Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.
Avsnitt
Risky Business #798 -- Mexican cartel surveilled the FBI to identify, kill witnesses
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- Australian airline Qantas looks like it got a Scattered Spider-ing
- Microsoft works towards blunting the next CrowdStrike disaster
- Changes are coming for Microsoft’s default enterprise app consenting setup
- Synology downplays hardcoded passwords for its M365 cloud backup agent
- The next Citrix Netscaler memory disclosure looks nasty
- Drug cartels used technical surveillance to find, fix and finish FBI informants and witnesses
This week’s episode is sponsored by RAD Security. Co-founder Jimmy Mesta joins to talk through how they use AI automation to assess the security posture of sprawling cloud environments.
This episode is also available on Youtube.
Show notes
- Qantas hit by cyber attack, leaving 6 million customer records at risk of data breach
- Scattered Spider appears to pivot toward aviation sector | Cybersecurity Dive
- Microsoft to make Windows more resilient following 2024 IT outage | Cybersecurity Dive
- (384) The Ultimate Guide to App Consent in Microsoft Entra - YouTube
- When Backups Open Backdoors: Accessing Sensitive Cloud Data via "Synology Active Backup for Microsoft 365" / modzero
- AT&T deploys new account lock feature to counter SIM swapping | CyberScoop
- Iran-linked hackers threaten to release Trump aides' emails | Reuters
- US government warns of new Iran-linked cyber threats on critical infrastructure | Cybersecurity Dive
- Actively exploited vulnerability gives extraordinary control over server fleets - Ars Technica
- Critical vulnerability in Citrix Netscaler raises specter of exploitation wave | Cybersecurity Dive
- Identities of More Than 80 Americans Stolen for North Korean IT Worker Scams | WIRED
- Cloudflare confirms Russia restricting access to services amid free internet crackdown | The Record from Recorded Future News
- Mexican drug cartel used hacker to track FBI official, then killed potential FBI informants, government audit says | CNN Politics
- Audit of the FBI's Efforts to Mitigate the Effects of Ubiquitous Technical Surveillance - Redacted Report
- NATO members aim for spending 5% of GDP on defense, with 1.5% eligible for cyber | The Record from Recorded Future News
- US sanctions bulletproof hosting provider for supporting ransomware, infostealer operations | CyberScoop
- US, French authorities confirm arrest of BreachForums hackers | TechCrunch
- Spanish police arrest five over $542 million crypto investment scheme | The Record from Recorded Future News
- Scam compounds labeled a 'living nightmare' as Cambodian government accused of turning a blind eye | The Record from Recorded Future News
Risky Business #797 -- Stuxnet vs Massive Ordnance Penetrators
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- We roll our eyes over the “16 billion credentials” leak hitting mainstream news
- Some interesting cyber angles emerge from the conflict in Iran
- Opensource maintainer of libxml2 is fed up with this hacker crap
- Shockingly, there are yet more ways to trick people into pasting commands into Windows
- Veeam “patches” its backup software RCE like it’s 2002 … by breaking the public PoC
This week’s episode is sponsored by Internet-wide honeypot reconnaissance platform, Greynoise. Founder Andrew Morris joins to talk about their journey spotting Chinese ORB-builders hacking thousands of ASUS routers, and why they’re destined for the woodchipper.
This episode is also available on Youtube.
Show notes
- No, the 16 billion credentials leak is not a new data breach
- Canadian telecom hacked by suspected China state group - Ars Technica
- Telecom giant Viasat breached by China's Salt Typhoon hackers
- WarTranslated on X: "Iran’s jamming GPS in the Strait of Hormuz, messing with ~970 ships, per Windward. UKMTO confirms the interference. Faulty AIS coordinates are screwing up navigation in the Persian Gulf. The IRGC threatens to shut the strait down in hours. https://t.co/kdMJvshOGC" / X
- Dmitri Alperovitch on X: "Chairman of the Joint Chiefs Gen. Dan Caine says @US_CYBERCOM supported this strike mission" / X
- Top Pentagon spy pick rejected by White House - POLITICO
- DHS warns of heightened cyber threat as US enters Iran conflict | Cybersecurity Dive
- Exclusive: Early US intel assessment suggests strikes on Iran did not destroy nuclear sites, sources say
- U.S. braces for Iran's response after overnight strikes on nuclear sites
- Assessing the Damage to Iran’s Nuclear Program
- Iran Hacks Tirana Municipality in Retaliation Over MEK - Tirana Times
- Iran's government says it shut down internet to protect against cyberattacks | TechCrunch
- Aflac discloses cyber intrusion linked to wider crime spree targeting insurance industry | Cybersecurity Dive
- Tonga Ministry of Health hit with cyberattack affecting website, IT systems | The Record from Recorded Future News
- Alleged Ryuk ransomware gang member arrested in Ukraine and extradited to US | The Record from Recorded Future News
- Russia releases REvil members after convictions for payment card fraud | The Record from Recorded Future News
- OneLogin, Many Issues: How I Pivoted from a Trial Tenant to Compromising Customer Signing Keys - SpecterOps
- Triaging security issues reported by third parties (#913) · Issue · GNOME/libxml2
- README: Set expectations straight (35d04a08) · Commits · GNOME / libxml2 · GitLab
- What’s in an ASP? Creative Phishing Attack on Prominent Academics and Critics of Russia | Google Cloud Blog
- FileFix - A ClickFix Alternative | mr.d0x
- Address bar shows hp.com. Browser displays scammers’ malicious text anyway. - Ars Technica
- Researchers urge vigilance as Veeam releases patch to address critical flaw | Cybersecurity Dive
- ASUSpicious Flaw - Millions of Users’ Information Exposed Since 2022 | MrBruh's Epic Blog
- Perth dad who created ‘evil twin’ Wi-Fi did so to access pictures of women
- GreyNoise Discovers Stealthy Backdoor Campaign Affecting Thousands of ASUS Routers
Risky Business #796 -- With special guest co-host Chris Krebs
On this week’s show Patrick Gray and Adam Boileau are joined by special guest Chris Krebs to discuss the week’s cybersecurity news. They talk through:
- Israeli “hacktivists” take out an Iranian state-owned bank
- Scattered-spider and friends pivot into attacking insurers
- Securing identities in a cloud-first world keeps us awake at night
- Microsoft takes the “aas” out of SaaS for Europe, leaving us with just software!
- An AI prompt injection into M365 exfils corporate data
This week’s episode is sponsored by Kroll’s Cyber practice. Kroll Cyber Associate Managing Director George Glass is based in London and talks through his experiences helping organisations in the UK deal with the Scattered Spider attacks.
This episode is also available on Youtube.
Show notes
- Iran’s Bank Sepah disrupted by cyberattack claimed by pro-Israel hacktivist group | CyberScoop
- Iran orders officials to ditch connected devices
- Heightened Cyberthreat Amidst Israel-Iran Conflict
- Threat group linked to UK, US retail attacks now targeting insurance industry | Cybersecurity Dive
- Coming to Apple OSes: A seamless, secure way to import and export passkeys - Ars Technica
- Cyberattack on Washington Post Compromises Email Accounts of Journalists
- Hackers impersonating US government compromise email account of prominent Russia researcher | The Record from Recorded Future News
- A good one to talk to Chris about:
- Breaking down ‘EchoLeak’, the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot
- CISA warns of supply chain risks as ransomware attacks exploit SimpleHelp flaws | Cybersecurity Dive
- Whole Foods supplier making progress on restoration after cyberattack left shelves empty | The Record from Recorded Future News
- Ransomware attack on ticketing platform upends South Korean entertainment industry | The Record from Recorded Future News
- Advisory: Cybersecurity incident
Soap Box: AI has entered the SOC, and it ain't going anywhere
In this sponsored Soap Box edition of the Risky Business podcast Patrick Gray chats with Dropzone AI founder Ed Wu about the role of LLMs in the SOC.
The debate about whether AI agents are going to wind up in the SOC is over, they’ve already arrived. But what are they good for? What are they NOT good for? And where else will we see AI popping up in security?
This episode is also available on Youtube.
Show notes
Risky Business #795 -- How The Com is hacking Salesforce tenants
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- New York Times gets a little stolen Russian FSB data as a treat
- iVerify spots possible evidence of iOS exploitation against the Harris-Walz campaign
- Researcher figures out a trick to get Google account holders’ full names and phone numbers
- Major US food distributor gets ransomwared
- The Com’s social engineering of Salesforce app authorisations is a harbinger of our future problems
- Australian Navy forgets New Zealand has computers, zaps Kiwis with their giant radar.
This week’s episode is sponsored by identity provider Okta. Long-time friend of the show Alex Tilley is Okta’s Global Threat Research Coordinator, and he joins to discuss how organisations can use both human and technical signals to spot North Koreans in their midst.
This episode is also available on Youtube.
Show notes
- How The Times Obtained Secret Russian Intelligence Documents - The New York Times
- Ukraine's military intelligence claims cyberattack on Russian strategic bomber maker | The Record from Recorded Future News
- Harris-Walz campaign may have been targeted by iPhone hackers, cybersecurity firm says
- iVerify Uncovers Evidence of Zero-Click Mobile Exploitation in the U.S.
- Spyware maker cuts ties with Italy after government refused audit into hack of journalist’s phone | The Record from Recorded Future News
- Italian lawmakers say Italy used spyware to target phones of immigration activists, but not against journalist | TechCrunch
- Android chipmaker Qualcomm fixes three zero-days exploited by hackers | TechCrunch
- Cellebrite to acquire mobile testing firm Corellium in $200 million deal | CyberScoop
- Apple Gave Governments Data on Thousands of Push Notifications
- A Researcher Figured Out How to Reveal Any Phone Number Linked to a Google Account
- Bruteforcing the phone number of any Google user
- Acreed infostealer poised to replace Lumma after global crackdown | The Record from Recorded Future News
- BidenCash darknet forum taken down by US, Dutch law enforcement | The Record from Recorded Future News
- NHS calls for 1 million blood donors as UK stocks remain low following cyberattack | The Record from Recorded Future News
- Major food wholesaler says cyberattack impacting distribution systems | The Record from Recorded Future News
- Kettering Health confirms attack by Interlock ransomware group as health record system is restored | The Record from Recorded Future News
- Hackers abuse malicious version of Salesforce tool for data theft, extortion | Cybersecurity Dive
- shubs on X: "IP whitelisting is fundamentally broken. At @assetnote, we've successfully bypassed network controls by routing traffic through a specific location (cloud provider, geo-location). Today, we're releasing Newtowner, to help test for this issue: https://t.co/X3dkMz9gwK" / X
- Ross Ulbricht Got a $31 Million Donation From a Dark Web Dealer, Crypto Tracers Suspect | WIRED
- Australian navy ship causes radio and internet outages to parts of New Zealand
Risky Business #794 -- Psychic Panda outgunned by Fluffy Lizard and UNC56728242
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- Cyber firms agree to deconflict and cross-reference hacker group names
- Russian nuclear facility blueprints gathered from public procurement websites
- Someone audio deepfaked the White House Chief of Staff, but for the dumbest reasons
- Germany identifies the Trickbot kingpin
- Google spots China’s MSS using Calendar events for malware C2
- Meta apps abuse localhost listeners to track web sessions.
This week’s episode is sponsored by automation vendor Tines. Its Field CISO, Matt Muller, joins the show to discuss an open letter penned by JP Morgan Chase’s CISO that pleads with Software as a Service suppliers to try to suck less at security.
This episode is also available on Youtube.
Show notes
- 'Forest Blizzard' vs 'Fancy Bear' - cyber companies hope to untangle weird hacker nicknames | Reuters
- Ukraine's Massive Drone Attack Was Powered by Open Source Software
- Massive security breach: Russian nuclear facilities exposed online
- How a Spyware App Compromised Assad’s Army - New Lines Magazine
- Exclusive | Federal Authorities Probe Effort to Impersonate White House Chief of Staff Susie Wiles - WSJ
- Malaysian home minister’s WhatsApp hacked, used to scam contacts | The Record from Recorded Future News
- U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scams – Krebs on Security
- Top counter antivirus service disrupted in global takedown | CyberScoop
- Cops in Germany Claim They’ve ID’d the Mysterious Trickbot Ransomware Kingpin | WIRED
- Australian ransomware victims now must tell the government if they pay up | The Record from Recorded Future News
- Google: China-backed hackers hiding malware in calendar events | Cybersecurity Dive
- Coinbase breach linked to customer data leak in India, sources say | Reuters
- US military IT specialist arrested for allegedly trying to leak secrets to foreign government | The Record from Recorded Future News
- NSO appeals WhatsApp decision, says it can’t pay $168 million in ‘unlawful’ damages | The Record from Recorded Future News
- ConnectWise says nation-state attack targeted multiple ScreenConnect customers | The Record from Recorded Future News
- Google Online Security Blog: Sustaining Digital Certificate Security - Upcoming Changes to the Chrome Root Store
- Meta and Yandex are de-anonymizing Android users’ web browsing identifiers - Ars Technica
- An Open Letter to Third-Party Suppliers
Risky Business #793 -- Scattered Spider is hijacking MX records
In this week’s edition of Risky Business Dmitri Alperovitch and Adam Boileau join Patrick Gray to talk through the week’s news, including:
- EXCLUSIVE: A Scattered Spider-style crew is hijacking DNS MX entries and compromising enterprises within minutes
- The SVG format brings the all horrors of HTML+JS to image files, and attackers have noticed
- Brian Krebs eats a 6.3Tbps DDoS … ‘cause that’s how you demo your packet cannon
- Law enforcement takes out Lumma Stealer, Qakbot, Danabot and some dark web drug traffickers
- Iranian behind 2019 Baltimore ransomware mysteriously appears in North Carolina and pleads guilty
- CISA’s leadership is fleeing in droves, even though the US needs them more than ever.
This week’s episode is sponsored by Thinkst Canary. Long time friend of the show Haroon Meer joins and talks through where he feels the industry is at, having just returned home from the AI-fueled hype at this year’s RSA conference.
This episode is also available on Youtube.
Show notes
- China-linked ‘Silk Typhoon’ hackers accessed Commvault cloud environments, person familiar says - Nextgov/FCW
- Risky Bulletin: SVG use for phishing explodes in 2025 - Risky Business Media
- KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS – Krebs on Security
- Midwestern telco Cellcom confirms cyber incident after days of service outages | The Record from Recorded Future News
- Microsoft leads international takedown of Lumma Stealer | Cybersecurity Dive
- Who said what? on X: "Message from the administrator of Lumma Stealer on the forums about the recent events🕊️👀 https://t.co/MOjCSMMErK" / X
- Ransomware hackers charged, infrastructure dismantled in international law enforcement operation | The Record from Recorded Future News
- Oops: DanaBot Malware Devs Infected Their Own PCs – Krebs on Security
- DOJ charges man allegedly behind Qakbot malware | The Record from Recorded Future News
- US, Europol arrest 270 dark web drug traffickers in Operation RapTor | The Record from Recorded Future News
- Iranian pleads guilty to launching Baltimore ransomware attack, faces 30 years behind bars | The Record from Recorded Future News
- Decentralized crypto platform Cetus hit with $223 million hack | The Record from Recorded Future News
- Nearly 70,000 impacted by Coinbase breach involving $20 million ransom demand | The Record from Recorded Future News
- USA: Crypto investor charged with kidnapping, torturing man in an NYC apartment
- Vietnam orders ban on Telegram messaging app over security concerns | The Record from Recorded Future News
- Exclusive: Hacker who breached communications app used by Trump aide stole data from across US government | Reuters
- CISA loses nearly all top officials as purge continues | Cybersecurity Dive
- White House dismisses scores of National Security Council staff - The Washington Post
Risky Business #792 -- Beware, Coinbase users. Crypto thieves are taking fingers now
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- TeleMessage memory dumps show up on DDoSecrets
- Coinbase contractor bribed to hand over user data
- Telegram does seem to be actually cooperating with law enforcement
- Britain’s legal aid service gets 15 years worth of applicant data stolen
- Shocking no one, Ivanti were weaseling when they blamed latest bugs on a third party library
This week’s episode is sponsored by Prowler, who make an open source cloud security tool. Founder and original project developer Toni de la Fuente joins to talk through the flexibility that open tooling brings. Prowler is also adding support for SaaS platforms like M365, and of course, an AI assistant to help you write checks!
This episode is also available on Youtube.
Show notes
- TeleMessage - Distributed Denial of Secrets
- How the Signal Knockoff App TeleMessage Got Hacked in 20 Minutes | WIRED
- Coinbase says thieves stole user data and tried to extort $20M
- Hack could cost Coinbase up to $400M: filing | Cybersecurity Dive
- Severed Fingers and ‘Wrench Attacks’ Rattle the Crypto Elite
- Money Stuff: US Debt Rates Itself | NewsletterHunt
- 2 massive black market services blocked by Telegram, messaging app says | Reuters
- Telegram Gave Authorities Data on More than 20,000 Users
- GovDelivery, an email alert system used by governments, abused to send scam messages | TechCrunch
- ATO warning as hackers steal $14,000 in tax returns: ‘Be wary’
- Hack of SEC social media account earns 14-month prison sentence for Alabama man | The Record from Recorded Future News
- 19-year-old accused of largest child data breach in U.S. agrees to plead guilty
- Beach mansion, Benz and Bitcoin worth $4.5m seized from League of Legends hacker Shane Stephen Duffy | 7NEWS
- Pegasus spyware maker rebuffed in efforts to get off trade blacklist - The Washington Post
- Ransomware attack hits supplier of refrigerated groceries to British supermarkets | The Record from Recorded Future News
- UK government confirms massive data breach following hack of Legal Aid Agency | The Record from Recorded Future News
- Ivanti Endpoint Mobile Manager customers exploited via chained vulnerabilities | Cybersecurity Dive
- Expression Payloads Meet Mayhem - Ivanti EPMM Unauth RCE Chain (CVE-2025-4427 and CVE-2025-4428)
Risky Biz Soap Box: Push Security's browser-first twist on identity security
In this wholly sponsored Soap Box edition of the show, Patrick Gray chats with Adam Bateman and Luke Jennings from Push Security.
