skip navigation

More signal. Less noise.

MVISION Insights: Move Beyond Intelligence to Insights that Empower You to Change Your Environment.

Harnessing the power of one billion threat sensors worldwide, McAfee designs security fueled by Insights. MVISION Insights enables you to move beyond intelligence and empowers you to change your environment. Identify with Machine Learning. Defend and correct with Deep Learning. Anticipate with Artificial Intelligence. Move your security out of reactive mode to a proactive posture. McAfee, the device-to-cloud cybersecurity company. Go to McAfee.com/insights to learn more.

Daily briefing.

The Winnti Group, associated with the Chinese government and best-known for financially motivated attacks and industrial espionage, has turned its attention to Hong Kong. ESET reports finding that Winnti is using its eponymous Trojan to drop the ShadowPad backdoor in machines at five Hong Kong universities. The apparent purpose of the extensive campaign is to collect intelligence on protests of the Mainland’s role in the city. ShadowPad has many modules well-adapted to collection: one of them, for example, is a keylogger.

The US welcomes the EU’s decision on 5G network security, seeing it as European acknowledgement of the unacceptable risks untrusted suppliers bring. Computing reports that Secretary of State Pompeo is confident the US and UK will reach an understanding over Huawei.

The website of Serbian independent media outlet TV N1 has been disabled by distributed denial-of-service attacks this week, possibly DDoS for hire purchased from operators in China. The attacks come, says Balkan Insight, during a squabble with state-owned media over broadcast rights.

BleepingComputer reports that Microsoft has seen a resurgence of the EvilCorp cyber gang, phishing with malicious Excel files.

Vade Secure has found data stolen in the 2015 Ashley Madison breach resurfacing in highly specific blackmail attempts against former customers of the adultery facilitation service.

Digital Shadows says that the Sodinokibi ransomware crew is offering a $15 thousand prize for the best essay on a hacking topics. The researchers leave open the question of whether this represents a serious sharing of expertise or just “threat actor showboating.”

Notes.

Today's issue includes events affecting Australia, Canada, China, European Union, France, Iran, Israel, Italy, Japan, New Zealand, Russia, Saudi Arabia, Serbia, United Kingdom, United States.

Bring your own context.

Ransomware now routinely adds data theft to simple encryption of the victim's files.

"And then the criminals come back. And they say, OK, well, now we're going to release the documents if you don't give us more money, right? At that point in time, I said that nobody's going to agree to that because there's really nothing that stops them from asking you for more money over and over and over again, right? But what has happened is they are now essentially giving you the two-for-one option, right? They've increased the incentive. So now, when you get your files encrypted, the ransomware notice or the ransomware negotiation says, also, if you don't pay the ransom, we will release your files. That changes the value proposition dramatically, right? Now I get two benefits from paying the ransom. So if my files get encrypted and the person says, I won't release them if you pay the ransom, I won't make them public if you pay the ransom, then the incentive for me to pay the ransom has gone up while the cost has remained the same."

—Joe Carrigan, of the Johns Hopkins University's Information Security Institute, on the CyberWire Daily Podcast, 1.28.20.

Even some underwriters are biting this particular bullet.

Coming soon: CyberWire Pro.

Our new subscription program, CyberWire Pro, will be available soon. Designed for cyber security professionals and others who want to stay abreast of our rapidly evolving industry, CyberWire Pro is a premium news service that will save you time and keep you informed. Learn more and sign up to get launch updates here.

Simple, secure identity and access management for your business.

LastPass Identity provides simple control and visibility across every entry point to your business through single sign-on, password management and multi-factor authentication in one unified solution. LastPass Identity provides a holistic view of end user activity to simplify security for IT, all while delivering the passwordless login experience employees want. Start a free LastPass Identity trial today.

In today's CyberWire Daily Podcast, out later this afternoon, we speak with our partners at Terbium Labs, as Emily Wilson discusses the sale of “points” and “status benefits” on the dark web. Our guest is Michael Sutton from Stonemill Ventures, offering with insights from that part of the venture capital world that's particularly interested in investing in cybersecurity firms.

Cyber Security Summits: February 5 in Atlanta and on March 20 in Tampa (Atlanta, Georgia, United States, February 5, 2020) Sr. Level Executives are invited to learn about the latest threats & solutions in Cyber Security from experts from The FBI, U.S. Secret Service, IBM Security, Google and more. Register with promo code cyberwire20 for $95 VIP admission (Regular price $350) https://CyberSummitUSA.com

Suits & Spooks (Washington, DC, United States, February 6 - 7, 2020) Suits & Spooks DC is the only international security summit where the attendees and speakers from government agencies and technology companies engage in discussion and debate of security challenges. World-class speakers describe their vision of future threats and leading-edge companies will exhibit novel solutions. Get 15% off with discount code cyberwire15.

Cyber or Cleared Job Fair, February 13, San Antonio. (San Antonio, Texas, United States, February 13, 2020) Cleared and non-cleared cybersecurity pros make your next career move at the Cyber or Cleared Job Fair, February 13 in San Antonio. Meet face-to-face with leading cyber employers. Visit our site for more details.

RSAC 2020 (San Francisco, California, United States, February 24 - 28, 2020) Connect to the people and ideas that matter. To your growth. To your organization. At RSAC 2020, February 24 – 28, explore current and emerging trends, gain valuable skills and network with peers. Register today!

Cyber Attacks, Threats, and Vulnerabilities

Serbia’s Independent N1 Portal Buffeted by Cyber-Attacks (Balkan Insight) The Serbian website of the regional media outlet TV N1 has been hit by a wave of cyber-attacks in the last few days, after launching a public campaign to support the channel.

China's Winnti hackers (apparently): Forget the money, let's get political and start targeting Hong Kong students for protest info (Register) Supply-chain hackers now taking aim at kids fighting for democracy, say researchers

Winnti Group targeting universities in Hong Kong (WeLiveSecurity) ESET researchers have discovered a new campaign of the Winnti Group that deploys ShadowPad and Winnti malware to target universities in Hong Kong.

If the US launches cyberattacks on Iran, retaliation could be a surprise (Fifth Domain) The implication that cyberattacks are somehow a safer response for the United States than kinetic attacks is dangerous. More needs to be done to prepare the American people for Iranian cyber retaliation.

Iranian hackers monitor hotels, travel industry to follow targets, expert warns (Times of Israel) 'There are some serious physical concerns about potential victims being tracked,' FireEye's head of intelligence John Hultquist tells cybersecurity conference in Tel Aviv

Iran’s revenge is already well under way (Avast) Long stretch of reconnaissance, malware plantings position Iran to carry out varied attacks on the U.S. and its allies

BOJ warns of cyber-attack vulnerability ahead of Olympic Games (Reuters) Japan's financial institutions must guard against cyber-attacks ahead of th...

Human Rights Fears as UN Admits Major Breach (Infosecurity Magazine) Global body covered up 2019 attack by likely nation state group

U.N. Hack Stemmed From Microsoft SharePoint Flaw (Threatpost) Reportedly, the bug wasn't patched, leading to a data breach in July.

United Nations Data Breach Started with Microsoft SharePoint Bug (Dark Reading) A remote code execution flaw enabled a breach of UN offices in Geneva and Vienna, as well as the Office of the High Commissioner for Human Rights.

Prevailion Charts the Global Plunder of Known Ransomware Criminals (Prevailion) Education and Financial Sectors are in the crosshairs in a recent slate of ransomware attacks from TA505.

Microsoft Detects New Evil Corp Malware Attacks After Short Break (BleepingComputer) Microsoft says that an ongoing Evil Corp phishing campaign is using attachments featuring HTML redirectors for delivering malicious Excel documents, this being the first time the threat actors have been seen adopting this technique.

Sodinokibi Ransomware Group Sponsors Hacking Contest (Threatpost) Larger winnings for underground skills competitions are attracting sophisticated crime groups.

Memory Lane - Direct Memory Access Attacks (Eclypsium) High-speed DMA attacks can bypass built-in hardware protections on enterprise devices. Researchers from Eclypsium demonstrated that, even in the presence of protections such as UEFI Secure Boot, Intel Boot Guard, HP Sure Start, and Microsoft Virtualization-Based Security, laptops from Dell & HP were susceptible to pre-boot DMA attacks. This powerful class of attacks is an industry-wide issue that threatens servers as well as laptops.

