Pervasive OSINT and a shift toward a defensive advantage.

Announcement

Join us for the Women in Cyber virtual panel discussion.

As part of N2K’s Women in Cyber series and in partnership with Tulsa Innovation Labs, we’re hosting an engaging virtual discussion featuring insights, experiences, and strategies for advancing more women into leadership roles within the field. Register now and join us for this inspiring conversation.

N2K offers a new, on-demand course.

Based on our CSO's latest book, Cybersecurity First Principles: A Reboot of Strategy & Tactics, N2K has launched an on-demand course, featuring Rick “The Toolman” Howard himself as the instructor. Get a high-level overview of the strategies to pursue the absolute cybersecurity first principle: Reduce the probability of material impact due to a cyber attack. It’s the perfect quick-hitting content for busy security professionals, and it’s available now. Learn more here.

Summary

By the CyberWire staff

At a glance.

More evidence of OSINT's reach.
An Apache vulnerability is being used to install ransomware.
Exploitation of Citrix vulnerability in the wild.
AP sustains DDoS attack.
Microsoft draws a lesson from Russia's war: cyber defense now has the advantage over cyber offense.
HHS reaches settlement in HIPAA data breach incident.

More evidence of OSINT's reach.

Open source intelligence (OSINT) has shown its value in both of the major wars currently being fought, the war between Russia and Ukraine, and the conflict between Israel and Hamas. NPR describes, in the course of reporting Israel's ground operations into Gaza, how such sources enable observers to track action on the ground. The principal sources of information in Gaza have been overhead imagery, provided by commercial satellites with a timeliness and resolution formerly available only to the best-equipped nation-states, and social media--video, reports, audio, and so on. The social media can't be naively accepted as ground truth, but it represents information that can be sifted, assessed, and analyzed.

An Apache vulnerability is being used to install ransomware.

Huntress and Rapid7 have observed exploitation of a remote code execution vulnerability (CVE-2023-46604) affecting Apache ActiveMQ. The flaw is being used to deploy the HelloKitty ransomware. Apache released patches for the vulnerability on October 25th, and Rapid7 says the exploitation began two days later, on October 27th.

Rapid7 reported Wednesday, “The threat actor’s attempts at ransomware deployment were somewhat clumsy: In one of the incidents Rapid7 observed, there were more than half a dozen unsuccessful attempts to encrypt assets.” CVE-2023-46604, which has a CVSS score of 10, can “allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.”

Huntress wrote yesterday, “Exploitation for this attack is trivial. There is a Metasploit module that automates exploitation for this attack. The Huntress team confirms that this module works like a charm against vulnerable instances of ActiveMQ.”

Exploitation of Citrix vulnerability in the wild.

The Citrix Bleed vulnerability (CVE-2023-4966) affecting NetScaler ADC and NetScaler Gateway remains under active exploitation. Citrix issued patches for the flaw early last month. NetScaler has offered advice on mitigation. Mandiant has been researching the risk, and this morning updated its research into the exploitation: "Mandiant is currently tracking four distinct uncategorized (UNC) groups involved in exploiting this vulnerability. We have observed some lower degrees of confidence overlaps in post-exploitation stages among these UNC groups, like using the same recon commands and utilities available on Windows."

Join the Lacework CISO book club!

Get a copy of the classic novel, The Phoenix Project, and join quarterly interactive discussions with cybersecurity leaders. Sign up here.

AP sustains DDoS attack.

The Associated Press (AP) has reported that its site, apnews.com, was intermittently unavailable Tuesday as it underwent a flood of traffic during what appears to have been a distributed denial-of-service (DDoS) attack. Anonymous Sudan, a nominal hacktivist organization that's actually a front group for Russian intelligence and security services, announced in its Telegram channel that it intended to disrupt Western media, and informed speculation (as seen, for example, in Tech Monitor) holds it likely that this group was responsible for the attack on the AP. But the AP itself says it's been unable to conclusively attribute the incident to Anonymous Sudan.

