CyberWire Daily

In today's podcast, we hear that GCHQ may have known about the FBI's intentions to arrest Marcus Hutchins even before Hutchins departed England for Black Hat. A Chinese oil production field is thought to have sustained some sort of cyber incident similar to those involving NotPetya. US Cyber Command receives elevated status—it's now the tenth Unified Combatant Command. Ukrainian authorities warn that country's financial sector to expect a new wave of cyberattacks. Turla is back, inviting you to the G20 meetings. GPS spoofing fears rise. Dealing with extremism online. Palo Alto Networks' Rick Howard on the fading popularity of the Rig exploit kit. And another initial coin offering is hacked.

 Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Your patient data depends on incident response plans. Prepare with DeltaRisk's webinar.

JHUISI & partner COMPASS Cyber present Cyber Security Conference for Executives on September 19th in Baltimore. Register for the event.

In today's podcast, we hear that ransomware strains, old and new, are circulating in the wild. ShadowPad backdoors are tentatively attributed to Chinese espionage operations in the supply chain. A hacker releases the decryption key for Apple's Secure Enclave. Profexor may actually not know much about Fancy Bear's romp through the DNC. Another misconfigured AWS bucket exposes data on voters in Chicago. The difficulties of countering extremism online. Malek Ben Salem from Accenture Labs on the cloud security maturity model. Joseph Carson from Thycotic on the evolution of phishing campaigns. The FBI has a roadshow warning companies of the risks of using Kaspersky security products.

In today's podcast, we hear that Holyrood is defending itself with some success against email brute-forcing. India's national ID system compromised, again. ShadowBroker-leaked exploits continue to do damage. Hijacked Chrome extensions prove difficult to eradicate. New variants of Locky and other ransomware are out. "Pulse wave" DDoS attacks are observed. Researchers find DDoS-as-a-service for sale in Chinese online souks. Governments express suspicion of foreign IT. Extremist site loses hosts, but its content will go on, even as opposing vigilantes mistakenly dox innocent targets. Emily Wilson from Terbium Labs with thoughts from Black Hat and shifting awareness of the dark web.  Brad Stone from Booz Allen on a recently released report on NotPetya. And OurMine hijacks HBO social media accounts.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Your patient data depends on incident response plans. Prepare with DeltaRisk's webinar.

Domain Tools leverages both human and machine intelligence to expose malicious infrastructure. Learn more in their white paper.

In today's podcast, we hear about a new draft of NIST SP 800-53. There's been an attempt to brute-force email credentials in Scotland's Parliament. Fancy Bear's romp through high-end hotel Wi-Fi suggests the Equation Group leaks will be with us for some time. "Mr. Smith" remains at large, and still wants to be paid. Trickbot uses unusually convincing counterfeit sites. PowerPoint malware vectors may be part of a criminal test. NetSarang urges swift patching of a backdoor in its software. Extremist inspiration persists.  Ben Yelin from UMD CHHS on privacy concerns with robot vacuum cleaners. Guest is Jeff Pederson from Kroll Ontrack, a data recovery firm, with tips on data recovery.And some guy in Nigeria with more moxie than skills is behind a big business email compromise campaign.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Your patient data depends on incident response plans. Prepare with DeltaRisk's webinar.

Domain Tools leverages both human and machine intelligence to expose malicious infrastructure. Learn more in their white paper.

In today's podcast, we hear that the Lazarus Group is back, and now they're phishing in English. The Daily Stormer gets the boot, but companies and governments continue to struggle with developing appropriate responses to extremist content. Google has swiftly cleaned up SonicSpy, but the malware is still circulating outside the Play store. Indian police make four arrests for HBO hacking, but none of them are related to "Mr. Smith." Marcus Hutchins is out on bail and preparing for an October trial. DJI drones get a peacemaking makeover. Justin Harvey from Accenture on prepping for destructive attacks. Jeff Schumann CEO of Wiretap on vulnerabilities in messaging technologies like Slack and Yammer. And one weird trick to recognizing that a call is a help desk scam. Ready? It's this: they called you.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Your patient data depends on incident response plans. Prepare with DeltaRisk's webinar.

