CyberWire Daily

In today's podcast, we hear that Pegasus is now in the Android ecosystem. British authorities warn of possible ISIS cyberattacks on infrastructure. Russia investigates the St. Petersburg metro bombing. New evidence connects North Korea with the Lazarus group. Fancy Bear continues to romp unabated, and Turla seems to have remained quietly active for about twenty years. Zero-days reported for Samsung's Tizen. Our coverage of the Women in Cybersecurity Conference continues, featuring a conversation with Endgame malware researcher Amanda Rousseau. Virgina Tech’s Hume Center’s Dr. Charles Clancy describes telephony DDOS. Apple issues an emergency iOS patch. Industry notes, and tax season security advice.

In today's podcast, we hear that WikiLeaks has dumped what it claims are CIA source code files. The leak seems to aim at raising suspicion that attacks attributed to foreign governments are in fact false-flag operations. The International Association of Athletics Federations says it was hacked by Fancy Bear. Two new RATs—remote access Trojans—are discovered in the wild. ISIS takes some cyber hits, and an investigator outlines the group's information operations manual. At the annual Women in Cyber Security Conference we catch up with US Naval Academy Midshipmen Svetla Walsh and Deja Baker. David Dufour from Webroot reviews their latest threat report.

In today's podcast, we hear about how Fancy Bear left tracks in Bitly, and Fancy Bear did an awful lot of phishing going back to March 2015. Experts take a look at Russian espionage and influence operations, and they draw some disturbing conclusions. The EU seems ready to go anti-encryption—how that will work with the EU's regulatory emphasis on privacy is anyone's guess. The University of Maryland's Jonathan Katz explains the recent Z-Coin crypto-currency bug. Bob Ackerman from Allegis Captical and DataTribe offers insights on the investment environment for cyber. And no, that's not a famous theologian tweeting: it's the head G-Man.

In today's podcast, we hear about Apple's patches issued this week—how are your systems? Lastpass is working on a patch for an undescribed bug (said to be a complicated one). What IT staff actually work on. Politico's Eric Geller discusses emerging Trump Administration cyber policy. Emily Wilson from Terbium Labs outlines the data breach timeline. 

In today's podcast, we pass on what we've heard at ITSEF about Russian hybrid warfare: it aims, experts say, at redressing the loss of the Cold War. Microsoft Internet Information Services (IIS) 6.0 found vulnerable to a buffer overflow attack. Cerber ransomware evolves to evade detection. Bugs found in Siemens ICS products. VMWare patches vulnerabilities. Laptops with sensitive information lost in Hong Kong and New York. Joe Carrigan from the Johns Hopkins University Information Security Institute reviews a teddy bear who can’t keep a secret. Peak10’s David Kidd outlines compliance advantages of the cloud. Malicious USB sticks strewn around a Canadian university campus.

In today's podcast, we hear how Cozy Bear slips through with domain fronting. Shamoon's infection methods are revealed. The crypto wars flare over not-so-lone wolves, but there are some genuine lone wolves out there as well. Medical and dental practices warned against attacks on FTP servers. A networked sterilizer is, well, digitally unhygienic. Docs dot com search functionality temporarily disabled. Remember, if you want to reach the G-men, it's FBI dot GOV, not dot com. The UMD Center for Health and Homeland Security's Ben Yelin examines a case where a defendant's expertise is being held against him. Brian Brunetti from Route1 warns about VPN insecurity. Scareware hits iOS users. And a Brooklyn prosecutor gets bad advice from the old heart.

In today's podcast, we hear that British police think ISIS not-so-lone wolves may have been howling over WhatsApp. WikiLeaks still disgruntled over its disclosure offer's cool reception. March-Madness is also phishing season. How and why online gamers cheat. GiftGhostBot drains gift-card balances. States mull next steps after the America's JobLink breach. CrowdStrike walks back some claims in its Ukrainian artillery hacking report, but insists the hack was real, and that signs point to Fancy Bear. Lancaster University's Awais Rashid warns of the use of open source intel in social engineering. Wall Street Journal tech reporter Sarah Needleman explains the esports cheating arms race. April 7 marks two deadlines for cyber actions; observers hope for two fizzles.

