Don’t slow down development for application security.
We know that application security testing is a bottleneck for software development—but it’s also crucial. You need a solution that can simplify and automate as much of that process as possible without grinding development to a halt. Code Dx automates the most time-consuming steps in AppSec testing, keeping your DevOps pipeline running as smoothly as possible.
December 19, 2019.
By the CyberWire staff
Spain’s state-owned broadcaster TVE says that a portal they’d inadvertently left open was exploited last week by parties unknown to air an RT-produced interview with self-exiled Catalan separatist leader Carles Puigdemont. Reuters asked, and RT says they didn’t do it.
Fox-IT has been looking at an operation they call "Wocao," a China-based collection effort that’s prospecting energy, technology, and healthcare targets in at least ten countries. They’ve concluded “with medium confidence” that the group behind Wocao is APT20, a Beijing-controlled hacking crew that had been relatively quiet for the last few years.
Blackberry Cylance researchers announced the discovery of Russia-connected Zeppelin ransomware last week. Yesterday Morphisec offered some fresh insight into how Zeppelin is propagated: by leveraging the ConnectWise remote desktop application.
Germany's BSI security agency has issued a warning that criminals misrepresenting themselves as BSI operators are distributing Emotet malware in a spam campaign.
The US Congress is in a stern mood with respect to China and Russia. The Washington Post reports widespread skepticism on Capitol Hill that Beijing can be trusted to live up to the explicit security guarantees (still less the implicit ones) in any trade accords so far negotiated. And Reuters notes that an unusually stiff sanctions bill directed against Russia cleared the Senate Foreign Relations Committee yesterday.
Nathan Wyatt, a British subject accused of being part of the Dark Overlord gang, was extradited to the US and arraigned yesterday in a St. Louis Federal court on hacking-related charges. He entered a plea of not guilty.
Today's issue includes events affecting Austria, Canada, China, Estonia, European Union, France, Georgia, India, Netherlands, Russia, Ukraine, United States.
Bring your own context.
Let's pause and review why people in government and industry are as concerned as they are about 5G, especially when Huawei and ZTE come up as 5G equipment vendors.
"5G has a tremendous amount of potential, and it is going to be the enabler for the true expansion of what people call the internet of things. That's where, you know, your refrigerator, your baby camera, your car - everything is wirelessly connected. But that puts an even greater premium on security because if you're in an autonomous or semi-autonomous vehicle and, all of a sudden, the 5G connection is shut off, you get into an auto accident. If you're running your critical infrastructure on 5G and it gets shut off, all of a sudden, that goes dark. So more than ever, given the number of devices that are going to be part of this network, we need to build security by design when we architect the hardware and software. And that's been the subject of a good deal of discussion because right now, Chinese companies like Huawei and ZTE are ahead of most Western companies in terms of their ability to build and install hardware and software for 5G at the scale you would need for it to be really operational. And that raises questions about whether giving Chinese companies that kind of commanding position in the infrastructure of the technology would not only create the opportunity to engage in theft of data, but could also allow the Chinese, in some circumstances, to actually dial back or turn down the effectiveness of the networks."
—Michael Chertoff, former U.S. secretary of Homeland Security and current head of the Chertoff Group, on the CyberWire Daily Podcast, 12.17.19.
Pervasive connectivity among devices that run without a great deal of human intervention, and a vastly expanded attack surface.
Get your copy of the definitive guide to threat intelligence.
We brought together a team of experts and wrote the definitive guide to everything you need to know about threat intelligence. Whether you work in vulnerability management, incident response, or another part of cybersecurity, our book has something for you. Get your free copy of “The Threat Intelligence Handbook” now.
ON THE PODCAST
In today's Daily Podcast, up later this afternoon, we speak with our partners at Webroot, as David Dufour reviews their 2019 mid-year threat report. Our guest is James Ritchey from GitLab, with lessons learned on the one-year anniversary of their bug bounty program.
Hacking Humans is up. In this week's episode, "Managing access and insider threats," we hear that Joe's wife has been getting suspicious shipping notices. Dave describes a phone scam where crooks intercept phone calls. The catch of the day turns the tables on a would-be scammer. Carole Theriault speaks with Peter Draper from Gurucul about their 2020 Insider Threat Report.