Domain Tools leverages both human and machine intelligence to expose malicious infrastructure. Learn more in their white paper.

In today's podcast, we hear about online reactions and hacks in response to the Charlottesville rioting and homicide. Operation #LeakTheAnalyst releases another, smaller, set of documents. The ShadowBrokers get some poor customer reviews for their Exploit-of-the-Month Club. Reputation matters in the dark web souks. More HBO leaks (but no new messages). Google ejects SonicSpy-infected apps from the Playstore. Oxford researchers describe Android library collusion attacks. Robert M. Lee from Dragos on recent incursions into the Irish and UK power grids. And fellow security researchers can't believe Marcus Hutchins would wittingly do what the Feds accuse him of.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Your patient data depends on incident response plans. Prepare with DeltaRisk's webinar.

Domain Tools leverages both human and machine intelligence to expose malicious infrastructure. Learn more in their white paper.

In today's podcast, we hear that Mr. Smith turned down HBO's offer of a $250,000 bug bounty. Fancy Bear uses EternalBlue tools against hotel Wi-Fi networks. Argument over who leaked DNC emails last year flares again. New versions of Locky and Mamba ransomware circulate in the wild. The US Department of Defense is ready to use rapid acquisition to buy cyber tools and services. The FBI says a Maryland man used eBay and PayPal to receive ISIS funds for possible terror activity. Ukraine makes an arrest in the NotPetya case. David Dufour from Webroot on basic cyber hygiene. Barmak Meftah, President & CEO at AlienVault, with his thoughts on the state of the industry. And WikiLeaks dumps video intercept tool CouchPotato.

Supported by E8 Security, Johns Hopkins University, and Domain Tools.

In today's podcast, we learn that EU election monitors say Kenyan presidential voting went off without hacking (the losing opposition disagrees). Germany looks toward securing September's vote. North Korea receives cyber attention from somewhere in the civilized world. Ukraine's postal service sustains a two-day DDoS attack. WannaCry and NotPetya pseudoransomware fallout. Spyware-infected apps found in the Google Play Store. Jonathan Katz from UMD on a RSA 2048 encryption hack. Markus Jakobsson from Agari on a proposed cyber threat classification system. "Mr. Smith" comes to Midtown, and he wants a raise from Richard.

Supported by E8 Security, Johns Hopkins University, and Domain Tools.

In today's podcast, we hear that Patch Tuesday saw Windows and Adobe fixes. Venezuela's civil conflict gets a hacktivist dimension. Anti-Israeli wiper malware is circulating in the wild, unpolished by nasty. Kaspersky Lab expects to see more pseudoransomware, especially when disruption and not profit is the goal. The KONNI RAT, of unknown origin sniffs at sites associated with North Korea. The HBO hack remains under investigation. Putin turns his attentions to Georgia. Johannes Ulrich from the SANS Technology Institute and the ISC Stormcast podcast on weak two-factor authentications systems. Tim Erlin from Tripwire on their Infosecurity Europe 2017 survey. And familiar password advice gets jettisoned.

Supported by E8 Security, Johns Hopkins University, and Domain Tools.

In today's podcast, we hear about a security incident at EirGrid, a misconfigured server in Texas, and a demonstration of photovoltaic system hacking prompt power grid security concerns. Update on the Mandiant employee hack. "Mr. Smith" holds HBO for ransom (but says, no, he's really a good guy). Shipping industry looks for GPS backup capability, and shippers not hit by NotPetya enjoy an increase in business. Google patches ten Android remote-code execution vulnerabilities. Joe Carrigan from JHU on Facebook and Google eavesdropping conspiracy theories.  Juan Perez-Etchegoyen from Onapsis on Oracle business app vulnerabilities . NIST issues a Cybersecurity Workforce Framework.

Supported by E8 Security, Johns Hopkins University, and Domain Tools.