Push has built an identity security platform that collects identity information and events from your users’ browsers. It can detect phish kits and shut down phishing attempts, protect SSO credentials, and find shadow/personal account that a user has spun up.
It’s extremely difficult to bypass. That’s because when you’re in the browser it doesn’t matter how a phishing link arrives, or how a threat actor has concealed it from your detection stack – if the user sees it, Push sees it.
There are solutions for protecting your users SSO credentials, like passkeys. But what about all the SaaS in your environment? Even if it’s enrolled into your SSO, are you sure that’s how your users are authenticating to it? What about the automation platforms your developers and admins use? What about data platforms like Snowflake? Are your using setting up passkeys for those accounts? How would you know, and what problems can it cause if those accounts are vulnerable?
This is a fun one!
This episode is also available on Youtube.
Show notes
Risky Business #791 -- Woof! Copilot for Sharepoint coughs up creds and keys
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- Struggling to find that pesky passwords.xlsx in Sharepoint? Copilot has your back!
- The ransomware ecosystem is finding life a bit tough lately
- SAP Netweaver bug being used by Chinese APT crew
- Academics keep just keep finding CPU side-channel attacks
- And of course… bugs! Asus, Ivanti, Fortinet… and a Nissan LEAF?
This week’s episode is sponsored by Resourcely, who will soothe your Terraform pains. Founder and CEO Tracis McPeak joins to talk about how to get from a very red dashboard full of cloud problems to a workable future.
This episode is also available on Youtube.
Show notes
- Exploiting Copilot AI for SharePoint | Pen Test Partners
- MrBruh's Epic Blog
- Ransomware group Lockbit appears to have been hacked, analysts say | Reuters
- "CONTI LEAK: Video they tried to bury! 6+ Conti members on a private jet. TARGET’s birthday — $10M bounty on his head. Filmed by TARGET himself. Original erased — we kept a copy."
- Mysterious hackers who targeted Marks and Spencer's computer systems hint at political allegiance as they warn other tech criminals not to attack former Soviet states
- The organizational structure of ransomware groups is evolving rapidly.
- SAP NetWeaver exploitation enters second wave of threat activity
- China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures
- DOGE software engineer’s computer infected by info-stealing malware
- Hackers hijack Japanese financial accounts to conduct nearly $2 billion in trades
- FBI and Dutch police seize and shut down botnet of hacked routers
- Poland arrests four in global DDoS-for-hire takedown
- School districts hit with extortion attempts after PowerSchool breach
- EU launches vulnerability database to tackle cybersecurity threats
- Training Solo - vusec
- Branch Privilege Injection: Exploiting Branch Predictor Race Conditions – Computer Security Group
- Remote Exploitation of Nissan Leaf: Controlling Critical Body Elements from the Internet
- PSIRT | FortiGuard Labs
- EPMM Security Update | Ivanti
Wide World of Cyber: How state adversaries attack security vendors
In this edition of the Wide World of Cyber podcast Patrick Gray talks to SentinelOne’s Steve Stone and Alex Stamos about how foreign adversaries are targeting security vendors, including them.
From North Korean IT workers to Chinese supply chain attacks, SentinelOne and its competitors are constantly fending off sophisticated hacking campaigns.
This edition of the Wide World of Cyber was recorded in front of a live audience in San Francisco, with Patrick attending via Zoom.
The Wide World of Cyber podcast series is a wholly sponsored co-production between SentinelOne and Risky Business Media.
This episode is also available on Youtube.
Show notes
Risky Business #790 -- Bye bye Signal-gate, hello TeleMessage-gate
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- White House’s off-brand Israeli Signal fork logs cleartext messages with hard coded creds while getting hacked (twice). Just … Wow.
- Ransomware attacks on UK retailers are linked, and Marks & Spencer has it extra bad
- After six years dormant, a Magento eCommerce platform backdoor comes to life
- The North Korean IT worker scam is truly webscale
- NSO group owes Meta $168m for hacking WhatsApp
This week’s episode is sponsored by vulnerability management wranglers, Nucleus Security. Aaron Unterberger joins to talk through the complexities of tracking vulnerabilities in cloud components - left to the source, right to the deployments, and …sideways into the sidecars?
This week’s show also features an excerpt from Pat’s interview with Senator Mark Warner - Scoot back one in your podcast feed to check out the full chat, or find it on Youtube.
This episode is available on Youtube too.
Show notes
- Mike Waltz Accidentally Reveals Obscure App the Government Is Using to Archive Signal Messages
- Despite misleading marketing, Israeli company TeleMessage, used by Trump officials, can access plaintext chat logs
- The Signal Clone the Trump Admin Uses Was Hacked
- App used by Mike Waltz suspends services after hacking claims
- Senator Demands Investigation into Trump Admin Signal Clone After 404 Media Investigation
- MG on X: "Looks like TeleMessage was probably procured and rolled out under Biden. There are public records for it. https://t.co/XCuZpi8PL3" / X
- Harrods becomes latest retailer to announce attempted cyberattack | The Record from Recorded Future News
- Co-op DragonForce cyber attack includes customer data, firm admits
- Co-op cyber attack: Staff told to keep cameras on in meetings
- Hundreds of e-commerce sites hacked in supply-chain attack - Ars Technica
- Microsoft’s new “passwordless by default” is great but comes at a cost - Ars Technica
- Windows RDP lets you log in using revoked passwords. Microsoft is OK with that. - Ars Technica
- North Korean operatives have infiltrated hundreds of Fortune 500 companies | CyberScoop
- US wants to cut off key player in Southeast Asian cybercrime industry | The Record from Recorded Future News
- Myanmar militia leader sanctioned by US over cyber scam connections | The Record from Recorded Future News
- Trump proposes major cut to CISA’s budget, citing false ‘censorship’ claims | Cybersecurity Dive
- NSA to cut up to 2,000 civilian roles as part of intel community downsizing | The Record from Recorded Future News
- NSO Group owes $168M in damages to WhatsApp over spyware infections, jury says | CyberScoop
BONUS INTERVIEW: Senator Mark Warner on Signalgate, Volt Typhoon and tariffs
In this extended interview the Vice Chair of the Senate Select Committee on Intelligence, Senator Mark Warner, joins Risky Business host Patrick Gray to talk about:
- The latest developments in the Signalgate scandal
- Why America needs to be more aggressive in responding to Volt Typhoon
- How tariffs are affecting American alliances
- Why the Five Eyes alliance is sacrosanct
This episode is available on Youtube
Show notes
Risky Business #789 -- Apple's AirPlay vulns are surprisingly awful
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- British retail stalwart Marks & Spencer gets cybered
- South Korean telco sets out to replace all its subscriber SIMs after (we assume) it lost the keymat
- It’s a good exploit week! Bugs in Apple Airplay, SAP webservers, Erlang SSH and CommVault backups
- Juice jacking! No, really! Some researchers actually did it (so still not in the wild, then)
- Anti-DOGE whistleblower sure sounds like he has a point
This week’s episode is sponsored by Knocknoc, who let you glue your firewalls to your single sign on. Knocknoc’s CEO Adam Pointon talks about the joy that having end-to-end IPv6 would bring for zero-trust access control. He also touches on people using Knocknoc inside their network to isolate critical systems.
Editors Note : Pat also gives Adam (Boileau) stick in the sponsor interview about the Risky Biz webserver not having IPv6 enabled, which fact-checking during the edit says is FAKE NEWS. Just uh, don’t look at how fresh that AAAA record in the DNS is, friends 😉
This episode is also available on Youtube.
Show notes
- British retailer M&S confirms being hit by ‘cyber incident’ amid store delays | The Record from Recorded Future News
- M&S cyber-attack linked to hacking group Scattered Spider | Marks & Spencer | The Guardian
- Bina Puri shares, Warrant B close sharply lower day after hacking
- Bina Puri, Pos Malaysia tumble following hacking incident | FMT
- Japan warns of hundreds of millions of dollars in unauthorized trades from hacked accounts | The Record from Recorded Future News
- US conducts cyberattacks against major Chinese commercial encryption provider: report - Global Times
- Iran says major cyberattack on infrastructure repelled | Iran International
- Spain rules out cyber attack - but what could have caused power cut?
- South Korea's SK Telecom begins SIM card replacement after data breach
- AirBorne: Wormable Zero-Click RCE in Apple AirPlay Puts Billions of Devices at Risk | Oligo Security | Oligo Security
- iOS and Android juice jacking defenses have been trivial to bypass for years - Ars Technica
- How Android 16's new security mode will stop USB-based attacks - Android Authority
- Researchers warn of critical flaw found in Erlang OTP SSH | Cybersecurity Dive
- Critical vulnerability in SAP NetWeaver under threat of active exploitation | Cybersecurity Dive
- CVE-2025-31324: Critical SAP Flaw Explained | Strobes
- Fire In The Hole, We’re Breaching The Vault - Commvault Remote Code Execution (CVE-2025-34028)
- Risky Bulletin: NFC card malware keeps evolving in Russia, a bad omen for the future - Risky Business Media
- Hegseth had unsecured internet line in Pentagon for Signal, sources say | AP News
- Whistleblower: DOGE Siphoned NLRB Case Data – Krebs on Security
- 2025_0414_Berulis-Disclosure-with-Exhibits.s.pdf
- CISA gets a deputy director as it braces for major layoffs | Cybersecurity Dive
- Two top cyber officials resign from CISA | The Record from Recorded Future News
- Ex-CISA chief Chris Krebs leaving SentinelOne following Trump pressure | Reuters
- Former cyber official targeted by Trump speaks out after cuts to digital defense
- Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today's Adversaries | SentinelOne
- ZachXBT on X: "Nine hours ago a suspicious transfer was made from a potential victim for 3520 BTC ($330.7M)"
Snake Oilers: LimaCharlie, Honeywell Cyber Insights, CobaltStrike and Outflank
In this edition of the Snake Oilers podcast, three sponsors come along to pitch their products:
- LimaCharlie: A public cloud for SecOps
- Honeywell Cyber Insights: An OT security/discovery solution
- Fortra’s CobaltStrike and Outflank: Security tooling for red teamers
This episode is also available on Youtube.
Show notes
Snake Oilers: Pangea, Cosive and Sysdig
In this edition of Snake Oilers three vendors pitch host Patrick Gray on their tech:
- Pangea: Guardrails and security for AI agents and applications (https://pangea.cloud)
Worried about your AI apps going rogue, being mean to your customers or even disclosing sensitive information? Pangea exists to address these risks. Fascinating stuff.
- Cosive: A threat intelligence company that can host your MISP server in AWS. CloudMISP! (https://www.cosive.com/snakeoilers)
Are you running a MISP server on some old hardware under a desk in your SOC? There’s a better way! Cosive can run it for you on AWS so you can just use it instead of wrestling with maintaining it. They also do some CTI consulting to help you get better use out of MISP.
- Sysdig: A Linux runtime security platform (https://sysdig.com/)
The modern Windows network is an all-singing, all-dancing, perfectly orchestrated, EDR-protected ballet. The modern Linux production environment… isn’t. Find out how Sysdig can help you get some visibility and control over your Linux fleet.
This episode is also available on Youtube.
Show notes
Risky Business #788 -- Trump targets Chris Krebs, SentinelOne
On this week’s show Patrick Gray talks to former NSA Cybersecurity Director Rob Joyce about Donald Trump’s unprecedented, unwarranted and completely bonkers political persecution of Chris Krebs and his employer SentinelOne.
They also talk through the week’s cybersecurity news, covering:
- Mitre’s stewardship of the CVE database gets its funding DOGE’d
- The US signs on to the Pall Mall anti-spyware agreement
- China tries to play the nationstate cyber-attribution game, but comedically badly
- Hackers run their malware inside the Windows sandbox, for security against EDR
This week’s episode is sponsored by open source identity provider Authentik. CEO Fletcher Heisler joins to talk through the increasing sprawl of the identity ecosystem.
This episode is also available on Youtube.
Show notes
- Cybersecurity industry falls silent as Trump turns ire on SentinelOne | Reuters
- U.S. cyber defenders shaken by Trump's attack on their former boss
- Trump Revenge Tour Targets Cyber Leaders, Elections – Krebs on Security
- Wyden to block Trump's CISA nominee until agency releases report on telecoms’ ‘negligent cybersecurity’ | The Record from Recorded Future News
- Gabbard sets up DOGE-style team to cut costs, uncover intel ‘weaponization’
- MITRE Warns CVE Program Faces Disruption Amid US Funding Uncertainty
- US to sign Pall Mall pact aimed at countering spyware abuses | The Record from Recorded Future News
- Court document reveals locations of WhatsApp victims targeted by NSO spyware | TechCrunch
- Spyware Maker NSO Group Is Paving a Path Back Into Trump’s America | WIRED
- NCSC shares technical details of spyware targeting Uyghur, Tibetan and Taiwanese groups | The Record from Recorded Future News
- Risky Bulletin: Chinese APT abuses Windows Sandbox to go invisible on infected hosts
- China escalates cyber fight with U.S., names alleged NSA hackers
- Researcher uncovers dozens of sketchy Chrome extensions with 4 million installs - Ars Technica
- China-based SMS Phishing Triad Pivots to Banks – Krebs on Security
- Risky Bulletin: CA/B Forum approves 47-days TLS certs
- Ransomware in het mkb: Cybercriminelen verhogen losgeld bij cyberverzekering
- 4chan Is Down Following What Looks to Be a Major Hack Spurred By Meme War
Wide World of Cyber: How the Trump admin is changing the cybersecurity landscape
In this podcast, Patrick Gray chats with SentinelOne’s Chris Krebs and Alex Stamos about the huge changes afoot in the United States government and what they mean for the threat environment. From the director of NSA being fired to massive job cuts at CISA and huge foreign policy shifts, tomorrow’s threat environment is going to be very different to today’s. Tune in to hear analysis from two of the best in the business!
This episode is also available on Youtube.
Show notes
Risky Business #787 -- Trump fires NSA director, CISA cuts inbound
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- Oracle quietly cops to being hacked, but immediately pivots into pretending it didn’t matter
- NSA and CyberCom leaders fired for not being MAGA enough
- US Treasury had some dusty corners it hadn’t found China in yet, looked, found China in them
- …which is a great time to discuss slashing CISA’s staffing
- Ransomware crews and bullet proof hosting providers are getting rekt, and we love it
- And Microsoft patches yet another logging 0-day being used in the wild.
This episode is sponsored by Yubico, makers of Yubikey hardware authentication tokens. Yubico’s Vice President of Solutions Architecture and Alliances Derek Hanson joins to discuss how the consumer-centric passkey ecosystem has become a real challenge for enterprises. One that Yubico is actually ideally positioned to solve.
This episode is also available on Youtube.
Show notes
- Oracle privately confirms Cloud breach to customers
- Oracle have finally issued a written notification to customers about their cybersecurity incident.
- Head of NSA and US Cyber Command reportedly fired | Cybersecurity Dive
- Trump fires numerous National Security Council staff - The Washington Post
- Trump administration under scrutiny as it puts major round of CISA cuts on the table | Cybersecurity Dive
- Hackers Spied on US Bank Regulators’ Emails for Over a Year - Bloomberg
- This is how Jeffrey Goldberg got added to the Signal chat
- Cybercriminals are trying to loot Australian pension accounts in new campaign | The Record from Recorded Future News
- $500,000 stolen in Australian super fund data breach | Superannuation | The Guardian
- Australian regulator pulls licenses of 95 companies in effort to crack down on investment scams | The Record from Recorded Future News
- Everest ransomware group’s darknet site offline following defacement | The Record from Recorded Future News
- On March 28, 2025, a threat actor leaked internal data from Medialand, a major bulletproof hosting (BPH) provider long linked to Yalishanda (LARVA-34).
- There's a ransomware group named DragonForce going around hacking its rivals. After Mamona and BlackLock, the group has now hacked RansomHub
- The DragonForce ransomware group hacked two rivals this month
- CISA, experts warn of Crush file transfer attacks as ransomware gang makes threats | The Record from Recorded Future News
- Kill Security Campaign Targets CrushFTP Servers
- National Vulnerability Database | NIST
- Microsoft patches zero-day actively exploited in string of ransomware attacks | CyberScoop
- Exploitation of CLFS zero-day leads to ransomware activity | Microsoft Security Blog
- Is The Sofistication In The Room With Us? - X-Forwarded-For and Ivanti Connect Secure (CVE-2025-22457)
Risky Business #786 -- Oracle is lying
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- Yes, Oracle Health and Oracle Cloud did get hacked
- The fallout from Signalgate continues
- North Korean IT workers pivot to Europe
- Honeypot data suggests a storm is brewing for Palo Alto VPNs
- Canadian Anon gets arrested for hacking Texas GOP
This week’s episode is sponsored by Trail of Bits. Tjaden Hess, a Principal Security Engineer at Trail of Bits who specialises in cryptography, joins the show this week to talk about what a responsible crypto-currency exchange cold wallet setup looks like, and … contrasts that with Bybit.
This episode is also available on Youtube.
