The CyberWire Daily

Senator Wyden calls out the NSA for purchasing American’s internet records. Senators look to add IT and ICS environments to federal employee cyber competitions. The FTC asks big tech about their investments in AI. Turns out the GSA bought a bunch of Chinese security cameras. Akira ransomware claims a breach of Lush cosmetics. ESET reports on the Blackwood cyberespionage group. Wired looks at Predatory Sparrow. The U.S. stands firm on the United Nations Cybercrime Treaty. Our guest is Tony Surak, CMO & Operating Partner from DataTribe, with insights on the state of venture capital in cyber. And a Trickbot gang member will be doing some time.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Tony Surak from DataTribe joins us to share his take on the state of the VC cyber market.

Wyden Releases Documents Confirming the NSA Buys Americans’ Internet Browsing Records; Calls on Intelligence Community to Stop Buying U.S. Data Obtained Unlawfully From Data Brokers, Violating Recent FTC Order 

Senate Committee debuts bipartisan bill to add OT, ICS environments to federal employee cyber competition 

FTC officially asks Big Tech about their AI deals | Cybernews 

GSA Sparks Security Fears After Buying Risky Chinese Cameras

Akira ransomware gang says it stole passport scans from Lush • The Register

Elusive Chinese Cyberspy Group Hijacks Software Updates to Deliver Malware - SecurityWeek

How a Group of Israel-Linked Hackers Has Pushed the Limits of Cyberwar | WIRED

On eve of final negotiations, US says consensus growing around ‘narrow’ UN cybercrime treaty

Trickbot malware developer sentenced to 5 years behind bars • The Register

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cozy Bear breaches Hewlett Packard Enterprise. An investigation reveals global surveillance based on digital advertising. Cisco patches critical vulnerabilities. Meta aims to enhance the online safety of minors.  iOS notifications are exploited for tracking. EquiLend’s systems go offline after a cyberattack.  A DC theater faced financial crisis after seeing their bank account drained. Critical infrastructure is targeted in Ukraine.  The latest insights on ransomware. Guest Lance Hood joins us from TransUnion to share how fraud attacks on financial industry call centers are rising. And Teslas get POwned in Tokyo.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Lance Hood joins us from TransUnion to share how fraud attacks on financial industry call centers are rising.

Hewlett Packard Enterprise tells SEC it was breached by Russia’s 'Cozy Bear' hackers (The Record)

Inside a Global Phone Spy Tool Monitoring Billions (404 Media)

Cisco Patches Critical Vulnerability in Enterprise Collaboration Products (SecurityWeek)

Instagram and Facebook will now prevent strangers from messaging minors by default (The Verge)

Research Reveals How iPhone Push Notifications Leak User Data (MacRumors)

Financial tech firm EquiLend says recovery after cyberattack ‘may take several days’ (The Record)

'No gift is too small' | GALA Hispanic Theater asking for donations after hackers drain bank accounts (WUSA9)

Ukrainian energy giant, postal service, transportation agencies hit by cyberattacks (The Record)

The 2024 Ransomware Threat Landscape (Symantec Enterprise Blogs)

Who pays, and why: A researcher examines the ransomware victim’s mindset (The Record)

Tesla Hack Earns Researchers $100,000 at Pwn2Own Automotive - SecurityWeek (SecurityWeek)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Biden prepares executive order on foreign access to data. Britain’s NCSC warns of a significant ransomware increase. Cisco Talos confirms ransomware surge. BuyGoods.com leaks PII and KYC data. Fortra faces scrutiny over slow disclosure. AI fights financial fraud. Intel471 highlights bulletproof hosting. NSO Group lobbies to revamp their image. Tussling in Missouri over election security. Integrating cyber education. Our guests are N2K President Simone Petrella and WiCyS Executive Director Lynn Dohm talking about a new partnership for a comprehensive Cyber Talent Study. And the moral panic of Furbies.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today’s guests are N2K President Simone Petrella and WiCyS Executive Director Lynn Dohm talking with Dave Bittner about a new partnership for a comprehensive Cyber Talent Study to deepen the collective understanding of cybersecurity competencies within the industry.

Biden Seeks to Stop Countries From Exploiting Americans’ Data for Espionage (Bloomberg)

British intelligence warns AI will cause surge in ransomware volume and impact (The Record)

Significant increase in ransomware activity found in Talos IR engagements, while education remains one of the most-targeted sectors (Talos)

Global Retailer BuyGoods.com Leaks 198GB of Internal and User PII, KYC data (HACKREAD)

Fortra blasted over slow response to critical GoAnywhere file transfer bug (SC Media)

Gen AI Expected to Bring Big Changes to Banking Sector (GovInfo Security)

Why Bulletproof Hosting is Key to Cybercrime-as-a-Service (Infosecurity Magazine)

Notorious Spyware Maker NSO Group Is Quietly Plotting a Comeback (WIRED)

Missouri secretary of state accused of withholding cybersecurity reviews of election authorities (StateScoop)