In today's podcast, we hear that the US Army bans, immediately, all use of DJI commercial-off-the-shelf drones. We discuss two known unknowns and offer some background on Defense acquisition practices. Amazon will begin scanning AWS customers' buckets for publicly accessible data. Dale Drew from Level 3 Communications offers his view on hacking back. White hat hackers offer recommendations for election security. And Marcus Huchins, a.k.a. MalwareTech, pleads not guilty to Kronos-related charges and makes bail.

Supported by E8 Security, Johns Hopkins University, and Domain Tools.

In today's podcast, we hear that security researcher MalwareTech has been arrested as the alleged author of the Kronos banking Trojan. Carbanak hoods release "Bateleur" into the wild, phishing in chain restaurant waters. A long DDoS attack in China seems aimed at extortion. German elections prepare for Russian influence operations, but the novelty may have worn off Moscow's line. US states and DHS work toward cooperative cybersecurity. Emily Wilson from Terbium Labs on dark web gun sales. William Saito on Japan’s cyber security preparations for the upcoming Olympics. The FBI is investigating the HBO hack.

In today's podcast, we hear that WikiLeaks has dumped "Dumbo" project documents. Separation of agencies as a way of rendering leaks less likely. HBO's hack is getting bigger, apparently. Group IB outs members of the United Islamic Cyber Force to Interpol. Cerber goes after Bitcoin. WannaCry ransom payments are being moved, perhaps laundered. Lawsuits loom over NotPetya as more companies warn the malware had a material effect. The FBI says you can't exercise your right to be forgotten by DDoS. Election fraud in Venezuela. Markus Rauschecker from UMD CHHS on large companies like FaceBook and Google being vulnerable to privacy and antitrust concerns. Jim Pflaging from the Chertoff Group, promoting their upcoming Security in the Boardroom event, speaking to the role of the board director when it comes to cyber security.And your guests can eavesdrop on you through your Amazon Echo. (But why would you have those people over anyway?)

In today's podcast we following up on some of the stories we've been tracking: the latest on Operation #LeakTheAnalyst, firmware spyware in down-market phones, Sweden's big breach, and Ukraine's new cyber friends. BrickerBot is back, offering Indian routers and modems unwelcome help. The US Senate considers IoT security legislation, and the US Justice Department issues a framework with guidelines for bug-hunting programs. Bitcoin's hard fork occurred yesterday. Robert M. Lee from Dragos, on ICS attack basics. David Murray from Corvil on security in the financial markets. And why people care about the HBO hack.

In today's podcast, we hear about the HBO hack, and the exposure of episodes and scripts Operation #LeakTheAnalyst targets individual security researchers. Election hacking: machines, databases, and public opinion are all targets. The UK's Home Secretary wants Silicon Valley to rethink strong encryption. Russia, like China, is clamping down on virtual private networks. The BTC-e Bitcoin exchange is shut down amid allegations of money laundering. Awais Rashid from Lancaster University on developing a security culture. Michael Janke from Data Tribe on his efforts to stand up the National Institute of Digital Security. And write this 500 times: "I will not mine Bitcoin on my school computer."

Black Hat 2017 has wrapped up, and by all accounts it was another successful conference, with an active trade show floor, exciting keynotes and engaging, informative educational sessions on a variety of topics. There was business being done, with hopeful entrepreneurs and investors alike looking to identify the next big thing in cyber security. In this CyberWire special edition, we’ve rounded up a handful of presenters and one investor for a taste of Black Hat, to help give you a sense of the event. 

