The Gate 15 Podcast Channel

Bleeping Computer: Massive ESXiArgs ransomware attack targets VMware ESXi servers worldwide, 3 Feb 

Risky Business News: Risky Biz News: Ransomware wave hits thousands of VMWare ESXi servers, 06 Feb 

CISA: VMware Releases Security Update for VMware vRealize Operations, 1 Feb 

Canadian Centre for Cyber Security: VMware security advisory (AV23-066), 3 Feb 

Valentine’s Day 2023, :sparkling_heart: and 

Ransomware! Webinar, REGISTER NOW! Ransomware: Planning and Protecting Your Organization, Recorded Future & Gate 15, 14 Feb 

Radware, Passion: A Russian Botnet, 31 Jan 

Bleeping Computer, New DDoS-as-a-Service platform used in recent attacks on hospitals, 01 Feb 

The Record: Customizable new DDoS service already appears to have fans among pro-Russia hacking groups, 03 Feb 

Fox 5, Las Vegas: Man threatened mass shooting at Las Vegas synagogue, police say, 31 Jan 

ABC 7 News: SFPD arrest man suspected of firing blank rounds inside synagogue, bringing gun into theater, 05 Feb 

Chinese Balloons: US DOD: Statement From Secretary of Defense Lloyd J. Austin III, 04 Feb 

And see the Gate 15 SUN from Friday and Monday for numerous links. 

Foreign Affairs: Stop Passing the Buck on Cybersecurity; Why Companies Must Build Safety Into Tech Products, 01 Feb 

Washington Post Cybersecurity 202: How CISA plans to get tech firms to bake security into their products, 06 Feb 

FBI: Elicitation Techniques, 31 Jan 

Voice of America, Russia Developing Weapons to Target Critical Subsea Cables, Pipelines, 02 Feb 

Reuters: Huge earthquake kills 2,600 in Turkey and Syria, bad weather worsens plight, 06 Feb

In the latest Security Sprint, Dave and Andy talked about the following topics:

US Secret Service: New Secret Service Research Examines for the First Time Five Years of Mass Violence Data, 25 Jan

Gate 15 White Paper: The Hostile Event Attack Cycle (HEAC), 2021 Update

DoJ: U.S. Department of Justice Disrupts Hive Ransomware Variant, 26 Jan

FTC: FTC Finalizes Order with Ed Tech Provider Chegg for Lax Security that Exposed Student Data, 27 Jan

DoJ: Former Special Agent in Charge of the FBI New York Counterintelligence Division Charged with Violating U.S. Sanctions on Russia, 23 Jan

Washington Post: N. Carolina church says it lost nearly $800K in email scam, 28 Jan

Gate 15 SUN, US Section, faith-based incidents, 30 Jan

CISA: JCDC Focused on Persistent Collaboration and Staying Ahead of Cyber Risk in 2023, 26 Jan

Washington Post THE CYBERSECURITY 202: Anne Neuberger discusses work to protect critical infrastructure, 30 Jan

CISA: Secure Your Drone: Privacy and Data Protection Guidance, 27 Jan

Hawaii News Now: After signs are hacked, state warns changing roadwork message boards is illegal, 26 Jan

Risky Biz News: KeePass disputes vulnerability designation for feature that exposes cleartext passwords, 29 Jan

Webinar, REGISTER NOW! Ransomware: Planning and Protecting Your Organization, Recorded Future & Gate 15, 14 Feb:  https://go.recordedfuture.com/ransomware-planning-and-protecting-your-organization?utm_campaign=ransomware-webinar&utm_source=gate15&

