CyberWire Daily

In August 2017, multiple Content Delivery Networks (CDNs) and content providers were subject to significant attacks from a botnet dubbed WireX. (The botnet is named for an anagram for one of the delimiter strings in its command and control protocol.) The WireX botnet is primarily made up of Android devices running malicious applications and is designed to create DDoS traffic. The botnet is sometimes associated with ransom notes to targets.

Justin Paine is Head of Trust and Safety at Cloudflare, and he joins us to share the WireX story. 

https://blog.cloudflare.com/the-wirex-botnet/

In today's podcast we hear that an IoT botnet hurricane may be forming among IP cameras. (IP cameras are to DDoS what the West African coast is to Atlantic tropical depressions.) Sofacy rushes to exploit a patched Flash bug in a use-it-or-lose-it espionage race. Want to spy on someone? Go buy an ad. Cisco patches the wi-fi KRACK. NotPetya's still costing manufacturers and their insurers a lot of money. MalwareTech, a.k.a. Emily Wilson from Terbium Labs responding to post-Equifax breach credit agency claims that they can scan the Dark Web. Michael Sutton, CISO at Zscaler on zero-day hoarding. Marcus Hutchins, gets to take off that GPS and stay out late, since the judge decided his pre-trial behavior has been pretty good.

In today's podcast, we hear about how a cyber espionage campaign exploits a recently patched .NET vulnerability as Leviathan phishes with torpedo recovery programs. What does Pyongyang want in cyberspace? Apparently a lot of the same things it wants in physical space. Some observers think Putin thinks the Americans started that whole destabilization and delegitimation influence ops struggle. He's probably wrong, but there you go. Cutlet Maker malware jackpots ATMs. BoundHook stealth tool demonstrated. Minecraft malware got into Google Play. Ben Yelin from UMD CHHS with a follow up on President Trump’s executive orders. Guest is Dinah Davis from Code.Likeagirl.io with an update on their activities. Ransomware's still a threat, and a New York judge thinks the NYPD didn't get the memo about the importance of backup.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, and we think you'll find it valuable, too.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Interested in the latest research in cyber security? Our new Research Saturday podcast highlights research being done in industry, universities, and governments. Hear from people who are discovering threats, uncovering vulnerabilities, and devising the security measures to keep cyberspace as safe as it can be. Check it out.

In today's podcast we hear that the Lazarus Group is back at it with SWIFT. Maniber ransomware hits South Korea. Researchers cast the first KRACK-related stone at IEEE. Oracle, BlackBerry, and Lenovo patch. A study finds criminals turning to cryptominers. Awais Rashid from Lancaster University on securing critical infrastructure. Aaron Higbee, CTO of PhishMe, on the human factors in phishing. And one cryptominer seems to be tugging on Superman's cape—OPSEC isn't their strong suit, to say the least.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, and we think you'll find it valuable, too.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Interested in the latest research in cyber security? Our new Research Saturday podcast highlights research being done in industry, universities, and governments. Hear from people who are discovering threats, uncovering vulnerabilities, and devising the security measures to keep cyberspace as safe as it can be. Check it out.

In today's podcast, we hear about the assassination of a reporter who covered the Panama Papers. The Black Oasis threat group is found distributing FinFisher by exploitation of a bug in Flash Player. North Korean hacking is said to have been responsible for cancellation of a projected television show. Infineon patches a firmware flaw that could be exploited in a Coppersmith's attack. Vendors work to close the KRACK in their wi-fi products. WikiLeaks appears to be preparing for a large dump. The US Department of Homeland Security mandates improved email and website security across the Federal Government. David DuFour from Webroot discussing Bluetooth vulnerabilities. Neil Murray from Mimecast on cyber resilience. The US Supreme Court will review a significant cloud data decision.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, and we think you'll find it valuable, too.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Interested in the latest research in cyber security? Our new Research Saturday podcast highlights research being done in industry, universities, and governments. Hear from people who are discovering threats, uncovering vulnerabilities, and devising the security measures to keep cyberspace as safe as it can be. Check it out.