Patrick Wardle is Chief Security Researcher at Synack, and creator of objective-see, an online site where he publishes the personal tools he’s created to help protect Mac OS computers. He’ll be telling us about his research on the FruitFly malware recently discovered on Mac OS. 

https://objective-see.com/

Hyrum Anderson is technical director of data science at Endgame, he will discuss research he released on stage at Black Hat showing the pros and cons of using machine learning from both a defender and attacker perspective. 

https://www.endgame.com/our-experts/hyrum-anderson

Zack Allen, Manager of Threat Operations, and Chaim Sanders, Security Lead, of ZeroFOX will be speaking about their Black Hat presentation on finding regressions in web application firewall (WAF) deployments. 

https://www.linkedin.com/in/zack-allen-12749a76

https://www.linkedin.com/in/chaim-sanders-a7a23713/

And we’ll wrap it up with some insights from Alberto Yepez, founder and managing director of Trident Cybersecurity, on the investment environment and the changes he’s seen in the market in the last year. 

https://www.linkedin.com/in/albertoyepez/

In today's podcast we hear that US investigators are looking for a disgruntled former insider in the ShadowBrokers case. Operation #HackTheAnalyst claims to have doxed a threat intelligence analyst. Electrical utilities look to their defenses. Trickbot gets wormy. NotPetya continues to have material effect on its corporate victims' earnings. Sweden's government shaken by its data breach. ISIS loses brick-and-mortar presence; may be moving online. Ransomware's lethality to small businesses may be exaggerated. And how do you fund a nuclear program? Malek Ben Salem from Accenture Labs, on their work developing a global ID system for refugees. From Pyongyang, Texas Hold 'Em looks like a good bet.

In today's podcast, we learn that WikiLeaks has dumped Vault7 documents attributed to the CIA. Russian catphish are said to have nibbled at French President Macron's campaign. North Korea mines Bitcoin. Malware warnings include a banking Trojan and two malicious Android apps. NotPetya's effect on TNT is said to have hit small businesses hard. MedSec has no regrets, and says it would short St. Jude again. The Pwnie Awards have been given at Black Hat. Justin Harvey from Accenture on recent waves of auto-propagating malware. Edna Conway from Cisco on third party risks. And the ShadowBrokers are back.

In today's podcast we hear there's a new catphish out in the wild: meet Mia Ash. WikiLeaks throws shade by dumping UMBRAGE from Vault7. Germany braces for hacking by Russia, China, and Iran—especially by Russia. Google kicks unwelcome intercept tool Lipizzan out of the PlayStore. WhatsApp scammers phish for banking credentials. Business disruption kills small businesses in ransomware attacks, not the ransom itself. Facebook makes a plea for culture change. Ben Yelin from UMD CHHS on allegations the FBI was paying the Geek Squad to ferret out illegal content on computers brought in for service. Neill Feather from SiteLock dispells the notion that small businesses can rely on security by obscurity. And there are enough anti-drone products out there to make Wyle E. Coyote max out his Acme loyalty card.

In today's podcast we hear about a Symantec study that shows APTs use some pretty buggy tools. Juche may not extend to the Internet, at least for Pyongyang's leaders. Iran's CopyKitten is characterized as unsophisticated but nonetheless effective. Mac users awakened by Fruitfly—the FBI is investigating. Adobe tells us to begin saying our goodbyes to Flash. Jonathan Katz from UMD on recent experiments with quantum cryptography. Stewart Kantor from Full Spectrum on protecting utility companies by using private RF (radio frequency) networks. And some notes from Vegas, because what goes on in Vegas doesn't stay there.

In today's podcast, we hear that hundreds of enterprises may be oversharing on Google Groups. Wells Fargo works to recover from botched e-discovery. Energetic Bear may be back, with some cunning phishbait. Pravda says Russians feel strange new respect in cyberspace. The CopyKittens appear to be Persian cats. Another Ethereum ICO is pilfered, but, contrary to expectations, the White Hat Group looks like a genuine group of white hats. Emily Wilson from Terbium Labs wonder what qualifies at personal information on the Dark Web. FICO's Doug Clare outlines scoring your cyber security posture. And some notes from Vegas.

