CyberWire Daily

In today's podcast, we hear that SWIFT phishbait is hitting inboxes. North Korean hackers show fresh sophistication and new ambitions. Fancy Bear seems to be snuffling east. Monero miners in Word, and why cryptojacking for Bitcoin is harder than it is for other currencies. The Coldroot RAT hides in plain sight. The US Departments of Justice and Homeland Security undertake new approaches to election security. Justin Harvey from Accenture on data-centric security. Guest is Scott Totzke from ISARA on the threat to encrypted data by quantum computing. And Facebook has a new verification mode: send in a postcard. 

In today's podcast we hear that SWIFT fraud has hit an Indian lender. North Korean hacking continues, even during the DPRK's Winter Olympics charm offensive. US indicts Russian influence operators—the Internet Research Agency is the leading defendant. Russian trolling continues, exploiting the Florida school shooting. (And the alleged shooter apparently expressed his intentions online.) Rick Howard from Palo Alto Networks, on the importance of partnering with universities to improve the quantity and diversity of people coming through the STEM pipeline.  All Five Eyes see Fancy Bear behind NotPetya. 

The research we’re discussing today is called, “Beware the Hex Men”, and it tracks multiple attack campaigns conducted by a Chinese threat actor. The GuardiCore Labs team identified three attack variants that they named Hex, Hanako and Taylor, targeting SQL servers.

In today's podcast, we hear more about Olympic Destroyer: its relationship status with known threat actors is "complicated." The US joins the UK in blaming Russia for NotPetya, and seems to be considering sanctions. The US Congress considers election security, and considers a state-level option: let governors call in the National Guard. New York cyber law reaches its second milestone. Zulfikar Ramzan from RSA, discussing the hype around blockchain technology. Guest is Jack Rhysider, producer and host of the Darknet Diaries podcast.  And no, Edward Snowden has not moved in down the block and bought a two-terabyte iCloud storage plan. 

In today's podcast we hear that Olympic Destroyer may have started with a supply-chain compromise back in December. The British Foreign Office blames Russia for NotPetya pseudoransomware, and the Russian Foreign Ministry says they didn't do anything. Trend Micro researchers find a new Monero cryptomining campaign underway. Coinherder phishes in alt-coin wallets. The Satori botnet has expanded its target list. A new IoT botnet, DoubleDoor, gets into routers with a one-two punch. Ben Yelin from UMD CHHS, on New Jersey taking on the FCC and net neutrality.  Guest is Scott Register from Ixia on security issues with the coming 5G cellular rollout. And the LoopX ICO vanishes into thin air. 

In today's podcast, we hear that Olympic Destroyer exploits EternalRomance and morphs as it moves from machine to machine. Other Olympic hacks are out there, too. The US Intelligence Community tells Congress to expect a more assertive Iran, Russia, and North Korea in cyberspace. They also forecast more election influence operations. General Nakasone has been nominated to succeed Admiral Rogers at NSA and US Cyber Command. Yossi Oren from BGU on two-factor authentication for the disabled. Guest is John Kuhn from IBM X-Force Iris on the uptick in spam around the Valentine’s Day holiday.Coin mining continues to make a nuisance of itself. 

In today's podcast, we hear that Patch Tuesday will not include a Skype fix—that one will take some time and attention. Olympic Destroyer is the malware thought to be infesting the Winter Games. Attribution remains unclear, but a lot of suspicious eyes are looking at you, Mr. Putin.  The Lazarus Group is stepping up its cryptocurrency stealing game. Questions swirl around the alleged BitGrail cryptocurrency exchange losses. David Dufour from Webroot on Mac vulnerabilities. Guest is Mark Loveless from Duo security, looking at IoT personal safety devices.  And, hey—Valentine's Day is tomorrow. 

In today's podcast we hear that the the Winter Olympics report ongoing hacking. Cryptojacker hits government websites in the UK, Australia, and the US. Engineers use a research institute's supercomputer to mine Bitcoin in Sarov, Russia. The Equifax breach may be bigger and worse than hitherto believed. The Sacramento Bee deletes encrypted database rather than pay ransom. IBM patches Spectre and Meltdown. Emily Wilson from Terbium Labs offers a dark web scorecard on the 2018 Olympics and the 2018 elections, specifically addressing how matters stand in comparison with the last round of games and voting. The CIA says it was no way bilked by a proffered sale of kompromat. And bots scalp airline seats. 