In today's podcast, we hear about how KRACK attacks get past secure wi-fi protocols. Probes and distributed denial-of-service incidents in Poland and Sweden have the look of state operations. East Asian threat actors moving on from cyber espionage to supply chain attacks. Iran blamed for June's hack of UK Parliamentary email. QR codes may pose security issues. Do FSB social media trolls really train against US targets by watching House of Cards? Johannes Ullrich from SANS Technology Institute and the ISC Stormcast podcast on scammers taking advantage of disaster. And can the CryptoRuble really complete with VopperCoin? Investors want to know.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, and we think you'll find it valuable, too.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Interested in the latest research in cyber security? Our new Research Saturday podcast highlights research being done in industry, universities, and governments. Hear from people who are discovering threats, uncovering vulnerabilities, and devising the security measures to keep cyberspace as safe as it can be. Check it out.

Peter Ney is a PhD candidate in the Allen School of Computer Science and Engineering at the University of Washington where he is advised by Professor Tadayoshi Kohno. His current research is focused on understanding computer security risks in emerging technologies like DNA synthesis and sequencing and the new threats posed by maliciously crafted, synthetic DNA. He and his team found that security of DNA processing programs is poor and show with a proof-of-concept that it is possible to attack computer systems with adversarial synthetic DNA.

In today's podcast, we hear that German authorities say they see nothing bad up with Kaspersky software, but they're in the Western minority on this one. ISIS messaging looks as if it's shifting toward a hejira narrative. Hyatt discloses a significant credit card breach. Equifax and its competitor TransUnion both remove third-party malvertizing code from their websites. Malek Ben Salem from Accenture Labs with a new vulnerability in software defined networks. Guest is Jeff Schilling, CSO of Armor Cloud Security with insights on Russian state actors. And the dark web is in many ways a lot like the regular web, down to seasonal sales, customer reviews, and cat pictures. 

In today's podcast, we hear that German police raid a Panama Papers connected slush fund. North Korea spearphishes in the North American power grid. Security tools can be dual-use, too. Notes on CyberMaryland, where we heard about business climates, the Baltimore-to-Birmingham cyber connection, the Red Queen's race, and the curmudgeonly demeanor too many security types cop. Rick Howard from Palo Alto Networks with an update on the Cyber Canon suggested reading list and a call to vote for the nominated books. Guest is John Morello from Twistlock on securing container environments.  And Google Home's Mini speakers were apparently listening and tattling as well as speaking. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Cylance uses cutting edge artificial intelligence to help protect your systems.

If you are a woman in cyber security and want make connections with others in the field, check out our own Women in Cyber Security event.

In today's CyberWire, we discuss why the US Intelligence Community got prickly about Kaspersky: their Israeli colleagues tipped them off that something was fishy in the software's use. UpGuard says Accenture left some AWS data buckets exposed. Accenture says they were associated with decommissioned systems, but exposed they seem to have been. Sources say Deloitte's breach is worse than hitherto disclosed, with more than three-hundred clients exposed. Joe Carrigan from JHU ISI with some follow-up from a listener on password security when using password managers. Brian NeSmith from Arctic Wolf with results from an IoT ransomware survey.  

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Cylance uses cutting edge artificial intelligence to help protect your systems.

If you are a woman in cyber security and want make connections with others in the field, check out our own Women in Cyber Security event.

In today's podcast, we hear that North Korea may have hacked into South Korean defense plans. Facebook and Google receive increasing scrutiny for Russian ad buys during 2016 US election season. A dissident Chinese billionaire, exiled to New York, says he's been under cyberattack from Shanghai. OilRig is back, with new and improved cyberespionage. Forrester market research reports accessed by hackers. Kovter malware gets an upgrade. Chris Poulin from BAH on medical device safety. Yassir Abousselham from Okta on challenges establishing and managing identity.  And we offer some observations from the Cyber Pavilion at the Association of the United States Army meetings. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Cylance uses cutting edge artificial intelligence to help protect your systems.

If you are a woman in cyber security and want make connections with others in the field, check out our own Women in Cyber Security event.

Following major breach revelations from Equifax, Yahoo!, Deloitte and the US Securities and Exchange commission, there have been many calls in the US for increased legislation and regulation that would force better privacy and identity management practices.