Show notes
- Oracle Health breach compromises patient data at US hospitals
- FBI probes Oracle hack tied to healthcare extortion: Report - Becker's Hospital Review | Healthcare News & Analysis
- Oracle Still Denies Breach as Researchers Persist
- Hacker linked to Oracle Cloud intrusion threatens to sell stolen data | Cybersecurity Dive
- Publius on X: "🚨 SIGNAL SCANDAL: Katherine Maher, the leftist NPR CEO, is currently the Chair of the Board of Signal! WHAT ARE THE ODDS? https://t.co/jWNTeAt3Jz" / X
- Mike Waltz Is Losing Support Inside the White House - WSJ
- Waltz and staff used Gmail for government communications, officials say - The Washington Post
- Pete Hegseth, Mike Waltz, Tulsi Gabbard: Private Data and Passwords of Senior U.S. Security Officials Found Online - DER SPIEGEL
- Even More Venmo Accounts Tied to Trump Officials in Signal Group Chat Left Data Public | WIRED
- You Need to Use Signal's Nickname Feature
- SignalGate Is Driving the Most US Downloads of Signal Ever | WIRED
- Wickr - Wikipedia
- When Getting Phished Puts You in Mortal Danger – Krebs on Security
- DPRK IT Workers Expanding in Scope and Scale | Google Cloud Blog
- How the FBI Tracked, and Froze, Millions Sent to Criminals in Massive Caesars Casino Hack
- Defense contractor to pay $4.6 million over third-party provider’s security weakness | The Record from Recorded Future News
- Surge in Palo Alto Networks Scanner Activity Indicates Possible Upcoming Threats
- CISA warns new malware targeting Ivanti zero-day vulnerability | Cybersecurity Dive
- Canadian hacker arrested for allegedly stealing data from Texas Republican Party | The Record from Recorded Future News
- British intel intern pleads guilty to smuggling top secret data out of protected facility | The Record from Recorded Future News
Soap Box: Knocknoc glues your SSO to your firewalls for Just-in-Time network access
In this Soap Box edition of Risky Business host Patrick Gray talks to Knocknoc CEO Adam Pointon about how to easily rein in attack surface by glueing your single sign-on service to your network controls.
Do your Palo Alto and Fortinet devices really need to be discoverable by ransomware crews? Does your file transfer appliance need to be open to the whole world? What about your SSH and RDP? Your Citrix? Your (gasp) Exchange Online servers??
You can do a lot with IP allowlisting and simple Identity Aware Proxies (IAPs) to minimise your exposure.
Knocknoc is a bit of a “Risky Business special”, too. Pat helped Knocknoc to raise a seed round through Decibel Partners where he’s a founder advisor. He also serves on Knocknoc’s board of directors.
This episode is also available on Youtube.
Show notes
Risky Business #785 -- Signal-gate is actually as bad as it looks
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- Yes, the Trump admin really did just add a journo to their Yemen-attack-planning Signal group
- The Github actions hack is smaller than we thought, but was targeting crypto
- Remote code exec in Kubernetes, ouch
- Oracle denies its cloud got owned, but that sure does look like customer keymat
- Taiwanese hardware maker Clevo packs its private keys into bios update zip
- US Treasury un-sanctions Tornado Cash, party time in Pyongyang?
This week’s episode is sponsored by runZero. Long time hackerman HD Moore joins to talk about how network vulnerability scanning has atrophied, and what he’s doing to bring it back en vogue. Do you miss early 2000s Nessus? HD knows it, he’s got you fam.
This episode is also available on Youtube.
Show notes
- The Trump Administration Accidentally Texted Me Its War Plans - The Atlantic
- Using Starlink Wi-Fi in the White House Is a Slippery Slope for US Federal IT | WIRED
- Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed
- GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 3/21)
- Critical vulnerabilities put Kubernetes environments in jeopardy | Cybersecurity Dive
- Researchers back claim of Oracle Cloud breach despite company’s denials | Cybersecurity Dive
- The Biggest Supply Chain Hack Of 2025: 6M Records Exfiltrated from Oracle Cloud affecting over 140k Tenants | CloudSEK
- Capital One hacker Paige Thompson got too light a sentence, appeals court rules | CyberScoop
- US scraps sanctions on Tornado Cash, crypto ‘mixer’ accused of laundering North Korea money | Reuters
- Tornado Cash Delisting | U.S. Department of the Treasury
- Major web services go dark in Russia amid reported Cloudflare block | The Record from Recorded Future News
- Clevo Boot Guard Keys Leaked in Update Package
- Six additional countries identified as suspected Paragon spyware customers | CyberScoop
- The Citizen Lab’s director dissects spyware and the ‘proliferating’ market for it | The Record from Recorded Future News
- Malaysia PM says country rejected $10 million ransom demand after airport outages | The Record from Recorded Future News
- Hacker defaces NYU website, exposing admissions data on 1 million students | The Record from Recorded Future News
- Notre Dame uni students say outage creating enrolment, graduation, assignment mayhem - ABC News
- DNA of 15 Million People for Sale in 23andMe Bankruptcy
Risky Business #784 -- GitHub supply chain attack steals secrets from 23k projects
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- Github Actions supply chain attack loots keys and secrets from 23k projects
- Why a VC fund now owns a minority stake in Risky Business Media (!?!?)
- China doxes Taiwanese military hackers
- Microsoft thinks .lnk file whitespace trick isn’t worth patching but APTs sure love it
- CISA delivers government efficiency by re-hiring fired staff… to put them on paid leave
- …and Google acquires Wiz for $32bn
This week’s show is sponsored by Zero Networks, and they have sent along a happy customer to talk about their experience. Aaron Steinke is Head of Infrastructure at La Trobe Financial, an asset management firm in Australia. Aaron talks through bringing modern zero-trust goodness to the reality of a technology environment that’s been around 40 years.
This episode is also available on Youtube.
Show notes
- Risky Bulletin: GitHub supply chain attack prints everyone's secrets in build logs - Risky Business Media
- China says Taiwan's military is behind PoisonIvy APT
- China identifies Taiwanese hackers allegedly behind cyberattacks and espionage | The Record from Recorded Future News
- Crypto exchange OKX shuts down tool used by North Korean hackers to launder stolen funds | The Record from Recorded Future News
- Lazarus Group deceives developers with 6 new malicious npm packages | CyberScoop
- Poisoned Windows shortcuts found to be a favorite of Chinese, Russian, N. Korean state hackers | The Record from Recorded Future News
- 'Mora_001' ransomware gang exploiting Fortinet bug spotlighted by CISA in January | The Record from Recorded Future News
- Black Basta uses brute-forcing tool to attack edge devices | Cybersecurity Dive
- Alleged Russian LockBit developer extradited from Israel, appears in New Jersey court | The Record from Recorded Future News
- CISA works to contact probationary employees for reinstatement after court order - Nextgov/FCW
- ‘People Are Scared’: Inside CISA as It Reels From Trump’s Purge | WIRED
- The Wiretap: CISA Staff Are Cautiously Optimistic About Trump’s Pick For Director
- White House instructs agencies to avoid firing cybersecurity staff, email says | Reuters
- Signal no longer cooperating with Ukraine on Russian cyberthreats, official says | The Record from Recorded Future News
- Telegram CEO Pavel Durov allowed to leave France amid investigation
- Appellate court upholds sentence for former Uber cyber executive Joe Sullivan | The Record from Recorded Future News
- Google buys cloud security provider Wiz for $32 billion | The Record from Recorded Future News
- Pat Gray, Founder of Risky Business, Joins Decibel as Founder Advisor - Decibel
Risky Business #783 -- Evil webcam ransomwares entire Windows network
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news with special guest Rob Joyce, a Former Special Assistant to the US President and Director of Cybersecurity for NSA.
They talk through:
- A realistic bluetooth-proximity phishing attack against Passkeys
- A very patient ransomware actor encrypts an entire enterprise with a puny linux webcam processor
- The ESP32 backdoor that is neither a door nor at the back
- The X DDoS that Elon said was Ukraine is claimed by pro-Palestinian hacktivists
- Years later, LastPass hackers are still emptying crypto-wallets
- …and it turns out North Korea nailed {Safe}Wallet with a malicious docker image. Nice!
Rob Joyce recently testified to the US House Select Committee on the Chinese Communist Party, and he explains why DOGE kicking probationary employees to the curb is “devastating” for the national security staff pipeline.
This week’s episode is sponsored by SpecterOps, makers of the BloodHound identity attack path mapping tool. Chief Product Officer Justin Kohler and Principal Security Researcher Lee Chagolla-Christensen discuss their pragmatic approach to disabling NTLM authentication in Active Directory using BloodHound’s insight.
This episode is also available on Youtube.
Show notes
- CVE-2024-9956 - PassKey Account Takeover in All Mobile Browsers | Tobia Righi - Security Researcher
- Feds Link $150M Cyberheist to 2022 LastPass Hacks – Krebs on Security
- Camera off: Akira deploys ransomware via webcam
- Tarlogic detects a hidden feature in the mass-market ESP32 chip that could infect millions of IoT devices
- Alleged Co-Founder of Garantex Arrested in India – Krebs on Security
- 37K+ VMware ESXi instances vulnerable to critical zero-day | Cybersecurity Dive
- Apple patches 0-day exploited in “extremely sophisticated attack” - Ars Technica
- What Really Happened With the DDoS Attacks That Took Down X | WIRED
- Eleven11bot estimates revised downward as researchers point to Mirai variant | Cybersecurity Dive
- Previously unidentified botnet infects unpatched TP-Link Archer home routers | The Record from Recorded Future News
- Safe.eth on X: "Investigation Updates and Community Call to Action" / X
- How to verify Safe{Wallet} transactions on a hardware wallet | Safe{Wallet} Help Center and Support.
- US charges Chinese nationals in cyberattacks on Treasury, dissidents and more | The Record from Recorded Future News
- Former top NSA cyber official: Probationary firings ‘devastating’ to cyber, national security | CyberScoop
- U.S. pauses intelligence sharing with Ukraine used to target Russian forces - The Washington Post
Risky Business #782 -- Are the USA and Russia cyber friends now?
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- Did the US decide to stop caring about Russian cyber, or not?
- Adam stans hard for North Korea’s massive ByBit crypto-theft
- Cellebrite firing Serbia is an example of the system working
- Starlink keeps scam compounds in Myanmar running
- Biggest DDoS botnet yet pushes over 6Tbps
This week’s episode is sponsored by network visibility company Corelight. Vincent Stoffer, field CTO at Corelight joins to talk through where eyes on your network can spot attackers like Salt and Volt Typhoon.
This episode is also available on Youtube.
Show notes
- Sygnia Preliminary Bybit Investigation Report
- Verichains Bybit Incident Investigation Preliminary Report
- North Koreans finish initial laundering stage after more than $1 billion stolen from Bybit | The Record from Recorded Future News
- Risky Bulletin: Trump administration stops treating Russian hackers as a threat - Risky Business
- Did Trump Admin Order U.S. Cyber Command and CISA to Stand Down on Russia? (Story updated)
- Russia to redeploy resources freed up by end of war in Ukraine, warns Finnish intelligence | The Record from Recorded Future News
- FBI urges crypto community to avoid laundering funds from Bybit hack | The Record from Recorded Future News
- Risky Bulletin: Cellebrite bans bad boy Serbia - Risky Business
- Belgium probes suspected Chinese hack of state security service | The Record from Recorded Future News
- Gabbard: UK demand to Apple for backdoor access is 'grave concern' to US | The Record from Recorded Future News
- Elon Musk’s Starlink Is Keeping Modern Slavery Compounds Online | WIRED
- U.S. Soldier Charged in AT&T Hack Searched “Can Hacking Be Treason” – Krebs on Security
- Google Password Manager finally syncs to iOS—here’s how - Ars Technica
- Gmail Security Alert: Google To Ditch SMS Codes For Billions Of Users
- Massive Iran-linked botnet launches DDoS attacks against telecom, gaming platforms | Cybersecurity Dive
- Microsoft-signed driver used in ransomware attacks | Cybersecurity Dive
- London member of ‘Com’ network convicted of making indecent images of children | The Record from Recorded Future News
- Volt Typhoon & Salt Typhoon Attackers Are Evading EDR: What Can You Do? | Corelight
Risky Business #781 -- How Bybit oopsied $1.4bn
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
- North Korea pulls off a 1.5 billion dollar crypto heist
- Apple pulls Advanced Data Protection from the UK
- Black Basta ransomware gang’s internal chats leak
- Russians snoop on Signal with QR codes
- And Myanmar ships thousands of freed scam compound workers to Thailand
Regular guest Lina Lau joins to discuss her work reading Chinese incident response reports on WeChat, and how that has people thinking that … she outed the NSA?
This week’s episode is sponsored by Airlock Digital, and allow-listing tragics Daniel Schell and David Cottingham are along with an amusing tale of using Windows’ own allow-listing software to block EDR from loading.
This episode is also available on Youtube.
Show notes
- Hackers drained $1.4 billion of cryptocurrency from Bybit exchange, CEO confirms | The Record from Recorded Future News
- CertiK - Bybit Incident Technical Analysis
- Hackers use ‘sophisticated’ macOS malware to steal cryptocurrency, Microsoft says | The Record from Recorded Future News
- EU sanctions North Korean tied to Lazarus group over involvement in Ukraine war | The Record from Recorded Future News
- Sanctions: Iranians Flock to Crypto; Int'l Actions Target Russia - Chainalysis
- Apple turns off iCloud encryption feature in UK following reported government legal order | The Record from Recorded Future News
- Swedish authorities seek backdoor to encrypted messaging apps | The Record from Recorded Future News
- Leaked chat logs expose inner workings of secretive ransomware group - Ars Technica
- Russian state hackers spy on Ukrainian military through Signal app | The Record from Recorded Future News
- Meta Sues Alleged Violent Extortionist For Holding Instagram Accounts Hostage
- Weathering the storm: In the midst of a Typhoon
- Thailand to take in 7,000 rescued from illegal cyber scam hubs in Myanmar | The Record from Recorded Future News
- Genea confirms cyber breach after ‘unauthorised third party’ accesses data | news.com.au — Australia’s leading news site
- Managed healthcare defense contractor to pay $11 million over alleged cyber failings | The Record from Recorded Future News
- Botnet looks for quiet ways to try stolen logins in Microsoft 365 environments | The Record from Recorded Future News
- Director-General's Annual Threat Assessment 2025 | ASIO
- An inside look at NSA (Equation Group) TTPs from China’s lense
Wide World of Cyber: DeepSeek lobs an AI hand grenade
In this episode of the Wide World of Cyber podcast Risky Business host Patrick Gray chats with SentinelOne’s Chris Krebs and Alex Stamos about AI, DeepSeek, and regulation.
From its bad transport security to its Chinese ownership and the economic implications of China “entering the chat”, everyone’s freaking out over this new model. But should they be?
Pat, Alex and Chris dissect the model’s significance, the politics of it all and how AI regulation in Europe, the US and China will shape the future of LLMs.
This episode is also available on Youtube.
Show notes
Risky Business #780 -- ASD torched Zservers data while admins were drunk
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- Australian spooks scrubbed Medibank data off Zservers bulletproof hosting
- Why device code phishing is the latest trick in confusing poor users about cloud authentication
- Cloudflare gets blocked in Spain, but only on weekends and because of… football?
- Palo Alto has yet another dumb bug
- Adam gushes about Qualys’ latest OpenSSH vulns
Enterprise browser maker Island is this week’s sponsor and Chief Customer Officer Bradon Rogers joins the show to talk about how the adoption of AI everywhere is causing headaches.
This episode is also available on Youtube.
Show notes
- Five Russians went out drinking. When they got back, Australia had struck
- Dutch police say they took down 127 servers used by sanctioned hosting service | The Record from Recorded Future News
- Further cyber sanctions in response to Medibank Private cyberattack | Defence Ministers
- What is device code phishing, and why are Russian spies so successful at it? - Ars Technica
- Anyone Can Push Updates to the DOGE.gov Website
- Piracy Crisis: Cloudflare Says LaLiga Knew Dangers, Blocked IP Address Anyway (Update) * TorrentFreak
- Palo Alto Networks warns firewall vulnerability is under active exploitation | Cybersecurity Dive
- Qualys TRU Discovers Two Vulnerabilities in OpenSSH: CVE-2025-26465 & CVE-2025-26466 | Qualys Security Blog
- China’s Salt Typhoon hackers targeting Cisco devices used by telcos, universities | The Record from Recorded Future News
- RedMike Exploits Unpatched Cisco Devices in Global Telecommunications Campaign
- A Hacker Group Within Russia’s Notorious Sandworm Unit Is Breaching Western Networks | WIRED
- How Phished Data Turns into Apple & Google Wallets – Krebs on Security
- New hack uses prompt injection to corrupt Gemini’s long-term memory
- Arizona woman pleads guilty to running laptop farm for N. Korean IT workers, faces 9-year sentence | The Record from Recorded Future News
- US reportedly releases Russian cybercrime figure Alexander Vinnik in prisoner swap | The Record from Recorded Future News
- EXCLUSIVE: A Russia-linked Telegram network is inciting terrorism and is behind hate crimes in the UK – HOPE not hate
- Remembering David Jorm - fundraising for Mental Health research
Risky Biz Soap Box: Run your own open source IDP with Authentik
In this SoapBox edition of the show Patrick Gray chats to Fletcher Heisler, the CEO of open-source identity provider Authentik.
The whole idea of Authentik is you can take control of an essential IT and security function: identity. Because Authentik is open source it’s extremely flexible, and if you’re running it yourself, you get to decide where your IDP should sit in your architecture. You can run it on prem if you’re an emergency call centre or you’re operating an airgapped network, or you can spin it up in your cloud environment if you’re a typical enterprise.
Fletcher talks through the reasons Authentik users are decoupling themselves from the major SaaS Identity Providers, and the flexibility that comes from being able to assemble exactly what you need.
This episode is also available on Youtube.
Show notes
Risky Business #779 -- DOGE staffer linked to The Com
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- Musk’s DOGE kid has a history with The Com
- Paragon fires Italy as a spyware customer
- Thailand cuts power to scam compounds…
- … and arrests Phobos/8Base Russian cybercrims
- The CyberCX DFIR report shows non-U2F MFA is well and truly over
- And much, much more.
This week’s episode is sponsored by Dropzone.AI. They make an AI SOC analysis platform that relieves your analysts of the necessary but tedious work, so they can focus on the value of human insight. Dropzone’s founder and CEO Edward Wu joins to talk about how they approach the problem.
