Loading summary
Transcript21 lines
- [00:02]
Dave Bittner
You're listening to the Cyberwire network, powered by N2K. Hey everybody, Dave here. I've talked about Deleteme before and I'm still using it because it still works. It's been a few months now and I'm just as impressed today as I was when I signed up. Deleteme keeps finding and removing my personal information from data broker sites, and they keep me updated with detailed reports so I know exactly what's been taken down. I'm genuinely relieved. Knowing my privacy isn't something I have to worry about every day. The Deleteme team handles everything. It's the set it and forget it peace of mind. And it's not just for individuals. Deleteme also offers solutions for businesses, helping companies protect their employees personal information and reduce exposure to social engineering and phishing threats. And right now, our listeners get a special 20% off your delete me plan. Just go to JoinDeleteMe.com N2K and use promo code N2K at checkout. That's JoinDeleteMe.com N2k code N2K.
- [01:26]
Ian Itz
Foreign.
- [01:34]
Dave Bittner
Airlines reports a cybersecurity incident. Microsoft updates its Windows resiliency initiative after the 2024 CrowdStrike crash. Citrix Bleed 2 is under active exploitation in the wild. Researchers disclose a critical vulnerability in open VSX malware uses prompt injection to evade AI analysis. A new report claims Cambodia turns a blind eye to scam compounds. Senators propose a ban on AI tools from foreign adversaries. An NSA veteran is named top civilian at US Cyber Command. Maria Ramazes speaks with Ian Itz from Iridium Communications on allowing IoT devices to communicate directly with satellites and one Kansas City hacker's bold marketing campaign ends with a guil plea. It's Friday, June 27th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Brief. Happy Friday and thanks for joining us. It's great to have you with us. Hawaiian Airlines has reported a cybersecurity incident affecting some of its IT systems. The airline posted updates yesterday confirming that flights are operating safely and on schedule despite the disruption. The company stated it's working with experts and federal authorities while restoring systems in an orderly manner, implying some systems were taken offline. No details have been released about the nature of the cyber event or whether customer data was impacted. The FAA said it is in contact with the airline and monitoring the situation. This incident follows a similar cyber attack on Canada's WestJet Airlines less than two weeks ago. Hawaiian Airlines was recently acquired by Alaska Airlines with plans to integrate their systems under a single passenger service platform. Microsoft has shared progress on its Windows Resiliency Initiative, launched after last year's major CrowdStrike incident that caused global windows outages. In July 2024, a faulty CrowdStrike update crashed systems due to its use of kernel drivers for security functions. In response, Microsoft announced a redesign to reduce risks when endpoint security software interacts with the Windows kernel. The Windows Resiliency Initiative, or wri, launched in November of last year and aims to boost Windows reliability and resilience. Microsoft is working with vendors like CrowdStrike, BitDefender, SentinelOne, and Trend Micro to ensure safer update processes. Starting next month, some partners will preview a new security platform allowing antivirus and endpoint protection tools to enhance run in user mode instead of the kernel, enhancing stability and recovery. Microsoft has also released an ebook on digital resilience and introduced features like Quicker PC Recovery, Hot Patch Security updates without reboots, and Windows 365 reserve, offering temporary cloud PCs when primary devices fail A critical vulnerability dubbed Citrix bleed 2 has been discovered in Citrix, Netscaler, ADC and Gateway devices and is reportedly being exploited in the wild. This out of bounds read flaw allows attackers to extract session tokens, bypass multi factor authentication and hijack user sessions. Similar to the 2023 Citrix Bleed, this vulnerability targets session tokens rather than cookies. It affects multiple versions. Security firm ReliaQuest reports medium confidence of active exploitation based on session hijacking, MFA bypassing, LDAP reconnaissance and activity from VPN related IPs. Additionally, a separate memory overflow vulnerability is under active attack, potentially causing denial of service. Citrix urges immediate patching and session termination Researchers at COI Security have disclosed a critical vulnerability in OpenVSX, the open source extension marketplace hosted by the Eclipse Foundation. The flaw exposed the publishing account's secret token to any extension or its dependencies. This token acts as a super admin credential, giving attackers the ability to publish malicious extensions or overwrite existing ones, potentially compromising over 8 million developers. OpenVSX is widely used by VS code based editors like Cursor, Gitpod and Windsurf as an alternative to Microsoft's Marketplace. Koi Security warned that attackers could have installed keyloggers, information stealers or backdoors, posing a solar winds like supply chain risk for developer tooling. The vulnerability was discovered in early May and has now been patched after thorough vetting. Security Week reached out to the Eclipse foundation for further comment, but so far has received none. Check point Researchers have discovered a malware sample containing a prompt injection designed to bypass AI code analysis tools uploaded to VirusTotal in