In this CyberWire special edition, we’ll ask some cyber security experts about GDPR, what it means for privacy and data use, the right to be forgotten, the penalties for noncompliance, and what it means for organizations outside the EU.

Joining us are Steve Durbin, Managing Director of the Information Security Forum, a not-for-profit organization providing its members with guidance on cyber, information security and risk management, Brett Hansen, Vice President of data security solutions at Dell, one of the largest suppliers of computer hardware, software and services in the world, and Darron Gibbard, CTSO at Qualys, a global provider of cloud-based security and compliance solutions.

Android Toast Overlay enables attackers to trick Android users into enabling permissions on infected devices by making them think they are clicking on benign buttons superimposed over the user interface.

Ryan Olson is Director of Threat Intelligence at Palo Alto Networks' Unity 42, and he joins us to share their research.

In today's podcast, we hear more on what happened with NSA material at (allegedly) Russian hands. Kaspersky security software alleged to have been exploited for intelligence service reconnaissance of contractor machine. Germany cancels post-Snowden surveillance investigation. Reality Winner will not be released on bail. Awais Rashid from Lancaster University on securing the supply chain. Guest is Timothy H. Edgar, author of “Beyond Snowden: Privacy, Mass Surveillance, and the Struggle to Reform the NSA.” 

In today's podcast we hear that sensitive NSA files appear to have been obtained by Russian intelligence services, and there are claims Kaspersky software was the gateway to compromise. Las Vegas massacre investigation expands to consider possibility of accomplices. A new password stealer is out in the wild. NFL Players Association data exposed. Justin Harvey from Accenture on insider threats. Guest Joe Coleman, cyber threat intelligence analyst from PepsiCo.The FCC was mostly advised by bots on net neutrality (and bots who haven't benefited from DeepMind's ethics class). 

In today's podcast, we hear that ISIS claims of responsibility for Las Vegas murders continue to lose plausibility, but the shooter's motives remain a mystery. Yahoo!'s epic breach just got even more epic. Equifax looks little better in the wake of its CEO's Congressional testimony. A major breach seems to be unfolding in India.  Jonathan Katz from UMD on the importance of random numbers for cryptography. Guest is Dave Mahon from Century Link on the importance of diversity and opportunities for women in cyber security. And does Star Fleet still run Windows XP? Who's responsible for information security on that bridge anyway? 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Delta Risk put together an infographic full of tips for Cyber Security Awareness Month. 

If you are a woman in cyber security and want make connections with others in the field, check out our own Women in Cyber Security event.

In today's podcast, we consider the bogus rumors and highly questionable claims of responsibility circulating online after the Las Vegas massacre. ISIS is especially keen to make inspirational capital out of senseless killing and suffering. Google and Facebook come under pressure to moderate the content they carry. The UK prepares to pass tougher restrictions on viewing radical content. The Equifax breach gets two-and-a-half-million people bigger. Ben Yelin from UMD CHHS on Yahoo! data breach victims’ right to sue. Tony Gauda, CEO of ThinAir on dealing with insider threats. And US Cyber Command is said to have disrupted North Korean intelligence networks. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Delta Risk put together an infographic full of tips for Cyber Security Awareness Month. 

If you are a woman in cyber security and want make connections with others in the field, check out our own Women in Cyber Security event.

In today's podcast, it's bots, sockpuppets, and trolls, oh my. Mr. Zuckerberg goes to Washington. Equifax sources suggest China hacked it. Credit bureau phishbait chums the Internet. Pyongyang gets a new Internet connection, and observers bet it's not for checking Mr. Kim's fantasy sports leagues (anyway he could get all that from Mr. Rodman). ISIS posts more inspiration, and warnings. NSA prepares to wind down Section 702 operations. Johannes Ullrich from SANS Technology Institute and the ISC Stormcast podcast on malware using malicious DLL files. US and Russia seem to agree on one thing at least: Bitcoin fraud is bad. 

APT 33 is an Iranian cyber espionage group that targets aerospace and energy sectors and has ties to destructive malware. John Hultquist is Director of Intelligence Analysis at FireEye, and he takes us through their research.