This episode is also available on Youtube.
Show notes
- Teen on Musk’s DOGE Team Graduated from ‘The Com’ – Krebs on Security
- ACLU Warns DOGE’s ‘Unchecked’ Access Could Violate Federal Law | WIRED
- Lawsuit accuses Trump administration of violating federal information security law | The Record from Recorded Future News
- The Recruitment Effort That Helped Build Elon Musk’s DOGE Army | WIRED
- States prepare privacy lawsuit against DOGE over access to federal data | The Record from Recorded Future News
- Union groups sue Treasury over giving DOGE access to sensitive data | The Record from Recorded Future News
- Student group sues Education Department over reported DOGE access to financial aid databases | The Record from Recorded Future News
- Hackers exploiting bug in popular Trimble Cityworks tool used by local gov’ts | The Record from Recorded Future News
- DeepSeek iOS app sends data unencrypted to ByteDance-controlled servers - Ars Technica
- DeepSeek Is a Win for Chinese Hackers - Risky Business
- Owner of spyware used in alleged WhatsApp breach ends contract with Italy | WhatsApp | The Guardian
- Another person targeted by Paragon spyware comes forward | TechCrunch
- Apple fixes security flaw allowing third-party access to locked devices | The Record from Recorded Future News
- U.S. sanctions bulletproof hosting provider for supplying LockBit infrastructure | CyberScoop
- Thailand cuts power supply to Myanmar scam hubs | The Record from Recorded Future News
- 8Base ransomware site taken down as Thai authorities arrest 4 connected to operation | The Record from Recorded Future News
- Two Russian nationals arrested in takedown of Phobos ransomware infrastructure | The Record from Recorded Future News
- The Company Man: Binance exec detained in Nigeria breaks his silence | The Record from Recorded Future News
- Deloitte pays $5M in connection with breach of Rhode Island benefits site | Cybersecurity Dive
- DFIR - Threat Report 2025 | CyberCX
- Request a Demo | Dropzone AI
Risky Business #778 -- Musk's child soldiers seize control of FedGov IT systems
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- DeepSeek leaves an unauthed database on the internet
- Russia hacked UK prime minister’s personal mail
- Australia sanctions a Telegram group… which is more sensible than it sounds
- Medical device backdoor turns out to be just poorly thought out upgrade feature
- Google abuses weak hashing to patch AMD CPU microcode
- And much, much more.
This week’s episode is sponsored by email security boffins Sublime. Their co-founder and CEO Josh Kamdjou joins to talk about how attackers’ abuse of legitimate services like Docusign is a challenge for email security vendors.
This episode is also available on Youtube.
Show notes
- Exclusive: Musk aides lock workers out of OPM computer systems | Reuters
- Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History | Wiz Blog
- Криптостилер SparkCat в магазинах Google Play и App Store | Securelist
- Russian hackers suspected of compromising British PM’s personal email account | The Record from Recorded Future News
- PowerSchool hack: missed basic security step resulted in data breach
- Australia sanctions ‘Terrorgram’ white supremacist online group | The Record from Recorded Future News
- ‘Paid actors’ could be behind some antisemitic attacks, Albanese says | Australian security and counter-terrorism | The Guardian
- Interview with James Glenday, ABC News Breakfast | Australian Minister for Foreign Affairs
- WhatsApp says spyware company Paragon Solutions targeted journalists
- Spyware maker Paragon confirms US government is a customer | TechCrunch
- Former Polish justice minister arrested in sprawling spyware probe | The Record from Recorded Future News
- Sweden releases suspected ship, says cable break ‘clearly’ not sabotage | The Record from Recorded Future News
- Backdoor found in two healthcare patient monitors, linked to IP in China
- Attackers exploit zero-day vulnerability in Zyxel CPE devices | Cybersecurity Dive
- AMD: Microcode Signature Verification Vulnerability · Advisory · google/security-research · GitHub
- 22-year-old math wiz indicted for alleged DeFI hack that stole $65M - Ars Technica
- A method to assess 'forgivable' vs 'unforgivable'... - NCSC.GOV.UK
- Living Off the Land: Credential Phishing via Docusign abuse
- Living Off the Land: Callback Phishing via Docusign comment
- B2B freight-forwarding scams on the rise to evade financial fraud crackdowns
- Callback phishing via invoice abuse and distribution list relays
- Enhanced message groups: Improving efficiency in email incident response
Risky Business #777 -- It's SonicWall's turn
Coming to you from the same room in Risky Business headquarters Patrick Gray and Adam Boileau discuss the week’s cybersecurity news. They talk through:
- Sonicwall firewalls hand out remote code exec like candy
- Mastercard make a slapstick-grade mistake with their DNS
- The data breach at PowerSchool and other niche SaaS providers
- Academic research proposes taking down Europe’s power grid
- Apple CPUs get a new speculative execution side channel
- And much, much more.
This week’s episode is sponsored by Push Security, who make an identity security product that runs inside browsers. Luke Jennings joins to discuss some of the pitfalls of federated authentication, like attackers using unexpected identity providers to log in to your apps.
This episode is also available on Youtube.
Show notes
- SonicWall warns hackers targeting critical vulnerability in SMA 1000 series appliances | Cybersecurity Dive
- MasterCard DNS Error Went Unnoticed for Years – Krebs on Security
- Data breach hitting PowerSchool looks very, very bad - Ars Technica
- OpenAI rival DeepSeek limits registration after ‘large-scale malicious attacks’ | The Record from Recorded Future News
- Hackers imitate Kremlin-linked group to target Russian entities | The Record from Recorded Future News
- UK to examine undersea cable vulnerability as Russian spy ship spotted in British waters | The Record from Recorded Future News
- Questions grow over whether Baltic Sea cable damage was sabotage or accidental | The Record from Recorded Future News
- Researchers say new attack could take down the European power grid - Ars Technica
- At least $69 million stolen from crypto platform Phemex in suspected cyberattack | The Record from Recorded Future News
- BreachForums admin to be resentenced after appeals court slams supervised release | The Record from Recorded Future News
- Apple chips can be hacked to leak secrets from Gmail, iCloud, and more - Ars Technica
- Apple fixes zero-day flaw affecting all devices | TechCrunch
- I’m Lovin’ It: Exploiting McDonald’s APIs to hijack deliveries and order food for a penny
- Government websites vanish under Trump, from the Constitution to DEI
- Trail of Bits: Director, Technical Marketing
- Push Security: Security Researcher (remote in the USA)
- A new class of phishing: Verification phishing and cross-IdP impersonation
Risky Business #776 -- Trump will flex American cyber muscles
Risky Business returns for its 19th year! Patrick Gray and Adam Boileau discuss the week’s cybersecurity news and there is a whole bunch of it. They discuss:
- The incoming Trump administration guts the CSRB
- Biden’s last cyber Executive Order has sensible things in it
- China’s breach of the US Treasury gets our reluctant admiration
- Ross Ulbricht - the Dread Pirate Roberts of Silk Road fame - gets his Trump pardon
- New year, same shameful comedy Forti- and Ivanti- bugs
- US soldier behind the Snowflake hacks faces charges after a solid Krebs-ing
- And much, much (much! after a month off) more.
This week’s episode is sponsored by Sandfly Security, who make a Linux EDR solution. Founder Craig Rowland joins to talk about how the Linux ecosystem struggles with its lack of standardised approaches to detection and response. If you’ve got a telco full of unix, and people are asking how much Salt Typhoon you’ve got in there… Sandfly’s tools are probably what you’re looking for.
If you like your Business like us… - Risky - then we’re hiring! We’re looking for someone to help with audio and video production for our work, manage our socials, and if you’re also into the Cybers… even better. Position is remote, with a preference for timezones amenable to Australia/NZ. Drop us a line: editorial at risky.biz.
This episode is also available on Youtube.
Show notes
- POLITICO Pro | Article | Acting DHS chief ousts CSRB experts, other department advisers
- Treasury’s sanctions office hacked by Chinese government, officials say
- Strengthening America’s Resilience Against the PRC Cyber Threats | CISA
- AT&T, Verizon say they evicted Salt Typhoon from their networks
- Risky Bulletin: Looking at Biden's last cyber executive order - Risky Business
- Internet-connected devices can now have a label that rates their security | Reuters
- US sanctions prominent Chinese cyber company for role in Flax Typhoon attacks
- FCC ‘rip and replace’ provision for Chinese tech tops cyber provisions in defense bill
- CIA nominee tells Senate he, too, wants to go on cyber offense | CyberScoop
- Trump tells Justice Department not to enforce TikTok ban for 75 days
- Judge rules NSO Group is liable for spyware hacks targeting 1,400 WhatsApp user devices | The Record from Recorded Future News
- Unpacking WhatsApp’s Legal Triumph Over NSO Group | Lawfare
- Time to check if you ran any of these 33 malicious Chrome extensions
- Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls - Arctic Wolf
- Ongoing attacks on Ivanti VPNs install a ton of sneaky, well-written malware
- Researchers warn of active exploitation of critical Apache Struts 2 flaw
- DOJ deletes China-linked PlugX malware off more than 4,200 US computers
- Russian internet provider confirms its network was ‘destroyed’ following attack claimed by Ukrainian hackers | The Record from Recorded Future News
- Ukraine restores state registers after suspected Russian cyberattack | The Record from Recorded Future News
- Hackers claim to breach Russian state agency managing property, land records | The Record from Recorded Future News
- U.S. Army Soldier Arrested in AT&T, Verizon Extortions – Krebs on Security
Risky Biz Soap Box: Cool compliance tricks with the Island enterprise browser
In this sponsored Soap Box edition of the show Patrick Gray talks to Island CEO Michael Fey about some of the cool tricks in the Island enterprise browser. You can use it to tick off so many compliance boxes, and not just cybersecurity boxes.
This is largely a conversation about compliance, but it’s actually interesting and fun. These are words we never thought we’d type!
You can find Island at https://island.io/
This episode is also available on Youtube.
Show notes
Risky Business #775 -- Cl0p is back, SEC hack disclosures disappoint
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- The SEC’s cyber incident reporting isn’t very exciting after all
- China Telecom on the way to being thrown out of the US
- The NSA/Cybercom might get two separate hats
- The Cl0p ransomware crew are back and taking responsibility for the Cleo hacks
- (Yet another) File upload bug in Struts makes Java admins weep
- And much, much more.
This episode is sponsored by SpecterOps, who run a pretty top notch offsec/pentest team when they’re not busy making the Bloodhound Enterprise identity attack path enumeration software. SpecterOps’ Robby Winchester joins to talk about how pentest has changed, and how their customers get value from their testing.
This episode is also available Youtube.
Show notes
- SEC cyber incident reporting rule generates 71 filings in 11 months | Cybersecurity Dive
- US senators, green groups call for accountability over hacking of Exxon critics | Reuters
- Biden Administration Takes First Step to Retaliate Against China Over Hack - The New York Times
- Unfinished business for Trump: Ending the Cyber Command and NSA 'dual hat' | The Record from Recorded Future News
- EU opens investigation into TikTok and the Romanian election – POLITICO
- Clop ransomware claims responsibility for Cleo data theft attacks
- CISA warns of ransomware gangs exploiting Cleo, CyberPanel bugs | The Record from Recorded Future News
- CVE-2024-55956 | AttackerKB
- Apache issues patches for critical Struts 2 RCE bug • The Register
- Japanese game and anime publisher reportedly pays $3 million ransom to Russia-linked hackers | The Record from Recorded Future News
- Israeli spyware firm Paragon acquired by US investment group, report says | Reuters
- How Cryptocurrency Turns to Cash in Russian Banks – Krebs on Security
- Arizona man arrested for alleged involvement in violent online terror networks | CyberScoop
- Russia bans Viber, claiming app facilitates terrorism and drug trafficking | The Record from Recorded Future News
Wide World of Cyber: SentinelOne's Chris Krebs on Chinese cyber operations
In this edition of the Wild World of Cyber podcast Patrick Gray sits down with SentinelOne’s Chief Intelligence and Public Policy Officer Chris Krebs to talk all about Chinese cyber operations.
They look at the Salt Typhoon and Volt Typhoon campaigns, the last 20 years of Chinese operations, and the evolution of the cyber roles of China’s Ministry of State Security and People’s Liberation Army.
It’s a very dense hour of conversation!
This podcast was recorded in front of an audience at the Museum of Contemporary Art in Sydney.
This episode is also available on Youtube.
Show notes
Risky Business #774 -- Cleo file transfer appliances under widespread attack
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- Cleo file transfer products have a remote code exec, here we go again!
- Snowflake phases out password-based auth
- Chinese Sophos-exploit-dev company gets sanctioned
- Romania’s election gets rolled back after Tiktok changed the outcome
- AMD’s encrypted VM tech bamboozled by RAM with one extra address bit
- Some cool OpenWRT research
- And much, much more.
This week’s episode is sponsored by Thinkst, who love sneaky canary token traps. Jacob Torrey previews an upcoming Blackhat talk filled with interesting operating system tricks you can use to trigger canaries in your environment. You wont believe the third trick! Attackers hate him!
This episode is also available on Youtube.
Show notes
- Cleo Software Actively Being Exploited in the Wild CVE-2024-50623 | Huntress
- Blue Yonder investigating data leak claim following ransomware attack | Cybersecurity Dive
- Snowflake to phase out single-factor authentication by late 2025 | Cybersecurity Dive
- Treasury Sanctions Cybersecurity Company Involved in Compromise of Firewall Products and Attempted Ransomware Attacks | U.S. Department of the Treasury
- Another teenage hacker charged as feds continue Scattered Spider crackdown | The Record from Recorded Future News
- Germany arrests suspected admin of country’s largest criminal marketplace | The Record from Recorded Future News
- FCC, for first time, proposes cybersecurity rules tied to wiretapping law | CyberScoop
- Russian state hackers abuse Cloudflare services to spy on Ukrainian targets | The Record from Recorded Future News
- Cloudflare’s pages.dev and workers.dev Domains Increasingly Abused for
- Romania annuls presidential election over alleged Russian interference | The Record from Recorded Future News
- EU demands TikTok 'freeze and preserve data' over alleged Russian interference in Romanian elections | The Record from Recorded Future News
- Research Note: Meta’s Role in Romania’s 2024 Presidential Election - CheckFirst
- Key electricity distributor in Romania warns of ‘cyber attack in progress’ | The Record from Recorded Future News
- Backdoor slipped into popular code library, drains ~$155k from digital wallets - Ars Technica
- AMD’s trusted execution environment blown wide open by new BadRAM attack - Ars Technica
- New dog, old tricks: DaMAgeCard attack targets memory directly thru SD card reader – PT SWARM
- Telegram partners with child safety group to scan content for sexual abuse material
- Apple hit with $1.2B lawsuit after killing controversial CSAM-detecting tool - Ars Technica
- Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection - Flatt Security Research
- How do I turn on the Do Not Track feature? | Firefox Help
Risky Biz Soapbox: Enterprise Yubikeys can now be pre-registered
In this interview Patrick Gray talks to Yubico’s COO and President Jerrod Chong about a new Yubikey feature: pre-registration.
You can now ship pre-registered Yubikeys to your staff so you don’t need to rely on your staff to enrol them. They’ve achieved this with really slick Okta and Entra ID integrations.
Jerrod also talks about a recent trip to Singapore and concerns he has about the cybersecurity of critical infrastructure in the energy sector.
Risky Business #773 -- Cybercriminals are dropping like flies in Russia
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- The FTC decides its time to take another look at Microsoft
- Exxon’s opponents targeted by hackers
- Russian hackers keep getting sentenced and it confuses us
- The Feds recommend Signal, because throwing hackers out of telcos ain’t gonna happen
- A South Korean set-top-box manufacturer shipped a DDoS client for corpo-combat
- And much, much more.
This week’s sponsor interview with Vijit Nair from Corelight. We talk to him about doing detection in cloud environments, and how the varied nature of cloud systems makes the old ways - network monitoring - useful in new and interesting ways.
If you’re in Sydney, Pat is recording a live episode of the Wide World of Cyber with Chris Krebs on 5 December. There might still be tickets left!
This episode is also available on Youtube.
Show notes
- SentinelOne: Risky Business LIVE
- FTC opens Microsoft antitrust investigation | AP News
- Exclusive: Exxon lobbyist investigated over hack-and-leak of environmentalist emails, sources say | Reuters
- Costa Rica state energy company calls in US experts to help with ransomware attack | The Record from Recorded Future News
- Blue Yonder Security Rating, Vendor Risk Report, and Data Breaches
- ENGlobal IT systems impacted by ransomware attack | Cybersecurity Dive
- Ransomware suspect Wazawaka reportedly arrested by Russia | The Record from Recorded Future News
- Russia delivers historic life sentence to suspected founder of darknet marketplace | The Record from Recorded Future News
- Vodka maker Stoli says August ransomware attack contributed to bankruptcy filing | The Record from Recorded Future News
- Hacker in Snowflake Extortions May Be a U.S. Soldier – Krebs on Security
- Uganda confirms cyberattack on central bank but minimizes extent of breach | The Record from Recorded Future News
- Press Release: HOME > Announcements/News > Announcements > Press Release
- U.S. officials urge Americans to use encrypted apps amid cyberattack
- With Threats to Encryption Looming, Signal’s Meredith Whittaker Says ‘We’re Not Changing’ | WIRED
- Japanese crypto service shuts down after theft of bitcoin worth $308 million | The Record from Recorded Future News
- He Got Banned From X. Now He Wants to Help You Escape, Too | WIRED
- cyberundergroundfeed on X: "🚨 Pro-Russian Group Allegedly Hacks #Australia #Melbourne Sewage System 🚨 Hackers claim to have compromised the Riversdale sewage pumping station in #Melbourne, #Australia, switching it to manual control and placing it in emergency mode."