Social media boosting service exposed Instagram passwords (TechCrunch) Exclusive: A bug in the service's website exposed thousands of Instagram passwords in plaintext.

Trello exposed! Search turns up huge trove of private data (Naked Security) A surprising number of users seem to be setting Trello boards, and their often highly sensitive content, to ‘public’.

Coronavirus conspiracy theories are flooding Facebook and Twitter, despite promises of a crackdown (The Telegraph) The Wuhan coronavirus has infected thousands and killed more than 170 people.

Keeping People Safe and Informed About the Coronavirus (About Facebook) We're working to limit the spread of misinformation and harmful content.

Five Years Later, Ashley Madison Data Breach Fuels New Extortion Scam (Email Security | Vade Secure) The Ashley Madison data breach of 2015 is coming back to haunt victims in a big way, with leaked data fueling a new wave of extortion scams.

Texting scam using links to target personal information (WCTI) When a text message with a link appears to be from a packaging company, many people say their first instinct is to open the link. However, opening some of these text messages could help hackers steal personal information. It is all part of scam officials call smishing - also known as SMS phishing. Hackers are attempting to get personal information through text, similar to phishing emails.

Huge growth in malware connected to popular musicians - Kaspersky (Future Five) Cybercriminals are actively abusing the names of artists and songs nominated for a Grammy 2020 award, in order to spread malware.

Phone phishing scams now targeting Social Insurance Numbers (CityNews Toronto) A different version of phone scams currently doing the rounds has fraudsters aiming for a large cache of information rather than just cash - your Social Insurance Number (SIN).

DOD contractor suffers ransomware infection (ZDNet) Virginia-based EWA has had systems infected with the Ryuk ransomware.

US Defense Contractor Hit by Ryuk Ransomware (Infosecurity Magazine) Websites down at EWA as attackers step up efforts

Touchdown! Measuring External Cyber Posture and the NFL Hack (Panorays) How were the NFL teams hacked, and was there any indication that some teams were more or less likely to be targeted? The answers may surprise you.

State Treasurer Warns of New Lottery Texting Scam (1420 WBSM) Massachusetts Treasurer Deb Goldberg issued a press release Friday warning state residents of a lottery scam being conducted via text messages.

Please don't fall for these surprisingly badly written phishing scam emails (ZDNet) A new wave of fraud emails are circulating, but many of them are pretty easy to spot.

Medtronic 2090 Carelink Programmer Vulnerabilities (Update C) (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.1 Vendor: Medtronic Equipment: 2090 CareLink Programmer, 29901 Encore Programmer Vulnerabilities: Storing Passwords in a Recoverable Format, Relative Path Traversal, Improper Restriction of Communication Channel to Intended Endpoints 2.

Medtronic Conexus Radio Frequency Telemetry Protocol (Update A) (CISA) 1. EXECUTIVE SUMMARY CVSS v3 9.3 ATTENTION: Exploitable with adjacent access/low skill level to exploit Vendor: Medtronic Equipment: MyCareLink Monitor, CareLink Monitor, CareLink 2090 Programmer, specific Medtronic implanted cardiac devices listed below Vulnerabilities: Improper Access Control, Cleartext Transmission of Sensitive Information 2.

Security Patches, Mitigations, and Software Updates

Zoom Fixes Flaw That Could Allow Strangers Into Meetings (BankInfo Security) Conferencing service provider Zoom has fixed a vulnerability that - under certain conditions - could have allowed an uninvited third party to guess a meeting ID and

Cyber Trends

2019 Holiday Shopping Season Threat Review (RiskIQ) This holiday shopping season raked in a record $1 trillion, an increase of nearly $300 billion from 2018. Overall online sales increased 13%, while Black Friday and Cyber Monday saw 17% and 19% increases, respectively.

80% of successful breaches are from zero-day exploits (Help Net Security) Organizations are not making progress in reducing their endpoint security risk, especially against new and unknown threats.

