Spotlight, guest Lee Parrish, author and CISO at Newell Brands, joins N2K President Simone Petrella to discuss his book "The Shortest Hour: An Applied Approach to Boardroom Governance of Cyber Security" and security relationship management.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Confidential or compromised? Aug 12, 2024

Show notes

The Trump campaign claims its email systems were breached by Iranian hackers. A Nashville man is arrested as part of an alleged North Korean IT worker hiring scam. At Defcon, researchers reveal significant vulnerabilities in Google’s Quick Share. Ransomware attacks hit an Australian gold mining company as well as multiple U.S. local governments. GPS spoofing is a matter of time. Cisco readies another round of layoffs. Nearly 2.7 billion records of personal information for people in the United States have been shared on a hacking forum. Our own Rick Howard speaks with Mark Ryland, Director of Amazon Security, about formal verification. A hacker hacks the hackers.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s guest slot, N2K’s CSO Rick Howard speaks with Mark Ryland, Director of Amazon Security at AWS, about formal verification, which is logical proofs about correctness of systems, at AWS re:Inforce. Rick and Mark caught up at AWS re:Inforce 2024.

Selected Reading

Experts warn of election disruptions after Trump says campaign was hacked (Washington Post)

Nashville man arrested for running “laptop farm” to get jobs for North Koreans (Ars Technica)

Google Patches Critical Vulnerabilities in Quick Share After Researchers' Warning (Hackread)

Australian gold mining company Evolution Mining announces ransomware attack (The Record)

GPS spoofers 'hack time' on commercial airlines, researchers say (Reuters)

Exclusive: Cisco to lay off thousands more in second job cut this year (Reuters)

Hackers leak 2.7 billion data records with Social Security numbers (Bleeping Computer)

Local gov’ts in Texas, Florida hit with ransomware as cyber leaders question best path forward (The Record)

Simple Coding Errors Lead to Major Ransomware Takedown (Cybersecurity News)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

What does materiality mean exactly? Aug 12, 2024

Show notes

Rick Howard, N2K CyberWire’s Chief Analyst and Senior Fellow, discusses the meaning of cybersecurity materiality.

References:

Amy Howe, 2024. Supreme Court strikes down Chevron, curtailing power of federal agencies [Blog]

Cydney Posner, 2023. SEC Adopts Final Rules on Cybersecurity Disclosure [Explainer]. The Harvard Law School Forum on Corporate Governance.

Cynthia Brumfield, 2022. 5 years after NotPetya: Lessons learned Analysis]. CSO Online.

Eleanor Dallaway, 2023. Closed for Business: The Organisations That Suffered Fatal Cyber Attacks that Shut Their Doors For Good [News]. Assured.

Gary Cohen, 2021. Throwback Attack: Chinese hackers steal plans for the F-35 fighter in a supply chain heist [Explainer]. Industrial Cybersecurity Pulse.

James Pearson, 2022. Russia downed satellite internet in Ukraine [News]. Reuters.

Katz, D., 2021. Corporate Governance Update: “Materiality” in America and Abroad [Essay]. The Harvard Law School Forum on Corporate Governance.

Kim Zetter, 2014. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon [Cybersecurity Canon Hall of Fame Book]. Goodreads.

Lizárraga, C.J., 2023. Improving the Quality of Cybersecurity Risk Management Disclosures [Essay]. U.S. Securities and Exchange Commission.

MATTHEW DALY, 2024. Supreme Court Chevron decision: What it means for federal regulations [WWW Document]. AP News.

Rick Howard. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon [Book Review]. Cybersecurity Canon Project.

Rick Howard, 2021. Using cyber sand tables to study the DNC hack of 2016. [Podcast]. The CyberWire.

Rick Howard, 2022. Cyber sand table series: OPM. [Podcast and Essay]. The CyberWire.

Staff, 2020. Qasem Soleimani: US strike on Iran general was unlawful, UN expert says [Explainer]. BBC News.

Staff, 2023. Final Rule: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure [Government Guidance]. U.S. Securities and Exchange Commission.

Staff, 2024. Number of Public Companies v. Private: U.S. [Website]. Advisorpedia.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Andrea Little Limbago: Look at the intersection of the of humans and technology. [Social Science] Aug 11, 2024

Show notes

Enjoy this special encore episode:

Computational Social Scientist Andrea Little Limbago shares her journey as a social scientist in cybersecurity. Andrea laments that she wishes she'd known there is no straight line between what you think you want to do and then where you end up going. Beginning her career in international relations and courted by the Department of Defense's Joint Warfare Analysis Center while teaching at New York University, Andrea began her work in cybersecurity. Her team was one of the first to start thinking about the intersection of cybersecurity and geopolitics and quantitative modeling. Andrea reminds us there are many paths and skills needed in cybersecurity and hopes she's opened some doors for others. We thank Andrea for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices