CyberWire Daily

In today's podcast, we hear that German police raid a Panama Papers connected slush fund. North Korea spearphishes in the North American power grid. Security tools can be dual-use, too. Notes on CyberMaryland, where we heard about business climates, the Baltimore-to-Birmingham cyber connection, the Red Queen's race, and the curmudgeonly demeanor too many security types cop. Rick Howard from Palo Alto Networks with an update on the Cyber Canon suggested reading list and a call to vote for the nominated books. Guest is John Morello from Twistlock on securing container environments.  And Google Home's Mini speakers were apparently listening and tattling as well as speaking.  Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. Cylance uses cutting edge artificial intelligence to help protect your systems. If you are a woman in cyber security and want make connections with others in the field, check out our own Women in Cyber Security event. Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's CyberWire, we discuss why the US Intelligence Community got prickly about Kaspersky: their Israeli colleagues tipped them off that something was fishy in the software's use. UpGuard says Accenture left some AWS data buckets exposed. Accenture says they were associated with decommissioned systems, but exposed they seem to have been. Sources say Deloitte's breach is worse than hitherto disclosed, with more than three-hundred clients exposed. Joe Carrigan from JHU ISI with some follow-up from a listener on password security when using password managers. Brian NeSmith from Arctic Wolf with results from an IoT ransomware survey.   Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. Cylance uses cutting edge artificial intelligence to help protect your systems. If you are a woman in cyber security and want make connections with others in the field, check out our own Women in Cyber Security event. Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that North Korea may have hacked into South Korean defense plans. Facebook and Google receive increasing scrutiny for Russian ad buys during 2016 US election season. A dissident Chinese billionaire, exiled to New York, says he's been under cyberattack from Shanghai. OilRig is back, with new and improved cyberespionage. Forrester market research reports accessed by hackers. Kovter malware gets an upgrade. Chris Poulin from BAH on medical device safety. Yassir Abousselham from Okta on challenges establishing and managing identity.  And we offer some observations from the Cyber Pavilion at the Association of the United States Army meetings.  Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. Cylance uses cutting edge artificial intelligence to help protect your systems. If you are a woman in cyber security and want make connections with others in the field, check out our own Women in Cyber Security event. Learn more about your ad choices. Visit megaphone.fm/adchoices

Following major breach revelations from Equifax, Yahoo!, Deloitte and the US Securities and Exchange commission, there have been many calls in the US for increased legislation and regulation that would force better privacy and identity management practices.In this CyberWire special edition, we’ll ask some cyber security experts about GDPR, what it means for privacy and data use, the right to be forgotten, the penalties for noncompliance, and what it means for organizations outside the EU.Joining us are Steve Durbin, Managing Director of the Information Security Forum, a not-for-profit organization providing its members with guidance on cyber, information security and risk management, Brett Hansen, Vice President of data security solutions at Dell, one of the largest suppliers of computer hardware, software and services in the world, and Darron Gibbard, CTSO at Qualys, a global provider of cloud-based security and compliance solutions. Learn more about your ad choices. Visit megaphone.fm/adchoices

Android Toast Overlay enables attackers to trick Android users into enabling permissions on infected devices by making them think they are clicking on benign buttons superimposed over the user interface.Ryan Olson is Director of Threat Intelligence at Palo Alto Networks' Unity 42, and he joins us to share their research. Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear more on what happened with NSA material at (allegedly) Russian hands. Kaspersky security software alleged to have been exploited for intelligence service reconnaissance of contractor machine. Germany cancels post-Snowden surveillance investigation. Reality Winner will not be released on bail. Awais Rashid from Lancaster University on securing the supply chain. Guest is Timothy H. Edgar, author of “Beyond Snowden: Privacy, Mass Surveillance, and the Struggle to Reform the NSA.”  Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we hear that sensitive NSA files appear to have been obtained by Russian intelligence services, and there are claims Kaspersky software was the gateway to compromise. Las Vegas massacre investigation expands to consider possibility of accomplices. A new password stealer is out in the wild. NFL Players Association data exposed. Justin Harvey from Accenture on insider threats. Guest Joe Coleman, cyber threat intelligence analyst from PepsiCo.The FCC was mostly advised by bots on net neutrality (and bots who haven't benefited from DeepMind's ethics class).  Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that ISIS claims of responsibility for Las Vegas murders continue to lose plausibility, but the shooter's motives remain a mystery. Yahoo!'s epic breach just got even more epic. Equifax looks little better in the wake of its CEO's Congressional testimony. A major breach seems to be unfolding in India.  Jonathan Katz from UMD on the importance of random numbers for cryptography. Guest is Dave Mahon from Century Link on the importance of diversity and opportunities for women in cyber security. And does Star Fleet still run Windows XP? Who's responsible for information security on that bridge anyway?  Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. Delta Risk put together an infographic full of tips for Cyber Security Awareness Month.  If you are a woman in cyber security and want make connections with others in the field, check out our own Women in Cyber Security event. Learn more about your ad choices. Visit megaphone.fm/adchoices

  In today's podcast, we consider the bogus rumors and highly questionable claims of responsibility circulating online after the Las Vegas massacre. ISIS is especially keen to make inspirational capital out of senseless killing and suffering. Google and Facebook come under pressure to moderate the content they carry. The UK prepares to pass tougher restrictions on viewing radical content. The Equifax breach gets two-and-a-half-million people bigger. Ben Yelin from UMD CHHS on Yahoo! data breach victims’ right to sue. Tony Gauda, CEO of ThinAir on dealing with insider threats. And US Cyber Command is said to have disrupted North Korean intelligence networks.  Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. Delta Risk put together an infographic full of tips for Cyber Security Awareness Month.  If you are a woman in cyber security and want make connections with others in the field, check out our own Women in Cyber Security event. Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, it's bots, sockpuppets, and trolls, oh my. Mr. Zuckerberg goes to Washington. Equifax sources suggest China hacked it. Credit bureau phishbait chums the Internet. Pyongyang gets a new Internet connection, and observers bet it's not for checking Mr. Kim's fantasy sports leagues (anyway he could get all that from Mr. Rodman). ISIS posts more inspiration, and warnings. NSA prepares to wind down Section 702 operations. Johannes Ullrich from SANS Technology Institute and the ISC Stormcast podcast on malware using malicious DLL files. US and Russia seem to agree on one thing at least: Bitcoin fraud is bad.    Learn more about your ad choices. Visit megaphone.fm/adchoices