- Pump station fears rebuffed - New Zealand News - NZ Herald
- NZ Navy ship runs aground off Samoa, catches fire and sinks
Risky Business #772 -- Salt Typhoon is truly a national security disaster
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- A ransomware attack has crippled US supply chain software provider Blue Yonder
- Russian spies hack nearby wifi to get to their targets, but that doesn’t seem surprising?
- Salt Typhoon’s attacks on telcos are hard to solve and big on impact
- China’s surveillance state workers sell their access at home
- Palo Alto is bad and should feel bad
- And much, much more.
In this week’s sponsor interview Patrick Gray chats with Matt Muller from Tines about Gartner’s “spicy take” that the SOAR category is dead. SOAR is dead! Long live SOAR!
This episode is also available on Youtube.
Show notes
- Retailers struggle after ransomware attack on supply chain tech provider Blue Yonder | The Record from Recorded Future News
- Customer Update
- Russian Spies Jumped From One Network to Another Via Wi-Fi in an Unprecedented Hack | WIRED
- China’s Salt Typhoon hackers target telecom firms in Southeast Asia with new malware | The Record from Recorded Future News
- Emerging Details of Chinese Hack Leave U.S. Officials Increasingly Concerned
- Top senator calls Salt Typhoon “worst telecom hack in our nation’s history” - The Washington Post
- Privacy-focused mobile phone launches for high-risk individuals | CyberScoop
- China’s Surveillance State Is Selling Citizen Data as a Side Hustle | WIRED
- Former Verizon employee gets four-year sentence for sharing cyber secrets with Chinese government | The Record from Recorded Future News
- Surveillance Legislation (Confirmation of Application) Bill 2024 – Parliament of Australia
- ParlInfo - BILLS : Surveillance Legislation (Confirmation of Application) Bill 2024 : Second Reading
- ParlInfo - Surveillance Legislation (Confirmation of Application) Bill 2024
- ParlInfo - Surveillance Legislation (Confirmation of Application) Bill 2024
- Chris Bing: "Regarding the reported hack of the Gaetz-ethics committee report, the file storage platform (FileShare) that held the document said they weren't hacked. But rather: "this file was shared anonymously which allowed anyone to download. This was not a breach"" — Bluesky
- Tether Has Become a Massive Money Laundering Tool for Mexican Drug Traffickers, Feds Say
- Palo Alto Networks boasts as customers coalesce on its platforms | Cybersecurity Dive
- Palo Alto Networks pushes back as Shadowserver spots 2K of its firewalls exploited | Cybersecurity Dive
- RSF investigation: the Indian cyber-security giant silencing media outlets worldwide | RSF
- Patrick Gray (@patrick.risky.biz) — Bluesky
- metlstorm (@metlstorm.risky.biz) — Bluesky
- Catalin Cimpanu (@campuscodi.risky.biz) — Bluesky
- Tom Uren (@tom.risky.biz) — Bluesky
Risky Business #771 -- Palo Alto's firewall 0days are very, very stupid
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- Microsoft introduces some sensible sounding post-Crowdstrike changes
- Palo Alto patches hella-stupid bugs in its firewall management webapp
- CISA head Jen Easterly to depart as Trump arrives
- AI grandma tarpits phone scammers in family-tech-support hell
- Academic research supports your gut-reaction; phishing training doesn’t work
- And much, much more.
This week’s episode is sponsored by Greynoise. The always excitable Andrew Morris joins to remind us that the edge-device vulnerabilities Pat and Adam complain about on the show are in fact actually even worse than we make them out to be. Andrew also tells us about a zero-day Greynoise’ AI system truffle-pigged out of their data set.
This episode is also available on Youtube.
Show notes
- Windows security and resiliency: Protecting your business | Windows Experience Blog
- Microsoft revamps how it will disclose vulnerabilities | Cybersecurity Dive
- NIST says exploited vulnerability backlog cleared but end-of-year goal for full list unlikely
- Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474
- Palo Alto Networks customers grapple with another actively exploited zero-day | Cybersecurity Dive
- Unpatched zero-days in Fortinet and Palo Alto Networks software
- Palo Alto Networks’ customer migration tool hit by trio of CVE exploits | Cybersecurity Dive
- Readout of President Joe Biden’s Meeting with President Xi Jinping of the People’s Republic of China | The White House
- Easterly to step down from CISA director role on Inauguration Day | Cybersecurity Dive
- Top White House cyber official urges Trump to focus on ransomware, China
- Ransomware gang Akira leaks unprecedented number of victims’ data in one day
- Hacker Is Said to Have Gained Access to File With Damaging Testimony About Gaetz
- 1,400 Pegasus spyware infections detailed in WhatsApp’s lawsuit filings
- NSO Group admits cutting off 10 customers because they abused its Pegasus spyware, say unsealed court documents | TechCrunch
- Ransomware gang Akira leaks unprecedented number of victims’ data in one day
- Ohio man behind Helix cryptocurrency mixer gets 3-year sentence
- O2 unveils Daisy, the AI granny wasting scammers’ time - Virgin Media O2
- Understanding the Efficacy of Phishing Training in Practice
- Bunnings facial recognition cameras breach Privacy Act, retailer to challenge ruling | news.com.au — Australia’s leading news site
- Nudity, punches in newly released Bunnings CCTV as company found to breach Privacy Act | news.com.au — Australia’s leading news site
- Bitfinex Hack Launderer Heather 'Razzlekhan' Morgan Sentenced to 18 Months in Prison
Risky Business #770 -- A Russian IR guy discovers extremely cool spookware
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- Apple frustrates law enforcement with iOS auto-reboot
- CISA says most KEV vulnerabilities in 2023 were first used as zero days
- Russians roll incident response on some sweet Linux spookware
- Regular users can create mailboxes in M365?
- Tor tracks down the source of its joe-job abuse complaints
- And much, much more.
This week’s feature guest is former FBI agent Chris Tarbell, who arrested Silk Road operator Ross Ulbricht way back in 2013. As suggestions swirl that an incoming Trump administration might release Ulbricht, Chris talks about the reality of the Dread Pirate Roberts.
This episode is sponsored by software supply chain security firm Socket.dev. Founder Feross Aboukhadijeh thinks that we need a CVE-like catalogue for supply-chain attacks, and he makes a solid argument.
The show is also available on Youtube.
Show notes
- Jason Koebler: "New: We’ve confirmed Apple quietly introduced a feature in the new iOS that is preventing cops from hacking iPhones that they have confiscated as evidence. Apple really did say ACAB www.404media.co/apple-quietl..." — Bluesky
- Apple Quietly Introduced iPhone Reboot Code Which is Locking Out Cops
- Exclusive | U.S. Agency Warns Employees About Phone Use Amid Ongoing China Hack - WSJ
- Surge in exploits of zero-day vulnerabilities is ‘new normal’ warns Five Eyes alliance
- The Elusive GoblinRAT: How a Linux Backdoor Infiltrated Government Infrastructures
- Microsoft Bookings – Facilitating Impersonation | Cyberis Limited
- TrustedSec | EKUwu: Not just another AD CS ESC
- Russia’s internet watchdog blocks thousands of websites that use Cloudflare's privacy service
- Defending the Tor network: Mitigating IP spoofing against Tor | The Tor Project
- Law enforcement operation takes down 22,000 malicious IP addresses worldwide - Ars Technica
- Press Conference - Parliament House, Canberra | Prime Minister of Australia
- DHS nominee Kristi Noem stood alone for rejecting department cyber grants to state, local governments | CyberScoop
- Patrick Gray: "Allies will feel comfortable until these guys get fired in their first 100 days for opposing Trump’s proposed annexation of Iceland or something. People have forgotten… Trump is out of his gourd" — Bluesky
Risky Biz Soap Box: Why black box email security is dead
In this edition of the Risky Business Soap Box we’re talking all about email security with Sublime Security co-founder Josh Kamdjou.
Email security is one of the oldest product categories in security, but as you’ll hear, Josh thinks the incumbents are just doing it wrong. He joins Risky Business host Patrick Gray for this interview about Sublime’s origin story and its new approach to email security.
Risky Business #769 -- Sophos drops implants on Chinese exploit devs
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- Sophos drops implants on Chinese firewall exploit devs
- Microsoft workshops better just-in-time Windows admin privileges
- Snowflake hacker arrested in Canada
- Okta has a fun, but not very impactful auth-bypass bug
- Russians bring dumb-but-smart RDP client attacks
- And much, much more.
Special guest Sophos CISO Ross McKerchar joined us to talk about its “hacking back” campaign. The full interview is available on Youtube for those who want to really live vicariously through Sophos doing what every vendor probably wants to do.
This week’s episode is sponsored by attack surface mapping vendor runZero. Founder and CEO HD Moore joins to talk about marrying up the outside and inside views of your network.
You can also watch this episode on Youtube
Show notes
- Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory
- Does bcrypt have a maximum password length? - Information Security Stack Exchange
- Local Administrator Protection | Privilege Protection
- Inside Sophos' 5-Year War With the Chinese Hackers Hijacking Its Devices | WIRED
- A Deeper Look at FortiJump (FortiManager CVE-2024-47575) | Bishop Fox
- Man Arrested for Snowflake Hacking Spree Faces US Extradition | WIRED
- Google uses large language model to discover real-world vulnerability
- GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI
- Thousands of hacked TP-Link routers used in yearslong account takeover attacks - Ars Technica
- CISA warns of foreign threat group launching spearphishing campaign using malicious RDP files | Cybersecurity Dive
- Chinese state-backed hackers breached 20 Canadian government networks over four years, agency warns
- India-Canada row: Canadian officials confess to leaking 'intel' against India to Washington Post - India Today
- Amid diplomatic row, Canada names India in ‘cyberthreat adversary’ list, accuses it of ‘likely spying’ | World News - The Indian Express
- The Untold Story of Trump's Failed Attempt to Overthrow Venezuela's President | WIRED
- Risky Biz News: The mystery at Mango Park
- North Korean hackers seen collaborating with Play ransomware group, researchers say
Risky Business #768 -- CSRB will investigate China's Wiretap Hacks
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- CSRB to investigate China’s telco-wiretapping hacks
- Euro law enforcement takes down the Redline infostealer
- Someone steals Fed crypto… and then tries to quietly sneak it back in
- Russia sentences REvil guys to … jail? Really?
- Apple private cloud compute gets a proper bug bounty program
- And much, much more.
This week’s episode is sponsored by Material Security, who help navigate the mess of cloud productivity data security. Daniel Ayala - Chief Security and Trust Officer at Dotmatics - is a Material customer, and joins Pat and Material Security’s Rajan Kapoor to talk about how to wrangle securing data that ends up in corporate cloud email and file stores.
This episode is also available on Youtube.
Show notes
- Apple 10 day certificates
- Chinese hackers said to have collected audio of American calls
- U.S. Panel to Probe Cyber Failures in Massive Chinese Hack of Telecoms
- How a series of opsec failures led US authorities to the alleged developer of the Redline password-stealing malware
- Operation Magnus
- Hacker Returns $19.3 Million to Drained US Government Crypto Wallet
- Meet ZachXBT, the Masked Vigilante Tracking Down Billions in Crypto Scams and Thefts | WIRED
- Radar systems in Iran breached prior to Israel's Saturday counter-strike - report
- Delta sues CrowdStrike after widespread IT outage that caused thousands of cancellations
- Tens of thousands of taxpayer accounts hacked as CRA repeatedly paid out millions in bogus refunds
- Microsoft CEO asked board to cut pay in connection with security overhaul | Cybersecurity Dive
- Four REvil members sentenced to more than four years in prison
- Russia says it might build its own Linux community after removal of several kernel maintainers
- Nigerian court drops charges against detained Binance executive Tigran Gambaryan
- Apple will pay security researchers up to $1 million to hack its private AI cloud | TechCrunch
- SonicWall firewalls the common access point in spreading ransomware campaign | Cybersecurity Dive
- Fortinet zero-day attack spree hits at least 50 customers | Cybersecurity Dive
- Cisco warns actively exploited CVE can lead to DoS attacks against VPN services | Cybersecurity Dive
- Chinese influence operation targets US down-ballot races, Microsoft says | Reuters
- Exclusive: Accused Iranian hackers successfully peddle stolen Trump emails | Reuters
- Viral video of ripped-up Pennsylvania ballots is fake and Russian-made, intelligence agencies say
- Product Demo: Securing M365 and Google Workspace with Material Security
Risky Biz Soap Box: Thinkst Canary's decade of deception
In this Soap Box edition of the podcast Patrick Gray chats with Thinkst Canary founder Haroon Meer about his “decade of deception”, including:
- A history of Thinkst Canary including a recap of what they actually do
- A look at why they’re still really the only major player in the deception game
- A look at what companies like Microsoft are doing with deception
- Why security startups should have conference booths
Risky Business #767 – SEC fines Check Point, Mimecast, Avaya and Unisys over hacks
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
- SEC fines tech firms for downplaying the Solarwinds hacks
- Anonymous Sudan still looks and quacks like a Russian duck
- Apple proposes max 10 day TLS certificate life
- Oopsie! Microsoft loses a bunch of cloud logs
- Veeam and Fortinet are bad and should feel bad
- North Koreans are good (at hacking)
- And much, much more.
This week’s episode is sponsored by Proofpoint. Chief Strategy Officer Ryan Kalember joins to talk about their work keeping up with prolific threat actor SocGholish.
This episode is also available on Youtube.
Show notes
- Four cyber companies fined for SolarWinds disclosure failures
- U.S. charges Sudanese men with running powerful cyberattack-for-hire gang
- Hacker Charged With Seeking to Kill Using Cyberattacks on Hospitals | WIRED
- Risky Biz News: Anonymous Sudan's Russia Links Are (Still) Obvious
- Microsoft confirms partial loss of security log data on multiple platforms | Cybersecurity Dive
- Risky Biz News: Apple wants to reduce the lifespan of TLS certificates to 10 days
- Encrypted Chat App ‘Session’ Leaves Australia After Visit From Police
- Crypto platform Radiant Capital says $50 million in digital coins stolen following account compromises
- North Korean hackers use newly discovered Linux malware to raid ATMs - Ars Technica
- Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach – Krebs on Security
- Here’s how SIM swap in alleged bitcoin pump-and-dump scheme worked - Ars Technica
- Critical Veeam CVE actively exploited in ransomware attacks | Cybersecurity Dive
- FortiGate admins report active exploitation 0-day. Vendor isn’t talking. - Ars Technica
- Hackers reportedly impersonate cyber firm ESET to target organizations in Israel
- The latest in North Korea’s fake IT worker scheme: Extorting the employers
Risky Business #766 – China hacks America's lawful intercept systems
On this week’s show Patrick Gray and Adam Boileau discuss the week’s infosec news, including:
- Chinese spooks all up in western telco lawful intercept
- Jerks ruin the Internet Archive’s day
- Microsoft drops a great report with a bad chart
- The feds make their own crypto currency and get it pumped
- Forti-, Palo- and Ivanti-fail
- And much, much more.
This week’s episode is sponsored by detection-as-code vendor Panther. Casey Hill, Panther’s Director Product Management joins to discuss why the old “just bung it all in a data lake and… ???… “ approach hasn’t worked out, and what smart teams do to handle their logs.
This episode is also available on [Youtube].(https://youtu.be/86zy6DcwtbE)
Show notes
- White House forms emergency team to deal with China espionage hack - The Washington Post
- DDoS attacks on Internet Archive continue after data breach impacting 31 million
- Microsoft Digital Defense Report 2024
- Ransomware encryption down amid surge of attacks, Microsoft says | CyberScoop
- Russian court websites down after breach claimed by pro-Ukraine hackers
- Ukrainian anti-corruption agency reportedly finds no violations in disclosures of top cyber official
- Trump campaign turns to secure hardware after hacking incident | Reuters
- FBI creates its own crypto token to nab suspects in alleged fraud scheme
- District of Massachusetts | Eighteen Individuals and Entities Charged in International Operation Targeting Widespread Fraud and Manipulation in the Cryptocurrency Markets | United States Department of Justice
- Critical CVE in 4 Fortinet products actively exploited | Cybersecurity Dive
- Fortinet FortiGate CVE-2024-23113 - A Super Complex Vulnerability In A Super Secure Appliance In 2024
- Palo Alto Expedition: From N-Day to Full Compromise
- Ivanti up against another attack spree as hackers target its endpoint manager | Cybersecurity Dive
- 1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies · GitHub
- Recently-patched Firefox bug exploited against Tor browser users
- Two never-before-seen tools, from same group, infect air-gapped devices - Ars Technica
- A Single Cloud Compromise Can Feed an Army of AI Sex Bots – Krebs on Security
- Opinion | The Cyber Sleuth - Washington Post
Snake Oilers: Sandfly Security, Permiso and Wiz
In this edition of Snake Oilers we hear pitches from three security vendors:
- Sandfly Security: An agentless Linux security platform that actually sounds very cool
- Permiso: An identity security platform founded by ex FireEye folks
- Wiz: The cloud security giant is getting in on code security scanning
You can watch this edition of Snake Oilers on YouTube here.
Risky Business #765 -- The Kaspersky switcheroo
Patrick Gray and Adam Boileau discuss the week’s infosec news with everyone’s favourite ex-NSA big-brain, Rob Joyce. They talk through:
- Musk and Durov bow to government pressure
- Tiktok rushes to ban authoritarian propagandists
- The US doesn’t want Chinese software in its cars
- Kaspersky replaces itself with an AV no one has ever heard of
- Aussie police chalk up another crimephone takedown
- Press Win-R Ctrl-V to prove you’re human
- And much, much more.
This week’s show is brought to you by Stairwell, and Stairwell’s founder Mike Wiacek will be along to talk about how people are using their platform to hunt down detection resistant malware.
A video version of this episode is also available on Youtube.