In today's podcast, we hear that Whole Foods has been breached—if you've been to the taproom, look to your credit cards. An illusion gap could help bypass Windows Defender, says Cyber Ark. Microsoft says don't sweat the small stuff. A Mac firmware issue may be giving users a false sense of security. Equifax is offering a lifetime of free credit freezing, but observers are dubious. A study suggests there are still a lot of improperly secured clouds out there. ISIS and the Taliban resume their inspiration operations online. David DuFour from Webroot on the difference between Artificial Intelligence and Machine Learning. Guest is R.P. Eddy, coauthor with Richard Clarke of the book Warnings: Finding Cassandras to Stop Catastrophes. And alleged NSA leaker Reality Winner remains in custody, at least for now. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

Recorded Future's user conference RFUN 2017 comes to Washington, D.C. , October 4th and 5th, 2017, bringing together the people who put the act in actionable intelligence.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper

If you want to execute at machine speed, doesn’t make sense to see what the algorithms a good machine runs on can do for you? Check out sponsor Cylance .

Deloitte and Equifax continue to find themselves under scrutiny, but we should all resist the urge to chase Ambulances. The SEC commissioner gets a grilling form congress, and we can't help wonder if his Spidey sense was tingling. Chances are your credentials aren't as secure as you'd like them. Dale Drew from Level 3 Communications on attack patterns and lulls. Trip Nine from Comodo on credential theft trends. And Pyongyang is perched on a pile of coal. 

In today's podcast, we hear more about the Deloitte breach. Deloitte's stil saying little, but other people are talking. The SEC tells the Senate it's "deeply concerned" about its own breach. Popular iOS and Android stock-trading apps are found vulnerable. Sonic drive-ins have sustained what looks like a pretty big breach. Ben Yelin discusses a bipartisan bill to improve IoT security. Isaac Kohen from Teramind on detecting employees involved in radical political activities on company time. Russian influence operations against the US are turning toward local government, religious groups, civic associations and others at the grassroots. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

Recorded Future's user conference RFUN 2017 comes to Washington, D.C. , October 4th and 5th, 2017, bringing together the people who put the act in actionable intelligence.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper

If you want to execute at machine speed, doesn’t make sense to see what the algorithms a good machine runs on can do for you? Check out sponsor Cylance .

In today's podcast we hear that Equifax CEO Smith has joined the company's CSO and CIO in retirement, apparent expiation for the credit bureau's breacn. Deloitte remains tight-lipped. Suggestions about how to handle identity and investigate breaches. Mac OS High Sierra suffers from a password exfiltration zero-day. Joe Carrigan discusses Dave's skepticism of password managers. Stephen Moore from Exabeam on post-breach cleanup.  Two days after Germany's elections and the Russian dog hasn't barked (or the Bears growled) but there are plenty of 2016 paw prints over US opinion. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

Recorded Future's user conference RFUN 2017 comes to Washington, D.C. , October 4th and 5th, 2017, bringing together the people who put the act in actionable intelligence.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper

If you want to execute at machine speed, doesn’t make sense to see what the algorithms a good machine runs on can do for you? Check out sponsor Cylance .

In today's podcast, we review reports saying that Deloitte has been hacked. Details are sparse but the story is developing. A Verizon AWS S3 bucket is found exposed online. Locky is being spammed out in quantity. Phantom Squad hoods run a DDoS protection racket. Kinetic tensions the US, Tehran, and North Korea raise expectations of cyber offensives. Chinese intelligence thought behind CCleaner backdoor. Unnamed ISPs accused of FinFisher spyware campaign complicity. Chris Poulin from BAH on vulnerabilities in connected cars. And Carlos Danger will go to the Big House. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

Recorded Future's user conference RFUN 2017 comes to Washington, D.C. , October 4th and 5th, 2017, bringing together the people who put the act in actionable intelligence.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper

If you want to execute at machine speed, doesn’t make sense to see what the algorithms a good machine runs on can do for you? Check out sponsor Cylance .

In 2016 Bitdefender uncovered a new advanced persistent threat dubbed Pacifier, targeting government institutions starting in 2014. Using malicious .doc documents and .zip files distributed via spear phishing e-mails, attackers would lure victims with invitations to social functions or conferences into executing the attachments. It’s capable of dropping multi-stage backdoors.

