The CyberWire Daily

A major American chipmaker discloses a cyberattack. Cybercriminals exploit Progressive Web Applications (PWAs) to bypass iOS and Android defenses. Mandiant uncovers a privilege escalation vulnerability in Microsoft Azure Kubernetes Services. ALBeast hits ALB. Microsoft’s latest security update has caused significant issues for dual-boot systems. The DOE’s new SolarSnitch program aims to sure up solar panel security. Researchers uncover LLM poisoning techniques. An Iranian-linked group uses a fake podcast to lure a target. Our guest is Parya Lotfi, CEO of DuckDuckGoose, discussing the increasing problem of deepfakes in the cybersecurity landscape. Return to sender - AirTag edition. 

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest Parya Lotfi, CEO of DuckDuckGoose, discusses the increasing relevance of deepfakes in the cybersecurity landscape.

Microchip Technology discloses cyberattack impacting operations (Bleeping Computer)

Android and iOS users targeted with novel banking app phishing campaign (Cybernews)

Azure Kubernetes Services Vulnerability Exposed Sensitive Information (SecurityWeek)

ALBeast: Misconfiguration Flaw Exposes 15,000 AWS Load Balancers to Risk (HACKREAD)

Microsoft’s latest security update has ruined dual-boot Windows and Linux PCs (The Verge)

DOE debuts SolarSnitch technology to boost cybersecurity in solar energy systems (Industrial Cyber)

Researchers Highlight How Poisoned LLMs Can Suggest Vulnerable Code (Dark Reading)

Best Laid Plans: TA453 Targets Religious Figure with Fake Podcast Invite Delivering New BlackSmith Malware Toolset | Proofpoint US (Proofpoint)

Serial mail thieves thwarted when victim sends herself an AirTag (Apple Insider) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Dem’s 2024 party platform touches on cybersecurity goals. The feds warn of increased Iranian influence operations. A severe security flaw has been discovered in a popular WordPress donation plugin. The Lazarus Group exploits a Windows zero-day to install a rootkit. Krebs on Security takes a closer look at the significant data breach at National Public Data. Toyota confirms a data breach after their data shows up on a hacking forum. A critical Jenkins vulnerability is added to CISA’s Known Exploited Vulnerabilities catalog. Cybercriminals steal credit card info from the Oregon Zoo. Guest CJ Moses, CISO at Amazon, discussing partnership and being a good custodian of the community in threat intel and information sharing. CISA gets new digs. 

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest CJ Moses, CISO at Amazon, speaks with N2K’s Brandon Karpf about partnership and being a good custodian of the community in threat intel and information sharing at re:Inforce 2024.

Democratic Party Platform Contains Three Cyber Goals (Metacurity)

US warns of Iranian hackers escalating influence operations (Bleeping Computer)

Critical WordPress Plugin RCE Vulnerability Impacts 100k+ Sites (Cyber Security News)

Windows driver zero-day exploited by Lazarus hackers to install rootkit (Bleeping Computer)

National Public Data Published Its Own Passwords (Krebs on Security)

Toyota confirms breach after stolen data leaks on hacking forum (Bleeping Computer)

Critical Jenkins vulnerability added to CISA’s known vulnerabilities catalog (SC Media)

Cybercriminals siphon credit card numbers from Oregon Zoo website (The Record)

CISA to Get New $524 Million Headquarters in DC, Backed by Inflation Reduction Act Funding (SecurityWeek)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cisco Talos discovers vulnerabilities in Microsoft applications for macOS. OpenAI disrupts an Iranian influence campaign. Jewish Home Lifecare discloses a data breach affecting over 100,000. Google tests an auto-redaction feature in Chrome for Android. Unicoin informs the SEC that it was locked out of G-Suite for four days. House lawmakers raise concerns over China-made WiFi routers. Moody’s likens the switch to post-quantum cryptography to the Y2K bug. Diversity focused tech nonprofits grapple with flagging support. Tim Starks of CyberScoop is back to discuss his investigation of a Russian hacking group targeting human rights groups. Smart phones get some street smarts.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

We welcome Tim Starks of CyberScoop back to discuss his story "Russian hacking campaign targets rights groups, media, former US ambassador."