In today's podcast we hear assessments of WikiLeaks' latest Vault 7 files—compromised supply chain or damp squib? NATO worries about Russian information operations. ISIS continues to push jihadist inspiration online, claiming the London killer as one of the Caliphate's soldiers. Facile attribution can mislead, as seen in a surprising arrest. Comments on America's Joblink Alliance breach. Acalvio's Chris Roberts wonders if AI and Machine Learning are all they're cracked up to be. Palo Alto Networks' Rick Howard has an update on the Cyber Threat Alliance. And Estonian experience suggests to the world that President Putin is a proud spirit who cannot endure to be mocked.

In today's podcast we offer a rundown of recently announced threats and vulnerabilities in stores and documents: Play Store, App Store, and MS Office. Some crooks move to the cloud. GoDaddy buys Sucuri. The US is rumored to be preparing a North Korean indictment for the Bangladesh Bank heist. Social media look for bad bots. Level 3's Dale Drew describes botnet evolution. LookingGlass' Eric Olson explains FaceBook Marketplace security. And some dodgy scientific journals seem to use catphish for peer review.

In today's podcast, we hear that laptop flight restrictions spread as security services continue to grapple with ISIS inspiration operations. The Necurs botnet returns, but now it's swapped pump-and-dump scams with penny stocks for its usual ransomware payloads. MajikPOS is active in the North American wild. Joe Carrigan from the Johns Hopkins University Information Security Institute reviews lessons learned from the Cloudbleed event. Philip Susmann describes Norwich University's DECIDE cyber simulation platform. And the Bangladesh Bank hack looks like it may have been a North Korean job. 

In today's podcast, we hear about the claim that "the Turkish Crime Family" is holding iPhones hostage. WikiLeaks grumbles that it has few takers for its Vault 7 bugs. Germany raises its state of cyber alert, pre-election. The US expects more Russian cyber and influence operations. A Russian bank says it was framed (and maybe it was). UMD's Jonathan Katz provides technical details on the recent SHA-1 collision. Mandiant's Ronald Bushar gives us highlights from their M-Trends report. Fears of a "cyber Pearl Harbor" may distract from real ICS risks. And no, Martians haven't landed in New Jersey.

In today's podcast we ask whether careless cyber criminals working for the FSB blew the gaffe on the Yahoo! hack. WikiLeaks offers to share Vault 7 vulnerabilities with vendors, but it wants something in return. A look at the Atlantic Council's recently concluded Cyber 9/12 competition. Does cabin fever increase the risk of being hacked? Enigma Software saw things during last week's unseasonable US weather that suggests it might. We welcome David Dufour from Webroot to the show as our newest industry partner. And Kirk ransomware is ready to beam into your enterprise.

In today's podcast, we hear about observers who look around and think they may be seeing Cold War Two in cyberspace. (But this is no bipolar conflict.) Investigation into Vault 7 continues as people wonder where WikiLeaks gets its leaks. The quiz app Wishbone has been breached—take it as a teachable moment with the children. Fileless malware gets quieter as researchers get close to the cyber gang. A cloud-based keylogger is getting ready to take black market share. Palo Alto Networks' Rick Howard describes a capture-the-flag collaboration. Futurist Brian David Johnson explains Threatcasting. The proposed Active Cyber Defense Certainty Act. And what we're seeing at a policy competition.

In today's podcast we hear about the return of the the Lazarus Group (or maybe it never really left). A Dun & Bradstreet database is compromised—more than thirty-three million are said to be affected. British travel association ABTA suffers a breach. Notes on identity theft. Netherlands voter information sites hit with DDoS—Turkish hacktivists (or government operators) suspected. The University of Maryland's Center for Health and Homeland Security's Markus Rauschecker describes the increasingly important role of cyber lawyers in M&A activity. Digital Guardian's Tim Bandos has methods for protecting against state sponsored actors and hacktivists. The US indicts four in the Yahoo! breach—two of them have FSB connections.