Liviu Arsene is a senior e-threat analyst at BitDefender, and he's our guide to the complex components of Pacifier APT.

In today's podcast, we hear that the EDGAR breach is being seen as a blow to confidence in financial system. Credit bureaus continue to receive heightened scrutiny after the Equifax breach. FinFisher campaign suggests ISPs may have been compromised. The backdoor in CCleaner seems to have targeted specific companies. US Forces Korea personnel receive a bogus noncombatant evacuation order. Someone behind Locky watches a lot of Game of Thrones. Malek Ben Salem from Accenture Labs with a new attack vector that uses power management systems. Guest is Robert Sell sharing his experience participating in a DEFCON capture the flag. And Thomas the Tank Engine would never do what some skids show him doing. 

In today's podcast, we hear that the SEC was hacked, and someone might have made a lot of money from the incident. Equifax tweets send inquirers to a phishing site. Investigation into the Avast caper suggests a state intelligence service's hand. The Department of Homeland Security clarifies its ban on Kaspersky products. Emily Wilson from Terbium Labs, cautioning us to not be so distracted by big shiny objects like "taking down the power grid" that we forget the basics, like enabling two-factor authentication. Richard Henderson, global security strategist at Absolute, commenting on the Equifax breach and the challenges of keeping up with patching. And chatbots turn spiritual. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. Recorded Future's user conference RFUN 2017 comes to Washington, D.C. , October 4th and 5th, 2017, bringing together the people who put the act in actionable intelligence. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

In today's podcast we learn that so far Russian influence seems not to be operating in Germany's election. Iran's APT33 turns from spying to sabotage. Equifax woes continue, but don't appear to include cover-up of an earlier breach. UpGuard helps Viacom dodge a cyber bullet. You may be party to a contract you didn’t know about. Criminal boneheads again more common than criminal geniuses. Ben Yelin from UMD CHHS with a story of the FBI raiding the wrong home based on WiFi router information. Guest is Eddie Habibi from PAS, debunking some ICS myths. And don't be a gazelle. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. Recorded Future's user conference RFUN 2017 comes to Washington, D.C. , October 4th and 5th, 2017, bringing together the people who put the act in actionable intelligence. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

In today's podcast, we hear that WikiLeaks is shocked, shocked, to learn that there's gambling…uh, we mean, Russian surveillance going on. Advice from Ukraine about influence operations. The Equifax story may have gotten worse—there may have been an earlier breach in March. Software supply chain issues come up in an Avast backdoor. Awais Rashid from Lancaster University on security being the responsibility of everyone in an organization, not just the IT folks. Mike Kail from Cybric on the DevSecOps trend. Industry notes, and the "Unlucky 13,' presented by Johns Hopkins. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. Recorded Future's user conference RFUN 2017 comes to Washington, D.C. , October 4th and 5th, 2017, bringing together the people who put the act in actionable intelligence. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

In today's podcast, we note reports that, while Germany will hold elections Sunday, Russian cyber operators seem quiet. Too quiet? Switzerland and Singapore both report sustaining state-sponsored cyber espionage attempts. ISIS howls for its lone wolves to hit soft targets. The Equifax breach news isn't getting any better. Cisco finds a backdoor in an Avast security product. Chris Poulin from Booz Allen Hamilton, our newest industry partner, introduces himself. He leads the Internet of Things security strategy in Booz Allen’s Dark Labs, as well as dabbles in Machine Intelligence. He joins BAH from IBM, where he lead their X-Force research teams and built the first prototype Watson for cybersecurity.OurMine hackers hit Vevo to redress an insult delivered over LinkedIn. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. Recorded Future's user conference RFUN 2017 comes to Washington, D.C. , October 4th and 5th, 2017, bringing together the people who put the act in actionable intelligence. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Deepen Desai, senior director of security research and operations at Zscaler, describes research he and his team have been doing since discovered a clever bit of malware they’ve named Cobian RAT. (RAT stands for Remote Access Trojan.) It’s available for free, but contains a back door that allows the original author to access and control the RAT remotely.