early June. The sample included a string instructing large language models to act as a calculator and reply with no malware detected. Named Skynet by its author, the malware is half complete and acts as a proof of concept rather than fully functional malware. It uses byte wise rotating XOR obfuscation with a hard coded key sandbox evasion techniques, and decrypts an embedded Tor client to create a controllable proxy before deleting its installation directly to cover its tracks. OpenAI's O3 and GPT 4.1 models identified the prompt injection as a jailbre attempt. Researchers warn this reflects the next evolution in malware targeting AI driven defenses with prompt injection and jailbreak methods to evade detection. Amnesty International has condemned what it calls Cambodia's grossly inadequate response to human trafficking in online scamming compounds. Its two year study released Thursday documented 53 active scam centers where workers are forced to assist in fraudulent operations, often under threat from guards armed with electric batons. Victims are lured with fake job offers, trapped in prison like compounds and made to run cryptocurrency scams, create fake websites or set up bank accounts for money laundering. Some describe pig butchering scams where scammers build trust before defrauding victims. Despite police rescues, Amnesty says abuses continue, with authorities often freeing only those who contact them while ignoring others. Survivors also reported collusion between police and traffickers. The UN estimates Southeast Asia's scam centers generate $40 billion annually. The Thai government has closed border crossings and halted fuel exports to Cambodia in response, as organized criminal networks shift operations from Myanmar to Cambodia. Senators Rick Scott and Gary Peters have introduced the no Adversarial AI act to ban federal agencies from using AI tools made in countries deemed foreign adversaries, including China, Russia, Iran and North Korea. The bill would create and update a Federal list every 180 days, prohibiting tools like China's Deep Seq, which reportedly aids China's military and shares user data with its government. Exceptions would exist for research requiring written justification to Congress. The legislation aims to protect national security and personal data from potential exploitation by adversarial AI systems. It follows reports that a USDA employee attempted to access Deepseek but was blocked. Lawmakers compared the move to past bans on foreign software such as TikTok and Kaspersky, framing it as necessary to keep US government technology secure against evolving threats. Patrick Ware, a 34 year NSA veteran, has been appointed executive director of US Cyber Command, becoming its top civilian leader. He replaces Morgan Adamski, who is expected to move to the private sector after serving in the role since June of 2024. The position traditionally filled by an NSA official is the number three role at Cyber Command. Ware takes over during a period of leadership uncertainty, as Cyber Command has lacked a permanent chief since general Timothy Hogg was fired nearly three months ago. A planned appointment of lieutenant general Richard Angle was reportedly rejected by the White House for undisclosed reasons. Ware will oversee strategic initiatives, talent management and partnerships amid questions about the future of the Cyber Command 2.0 overhaul. Ware holds electrical engineering degrees from the University of Maryland and Johns Hopkins university. We wish Mr. Ware the very best as he steps into this critical role, guiding U.S. cyber Command through its next chapter of challenges and opportunities. Coming up after the break, Maria Vermazes speaks with Ian Itz from Iridium Communications on allowing IoT devices to communicate directly with satellites and one Kansas City hacker's bold marketing campaign ends with a guilty plea Stick and now a word from our sponsor, ThreatLocker keeping your system secure shouldn't mean constantly reacting to threats. Threat Locker helps you take a different approach by giving you full control over what software can run in your environment. If it's not approved, it doesn't run. Simple as that. It's a way to stop ransomware and other attacks before they start without adding extra complexity to your day. See how ThreatLocker can help you lock down your environment at www.threatlocker.com compliance regulations, third party risk and customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you've ever found yourself drowning in spreadsheets, chasing down screenshots or wrangling manual processes just to keep your GRC program on track, you're not alone. But let's be clear. There is a better way. Vanta's trust management platform takes the headache out of governance, risk and compliance. It automates the essentials from internal and third party risk to consumer trust, making your security posture stronger. Yes, even helping to drive revenue. And this isn't just nice to have. According to a recent analysis from IDC, teams using Vanta saw a 129% boost in productivity. That's not a typo, that's real impact. So if you're ready to trade in chaos for clarity, check out Vanta and bring some serious efficiency to your GRRC game. Vanta GRC how much easier trust can be? Get started at vanta.com cyber Our guest today comes from T Space Daily's Deep Space Program Host Maria Vermazes speaks with Ian Itz, executive director at the IoT Line of Business at Iridium Communications. They're talking about how Iridium allows IoT devices like sensors and trackers to communicate directly with satellites, bypassing terrestrial infrastructure.
