The CyberWire Daily

The Trump campaign claims its email systems were breached by Iranian hackers. A Nashville man is arrested as part of an alleged North Korean IT worker hiring scam. At Defcon, researchers reveal significant vulnerabilities in Google’s Quick Share. Ransomware attacks hit an Australian gold mining company as well as multiple U.S. local governments. GPS spoofing is a matter of time. Cisco readies another round of layoffs. Nearly 2.7 billion records of personal information for people in the United States have been shared on a hacking forum. Our own Rick Howard speaks with Mark Ryland, Director of Amazon Security, about formal verification.  A hacker hacks the hackers.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On today’s guest slot, N2K’s CSO Rick Howard speaks with Mark Ryland, Director of Amazon Security at AWS, about formal verification, which is logical proofs about correctness of systems, at AWS re:Inforce. Rick and Mark caught up at AWS re:Inforce 2024. 

Experts warn of election disruptions after Trump says campaign was hacked (Washington Post)

Nashville man arrested for running “laptop farm” to get jobs for North Koreans (Ars Technica)

Google Patches Critical Vulnerabilities in Quick Share After Researchers' Warning (Hackread)

Australian gold mining company Evolution Mining announces ransomware attack (The Record)

GPS spoofers 'hack time' on commercial airlines, researchers say (Reuters)

Exclusive: Cisco to lay off thousands more in second job cut this year (Reuters)

Hackers leak 2.7 billion data records with Social Security numbers (Bleeping Computer)

Local gov’ts in Texas, Florida hit with ransomware as cyber leaders question best path forward (The Record)

Simple Coding Errors Lead to Major Ransomware Takedown (Cybersecurity News)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Rick Howard, N2K CyberWire’s Chief Analyst and Senior Fellow, discusses the meaning of cybersecurity materiality.

Amy Howe, 2024. Supreme Court strikes down Chevron, curtailing power of federal agencies [Blog]

Cydney Posner, 2023. SEC Adopts Final Rules on Cybersecurity Disclosure [Explainer]. The Harvard Law School Forum on Corporate Governance.

Cynthia Brumfield, 2022. 5 years after NotPetya: Lessons learned Analysis]. CSO Online.

Eleanor Dallaway, 2023. Closed for Business: The Organisations That Suffered Fatal Cyber Attacks that Shut Their Doors For Good [News]. Assured.

Gary Cohen, 2021. Throwback Attack: Chinese hackers steal plans for the F-35 fighter in a supply chain heist [Explainer]. Industrial Cybersecurity Pulse.

James Pearson, 2022. Russia downed satellite internet in Ukraine [News]. Reuters.

Katz, D., 2021. Corporate Governance Update: “Materiality” in America and Abroad [Essay]. The Harvard Law School Forum on Corporate Governance.

Kim Zetter, 2014. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon [Cybersecurity Canon Hall of Fame Book]. Goodreads.

Lizárraga, C.J., 2023. Improving the Quality of Cybersecurity Risk Management Disclosures [Essay]. U.S. Securities and Exchange Commission.

MATTHEW DALY, 2024. Supreme Court Chevron decision: What it means for federal regulations [WWW Document]. AP News.

Rick Howard. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon [Book Review]. Cybersecurity Canon Project.

Rick Howard, 2021. Using cyber sand tables to study the DNC hack of 2016. [Podcast]. The CyberWire.

Rick Howard, 2022. Cyber sand table series: OPM. [Podcast and Essay]. The CyberWire.

Staff, 2020. Qasem Soleimani: US strike on Iran general was unlawful, UN expert says [Explainer]. BBC News.

Staff, 2023. Final Rule: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure [Government Guidance]. U.S. Securities and Exchange Commission.