Vulnerabilities in Microsoft’s macOS apps could help hackers access microphones and cameras (The Record)

OpenAI Disrupts Iranian Misinformation Campaign (The New York Times)

100,000 Impacted by Jewish Home Lifecare Data Breach (SecurityWeek)

Chrome will redact credit cards, passwords when you share Android screen (Bleeping Computer)

Crypto firm says hacker locked all employees out of Google products for four days (The Record)

House lawmakers push Commerce Department to probe Chinese Wi-Fi router company (CyberScoop)

Moody's sounds alarm on quantum computing risk, as transition to PQC ‘will be long and costly’ (Industrial Cyber)

The movement to diversify Silicon Valley is crumbling amid attacks on DEI (Washington Post)

Google’s Stunning New Android AI Feature Instantly Locks Phone Thieves Out (Forbes)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Enjoy this special encore with CEO and co-founder of Dragos Robert Lee, as he talks about how he came to cybersecurity through industrial control systems. Growing up with parents in the Air Force, Robert's father tried to steer him away from military service. Still Rob chose to attend the Air Force Academy where he had greater exposure to computers through ICS. Robert finds his interest lies in things that impact the physical world around us. In his work, Dragos focuses on identifying what people are doing bad and helping people understand how to defend against that. Rob describes the possibility of making a jump to control system security from another area recommending you bring something to the table. Rob talks about the world he would like to leave to his son and his hopes for the future. We thank Rob for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Snir Ben Shimol from ZEST Security on their work, "How we hacked a cloud production environment by exploiting Terraform providers." In this blog, ZEST discusses the security risks associated with Terraform providers, particularly those from community sources.

The research highlights the importance of carefully vetting providers, regular scanning, and following best practices like version pinning to mitigate potential vulnerabilities in cloud infrastructure management.

The research can be found here:

• The hidden risks of Terraform providers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Google and iVerify clash over the security implications of an Android app. CISA has issued a warning about a critical vulnerability in SolarWinds Web Help Desk. Ransomware attacks targeting industrial sectors surge. Microsoft is rolling out mandatory MFA for Azure. Banshee Stealer is a new macOS-targeted malware developed by Russian threat actors. A popular flight tracking website exposes users’ personal and professional information. San Francisco goes after websites generating deepfake nudes. Daniel Blackford, Director of Threat Research at Proofpoint, joins us to discuss emerging tactics used by threat actors and trends in e-crime tied to nation states.  Scammers Use Google to Scam Google.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Daniel Blackford, Director of Threat Research at Proofpoint, joined us while he was out at Black Hat to discuss emerging tactics used by threat actors and trends in e-crime tied to nation states. 

Google to remove app from Pixel devices following claims that it made phones vulnerable (The Record)

Nearly All Google Pixel Phones Exposed by Unpatched Flaw in Hidden Android App (WIRED)

SolarWinds Web Help Desk Vulnerability Possibly Exploited as Zero-Day (SecurityWeek)

Microsoft Mandates MFA for All Azure Sign-Ins (Infosecurity Magazine)

New Banshee Stealer macOS Malware Priced at $3,000 Per Month (SecurityWeek)

Dragos reports resurgence of ransomware attacks on industrial sectors, raising likelihood of targeting OT networks (Industrial Cyber)

CISA Releases Eleven Industrial Control Systems Advisories (CISA)

FlightAware Exposed Pilots’ and Users’ Info (404 Media)

AI-powered ‘undressing’ websites are getting sued (The Verge)

Dozens of Google products targeted by scammers via malicious search ads (Malwarebytes) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Microsoft urges users to patch a critical TCP/IP remote code execution vulnerability. Texas sues GM over the privacy of location and driving data. Google says Iran’s APT42 is responsible for recent phishing attacks targeting presidential campaigns. Doppelgänger struggles to sustain its operations. Sophos X-Ops examines the Mad Liberator extortion gang. Fortra researchers document a potential Blue Screen of Death vulnerability on Windows. China’s Green Cicada Network creates over 5,000 AI-controlled inauthentic X(Twitter) accounts. Kim Dotcom is being extradited to the United States. Our guest is Rui Ribeiro, CEO at JScrambler, to discuss how the extensive use of first and third-party JavaScript is a blessing and a curse. Wireless shifting can really grind your gears. 

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today’s guest Rui Ribeiro, JScrambler's CEO, joins us to discuss how the extensive use of first and third-party JavaScript is both a blessing and a curse.

Zero-click Windows TCP/IP RCE impacts all systems with IPv6 enabled, patch now (Bleeping Computer)

Texas sues General Motors over car data tracking (POLITICO)

Google: Iranian Group APT42 Behind Trump, Biden Hack Attempts (Security Boulevard)

Doppelgänger operation rushes to secure itself amid ongoing detections, German agency says (The Record)

Palo Alto Networks Patches Unauthenticated Command Execution Flaw in Cortex XSOAR (SecurityWeek)

A new extortion crew, Mad Liberator, emerges on the scene (The Register)

Beware, Windows users. Newly-spotted CVE-2024-6768 vulnerability can cause blue screen (MSPoweruser)

CyberCX Unmasks China-linked AI Disinformation Capability on X (Cyber CX)