In today's podcast, we hear about the wisdom of attending to your AWS Access Control Lists. Wells Fargo data leaked in the course of e-discovery. NotPetya fallout and investigation. The Islamic State's presence in cyberspace is getting a bit threadbare. Fruitfly has been buzzing through Macs, quietly, for a decade. Palo Alto Networks' Rick Howard describes a new security framework. Other dark web souks are poised to take the place of Alpha Bay and Hansa Market. And Ocean's 11 meet the IoT.

In today's podcast we hear about an international raid that took down the illicit Hansa Market—which, it turns out, the Dutch National Police had covertly taken over for about a week. Recovery from WannaCry and NotPetya continues its long slog. Banking malware is on the rise in the wild. Studies warn of power grid vulnerabilities. Devil's Ivy infests security cameras in the IoT. Digital Shadows offers a look at hackers' black markets and see similarities to the drug trade. Our newest partner Robert M. Lee from Dragos introduces himself and the ICS work he does. Guests are Leslie P. Francis and John G. Francis, coauthors of the book, “Privacy - What Everyone Needs to Know.”And our congratulations to Dr. Whitfielf Diffie, the newest Fellow of the Royal Society.

In today's podcast, we discuss a reminder from Amazon Web Services is timely: check your cloud's configuration. Hacks now seem to affect revenue for years. A rundown of some new threats and vulnerabilities. Apple issues security patches for iOS, MacOS, and Safari. Oracle fixes more than 300 bugs. Dale Drew from Level 3 Communications on the responsibilities of ISPs. Chris Ensey from Dunbar Cyber Security, on the roles states play in creating an environment for innovation and success in cyber security. And forget Mayweather-Macgregor—the pay per view we'd sign up for is Putin-Wittes.

In today's podcast, we hear about how another tippy AWS S3 bucket spills its contents over the Web. The FedEx 10-K report indicates it may never fully recover systems and data hit by NotPetya. Virus hides in Game of Thrones torrent. Harvard's Belfer Center wants to secure electronic voting. Departments of Commerce and Homeland Security consider moonshot research to take out botnets. M&A and venture funding notes. Justin Harvey from Accenture on fileless malware. Robert Hamilton from Imperva Incapsula on DDoS attacks on video game servers. And an initial coin offering gets hacked.

In today's podcast we hear more on how Qatar has accused the UAE of hacking, and vows legal retribution—all on the strength of a Washington Post story. UAE says it didn't do it. Warnings about vulnerabilities in commonly used IoT code. Markus Rauschecker from UMD CHHS on Facebook running afoul of European privacy laws. Tina Ladabouche, NSA GenCyber Program Manager, on the NSA’s GenCyber program, supporting summer camp programs. FBI warns of risks inherent in Internet-connected toys. And people really, really don't read those EULAs.

In today's podcast we hear that Qatar has accused the United Arab Emirates of a hacking and disinformation campaign—the UAE deny it. Russia's Foreign Ministry says it was hacked. Russia-experts in the US said to be receiving unwelcome attention from possible state intelligence services. Deterrence and confidence building measures remain works in progress in cyberspace. Ransomware and click-fraud combined in a single criminal campaign. Macs attacked by banking credential stealing malware. Johns Hopkins' Joe Carrigan reviews educational options for aspiring cyber security pros. Twitter bots driving traffic to dodgy adult sites. And Ashley Madison proposes a settlement for its 2015 breach.

In today's podcast, we hear that WikiLeaks dumps another alleged CIA cyber manual from Vault7. Cyberwar is the continuation of war (and therefore policy) by other means. Counting the cost of NotPetya. AWS S3 misconfigurations could happen to the best of us (but need not). Chasing innovation in the UK and the US. AlphaBay taken down in international police operation. Rick Howard from Palo Alto Networks on their new initiative with the Girl Scouts for cyber security merit badges. Raj Samani, chief scientist from McAfee, on NotPetya. And what kind of bait is best for phishing?