- [14:57]
Ian Itz
So my name is Ian Itz. I'm the executive director for the IoT line of business here at Iridium. And kind of the way that I started my journey in space was through a very small universal bus building company. And so they were building universal buses for the Navy and for the Air Force. And so I was looking for product management jobs coming out of college and there just happened to be a space startup in the town that I was living in and we're not too far outside of the D.C. region. And so there's obviously a lot of tech here, a lot of government work. And so that was kind of my entry. And so I was working on course sun sensors and star trackers and things that satellites need to kind of keep their navigation and their orientation. I started to look at who are the big satellite carriers in what we call this MSS space and looked at Globalstar and looked at Iridium and I actually ended up working a little bit for Globalstar. I worked for one of their largest distributors for a bit, but I always wanted to be at Iridium. That was always kind of the seal of excellence for me in terms of what I was into, which was very small devices, mobile devices, IoT really. Right. That's kind of where I kind of gravitated towards that. And Iridium kind of had all the pieces right. They had a great constellation, they did small devices, they're very reliable in terms of the product. And so I'm always aspired to be part of the Iridium team. I said this is a great opportunity for me. And so that was kind of how I started here at Iridium. So kind of continued on and became a product manager and then slowly learned the business here, did some BD work for a couple years and now I'm fully running the entire IoT line of business here at Iridium, which is our fastest growing business. And for me it's probably the most exciting business unit here. But I say that very biased.
- [16:45]
Maria Vermazes
Thank you for sharing your journey with me. I love hearing people's stories because they're all so different and I find them just really fascinating. So thank you. So yeah, we are here to talk about the IoT line of business that Iridium has. So maybe we can just set the scene a bit first about what it kind of looks like, what IoT and satellite connectivity together are enabling. Let's start there.
- [17:05]
Ian Itz
Yeah, absolutely. So the way that I kind of look at IoT is a little bit of what I described earlier, which is small devices that are sending small chunks of data. Now, that obviously has a variety of different meanings for different folks. IoT could be big chunks of data and lots of information passing back and forth. But when we kind of marry the two, IOT and satellite, what we're really looking at is smaller pieces of data because that's the most efficient way to get that across on the network. And so from our perspective, IoT is typically small devices with small antennas. In a lot of cases, they can be carried by a human, so by an individual, or they're just getting environmental data from wherever they're at. So it could be tracking an asset, it could be a sensor in a farm measuring the amount of water in the soil. It could be buoys in the ocean that are measuring ocean current salinity, early warning, tsunami detection. So really, IOT is kind of all encompassing in terms of the way that we think about it. We're really applying the fundamentals of IoT to basically any application that's out there today on the terrestrial network. We complement it on the satellite side. So we're really kind of that backup link in a lot of cases. But in many cases for IoT specifically, we are the primary comms. We are operating in locations where terrestrial coverage just simply isn't available. And so our customers look to us to provide, again, kind of rugged, small devices that can be deployed anywhere on the globe. And that's kind of our forte. Right. That's really where Iridium shines. And so that's kind of the way that we see IOT in general. But small devices, small aperture antennas, low energy, and then typically satellite and cellular are complementary to each other. Right. We're bouncing back and forth from one network to another. But that's kind of my world in terms of IoT and satellite specifically.
- [19:03]
Maria Vermazes
That's so fascinating what this all enables and the places that IoT is being used. It just blows my mind. And I know we think maybe, or I think about IOT as usually small device sending small amounts of data, but that's changing. Right. Where a lot of these devices are sending a lot more information now, lots more data being sent out. And I guess how, how do you all support that?
- [19:25]
Dave Bittner
Like what?
- [19:26]
Maria Vermazes
That must be an interesting advancement for you.
