CyberWire Daily

In today's podcast, we hear that the Reaper botnet is still quiet, and looking like a booter-for-hire. BadRabbit shows some odd stealth, and some interesting strategic selectivity. A malicious Chrome extension steals everything you put on a website. Currency miners on phones seem to be the kind of crime that doesn't pay, but that's not stopping crooks from stuffing them into Google Play. First indictments in the US probe of Russian election influence operations are out.  Emily Wilson from Terbium Labs on third party breaches, what she describes as “Not your breach, still your problem.” And a class action suit is filed over the Equifax breach.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, you might find it valuable, too. If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper. Interested in the latest research in cyber security? Cylance is revolutionizing cybersecurity with products and services that proactively prevent, rather than reactively detect the execution of advanced persistent threats and malware. Learn more at cylance.com.

Podcast sponsor 1-Recorded Future: http://goo.gl/wphZ1z
Podcast sponsor 2- E8 Security: https://goo.gl/yBBx55
Friday sponsor- Cylance: https://goo.gl/fHR65L

Learn more about your ad choices. Visit megaphone.fm/adchoices

The moniker KHRAT came about because of the identification of a Remote Access Trojan (RAT) with command and control infrastructure found in Cambodia (KH). In the most recent episode of the CyberWire's Research Saturday, Ryan Olson, Director of Threat Intelligence at Palo Alto Networks, talks with us about the capabilities of KHRAT and shares details the feature set it provides to threat actors that use it.

https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that BadRabbit, still quiet, looks like a TeleBots product. Reaper is still locked and loaded, but is also still quiet. Maritime SATCOM system found to be buggy, and the worse news is that it's beyond its end-of-life. A look back at the annual ICS Cybersecurity Summit that wrapped yesterday in Atlanta. Moscow tells Twitter buying ads is a free speech issue. Justin Harvey from Accenture on monitoring cloud infrastructure. Guest is Michael Sulmeyer, Director of the Cyber Security Project at the Harvard Kennedy School’s Belfer Center for Science and International Affairs. Anonymous is back and poking at the Spanish government. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear that there's still no sign of the Reaper botnet doing anything. An update on BadRabbit—which for some reason seems to have hopped quietly away from its infrastructure. Other forms of more conventional ransomware, however, remain in circulation, in the wild. It looks as if Kaspersky software might have stumbled across NSA files after all. The US Senate Intelligence Committee has voted to reauthorize Section 702 surveillance authorities through the end of 2025. Ben Yelin from UMD CHHS on states' funding challenges when trying to sure up the security of their voting systems. Bob Ackerman and Dave DeWalt from AllegisCyber, on the occasion of their business announcements, discussing the investment climate for cyber security. And we have notes on ICS from Atlanta. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear about BadRabbit, a new strain of ransomware that's hopped out of Petya's hutch. The Lazarus Group is said to have taken control of some servers in India. DUHK [duck] warnings. Are industrial control system operators paying sufficient attention to Level 1 and Level 0 threats? Next May will see not only GDPR, but also NIS. Joe Carrigan from JHU reviews a list of security tips suggested by IBM. Guest is Scott Kaine, CEO of Delta Risk on cloud migration security issues.And Kapersky continues to protest its innocence of spying, and offers an explanation of what really happened with NSA leaks. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we learn that Hurricane Reaper, the big IoT botnet, remains a digital tropical depression, but plenty of people are warning everyone to stock up on the cyber equivalents of flashlight batteries and bottled water. Czech parliament sites hacked in apparent election-related mischief. Kenya's contentious re-vote approaches. APT28 gets a Bronx cheer for lame CyCon phishing, but don't get cocky, kid. KnowBe4 and Cisco announce acquisitions. Kaspersky seeks to undo reputational damage inflicted by US Government ban. The FBI re-engages in the crypto wars. David DuFour from Webroot on phishing trends. Phil Neray from CyberX reviewing their Global ICS & IIoT Risk Report. If you had a nose job at London Bridge Plastic Surgery, someone's got your before and after pix. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we share some notes on active malware campaigns, and a warning to be on the lookout for the Reaper botnet, which hasn't yet realized its disruptive potential. Kaspersky opens its source code to independent review, to show it's got nothing to hide. Fancy Bear is phishing for you if you plan to attend CyCon. The difficulty of recognizing trolls, and the dangers of innocent posts getting badly lost in translation. A quick note about the ICS Security Conference. Dale Drew from Level 3 Communications on managing the security of the supply chain. And looking for lulz in all the wrong places. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

In August 2017, multiple Content Delivery Networks (CDNs) and content providers were subject to significant attacks from a botnet dubbed WireX. (The botnet is named for an anagram for one of the delimiter strings in its command and control protocol.) The WireX botnet is primarily made up of Android devices running malicious applications and is designed to create DDoS traffic. The botnet is sometimes associated with ransom notes to targets.

Justin Paine is Head of Trust and Safety at Cloudflare, and he joins us to share the WireX story. 

https://blog.cloudflare.com/the-wirex-botnet/

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we hear that an IoT botnet hurricane may be forming among IP cameras. (IP cameras are to DDoS what the West African coast is to Atlantic tropical depressions.) Sofacy rushes to exploit a patched Flash bug in a use-it-or-lose-it espionage race. Want to spy on someone? Go buy an ad. Cisco patches the wi-fi KRACK. NotPetya's still costing manufacturers and their insurers a lot of money. MalwareTech, a.k.a. Emily Wilson from Terbium Labs responding to post-Equifax breach credit agency claims that they can scan the Dark Web. Michael Sutton, CISO at Zscaler on zero-day hoarding. Marcus Hutchins, gets to take off that GPS and stay out late, since the judge decided his pre-trial behavior has been pretty good.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we hear about how a cyber espionage campaign exploits a recently patched .NET vulnerability as Leviathan phishes with torpedo recovery programs. What does Pyongyang want in cyberspace? Apparently a lot of the same things it wants in physical space. Some observers think Putin thinks the Americans started that whole destabilization and delegitimation influence ops struggle. He's probably wrong, but there you go. Cutlet Maker malware jackpots ATMs. BoundHook stealth tool demonstrated. Minecraft malware got into Google Play. Ben Yelin from UMD CHHS with a follow up on President Trump’s executive orders. Guest is Dinah Davis from Code.Likeagirl.io with an update on their activities. Ransomware's still a threat, and a New York judge thinks the NYPD didn't get the memo about the importance of backup.

Thanks for listening to the CyberWire. One of the ways you can support what we do is by visiting our sponsors.

We read Recorded Future’s free intel daily, and we think you'll find it valuable, too.

If you’d like to learn more about how small nuances in how artificial intelligence and machine learning are used can make a big difference, check out E8’s white paper.

Interested in the latest research in cyber security? Our new Research Saturday podcast highlights research being done in industry, universities, and governments. Hear from people who are discovering threats, uncovering vulnerabilities, and devising the security measures to keep cyberspace as safe as it can be. Check it out.

Learn more about your ad choices. Visit megaphone.fm/adchoices