CyberWire Daily

In today's podcast we hear from the experts on how old data breaches can cross-contaminate users' other accounts. Point-of-sale problems seem ready to grow in the recent Wendy's incident. Ransomware's shifting landscape sees Locky's distribution botnet vanish (for unclear reasons), Crysis replace TeslaCrypt, and CryptXXX jump exploit kits. Some startups get some nice VC rounds. We hear about the law surrounding mobile location data, and we're reminded of cyber-physical threats to security systems and critical infrastucture. Markus Rauschecker from the University of Maryland Center for Health and Homeland Security reviews an important circuit court privacy decision, and researcher Wesley Wineberg warns us about embedded security cameras.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we follow the latest news and trends with respect to ransomware, now the hottest commodity on the black market, and still able to fetch between $15,000 and $20,000 an extortion. Twitter credentials join VK's in the criminal souk; both sets may have been harvested via earlier breaches in other social media sites. NATO looks into cyber collaboration, workforce development, innovation (Estonia hints low budgets can drive creativity), and the risk of strategic surprise in hybrid warfare. Cylance becomes the industry's latest unicorn with a big Series D funding round. The Johns Hopkins University's Joe Carrigan help us plan our backup strategy, and Scott Petry from Authentic8 offers suggestions for safe browsing while traveling.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we hear about trends in phishing, ransomware, and distributed denial-of-service—and none of those trends are particularly good. We hear why some ransomware may keep coming back after it's been removed. US bank regulators warn financial institutions to mind their security manners in the wake of the SWIFT-related fraudulent transfers, and investigation into the Bangladesh Bank hack still point toward Pyongyang (with a slight nod in the direction of Shanghai. The FBI is actively stinging potential jihadists, and Singapore gets ready to wean its civil servants from the Internet at work. And we welcome our newest research partner, Dr. Charles Clancy from Virginia Tech's Hume Center.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we discuss another in the long-running series of big social media breaches, this one in VK. Password re-users are advised to change not only their credentials, but their ways. Vulnerabilities are reported in Facebook features, and in Ubee VoIP routers. Dale Drew from Level 3 Communications explains that cyber attack traffic in Latin America is up. Raytheon's Dave Amsler shares the findings of a new survey on how companies interact with MSSPs. Al Qaeda makes its way back to Twitter (from Syria). As the US seeks expanded warrantless electronic search authority in terrorism and espionage investigations, observers find themselves thinking that maybe Snowden actually did the NSA some favors.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we follow developments in the SWIFT-related Bangladesh Bank fraud case—more observers buy into the view that North Korea was involved. Many see anti-racketeering measures being adapted to cyberspace, with businesses improving their security by reducing their attackers' return-on-investment. Pakistani hackers spearphish Indian civil servants and install espionage backdoors. Anti-ISIS measures seem to have heightened ISIS's internal mistrust. Irongate and other IoT threats are discussed, as is a rise in hacker attention to Android. Malek Ben Salem speaks to the challenges of identity in the IoT. Zack Schuler from Ninjio makes the case for entertaining training. And OurMine tweets dadada...

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we review some notes on alleged North Korean involvement in fraudulent SWIFT transfers, and on new US sanctions. We take a look at various corners of the cyber criminal underground, including commodification of both malware and stolen data. Big claims for artificial intelligence are going to involve some big litigation, too. And we hear, again, about the vulnerability of data-at-rest and the importance of encrypting your devices. Ben Yelin from the University of Maryland Center for Health and Homeland security discusses the potential legal ramifications of a Facebook privacy suit, and Joseph Billingsley tells us about the Military Cyber Professionals Association.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we hear about online censorship in China, and an espionage campaign directed against Taiwan. RiskIQ finds that many large companies are riding for the same fall Mossac Fonseca took with the Panama Papers. We talk to Trustwave about that alleged Windows zero-day being sold by cyber criminals, and we hear about some smaller potatoes in the ransomware market. Industry news highlights US Federal contract wins and recent M&A activity. The University of Maryland's Jonathan Katz highlight some new research in random number generation.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's Podcast, we hear about Citizen Lab's discovery of an apparent cyber espionage campaign operating under journalistic cover (and targeting journalists). We discuss the state of the black market for both zero-days and stolen data, and get some recommendations for identity protection from the experts. Venafi talks about the implications of the coming SHA-1 expiration, Joe Carrigan from Johns Hopkins tells us what's wrong with public photo-printing kiosks, and some University of Michigan researchers have a clever, insidious hardware backdoor proof-of-concept.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast we hear about the ways in which some old breaches are resurfacing to trouble major social media platforms. Those old breaches are also looking far larger than initially suspected. We learn about "sandjacking" and "bug poaching" as new additions to the lexicon of cyber crime. Analysts continue to think threats will drive cyber industry growth, and venture capital interest seems high, but more selective. Dr. Vikram Sharma from Quintessence explains One Time Pads, and Threat Quotient's Ryan Trost shares the pros and cons of attribution. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

In today's podcast, we discuss the SWIFT transfer issues now under investigation in a dozen more banks. SWIFT announces a five-point security strategy. Attacks on the private sector are seen as having national security implications. Other cyber threats to business--DDoS and ransomware--place availability of data and networks at risk. We take a look at investor interest in cyber stocks, and we talk with experts on artificial intelligence and encryption. And, as far as nation-state attacks are concerned, again, signs point to Pyongyang. (As they so often do.) Malek Ben Salem from Accenture Labs explains AI and Machine Learning, and Brent Waters, of the University of Texas at Austin, who's recently been honored with an early career award from the Association of Computing Machinery for his contributions to encryption.

Learn more about your ad choices. Visit megaphone.fm/adchoices