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. CyberVista’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

Microsoft draws a lesson from Russia's war: cyber defense now has the advantage over cyber offense.

In announcing its Secure Future Initiative, Microsoft sees Russia's hybrid war as having demonstrated that the advantage in cyberspace has swung from the offense to the defense. "The war in Ukraine has demonstrated the tech sector’s ability to develop cybersecurity defenses that are stronger than advanced offensive threats," the company writes. "Ukraine’s successful cyber defense has required a shared responsibility between the tech sector and the government, with support from the country’s allies. It is a testament to the coupling of public-sector leadership with corporate investments and to combining computing power with human ingenuity." And Redmond thinks that AI promises even more to the defenders. "As much as anything, it provides inspiration for what we can achieve at an even greater scale by harnessing the power of AI to better defend against new cyber threats."

The company has committed to improving cyber defense in these ways:

"First, we are taking new steps to use AI to advance Microsoft’s threat intelligence."
"Second, we are using AI as a gamechanger for all organizations to help defeat cyberattacks at machine speed."
"Third, we are securing AI in our services based on our Responsible AI principles."

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

HHS reaches settlement in HIPAA data breach incident.

The US Department of Health and Human Services’s (HHS) Office for Civil Rights (OCR) has reached a $100,000 HIPAA (Health Insurance Portability and Accountability Act) settlement with a Massachusetts medical management company, Doctors’ Management Services, over a ransomware attack the company sustained in 2018.

HHS states, “On April 22, 2019, Doctors’ Management Services filed a breach report with HHS stating that approximately 206,695 individuals were affected when their network server was infected with GandCrab ransomware. The initial unauthorized access to the network occurred on April 1, 2017; however, Doctors’ Management Services did not detect the intrusion until December 24, 2018, after ransomware was used to encrypt their files. In April 2019, OCR began its investigation.

“OCR’s investigation found evidence of potential failures by Doctors’ Management Services to have in place an analysis to determine the potential risks and vulnerabilities to electronic protected health information across the organization. Other findings included insufficient monitoring of its health information systems’ activity to protect against a cyber-attack, and a lack of policies and procedures in place to implement the requirements of the HIPAA Security Rule to protect the confidentiality, integrity, and availability of electronic protected health information.”

Notes.

Today's issue includes events affecting China, the European Union, Gaza, Iran, Israel, Russia, Ukraine, the United Kingdom, and the United States.

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Ukraine at D+617: Advantage defense. (CyberWire) In all domains, both kinetic and cyber, the advantage seems to have shifted toward the defense (and toward the robots).

Israel-Hamas war live: US tells Israel that civilians caught in crossfire must be protected (the Guardian) US secretary of state Antony Blinken says Israel has a right to defend itself – but how it does that matters

Satellites and social media offer hints about Israel's ground war strategy in Gaza (NPR) The Israeli military appears to have encircled Gaza City, but so far, it's made only limited forays into the densest urban areas.

WSJ News Exclusive | Russia’s Wagner Group Plans to Send Air Defenses to Hezbollah, U.S. Says (Wall Street Journal) Intelligence suggests that the Russian paramilitary group might provide the SA-22 system of missiles and air-defense guns to the Lebanese militia, American officials say.

The UN Hired an AI Company to Untangle the Israeli-Palestinian Crisis (WIRED) CulturePulse's AI model promises to create a realistic virtual simulation of every Israeli and Palestinian citizen. But don't roll your eyes: It's already been put to the test in other conflict zones.

CEO of X Intervened to Get Hitler Post Taken Down (The Information) Last weekend, staffers at X grew increasingly upset after a Pakistani senator posted a photo of Adolf Hitler on the service with the text “at least now the world know, why he did, what he did,” in reference to the Holocaust. Over the course of several hours, the post drew about a million views, ...

Defense Department Continues to Stress Law of War With Israel (U.S. Department of Defense) As Israel defends itself against ongoing attacks by Hamas, defense officials continue to underscore the importance of following the law of war, the Pentagon press secretary said.