In today's podcast, we look as influence operations in the UK and in Europe: the former emanate from Russia, the latter from Turkey. Third-party social media apps increase your attack surface. Petya ransomware is stolen and improved by rival crooks. Google purges bad apps from the Play Store. Patch Tuesday notes. A convicted leaker offers some unexpected wisdom for prospective whistleblowers. Lawyers can't figure out the GDPR. US said ready to indict four for the Yahoo! breaches. Emily Wilson from Terbium Labs discusses the effects of high profile breaches on Dark Web markets. Justin Harvey from Accenture Security wonder if private sector attribution is dead. And we bid a respectful farewell to Becky Bace, one of our industry's thought leaders.

In today's podcast, we hear about how the Apache Struts bug has bitten in Canada. FireEye sees financial cybercrime approaching state espionage exploits in sophistication. The US Air Force leaves sensitive personal information exposed in a backup database. Investigation into WikiLeaks' Vault 7 continues. Okta files for its IPO. Ben Yelin from the UMD Center for Health and Homeland Security reviews a mobile device privacy bill. Adam Thomas from Deloitte outlines their latest cyber insurance report.  And today is Patch Tuesday.

In today's podcast, we review some speculation about Vault 7 that holds the leaker was an insider. (But there's no specific insider named, yet—the investigation is still in its early stages.) Supply chain security issues are raised by both Vault 7 leaks and discovery of pre-loaded malware in some Android devices. Bitcoin won't get its own ETF, yet. Japanese companies willingness to "pay to make it go away" is seen playing into the hands of ransomware extortionists. Dr. Charles Clancy from Virginia Tech's Hume Center surveys the end-to-end encryption debate. Novetta's Dr. Corey Petty previews his upcoming Etherium smart contracts presentation. GCHQ warns Britain's political parties to expect Russian influence operations in the general election.

In today's podcast, WikiLeaks offers to enter the responsible disclosure game, but be warned: there are legal problems should you accept classified information. Some AV companies tout their reviews in Vault 7. Speculation about how CIA hacking notes leaked turns to an insider threat. HackRead warns that Playstation credentials may have been compromised. The Apache Struts vulnerability is being exploited in the wild. Observers cast doubt on reports the US successfully hacked North Korean missile launches. Joe Carrigan from the Johns Hopkins University Information Security Institute weighs in on SHA-1. Comodo's Kenneth Geers share insights from their 2016 Global Report. Trend Micro and Interpol take a look at the West African cybercrime scene.

In today's podcast, we follow the Vault 7 story and the false flags that really aren't there. A call for more stress-testing of software. RAND reports on the market for zero-days. The Near Abroad warns the US that it would like to see more American soft power deployed in their part of the world. Jonathan Katz from the University of Maryland praises Google's Project Wycheproof. VMWare's Tom Corn provides his take on the promise of secure cloud environments. 

In today's podcast we talk over the latest news, rumors, gossip, and common sense surrounding WikiLeaks and its Vault 7 dump of hacking tools and other spy stuff. And wait a minute—do angels really weep? After all, they're supposed to be pure intelligence. But you came here for the hacking, not the angelology, and there's a lot of stuff dancing around in Vault 7. Research Scientist Jim Walter from Cylance weighs in with his take. Some people even see dancing Bears, but we think they're seeing things. Dale Drew from Level 3 Communications tracks changes they’re seeing in DDoS attacks.

In today's podcast we hear about how StoneDrill maybe succeeding Shamoon—it's more evasive and at least as destructive. Malwarebytes advises sticking to Google Play to avoid a new Trojan. Russian hackers—apparently mobsters who've copped some of Cozy Bear's MO—are blackmailing US progressive political groups. The University of Maryland Center for Health and Homeland Security's Ben Yelin explains Amazon Alexa's role in a murder case. Neill Feather from SiteLock describes a Wordpress vulnerability.  Congress considers a bill to allow companies to hack back. WikiLeaks' Vault Seven seems mostly unsurprising. Washington wiretapping allegations prompt recriminations.