IcedID is a banking trojan recently discovered and tracked by IBM's X-Force research team, targeting banks, payment card providers, mobile services providers, payroll, webmail and e-commerce sites in the U.S. 

Limor Kessem is an executive security advisor with IBM Security. She returns to Research Saturday to describe what she and her team found.

In today's podcast we hear that phishing has gotten more personal with conversation hijacking and attempts on direct deposit instructions. The Olympics have opened: do you know where your hackers are? Apple finds leaked iOS source code on Github. Cryptominers found in hospital systems. Litecoin picks up black market share. Notes on recent patches. Concerns about Russian influence operations continue as US midterm elections approach. Dale Drew from CenturyLink on victim notification. Guest is Deidre Diamond from #brainbabe. They are a nonprofit working to replace “booth babes” at trade shows with students. And are bicycle thieves going online?  

In today's podcast we hear that Operation Shadow Web has tken down the Infraud criminal carding gang. Two more Fancy Bear sightings—one in voter databases, one in Defense contractor emails. North Korea may have purchased its Flash Player zero-day from a third-party. Cryptojacking hits a European water utility. US Senate considers banning Huawei and ZTE from Federal use. Johannes Ullrich on cryptocurrency theft, and advice for protecting your virtual currency. Guest is Christopher Doman from AlienVault on their discovery of a Monero cryptocurrency miner linked to North Korea. And no, Messrs. McAfee and Musk aren't Nigerian princes, and they're not giving away Bitcoin. 

In today's podcast we hear that Dutch police have made an arrest in last week's financial sector DDoS case: it's a teenager. North Korean interest in stealing cryptocurrency remains high. Adobe patches the zero-day Pyongyang had exploited against Seoul. Hardware wallets found vulnerable to man-in-the-middle attacks. Crytpojacking trends. US regulators take a hard look at alt-coins and how they're traded. Uber says it regrets not coming clean sooner about its breach. Justin Harvey from Accenture on ransomware, to pay or not to pay. Guest is Yassir Abousselham from Okta on their 2018 Business at Work report. New trends in an old help desk scam. 

In today's podcast, we hear that the Shadow Broker exploits have now been found to be more exploitable. Cryptocurrency miners are recognized as a problem: MacUpdate sustained a brief infestation late last week, and a new Android mining campaign takes a page from Mirai's playbook. Smominru botnet rakes in $3.6 million. T-Mobile warns of SIM-hijacking. Comment period extended for NIST Special Publication 800-171. New paycard skimmer found in Pennsylvania stores. Emily Wilson from Terbium Labs on tax fraud issues. Guest is Woody Shea from Covata on S3 bucket leaks. And a tsunami false alarm on the US East Coast. 

In today's podcast, we hear that Flash Player is being exploited by DPRK's TEMP.Reaper, also known as Group 123. ISIS may have a hacker help-wanted sign out. JenX botnet update. Scareby ransomware tells victims it will shred their files if they don't pay up. The Nunes Memo remains a political Rohrschach Test. A Japanese teenager is arrested for writing cryptocurrency-stealing code. Lauri Love will not be extradited to the US. Peter Levashov is not so lucky.  Joe Carrigan from JHU responds to listener mail on passwords. And the FBI is not emailing you to say you may be entitled to compensation.  

Adware is generally considered unsophisticated, and because of its low perceived threat level it's often ignored. Researchers at the Booz Allen Dark Labs' Advanced Threat Hunt Team have recently published research describing a more advanced type of adware, using infection techniques usually attributed to nation-state actors. 

Jay Novak is a threat hunter and tech lead at Booz Allen, and he takes us through their research.

In today's podcast, we hear that the JenX botnet will conduct DDoS-for-hire, if you've got twenty bucks. South Korea's CERT warns of an Adobe Flash Player zero-day being exploited in the wild. Bitcoin's price drops below $9000, but miners and scammers are still after this and other cryptocurrencies. BeeToken's ICO is used to phish for Ethereum. ICS security reflections in the wake of the Triton/Trisis attack. The 9th Circuit rules that Twitter didn't provide material support to ISIS killers. Rob Lee from Dragos on the security of wind power systems. Guest is Dana Simberkoff from AvePoint, with a discussion on women working in privacy, and why it’s one area where we are doing well at getting and equal number of women engaged. And the Nunes Memo is out, declassified and unredacted. 