Russia-Ukraine war: List of key events, day 618 (Al Jazeera) As the war enters its 618th day, these are the main developments.

Russian War Report: Russia just lost the most troops in a single battle so far in 2023 (Atlantic Council) In Ukraine, fighting over the strategically important town of Avdiivka has led to heavy Russian losses. Meanwhile, Russian propaganda is targeting the Armenian government.

Ukraine has taken 17,000 Russians off the battlefield without firing a shot, US Army special-ops general says (Business Insider) "That's 17,000 soldiers you didn't have to blow up on the battlefield or destroy," the head of US Army Special Operations Command said in October.

Ukraine’s commander-in-chief on the breakthrough he needs to beat Russia (The Economist) General Valery Zaluzhny admits the war is at a stalemate

ATACMS missiles create new dilemmas for Russian army in Ukraine (Atlantic Council) Two weeks since Ukraine's President Zelenskyy first confirmed delivery of ATACMS missiles from the US, reports continue to mount of highly destructive ATACMS strikes against the Russian army in Ukraine, writes Mykola Bielieskov.

Senior US Republicans urge long-range missiles for Ukraine (Reuters) A group of senior Republicans in the U.S. Congress urged President Joe Biden to send longer-range missiles to Ukraine, in a show of continued support for Kyiv among U.S. lawmakers despite pushback from some conservatives against more aid.

National Armaments Directors Focus on Long-Term Support for Ukraine (U.S. Department of Defense) As the conflict in Ukraine surpassed its 600th day, national armaments directors from more than 40 countries, the European Union and NATO gathered in Brussels to discuss long-term support for Ukraine.

Putin will win unless the West finally commits to Ukrainian victory (Atlantic Council) Russian dictator Vladimir Putin is more confident than ever that time is on his side in Ukraine and believes the Western world ultimately lacks the political will to oppose him, writes Ivan Verstyuk.

Top Ukrainian general’s gloomy view of Russia war fuels military aid debate (POLITICO) Ukraine’s Gen. Valery Zaluzhnyy wants more weapons from the West to break through a “stalemate.”

War in Ukraine Loosens Russia’s Grip on Its Own Backyard (Wall Street Journal) Spooked by the war in Ukraine and the international sanctions that followed, Russia’s neighbors and allies are busy diversifying their relationships, hedging against Moscow by deepening ties with China and the West.

The Dream of a European Security Order With Russia Is Dead (Foreign Policy) How the war ends will determine Europe’s future as much as Ukraine’s.

NATO needs a plan for military and nonmilitary instruments of power to work together (Atlantic Council) The Alliance's planning must include nonmilitary parts of government as well as the private sector to reflect the realities of modern warfare.

AP news site hit by apparent denial-of-service attack (AP News) The Associated Press news website experienced an outage that appeared to be consistent with a denial-of-service attack, a federal criminal act that involves flooding a site with data in order to overwhelm it and knock it offline.

Associated Press hit by Anonymous Sudan DDoS attack? (Tech Monitor) News agency the Associated Press, or AP, may have suffered a cyberattack, with hacking gang Anonymous Sudan claiming a successful DDoS breach.

Kremlin spread rumour Putin had died to ‘test his popularity’ (The Telegraph) Ukrainian intelligence claim purposeful spread of fake news helps gauge ‘reactions of individuals, the elite and the media’

Hunt For Answers Continues Over Chinese Ship's Suspected Role In Damaging Baltic Pipeline (RadioFreeEurope/RadioLiberty) Finnish investigators say a Chinese vessel, which is currently making its way to China through Russian waters, damaged the Balticconnector pipeline that brings gas between Finland and Estonia. Was it an accident or another example of sabotage in the Baltic Sea?

The US sanctions more foreign firms in a bid to choke off Russia's supplies for its war in Ukraine (AP News) Secretary of State Antony Blinken says the U.S. has imposed a new round of sanctions targeting Russia over its invasion of Ukraine.