In this CyberWire 2017 RSA Conference special edition, we wrap up our show coverage with insights from experts, about the trends they’re seeing, the products they’re pitching, and where they think we, as an industry, need to go.

Guests include:

Mark Dufresne, Director, Threat Research and Adversary Prevention, Endgame

https://www.linkedin.com/in/mark-dufresne-b3275610a/

James Lyne, Global Head of Security Research, Sophos

https://www.linkedin.com/in/jameslyne/

Emily Mossburg, Principal, Cyber Risk Services Leadership Team, Deloitte & Touche

https://www.linkedin.com/in/emilymossburg/

Mark Nunnikhoven, Vice President, Cloud Research, Trend Micro

https://www.linkedin.com/in/marknca/

Levi Gundert, Vice President of Intelligence and Strategy, Recorded Future

https://www.linkedin.com/in/levigundert/

Carl Leonard, Principal Security Analyst, Forcepoint

https://www.linkedin.com/in/carl-leonard-5486405/

Evan Blair, Founder, ZeroFOX

https://www.linkedin.com/in/evanblair/

Gabby Nizri, Founder and CEO, Ayehu Software Technologies

https://www.linkedin.com/in/gabbynizri/

Jason Porter, Vice President Security Solutions, AT&T

https://www.linkedin.com/in/jason-porter-4a604757/

In today's podcast, we hear about warnings from Cisco's Talos unit and others concerning DNSMessenger, a dangerous and evasive RAT. DDoS hits Luxembourg government sites and remains a threat to businesses. The US is said to be running a cyber campaign against North Korea's ballistic missile program. The US Defense Science Board releases its report on cyber-deterrence. Rick Howard from Palo Alto Networks explores the history of security orchestration. Mutual recriminations over allegations of election-season campaign surveillance swirl in the US.

In today's podcast, we review some encouraging news about Android apps, Cloudbleed, and Slack's swift bug patching. Amazon finds a typo at the root of Wednesday's internet outages. Symantec opens a venture arm. Yahoo! breach post mortems continue. Decryption tools for Dharma ransomware are out. Prospects look dim, again, for Wassenaar. China calls for the demilitarization of cyberspace. Terbium's Emily Wilson surveys the Dark Web scene during tax season. MasterCard's Melanie Gluck takes us behind the scenes of credit card security. And the security sector bids farewell to Howard Schmidt—leader, advisor, and mentor. 

In today's podcast we hear about how a criminal gang is deploying sophisticated malware against remote banking system customers. Business email compromise continues to appear in the wild—be good to your proofreaders, CEOs. Telegram being used by phone scammers. FCC privacy and caller-ID blocking regulations debated. Vulnerable WordPress plug-in found. Markus Rauschecker from the University of Maryland Center for Health and Homeland Security reviews the privacy implications of Smart Cities. Tony Guada from ThinAir explains the weaponization of data. And life sure was a lot easier before toys became part of the IoT. 

In today's podcast, we hear that yesterday's Internet outages were due to errors in Amazon's S3 servers. Dridex has evolved to become more evasive. The Necurs botnet acquires a DDoS capability. Web cache deception attack technique is described. Austrian authorities think they have a suspect in the attempted cyberattack on Vienna's airport. Palo Alto buys LightCyber. Companies continue to grapple with GDPR compliance. Uncertainty about US policy direction expected to drive an increase in foreign cyber espionage. The University of Maryland's Jonathan Katz reviews encryption types. Jon Gross from Cylance explains Snake Wine. Congress thinks about casus belli in cyberspace. And in the IoT, people are worried about everything from Terminators to Teddy bears.

In today's podcast, we learn that the BND may have been listening to the BBC, but not in a good way. Cylance reports on Snake Wine, a curiously familiar vintage sniffed in Japanese networks. Singapore's military sustains a phishing campaign without sustaining apparent damage. Google discloses more unpatched Microsoft vulnerabilities, these in IE and Edge browsers. Criminals claim to have exploited Cloudbleed, but the jury's still out. Joe Carrigan from the Johns Hopkins University's Information Security Institute helps us understand Cloudbleed. Steven Grossman from Bay Dynamics reviews New York State's newly enacted cyber regulations. And watch your language around those networked stuffed animals.