In today's podcast, we hear that ISIS inspiration is increasingly directed at children. Cryptomining botnets use same EternalBlue exploit as WannaCry. Criminals experiment to weaponize Spectre and Meltdown vulnerabilities. Phishing campaigns exploit well-known services including Google Docs and Outlook. Patch notes. Ben Yelin from UMD CHHS on the National Association of Insurance Commissioners adopting a model data cyber security law. Guest is Shashi Kiran from Quali on cyber ranges and cloud sandboxes. Geolocation and other app-collected info raise OPSEC concerns. 

In today's podcast we hear about a possible Charming Kitten sighting. Phishing in Tibet shows just how successful cheap skid labor can be. Cisco patches a serious flaw in VPN products. Fitness app Strava says it will work to close privacy holes. Experts say you're just a tap away from giving yourself away, and it's not just Strava, not by a long shot. South Korea considers how cryptocurrency might be regulated. The US SEC shuts down an allegedly fraudulent ICO. Yossi Oren from BGU on insecure mobile device cases. Guest is JT Keating from Zimperium on the effects of Meltdown and Spectre on mobile devices. And what do you call an ICO that steals the price of a cheap seat? 

In today's podcast we hear that the Dutch financial sector is well on its way to recovering from the recent DDoS wave, which could be the work of anyone from teenaged skids to some nation's intelligence service. Lizard Squad may have a connection to Mirai. The reptiles are also getting into the coin mining business. Patient phishing relieves IOTA cryptocurrency users of the contents of their wallets. UK's Snooper's Charter smacked down by High Court. US House Intelligence Committee votes to release classified memo on surveillance. Jonathan Katz from UMD on the “fuzzing” of private healthcare information. Guest is Michael Simon from Cryptonite with results from their 2018 Health Care Cyber Report. US military personnel get an OPSEC lesson on Strava. 

In today's podcast, we hear that hackers have looted cryptocurrency exchange Coincheck to the tune of about $530 million. Experty's ICO speculators get phished by crooks. Jackpotting hits American ATMs. The Dridex banking Trojan apparently has a ransomware sibling: FriedEx. Transduction attacks could hit IoT sensors. Steganographic app "Muslim Crypt" is designed for jihadist communication. North Korea tells Britain to mind its own business about WannaCry. Zulfikar Ramzan from RSA with his perspective on Spectre and Meltdown. Strava fitness app reveals locations of user activity. 

This week we’re discussing the a campaign the McAfee Advanced Threat Research team recently discovered, one that’s targeting organizations involved with the upcoming Pyeongchang Winter Olympics.

Raj Samani is chief scientist at McAfee, and he shares the campaign's clever details.

In today's podcast, we hear how Lebal malware steps its way through layered defenses. Cryptocurrency mining campaigns go after Monero with XMRig, WannaMine, and other toolkits. It's not a victimless crime, either—CPUs can be rendered effectively unusable. Influence operations are tracked in Twitter and Facebook. Dutch intelligence services penetrated Cozy Bear and shared warnings with allied services. Russia demanded, and got, source code access as a condition of doing business. Dale Drew from CenturyLink shares his outlook on 2018. Stacey Higginbotham, host of the Internet of Things Podcast, chats about IoT security. A creep exploits password recovery utilities. 

It’s fair to say that 2017 was a busy year when it came to cyber security, and as we head into 2018 there’s certainly no sign of things slowing down. Days into the new year the news of serious vulnerabilities like Meltdown and Spectre, the ongoing threat of ransomware, major data and privacy breaches, and political unrest around the world, well, hold onto your hats, it looks like we may be in for a bumpy ride.

In this CyberWire special edition, we’ve gathered a group of seasoned cyber security experts to share their views on what we might expect over the coming year.

 Nate Beach-Westmoreland is Head of Strategic Threat Intelligence at Booz Allen's Cyber4Sight.

https://www.linkedin.com/in/natebeachw/

Christopher Porter is Chief Intelligence Strategist at FireEye.

https://www.linkedin.com/in/christopher-porter-039620112/

Caleb Barlow is Vice President Threat Intelligence at IBM Security.

https://www.linkedin.com/in/calebbarlow/

In today's podcast, we hear about how patriotic hacktivists are talking turkey to high-profile Twitter accounts. The Hide 'N' Seek IoT botnet spreads swiftly through specially crafted peer-to-peer communications. Vulnerabilities found in the Electron developers framework. ICOs are heavily targeted by criminals. Bell Canada was breached, and the Mounties are on the case. Ontario transit operator Metrolinx is asked how it knows North Korea hacked it. British Prime Minister May takes a swing at secure messaging and tech companies generally. Fancy Bear doesn't like Olympic luge. David DuFour from WebRoot with his outlook on ransomware for the coming year. Guest is Malcolm Harkins from Cylance with thoughts on the Aadhaar data breach. And what's the significance of a values statement? 

