CyberWire Daily

In today's podcast, we hear that tensions between Britain and Russia remain high, as the UK fears a cyberattack. US power utilities are also on alert to an ongoing Russian cyber campaign. Despite a claimed DDoS attack, President Putin is re-elected in Russia. Facebook under fire for Cambridge Analytica data incident. More political bots in Twitter. YouTube tries content moderation. FTC takes on an alt-coin Ponzi scheme. SEC has "dozens" of ICO investigations in progress. Notes on the Hal Martin alleged NSA-hoarder case. Malek Ben Salem from Accenture Labs with tips on cryptography deployment. Guest is Paul Brigner from the Security and Software Engineering Research Center (S2ERC) at Georgetown University, discussing their research on Virtual Browsers.  Learn more about your ad choices. Visit megaphone.fm/adchoices

There's been an epidemic of cryptojacking code injections recently, as bad actors attempt to cash in on the cryptocurrency craze through unauthorized cryptomining operations on unsuspecting users. Marcelle Lee is a threat researcher at LookingGlass, and she takes us through her recently published research, Cryptojacking — Coming to a Server Near You.  Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we hear that NATO has condemned Russia for a chemical attack in England. The US sanctions Russia for NotPetya and election meddling, and warns of Russian preparations for an attack against US infrastructure. Chinese cyber operations support that country's claims to the South China Sea. Iran shows increased cyber espionage activity. Observers fear a return of Triton/Trisis ICS malware. Another unsecured AWS bucket may have been found. Johannes Ullrich from SANS and the Internet Storm Center podcast, discussing credential stuffing. Guest is Rico Chandra from Arktis Radiation Detectors on securing radiation detectors.   Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that AMD continues its investigation of the backdoors and other vulnerabilities CTS Labs publicly disclosed. That disclosure remains controversial. BlackTDS offers malware distribution as-a-service on the black market. PinkKite is a small but persistent point-of-sale threat. The SEC charges a former Equifax exec with trading on non-public information of the credit bureau's data breach. Germany, France, and the United States join the United Kingdom in denouncing Russia for the Salisbury nerve agent attack. Rick Howard from Palo Alto Networks, with this year’s Cyber Cannon nominees. Guest is Ted Bardusch from Usermind on data-rich marketing and GDPR.  Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that AMD is investigating a report of exploitable flaws in its processors. Vietnamese threat actor OceanLotus gets a look from researchers. Patch Tuesday notes. Britain expels Russian diplomats in retaliation for a nerve agent attack. Russia demands to know what these cyberattacks are that the UK is said to be threatening. A brief history of Russo-British Twenty-first Century espionage and cyber tensions. Iranian threat actor MuddyWaters threatens researchers.  Justin Harvey from Accenture on the importance of the first 48 hours following a breach. Guest is Patrick Sullivan from Akamai on VPNs and the notion of “verify and never trust.”  Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we hear that Britain has given Russia an ultimatum: explain by midnight how your nerve agent got to Salisbury or face the consequences. Russia calls it nonsense. Cyber conflict between the two countries is widely expected. Palo Alto's Unit 42 finds HenBox Android spyware. NCC Labs describes Chinese backdoors used against UK Government and industry targets. President Trump replaces Secretary of State Tillerson with DCI Pompeo. Gina Haspel is tapped as next DCI. Awais Rashid from University of Bristol on cyber physical systems. Guest is Tom Badders from Telos on obfuscation as applied to threat intelligence. And a wrap-up of SINET ITSEF.  Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcasts, we hear that security firms are warning of Iran's growing cyber capabilities, and Tehran's disposition to use them. Gossips and activists far outdo bots in spreading disinformation. Memcache kill-switch should be approached with legal caution. Slingshot espionage tools active quietly in the Middle East and Africa for six years. Fancy Bear sniffs at Asia. Australia is concerned about Chinese espionage and influence operations. Jonathan Katz from UMD with his thoughts on Spectre and Meltdown. Guest is Christopher Pierson from Binary Sun Cyber Risk Advisors, with an update on SEC cyber security guidance.  Learn more about your ad choices. Visit megaphone.fm/adchoices

Researcher from Lookout and the EFF have discovered an APT group operating out of Lebanon they've named Dark Caracal. The group is running a global espionage campaign, targeting journalists, military personnel, activists, lawyers, medical professionals and educational institutions. Mike Murray is VP of Security Intelligence at Lookout, and he's our guide through their research. Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear reports of cyber reconnaissance of Turkish financial institutions: Hidden Cobra is the suspect. The Chinese government appears to have finagled its national vulnerability database to afford misdirection to cyber operations. Cryptomining attempts hit Windows endpoints. Other cryptojacking campaigns afflict vulnerable servers. Memcrash DDoS hits new targets. The US Administration hints at possible cyber policy changes. Emily Wilson from Terbium Labs, on the issue of trying to spend our way to security. Guest is Priscilla Moriuchi from Recorded Future, with research documenting a backdating issue in the CNNVD, China’s National Vulnerability Database.  Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that a kill-switch for Memcrash may have been found (and Memcrash may be dangerous for other purposes than denial-of-service). Researchers in Hungary take a look at the Shadow Brokers' dumps and speculate about the purpose of the "Territorial Dispute" module. The Dutch Tax Authority sustained another DDoS attack last night. India's CERT renders a troubling report to Parliament. The FBI still wants a non-backdoor backdoor. David Dufour from Webroot on vulnerabilities in cryptocurrency markets. Guest is Richard Henderson from Absolute Software on protecting against insider threats. And some notes from SINET ITSEF.  Learn more about your ad choices. Visit megaphone.fm/adchoices