In today's podcast, we hear about how Equifax continues to struggle in the quicksand of wayward patching and clumsy incident response. Congress, the FTC, the CFPB, and DoNotPay are all taking an interest. Another unsecured database—this one for sale to political campaigns—is found (Alaska voters are affected). Kaspersky says his company is a bystander that's been hit in the Russo-American political crossfire. The US Navy continues to investigate the USS McCain collision. Justin Harvey from Accenture on what it’s like to be on an incident response team. Luke Beeson from BT on the challenges such a large organization faces protecting themselves and their clients. And Harvard decides Manning won't be a Kennedy School Fellow after all. 

In today's podcast, we hear that DHS tells the US Executive Branch to stop using Kaspersky security software. Kromtech finds ElastiSearch servers hosting point-of-sale malware. BlueBorne bugs buzz billions of boxes. Equifax says that its breach was accomplished via the Apache Struts flaw patched in April. Industry notes include both venture funding and acquisition news. We take a quick look back at the Billington CyberSecurity Summit. Johannes Ulrich with an update on the Mirai botnet. Renato Marinho, Chief Research Officer at Morphus Labs, on a bad Chrome browser extension that can steal banking credentials. And robo-lawyers come to small claims court. 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, you might find it valuable, too.

If you’d like to protect your endpoints against advanced threats, check out Cylance.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast, we hear that North Korea's stealing all the Bitcoins it can find. The Equifax breach continues to spread: countries other than the US are increasingly involved. Patch Tuesday notes. The US Director of National Intelligence addresses the Billington CyberSecurity Summit. Joe Carrigan from JHU on VPN companies collecting private user data. Dr. Richard Ford, Chief Scientist, Forcepoint, on the Equifax breach. And did a Russian lawmaker just cop to the influence ops President Putin has so piously denied? 

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, you might find it valuable, too.

If you’d like to protect your endpoints against advanced threats, check out Cylance.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast, we hear about how Equifax has attracted more attention from plaintiffs, AGs, and Congress. Everyone else is on heightened alert for fraud and identity theft. MongoDB says users of its database process were not assigning passwords to administrative accounts. A Bluetooth-based attack vector, "BlueBorne," is described. Syringe pumps are found to be hackable. Bots serve more effective social media clickbait than human operators can. Robert M. Lee from Dragos on deterrence.  Myke Cole, cyber security analyst and fantasy writer discussing the importance of empathy when considering your adversaries. And Roman Seleznev gets 27 years after he cops a plea to hacking.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, you might find it valuable, too.

If you’d like to protect your endpoints against advanced threats, check out Cylance.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

Today's podcast features all things Equifax, as the credit bureau deals with its breach (and the lawyers and Wall Street wind up to deal with the credit bureau). The Chaos Computer Club says it's found major flaws in German election software. Moscow seems to have done a lot of catphishing in social media during the last US campaign season. Best Buy boots Kaspersky security products from its big box stores. Dale Drew from Level 3 Communications with some sobering statistics on attack trends. And a Cracka with Attitude gets five years in Club Fed.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, you might find it valuable, too.

If you’d like to protect your endpoints against advanced threats, check out Cylance.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast we hear that credit bureau Equifax had disclosed a massive data breach it discovered on July 29th. Does that mean they're about a month delinquent? WikiLeaks weekly Vault7 dump departs from past practice with respect to content. The ShadowBrokers are back, and offering a twice monthly twofer. Emily Wilson from Terbium Labs with her thoughts on the encryption debate. Alexander Klimburg, author of The Darkening Web. And Intelligence Community leaders agree on at least three things: they need a better security clearance process, they need Section 702, and nowadays all intelligence involves cyber intelligence.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

To learn about combining threat intelligence, analytics, and orchestration, check out ThreatConnect’s webinar.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

DragonFly 2.0 is up to some very bad things in several nations' power grids. China ramps up cyberespionage against South China Sea rivals. Facebook finds that a Russian front company bought more than $100,000 in influence-ops ads on its service over the last two years. US info ops stumble over a dog. Jonathan Katz on encryption bit depth. Kyle Wilhoit from Domain Tools with the results of a Black Hat survey on "fake news." And a Japanese 13-year-old is in hot water for trying to sell malware.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

