Fortinet 0days, Appin hack-for-hire exposé, crypto heists, Russians booted from Linux kernel
Oct 25, 2024
auto_awesome
In this engaging discussion, Juan Andres Guerrero-Saade, a threat intelligence expert from SentinelLabs, and Costin Raiu, Kaspersky's Global Research Director, dive into critical cybersecurity issues. They unpack the alarming rise of cryptocurrency heists and the sophisticated tactics employed by cybercriminals. The conversation also touches on the implications of a major Fortinet zero-day exploit linked to potential nation-state actors and the exclusion of Russian contributors from the Linux kernel amid geopolitical tensions. Insights on accountability in tech vendors and investigative journalism add further depth.
The White House's new TLP guidance aims to enhance information sharing protocols among federal agencies and researchers for improved collaboration.
The legal battles surrounding Appin highlight the critical need for protecting journalistic integrity in cybersecurity reporting against potential coercion.
The increasing sophistication of cyber threats, particularly in cryptocurrency, demonstrates the urgent necessity for vigilance and investigation amidst evolving criminal tactics.
Deep dives
Traffic Light Protocol Guidance
The podcast discusses the recent guidance issued by the White House regarding the Traffic Light Protocol (TLP) for federal agencies. This guidance aims to clarify how federal entities should handle information shared under different TLP levels, specifically addressing the lack of respect for these classifications. Historically, many federal agencies viewed TLP guidelines as non-binding, which led to misinterpretation and misuse of information sharing protocols, resulting in a culture of disregard. The hosts highlight that the ONCD's intervention could enhance collaboration and respect for information shared among researchers and government bodies.
The Challenge of Information Sharing
The conversation delves into the difficulties researchers face when sharing sensitive information with government entities, particularly the FBI. The hosts illustrate how researchers often feel mismanaged, as the FBI treats informants and domain expert contributions similarly, lacking the necessary distinctions. This has caused friction and misunderstandings in interactions, discouraging open communication and vital information sharing. The discussion emphasizes the need for the FBI to adopt a more nuanced understanding of collaboration with researchers to foster a better information-sharing environment.
The Legal Landscape Around Cyber Reporting
The hosts review the ongoing legal battles involving Appin, an Indian startup, highlighting significant concerns regarding press freedom and academic research in cyber investigations. Following a court ruling, Appin was able to compel media outlets like Reuters to retract reports related to its activities, indicating a troubling trend for journalistic integrity in the cybersecurity domain. This raises important questions about the implications for future reporting and the chilling effect such legal actions could have on investigative journalism. The discussion points to the need for protective measures and support for journalists covering sensitive cybersecurity issues.
Rising Threats in Cryptocurrency Space
The podcast touches on the increasing sophistication of cyber threats targeting the cryptocurrency sector, with a focus on recent attacks involving advanced malware. In one instance, Radiant Capital lost a significant amount of money due to malware compromising their hardware wallets, showcasing the evolving tactics criminals use. Furthermore, the episode discusses how North Korean threat actors exploit vulnerabilities and use innovative methods to launder stolen funds. With $263 million stolen recently from a group of teenagers engaged in crypto heists, the hosts underline the need for greater vigilance and investigation in this rapidly evolving threat landscape.
Chinese Cybersecurity Threat Reports
The hosts analyze a contentious report issued by Antiy, a Chinese anti-malware firm, which defends its contributions to cybersecurity research against criticisms from Dakota Carey of SentinelOne. The discussion reveals tensions between the way Chinese researchers frame their findings and the perception of propaganda in their reports. Despite acknowledging some valid contributions from Chinese researchers, the hosts highlight a lack of rigor and clarity in their outputs. The podcast emphasizes the importance of objective and comprehensive reporting in the cybersecurity field, regardless of national origin, to foster genuine understanding and improvement.
Three Buddy Problem - Episode 18: This week’s show covers the White House's new Traffic Light Protocol (TLP) guidance, Reuters expose of Appin as a hack-for-hire mercenary company, Fortinet zero-day exploitation and missing CSRB investigations, major cryptocurrency heists, Apple opening Private Cloud Compute to public inspection, Russians removed from Linux kernel maintenance and China’s Antiy beefing with Sentinel One over APT reporting.