And in case you missed it, Caveat is up, too. On this week’s show, "The cyber resiliency of White House operations," Ben unpacks a recent Capitol Hill hearing on the crypto wars, Dave describes a ruling that addresses biometrics and self incrimination. Our guest is Christopher Whyte, an assistant professor of homeland security and emergency preparedness at Virginia Commonwealth University. We’ll be discussing the notion that cyber security in the White House is in disarray.
Information Security Institute Virtual Information Session(Online, January 23, 2020) Our graduate students in the Johns Hopkins University Information Security Institute work alongside our faculty who are world-renowned for their research in cryptography, privacy, medical information security, and network and system security. To learn more, register for the January 23rd one-hour session to get an overview of the Information Security Institute. Panelists will provide a program overview, areas of research, admissions requirements, and discuss life in Baltimore.
6th Annual Cyber Security Conference for Executives(Baltimore, Maryland, United States, March 25, 2020) The 6th Annual Cyber Security Conference for Executives, hosted this year by The Johns Hopkins University Information Security Institute and Ankura, will be held on Wednesday, March 25th, in Baltimore, Maryland. Learn about the do’s and don’ts of risk management with industry leaders and other cyber professionals. Check out the details at http://isi.jhu.edu and click on 6th Annual Cybersecurity Conference for Executives.
Malware Spotlight: What is BabaYaga?(Infosec Resources) Introduction In traditional Slavic cultures, Baba Yaga is an entity that haunts the dreams of children and a common threat that parents use when their
Extortion attacks are ‘worst-case scenario:’ expert(Toronto Sun) Cyber attacks like the one inflicted upon LifeLabs are among the most concerning, says a Vancouver-based cybersecurity expert.“Attacks like these are the worst-case scenario for any security …
Cyber attack shuts down 12-year-old Dublin business(Columbus Business Journal) A massive cyber attack so damaged the servers running a company that it had to close its doors and seek new homes for hundreds of products and businesses. "It’s devastating," the company's CEO said.
Integris Software 2020 Financial Services Data Privacy Maturity Study(Integris Software) Integris Software recently surveyed an exclusive community of 258 top business executives and IT decision-makers across financial services, retail, government, and healthcare organizations to compile a series of reports to determine privacy practices, challenges, data complexities, and preparedness to comply with privacy regulations.
Holiday Threat Report(DEVCON | Cybersecurity for the Web) The DEVCON 2019 Holiday Threat Report details ad threat activity during the critical online shopping period between Thanksgiving and Cyber Monday, and describes how attacks are evolving into broader, more sophisticated risks for companies and their customers.
2019 State of the API(Postman) Postman's 2019 “State of the API” report is based on an exclusive survey of more than 10,000 API developers, users, testers, and executives.
IBM X-Force Security Predictions for 2020(Security Intelligence) Experts from IBM X-Force reflect on the past year and also share security predictions for 2020, including evolutions in ransomware, AI adoption and targets for cybercriminals.
Analysis | How Huawei Landed at the Center of Global Tech Tussle(Washington Post) This was supposed to be the year that Huawei Technologies Co., China’s biggest tech firm, rose to global prominence as the leader in 5G, the much ballyhooed, next-generation wireless technology. Instead, it’s landed in the crossfire of a brutal trade war between the U.S. and China, with the Trump administration pushing allies to ban Huawei equipment from their telecom networks over security concerns. The dispute is threatening to divide German Chancellor Angela Merkel’s ruling coalition, after C
Ground-up cybersecurity(Control Global) Just as users must be sure their contractors and clients are protected—and not just themselves—they must also extend cybersecurity beyond—and below—their usual networks, especially to sensors, instruments and other plant-floor devices.
Anyone Can Check for Magecart with Just the Browser(Trustwave) In the past, there have been plenty of articles and blog posts recommending the use of Content Security Policy (CSP) and Sub Resource Integrity (SRI) to prevent the insidious skimming malware from taking hold of a website. However, what can a small business owner do if resources are limited and implementing these countermeasures is just not feasible?