At the 2017 RSA conference, artificial intelligence and machine learning were on just about everyone’s list of hot topics. Countless companies are offering AI and ML solutions, with many of them claiming “game changer” status. In this CyberWire special edition, we gather a group of experts to help sort through the hype, try to agree on some definitions, demystify the technology, and make the business case for artificial intelligence.

In today's podcast, we hear how Cloudflare suffered from Cloudbleed. The bug's now swatted, but it will take a lot of people some time to clear up their passwords. Spora ransomware's customer service gives lousy service. TrumpLocker ransomware's just VenusLocker poaching some brand equity. Pen testers say they can break into most networks in under twelve hours. FBI asked again how it gained access to the San Bernardino jihadist's iPhone. Update on the Moscow treason trials. The University of Maryland Center for Health and Homeland Security's Ben Yelin describes some unintended consequences from a Trump executive order. Headed to Coachella? Hang onto your passwords.

SHA-1 is broken, for real. Grizzly Steppe threat actors seem to have a lot in common with the Carbanak gang. Bitcoin exchange hit by DDoS. Linux patches an old vulnerability. Reuters says Symantec was in talks to buy FireEye, but the companies backed away from a deal. An arrest in the Deutsche Telekom hack. Dr. Charles Clancy from Virginia Tech's Hume Center explores the designation of election systems as critical infrastructure. Jason Porter from AT&T decribes the newly formed IoT Cybersecurity Alliance. And what the vulnerability researchers found when they looked at connected cars.

In today's podcast, we hear about how Patcher ransomware is infesting Macs. Locky, Cryptowall, and Cerber are also still out and about in the wild. NSA seems likely to continue its Vulnerabilities Equities Process. Industry reactions to New York State's coming cybersecurity regulations for financial institutions. A look back at RSA discussions of cyber warfare. Further developments in the study of BugDrop malware. Terbium Labs' Emily Wilson examines the way novel exploits becomes part of the standard tool kit. And TruSTAR looks at Grizzly Steppe and has some thoughts on the difficulties of attribution.

In today's podcast, we hear from Paris that Moscow's not welcome in upcoming French elections. A new version of Mirai is out, spreading through Windows systems. Researchers warn of FTP protocol injection vulnerabilities in Python and Java. A new JavaScript exploit may affect Internet Explorer. New York State's new financial sector cyber regulations take effect next Wednesday. The Johns Hopkins University's Joe Carrigan reviews privacy tools from the EFF. Mark Dufresne from Endgame explains Fileless Attacks.  A quick glance back at RSA, and some analysts' thoughts on why Verizon still wants Yahoo!'s assets. 

In today's podcast, we hear that analysts are predicting a surge in North Korean hacking after China embargoes coal. ViperRAT catphishes the IDF. Magic Hound and Shamoon both use malicious macros to infect victim systems. TASS says no one really knows who hacked OSCE. Sputnik teases with a WikiLeaks tease. RSA Security's Zulfikar Ramzan offers insights from the conference. UMD Center for Health and Homeland Security's Markus Rauschecker explains how Airbnb might be affecting some foundational elements of the internet. Google shames Microsoft over patching. NIST has cyber advice for power utilities. Some RSA notes, and My Friend Cayla gets the boot from Berlin.

In today's podcast, we talk about hybrid warfare, with disinformation, cyber espionage, and spyware infestations—we also hear calls for norms of cyber conflict. BugDrop is active in Ukraine, and researchers see some cut-and-paste oddness slip from Fancy Bear's paws. A new X-Agent variant is out: this one infects Macs. Ransomware thumbs its nose at security products. A look at RSA trends as the conference closes. A converation with City of San Diego CISO and author Gary Hayslip. Rick Howard from Palo Alto Networks on a new addition to the Cyber Canon that's all about DevOps. And where do we get one of those "Has no purchase authority" T-shirts?

