Research Saturday

Researchers at Trend Micro recently published their look inside online underground marketplaces in the Middle East and North Africa, where criminals are buying and selling malware, laundering money and event booking their next discount vacation.

Jon Clay is director of global threat communications at Trend Micro, and he joins us with their findings. 

The original research can be found here:

https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/cash-and-communication-new-trends-in-the-middle-east-and-north-africa-underground

Learn more about your ad choices. Visit megaphone.fm/adchoices

Researchers from Duo Security have been analyzing the behavior of Twitter bots in a series of posts on their web site. Their most recent dive into the subject explores amplification bots, which boost the impact of tweets through likes and retweets.

Jordan Wright is a principal R&D engineer at Duo Security, and he joins us to share their findings.

Link to the original research - 

https://duo.com/labs/research/anatomy-of-twitter-bots-amplification-bots

Learn more about your ad choices. Visit megaphone.fm/adchoices

Researchers from Netscout's ASERT team have been making use of honeypots to gather information on rapidly evolving IoT botnets that take advantage of default usernames and passwords to gain access and take control of unprotected devices.

Matt Bing is a security research analyst with Netscout, and he guides us through their findings.

The original research can be found here:

https://asert.arbornetworks.com/dipping-into-the-honeypot/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Researchers at RiskIQ have been tracking a series of web-based credit card skimmers known as Magecart. We take a closer look at attacks on Ticketmaster, British Airways, NewEgg and Shopper Approved payment card pages. 

Yonathan Klijnsma is lead of threat research at RiskIQ, and he guides us through what they've learned.

Links to RiskIQ research:

https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/

https://www.riskiq.com/blog/labs/magecart-british-airways-breach/

https://www.riskiq.com/blog/labs/magecart-newegg/

https://www.riskiq.com/blog/labs/magecart-shopper-approved/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Researchers from Unit 42 at Palo Alto Networks have discovered an interesting relationship between the NOKKI and DOGCALL malware families, as well as a new RAT being used to deploy the malware.

Jen Miller-Osborn is Deputy Director of Threat Intelligence with Unit 42, and she joins us to share their findings.

The original research can be found here:

https://unit42.paloaltonetworks.com/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Researchers at Duo Security have been looking into Apple's Device Enrollment Program (DEM) and have discovered vulnerabilities that could expose users of the service to potential issues from social engineering and rogue devices.

James Barclay is Senior R&D Engineer at Duo Security, and he joins us to share what they've found.

The original research can be found here:

https://duo.com/blog/weak-apple-dep-authentication-leaves-enterprises-vulnerable-to-social-engineering-attacks-and-rogue-devices

Learn more about your ad choices. Visit megaphone.fm/adchoices

Researchers at Risk Based Security took a detailed look back at the 2014 Sony hack, comparing analysis that occurred while the facts were still unfolding with what we know, today. There are interesting lessons to be learned, especially when it comes to attribution.

Brian Martin is V.P. of vulnerability intelligence at Risk Based Security, and he shares their findings.

The research can be found here:

https://www.riskbasedsecurity.com/2018/09/you-didnt-think-the-sony-saga-was-over-did-you/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Researchers at Trend Micro uncovered a supply chain attack targeting organizations in South Korea. With the goal of information theft, attackers compromised the update server of a third party support provider, resulting in the installation of a RAT, or remote access trojan.

Rik Ferguson is Vice President of Security Research at Trend Micro, and he guides us through their discoveries.

The research can be found here:

https://blog.trendmicro.com/trendlabs-security-intelligence/supply-chain-attack-operation-red-signature-targets-south-korean-organizations/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Researchers from Secureworks' Counter Threat Unit have been tracking a threat group spoofing login pages for universities. Evidence suggests the Iranian group Cobalt Dickens is likely responsible.

Allison Wikoff is a senior researcher at Secureworks, and she joins us to share what they've found.

The original research is here:

https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities

Learn more about your ad choices. Visit megaphone.fm/adchoices

The NETSCOUT Arbor ASERT team has been tracking Cobalt Group campaigns targeting financial institutions. Richard Hummel is manager of threat intelligence with ASERT, and he joins us to share his team's findings. 

The research can be found here:

https://asert.arbornetworks.com/double-the-infection-double-the-fun/

Learn more about your ad choices. Visit megaphone.fm/adchoices