Show notes
- Elon Musk backs down in his fight with Brazilian judges to restore X | Elon Musk | The Guardian
- Telegram says it will share phone numbers and IP addresses of ‘bad actors’ to authorities
- Jane Lytvynenko on X: "Ukrainian cybersecurity officials are limiting the use of Telegram for military, critical infrastructure, and other authorities. Budanov said he has “substantiated data” on Ru authorities having access to personal messages on TG, including removed ones. https://t.co/xOcnf7am9R" / X
- TikTok blocks dozens of Kremlin-backed media accounts
- Biden administration proposes rule banning Chinese, Russian connected vehicles and parts
- Some Kaspersky customers receive surprise forced-update to new antivirus software | TechCrunch
- Russian cyber firm Dr.Web says services are restored after ‘targeted cyberattack’
- Police announce takedown and arrest mastermind behind criminal comms platform 'Ghost'
- Turning Everyday Gadgets into Bombs is a Bad Idea « bunnie's blog
- Iranian-linked election interference operation shows signs of recent access | CyberScoop
- Republicans demand FBI hearing on Iran theft of Trump documents
- Ermittlungen im Darknet: Strafverfolger hebeln Tor-Anonymisierung aus | tagesschau.de
- DOJ charges hackers for stealing $230 million in crypto from individual
- This Windows PowerShell Phish Has Scary Potential – Krebs on Security
- You can now use Apple’s best iPhone Mirroring feature on your Mac and iPhone | TechRadar
Risky Business #764 -- Mossad expands into telecommunications services
On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:
- Hezbollah’s attempts to avoid SIGINT with pagers ends in explosions
- The US shines many bright lights on RT’s disinfo role
- Australia counters Chinese bullying in the Pacific
- Valid accounts are the most prevalent entry point, says CISA’s data
- Ivanti and Fortinet vie for worst vendor of the week
- Krebs writes up the shift towards charging The Com with terrorism
- And much, much more…
This week’s episode is sponsored by Push Security, who bring security visibility to where it needs to be these days – the browser. Luke Jennings joins this week’s show to discuss how phish-kit crews are driving the arms race forward, and how detection has to adapt and go where the users are.
This episode is also available on Youtube.
Show notes
- Israel planted explosives in Hezbollah's Taiwan-made pagers, sources say | Reuters
- How Hezbollah used pagers and couriers to counter Israel's high tech surveillance | Reuters
- Biden administration unveils new evidence of RT’s key role in Russian intelligence operations globally | CNN Politics
- Meta bans RT days after U.S. accused Russian outlet of disinformation
- U.S. to file charges in Trump campaign hacking case, officials say
- China suspected of hacking diplomatic body for Pacific islands region
- Chinese-made port cranes in US included 'backdoor' modems, House report says
- Stolen account info still chief risk for federal agencies, annual CISA audit finds
- Notice of Recent Security Incident | Fortinet Blog
- WordPress.org to require two-factor authentication for plugin developers | CyberScoop
- Multiple attacks force CISA to order agencies to upgrade or remove end-of-life Ivanti appliance
- Ivanti Endpoint Manager and Ivanti Endpoint Manager Security Suite and Ivanti Cloud Service Application (CSA) - End Of Life (EOL)
- The Dark Nexus Between Harm Groups and ‘The Com’ – Krebs on Security
- Feds sentence 12 crypto thieves behind SIM swaps, home invasions
- Ex-CrowdStrike employees detail rising technical errors before July outage | Semafor
- Post-CrowdStrike Fallout: Microsoft Redesigning EDR Vendor Access to Windows Kernel - SecurityWeek
- Apple seeks dismissal of its NSO Group lawsuit, citing risk of exposing ‘vital security information’
- US hits Intellexa spyware maker with more sanctions
- (1) BolivarCucuta on X: "Encuentran muerto al ciudadano israelí Yariv Bokor en Medellín En un apartamento de El Poblado, Medellín, fue encontrado sin vida el ciudadano israelí Yariv Bokor, con aparentes signos de violencia. Bokor estaba vinculado a la empresa Sandvine, la cual tiene relación con NSO https://t.co/EeY1os1omW" / X
- Instagram to bolster privacy and safety features for millions of teen users
- Mastercard buys Recorded Future for $2.65 billion | CyberScoop
Risky Business #763 – Microsoft un-patches critical bug
On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:
- Russia’s disinformation peddlers face multifaceted sternness from the DoJ
- Telegram is now law enforcement’s bestest new pal, all of a sudden
- Iran’s banking industry arranges a payment plan for a ransom
- Columbia investigates how it sent private jets full of cash to pay for Pegasus
- Microsoft innovates with Un-Patch Tuesday
- And much, much more.
This week’s sponsor is Kroll Cyber, and one of their incident responders Paul Wells joins to discuss that one weird trick that actually helps - preparing for an incident before hand, rather than learning all those hard lessons in the middle of a crisis.
This week’s episode is also available on Youtube.
Show notes
- Risky Biz News: Doppelganger gets a kick in the butt from Uncle Sam
- Russia focusing on American social media stars to covertly influence voters | Reuters
- Russian pro-democracy nonprofit investigates alleged data breach by Kremlin-backed hackers
- Biden administration hits Russia with sanctions over efforts to manipulate U.S. opinion ahead of the election
- US hits Chinese companies with new sanctions over Russia-Ukraine war
- Elon Musk’s Starlink backtracks to comply with Brazil’s ban on X | Elon Musk | The Guardian
- Why It's So Hard to Fully Block X in Brazil | WIRED
- Durov says Telegram will tackle criticism of how it moderates content | Reuters
- Navalny allies accuse Telegram and other platforms of censorship | Economy News | Al Jazeera
- How India tamed Twitter and set a global standard for online censorship - The Washington Post
- 2 white supremacists tried to spark race war by soliciting murder and hate crimes on Telegram, feds say
- Matthew Garrett: "Why clone a yubikey when you c…" - Nondeterministic Computer
- Iran pays millions in ransom to end massive cyberattack on banks, officials say – POLITICO
- Four Delaware men charged in international sextortion scheme that netted nearly $2 million | CyberScoop
- Colombian president suggests prior administration illegally sent $11 million in cash to Israel for spyware
- Poland’s constitutional court finds commission investigating use of Pegasus spyware unconstitutional | Notes From Poland
- CISA says SonicWall bug being exploited as experts warn of ransomware gang use
- SonicWall SSLVPN access control flaw is now exploited in attacks
- Bug Left Some Windows PCs Dangerously Unpatched – Krebs on Security
Snake Oilers: Authentik, Dropzone and SlashID
In this edition of Snake Oilers Patrick Gray gets pitches from three cybersecurity companies:
- Authentik, an open source identity provider that a lot of large organisations are deploying on prem as an alternative to cloud-based IDPs
- Dropzone AI, an LLM-based agent that can do the work of a Tier 1 SOC analyst
- SlashID, an identity security company that can crunch your logs to find attackers
You can watch this edition of Snake Oilers on YouTube here.
Show notes
Risky Business #762 -- Brazil nukes X, Iranian APTs deploy ransomware
On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:
- Brazil’s supreme court bans X-formerly-Twitter,
- Iranian cyber teams cooperate with ransomware crews
- While North Koreans wield chrome-windows 0-day
- Yubikey cloning attack is impressive, but doesn’t have us binning our keys quite yet
- The White House is coming for your unsigned BGP announcements
- And much, much more.
This week’s episode is sponsored by Okta, and specifically their Identity Security Posture Management product. Okta recently acquired Spera Security, and co-founder Ariel Kadyshevitch joins to talk through the messy reality of modern identity. Pat even gets the giggles at how terrible everything is!
You can also watch this episode on Youtube.
Show notes
- Brazil X ban: Top court judges uphold block of Musk's platform
- Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations | CISA
- Malicious North Korean packages appear again in open source code repository
- North Korean threat actor Citrine Sleet exploiting Chromium zero-day | Microsoft Security Blog
- SEC.gov | SEC Charges Transfer Agent Equiniti Trust Co. with Failing to Protect Client Funds Against Cyber Intrusions
- Chinese ‘Spamouflage’ operatives are mimicking disillusioned Americans online
- Researchers uncover ‘SlowTempest’ espionage campaign within China
- City of Columbus sues man after he discloses severity of ransomware attack | Ars Technica
- Bypassing airport security via SQL injection
- Cyberattack hits agency responsible for London’s transport network
- German air traffic control agency confirms cyberattack, says operations unaffected
- White House calls attention to ‘hard problem’ of securing internet traffic routing
- Cambodian scam giant handled $49 billion in crypto transactions since 2021, researchers say
- YubiKeys are vulnerable to cloning attacks thanks to newly discovered side channel | Ars Technica
- CrowdStrike takes a revenue hit as global IT outage reckoning lingers | Cybersecurity Dive
- Owners of 1-Time Passcode Theft Service Plead Guilty – Krebs on Security
Risky Business #761 – Telegram v frogs. Fight!
On this week’s show, Patrick Gray and Adam Boileau discusses the week’s security news, including:
- Telegram founder’s arrest in France
- Volt Typhoon 0days some SD-WAN gear
- Russia frets about Ukraine all up in Kursk’s webcams
- Cybercriminals social engineer payment card NFC relay attacks in the wild
- The slow burn of Active Directory name collisions
- And much, much more.
This week’s episode is sponsored by Nucleus Security. Aaron Unterberger joins to discuss how vulnerability management starts out easy, but gets serious very quickly.
You can also watch this week’s show on Youtube.
Show notes
- Pavel Durov: Telegram CEO's arrest part of larger investigation
- Keep Pavel Durov LOCKED UP
- Internet mogul Kim Dotcom to be extradited to the US, NZ justice minister says
- New 0-Day Attacks Linked to China’s ‘Volt Typhoon’ – Krebs on Security
- Oil industry giant Halliburton confirms 'issue' following reported cyberattack
- Seattle airport confronts 4th day of cyberattack outages | Cybersecurity Dive
- Russia calls for restrictions on surveillance cameras, dating apps in cities under attack from Ukraine
- In a Kyiv hangar, Ukraine launches a cyber range for everyone
- U.S. military, on Tinder, says to swipe left on Iran-backed militants - The Washington Post
- CISA officials credit Microsoft security log expansion for improved threat visibility | Cybersecurity Dive
- Suspect in $14 billion cryptocurrency pyramid scheme extradited to China
- Android malware used to steal ATM info from customers at three European banks
- Novel technique allows malicious apps to escape iOS and Android guardrails | Ars Technica
- Local Networks Go Global When Domain Names Collide – Krebs on Security
- Attack tool update impairs Windows computers
- SonicWall pushes patch for critical vulnerability in SonicOS platform | CyberScoop
- “YOLO” is not a valid hash construction
Feature interview: ASIO Director General Mike Burgess on encryption and access
Mike Burgess is the director general of ASIO. But the thing about Mike is he’s actually a cybersecurity guy. He joined ASD, Australia’s NSA, back in 1995 when it was still the Defence Signals Directorate. He was there for 18 years before he bounced out to the private sector for a while to work as the CISO for Australia’s largest telco, Telstra. In 2017 he returned to ASD to run it, and in 2019 he was appointed director general of ASIO.
Back in April, Burgess made a series of comments on the topic of encrypted messaging during a Press Club speech in Canberra. Our right to privacy, he said, is not absolute, and he implied that if certain providers didn’t start helping Australian authorities out a little more, he’d use some of the provisions in Australia’s Assistance and Access bill to force them to provide access to certain content.
So I reached out to organise this interview to get some more detail from him about exactly what sort of cooperation he’s seeking and why.
Risky Business #760 – Microsoft to make MFA mandatory
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news including:
- Microsoft did a good thing! Soon all Azure admins will require MFA
- The three billion row National Public Data breach mess, courtesy Florida Man
- US govt confirms that it was Iran that hacked the Trump campaign
- Is TP-Link the next Huawei, or just not very good at computers?
- Major Chinese RFID card maker has hardcoded backdoors
- And much, much more.
This week’s episode is sponsored by Specter Ops, makers of Bloodhound Enterprise. VP of Products Justin Kohler joins to talk about how they’ve joined their on-prem AD and cloud Entra attack path graphs, so you can map out that juicy, real-world attack surface.
Show notes
- Announcing mandatory multi-factor authentication for Azure sign-in | Microsoft Azure Blog
- phishing resistant mfa - Google Search
- Microsoft will require MFA for all Azure users
- NationalPublicData.com Hack Exposes a Nation’s Data – Krebs on Security
- National Public Data Published Its Own Passwords – Krebs on Security
- Bloomberg Law
- How the government's proposed 'Trust Exchange' digital ID scheme would work - ABC News
- German Cyber Agency Wants Changes in Microsoft, CrowdStrike Products After Tech Outage - WSJ
- Joint ODNI, FBI, and CISA Statement on Iranian Election Influence Efforts — FBI
- Crypto firm says hacker locked all employees out of Google products for four days
- ZachXBT on X: "Seven hours ago a suspicious transfer was made from a potential victim for 4064 BTC ($238M)" / X
- Bitcoin News Today: $238 Million Bitcoin Heist Linked to Genesis Global Trading
- Routers from China-based TP-Link a national security threat, US lawmakers claim
- Hardware backdoors found in Chinese smart cards
- Unmasking Styx Stealer: How a Hacker's Slip Led to an Intelligence Treasure Trove - Check Point Research
- Hardware backdoors found in Chinese smart cards
- Man who hacked Hawaii state registry to forge his own death certificate sentenced to 81 months
Wide World of Cyber: 2024 election interference, the media and Iran's hack and leak
In this conversation Risky Business host Patrick Gray speaks with SentinelOne’s Chris Krebs and Alex Stamos about what sort of cyber enabled interference we can expect in the 2024 US presidential race.
Alex was the CISO at Facebook during the 2016 election, and Chris Krebs was responsible for US election security as the director of CISA in 2020.
Watch the video version of this episode on Youtube.
Risky Business #759 – Why Iran's hack and leak will amount to naught
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news and recap the best research presented at Black Hat and DEF CON in Las Vegas last week. They cover:
- Iran tries an election hack’n’leak like its still 2016
- Crowdstrike takes home the Pwnie for Epic Fail at DEF CON
- UK healthcare SaaS faces six million pound fine for lack of MFA
- US circuit courts disagree on geofence warrants
- Our roundup of juicy Blackhat/DEF CON research
- And much, much more.
This week’s episode is sponsored by Trail of Bits. CEO Dan Guido is fresh back from the DARPA AI Cyber Challenge at DEF CON, where the Trail of Bits team moved through into the finals. Dan talks through the challenge of finding, reporting and fixing bugs with AI systems.
You can also watch this week’s show on Youtube.
Show notes
- Trump campaign points finger at Iranian hackers for documents leak
- FBI says it's investigating efforts to hack Trump and Biden-Harris campaigns
- Iranian hackers ramping up US election interference, Microsoft warns
- State Dept puts $10 million bounty on IRGC-CEC hackers
- CrowdStrike snafu was a ‘dress rehearsal’ for critical infrastructure disruptions, CISA director says | Cybersecurity Dive
- Dominic White 👾 on X: "CrowdStrike accepting the @PwnieAwards for “most epic fail” at @defcon. Class act. https://t.co/e7IgYosHAE" / X
- Russia's Kursk region suffers 'massive' DDoS attack amid Ukraine offensive
- Elon Musk on X: "@markpinc Yeah" / X
- Progress Software says SEC declines to pursue action related to MOVEit exploitation spree | Cybersecurity Dive
- NHS software supplier Advanced faces £6m fine over ransomware attack failings
- Security bugs in ransomware leak sites helped save six companies from paying hefty ransoms | TechCrunch
- 5th Circuit rules geofence warrants illegal in win for phone users’ privacy | Ars Technica
- Customs and Border Protection agents need a warrant to search your phone - The Verge
- Hackers could spy on cell phone users by abusing 5G baseband flaws, researchers say | TechCrunch
- ‘Sinkclose’ Flaw in Hundreds of Millions of AMD Chips Allows Deep, Virtually Unfixable Infections | WIRED
- Downgrade Attacks Using Windows Updates | SafeBreach
- Listen to the whispers: web timing attacks that actually work | PortSwigger Research
- Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources
- Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server! | DEVCORE
- Trail of Bits Advances to AIxCC Finals | Trail of Bits Blog
Soap Box: Making security tech more people friendly
In this sponsored Soap Box edition of the show we talk to Proofpoint’s Chief Strategy Officer Ryan Kalember about making security tech more people centric.
We often talk about how we can use signals from users to drive some of our security tech. But what about using our security tech to drive user behaviour?
Ryan thinks there are some opportunities here, particularly around identity security.
Risky Business #758 – Crowdstrike's postmortem underwhelms
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:
- Crowdstrike talks loud in its postmortem, but says very little
- Digicert fears the CA-Browser Forum, gets lawsuit from a customer
- Dmitri Alperovitch joins the show to talk about the Russian prisoner swap
- Cloudflare continues to harbour scum and villainy
- Professional ransomware crew … is an improvement?
- And much, much more.
This week’s episode is sponsored by Thinkst Canary. Marko Slaviero joins to discuss the unfashionable choice they made in hosting their platform one-VM-per-customer.
Show notes
- CrowdStrike investors file class action suit following global IT outage | Cybersecurity Dive
- CrowdStrike rebukes Delta’s negligence claims in fiery letter | Cybersecurity Dive
- Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf
- Sparks fly when lawyers meet a certificate revocation
- crt.sh | Alegeus
- U.S. releases Russian hackers in Evan Gershkovich prisoner swap
- U.S. Trades Cybercriminals to Russia in Prisoner Swap – Krebs on Security
- Who are the two major hackers Russia just received in a prisoner swap? | Ars Technica
- Hackers remotely wipe 13,000 students’ iPads and Chromebooks after breaching safety software
- Mobile Guardian Device Management Application to be removed | MOE
- Ford wants patent for tech allowing cars to surveil and report speeding drivers
- I'm Sorry, Dave, You're Speeding | WIRED
- Cloudflare once again comes under pressure for enabling abusive sites | Ars Technica
- Low-Drama ‘Dark Angels’ Reap Record Ransoms – Krebs on Security
- Bumble and Hinge allowed stalkers to pinpoint users’ locations down to 2 meters, researchers say | TechCrunch
- Unfashionably secure: why we use isolated VMs – Thinkst Thoughts
- Defending AI Model Files from Unauthorized Access with Canaries | NVIDIA Technical Blog
Risky Business #757 – The ClownStrike cleanup continues
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:
- The insurance industry’s reaction to CrowdStrike’s mess
- Google’s Workspace email validation flaw and its consequences for OAuth’d applications
- Is the VMWare ESX group membership feature a CVE or an FYI?
