Passkeys, PLCs, and America's New Cyber Privateers

David opens with a question that runs through the whole episode: does removing operational complexity solve the problem, or just relocate who is responsible for it. Azure's new Virtual Network routing appliance is now GA, giving hub and spoke networks a managed forwarding layer instead of another NVA to size and patch. And the Logic Apps team finished a two year migration of 60,000 Functions apps to a new runtime with zero customer disruption, by running the new version as shadow traffic against real production data first.

Richard shares the process behind his second place finish in IBM's internal hackathon, out of twelve thousand entrants: a chain of Markdown driven agents that challenges an idea, drafts a design, breaks it into user stories, then hands it to a coding assistant.

David also covers two security stories. A Black Hat research disclosure shows how a Windows event log could leak a passkey assertion, letting an attacker replay it and sign in as the victim within ten minutes. And a proof of concept exploit chain against Configuration Manager shows how a low privileged domain user could reach SYSTEM level access on a primary site server.

Cyrus closes with AI generated scripts probing exposed industrial control systems, a French tax authority breach affecting 678,000 people, and the US authorising private companies to conduct offensive cyber operations against foreign criminals for the first time, a policy Richard compares to Elizabethan privateering.

Links

• Azure Virtual Network routing appliance GA
• The Logic Apps migration writeup
• Pass the passkey research
• Configuration Manager exploit chain
• CISA advisory on PLC attacks
• DGFiP data breach coverage
• The offensive cyber operations memorandum
• Entra passkey as first MFA method

Socials

• X/Twitter
• Bluesky
• LinkedIn
• Facebook
• Threads

Music

• Null Invocation, Monochrome Pulse, listen here