In this episode of The Gate 15 Interview, Andy Jabbour visits with Josh Poster, Intelligence and Analysis Operations Manager for Auto-ISAC. In that role, Josh also serves as the Leader, Auto-ISAC Intel & Analysis Division & Vice Chair, National Council of ISACs (NCI). His past roles have included Program Manager, Public Transportation and Surface Transportation ISACs, Program Manager, Information and Infrastructure Technologies, and Sr. Analyst, Electronic Warfare Associates, among others. He holds a Bachelor of Science degree in Anthropology and is a long-time leader in the ISAC and homeland security communities.  ‘Preparation is prevention’ - Josh Poster ‘Everyone has a plan until they get punched in the mouth.’ – Mike Tyson 

In the discussion we address: 

Josh’s background and current position 

Developing trust, the importance of relationships and how those relate to both Auto-ISAC and broader, cross-sector and private-public information sharing

Building confidence through preparedness 

We name drop longtime National Council of ISACs leaders Health ISAC’s Denise Anderson, IT-ISAC’s Scott Algeier, and Comms ISAC’s Joe Veins, as well as Bob Kolasky, formerly Assistant Director the Cybersecurity and Infrastructure Security Agency (CISA) and now Exiger’s Senior Vice President of Critical Infrastructure. We also talk about the very valued Auto-ISAC Executive Director, Faye Francy. 

The Gate 15 Interview EP 28: Talking election security, tea and baseball, with Scott Algeier 

Bob Kolasky - How the Cyber Risk Landscape Changed in 2022 – and What’s in Store for 2023 

Companies recognizing bottom-line impact will spend more on cybersecurity, 13 Jan 2023 

The cyber threats facing the automotive industry Fishing, Rainbow Trout, BMX and more! ‘Every single one of our members has a global presence’ - Josh Poster 

A few references mentioned in or relevant to our discussion include: 

Automotive Information Sharing And Analysis Center (Auto-ISAC)  

National Council of ISACs (NCI) 

Josh was also a guest on the podcast in September 2022: The Gate 15 Interview: Cybersecurity Awareness Month 2022 with the National Cybersecurity Alliance, Auto-ISAC and FS-ISAC! 

Plus, background! shout-outs!! favorite movies, tigers, and more!!! 

BBC, Industrial espionage: How China sneaks out America’s technology secrets, 17 Jan 2023 

FEMA National Level Exercises and Cyber Storm ENISA: The European Union Agency for Cybersecurity 

Japanese Auto-ISAC 

WIRED: Hackers Remotely Kill a Jeep on the Highway—With Me in It, 21 July 2015 

WIRED: The Jeep Hackers Are Back to Prove Car Hacking Can Get Much Worse, 01 Aug 2016

In the latest Nerd Out, Dave welcomes Ed Heyman and Alec Davison to talk about the recent hostile event in Monterey Bay and how organizations can take some of the lessons learned from the incident and apply them to their business. This led to a deeper discussion about simple and straightforward security measures that can go a long way to ensuring the organization is prepared for a wide variety of events. This discussion included sharing free resources around vulnerability assessments, training, and exercises. The nerds then talked about Faith-Based Organizations and some of the threats that these organizations are facing heading into 2023 to include the often-overlooked threat from above (drones), as well as the impacts that attacks on critical infrastructure can have.

Ed Heyman is a security professional with over 30 years of experience in the intelligence and security community and he is the co-chair of the Faith-Based Information Sharing and Analytical Organization (FB-ISAO) Organizational Resilience Group.

Alec Davison is a threat and risk analyst with Gate 15 where he works with various industries on threat awareness and security preparedness matters.

Some of the resources mentioned in this episode include:

Conduct a facility vulnerability assessment, such as a free assessment offered through DHS’s Protective Security Advisor (PSA) program.

Train employees on how to identify suspicious behaviors and activities, using resources available through the Nationwide Suspicious Activity (SAR) Initiative (NSI) and information in the U.S. Violent Extremist Mobilization Indicators booklet (2021 edition).

Maintain situational awareness about incidents and events happening in your communities that threat actors might seek to exploit to commit acts of violence, such as by connecting with your local fusion center.

Prepare and/or update an emergency response plan, including by using templates and resources provided by EPA and FEMA.