Marketplace

How will the UK tech sector be affected by Brexit? (Information Age) With the transition period for Brexit beginning tonight, we explore what Brexit will mean for the UK tech sector

Space executive says the industry needs help to understand cyber threats (SpaceNews.com) Emerging companies in the space industry lack cybersecurity expertise and may be ill prepared to prevent or respond to attacks.

Raytheon Takes Control of Forcepoint Cybersecurity Business (Wall Street Journal) The defense company said it paid $588 million to Vista Equity Partners for its minority stake in Forcepoint, four years after creating a business aimed at selling military-style cyber products to commercial clients.

Israel Electric inks deal to help safeguard Tokyo Olympics from cyberattack (Times of Israel) IEC signs agreement with Japanese energy utility to secure critical infrastructure during games, also launches new set of cybersecurity tools at Cybertech 2020 confab in Tel Aviv

Microsoft invites gamers and researchers to new Xbox bug bounty program (Help Net Security) Microsoft invites gamers and researchers to participate in Xbox bug bounty program. ounty rewards will range from $500 to $20,000 USD.

IBM’s Ginni Rometty Steps Down as CEO (Wall Street Journal) Ginni Rometty is retiring after almost 40 years at IBM and will be succeeded as CEO by Arvind Krishna, who heads the company’s cloud and cognitive-software division.

Cybersecurity: Die Frau, die Siemens hackt (Süddeutsche Zeitung) Fabienne Waidelich und ihr Team versuchen jeden Tag, in die Computer von Siemens einzubrechen. Warum? Damit es kein anderer macht. Über eine Frau in einer Männer-Domäne und die Frage: Was macht ein Hacker eigentlich?

Cyber Campus backed by Orange, Atos and Thales to open in Paris in Q1 2021 (Telecompaper) France's secretary of state for digital affairs, Cedric O, has announced the launch of the Cyber Campus initiative with the publication of a paper presenting the project, which owes its origin to the work of Michel Van Den Berghe, CEO of Orange Cyberdefense. Located in the Paris region, the new 10,000 square metre site will group between 500 and 1,000 cyber security experts from its launch, which is planned for Q1 2021.

Cybersecurity firm plans move to Fairlawn (Akron Beacon Journal) TrustedSec started in the basement of a Northeast Ohio home in 2012.Almost eight years later, the information security consulting firm that breaks into

Products, Services, and Solutions

New infosec products of the week: January 31, 2020 (Help Net Security) Featured infosec products this week come from the following vendors: Swimlane, RiskSense, Cisco, and Magnet Forensics.

Technologies, Techniques, and Standards

SEC Publishes Cybersecurity and Resiliency Best Practices (Security Magazine) The SEC has published guidance to help firms in the securities market enhance their cybersecurity preparedness and operational resiliency.

What's Actually on the Dark Web (Vice) Dark web researcher Emily Wilson explains the good, bad, and nefarious parts of the dark web to CYBER.

How states held hostage by ransomware attacks can take control (Boston Globe) It’s not clear that government officials are learning the right lessons from these attacks about how to secure their citizens and online infrastructure.

Facebook knows a lot about your online habits – here’s how to stop it (Naked Security) Facebook’s new Off-Facebook Activity feature is part of the company’s effort to appear more privacy-friendly to its users.

Avoiding Risk Acceptance With Security Alerts (Forbes) Resolving alerts without accepting risk requires resolving every alert without crippling the effectiveness of security tools by changing alert thresholds or ignoring security events.

Russia Blocks ProtonMail and ProtonVPN, Tor to the Rescue (BleepingComputer) Proton Technologies​​​​​​​' security-focused ProtonMail end-to-end encrypted email service and ProtonVPN VPN service have been blocked by the Russian government within Russia since yesterday.

Can the government stop fake comments on its rules without alienating citizens? (Federal Times) Innovations that make it harder for people to spam public comment opportunities could also make concerned members of the public less likely to participate.