- Secureboot continues to under-deliver
- North Korea’s revenue neutral intelligence services
- And much, much more
This episode is sponsored by allowlisting software vendor Airlock Digital. Airlock uses a kernel driver on Windows, so Chief Executive David Cottingham joined to discuss what the CrowdStrike kernel driver bug drama means for security vendors.
This episode is also available on Youtube. If you want to ruin the magic of radio and see the faces behind the show, well, now you can!
Show notes
- Business interruption claims will drive insurance losses linked to CrowdStrike IT disruption | Cybersecurity Dive
- Delta hires David Boies to seek damages from CrowdStrike, Microsoft
- CrowdStrike disruption direct losses to reach $5.4B for Fortune 500, study finds | Cybersecurity Dive
- (1145) Why CrowdStrike's Baffling BSOD Disaster Was Avoidable - YouTube
- CrowdStrike offers a $10 apology gift card to say sorry for outage | TechCrunch
- Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services – Krebs on Security
- Hackers exploit VMware vulnerability that gives them hypervisor admin | Ars Technica
- Microsoft calls out apparent ESXi vulnerability that some researchers say is a ‘nothing burger’ | CyberScoop
- AMI Platform Key leak undermines Secure Boot on 800+ PC models
- Chrome will now prompt some users to send passwords for suspicious files | Ars Technica
- Google Online Security Blog: Improving the security of Chrome cookies on Windows
- A Senate Bill Would Radically Improve Voting Machine Security | WIRED
- U.S. told Philippines it made ‘missteps’ in secret anti-vax propaganda effort | Reuters
- Cyber firm KnowBe4 hired a fake IT worker from North Korea | CyberScoop
- North Korean hacker used hospital ransomware attacks to fund espionage | CyberScoop
- North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs
- North Korean hacking group makes waves to gain Mandiant, FBI spotlight | CyberScoop
- ServiceNow spots sales opportunities post-CrowdStrike outage | Cybersecurity Dive
- Chaining Three Bugs to Access All Your ServiceNow Data
- Cyber Supply Chain Risk Management Conference (CySCRM) 2024 | Conference | PNNL
Wide World of Cyber: Why we should show CrowdStrike no mercy
In this episode of Wide World of Cyber, Risky Business host Patrick Gray discusses the recent CrowdStrike incident and its implications for security software that operates in kernel space with Chris Krebs and Alex Stamos of SentinelOne, a CrowdStrike Competitor. The conversation also delves into Microsoft’s role in this whole disaster and the potential changes it could make to its operating system to prevent similar incidents in the future.
A video version of this episode is also available on Youtube!
Risky Business #756 -- Move fast and break everything
The Risky Biz main show returns from a break to the traditional internet-melting mess that happens whenever Patrick Gray takes a holiday. Pat and Adam Boileau talk through the week’s security news, including:
- Oh Crowdstrike, no, oh no, honey, no
- AT&T stored call records on Snowflake and you’ll never guess what happened next
- Squarespace buys Google Domains and makes a hash of it
- Some but not all of the SECs case against Solarwinds gets thrown out
- Pity the incident responders digging through a terabyte of Disney Slack dumps
- Internet Explorer rises from the grave, and it wants SHELLS RAAAAARGH SSHHEEELLLS
- And much, much more.
This week’s show is brought to you by Sublime Security, a flexible and modern email security platform. If you’re sick of using a black box email security solution, Sublime is a terrific option for you.
Show notes
- Risky Biz News: CrowdStrike faulty update affects 8.5 million Windows systems
- Low-level cybercriminals are pouncing on CrowdStrike-connected outage | CyberScoop
- CrowdStrike says flawed update was live for 78 minutes | Cybersecurity Dive
- Crooks Steal Phone, SMS Records for Nearly All AT&T Customers – Krebs on Security
- Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks – Krebs on Security
- Teenage suspect in MGM Resorts hack arrested in Britain
- Majority of SEC civil fraud case against SolarWinds dismissed, but core remains | Cybersecurity Dive
- How Russia-Linked Malware Cut Heat to 600 Ukrainian Buildings in Deep Winter | WIRED
- Kaspersky Lab Closing U.S. Division; Laying Off Workers
- Hackers Claim to Have Leaked 1.1 TB of Disney Slack Messages | WIRED
- Wallets tied to CDK ransom group received $25 million two days after attack | CyberScoop
- UnitedHealth’s cyberattack response costs to surpass $2.3B this year | Cybersecurity Dive
- Ransomware ecosystem fragmenting under law enforcement pressure and distrust
- Threat actors exploited Windows 0-day for more than a year before Microsoft fixed it | Ars Technica
Risky Biz Soap Box: Mike Wiacek on lazy mode threat hunting
This Soap Box edition of the show is with Mike Wiacek, the CEO and Founder of Stairwell.
Stairwell is a platform that creates something similar to an NDR, but for file analysis instead of network traffic. The idea is you get a copy of every unique file in your environment to the Stairwell platform, via a file forwarding agent. You get an inventory that lists where these files exist in your environment, at what times, and from there you can start doing analysis.
If you find a dodgy file you can do all the usual malware analysis type stuff, but you can also do things like immediately find out where else that file is in your organisation, or even where else it was. From there you can identify other files that are similar – variants of those files – and search for those. And you can unpack all this very, very quickly.
This is the type of tool that EDR companies use internally to do threat hunting, but it’s just for you and your org – you can drive it. And as you’ll hear, the idea of a transparent, customisable and programmable security stack is something that’s on-trend at the moment. Mike lays out the case that doing this sort of file analysis in your organisation makes a whole lot of sense.
Wide World of Cyber: State directed cybercrime
In this podcast Alex Stamos, Chris Krebs and Patrick Gray discuss the relationship between cybercrime and the state, which is often more complicated than it should be.
While the US Government and its allies fight the scourge of ransomware, other governments are using it to either raise revenue or irritate their foes. North Korea sees ransomware as a money spinner, while the Kremlin enjoys poking the west in the eye with it.
Join us for a breakdown of the relationships between governments who should know better and the worst types of people on the planet.
Risky Business #755 -- SSH 0day! Polyfill drama! Entrust crushed!
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:
- Widely used polyfill javascript gets hijacked by its new owners
- MacOS supply chain disaster bullet dodged
- That OpenSSH remote code exec OH MY <3
- Entrust gets its CA business kicked to the kerb by Google
- South Korean telco intentionally viruses 600k customers
- Microsoft continues to deeply underwhelm
- And much, much more.
This week’s episode is sponsored by Greynoise. Founder Andrew Morris joins to talk about ways to track attackers across NAT and VPNs, as well as how you can join in the fun of running an internet-scale honeypot network.
Show notes
- Polyfill, Cloudflare trade barbs after reports of supply chain attack threatening 100k websites
- 3 million iOS and macOS apps were exposed to potent supply-chain attacks
- regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems (CVE-2024-6387)
- Google Online Security Blog: Sustaining Digital Certificate Security - Entrust Certificate Distrust
- TeamViewer: Hackers copied employee directory data and encrypted passwords
- South Korean telecom company attacks customers with malware — over 600,000 torrent users report missing files, strange folders, and disabled PCs | Tom's Hardware
- CDK eyes service restoration for all car dealers by Fourth of July
- ‘I don’t see it happening’: CISA chief dismisses ban on ransomware payments
- Patelco Credit Union ransomware attack halts banking services for nearly half a million members
- LockBit claims cyberattack on Croatia’s largest hospital
- Inside a Violent Gang's Ruthless Crypto-Stealing Home Invasion Spree
- Suspected Chinese gov’t hackers used ransomware as cover in attacks on Brazil presidency, Indian health org
- Nearly 4,000 arrested in global police crackdown on online scam networks
- USD 257 million seized in global police crackdown against online scams
- Microsoft alerts additional customers of state-linked threat group attacks
- Midnight Blizzard Microsoft Email Data Sharing Request: Legit? : r/Office365
- Polish Parliament strips official of immunity, clearing path for prosecution in spyware scandal
- Stolen credentials could unmask thousands of darknet child abuse website users
- WA man set up fake free wifi at Australian airports and on flights to steal people’s data, police allege
- Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
- iOS 17 lockdown mode blocking CarPlay? : r/ios
Risky Biz Soap Box: Why AI shouldn't really change your security controls
This is a sponsored Soap Box edition of the Risky Business podcast.
Abhishek Agrawal is the CEO and co-founder of Material Security, an email security company that locks down cloud email archives. Attackers have been raiding mailspools since hacking has existed, and with those mailspools now in the cloud with services like o365 and Google Workspace, guess where the attackers are going?
Material built a product that helps you lock up your email data, to archive and redact sensitive information. The idea is to really just limit what an attacker can do with email data if they pop an account.
Abhishek joined me to talk about a few things, like how non phishing resistant MFA is basically dead, how email content is very useful to security programs, and about how the gen AI won’t really change much on the defensive control side.
Risky Business #754 -- Assange pleads guilty to espionage, walks free
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:
- Julian Assange finally cuts a deal, pleads guilty, and goes free
- USA to ban Kaspersky - even updates
- Car dealer SaaS provider CDK contemplates paying a ransom
- Intolerable healthcare ransomware attacks continue
- We revisit Windows proximity bugs via wifi and bluetooth
- And much, much more.
This week’s episode is sponsored by enterprise browser maker Island. Crowdstrike co-founder Dmitri Alperovitch is an investor in Island, and joins on its behalf to discuss why an enterprise browser is really starting to make sense.
Show notes
- Julian Assange released from prison and has left UK, WikiLeaks says
- US to ban Kaspersky Lab software nationwide later this year
- Cyberattack on CDK Global stymies work at car dealerships across US
- Almost 200 cancer operations postponed as ransomware group publishes London hospitals data
- UK government weighs action against Russian hackers over NHS records theft
- South Africa’s national health lab hit with ransomware attack amid mpox outbreak
- Ransomware victims are becoming less likely to pay up | Cybersecurity Dive
- Lawmakers in Philippines push for probe into Pentagon's anti-vax propaganda operation | Reuters
- Telegram says it has 'about 30 engineers'; security experts say that's a red flag | TechCrunch
- Two bluetooth vulnerabilities in Windows
- Thread on reversing the patch
- Basic concept for the latest windows wifi driver CVE
Risky Business #753 – Congress and vuln researchers maul Microsoft
On this week’s retreat special, the entire Risky Business team is together in a tropical paradise for the first time. The team takes a break from the infinity pool to discuss the week’s security news:
- Microsoft recalls Recall, but why did it have to be such a mess
- And a Windows kernel wifi code-exec, really?
- Passkeys and identity are hard
- Scattered Spider bigwig arrested in Spain
- The pentagon runs a deeply flawed info-op
- Is it time E2E crypto nerds accept their place in the world?
- And much, much more.
This week’s show is brought to you by Corelight… Corelight’s CEO Brian Dye will be along in this week’s sponsor interview to make a really compelling case for something that shouldn’t exist… which is NDR in cloud environments.
Show notes
- Microsoft shelves Recall feature release after security uproar
- Microsoft’s Recall puts the Biden administration’s cyber credibility on the line | CyberScoop
- Microsoft’s cybersecurity vulnerabilities endanger America
- US lawmakers grill Microsoft president over China ties, hacks | Reuters
- Microsoft Refused to Fix Flaw Years Before SolarWinds Hack — ProPublica
- CVE-2024-30078 - Security Update Guide - Microsoft - Windows Wi-Fi Driver Remote Code Execution Vulnerability
- Security bug allows anyone to spoof Microsoft employee emails | TechCrunch
- Patrick Gray on X: "I was wrong about some things I said about iCloud accounts in this week’s show and I’ll tell you all exactly how I was wrong in next week’s show"
- Passkeys in Microsoft Authenticator and Entra ID
- Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED
- MFA plays a rising role in major attacks, research finds | Cybersecurity Dive
- Luke Jennings on LinkedIn: saas-attacks/techniques/ghost_logins/description.md at main ·…
- Alleged Boss of ‘Scattered Spider’ Hacking Group Arrested – Krebs on Security
- EXPOSED: Identities of Iranian Hackers Targeting Israel and Other Countries Revealed | Matzav.com
- Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating | Ars Technica
- Windows flaw may have been exploited with Black Basta ransomware before it was patched
- Crown Equipment Corporation victim of a Ransomware attack | Born's Tech and Windows World
- City governments in Michigan, New York face shutdowns after ransomware attacks
- Cleveland confirms ransomware attack as City Hall remains closed
- Authorities investigating extended ‘network outage’ at organization that runs TheBus
- Pentagon ran secret anti-vax campaign to incite fear of China vaccines
- Shashank Joshi on X: "Just finished “Information Operations”, a new book by @TathamSteve. Includes this anecdote on a British effort to stop children throwing stones at a base in Afghanistan. “LRGR was the abbreviation for the Long-Range Gonad Reducer.” https://t.co/zmoxb45Cgz"
- Dmitri Alperovitch on X: "@shashj They also allegedly hacked the email of the lieutenant leading the medical service of the 960th unit and retrieved the medical certificates of 150 officers and enlisted personnel"
- Signal president Meredith Whittaker criticizes EU attempts to tackle child abuse material
Risky Business #752 -- Apple announcements thrill and terrify at the same time
On this week’s show Patrick Gray and Adam Boileau are joined by long-time NSA boffin Rob Joyce. Now Rob’s left the government service, he’s hobnobbing with us pundits, talking through the week’s news:
- Apple announces a big leap for confidential cloud computing into the mass market
- While at the same time, letting you just mosey around your iPhone from your Mac
- Mandiant reports in about the Snowflake breach
- Moody’s say credit ratings might consider cyber incidents
- Microsoft fixes an Azure flaw with a… “comprehensive documentation update”
- And much, much more.
This week’s show is sponsored by Yubico, maker of the Yubikey hardware authentication token. Jerrod Chong, Yubico’s COO and President joins to talk about the challenges of the passkey and hardware authenticator ecosystem.
Show notes
- Apple makes a password manager play in a heavily targeted market | Cybersecurity Dive
- macOS Sequoia takes productivity and intelligence on Mac to new heights - Apple
- The Wiretap: Apple’s AI Announcement Promises Big Security Boosts–Not Everyone Is Convinced
- Matthew Green on X: "Ok there are probably half a dozen more technical details in the blog post. It’s a very thoughtful design. Indeed, if you gave an excellent team a huge pile of money and told them to build the best “private” cloud in the world, it would probably look like this. 14/" / X
- Risky Biz News: Microsoft budges on Windows 11 Recall
- Tenable finds an Azure flaw, Microsoft calls it a feature • The Register
- LendingTree confirms that cloud services attack potentially affected subsidiary
- Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica
- 7,000 LockBit decryption keys now in the hands of the FBI, offering victims hope | Ars Technica
- Urgent call for O-type blood donations following London hospitals ransomware attack
- Darknet site for Qilin gang, suspected in London hospitals ransomware attack, goes down
- Cyberattacks pose mounting risks to creditworthiness: Moody’s | Cybersecurity Dive
- Apple refused to pay bug bounty to Russian cybersecurity firm Kaspersky Lab
- FCC moves ahead on internet routing security rules | CyberScoop
- House Republicans propose eliminating funding for election security | CyberScoop
- New DJI policy: No flight record syncing for US drone pilots
- Semiconductor giants Nvidia and Arm warn of new flaws in their graphics processors
- Critical PHP CVE is under attack — research shows it’s easy to exploit | Cybersecurity Dive
- A US Company Enabled a North Korean Scam That Raised Money for WMDs | WIRED
Risky Business #751 -- Snowflake, operation Endgame and Microsoft's looming FTC problem
On this week’s show Patrick Gray and Mark Piper discuss the week’s security news, including:
- What on earth happened at Snowflake?
- A look at operation Endgame
- Check Point’s hilarious adventures with dot dot slash
- Report says the FTC is looking at Microsoft’s security product bundling
- More ransomware hits Russia
- Much, much more
404 Media co-founder Joseph Cox is this week’s feature guest. He joins us to talk about his new book, Dark Wire, which is all about the FBI’s Anom sting.
This week’s show is brought to you by Resourcely. If your Terraform is a mess or your CSPM dashboards are lighting up with insane and stupid things, you should check out Resourcely. Its founder and CEO Travis McPeak will be along in this week’s sponsor interview to talk about all things Terraform.