Staff, 2024. Number of Public Companies v. Private: U.S. [Website]. Advisorpedia.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Enjoy this special encore episode:

Computational Social Scientist Andrea Little Limbago shares her journey as a social scientist in cybersecurity. Andrea laments that she wishes she'd known there is no straight line between what you think you want to do and then where you end up going. Beginning her career in international relations and courted by the Department of Defense's Joint Warfare Analysis Center while teaching at New York University, Andrea began her work in cybersecurity. Her team was one of the first to start thinking about the intersection of cybersecurity and geopolitics and quantitative modeling. Andrea reminds us there are many paths and skills needed in cybersecurity and hopes she's opened some doors for others. We thank Andrea for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Shachar Menashe, Senior Director of Security Research at JFrog, is talking about "When Prompts Go Rogue: Analyzing a Prompt Injection Code Execution in Vanna.AI." A security vulnerability in the Vanna.AI tool, called CVE-2024-5565, allows hackers to exploit large language models (LLMs) by manipulating user input to execute malicious code, a method known as prompt injection.

This poses a significant risk when LLMs are connected to critical functions, highlighting the need for stronger security measures.

The research can be found here:

• When Prompts Go Rogue: Analyzing a Prompt Injection Code Execution in Vanna.AI

Learn more about your ad choices. Visit megaphone.fm/adchoices

Deep firmware vulnerabilities affect chips from AMD. CISA warns of actively exploited Cisco devices. Solar inverters are found vulnerable to disruption. Iran steps up efforts to interfere with U.S. elections. The UN passes its first global cybercrime treaty. ADT confirms a data breach. A longstanding browser flaw is finally fixed. Crash reports help unlock the truth. Rob Boyce of Accenture shares his thoughts live from Las Vegas at the Black Hat conference. These scammers messed with the wrong guy. 

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

We are joined by podcast partner Rob Boyce of Accenture sharing his thoughts as our man on the street from the Black Hat USA 2024.

‘Sinkclose’ Flaw in Hundreds of Millions of AMD Chips Allows Deep, Virtually Unfixable Infections (WIRED)

Warnings Issued Over Cisco Device Hacking, Unpatched Vulnerabilities (SecurityWeek)

Series Of Solar Power System Vulnerabilities Impacts Millions Of Installations (Cyber Security News)

Microsoft: Iran makes late play to meddle in U.S. elections (CyberScoop)

UN cybercrime treaty passes in unanimous vote (The Record)

ADT confirms data breach after customer info leaked on hacking forum (Bleeping Computer)

It's 2024 and we're just getting round to stopping browsers insecurely accessing 0.0.0.0 (The Register)

Computer Crash Reports Are an Untapped Hacker Gold Mine (WIRED)

USPS Text Scammers Duped His Wife, So He Hacked Their Operation (WIRED)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Black Hat kicks off with reassurances from global cyber allies. Researchers highlight vulnerabilities in car head units, AWS and 5G basebands. Alleged dark web forum leaders are charged in federal court. Tens of thousands of ICS devices are vulnerable to weak automation protocols. Kimsuky targets universities for espionage. Ransomware claims the life of a calf and its mother. A look at job risk in the face of AI. In our Threat Vector segment, host David Moulton speaks with Nir Zuk, Founder and CTO of Palo Alto Networks, about the future of cybersecurity. An alleged cybercrime rapper sees his Benjamins seized.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

In this Threat Vector segment, host David Moulton, Unit 42 Director of Thought Leadership, converses with Nir Zuk, Founder and CTO of Palo Alto Networks, about the future of cybersecurity. They discuss the pressing challenges organizations face today and the pivotal shift from traditional defense strategies to a mindset that assumes breaches. To listen to their full conversation, check out the episode here. You can catch new episodes of Threat Vector every Thursday on the N2K CyberWire network. 

US elections have never been more secure, says CISA chief (The Register)

Black Hat USA 2024: vehicle head unit can spy on you, researchers reveal (Cybernews)

AWS Patches Vulnerabilities Potentially Allowing Account Takeovers (SecurityWeek)

Hackers could spy on cell phone users by abusing 5G baseband flaws, researchers say (TechCrunch)

Exclusive: Massive Criminal Online Platform Disrupted (Court Watch)

Web-Connected Industrial Control Systems Vulnerable to Attack (Security Boulevard)

North Korea Kimsuky Launch Phishing Attacks on Universities (Infosecurity Magazine)

Swiss cow and calf dead after ransomware attack on milking robot (Cybernews)

AI Will Displace American Workers—When, How, and To What Extent Is Less Certain (Lawfare)