In today's podcast, we hear about signs that NotPetya was covering up a broad espionage campaign. State-sponsored hacking seems, when not simple spying, to aim at eroding trust. Verizon suffers a major customer data breach said to derive from a vendor's misconfiguration of an Amazon S3 bucket. Industry notes—venture funding and an acquisition. David Dufour from Webroot on homoglyph attacks. Thomas Jones from Bay Dynamics on federal agencies being required to submit a Framework Implementation Action Plan. Singapore will license white hats. And Russia wants you properly signed into adult sites. Or, at least, one of them, anyway.

In today's podcast we share some Patch Tuesday notes: Microsoft and Adobe both offer updates. Kremlinology goes cyber as infrastructure attacks remain under investigation. A cyber company emerges from stealth. The US General Services Administration removes Kaspersky Lab from Schedule 70. Election influence investigations turn to the question of Russian opposition research. Jonathan Katz from the University of Maryland explains a side-channel attack on 1024-bit encryption. Cisco's Jennie Kay wants to ease your trade show anxiety with a helpful webinar. And, Sheriff of Nottingham, call your office, because Robin Hood was no winker.

In today's podcast we hear about how Russia has apparently been phishing in the North American and European power grid. NATO has had about enough of that. There will be no US-Russian joint cybersecurity effort. The Adwin RAT is back, and seeking to socially engineer its way into aerospace company networks. Election hacking investigation updates. Industry notes, including both venture and M&A news. Level 3 Communications' Dale Drew provides an update on botnets. Ntrepid's Lance Cottrell describes online ad tracking technology. And BYOD can pose a threat, especially when the device your rogue employees are bringing is an off-the-books server.

In today's podcast we discuss some answers to two Russian claims. No, Russia and America won't be linking up in a cyber alliance. And no, no one at the G20 meetings actually bought the line about election hacking retailed there by President Putin and Foreign Minister Lavrov. NotPetya recovery continues. Android infestations in the wild. US power plants warned to be alert for cyberattack. Criminals compromise self-service food kiosks; others phish with official-looking Australian emails as bait. Ben Yelin from UMD CHHS reviews license plate reader laws. ISIS adopts misspelling as a form of OPSEC.

In today's podcast, we hear that NotPetya still looks like a Russian campaign to Ukrainian authorities, and experts remain skeptical that affected data can be recovered. Companies warn that NotPetya may have a material effect on earnings. WikiLeaks dumps Gyrfalcon and BothanSpy documents from Vault7.  Johannes Ulrich from SANS and the ISC Stormcast Podcast on no SQL database security. Andy Greenberg, senior writer at WIRED, on his July 2017 issue cover story on Ukraine cyberwar. And pro wrestling fans now have something in common with registered voters, data.gov.uk, and the National Geospatial Agency.

In today's podcast we hear about the Ukrainian police raid on Intellect Service and their seizure of M.E. Doc servers. Ukraine's Interior Ministry says this stopped a second wave of NotPetya. Affected companies continue to recover from the NotPetya infestation. US Cyber Command prepares to parry hybrid warfare. Spyware campaign hits Chinese-language news services. The EU considers adopting a "right to repair." Joe Carrigan from the Johns Hopkins University ponders always-on cameras.  Dan Larson from CrowdStrike on fileless attacks. Medical information-sharing runs into problems in the UK. 

In today's podcast, we hear how affected enterprises are restoring services after last week's NotPetya pandemic. Maersk's experience prompts some introspection in the logistics sector. Ukraine prepares to charge ME Doc's maker with criminal negligence for allowing the infection to take hold. NotPetya tied to BlackEnergy and thence to a "state actor" (NATO's not saying it's Russia, but Ukraine is). Awais Rashid from Lancaster University looks at the anatomy of recent attacks. Haiyan Song from Splunk on a recent IDC report, “Investigation or Exasperation? The State of Security Operations.” FSB certificates allegedly express links between FSB and Kaspersky.