Attacks, Threats, and Vulnerabilities

Spy Module Discovered in WhatsApp Mods (Infosecurity Magazine) Kaspersky said that between October 5 and 31 alone, it intercepted over 340,000 attacks

Combatting Kimsuky and Safeguarding National Intelligence (AttackIQ) In the covert realm of cyberspace, a formidable adversary has emerged – a state-sponsored, North Korean group known as Kimsuky. Their clandestine operations are not motivated by profit, but by the pursuit of state secrets and strategic intelligence for the Democratic People’s Republic of Korea (DPKR).

Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604 (Huntress) CVE-2023-46604 is a critical remote code execution vulnerability in Apache ActiveMQ. Patch now to avoid any potential adversary exploitation.

Suspected Exploitation of Apache ActiveMQ CVE-2023-46604 (Rapid7) On October 27, Rapid7 Managed Detection & Response identified suspected exploitation of Apache ActiveMQ CVE-2023-46604 in 2 separate customer environments.

Looney Tunables Vulnerability Exploited by Kinsing (Aquasec) We intercepted Kinsing's experimental incursions into cloud environments and have uncovered their efforts to manipulate the Looney Tunables vulnerability.

Critical Apache ActiveMQ Vulnerability Exploited to Deliver Ransomware (SecurityWeek) A recently patched Apache ActiveMQ vulnerability tracked as CVE-2023-46604 is being exploited to deliver ransomware.

HelloKitty ransomware now exploiting Apache ActiveMQ flaw in attacks (BleepingComputer) A remote code execution (RCE) flaw impacting Apache ActiveMQ has been under active exploitation by threat actors who use HelloKitty ransomware payloads.

Okta hit by third-party data breach exposing employee information (BleepingComputer) Okta is warning nearly 5,000 current and former employees that their personal information was exposed after a third-party vendor was breached.

5,000 Okta employees' data accessed in a third-party breach (Register) The hits keep on coming for troubled ID management biz

Nearly 5,000 Okta employees affected by third-party data breach (Record) Almost 5,000 Okta employees were affected by a data breach following a cyberattack on a third-party provider used by the company for healthcare services.

Mortgage giant Mr. Cooper hit by cyberattack impacting IT systems (BleepingComputer) U.S. mortgage lending giant Mr. Cooper was breached in a cyberattack that caused the company to shut down IT systems, including access to their online payment portal.

Mortgage and loan giant Mr. Cooper blames cyberattack for ongoing outage (TechCrunch) The home loan and mortgage refinancing giant has more than 4.1 million customers, according to the company's website.

Infamous ransomware group takes credit for cyberattack against SW Ontario hospitals (Windsor Star) Windsor Regional Hospital CEO David Musyj said the blackmailers are part of well-organized operation.

What to know about cybercrime group Daixin Team (Windsor Star) The cybercrime organization believed to be responsible for the blackmail attack at five southwestern Ontario hospitals is known as Daixin Team, a ransomware and data extortion group notorious for their strikes against the public health sector.

Toronto Public Library Website Update (Toronto Public Library) We are actively addressing a cybersecurity incident that came to our attention on Saturday, October 28.

Ace Hardware says 1,202 devices were hit during cyberattack (BleepingComputer) Ace Hardware confirmed that a cyberattack is preventing local stores and customers from placing orders as the company works to restore 196 servers.

Hackers behind CCSD cyberattack contact FOX5, share confidential student info (Fox5 Vegas) Hackers sent screenshots to prove they had student information including that of a 7-year-old girl. FOX5 called the phone number included and spoke with girl's mom.

CISA Adds One Known Exploited Vulnerability to Catalog (Cybersecurity and Infrastructure Security Agency | CISA) CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Security Patches, Mitigations, and Software Updates

Cisco Patches 27 Vulnerabilities in Network Security Products (SecurityWeek) Cisco has released software updates to address 27 vulnerabilities in Cisco ASA, FMC, and FTD security products.