Cybersecurity education from childhood is a vital tool: 72% of children worldwide have experienced at least one type of cyber threat (Check Point) 

These Are the Notorious NSA Furby Documents Showing Spy Agency Freaking Out About Embedded AI in Children's Toy (404 Media)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The mother of all data breaches. CISA director Easterly is the victim of a swatting incident. An AI robocall in New Hampshire seeks to sway the election. Australia sanctions an alleged Russian cyber-crime operator. Atlassian Confluence servers are under active exploitation. Apple patches a webkit zero-day. Black Basta hits a major UK water provider. Hackers who targeted an Indian ISP launch and online search portal. A Massachusetts hospital suffered a Christmas day ransomware attack. Ann Johnson host of the Afternoon Cyber Tea podcast, speaks with Caitlin Sarian, known to many as Cybersecurity Girl. And HP claims bricked printers are a security feature, not a bug. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Microsoft Security’s Afternoon Cyber Tea podcast host, Ann Johnson, speaks with Caitlin Sarian, known to many as Cybersecurity Girl, a leading influencer with a cybersecurity-focused social presence. Listen to the full interview here. 

Mother of All Breaches: ​a Historic Data Leak Reveals 26 Billion Records (Cybernews)

CISA’s Easterly the target of ‘harrowing’ swatting incident (The Record)

AI robocalls impersonate President Biden in an apparent attempt to suppress votes in New Hampshire (PBS NewsHour)

Hear fake Biden robocall urging voters not to vote in New Hampshire (YouTube)

Medibank hack: Russian sanctioned over Australia's worst data breach (BBC)

Hackers start exploiting critical Atlassian Confluence RCE flaw (BleepingComputer)

iOS 17.3 and macOS Sonoma 14.3 Patch WebKit Vulnerability That May Have Been Exploited (MacRumors)

UK water company that serves millions confirms system attackIndian ISP Hathway Data Breach (The Record)

Hacker Leaks 4 Million Users, KYC Data (HACKREAD)

Massachusetts hospital claimed to be targeted by Money Message ransomware (SC Media)

HP's CEO spells it out: You're a 'bad investment' if you don't buy HP supplies (The Register)

HP CEO evokes James Bond-style hack via ink cartridges (Ars Technica)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Russian state hackers breach Microsoft. LockBit claims Subway restaurants hack. A Swedish datacenter is hit with ransomware. VMware patches a vulnerability targeted by Chinese espionage groups. Sentinel Labs warns of North Korean APTs focus on cybersecurity pros. FTC order another data broker to restrict location data. US Feds release security guidance for water and wastewater sectors. Senators question the DOJ on facial recognition technology. Ukraine’s Monobank gets DDoSed. N2K’s CSO Rick Howard joins us to share some insight into what he and the Hash Table are cooking up for the upcoming season of his CSO Perspectives podcast. The passing of a Time Lord. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

N2K’s CSO Rick Howard joins us to share some insight into what he and the Hash Table are cooking up for the upcoming season of his CSO Perspectives podcast launching next month.   

Microsoft: Russian Hackers Had Access to Executives' Emails (GovInfo Security)

LockBit ransomware gang claims the attack on the sandwich chain Subway (Security Affairs)

Ransomware hits cloud service Tietoevry; numerous Swedish customers affected (The Record)

Chinese Espionage Group UNC3886 Found Exploiting CVE-2023-34048 Since Late 2021 (Mandiant)

North Korea’s ScarCruft APT group targets infosec pros (CSO Online)

FTC Order Will Ban InMarket from Selling Precise Consumer Location Data (Federal Trade Commission)

US Gov Publishes Cybersecurity Guidance for Water and Wastewater Utilities (SecurityWeek)

Ukraine’s Monobank hit with massive DDoS attack (Silicon Republic)

Senators ask DOJ to investigate whether facial recognition tech violates Civil Rights Act (The Record)

RIP, Internet’s Time Lord (On My Om)

Network Time Protocol (NTP) attack (noun) (Word Notes podcast)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

CEO, Matt Devost, describes many firsts in his career including hacking into systems on an aircraft carrier at sea. He shares how he enjoys solving hard problems and the red teamer perspective, and how he was able to translate those into a career. For those interested in cybersecurity, Matt advises opportunities for self-directed learning including heading down to your basement and building your own lab. Our thanks to Matt for sharing his story with us. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

Earlier this month, the White House released the National Cybersecurity Strategy, the first issued since 2018. The strategy refocuses roles, responsibilities, and resource allocations in the digital ecosystem, with a five pillar approach. Those pillars are: defending critical infrastructure, disrupting threat actors, shaping market forces to drive security and resilience, investing in a resilient future, and forging international partnerships.