Moving beyond security 'blocking and tackling'(Healthcare IT News) Darren Lacey, CISO at Johns Hopkins University and Johns Hopkins Medicine, says vulnerability management looks at a more balanced security world that protects not only data, but also transactions and systems integrity.
Data storage military aerospace applications(Military & Aerospace Electronics) It’s not just about shielding data drives from shock and vibration; designers also are looking for the latest in speed and capacity, and want encryption to protect data at rest, and security to foil tampering.
The Drums of Cyberwar(terrorism Watch) In mid-October, a cybersecurity researcher in the Netherlands demonstrated, online, as a warning, * the easy availability of the Internet...
How India Dealt With Cyberattacks In 2019(Analytics India Magazine) Cyberattacks are rife in India, only the US and China are placed higher on this list. Bangalore, Mumbai, Delhi are among states which receives the highest traff
House Okays $1 Billion Huawei/ZTE ‘Rip and Replace’ for Comms Providers(MeriTalk) The House voted Dec. 16 to approve legislation that would provide $1 billion to smaller-sized private sector communications service providers to remove from their networks equipment purchased from China-based equipment makers Huawei and ZTE, and replace that gear with equipment that does not pose a threat to U.S. national security.
Senate advances bill to punish Russia for election interference(WCBI TV) On the same day that the House is expected to impeach President Trump for soliciting a foreign country’s help in the 2020 election, the Senate advanced a bill to punish Russia for meddling in America’s 2016 election. The Defending American Security from Kremlin Aggression Act (DASKA) passed the Senate Foreign Relations Committee on …
Trump nominates DHS senior cyber director(TheHill) President Trump on Wednesday formally submitted the nomination for a new assistant director of cybersecurity at the Department of Homeland Security (DHS), one of the top-ranking cyber officials at the agency.
Siemens Contract Employee Gets Jail Time for Intentionally Damaging Computers(U.S. Attorney’s Office for the Western District of Pennsylvania) A contract employee for Siemens Corporation at the Monroeville, PA location has been sentenced in federal court to a six-month term of imprisonment to be followed by a two-year term of supervised release, and a fine of $7,500 on his conviction of intentional damage to a protected computer, United States Attorney Scott W. Brady announced today.
Huawei’s Battle Against FCC’s Subsidy Ban Faces Long Odds(Bloomberg Law) Huawei Technologies Co.'s Fifth Circuit challenge to a Federal Communications Commission ban against carriers using federal subsidies to buy its equipment is unlikely to succeed, attorneys and academics watching the case say.
ISSA Central MD Information Security Conference(Columbia, Maryland, USA, February 28, 2020) Information System Security Assocition's Central Maryland Chapter is hosting a day long cybersecurity conference spanning two tracks that'll include topics covering: Leadership in cybersecurity - why it...
2020 Cipher Brief Threat Conference(Sea Island, Georgia, USA, March 22 - 24, 2020) The Cipher Brief Threat Conference brings together the expertise of one of the most trusted and relevant news sources for national security professionals around the globe. Attendees will engage with some...
CPX 360 Bangkok(Bangkok, Thailand, January 14 - 16, 2020) Mark your calendar now for CPX 360 2020, the world’s premiere cyber security summit of the year. Globally renowned industry experts will take to the stage to share analysis, core insights, and actionable...
Cyber Security for Critical Assets, MENA 2020(Dubai, United Arab Emirates, January 20 - 21, 2020) The 17th in a global series of Cyber Security for Critical Assets summits, #CS4CA MENA 2020 focuses on safeguarding the critical industries of the Middle East and Northern Africa from cyber threats. CS4CA...
CPX 360 New Orleans(New Orleans, Lousiana, USA, January 27 - 29, 2020) Mark your calendar now for CPX 360 2020, the world’s premiere cyber security summit of the year. Globally renowned industry experts will take to the stage to share analysis, core insights, and actionable...
SINET: Global Cybersecurity Innovation Summit(London, England, UK, January 30, 2020) Advancing global collaboration and innovation, SINET convenes a summit of international cybersecurity leaders at the British Museum. The conference will bring together innovators, investors, researchers,...
SPONSOR & SUPPORT
Grow your brand and reach new customers.
Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.
Be a part of the CyberWire story.
People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.