Atlassian Releases Security Advisory for Confluence Data Center and Server | CISA (Cybersecurity and Infrastructure Security Agency CISA) Atlassian released a security advisory to address a vulnerability (CVE-2023-22518) affecting Confluence Data Center and Server. A cyber actor could exploit this vulnerability to obtain sensitive information.

CISA Releases Six Industrial Control Systems Advisories | CISA (Cybersecurity and Infrastructure Security Agency CISA) CISA released six Industrial Control Systems (ICS) advisories on November 2, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

Trends

Vulnerability Exploitation: 3 Trends from Our Biannual Review (ReliaQuest) The ReliaQuest Threat Research Team uncovers research on the threats associated with vulnerabilities in Q2 and Q3 2023.

APT QUARTERLY HIGHLIGHTS - Q3 : 2023 (CYFIRMA) EXECUTIVE SUMMARY The third quarter of 2023 witnessed a surge in the dynamic and ever-evolving activities of Advanced Persistent Threat...

Marketplace

Former SpaceX Engineers Raise $8 Million to Launch AI Security Firm Wraithwatch (SecurityWeek) Former SpaceX cybersecurity engineers launched Wraithwatch, an AI-based security firm that received $8 million in seed funding.

FusionAuth Snags $65 Million Investment for Customer Identity Tech (SecurityWeek) Colorado startup raises new capital from Updata Partners to build out its customer authentication and authorization technology.

The AI Deals Enriching Silicon Valley’s Tech Giants (Wall Street Journal) Microsoft, Amazon and Google are getting billions in revenue from providing expensive cloud services to the startups they are backing.

Island Adds Accomplished Industry Veteran Matt Fairbanks as Chief Marketing Officer (Island) Island adds Matt Fairbanks as Chief Marketing Officer (CMO) and appoints Ellen Roeckl to Chief Communications Officer (CCO)

Illumio Hires Veteran Of Tanium, Palo Alto Networks As Channel Chief (CRN) Illumio announced it has hired Todd Palmer from Tanium as its new channel chief.

Forcepoint Announces Five New Executive Appointments for Global Governments and Critical Infrastructure Business (Yahoo Finance) Forcepoint Global Governments and Critical Infrastructure (G2CI) today announced the appointment of five cybersecurity industry veterans to its executive team. The company has named Joseph Bell as Chief Information Security Officer, Karen Clark as Chief Human Resources Officer, James Wallace as Chief Legal Officer, Jason Facer as interim Chief Financial Officer, and Greg Higham as interim Chief Information Officer.

Products, Services, and Solutions

Enzoic unveils BIN Monitoring to reduce credit card fraud (Help Net Security) Enzoic' BIN Monitoring service is designed to help banks and credit unions prevent card fraud through real-time exposure data.

AhnLab launches cloud-based XDR platform | Korea News Plus (Korea News Plus) The Korea News Plus: Insider info on Korea / 경제뉴스의 인사이더, 코리아뉴스플러스

Technologies, Techniques, and Standards

After Major Cloud Hacks, Microsoft Unveils ‘Secure Future Initiative’ (SecurityWeek) Redmond's new security initiative promises faster patches, better management of signing keys and products with a higher default security bar.

Microsoft Does Damage Control With Its New ‘Secure Future Initiative’ (WIRED) Following a string of serious security incidents, Microsoft says it has a plan to deal with escalating threats from cybercriminals and state-backed hackers.

Deputy Secretary of Defense Kathleen Hicks Announces Publication of Data, Analytics and AI (U.S. Department of Defense) Deputy Defense Secretary Kathleen Hicks announced the release of the 2023 DOD Data, Analytics and AI Adoption Strategy.

Deputy Secretary of Defense Dr. Kathleen Hicks Holds a Press Briefing to Discuss the State (U.S. Department of Defense) Deputy Defense Secretary Kathleen Hicks held a press briefing to discuss the state of artificial intelligence in the Defense Department.