Facebook Won’t Remove This Woman’s Butthole As A Business Page (BuzzFeed News) “This unofficial Page was created because people on Facebook have shown interest in this place or business. It's not affiliated with or endorsed by anyone associated with Samantha Rae Anna Jespersen's

Design and Innovation

The Fractured Future of Browser Privacy (Wired) Better anti-tracking measures have become the norm for Chrome, Firefox, Safari, and other modern browsers. But they still disagree on how exactly they should work.

Academia

Cyber Hawks team cracks NSA codebreaker challenge (Dahlonega Nugget) As computer scientists representing 532 universities across the United States competed to crack the latest NSA Codebreaker challenge, UNG proved to be a consistent force in the world of cyber secur

LT's CyberPatriots compete at national level (La Grange, IL Patch) One of your neighbors posted in Schools. Click through to read what they have to say. (The views expressed in this post are the author’s own.)

Texas schools now required to craft cybersecurity plans, staff to undergo training (KXAN.com) Texas lawmakers passed legislation last year enhancing cybersecurity requirements for school districts.

Legislation, Policy, and Regulation

Attempts to define international infosec rules of the road bogged down by endless talkshops, warn diplomats (Register) Do you want Russia or China writing treaties on what's cool online?

Diskin: Achieve cybersecurity with preemptive strikes (The Jerusalem Post) Diskin said, “The world of information security tends to forget cyberattacks did not happen by themselves or from computers."

United States Welcomes the EU’s Acknowledgement of the Unacceptable Risks Posed by Untrusted 5G Suppliers (United States Department of State) On January 29, the European Union (EU) Network Information Security Cooperation Group released a toolbox of recommended measures to mitigate security risks in 5G networks.  The United States welcomes this initiative from Member States, the Commission, and the EU Cybersecurity Agency. The Toolbox acknowledges that suppliers with high risk profiles (e.g., companies based in third …

Why Britain's spooks ‘think they know better’ than the US on Huawei (The Telegraph) In a sleepy business park on the edge of Banbury, a red-brick building houses what has become one of Britain’s most important weapons against state-backed cyber crime.

Huawei 5G verdict is decision 'with few good options' (BBC News) The government is due to decide later whether to ban Huawei from the UK's 5G networks.

US says 'Five-Eyes' intelligence alliance will remain in place despite Britain's Huawei decision (Computing) US Secretary of State Mike Pompeo confident of US and UK resolving their differences,Government

No Huawei ‘Smoking Gun’ in Europe, French Cyber Chief Says (Yahoo) France’s cybersecurity chief said his agency hasn’t uncovered any evidence of Huawei Technologies Co. spying via Europe’s communications networks, shrugging off U.S. and German concerns.Guillaume Poupard, the head of the national cybersecurity agency ANSSI, spoke following reports of a

Italy has no plans to exclude Chinese telecom firms, including Huawei from 5G network (Tech2) The United States has lobbied Italy and other European allies to avoid using Huawei equipment.

Brexit to Add Sanctions Compliance Complexity (Wall Street Journal) Britain is set to officially withdraw its membership from the European Union on Friday, but EU regulations still apply during the transitional period until Dec. 31.

Ottawa should follow allies in public-private collaboration, says cyber industry group (IT World Canada) Fed up with what it believes is a federal government that doesn't work closely enough with the private sector on cybersecurity-related acquisitions,

The Cybersecurity 202: Election officials confident about security days before first contests of 2020 (Washington Post) Election officials are striking a confident tone about digital security at their final summit before caucus and primary season begins. But they're also planning for the worst, war-gaming how to handle any major hacks from Russia or other adversaries.

Intel: Democrats push Trump administration to crack down on Saudi prince (Al-Monitor) Emboldened by the latest United Nations report implicating Crown Prince Mohammed bin Salman in hacking Amazon CEO Jeff Bezos’ phone, Democrats are pushing the Donald Trump administration to toughen up on the Saudi heir.

Democratic senator asks intelligence agencies to open probe into Bezos phone hack (TheHill) Sen. Chris Murphy (D-Conn.) on Wednesday asked the FBI and the Office of the Director of National Intelligence (DNI) to probe recent reports that Amazon CEO Jeff Bezos’s phone was hacked by Saudi Arabian officials. 