Rehearse and improve your plans and employee preparedness through training and exercises. DHS’s Cybersecurity and Infrastructure Security Agency (CISA) has published a series of CISA Tabletop Exercise Packages (CTEPs) that prompt participants to walk through their plans for responding to incidents.

First Responder Toolbox: Free reference aid material intended to promote counterterrorism coordination among federal, state, local, tribal, and territorial government authorities and partnerships with private sector officials in deterring, preventing, disrupting, and responding to terrorist attacks.

DOJ: Evergreen Man Arrested for Making Threats of Violence to Law Enforcement Agencies and a Performing Arts Group, 17 Jan

HS Today: Colorado Man Accused of Threatening Mass Shootings at FBI, DHS; Used FBI’s Online Tip Form, 17 Jan

White House: Statement from President Joe Biden on the Shooting in Monterey Park, California, 22 Jan

Chainanalysis: 2023 Crypto Crime Trends: Illicit Cryptocurrency Volumes Reach All-Time Highs Amid Surge in Sanctions Designations and Hacking, 12 Jan

Coveware: Improved Security and Backups Result in Record Low Number of Ransomware Payments, 20 Jan

Gate 15: Blended Threats (update 1.1): Understanding an Evolving Threat Environment, 01 Mar 2018

The Record: Samsung investigating claims of hack on South Korea systems, internal employee platform, 20 Jan

WBRZ 2, ABC News: Cyber attack on clerk of court systems prompts sheriff’s sale cancellations, 17 Jan

The Register: Punch-drunk Apple Watch called 15 cops to a boxing workout when it heard ‘shots’, 19 Jan

CNN: High egg prices may tempt you to start your own backyard flock, but chickens carry some health risks

FBI: Ten Most Wanted Fugitives FAQ — FBI

In the latest Security Sprint, Dave and Andy touched on the following topics:

Milestones and notable reports.

REN-ISAC Birthday! https://www.ren-isac.net/about/History/index.html

CISA Year Review. https://www.cisa.gov/2022-year-review

Weather.

https://www.cnn.com/2023/01/13/weather/tornado-storm-damage-south-friday/index.html

FAA Incident. 

https://www.faa.gov/newsroom/faa-notam-statement

Survey of Threat Landscape.

https://www.washingtoninstitute.org/policy-analysis/survey-2023-terrorism-threat-landscape

Protecting data.

https://www.bbc.com/news/world-asia-china-64206950

https://www.dw.com/en/us-to-invest-millions-to-expose-kim-jong-un-regime-to-north-koreans/a-64405400?maca=en-rss-en-world-4025-rdf

Dose of Cyber!

https://analyst1.com/ransomware-diaries-volume-1/

https://twitter.com/andyjabbour/status/1615048335760719872?s=20&t=qBDUVHXSk_jkOYKoKPv1TQ

https://twitter.com/NSA_CSDirector/status/1613850710453501955?s=20&t=DsfyO-7Gt3uObRlRN4-zjg

https://arstechnica.com/information-technology/2023/01/vulnerability-with-9-8-severity-in-control-web-panel-is-under-active-exploit/

https://www.reuters.com/world/europe/russian-hackers-targeted-us-nuclear-scientists-2023-01-06/

https://meduza.io/en/news/2023/01/13/phishing-scam-invites-russian-telegram-users[…]heck-conscription-lists-to-see-if-they-ll-be-drafted-in-february

Embarking on year 4, the Risk Roundtable jumps two feet into 2023 by talking through the various physical and cyber threats that continue to present challenges. Jen opened up the discussion covering the latest breaches with password managers, fast food restaurants and even platforms that seem to be unbreakable. Matching Jen, Dave covers the wide variety of physical security threats and environmental considerations that organizations are already dealing with this year to include critical infrastructure concerns (power stations, solar plants), terrorism, and environmental factors, to include understanding the role that politics can have in the workplace. 