Linux Foundation, ISC2 and OpenSSF Collaborate to Target Secure Code Development (Open Source Security Foundation) Linux Foundation Training & Certification, ISC2, and Open Source Security Foundation (OpenSSF) today announced a new collaboration to empower the open source cybersecurity community through secure software development, knowledge sharing, education, certification and much more. Together, the three organizations will lead the way to secure software development and lifecycle management for open source code.

Ransomware and Cyber Extortion Guide 2023 (CyberCX) This guide provides practical tools for people at all levels of an organisation to understand and manage the risk posed by ransomware and cyber extortion.

How US can get and stay ahead of adversaries on intelligence data (C4ISRNet) Opinion: Data is playing an increasingly critical role in intelligence community operations and mission support.

DHS to lean further into AI with generative pilots (Federal News Network) Eric Hysen, the agency’s chief information officer and first chief AI officer, said the goal is to give employees access to new tools and technologies to deal with the ever-growing number of…

DHS lays out new ‘cybersecurity readiness’ metrics for contractors (Federal News Network) DHS plans to use its own approach for evaluating contractor cybersecurity rather than adopting the Pentagon’s CMMC program.

Why penetration testing is critical to every robust cyber security strategy (Innovation News Network) Find out more about how penetration testing can help companies stay ahead with modern cyber security strategies.

Lock Aadhaar: Now you can easily lock Aadhaar Card sitting at home, the method is very easy (informalnewz) How to Lock Aadhaar: UIDAI gives you many such features, with the help of which you can keep your Aadhaar card and its related details safe. One such feature is Aadhaar Lock, with the help of which you can lock your biometrics. You can also unlock it if needed. Let us know how you can

CISA Launches Critical Infrastructure Security and Resilience Month 2023 (Cybersecurity and Infrastructure Security Agency | CISA) This November CISA is asking everyone to “Resolve to be Resilient”

Design and Innovation

Microsoft Vows to Revamp Security Products After Repeated Hacks (Bloomberg) Tech giant plans to use AI to scan code, find vulnerabilities. Announcement comes after government push on software security.

A new world of security: Microsoft’s Secure Future Initiative (Microsoft On the Issues) In recent months, we’ve concluded within Microsoft that the increasing speed, scale, and sophistication of cyberattacks call for a new response. Therefore, we’re launching today across the company a new initiative to pursue our next generation of cybersecurity protection – what we’re calling our Secure Future Initiative (SFI).

State Of Generative AI Survey [2023] | Portal26 (Portal26) Welcome to Portal26’s State of Generative AI Survey. The survey—conducted in partnership with CensusWide—polled 400+ C-suite and IT professionals, Its results depict an environment in which companies are optimistic about the potential of Generative AI, yet struggle to gain visibility into the operations of their AI programs, creating significant risks around governance, data security and … State Of Generative AI Survey [2023] | Portal26 Read More »

Announcing Microsoft Secure Future Initiative to advance security engineering (Microsoft Security) Today Microsoft’s Vice Chair and President Brad Smith shared insight on the global cybersecurity landscape and introduced our Secure Future Initiative. These engineering advances anticipate future cyberthreats, such as increasing digital attacks on identity systems. They also address how we will continue to build secure foundations necessary for the AI era and beyond.

Research and Development

Revolutionizing quantum technologies with photons made from quantum dots (Advanced Science News) Harnessing quantum dots to produce low-energy single photons for applications in secure communications and quantum computing.

Legislation, Policy, and Regulation

EU urged to drop new law that could allow member states to intercept and decrypt global web traffic (Record) More than 100 of the world’s most respected cybersecurity experts have written to European Union lawmakers to warn that a proposed legal reform that may soon become law could fundamentally undermine security online.

Elon Musk tells Sunak AI will mean people no longer need to work (The Telegraph) Elon Musk told Rishi Sunak on Thursday that artificial intelligence will one day eradicate the need for jobs.