In today's podcast, we hear that new Satori variants are out. Turkish hacktivists use Twitter for social engineering. Parties unknown are conducting an espionage campaign against Turkish defense contractors. North Korea's Lazarus Group improves its cryptocurrency theft tradecraft. Dating app vulnerabilities are a cyber-stalker's dream date. Britain will combat disinformation with a national office of rumor control. Justin Harvey from Accenture addressing the cyber skills shortage. Guest is Jon Condra from Flashpoint, reviewing their Business Risk Intelligence Decision Report. Plus, say phooey to pirated copies of Fire and Fury. 

In today's podcast we hear that ISIS is howling "we are in your home" as they lose their own home. Intel says a new patch for Spectre and Meltdown is coming to fix instability problems. Babies' social security numbers and other data are for sale on the dark web. So are email credentials from top-500 British law firms. Look closely at urls—IDN spoofing is out and about. Satori expands the reach of its botnets. New ransomware strains surface. SpriteCoin is no coin at all. Joe Carrigan from JHU responding to listener mail about disabling links in email. Chris Webber from SafeBreach on using simulations to test for Meltdown and Spectre vulnerabilities. And Sonic the Hedgehog fans watch out: three popular games may expose you to hacking. 

In today's podcast, we learn that the Evrial Trojan is interested in what's on your Windows Clipboard. The healthcare sector continues its struggle to recover from SamSam ransomware. People raise the possibility that Olympic timekeeping could be hacked. They're not saying it was, just that it might be. Russian troll farms are barking at the US House Intelligence Committee and the Czech Presidential run-off election. Some notes on crime and possible punishment. Malek Ben Salem from Accenture Labs on the challenges of deploying next-generation cryptography. And there are two new theories about Satoshi Nakamoto. 

Researchers at ThreatConnect have discovered evidence that Fancy Bear, a cyber espionage group generally associated with Russia's military agency GRU, may be spoofing domains belonging to the World Anti-Doping Agency (WADA), the US Anti-Doping Agency (USADA), and the Olympic Council of Asia.

Kyle Ehmke is a threat intelligence researcher with ThreatConnect, and he takes us through their work.  

In today's podcast we hear about ransomware afflicting a healthcare IT provider. Group 123 phishes in South Korean waters. Schneider Electric describes the zero-day Triton/Trisis exploited. The Dark Caracal spyware campaign is attributed to Lebanon's intelligence service. The US Congress will extend Section 702 surveillance authority for six years. GhostTeam-infected apps are booted from the Play Store. Jonathan Katz from the University of Maryland ponders "uncrackable" quantum encryption. Graham Cluley from the Smashing Security podcast drops by for a chat about the state of the industry. And is there ever a good reason to write down a password? 

In today's podcast we hear that Norway's Southern and Eastern Regional Health Authority has suffered a breach. False civil defense alerts are mistakes, not hacks, but they're worth some attention. Davos will take up international conflict and cybersecurity next week. Banking Trojan Exobot holds a going-out-of-business sale. Satori botnet rifles cryptocurrency wallets. Emily Wilson from Terbium Labs, looking at the upcoming Olympics and midterm elections. Guest is Nadav Avital from Imperva on web application vulnerabilities. And was Bitconnect's collapse a Ponzi scheme, a pump and dump, or something else? 

In today's podcast, we hear that the US Senate is ready, after a successful cloture motion, to vote on Section 702 surveillance reauthorization. Bipartisan Congressional support for election security bill. Skygofree is an unusually capable variety of Android spyware. More evidence ties North Korea's Lazarus Group to a Bitcoin spearphishing campaign. German users lured by fake Spectre/Meltdown patch sites. Healthcare organizations hit with a variety of attacks. Zulfikar Ramzan, CTO at RSA, introduces himself as we welcome him to the show. Guest is Mark Orlando from Raytheon Cyber on the Korean Olympics phishing campaigns. Thinking of VR adult content? Think twice. No, better, think thrice. 