To learn about combining threat intelligence, analytics, and orchestration, check out ThreatConnect’s webinar.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast we hear about a critical vulnerability in Apache Struts. It's been patched—enterprises are advised to apply it as soon as possible. Dragonfly poses a clear and present danger to European and US power grids. Ransomware continues rampant. Latin American social media platform Taringa suffers a breach. Notes from the Intelligence and National Security Summit. Cryptocurrencies in China and Russia. Ben Yelin from UMD CHHS on the resignation of many of President Trump’s cyber security advisors. Guest is Tom Billington promoting the upcoming Billington Cybersecurity event. And say it ain't so, Joe—are the Red Sox stealing signals with an Apple Watch?

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

To learn about combining threat intelligence, analytics, and orchestration, check out ThreatConnect’s webinar.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast, we hear that election influence operations appear to have begun in Germany. Turla's spoor tracked to the Pacifier APT. Cambodia takes an authoritarian turn, possibly extending to domestic spying via RAT. Rival jihadists remain active online; US Cyber Command working to deny them cyberspace safe havens. More exposed AWS S3 databases. MongoDB databases hit with ransom wiper. PrincessLocker and Locky ransomware continue to romp in the wild. Free RAT backdoors criminals. Johannes Ulrich from SANS Technology Institute and the ISC Stormcast podcast on DDoS extortion emails. Disgruntled customer doxes booter service.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

To learn about combining threat intelligence, analytics, and orchestration, check out ThreatConnect’s webinar.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast, we hear that Kenya's Supreme Court has nullified that country's presidential election results over electronic irregularities in the balloting. Chinese steps up cyber espionage against Vietnam during South China Sea disputes. Ransomware continued to surge this week. WikiLeaks dumps "Angelfire" documents from Vault7. Reality Winner says she wasn't properly Mirandized by the FBI. North Korea raids South Korean Bitcoin exchanges. Joe Carrigan from JHU on security issues with fitness apps. Charles Henderson from IBM’s X-Force Red group on automotive security.  And get ready for WhopperCoin.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. Check out & subscribe to Recorded Future’s free intel daily. We read it every day. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast we hear that Turla's using some sophisticated code against diplomatic and defense industry targets. OurMine hackers use DNS poisoning against WikiLeaks, but WikiLeaks opens up Vault7 anyway: this week it's "Angelfire." Accused US Intelligence Community leaker Reality Winner wants her initial statements to investigators suppressed at trial. House of Cards leaks stories and other material related to the TV show. A quick patching update. Insecure APIs take a toll on Instagram and the FCC. Emily Wilson from Terbium Labs with her thoughts on the closure of Alpha Bay. Mike Kearney from Deloitte on predictive reputation protection. And what's up with Rick and Morty?

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. Check out & subscribe to Recorded Future’s free intel daily. We read it every day. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast, we hear warnings against taking the Hurricane Harvey phishbait. The IRS says that email telling you to download a questionnaire and return it to the FBI isn't from them. Why you really don't want that tutorial in tumbling Bitcoin. Sources accuse North Korea of stealing cryptocurrency. Trickbot is back, and it's swiping Bitcoin. The ransomware strain in Scottish hospitals was Bit Paymer. More than 700 million email addresses found in the Onliner spambot. UK retailer suffers breach. St. Jude pacemakers get a firmware patch. Robert M Lee from Dragos on cutting through the hype. Joseph Loomis, promoting the upcoming IR17 event. And some industry notes.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. Check out & subscribe to Recorded Future’s free intel daily. We read it every day. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

Having a set of standards by which to measure your security organization, being able to compare your security posture to other organizations, and being able to justify your choices to investors and insurance firms are all worthwhile goals? It’s beneficial to have widely agreed upon standards of care and measurement in cyber security, to help know where you stand, where there’s room for improvement, and what’s important to you.

That’s where frameworks come in, and the NIST cybersecurity framework is one of the most popular in the cybersecurity industry. In this CyberWire special edition, we’ll examine frameworks in general and the NIST cybersecurity framework specifically, to see if adopting them is worth the time, energy and expense it takes.