In today's podcast, we hear that recovery from Petya/Nyetya/NotPetya proceeds—and it's not ransomware. Ukraine says Russia's responsible. US warnings of cyberattacks on nuclear power plants may have been premature. NATO members consider when to invoke Article 5 in cyberspace. Islamist inspiration and other political discontents continue to prompt content screening in Europe. Europe is also in punitive mood with respect to regulation. Kaspersky says it will show the US its source code if that's the cost of doing business. Markus Rauschecker from UMD CHHS describes a novel use of kidnapping insurance. And, hey, Lords and Commons: that's not really Windows support asking for your password.

In today's podcast we hear that Petya/Nyetya/NotPetya is almost certainly a wiper, and not ransomware after all. Ukraine blames Russia, but whoever did it had EternalBlue before the ShadowBrokers leaked it. WikiLeaks Vault7 disgorges OutlawCountry, a Linux attack tool. The ShadowBrokers raise their rates. Emily Wilson from Terbium Labs with research on fraud guides on the dark web. Guests are Drew Gidwani, Director of Analytics at ThreatConnect, and Andy Pendergast, VP of Product & Co-Founder at ThreatConnect, speaking about the findings of a recent SANS Survey on Security Optimization. Russia calls for international cooperation to stamp out cybercrime. 

In today's podcast we hear that the current Petya/Nyetya/NotPetya outbreak down deep doesn't look like ransomware, but a wiper, and a nasty one at that—probably a cyber warfare campaign. How are these three things alike: shipping, manufacturing, and Big Law? The ShadowBrokers are back, and WikiLeaks' Vault7 disgorges what looks like a creepy stalking tool. Other non-Petya ransomware attacks. Rick Howard from Palo Alto Networks explains the importance of capture-the-flag competitions. And officialdom seems to cling bitterly to Windows XP.

The IoT, or Internet of Things, broadly defined is the collection of physical objects with IP addresses, connected to the internet. From consumer devices like security cameras, DVRs, and smart thermostats to industrial control systems and autonomous cars, the IoT offers potential for both opportunity and vulnerability. 

In the first half of this CyberWire Special Edition, we speak with IoT experts Katie Curtin, director of IoT cyber security product management for AT&T, and Chris Poulin, Principal at Booz Allen Hamilton, where he leads internet of things security strategy for their strategic innovation group, as well as their industrial control group. 

They provide their take on the current state of the internet of things for consumers, enterprise, industrial control and even self-driving cars.

In the second part of our program, we examine third party risk. Ponemon Institute recently released an independent research report titled, “The Internet of Things - a New Era of Third Party Risk.” Dr. Larry Ponemon is the chairman and founder of Ponemon Institute, and he’s going to take us through some of the report’s findings, but first we’ll hear from Gary Roboff, a senior advisor at Shared Assessments and their Santa Fey group, who were the sponsors of the report.

Today we speak at length with Tanium's Chief Security Architect on tracking the Petya ransomware pandemic.

In today's podcast we hear that another ransomware pandemic has broken out—this one looks more sophisticated and dangerous than WannaCry. Ukraine is again the center, but it's moving out fast. Notes on the Parliament email hack in the UK. Accenture's Justin Harvey explains destructive malware. IBM's David Jarvis advocates an adoption of a "new collar" recruiting strategy. And ISIS isn't doing much cyber damage, but its hacktivist sympathizers are really tugging on Superman's cape.

In today's podcast, we hear that the UK's Parliament recovers from a brute-force attack. Reports on election hacking in the US suggest there was some American cyber retaliation last year against Russian influence operations. BlackTech goes after intellectual property in East Asia. Windows Defender gets a patch, but Windows 10 source code leaks. Fireball malware's extent is disputed. ISIS hacktivists deface websites associated with the government of the State of Ohio. Webroot's David Dufour offers thoughts on phishing. And how much can we count on common sense?

In today's podcast we hear about how Brutal Kangaroo has hopped out of Vault 7—don't let it poke your device with a thumb drive. Big data leaks wind up being traded on the black market. The dangers of careless configuration of an S3 bucket. Ransomware remains pricey. It can also serve as misdirection. Dale Drew from Level 3 Communications shares lessons from WannaCry. Darron Gibbard from Qaulys offer his take on the EU's GDPR. Software companies receive and respond to code audit requirements as a condition of doing business in Russia.