In today's podcast, in addition to notes from RSA, we hear some fresh accusations of Russian government hacking from Ukraine. Threat actors adapt. ASLR bypass exploit demonstrated. Yahoo!'s acquisition by Verizon appears likely to be deeply discounted. From RSA, notes on coming industry consolidation. Dale Drew from Level 3 Communications offers a strategy for choosing security vendors. James Lyne from Sophos provides his take of the RSA conference from the show floor. An update on the Popr-D3 Android malware. How they name the bears.

In today's podcast we consider the difficulty of distinguishing nation-state hacks from criminal capers. It's not always clear, and sometimes it's a distinction without a difference. But in any case, many call for international norms of cyber conflict. Waterholes and catphish. Ben Yelin reviews President Obama's security legacy. Steve Grobman from Intel Security on the challenges of changing course. RSA is at its midpoint; we offer some of what we're hearing on the floor about false alarms, where to draw the perimeter, and concerns about the Internet-of-things.

Researchers look into a wave of attacks on financial institutions. Microsoft calls for Geneva Convention for cyberspace. We take a look at phishing. The RSA conference is underway, and we’ve got news from the innovation sandbox, and venture capitalists. Trevor Hawthorn from Wombat Security shares insights from their State of the Phish report. Emily Wilson from Terbium Labs outlines nationalism on the dark web.

In today's podcast, Hamas appears to have improved its cyber attack capabilities. Egypt is believed to be ramping up Internet surveillance. ISIS sympathizers are being targeted with Android malware delivered over Telegram. The US increasingly integrates cyber into kinetic military operations. Russia is suspected of hacking the Italian Foreign Ministry. Malek Ben Salem from Accenture Technology Labs describes privacy techniques for data mining. And, of course, we begin our coverage of RSA in in San Francisco with a look at the annual Innovation Sandbox.

In today's podcast we hear about patching: the good, the bad, and the ugly. But mostly the good. Dridex is back. Brussels airport hacker turns out to be a literal script-kiddie, with the emphasis on the "kiddie." Moscow treason trials shut down Russian cooperation with Western law enforcement. Robert Lord from Protenus returns to share their Breach Barometer Report results. Ben Yelin from the University of Maryland Center for Health and Homeland Security revisits the Playpen case. Industry notes, a look ahead to RSA, and some Valentine's Day advice.

In today's podcast we review some updates on the Martin NSA-contractor case. Fileless malware hits banks worldwide. DDoS tools undergo refinement. Researchers take a look at ransomware developments. It's been an active week for the cyber sector in mergers, acquisitions, and venture funding. There's a new industry consortium for IoT security, and an autonomous vehicle consortium issues a manifesto for cooperation. Conga CISO Travis Howe shared his thoughts on privacy. The Johns Hopkins University's Joe Carrigan provides tips on third party DNS. And we suggest some good alternatives to doing random stuff.

In today's podcast, we hear that ISIS-affiliated hackers deface UK National Health Service sites with propaganda. Turkish Islamists DDoS Austria's parliament. Poorly crafted, but troubling, Mac malware seems linked to Iran. Criminals follow the money into the cloud. Salient buys Triple I, Malwarebytes picks up Saferbytes, and Sophos buys Invincea. Pala Alto Networks' Rick Howard walks us through the adversary playbok. The author and purveyor of the Dendroid RAT gets probation.

In today's podcast, we hear about brokerages in Taiwan being extorted with threats of DDoS. Polish banks compromised in watering hole campaign. Criminals turn from JavaScript to less obviously suspicious kinds of files. Cyber vigilantes poke at unsecured printers and dark web hosting. China ratchets up its efforts to control its Internet. The US shares classified intelligence on Russian influence operations with European allies, and works on its own information operations capability. Dale Drew from Level 3 Communications takes note of the increase in ransomware. Rami Essaid from Distil Networks describes efforts to combat ticket scalping bots. And a former NSA contractor will probably face espionage charges related to the ShadowBrokers.