Joining us are Rick Tracy, Chief Security Officer for Telos corporation, Rafal Los, Managing Director of the Solutions and Programs insight group at Optiv Security, and Matt Barrett, Program Manager for the Cyber Security Framework at NIST. Stay with us.

In today's podcast, we hear reports of cyberespionage against both India and Pakistan—some unknown third nation-state is said to be responsible. NHS Lanarkshire hack confirmed as ransomware. Notes on Hancitor malware, WireX Android DDoS botnet discovered and taken down by an industry consortium. BGP fumble hit Japan's Internet, not hackers. Hurricane Harvey and Game of Thrones phishbait in circulation. Justin Harvey from Accenture on open source threat intelligence. Avi Reichental from XponentialWorks on security issues with implantable data devices. And no, not that GPS.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. Check out & subscribe to Recorded Future’s free intel daily. We read it every day. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast, we hear that the USS McCain collision appears to unrelated to any cyberattack, but observers warn of ICS security issues as maritime cyber concerns rise. WikiLeaks' ExpressLane Vault7 dump raises concerns in India. Telnet credentials for Internet-of-things devices exposed; security experts work to close this DDoS risk. "Defray" ransomware being distributed with unusually precise and plausible spearphishing. A ransomware attack disrupts some healthcare services in Scotland. Acquisition news in the cyber sector. Ben Yelin from UMD CHHS on web sites logging form submissions even before you hit the “submit” button. And Iranian information operations seem to be piping the devil's tune (more or less literally, from Tehran's official point-of-view).

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. Check out & subscribe to Recorded Future’s free intel daily. We read it every day. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast we hear about how the four C's have come together: clouds, crooks, cheats, and crypotcurrencies. Locky continues to circulate in evolved forms. WikiLeaks dumps some curious alleged liaisonware documents from Vault7. Russian sources report that FSB officers facing treason charges in Moscow may have given up some connected hackers to the Americans. The FBI makes an arrest in the OPM breach. The Daily Stormer is way offline, but ISIS and its parasitic slave-trading gangs are decidedly online. Dale Drew from Level 3 Communications with some threat intelligence on phishing and malware. Guest is Nicole Eagan, CEO of Darktrace. And another consequence of NotPetya seems to be a pet food shortage.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Your patient data depends on incident response plans. Prepare with DeltaRisk's webinar.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast we consider the way in which two potential state cyberattacks are now looking more like, respectively, an accident and a conventional crime. US Government officials double-down on warnings of Kaspersky connection to the Kremlin, and Australia's Government isn't buying Huawei's protests that it's not working for the PLA, either. Ropemaker attacks could inject malicious code into email after it's been delivered. Joe Carrigan from JHU on medical device security legislation. Christopher Pierson from Viewpost with observations from DEFCON. Some teasers on the Chertoff Group's Security Series.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Your patient data depends on incident response plans. Prepare with DeltaRisk's webinar.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast, we hear that Ukraine is worried about cyberattacks in conjunction with tomorrow's independence day holiday. The US Navy investigates the possibility of cyberattack in this week's Malacca Straits collision, but that possibility may be fading. Zscaler finds more malicious apps in Google Play. New York State's Department of Financial Services' cyber regulations begin to take effect Monday. Delaware is also stepping up data security regulations. Johannes Ulrich from the SANS Technology Institute and the ISC Stormcast podcast on hacks to Uber driver accounts. Tony Dahbura from JHU promotes their upcoming Cyber Security Conference for Executives. And ISIS continues its inspiration online as police in many countries scramble to follow the Caliphate's messaging.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Your patient data depends on incident response plans. Prepare with DeltaRisk's webinar.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast, we hear about maritime hacking worries, with potential risks to navigation, cargo handling, and manifest data. Another misconfigured AWS S3 bucket exposes business data. "Mr. Smith" says he's going to release the Game of Thrones season finale. The UK's NHS may have been breached. Google pulls 500 backdoored apps from the Play store. Fear of robots. Fileless cryptocurrency miner installed through EternalBlue. Jonathan Katz from UMD on separating science from snake oil. Dan Larson from CrowdStrike on incident response for zero-days. Scareware scares web surfers.

 Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Your patient data depends on incident response plans. Prepare with DeltaRisk's webinar.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.