Before moving to the roulette round Andy led a discussion about the importance of preparedness in this complex environment and the risk of not evaluating these incidents and taking appropriate action. Jen then talked about the news and cyber implications around ChatGPT, as well as ensuring organizations are aware of some upcoming timelines such as the end of support for Windows 7 (yes, it is still being used). Dave transitioned and talked about Bridget Johnson's latest piece on 7 Terrorism Trends for 2023 before Andy wrapped up with the ever-popular three questions.

Some of the topics discussed include:

Imperva Report: More Lessons Learned from Analyzing 100 Data Breaches https://www.imperva.com/resources/resource-library/white-papers/more-lessons-learned-from-analyzing-100-data-breaches/

Not in a million years: It can take far less to crack a LastPass password Dec 28, 2022 https://blog.1password.com/not-in-a-million-years/

Troy Hunt on Twitter regarding Twitter breach: https://twitter.com/troyhunt/status/1611263070738972677?s=61&t=vOVhs4DMT_LNUVPd9z8gkg

We gave a few mentions of our esteemed colleague Bridget Johnson, @BridgetCJ on Twitter, and her recent article in HS Today, 7 Terrorism Trends to Watch in 2023.

Attacks on Critical Infrastructure to include power plants, and a solar energy farm

ChatGPT links:

SANS Institute https://www.sans.org/webcasts/what-you-need-to-know-about-openai-new-chatgpt-bot-and-how-it-affects-your-security-lightning-talks-panel-sessions/

https://www.darkreading.com/omdia/chatgpt-artificial-intelligence-an-upcoming-cybersecurity-threat-

https://www.hackread.com/hackers-openai-chatgpt-malware/

https://www.scmagazine.com/analysis/emerging-technology/cybercriminals-are-already-using-chatgpt-to-own-you

In this week's Security Sprint, Dave and Jen are joined by Alec Davison discuss:

7 Terrorism Trends to Watch in 2023 - https://www.hstoday.us/featured/7-terrorism-trends-to-watch-in-2023/

Two charged with attacks on four Pierce County power substations - https://www.justice.gov/usao-wdwa/pr/two-charged-attacks-four-pierce-county-power-substations|

Man, 34, is charged with terrorism after he ‘deliberately destroyed solar energy plant’ - https://tetracyclined7k.com/man-34-is-charged-with-terrorism-after-he-deliberately-destroyed-solar-energy-plant/

German police arrest Iranian man suspected of planning chemical attack - https://amp.theguardian.com/world/2023/jan/08/german-police-arrest-iranian-man-suspected-of-planning-chemical-attack

Political Violence.

https://thehill.com/homenews/state-watch/3802461-florida-man-arrested-for-threats-of-lgbtq-mass-shooting/

https://www.npr.org/2023/01/06/1147392476/albuquerque-democrats-attacks-homes-offices-bernalillo-new-mexico

Brazil protests and breach of government buildings - Brazil protests: Lula vows to punish ‘neo-fascists’ after Bolsonaro supporters storm congress

Cyber. 

Not in a million years: It can take far less to crack a LastPass password | 1Password

Mac vulnerabilities

Chick fil a breach

Windows 7 end of service

Gate 15 is kicking off 2023 with a new weekly pod with a sprint through the latest security news, risks and new threats and some of the key focus areas for organizations to consider behind the headlines. In this inaugural episode, Dave and Andy discuss:

Ransomware:

Ransomware gang apologizes, gives SickKids hospital free decryptor: https://www.bleepingcomputer.com/news/security/ransomware-gang-apologizes-gives-sickkids-hospital-free-decryptor/

Bleeping Computer: Ransomware gang cloned victim’s website to leak stolen data, 01 Jan 2023 https://www.bleepingcomputer.com/news/security/ransomware-gang-cloned-victim-s-website-to-leak-stolen-data/

ecrime Threat and Risk Intelligence Services https://ecrime.ch:  

Verve Security: How to Prevent Ransomware in 2023, 28 Dec 2022 https://verveindustrial.com/resources/blog/how-to-prevent-ransomware-in-2023/ which is not to be confused with The Verve: https://www.youtube.com/watch?v=1lyu1KKwC74

Climate / Weather: FEMA National Preparedness Report: https://www.fema.gov/emergency-managers/national-preparedness PDF: https://www.fema.gov/sites/default/files/documents/fema_2022-npr.pdf

Hostile Events: New York City and other attacks.