In today's podcast, we hear about how criminal markets offer ransomware-as-a-service under the guise of education. The UK's NHS and Licking County Ohio deal with separate ransomware attacks. The Slammer worm tried a comeback after fourteen years—so patch those known vulnerabilities. Crooks scammed slot machines, possibly by defeating their pseudo-random number generation. Norway tracks Fancy Bear. Russia says FSB officers charged with treason gave info to the Americans, but not necessarily the CIA. Markus Rauschecker outlines proposed changes to the email privacy act. GCHQ says security companies are peddling "witchcraft."

In today's podcast, we hear reports that Cellebrite forensic tools have been dumped online. The IRS warns that W-2 fraud is being combined with business email compromise. Cisco router vulnerabilities are under discussion. A Windows zero-day can produce the blue screen of death. Recent surveys prompt a review of enterprise security spending priorities: the perimeter is down, the endpoint is up, and network visibility is everywhere. Russia's treason trial proceeds. The US sends a good-cop/bad-cop message, or maybe just a mixed message, in cyber. Accenture Technology's Malek Ben Salem discusses embedded device security. Author Frederick Lane on his latest book, Cybertraps for Expecting Moms and Dads. And is Hogwarts in Buckinghamshire, or the Monongahela Valley?

In today's podcast, we hear about how criminals are recruiting company insiders, and how the black market trades insider information for illicit speculation. Cisco studies the costs and causes of data breaches, and the security industry offers reactions. Jonathan Katz from the University of Maryland describes searchable encryption. Vadim Vladimirskiy from Nerdio explains IT as a Service. The Internet seems to serve, again, as an R&D resource for threat actors. This time it's ISIS and commercial drones, but there's a lot out there for sale and trade. 

Bear prints in the Czech foreign ministry. Tinker, tailor, soldier, hacker in Moscow, with a side of Humpty Dumpty. Gamer forum data breaches go undetected for seventeen months. Credential reuse (and the limitations of human memory) are seen as a big threat to security. An IBM study throws up its hands over the state of healthcare cyber security. Trustwave's Chris Schueler reviews their latest report on resource limitations. Emily Wilson from Terbium Labs tracks the increased use of doxing. And Phineas Phisher, depending on whom you believe, is either under arrest or still at large.

In today's podcast, we review some ransomware developments: the good, the bad, and the ugly. Netgear routers and the mom-and-pop dilemma. Breaking Android pattern locks. Facebook has a novel approach to password recovery. Keysight will buy Ixia, and IBM's acquisition of Agile 3 Solutions gets positive analyst reviews. Australia's Data61 innovation shop wants to go all-in for cyber. ISIS makes hay of US immigration policy, but the group shows signs of cracks. Ben Yelin from the University of Maryland Center for Health and Homeland Securty revisits the CoinBase vs IRS case. Ian Cowger from RiskIQ explains malvertising. And remember Shaltai-Boltai.

WWhat are you expecting in 2017 when it comes to cyber security? There are sure to be attacks like we saw last year, ransomware and botnets, IoT vulnerabilities we just didn’t see coming. And what about all of those unfilled jobs? Can automation help fill the gap? Is the board room finally going to give cyber the attention it deserves? How will president Trump affect cyber policy?

In today's podcast we discuss some updates on the Russian treason arrests, with side suspicions being cast in the direction of underworld in-fighting. A principal victim of Shamoon 2 reports its recovery. IoT threats and the risk of always-on, always-listening devices. French security officials warn that cyber jihad could enlist cyber mercenaries. Cisco patches its telepresence software. Joe Carrigan from Johns Hopkins stops by to discuss always-listening IoT devices. And don’t worry: no one really got locked into their room at that posh Alpine resort. (Worry about other stuff.)

In today's podcast, we hear that LeakedSource is down, maybe for good. DoubleFlag seems to be selling bogus data on the black market. (And where, we ask, is the Ripper review? If you can't trust a criminal, who can you trust these days? Sad.) Fancy Bear is back—actually, she never really left—now snuffling at British and German networks. Saudi Arabia remains on Shamoon alert. The Dridex banking Trojan has reappeared, in an improved version. Dale Drew from Level 3 Communications shares findings on the Asia Pacific region. Vince Crisler from Dark Cubed puts Grizzly Steppe in perspective. And tech support scammers get scammed—don't try this at home.