Kim Dotcom is being Megauploaded to the US for trial (The Verge)

Want to Win a Bike Race? Hack Your Rival’s Wireless Shifters (WIRED) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Researchers at Tenable uncovered severe vulnerabilities in Microsoft’s Azure Health Bot Service. Scammers use deepfakes on Facebook and Instagram. Foreign influence operations target the Harris presidential campaign. An Idaho not-for-profit healthcare provider discloses a data breach. Research reveals a troubling trend of delayed and non-disclosure of ransomware attacks by organizations. Patch Tuesday roundup. Palo Alto Networks’ Unit 42 revealed a significant security risk in open-source GitHub projects. Enzo Biochem will pay $4.5 million to settle charges of inadequate security protocols. Our guest is Stephanie Schneider, Cyber Threat Intelligence Analyst at LastPass, joins us to discuss the ongoing Snowflake account attacks driven by exposed legitimate credentials.  Mining for profits on Airbnb. 

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Stephanie Schneider, Cyber Threat Intelligence Analyst at LastPass, joins us to discuss the ongoing Snowflake account attacks driven by exposed legitimate credentials and how enterprises can boost their defenses against these types of attacks.

Critical Vulnerability Found in Microsoft’s AI Healthcare Chatbot (Infosecurity Magazine)

UK Prime Minister Keir Starmer and Prince William deepfaked in investment scam campaign (Bitdefender)

FBI told Harris campaign it was target of 'foreign actor influence operation,' official says (Reuters)

3AM ransomware stole data of 464,000 Kootenai Health patients (Bleeping Computer)

Report reveals lag in disclosure of ransomware attacks in 2023 (Security Brief)

Fortinet, Zoom Patch Multiple Vulnerabilities (SecurityWeek)

Chipmaker Patch Tuesday: Intel, AMD Address Over 110 Vulnerabilities 

Adobe Patches 72 Security Vulnerabilities Across Multiple Products (Cyber Security News)

Microsoft Fixes Nine Zero-Days on Patch Tuesday (Infosecurity Magazine)

ICS Patch Tuesday: Advisories Released by Siemens, Schneider, Rockwell, Aveva (SecurityWeek)

Are your GitHub Action artifacts leaking tokens? (SC Magazine)

Enzo Biochem to pay $4.5 mln over cyberattack, NY attorney general says (Reuters)

Airbnb host adds ‘no crypto mining’ rule after tenant installs 10 rigs (Protos) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The FBI is the repossessor of Dispossessor. The NCA collars and extradites a notorious cybercriminal. A German company loses sixty million dollars to business email compromise. DeathGrip is a new Ransomware-as-a-Service (RaaS) platform. Russia blocks access to Signal. NIST publishes post-quantum cryptography standards. DARPA awards $14 million to teams competing in the AI Cyber Challenge. On our Solution Spotlight, N2K President Simone Petrella talks with Lee Parrish, CISO of Newell Brands, about his book "The Shortest Hour: An Applied Approach to Boardroom Governance of Cyber Security". AI generates impossible code - for knitters and crocheters.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Solution Spotlight, N2K President Simone Petrella talks with Lee Parrish, CISO of Newell Brands, about his book "The Shortest Hour: An Applied Approach to Boardroom Governance of Cyber Security" and security relationship management. Coming tomorrow, stay tuned for a special edition with Simone and Lee’s full conversation. 

FBI strikes down rumored LockBit reboot (CSO Online)

Suspected head of prolific cybercrime groups arrested and extradited (National Crime Agency)

Orion SA says scammers conned company out of $60 million (The Register)

DeathGrip Ransomware Expanding Services Using RaaS Service (GB Hackers)

Swiss manufacturer investigating ransomware attack that shut down IT network (The Record)

Russia Blocks Signal Messaging App as Authorities Tighten Control Over Information (SecurityWeek)

Post-Quantum Cryptography Standards Officially Announced by NIST – a History and Explanation (SecurityWeek)

Need to know: NIST finalizes post-quantum encryption standards essential for cybersecurity (N2K CyberWire)

NIST Releases First 3 Finalized Post-Quantum Encryption Standards (NIST)  

DARPA Awards $14m to Seven Teams in AI Cyber Challenge (Infosecurity Magazine)

The AI scams infiltrating the knitting and crochet world - and why it matters for everyone (ZDNET)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

On this Solution Spotlight, guest Lee Parrish, author and CISO at Newell Brands, joins N2K President Simone Petrella to discuss his book "The Shortest Hour: An Applied Approach to Boardroom Governance of Cyber Security" and security relationship management.

Learn more about your ad choices. Visit megaphone.fm/adchoices