Joe Biden Wants US Government Algorithms Tested for Potential Harm Against Citizens (WIRED) Draft rules from the White House would require federal agencies to assess AI systems currently in use in law enforcement, health care, and other areas—and to shut down any algorithms doing harm.

Biden’s Elusive AI Whisperer Finally Goes On the Record. Here's His Warning. (POLITICO) Bruce Reed had seen the pitfalls of letting Big Tech run roughshod over government. He is determined not to make the same mistakes on AI.

Biden's AI order didn't go far enough to address fairness, but it's a good first step, advocates say (CNBC) After the Biden administration unveiled its new AI executive order on Monday, a frenzy of industry leaders dug in to the implications of the landmark action.

Biden’s nominee for national cyber director outlines his vision for role (Washington Post) President Biden’s pick for the second permanent national cyber director, Harry Coker, said he would work to “ensure collaboration is the North Star” for his office if confirmed, noting that collaboration is “what motivates me to return to public service” during his nomination hearing on Thursday.

Proposed FAR Revisions Aim to Standardize Cybersecurity Requirements Across Agencies and Add Incident Reporting Obligations for Contractors (JD Supra) On October 3, the Department of Defense, General Services Administration, and the National Aeronautics and Space Administration published two sets of...

Banks 'flying blind' without cumulative data on regulatory proposals (American Banker) Trade groups, analysts and some regulators want more data on how various regulatory changes and proposals would impact the banking sector in totality. But regulatory agencies have yet to take on such a project and private sector groups say the task is beyond their capabilities.

What to Know About New Federal and State Cyber Rules (Wall Street Journal) New stiffer rules from the New York State Department of Financial Services and ones that go into effect in December from the U.S. Securities and Exchange Commission are of the same spirit but have key practical differences.

Wyden, Eshoo, Lesko Reintroduce Bipartisan, Bicameral Legislation to Prevent Domestic Abusers from Targeting Survivors with Technology (U.S. Senator Ron Wyden of Oregon) U.S. Senator Ron Wyden, D-Ore, and U.S. Representatives Anna G. Eshoo, D-Calif., and Debbie Lesko, R-Arizona, today reintroduced their bipartisan, bicameral legislation to help prevent domestic abusers from using technology to stalk, harass or control survivors.

His Job Was to Make Instagram Safe for Teens. His 14-Year-Old Showed Him What the App Was Really Like. (Wall Street Journal) When a Meta security expert told Mark Zuckerberg that Instagram’s approach to protecting teens wasn’t working, the CEO didn’t reply. Now the former insider is set to tell Congress about the predatory behavior.

Litigation, Investigation, and Law Enforcement

SolarWinds Is A Game Changer - You Cannot Sugarcoat Cybersecurity (Forbes) The SEC prosecution of SolarWinds and its CISO is a game changer for how cybersecurity will be handled and reported on by listed businesses.

Sam Bankman-Fried Is Convicted in FTX Collapse (Wall Street Journal) A New York federal jury found him guilty of stealing billions of dollars from the crypto exchange’s customers.

Sam Bankman-Fried found guilty on all seven counts (TechCrunch) Sam Bankman-Fried, the co-founder and former CEO of crypto exchange FTX and trading firm Alameda Research, has been found guilty on all seven counts

SBF verdict: Jury finds FTX founder guilty on all counts in Manhattan criminal fraud trial (Business Insider) FTX founder Sam Bankman-Fried was found guilty of all 7 charges after a 5-week fraud trial in Manhattan. SBF faces a prison sentence up to 110 years.

Closing time for Sam Bankman-Fried (The Verge) An underwhelming finale to a feeble defense.

Sam Bankman-Fried found guilty of defrauding FTX customers out of billions (the Guardian) The prosecutor said that ‘while the cryptocurrency industry might be new … this kind of corruption is as old as time’

A Year After Sam Bankman-Fried's Downfall, Solana and Other FTX Holdings Are Flying High (Coindesk) The FTX founder's downfall began on Nov. 2, 2022 – a year ago Thursday – when CoinDesk published a big scoop. Jurors are poised to begin deliberating his fate on the anniversary of that story, at a time when the SOL tokens FTX owns just got $1 billion more valuable.