In today's podcast, we hear that a new Mirai variant, Okiru, is forming botnets of ARC-based IoT devices. Meltdown and Spectre remediation continues. CIA is said to have confirmed that NotPetya was a GRU operation. Suspicions rise that the Shadow Brokers used security tools to scan for classified documents. US and Canadian officials raise alarms about election influence operations. Wichita swatter charged with involuntary manslaughter. Malicious Chrome extensions spotted. Robert M. Lee from Dragos on the security of petroleum ICS. Guest is Lance Cottrell from Ntrepid on the importance of net neutrality for security. And USB drives contain the darndest things. 

A group of Russian-speaking hackers have stolen nearly $10 million from banks around the world. Group-IB, a company with expertise in computer forensics, information security and, specifically, Russian‑speaking criminal groups, have named these thieves MoneyTaker. Nicholas Palmer is the director of international business development at Group-IB, and he's joined by their head of threat intelligence, Dmitry Volkob to explain the MoneyTaker group's schemes.

In today's podcast, we hear that Spectre and Meltdown have continued to receive patches, and they may not be as performance-killing as feared. F-Secure says if you leave your laptop alone it could be pwned in 30 seconds. Mobile ICS apps seem to be getting less, not more, secure. Google boots more bad stuff from the Play Store. Monero miners afflict unpatched Oracle WebLogic servers (so patch). The US Congress considers a Huawei ban. Johannes Ullrich from SANS and the Internet Stormcast podcast on IoT gifts. Guest is Phil Reitinger from the Global Cyber Alliance, an international, non-profit organization headquartered in New York City and London that is focused on eradicating systemic cybersecurity risks. And New Jersey is considering solving one of its biggest problems: droning under the influence. Sprung from cages on Highway 9 or not, don't try that on the turnpike, kids. 

In today's podcast we hear that the Government of India is working on Aadhaar security, suspending many officials' access. Fancy Bear doxes the IOC. WhatsApp snooping proof-of-concept revealed. Spectre and Meltdown patching continues. The US House voted to reauthorize Section 702 surveillance (the Senate is considering its own version). On the FBI's unwanted list: jerks and evil geniuses (and they're scowling in the direction of Cupertino). Rick Howard from Palo Alto Networks on AI and ML in cyber security. Guest is Shelley Westman from EY, with the results from their Global Information Security Survey. Conflating Bitcoin with Bitcoin cash could have been an e-commerce issue. 

In today's podcast, we hear that Turla's back, with a depressingly nifty man-in-the-middle campaign. The US thinks it sees Russia trying to influence Mexico's national elections. Russian banks are hit with a new mobile Trojan. Iran continues its Internet crackdown, and conducts more domestic surveillance and hacking. Winter Olympics-themed cyberattacks rely on well-crafted social engineering. Patch Tuesday addressed Spectre, Meltdown, Flash, and an Office zero-day. Yossi Oren from BGU on vulnerabilities in mobile device replacement touchscreens. Stay away from flashlight apps. (And take a look at your dog-walker's app, too, while you're at it.) 

In today's podcast, we hear about how Spectre and Meltdown mitigations are proceeding, with many successes (but some blue-screen-of-death failures, too). Psiphon looks like the souped-up VPN of choice for Iranian dissidents, as that country's Internet crackdown continues. Pop-up ads infest mobile devices as an old tactic finds new scope for its misapplication. Olympic phishing targets South Korean companies. China moves to stop illicit cryptocurrency miners. Jonathan Katz from UMD on bitcoin mining power use. Guest is Udi Yavo from Ensilo on Process Doppelganging. Is there an alt-coin bubble? Sure looks like it. 

In today's podcast we hear that someone is phishing for hockey enthusiasts during the run-up to the Winter Olympics. Continued unrest in Iran, with more arrests. More on Meltdown and Spectre, as most experts agree you should apply the mitigations being offered. Intel receives much hostile scrutiny over the chip bugs, but other vendor's processes are affected, too. India says Aadhaar is secure, but many aren't so sure. Admiral Rogers will retire as NSA Director this spring. Ben Yelin from UMD CHHS on legislation to enable hacking back, ACDC, the Active Cyber Defense Certainty act. Marcus Hutchins' attorneys want his confession to involvement with Kronos thrown out. 