- [19:28]
Ian Itz
Yeah. So what we strive to do is obviously continue to support customers that have kind of those low data rates and Those will always be, you know, a pertinent customer for us. You know, as I mentioned, the ground soil sensors, you know, those things don't go away, they'll be used for quite some time and they don't send that much data. But what we do obviously look at are some of these higher applications, as you mentioned. And so we look to develop kind of new technology kind of on a cycle basis primarily. Right. So primarily we developed core modules that were built for low data transmissions as we talked about, but we've got some new devices that have just come online that are now able to do more rich data sets. So they're able to send images, for example, they're able to send voice snippets. And so these things are very part and parcel to what we do from a reliability perspective. A lot of the devices that work on the Iridium network are there for safety of life type applications. And so the ability to send kind of voice snippets and these images from remote locations kind of aids in those potential situations where somebody is injured. They're able to not only kind of send their location and maybe some text messaging about what's going on, but they're able to then send images about their environment. They're able to potentially talk if they're unable to use their hands. And so, yeah, I mean, we try to offer a variety of services on the network to cater to different IoT applications. So yeah, we tend to focus on new modules every couple of years and expand the capabilities with each one as we develop.
- [21:05]
Maria Vermazes
That's really neat. And I have to ask the inevitable question that I think I ask in every interview nowadays is about AI, AI and cloud, how this all plays in. Because I know there's a lot of talk about what we're able to do at the edge now, what we're not able to do at the edge. But a lot IoT always comes up in that conversation. So often I'm talking to cloud and AI folks, asking them about IoT now I'm talking about an IoT person about cloud and edge. So tell me about what advancements you're seeing there and what that's enabling.
- [21:30]
Ian Itz
Yeah, so cloud for us is extremely important. We integrated kind of AWS as our first foray, I wanna say, five or six years ago now they were looking to expand their satellite connectivity options for their customers. And so we developed a partners. We're now kind of fully hooked in from an IoT perspective. We're able to send data back and forth on all of our IoT platform devices through the AWS Cloud. And not just AWS. Right. I mean, we operate now with kind of any cloud infrastructure that you bring to the table. So from that perspective, cloud is of utmost importance. We just want to give customers options and so we don't charge more for it. It's really just an additional data delivery mechanism. And then obviously there's all of the other features that are built into the cloud, either IoT core or any of the other kind of security capabilities that are involved, or any of the translation mechanisms that are in there. Our customers are more and more leveraging the cloud into their own internal applications. And it's really just by virtue of us offering that as a capability. We're not doing a whole lot of application building. We're kind of really just leveraging what's already there and then providing the data through our standard interconnects. The AI thing is really interesting to me specifically because a lot of our customers have been doing this for quite some time. Right. As you probably know, sending data over a satellite link is going to be traditionally more expensive than when you send it over a cellular link. And so a lot of our customers, especially early on when IoT was called M2M, those customers were figuring out how to optimize their data before sending it over the satellite link. Right. And so the advent of edge computing, edge technology, and then add on top of that machine learning and AI, and it gives these users kind of a lot more benefit in terms of being able to analyze their data, make decisions on the edge, and then really only pass the data that's critical or the most relevant to what they're doing. And so from that perspective, our customers have been early adopters of edge computing, ML and AI for some time. And so now that it's really kind of in everybody's face, it's kind of everywhere you go, it's really just kind of now being adopted by the mainstream. But I'd say that IoT and IoT and satellite specifically were kind of leading the front on a lot of those early technologies because it was necessary for them for a cost operation kind of environment.
- [23:55]
Maria Vermazes
I find that really fascinating what Iridium does, because you all are really a backbone and that you do enable all these different people and organizations to figure out how to use what you all provide. And then it just makes whole constellation. If I can use the space cliche of just different, different capabilities, it's quite amazing to watch. And something that I've been increasingly trying to learn more about is also the phrases non terrestrial networks and just that again, you guys are a huge player in that. I mean, enabling all that and you know what that looks like and what that's enabling as part of that, the ecosystem that's building a non terrestrial network. Like how are these different pieces all sort of fitting together to work towards what's coming in? Non terrestrial networks?
- [24:40]
Ian Itz
Yeah, absolutely. I think the vision for the non terrestrial network is to offer a service that to the consumer doesn't look any different than what they've used today. Right. So you're outside of terrestrial coverage. And whether it be your smartwatch or your phone or your vehicle or whatever it happens to be falls outside of terrestrial coverage, the transition to satellite and the use of satellite should be pretty deprecated from view from the customer. Right. If I can, for lack of a better term, they shouldn't know which network is providing the service underlying. They just want to know that seamless. Right. They just want to be able to close the link, send the data. And so from that perspective, I think that's where we're headed. Right. What you'll end up seeing over time and how all these pieces fit together is really kind of that seamless experience from a data connectivity persp.