New York Post: Alleged Islamic extremist who attacked NYPD cops with machete was on FBI watchlist: sources, 01 Jan 2023 https://nypost.com/2023/01/01/alleged-islamic-extremist-who-attacked-nypd-cops-with-machete-idd/

New York Post: Mass shooting at Alabama New Year’s Eve celebration leaves one dead, 9 others injured, 01 Jan 2023 https://nypost.com/2023/01/01/1-dead-9-injured-in-alabama-new-years-eve-shooting/

And cyber hygiene - software updates: WIRED: Update Android Right Now to Fix a Scary Remote-Execution Flaw

Plus: Patches for Apple iOS 16, Google Chrome, Windows 10, and more., 31 Dec 2022 https://www.wired.com/story/android-ios-16-windows-10-critical-update-december-2022/

In this episode of The Gate 15 Interview, Andy Jabbour visits with Brian Harrell, Vice President and Chief Security Officer (CSO) at AVANGRID. Brian currently serves as the Vice President and Chief Security Officer (CSO) at AVANGRID, an energy company with assets and operations in 24 states. He is responsible for the company’s cybersecurity, privacy, physical security, threat management, and business continuity. 

In 2018, Brian was appointed by the President of the United States to serve as the sixth Assistant Secretary for Infrastructure Protection at the U.S. Department of Homeland Security. He was also the first Assistant Director for Infrastructure Security at the Cybersecurity and Infrastructure Security Agency (CISA). He has spent time during his career in the US Marine Corps and various private sector agencies with the goal of protecting the United States from security threats. Brian is a Board Member and Strategic Advisor to many great companies.

Brian on Twitter: @gridsecure 

In the discussion we address:

Brian’s background and path from law enforcement to infrastructure, CISA to AVANGRID 

Information Sharing 

Preparedness and Best Practices 

Evolving threats to energy and infrastructure, including hostile events, insider threats, cyberattacks and nation state threats, 3rd party risk and more 

We talk baseball, burgers, and boating, plus shoutouts to some valued friends and partners! 

A few references mentioned in or relevant to our discussion include: 

AVANGRID. “AVANGRID is a leading sustainable energy company transitioning America toward a clean and connected future headquartered in Orange, CT, and has a footprint in 24 states with $40 billion in assets. Our primary businesses are Avangrid Networks, which serves 3.3 million electric and natural gas customers in the Northeast, and Avangrid Renewables, the third-largest renewable energy company in the U.S. with a diverse onshore and offshore renewable energy portfolio.” 

WSJ Pro Research Survey: Preparedness Results, 29 Nov 2022 

The Cybersecurity and Infrastructure Security Agency (CISA) release of the Resilient Power Best Practices for Critical Facilities and Sites. This document supports emergency and continuity managers with guidelines, analysis, background material, and references to increase the resilience of backup and emergency power systems during all durations of power outages. Improving power resilience can help the nation withstand and recover rapidly from deliberate attacks, accidents, natural disasters, as well as unconventional stresses, shocks, and threats to our economy and democratic system. 

The Electricity Information Sharing and Analysis Center (E-ISAC) 

GridEx VII – November 14-15, 2023 

Space ISAC 

DHS CISA on Cyber-Physical Convergence 

Gate 15: Blended Threats (update 1.1): Understanding an Evolving Threat Environment (and numerous other blog posts, papers and exercises)