Cybercrime Rapper Sues Bank over Fraud Investigation (Krebs on Security) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Crowdstrike releases a postmortem. LoanDepot puts a multimillion dollar price tag on their ransomware incident. RHADAMANTHYS info stealer targets Israelis. Zola ransomware is an advanced evolution of the Proton family. Firefox fixes several high-severity vulnerabilities. Researchers at Certitude uncover a vulnerability in Microsoft 365’s anti-phishing measures. Threat actors exploit legitimate anti-virus software for malicious purposes. Samsung’s new bug bounty program offers rewards up to a million dollars. Guest Adam Marré, CISO at Arctic Wolf, joining us to share his observations on the ground at Black Hat USA 2024. Ransomware gangs turn the screws and keep up with the times. 

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Adam Marré, CISO at Arctic Wolf, joining us to share his observations as our man on the street from Black Hat USA 2024.

CrowdStrike Publishes Technical Root Cause Analysis of Faulty Falcon Update (Cyber Security News)

Ransomware Attack Cost LoanDepot $27 Million (SecurityWeek)

RHADAMANTHYS Stealer Weaponizing RAR Archive To Steal Login Credentials (Cyber Security News)

New Zola Ransomware Using Multiple Tools to Disable Windows Defender (GB Hackers)

Firefox Patches Multiple High Severity Vulnerabilities (Cyber Security News)

Exploring Anti-Phishing Measures in Microsoft 365 (Certitude Blog)

Hackers Hijack Anti-Virus Software Using SbaProxy Hacking Tool (Cyber Security News)

Samsung to pay $1,000,000 for RCEs on Galaxy’s secure vault (Bleeping Computer)

Turning the screws: The pressure tactics of ransomware gangs (Sophos News)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Thousands of education sector devices have been maliciously wiped after an attack on a UK MDM firm. A perceived design flaw in Microsoft Authenticator leaves users locked out of accounts. SharpRino charges ahead to deploy ransomware. North Korea’s Stressed Pungsan provides initial access points for malware distribution. Magniber ransomware targets home users and SMBs. Google patches an Android zero-day. A new Senate bill aims to treat ransomware as terrorism. Microsoft ties security to employee compensation. Guest Kim Kischel, Director of Cybersecurity Product Marketing at Microsoft, discusses how AI is impacting the unified security operations center. A victim of business email compromise gets some good news. 

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Kim Kischel, Director of Cybersecurity Product Marketing at Microsoft, discusses how AI is impacting the unified security operations center and how it's changing the way defenders defend.

Over 13,000 phones wiped clean as cyberattack cripples Mobile Guardian (CSO Online)

Design Flaw Has Microsoft Authenticator Overwriting MFA Accounts, Locking Users Out (Slashdot)

Network Admins Beware! SharpRhino Ransomware Attacking Mimic as Angry IP Scanner (Cyber Security News)

North Korean Hackers Attacking Windows Users With Weaponized npm Files (Cyber Security News)

Surge in Magniber ransomware attacks impact home users worldwide (Bleeping Computer)

Google Patches Android Zero-Day Exploited in Targeted Attacks (SecurityWeek)

Intelligence bill would elevate ransomware to a terrorist threat (CyberScoop)

Microsoft is binding employee bonuses and promotions to security performance (TechSpot)

Police Recover Over $40m Headed to BEC Scammers (Infosecurity Magazine)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The justice department sues TikTok over alleged violations of children’s online privacy laws. Bad blood between Crowdstrike and Delta Airlines. The UK once again delays upgrades to their cybercrime reporting center. Apache OFBiz users are urged to patch a critical vulnerability. SLUBStick is a newly discovered Linux Kernel attack. CISA releases a handy guide to help software suppliers manage security risk. StormBamboo poisons DNS queries to deliver targeted malware. The White House looks to help close the cybersecurity skills gap with $15 million in scholarships. Our guest US Congressional candidate from Oklahoma, Madison Horn, speaking with my Caveat co host Ben Yelin about national security and cyberwarfare. Chewing on rumors of Olympic sabotage. 

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

US Congressional candidate from Oklahoma, Madison Horn, speaks with Caveat co host Ben Yelin about national security and cyberwarfare. You can hear the full interview on our latest episode of Caveat here.