The Bombshell Evidence That Led to Sam Bankman-Fried’s Conviction (TIME) Sam Bankman-Fried was found guilty on all counts in his fraud trial and could spend 120 years in prison. Here’s how events unfolded, according to his inner circle.

Live Updates: The Trial of FTX Founder Sam Bankman-Fried, the Verdict (WIRED) When Sam Bankman-Fried’s FTX crypto exchange collapsed, customers lost billions of dollars. After a bruising trial in New York, the jury is set to deliver its verdict.

Fake Nudes of Real Students Cause an Uproar at a New Jersey High School (Wall Street Journal) After boys shared faked pornographic images made of female classmates, both the school and the local police began investigating.

Russian Reshipping Service ‘SWAT USA Drop’ Exposed (KrebsOnSecurity) One of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. Here’s a closer look at the Russia-based SWAT USA Drop Service, which currently employs more than 1,200 people across…

Court construes claims in cybersecurity patent dispute (Virginia Lawyers Weekly) Listen to this article Where the parties disputed the construction of 10 claim terms in five cybersecurity patents that relate to systems and methods for evaluating packets of information travelling through a network, they were construed by the court. Background Centripetal Networks LLC sued Palo Alto Networks Inc., or PAN, alleging infringement of five cybersecurity […]

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Mozilla Meetups – Code to Conduct in AI: Open Source, Privacy, and More (Washington, DC, USA, Nov 15, 2023) The AI wave has generated excitement but also debate, as policymakers across the globe grapple with tough policy questions. We’re collectively wondering: How do we approach regulation in the US? How do we get the right safeguards in place when it comes to privacy and other harms? How do we treat open source? How do we create policies that enable a diverse AI landscape that works for everyone? The event will feature a fireside chat, followed by an expert panel discussion. A happy hour with drinks and light fare will follow.

SANS Stay Sharp: March 2024 (Virtual, Mar 18 - 20, 2024) At SANS Stay Sharp: March 2024, choose from 48 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Events

Hardwear.io Security Trainings and Conference (The Hague, Netherlands, Oct 30 - Nov 3, 2023) Learn from leading hardware security researchers & professionals and discuss the latest & most innovative research on attacking and and defending hardware. Connect with industry peers. Join us for a bigger, bolder, and better hardwear.io.

Schellmancon 2023 (Virtual, Nov 3, 2023) This event is intended for our clients, compliance experts, and all with a passion for cybersecurity to share relevant and impactful information in the cybersecurity and compliance space. And it is completely free, including the CPE! Prepare to unite with the foremost thought leaders in the world of compliance, where we discuss the emerging trends in compliance, cybersecurity, threat management, artificial intelligence and more. Industry expert panelists will explore best practice approaches to cybersecurity assessments, and share their winning strategies through networking and knowledge cafes. Participants are automatically enrolled for complimentary training and other prizes. Extend your invitations to your teams and partake in an action-packed, day-long agenda that promises to be truly enriching.

CyberSatGov (Reston, Virginia, USA, Nov 6 - 8, 2023) Join like-minded colleagues, high ranking intelligence and DoD officials, cybersecurity professionals, satellite industry providers and integrators in dynamic, high-level discussion, one-on-one networking, and informative, solution-oriented sessions.

SANS San Diego Fall 2023 (San Diego and Virtual, California, USA, Nov 6 - 11, 2023) Hands-on cyber security training taught by world-renowned practitioners. Attend in San Diego, CA or live online. At SANS San Diego Fall 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Predict 2023 (Singapore, Nov 7 - 8, 2023) PREDICT is the world’s leading intelligence summit where executives, security practitioners, technologists, researchers, and journalists come together to hear from experts, learn from one another, and make new connections. From illuminating panels and expert-led workshops, attendees gain practical skills and insights into the future of intelligence.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.