In today's podcast we hear that WannaCry's still here—just ask Honda and the Australian state of Victoria. North America and Europe work to secure their grids against CrashOverride. The US Congress hears testimony about Russian election influence ops: they didn't change the vote, but did they ever shake people up. Business email compromise scams hook sophisticated victims. The Queen's Speech says that, whatever else Brexit may mean, it won't mean a GDPR exit. Johns Hopkins University's Joe Carrigan review the ease of listening in on RF traffic. Asaf Cidon from Barracuda Networks on the increased threat from ransomware. And what's all this about CISOs and root canals? We didn't know that was an alternative to bearing bad news to the Board.

In today's podcast, we hear that nation-state influence operations against elections prompt investigation, introspection, and policy studies. We also hear about the implications of a major voter database exposure in the US, and about what might be done to mitigate such risks. Lancaster University's Awais Rashid shares research on security stakeholder biases. Arlen Frew from Nominum on small business vulnerabilities. Leaks from intelligence services seem to be inflicting collateral damage on Internet users as they find their way into criminal hands.

In today's podcast, we hear that some believe they've seen the Professor Moriarity behind 2017's Android malware outbreak. Erebus is back, and this time it's in Linux. Mirai may be about to become more resistant to cleaning. Crytpo wars flare in the UK and EU as terror investigations proceed. A quick look at SINET's Innovation Summit. Raytheon's DHS cyber contract survives challenge. CrashOverride looks to a lot of experts like a proven cyber weapon. Ben Yelin from UMD CHHS discusses a "right to know" privacy law. Perspectives on attribution from John Brick of the DNG-ISAC. And did the dog eat the Fort's homework, or did some Bear feed said homework to the dog?

In today's podcast, we hear that Google is in an "uphill battle" against adware infestation of the PlayStore. GCHQ seems to agree with NSA, which seems to think WannaCry was a North Korean caper. Big data firm leaves voter data exposed on an Amazon S3 account. GCHQ says the Russians didn't disrupt the recent UK elections. Dr. Charles Clancy from VA Tech's Hume Center describes methods for preventing another Dyn-style attack. Two hackers sentenced, one in Pennsylvania, the other in East Anglia, one for the vengeance and one for the lulz.

In today's podcast, we hear that WikiLeaks has dumped more of Vault7. More attribution of WannaCry to North Korea, where Hidden Cobra and the Lazarus Group appear to be one and the same. FIN10 cybercriminals are asking US and Canadian businesses for a big payoff to head off a big doxing. Conventional ransomware hits British universities. Kasperky and Avast release free decryptors for Jaff and EncrypTile. Markus Rauschecker from UMD CHHS reviews China's new cyber laws. Jocelyn Aqua from PwC describes attitudes toward AI. The ISAC process seems to be working. And patch early, patch often.

In today's podcast, we hear that the FBI and the Department of Homeland Security have warned that Hidden Cobra actively pursuing DDoS campaigns. Microsoft patches remaining ShadowBrokers' exploits, even in deprecated systems. The US Congress votes to sanction Russia for election influence operations. Those operations have a long, long history, going back to the 1930s at least. Electrical and natural gas sectors work to protect themselves against CrashOverride. Emily Wilson from Terbium Labs reminds us not to forget the basics. Michael Callahan from Firemon shares survey data suggesting that IT pros spend too much time fixing their coworkers personal devices. Mergers and acquisitions seem to be followed by layoffs—Hexadite is said to be the latest case.

Robert M Lee from Dragos provides an overview of CrashOverride. A quick look at yesterday's Patch Tuesday. Some of the fixes even reached back into Windows XP's unquiet grave. Terrorist information operations are increasingly sustained by cryptocurrency funding. Accenture's Justin Harvey reviews automation and orchestration. Russian intelligence may have been more active probing US state election systems than previously thought. Fake-news-as-a-service is now a black-market offering.