This week on N2K Pro’s CSO Perspectives podcast, host and N2K CSO Rick Howard focuses on “Cybersecurity is radically asymmetrically distributed.” Rick and Dave do a preview. You can find the full episode here if you are an N2K Pro subscriber, otherwise check out an extended sample here. 

Justice Department Sues TikTok, Accusing the Company of Illegally Collecting Children's Data (SecurityWeek)

CrowdStrike says it’s not to blame for Delta’s days-long outage (The Verge)

Replacement for Action Fraud, UK’s cybercrime reporting service, delayed again until 2025 (The Record)

Apache OFBiz Users Warned of New and Exploited Vulnerabilities (SecurityWeek)

Linux kernel impacted by new SLUBStick cross-cache attack (Bleeping Computer)

CISA says suppliers bear responsibility for insecure software in Fed procurement guide (The Stack)

Chinese hackers compromised an ISP to deliver malicious software updates (Help Net Security)

White House and EC-Council Launch $15m Cybersecurity Scholarship Program (Infosecurity Magazine)

2024 Paris Olympics: a snoop was at the origin of suspicions of sabotage in the fan zone of the Chateau de Vincennes (FranceInfo)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Rick Howard, N2K CyberWire’s Chief Analyst and Senior Fellow, discusses the idea that Cybersecurity is radically asymmetrically distributed. It means that cybersecurity risk is not the same for all verticals and knowing that may impact the first principle strategies you choose to protect your enterprise.

For a complete reading list and even more information, check out Rick’s more detailed essay on the topic.

André Munro, 2024. Liberal democracy [Explainer]. Encyclopedia Britannica.

David Weedmark, 2017. Why do some states require emissions testing? [Explainer]. Autoblog.

Kara Rogers, 2020. What Is a Superspreader Event? [Explainer]. Encyclopedia Britannica.

Lara Salahi, 2021. 1 Year Later: The ‘Superspreader’ Conference That Sparked Boston’s COVID Outbreak [News]. NBC10 Boston.

Malcolm Gladwell, 2002. The Tipping Point: How Little Things Can Make a Big Difference [Book]. Goodreads.

Malcolm Gladwell, 2005. Blink: The Power of Thinking Without Thinking [Book]. Goodreads.

Malcolm Gladwell, 2008. Outliers: The Story of Success [Book]. Goodreads.

Malcolm Gladwell, 2019. Talking to Strangers: What We Should Know About the People We Don’t Know [Book]. Goodreads.

Malcolm Gladwell, 2021. The Bomber Mafia: A Dream, a Temptation, and the Longest Night of the Second World War [Book]. Goodreads. 

Malcom Gladwell, 2024. Medal of Honor: Stories of Courage [Podcast]. Pushkin Industries.

Malcolm Gladwell. Revisionist History [Podcast]. Pushkin Industries.

Michael Lewis, 2003. Moneyball: The Art of Winning an Unfair Game [Book]. Goodreads.

Michael Lewis. Against the Rules [Podcast]. Pushkin Industries.

Nassim Nicholas Taleb, 2007. The Black Swan: The Impact of the Highly Improbable [Book]. Goodreads.

Rick Howard, 2023. Cybersecurity First Principles: A Reboot of Strategy and Tactics [Book]. Goodreads.

Rick Howard, 2023. Cybersecurity First Principles Book Appendix  [Diagram]. N2K CyberWire.

Rick Howard, 2023. Cybersecurity moneyball: First principles applied to the workforce gap. [Podcast]. The CyberWire.

Rick Howard, Simone Petrella , 2024. The Moneyball Approach to Buying Down Risk, Not Superstars [Presentation]. RSA 2024 Conference.

Robert Soucy, 2024. Fascism [Explainer]. Encyclopedia Britannica.

Staff, 2022. Information Risk Insights Study: A Clearer Vision for Assessing the Risk of Cyber Incidents [Report]. Cyentia Institute.

Staff. Congressional Medal of Honor Recipients [Website]. Congressional Medal of Honor Society.

Staff. North American Industry Classification System (NAICS)  [Website]. U.S. Census Bureau.

Learn more about your ad choices. Visit megaphone.fm/adchoices