Robert M. Lee. is CEO of Dragos Security, a company that specializes in the protection of industrial control systems. He’s describing his team's research on TRISIS, tailored ICS malware infecting safety instrumented systems (SIS), so far found only in the middle east. It's only the fifth known incident of malware targeting ICS systems. 

In today's podcast we hear how Meltdown and Spectre have put the fear of hardware flaws into enterprises everywhere. No family of systems can be safely assumed to be immune. Most are positively identified as vulnerable. Proofs-of-concept show that remote attacks exploiting chips' speculative execution features are feasible. India's Aadhaar national identification database is compromised. Justin Harvey from Accenture with his outlook on 2018. Guest is Dinah Davis from Code.likeagirl.io and Arctic Wolf Networks. We’re discussing trade shows and conferences, and the importance of having diverse panels. Cryptocurrency speculative mania continues. 

In today's podcast we follow the story of Meltdown and Spectre, which pose kernel-level security issues: speed was inadvertently purchased at the price of insecurity. Spectre affects most chips, not just those from Intel. Mitigations are on the way. Bogus security apps booted from Google Play. Be on the lookout for phony Android Uber apps. Iran's Internet crackdown continues. Michael Daly from Raytheon and David DuFour from Webroot share their views on Meltdown and Spectre. And former NSA contractor Hal Martin may plea to taking one classified document home with him. 

In today's podcast we hear that Iran's crackdown on Internet channels of dissent continues. Intel processors are determined to have a deep security flaw: cloud users are likely to be affected. A macOS local privilege escalation vulnerability is published. The "Trackmageddon" location service vulnerability seems to originate in a buggy API. The suicide forest video appears to have passed through YouTube's human curators. The man arrested in the Wichita police shooting may have been a serial SWATTER. Joe Carrigan from JHU on holiday IoT devices. Guest is Thomas Jones from Bay Dynamics on updated NIST rules for DOD contractors. 

In today's podcast we hear that ISIS has claimed responsibility for the December 27th St. Petersburg shopping center bombing. UK authorities seek to think ahead about cyber terror. US standards bodies propose more stringent mandatory reporting of cyber incidents at electrical utilities. Unrest in Iran prompts a government crackdown on the Internet. We meet our newest academic & research partner, Dr. Yossi Oren from Ben Gurion University. A YouTube celebrity learns something of the limits of the funny, and a Los Angeles man is arrested in a horrifying SWATTING attack that killed an utterly uninvolved bystander. 

Alan Neville is a senior threat intelligence analyst at Symantec located in Dublin. He is responsible for leading and documenting investigations into high priority attacks.

He recently published research on the Sowbug cyber espionage group targeting South American and Southeast Asian governments.

https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments

Gerald Hahn is CEO of Softshell ag, a German cybersecurity company. He shares his insights into the market for cybersecurity products in the German market, and how US companies can best prepare themselves to do business, there. 

Andrew Wild is CISO at QTS Data Centers. He shares his insights into the changing role of the Chief Information Security Officer, as businesses shift their focus toward risk.

Cybersecurity expert and author Scott Schober shares his personal story of being hacked, and how it set him on a mission to help prevent it from happening to others.

Jonathan is Cymmetria's General Counsel. A former trial attorney, Mr. Braverman is an expert in cyber-security law, policy and regulation. He has written policy papers on export controls over cyber technology, active defense and "hacking back."

In this edition of the CyberWire Research Saturday, we'll take a look at a more recent intrusion PwC has uncovered, named KeyBoy and highly likely a China-based threat actor. It uses compromised Word documents to gain access.

Bart Parys is a lead researcher in PwC's cyber threat intelligence team, responsible for tracking cyber threat actors, their latest toolsets and methodologies. 

https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html

In today's podcast we hear some updates on the Triton ICS malware campaign. North Korea amplifies its denials of responsibility for WannaCry. Cryptocurrency markets undergo a strong correction. "Blockchain" remains a word to conjure with. Citing a potential risk to national security, Lithuania's government bans Kaspersky software. ESET thinks Fancy Bear is growing more cunning and evasive. Chris Poulin from BAH on the transition to self driving cars, and the problem with selling fear and uncertainty. Guest is Kim DeCarlis from Gigamon on marketing cyber security. And how does Siri handle various linguistic challenges?