- [25:32]
Dave Bittner
Right.
- [25:33]
Ian Itz
You've got devices that primarily live on cellular and that want to jump over to satellite and now they're doing the opposite, which is they're living potentially their entire lives on satellite and using cellular sometimes. And so again, I think what we drive for is the ability to have customers again that see this kind of seamless experience and not necessarily know which satellite carrier they're operating on or that their device is actually on satellite. Right. So I think really what we're doing from an NTN perspective is moving towards a more standardized approach where any manufacturer of a chip or a module can now integrate Iridium into that same module without any additional cost. Right. And so that's really the benefit and that's kind of where all these things fit together is along the standardization of the satellite networks within existing terrestrial networks. And that's really what's going to make everything kind of, as you mentioned, seamless. Maria, and ensure that satellite is a connectivity piece that's integral to pretty much any Iot solution that's out there today.
- [26:38]
Maria Vermazes
Very cool. I want to make sure, if there's anything that we didn't talk about that you wanted to mention that was a high priority for you guys to make sure you get out there. I want to give you the floor if there's anything that you wanted to mention, it's over to you for that.
- [26:50]
Ian Itz
Yeah, I mean, the only thing I'd mention is that we cater to the developer. That's kind of as I talked about earlier, Maria, we couldn't be where we are today without kind of the expertise that our partners bring. And so one of the things that we try to do is be very developer friendly in terms of providing developer kits and the experience for those that are wanting to try satellite. It can seem quite daunting if you've never been part of a satellite project, but I assure you that it's extremely easy. For our latest module, which is the 9704, you can go out and buy a kit, you can receive that kit within a couple of days, and you can be transmitting and talking to a satellite within a matter of minutes of opening up.
- [27:31]
Maria Vermazes
That's awesome. Ian, you've been a great guest. Thank you so much for explaining so many things to me that have been confused in my mind for quite some time. So you've been awesome. Thank you. Thank you so much, Maria.
- [27:42]
Ian Itz
Thanks for having me. I certainly appreciate the opportunity and it's been a great conversation.
- [27:46]
Dave Bittner
We'll have a link in the show notes to Ian and Maria's full conversation on Deep Space. Be sure to check out T minus space daily. Brought to you by N2K CyberWire each weekday on your favorite podcast app. And now a word from our sponsor. Spy Cloud identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire and finally, in a plot that was just so crazy it might work, Kansas City's Nicholas Michael Kloster, age 32, has pleaded guilty to hacking multiple organizations, all to advertise his own cybersecurity services. Prosecutors say Kloster's methods were bold but far from sophisticated. At one gym, he strolled in, hacked their computer to access security cameras, erased his photo from their system, and reduced his membership fee to a bargain bin, $1. Then, like any enterprising entrepreneur, he emailed the owners the next day, offering his professional services. His business development tour continued at a non profit where he used a boot disk to reset passwords and install VPN software for future access. Presumably in preparation for his follow up sales email. Kloster's resume also includes using his employer's credit card to buy a hacking thumb drive, which led to his termination. He now faces up to five years in prison and a hefty fine. Talk about your failed penetration test. And that's the Cyberwire. For links to all of today's stories, check out our daily briefing@the cyberwire.com Be sure to check out Research Saturday and my conversation with Kyle Lefton, security researcher from Akamai. We're discussing their research. Two botnets, one flaw. Mirai spreads through WAZA vulnerability. That's Research Saturday. Check it out. We'd love to hear from you. We're conducting our annual audience survey to learn more about our listeners. We're collecting your insights through August 31st of this year. There's a link in the show Notes. Please do check it out. N2K's senior producer is Alice Carruth. Our producer is Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here next week. Did you know Active Directory is targeted in 9 out of 10 cyber attacks? Once attackers get in, they can take control of your entire network. That's why Sempras created Purple Night, the free security assessment tool that scans your Active directory for hundreds of vulnerabilities and shows you how to fix them. Join thousands of IT pros using Purple Knight to stay ahead of threats. Download it now at sempris.com purple-knight that's sempris.com purple knight.