The EARN IT Act: How to Ban End-to-End Encryption Without Actually Banning It (Center for Internet and Society) There’s a new bill afoot in Congress called the EARN IT Act. A “discussion draft” released by Bloomberg is available as a PDF here. This bill is trying to convert your anger at Big Tech into law enforcement’s long-desired dream of banning strong encryption. It is a bait-and-switch. Don’t fall for it.

A Primer on the California Consumer Privacy Act (Radware Blog) At its core, the CCPA is a data protection policy to ensure that the privacy rights of internet users in California are seriously enforced.

Leading Army Reserve Cyber Talent To Keystone State (DVIDS) Shaping the Army Reserve cyber force is still evolving from refining strategy and methodology to delivering proper talent management for the training of new reserve cyber warriors.

Employers can’t force you to get microchipped, Indiana reps say (Naked Security) The US state wants to make sure employers don’t “overstep their bounds” by imposing mandatory employee microchipping.

Litigation, Investigation, and Law Enforcement

Jeff Bezos met FBI investigators in 2019 over alleged Saudi hack (the Guardian) Amazon founder interviewed as FBI conducts inquiry into Israeli firm linked to malware

Remember FindFace? The Russian Facial Recognition Company Just Turned On A Massive, Multimillion-Dollar Moscow Surveillance System (Forbes) Russian company’s CEO claims it’s the biggest live facial recognition project in the world.

Exclusive: FBI probes use of Israeli firm's spyware in personal and government hacks - sources (Reuters) The FBI is investigating the role of Israeli spyware vendor NSO Group Technologi...

Government spyware company spied on hundreds of innocent people (Naked Security) eSurv execs have been charged with fraud, unauthorized access to a computer system, illicit interception and illicit data processing.

AIG must cover client's $5.9 million in cyber-related losses, judge rules (CyberScoop) Insurance giant AIG must cover nearly $6 million in losses for a client that was fleeced by an email scam carried out by suspected Chinese hackers, a federal court has decided. A judge in the Southern District of New York ruled Wednesday that AIG was in breach of contract when it previously denied a claim from SS&C Technologies, a $6 billion financial technology firm.

Canadian insurance firm pays off hackers to remove ransomware (Insurance Business) News of the attack was not publicly disclosed until the firm's reinsurer filed court documents – in the UK

Dallas County attorney agrees to drop charges against men contracted by judicial branch to test courthouse security (Des Moines Register) The charges against two men arrested while testing the security of an Iowa courthouse while on contract with the judicial branch have been dropped.

Dallas County drops charges against men who tested courthouse's security by breaking in (KCCI) The CEO of Coalfire, Tom McAndrew, said the Dallas County Courthouse doors were unlocked and deputies responded after one of the Coalfire employees intentionally tripped an alarm in the building.

Data-breach uni pays out £140k compensation (BBC News) Students' personal details, including information on health problems, were sent to 298 people.

Hacker snoops on art sale and walks away with $3.1m, victims fight each other in court (ZDNet) Each impacted party is claiming the other is responsible for not detecting the scam. The ownership of a valuable painting is at stake.

A year after Bank of Valletta 'cyber heist', cuffs applied as cash-cleansing case continues (Register) Would sir care for an Audi with that Jag?

‘Please be young,’ the Craigslist personal ad read. Feds say it led them to a Portsmouth man’s stash of child porn. (Virginian-Pilot) Robert H. Birchett, a petty officer 1st class stationed aboard the USS George H.W. Bush, denied trying to have sex with a child.

For a complete running list of events, please visit the Event Tracker on the CyberWire website.

Newly Noted Events

LBC2 (Towson, Maryland, USA, January 7, 2020) The third annual Loyola Blakefield Cyber Challenge is an exciting event for all participants. It will take place on March 7, 2020 at Loyola Blakefield High School. The challenge is created by students...

IFSEC 2020 (London, England, UK, May 19 - 21, 2020) IFSEC presents up-to-date information on the newest products, emerging trends and best practices in the safety and security industry, and access control. You will see established and emerging companies...

Grow your brand and reach new customers.

Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.

Be a part of the CyberWire story.

People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.