We wanted to delve into the strategy and its intended effects further, so Dave Bittner spoke with representatives from industry and inside government. Dave first speaks with Adam Isles, Principal and Head of Cybersecurity Practice at The Chertoff Group, sharing industry's take on the strategy. Following that conversation, Dave had a discussion with Steve Kelly, Special Assistant to the President and Senior Director for Cybersecurity and Emerging Technology at the National Security Council, for a look at the strategy from inside the White House.

Links to resources:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jon Williams from Bishop Fox is sharing their research on "It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable." SonicWall published advisories for CVE-2022-22274 and CVE-2023-0656 a year apart after finding that NGFW series 6 and 7 devices are affected by two unauthenticated denial-of-service vulnerabilities.

The research states "Our research found that the two issues are fundamentally the same but exploitable at different HTTP URI paths due to reuse of a vulnerable code pattern." They also found that when they scanned SonicWall firewalls with management interfaces exposed to the internet, they found that 76% are vulnerable to one or both issues.

The research can be found here:

• It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable

Learn more about your ad choices. Visit megaphone.fm/adchoices

Microsoft warns of an Iranian cyberespionage group. The CyberSafety Review Board receives critical reviews of its own. VMWare warns of active product exploitation. Tax info gets leaked in accounting firm breach. Kansas State University reports a cyber incident. CISA adds Citrix Netscaler vulnerabilities to its Known Exploited Vulnerabilities catalog. Councils in the UK suffer online disruptions. Cyber insurance can be a double edged sword. More email security breaches lead to firings. In our Solution Spotlight, N2K President Simone Petrella speaks with Michelle Amante of the Partnership for Public Service With an update on the Cybersecurity Talent Initiative. And it’s shields up for Generation Z.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On the Solution Spotlight, N2K President Simone Petrella speaks with Michelle Amante of the Partnership for Public Service sharing an update on the Cybersecurity Talent Initiative and how federal agencies and early career existing talent that may be interested in the program’s offerings.

Microsoft: Iranian hackers target researchers with new MediaPl malware (Bleeping Computer)

Cyber Safety Review Board needs stronger authorities, more independence, experts say (Cyberscoop)

VMware vCenter Server Vulnerability Exploited in Wild (SecurityWeek)

ELO accounting data breach sparks tax fraud (Cybernews)

Cyber attacks on Kent councils disrupt online services (BBC)

Kansas State University suffered a serious cybersecurity incident (SecurityAffairs)

CISA urges urgent patching of two actively exploited Citrix NetScaler vulnerabilities (Malwarebytes)

Cyber Insurance in the Age of Ransomware: Protection or Provocation? (SOCRadar)

Four-in-ten employees sacked over email security breaches as firms tackle “truly staggering” increase in attacks (IT Pro)

Think boomers are most vulnerable to cybersecurity attacks? Wrong. It's actually Gen Z (CBC)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2024 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A massive credential dump hits the online underground. CISA and the FBI issue joint guidance on drones. TensorFlow frameworks are prone to misconfigurations. Swiss federal agencies are targets of nuisance DDoS. Cybercriminals hit vulnerable Docker servers. Quarkslab identifies PixieFAIL in UEFI implementations. Google patches Chrome zero-day. The Bigpanzi botnet infects smart TVs. Proofpoint notes the return of TA866. In our Threat Vector segment, David Moulton dives into the evolving world of AI in cybersecurity with Kyle Wilhoit, director of threat research at Unit 42. And we are shocked- SHOCKED! - to learn that Facebook is tracking us. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

This segment of Threat Vector dives into the evolving world of AI in cybersecurity with Kyle Wilhoit, director of threat research at Unit 42. This thought-provoking discussion, hosted by David Moulton, director of thought leadership at Unit 42, ffocuses on the current state and future trends of AI in cyberthreats. Discover how AI is reshaping the landscape of cyberattacks, the role of generative AI in threat actor tactics, and the challenges of attribution in AI-driven cyberattacks. Visit Unit 42 by Palo Alto Networks to learn more. 

Check out the Threat Vector podcast and follow it on your favorite podcast app. 

Researcher uncovers one of the biggest password dumps in recent history (Ars Technica)

Troy Hunt: Inside the Massive Naz.API Credential Stuffing List (Troy Hunt)

Feds warn China-made drones pose risk to US critical infrastructure (SC Media)

TensorFlow CI/CD Flaw Exposed Supply Chain to Poisoning Attacks (The Hacker News)

Swiss Government Reports Nuisance-Level DDoS Disruptions (Data Breach Today)

Malware Exploits 9Hits, Turns Docker Servers into Traffic Boosted Crypto Miners (HACKREAD)

PixieFail: Nine flaws in UEFI open-source reference implementation (Security Affairs)

Update Chrome! Google patches actively exploited zero-day vulnerability (Malwarebytes)

Cybercrime crew infects 172,000 smart TVs and set-top boxes (Risky Biz News)

Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware (Google Threat Analysis Group)

Security Brief: TA866 Returns with a Large Email Campaign (Proofpoint)

Each Facebook User Is Monitored by Thousands of Companies (Consumer Reports)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices