Each week the CyberWire’s Hacking Humans podcast looks behind the social engineering scams, phishing schemes, and criminal exploits that make headlines and take a heavy toll on organizations around the world. We talk to social engineering experts, security pros, cognitive scientists, and those practiced in the arts of deception (perhaps even a magician or two). We also hear from people targeted by social engineering attacks and learn from their experiences. Trust us: check out the first episode and subscribe today. The second episode will arrive Thursday. (Thanks to KnowBe4, our sponsors for season 1.)
By The CyberWire Staff
The US-North Korean summit, still on for June 12th, approaches. According to FireEye, interest by other powers—notably Russia and China—in the meetings is said to have prompted an increase in cyberespionage targeting South Korea.
The meetings may not address cybersecurity to any extent. Advisors and various policy mavens are recommending that President Trump concentrate on nuclear affairs, leaving cybersecurity for another time.
Where does North Korea get the hardware and software it needs to operate online, particularly the tools its elite needs to use the Internet? Recorded Future concludes that they get it mostly from the US, but in roundabout ways, using spoofed identities or third-party cutouts. This part of its sanctions regime may be more porous than the US Government would like.
Concerns about Russian election meddling persist, in the US and elsewhere. These concerns generally come down to fear of influence operations, and of amplified "divisive narratives" as opposed to direct disinformation. There are secondary concerns of course about voting integrity; Synack, for one, is offering US state election officials free penetration testing.
Lastline finds at least three sophisticated keylogger variants currently targeting financial institutions.
Cryptocurrency exchange Bitfinex is back online after sustaining a denial-of-service attack.
Former Trump campaign manager Paul Manafort faces additional charges based on evidence the FBI collected under a warrant for his iCloud account.
Microsoft had to outbid Google to buy GitHub.
Facebook allowed at least four Chinese firms, including usual suspects Huawei and ZTE, to access its data. Senators want explanations.
Today's issue includes events affecting Australia, Canada, China, European Union, Germany, Iran, Italy, Democratic Peoples Republic of Korea, Mexico, Russia, Spain, United Kingdom, United States, and Venezuela.
$8.76 million: The average yearly cost of insider threats. Get the report.
Insider threat incidents come with a hefty price tag, according to the “2018 Cost of Insider Threats: Global Organizations” report released by independent research group, The Ponemon Institute. Make sure that you understand the full context (and cost) of these threats by downloading the full report. Get your copy today.
TU-Automotive Cybersecurity Conference(Detroit, Michigan, United States, June 6 - 7, 2018) Uniting 150+ experts from the connected car and security industries to help automotive to apply technology and best practices to deliver robust security defenses and processes. Co-located with TU-Automotive Detroit, attendees can access the world’s largest automotive technology exhibition. CyberWire audience save $100 off standard and basic passes with code TCW100.
8th Annual (ISC)2 Security Congress(New Orleans, Louisiana, United States, October 8 - 10, 2018) The (ISC)2 Security Congress brings together the sharpest minds in cyber and information security for over 100 educational sessions covering 17 tracks. Join us to learn from the experts, share best practices, and make invaluable connections. Your all-access conference pass includes educational sessions, workshops, keynotes, networking events, career coaching, expo hall and pre-conference training. Save your seat at congress.isc2.org.
Sophisticated keyloggers target the finance industry(Help Net Security) Lastline found three separate strains of keylogger malware that are currently targeting finance. The share of malware samples that display all four of the key advanced malware behaviors was 20 percent higher than the global average.
iOS 12 users must unlock their iPhones every hour to maintain USB connections(AppleInsider) Apple has enhanced the USB Restricted Mode feature in the first beta of iOS 12, requiring users to unlock their iPhone once an hour to allow data transfers via the Lightning port, in an attempt to protect user data stored on iOS devices from acquisition by unlocking services employed by law enforcement officials.
I'll Believe Apple Is Killing Cops' Anti-Encryption Tools When They Actually Do It(Gizmodo) Among the blizzard of news bits from Apple’s WWDC, a much-anticipated feature has returned to the beta for iOS 12: a mode for keeping the FBI and other snoopers out of your phone. The feature has come and gone in the past, but it’s looking more real and better than ever this time around. Still, I’ll believe it when it’s actually live.
Key challenges and frustrations of SOC workers(Help Net Security) Technology challenges, hiring and staffing issues, processes and pain points, as well as finance and funding difficulties have the potential to limit the ability of SOCs to tackle ever increasing volumes of security alerts and potential cyber attacks, a new Exabeam report shows.
The harsh realities of endpoint management(Help Net Security) 88 percent of IT professionals acknowledge the importance of endpoint management, yet 30 percent don’t know how many they have. LogMeIn released findings of a new global report revealing current market trends and business threats driving the need for IT professionals to make endpoint management a priority.
American Cybercrime: The Riskiest States in 2018(Webroot Blog) Webroot analyzed all 50 U.S. states and Washington, D.C., ranking them from the riskiest states to the least riskiest on their cyber hygiene habits. Read our findings to better understand the online behaviors that can put you at risk.
Verizon expands cybersecurity services(RCR Wireless News) Verizon is expanding its managed cybersecurity offerings, dipping into threat-related data it collects across its own network to inform "cyber-situational awareness" for enterprise customers.
Qualys streamlines supply chain GDPR compliance assessment with cloud app(Help Net Security) Qualys announced new functionality in its Security Assessment Questionnaire (SAQ) cloud app that allows customers to better achieve visibility of data across their own network and supply chain for compliance with the European Union’s General Data Protection Regulation (GDPR).
whiteCryption’s Secure Key Box (SKB) Adds Speck Lightweight Cryptography to Protect IoT Devices From Hacks(Odessa American) whiteCryption, a subsidiary of Intertrust Technologies Corporation, the inventor of Digital Rights Management (DRM), today announced that its latest version of whiteCryption Secure Key Box™ (SKB) 5.13.0 includes the Speck lightweight block cipher. Speck is suitable for IoT devices due to its small memory and code footprint. Applications that use SKB can now exchange data with IoT devices that use Speck.
Beat the Odds: Why It’s Not Too Late To Start GDPR Compliance(Security Boulevard) After several years in the making and a tidal wave of press coverage, the long-awaited EU General Data Protection Regulation (GDPR) finally came into force on May 25. And we’re all still here. But even if you still haven’t got your compliance house in order, it’s not too late.
The Multi-Million Dollar Question: Who owns cloud security?(Bricata) The cloud is changing the way enterprises need to think about security because they don’t have the same visibility. Enterprises can go all cloud, all on-premise, or use a cloud hybrid approach and each comes with unique security challenges. #cloudsecurity #networksecurity
US Cyber Command is fast-tracking dedicated “cyberwarrior” training platform(OODA Loop) The U.S. Cyber Command is fast-tracking a training platform to provide “cyberwarriors” with training resources comparable to what traditional forces use to train on the ground. “According to Jim Keffer, director of cyber at Lockheed Martin, it will be more than just a cyber range” and will include scenario design
Does Russia Want a Cyber Agreement? Who’s Listening?(CyberDB) A recent interview of Russian President Vladimir Putin revealed insight into his – and by extension – Russia’s views concerning cyber attacks, and really the cyber domain, as a whole. Made at a joint press briefing with France’s president, when asked about alleged interference in the 2016 U.S. presidential election, Putin remarked: “Action always causes …
SIA Commends Department of Commerce and Department of Homeland Security on Botnet Report(Security Industry Association) Report follows Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure SILVER SPRING, Md. – On May 30, 2018, the U.S. Departments of Commerce and Homeland Security released an action-oriented report on how the private sector and government can collaborate to mitigate against the threat of botnets and automated distributed attacks. The…
Prominent Ukrainian Journalists Question 'Russian Hit List'(RadioFreeEurope/RadioLiberty) Ukrainian authorities claimed to have uncovered a “hit list” during the controversial operation they say was necessary to foil a real plot to assassinate Russian journalist Arkady Babchenko. But like that operation, some believe it to be a fake.
Cyber expert: Colangelo investigation like 'old-school detective work'(Sportsnet.ca) The Sixers have launched an investigation into whether Colangelo used a variety of Twitter accounts to anonymously trash some of his own players and fellow executives, including Toronto Raptors president Masai Ujiri, and defend himself against criticism from fans and the sports media.
For a complete running list of events, please visit the Event Tracker on the CyberWire website.
Cyber//2018(Columbia, Maryland, USA, June 6, 2018) Cyber touches all aspects of our life from the myriad of devices we have brought into our homes to those we employ on the job to increase and improve our productivity. Please join us for our 9th annual...
TU-Automotive Cybersecurity(Novi, MIchigan, USA, June 6 - 7, 2018) Co-located with the world's largest automotive technology conference & exhibition. The conference unites players from research labs, automakers, tier 1’s, security researchers, and the complete supply...
SINET Innovation Summit 2018(New York, New York, USA, June 7, 2018) Connecting Wall Street, Silicon Valley and the Beltway. SINET New York connects the United States’ three most powerful institutions and evangelizes the importance of industry, government and academic collaboration...
CYCON: Cyber for the Community(Reston, Virginia, USA, June 9, 2018) Join us for a day of Cyber Security talks on privacy, lock picking, the Dark Web, cyber education, building attack machines, phishing attacks, malware analysis, Internet of Things security, threat monitoring...
Transport Security and Safety Expo(Washington, DC, USA, June 11 - 12, 2018) Security incidents are expected to cost the world $6 trillion annually by 2021, making now the time to find out more at the 2018 Transport Security and Safety Expo. The transportation industry is rapidly...
Transport Security & Safety Expo(Washington, DC, USA, June 11 - 12, 2018) The conference is devoted to the challenges and opportunities surrounding ensuring the safety and security of passengers and cargo in the digital age.
Dynamic Connections 2018(Palm Springs, California, USA, June 12 - 14, 2018) Together with you, our customers and partners, we’ll come together for 2 ½ days to learn, explore and create the possible at Dynamic Connections 2018 (DC18). To get ahead of the most critical, most pervasive...
Norwich University Cyber Security Summit(Northfield, Vermont, USA, June 18 - 20, 2018) Norwich University’s College of Graduate and Continuing Studies (CGCS) is pleased to announce the second annual Cyber Security Summit in June 2018. The summit, presented in a continuing education format,...
GovSummit(Washington, DC, USA, June 27 - 28, 2018) GovSummit -- the government security conference hosted annually by the Security Industry Association -- brings together government security leaders with private industry technologists for top-quality information...
The Cyber Security Summit: DC Metro(Tysons Corner, Virginia, USA, June 28, 2018) Learn from cyber security experts from The U.S. Department of Justice, The NSA, Pulse Secure, CenturyLink and more as they brief you on the latest security threats facing your business. This event is...
Impact Optimize2018(Rosemont, Illinois, USA, June 28, 2018) Impact Optimize2018, the first-ever IT and Business Security Summit hosted by Impact, will provide attendees with actionable steps that enable the betterment of information, network and cybersecurity.
Nuclear Asset Information Monitoring and Maintenance(Warrington, England, UK, July 3 - 4, 2018) On July 3rd and 4th in Warrington United Kingdom, nuclear industry leaders will meet for the IoE Events Nuclear Asset Information, Monitoring and Maintenance conference to further develop the sector’s...
The Cyber Security Summit: Seattle(Seattle, Washington, USA, July 19, 2018) This event is an exclusive conference connecting Senior Level Executives responsible for protecting their company’s critical data with innovative solution providers & renowned information security experts.
Cyber Security Summit 2018(Newport, Rhode Island, USA, July 18 - 20, 2018) Join us for Opal Group’s Cyber Security Summit – set in Newport, RI, this premier event will gather C-Level & Senior Executives responsible for defending their companies’ critical infrastructures together...
SPONSOR & SUPPORT
Grow your brand and reach new customers.
Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.
Be a part of the CyberWire story.
People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.