Show notes
- The Snowflake breach and the need for mandatory MFA
- Snowflake at centre of world’s largest data breach | by Kevin Beaumont | Jun, 2024 | DoublePulsar
- Cloud company Snowflake denies that reported breach originated with its products
- ‘Operation Endgame’ Hits Malware Delivery Platforms – Krebs on Security
- Treasury Sanctions Creators of 911 S5 Proxy Botnet – Krebs on Security
- TikTok warns of exploit aimed at 'high-profile accounts’
- SEC clarifies intent of cybersecurity breach disclosure rules after initial filings | Cybersecurity Dive
- SEC.gov | Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents[*]
- Nurses at Ascension hospital in Michigan raise alarms about safety following ransomware attack
- London hospitals declare emergency following ransomware attack | Ars Technica
- North Korea’s ‘Moonstone Sleet’ using fake tank game, custom ransomware in attacks
- OpenAI models used in nation-state influence campaigns, company says
- National Vulnerability Database | NIST
- More than 600,000 routers knocked out in October by Chalubo malware
- Hackers steal $305M from DMM Bitcoin crypto exchange | TechCrunch
- Germany's main opposition party hit by ‘serious’ cyberattack
- Cyberattack disrupts operations of supermarkets across Russia
- Rare earths miner targeted in cyber attack prior to removal of Chinese investors - ABC News
- Check Point - Wrong Check Point (CVE-2024-24919)
- Kevin Beaumont: "The latest Risky Business epis…" - Infosec Exchange
- This Hacker Tool Extracts All the Data Collected by Windows’ New Recall AI | WIRED
- FTC-industry talks over possible Microsoft probe raised recent hacking incidents - Nextgov/FCW
- Tim Schofield 🏴 🇬🇧 🇪🇺🗺: "@riskybusiness @metlstorm I d…" - Infosec Exchange
- Dark Wire: The Incredible True Story of the Largest Sting Operation Ever: Cox, Joseph: 9781541702691: Amazon.com: Books
- Distant Field Labs
Risky Business #750 -- Why Microsoft's Recall is an attacker's best friend
On this week’s show Patrick and Adam discuss the week’s security news, including:
- Russian delivery company gets ransomware-wiper’d
- A supply-chain attack targets video software used in US courts
- Checkpoint firewalls get hacked, details as clear as mud
- Microsoft Recall delights hackers
- Aussie telco Optus gets told its IR report isn’t legal advice
- Cyber insurer says you’re 5x more likely to get rekt if you have a Cisco ASA
- And much, much more.
This week’s episode is sponsored by Kroll Cyber. Alex Cowperthwaite, Kroll’s technical director research and development for offence joins to talk about how his team attacks AI models, in ways both classic and new.
Show notes
- Major Russian delivery company down for three days due to cyberattack
- Stark Industries Solutions: An Iron Hammer in the Cloud – Krebs on Security
- CVE-2024-4978: Backdoored Justice AV Solutions Viewer Software Used in Apparent Supply Chain Attack | Rapid7 Blog
- Check Point Software customers targeted by hackers using old, local VPN accounts | Cybersecurity Dive
- US pharma giant Cencora says Americans' health information stolen in data breach | TechCrunch
- Microsoft’s New Recall AI Tool May Be a ‘Privacy Nightmare’ | WIRED
- Kevin Beaumont: "I got ahold of the Copilot+ so…" - Cyberplace
- Kevin Beaumont: "For those who aren’t aware, Mi…" - Cyberplace
- Patrick Gray on X: "You know it’s coming… Microsoft Defender Advanced Security for Recall"
- Microsoft Edge for Business: Revolutionizing your business with AI, security and productivity - Microsoft Edge Blog
- Optus loses appeal to keep Deloitte report on cyberattack secret
- Optus says it will defend allegations it failed to protect confidential details of 9 million customers in cyber attack - ABC News
- Nearly 3 million affected by Sav-Rx data breach
- Spyware app pcTattletale was hacked and its website defaced | TechCrunch
- #F**kStalkerware pt. 6 - tattling on pcTattletale
- Spyware maker pcTattletale shutters after data breach | TechCrunch
- Jeremy Kirk: "Cyber insurer Coalition releas…" - Infosec Exchange
- Coalition_2024-Cyber-Claims-Report
- TikTok says it disrupted 15 influence operations this year — including one from China
- Israeli private eye accused of hacking was questioned about DC public affairs firm, sources say | Reuters
- RansomHub claims attack on Christie’s, the world’s wealthiest auction house
- Open-Source Assessments of AI Capabilities: The Proliferation of AI Analysis Tools, Replicating Competitor Models, and the Zhousidun Dataset
- Shashank Joshi on X: "Additionally, OpenAI will retain and consult with other safety, security, and technical experts to support this work, including former cybersecurity officials, Rob Joyce [@RGB_Lights], who advises OpenAI on security, and John Carlin."
Risky Business #749 -- Google answer to Microsoft's insecurity? Buy Google stuff!
This week’s episode was recorded in front of a live audience at AusCERT’s 2024 conference. Pat and Adam talked through:
- Google starts using security as a marketing tool against Microsoft, along with steep discounts
- Microsoft announces a creepy desktop recording AI
- UK govt proposes ransom payment controls
- Arizona woman runs a laptop farm for North Korea
- Julian Assange just keeps on with his malarky
- And much, much more
This week’s episode is sponsored by Tines. Its CEO Eoin Hinchy joins the show to talk about how AI can be genuinely useful in automation.
Show notes
- (1) Dina Bass on X: "Google is offering deep discounts to government and corporate customers to entice them to switch from Microsoft Office as it attacks Microsoft's cybersecurity over recent breaches, citing US gov't cybersecurity review board report https://t.co/43sIJmBWi5" / X
- Microsoft president set to testify before Congress on ‘security shortcomings’ | Cybersecurity Dive
- Chairman Green, Ranking Member Thompson Announce Microsoft President Will Testify on Company’s Security Shortcomings Following Hack of Government Accounts – Committee on Homeland Security
- Google leverages Microsoft’s cyber gaps to woo Workspace customers | Cybersecurity Dive
- CSRB report highlights the need for a new approach to security
- (1) vx-underground on X: "tl;dr Microsoft introduces 24/7 surveillance functionality for the NSA and/or CIA but markets it as a feature that you'll like" / X
- Everything You Need to Know About Windows 11's Recall Feature
- Australian government warns of 'large-scale ransomware data breach'
- (1) National Cyber Security Coordinator on X: "The Australian Government continues to assist MediSecure, an electronic prescriptions provider, respond to a cyber incident. We are still working to build a picture of the size and nature of the data that has been impacted by this data breach impacting MediSecure. This https://t.co/oyNeRonurZ" / X
- HHS offering $50 million for proposals to improve hospital cybersecurity
- Remote-access tools the intrusion point to blame for most ransomware attacks | Cybersecurity Dive
- UK insurance industry begins to acknowledge role in tackling ransomware
- Exclusive: UK to propose mandatory reporting for ransomware attacks and licensing regime for all payments
- Hacktivists turn to ransomware in attacks on Philippines government
- Arizona woman accused of helping North Koreans get remote IT jobs at 300 companies | Ars Technica
- US offers $5 million for info on North Korean IT workers involved in job fraud
- FCC might require telecoms to report on securing internet's BGP technology
- FCC to probe ‘grave’ weaknesses in phone network infrastructure
- EPA says it will step up enforcement to address ‘critical’ vulnerabilities within water sector
- EPA takes steps to address cybersecurity weaknesses at water utilities
- British signals agency to protect election candidates’ phones from cyberattacks
- Feds seize BreachForums platform, Telegram page
- Dark web narcotics market’s alleged leader arrested and charged in New York
- WikiLeaks’ Julian Assange Can Appeal His Extradition to the US, British Court Says | WIRED
Wide World of Cyber: Krebs and Stamos on How AI Will Change Cybersecurity
In this podcast SentinelOne’s Chief Trust officer Alex Stamos and its Chief Intelligence and Public Policy Officer Chris Krebs join Patrick Gray to talk all about AI.
It’s been a year and a half since ChatGPT landed and freaked everyone out. Since then, AI has really entrenched itself as the next big thing. It’s popping up everywhere, and the use cases for cybersecurity are starting to come into focus.
Threat actors and defenders are using this stuff already, but it’s early days and as you’ll hear, things are really going to change, and fast.
Risky Business #748 -- New cyber rules for US healthcare are coming
This week Patrick Gray and Adam Boileau along special guest Lina Lau discuss the week’s news, including:
- The ongoing Ascension healthcare disruption, and
- Whether its reasonable for healthcare orgs to be pushing back
- Platforming cybercriminals for interviews
- Own the libs by… not using E2EE messaging?
- CISA’s secure by design, we want to believe!
- The $64billion scale of indusrialised fraud
- And much, much more.
This week’s sponsor is network discovery specialist, Run Zero. Director of research Rob King joins to talk about the weird and wonderful delights in their new Research Report.
Show notes
- Federal agencies assisting Catholic health network amid cyberattack
- After Ascension ransomware attack, feds issue alert on Black Basta group
- As White House preps new cyber rules for healthcare, Neuberger says backlash is unwarranted
- Stolen children’s health records posted online in extortion bid
- Guidance for organisations considering payment in... - NCSC.GOV.UK
- How Did Authorities Identify the Alleged Lockbit Boss? – Krebs on Security
- In interview, LockbitSupp says authorities outed the wrong guy
- A (Strange) Interview With the Russian-Military-Linked Hackers Targeting US Water Utilities | WIRED
- UK 'increasingly concerned' about Russian intelligence links to hacktivists
- Civil society under increasing threats from ‘malicious’ state cyber actors, US
- Elon Musk Weighs in on the Encryption Wars Between Telegram and Signal
- Encrypted services Apple, Proton and Wire helped Spanish police identify activist | TechCrunch
- Christie's Website Offline For A Fifth Day And The Company Is Still Silent On The Extent Of Last Week's Security Breach
- 68 tech, security vendors commit to secure-by-design practices | Cybersecurity Dive
- UK government urges caution over blaming China for Ministry of Defence breach
- Black Basta group spam-bombs victims and then calls to help
- Southeast Asian scam syndicates stealing $64 billion annually, researchers find
- The $2.3 Billion Tornado Cash Case Is a Pivotal Moment for Crypto Privacy | WIRED
- ADVANCED APT EMULATION LABS
- Download the runZero Research Report
Risky Business #747 -- Lockbit Leader Has A Very Bad Day
Patrick dials in from RSA in San Francisco to discuss the week’s security news with Adam, including:
- The west doxxes LockbitSupp, who must now hide his hundred million dollars
- Revil hacker behind Kasaya breach gets 14 years
- Microsoft makes some positive sounding* noises on security
- A fun flaw in nearly all VPN clients
- Gitlab admins continue their never-ending incident response
- And much, much more.
This week’s sponsor is Stairwell. Long time infosec researcher Silas Cutler joins us to talk through his adventures in attacker C2 systems, and how this feeds into Stairwell’s data.
* we’re still sceptical they’ll get it right, but they do at least seem to realise how deep the doo-doo they’re in is… Pat speculates they have … tentacles, and a regulatory-threat-gland.
Show notes
- 'ArcaneDoor' Cyberspies Hacked Cisco Firewalls to Access Government Networks | WIRED
- Andy Greenberg: "@metlstorm @riskybusiness no w…" - Infosec Exchange
- U.S. Charges Russian Man as Boss of LockBit Ransomware Group – Krebs on Security
- Ukrainian sentenced to almost 14 years for infecting thousands with REvil ransomware
- Microsoft ties security goals to exec compensation
- China suspected of hacking British military payment system, reports say
- Germany recalls ambassador to Russia over cyberattacks
- Blinken unveils State Dept. strategy for ‘vibrant, open and secure technological future’
- Microsoft plans to lock down Windows DNS like never before. Here’s how. | Ars Technica
- Novel attack against virtually all VPN apps neuters their entire purpose | Ars Technica
- The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics | WIRED
- Dropbox says hacker accessed passwords, authentication info during breach
- Maximum-severity GitLab flaw allowing account hijacking under active exploitation | Ars Technica
- Our new research: Enhancing blockchain analytics through AI
- Reconstructing the Mind’s Eye: fMRI-to-Image with Contrastive Learning and Diffusion Priors
- Kevin Collier on X: "Oh my God. @riskybusiness is already the name of what is by a longshot the most established cyber podcast. There are a million possible names out there and Mr Decision Making over here went with one that's been in use for more than 15 years."
Risky Business #746 – Microsoft takes your security seriously*
On this week’s show Patrick and Adam discuss the week’s security news, including:
- Microsoft reassures* us that they take security very seriously*
- Cisco ASA firewalls get sneakily backdoored, but no one’s quite sure how
- Change Healthcare was 1FA Citrix all along
- The FTC, FCC and other government sticks get waved at tech
- Lizard Squad Finn who hacked the Vastaamo therapy chain gets sentenced
- And much, much more.
This week’s sponsor is Zero Networks, who make a network micro-segmentation product that is actually usable. Zero Networks CEO Benny Lakunishok joins us to talk through why firewalling everything everywhere is finally workable.
* You’ll forgive us for being… a tad sceptical.
Show notes
- 'ArcaneDoor' Cyberspies Hacked Cisco Firewalls to Access Government Networks | WIRED
- Change Healthcare hackers broke in using stolen credentials — and no MFA, says UHG CEO | TechCrunch
- Microsoft CEO says security is its No. 1 priority | Cybersecurity Dive
- TrustedSec | Full Disclosure: A Look at a Recently Patched Microsoft…
- Vintage Microsoft flaw resurfaces, threat actors attack with golden GooseEgg | Cybersecurity Dive
- FTC commercial surveillance rules could arrive within months, sources say
- FCC takes $200 million bite out of wireless carriers for sharing location data | CyberScoop
- Know-your-customer executive order facing stiff opposition from cloud industry
- Tech companies must help the fight aganst extremists using encryption: ASIO boss
- Josh Taylor on X: "Yess, excellent question from @Paul_Karp on why AFP et al aren't using the powers they already have. They say one technical assistance or capability notice has recently been issued. https://t.co/pEXrvjK5Q4" / X
- (720) IN FULL: ASIO and AFP respond to X chairman Elon Musk, issues social media warnings | ABC News - YouTube
- China-linked PlugX malware infections found in more than 170 countries
- Belarus secret service website still down after hackers claim to breach it
- Man Who Mass-Extorted Psychotherapy Patients Gets Six Years – Krebs on Security
- Sweden's liquor shelves to run empty this week due to ransomware attack
- Congress picked a direct fight with ByteDance and TikTok. The privacy implications are less clear.
- Telegram blocks, then unblocks, chatbots used by Ukraine’s intelligence services
- Elon Musk’s X takeover crushed Twitter’s profit to just $4804 in Australia
- Australian court orders Elon Musk’s X to hide Sydney church stabbing posts from users globally | Australia news | The Guardian
- After the Christchurch attacks, Twitter made a deal with Jacinda Ardern over violent content. Elon Musk changed everything - ABC News
- World on the Brink: How America Can Beat China in the Race for the Twenty-First Century - Kindle edition by Alperovitch, Dmitri, Graff, Garrett M.. Politics & Social Sciences Kindle eBooks @ Amazon.com.
Snake Oilers: Push Security, Knocknoc and iVerify
In this edition of Snake Oilers we’ll be hearing from:
- Push Security: A browser plugin-based security company that combats identity-based attacks. (Much more compelling that it sounds in this description.)
- Knocknoc: The tool Risky Business uses to protect our own applications and services. (Restrict network/port access to users who are authenticated via SSO.)
- iVerify: Mobile security and threat hunting for iOS and Android. (Caught Pegasus in the wild!)
Special Edition: Chris Krebs, Alex Stamos and Patrick Gray
In this special edition of the Risky Business podcast Patrick Gray chats with former Facebook CSO Alex Stamos and founding CISA director Chris Krebs about sovereignty and technology.
China and Russia are doing their level best to yeet American tech from their supply chains – hardware, software and cloud services. They’ll be rebuilding these supply chains – for government systems, at least – from components that they have complete visibility into, and control over.
Meanwhile, America’s government faces different supply chain challenges. It has a supply chain that won’t be weaponised against it by its adversaries, but it lacks the same sort of visibility and control that its adversaries will eventually achieve over their supply chains. So where does this leave the west? Where does it leave China and Russia?
Risky Business #745 – Tales from the PANageddon
On this week’s show Patrick and Adam discuss the week’s security news, including:
- Palo Alto’s firewalls have a ../ bad day
- Sisense’s bucket full of creds gets kicked over
- United Healthcare draws the ire of congress
- FISA 702 reauthorisation finally moves forward
- Apple warns about “mercenary exploitation” but what’s the India link?
- And much, much, more
This week’s sponsor is Panther, a platform that does detection as code on massive amounts of data. Panther’s founder Jack Naglieri is this week’s sponsor guest, and we spoke with him about some common detection-as-code approaches.
Show notes
- Palo Alto Networks releases fixes for zero-day as attackers swarm VPN vulnerability
- CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect
- Rapid7 Technical Analysis
- Why CISA is Warning CISOs About a Breach at Sisense – Krebs on Security
- Congress rails against UnitedHealth Group after ransomware attack | CyberScoop
- The US Government Has a Microsoft Problem | WIRED
- House GOP bridges divide to reauthorize FISA surveillance bill - The Washington Post
- Top officials again push back on ransom payment ban | Cybersecurity Dive
- Ex-White House cyber official says ransomware payment ban is a ways off | CyberScoop
- Over 500 people targeted by Pegasus spyware in Poland, officials say
- Apple drops term 'state-sponsored' attacks from its threat notification policy
- “All Your Secrets Are Belong To Us” — A Delinea Secret Server AuthN/AuthZ Bypass
- PuTTY vulnerability vuln-p521-bias
- Security engineer jailed for 3 years for $12M crypto hacks | TechCrunch
- Alleged cryptojacking scheme consumed $3.5M of stolen computing to make just $1M | Ars Technica
- Twitter’s Clumsy Pivot to X.com Is a Gift to Phishers – Krebs on Security
Risky Business #744 -- Ransomware upstarts jostle in Lockbit's absence
On this week’s show Patrick and Adam discuss the week’s security news, including:
- Ransomware: down but not out
- Zero day prices on the rise…
- … and what it means for enterprise software
- Geopolitical conflict comes to computers in Palau
- Ukraine cyber chief Illia Vitiuk suspended
- More x86 microarchitectural bad times
- And much much more
Proofpoint’s chief strategy officer Ryan Kalember is this week’s sponsor guest. He takes aim at some recent vendor trends, like security companies describing themselves as “platforms”.
Show notes
- CyberCX_Report_DFIR 2023 Year in Review_Online.pdf
- Ransomlook Stats
- Vlad Styran 🇺🇦 on X: ".@riskybusiness has noted recently that there is an “orthodox Easter”-like low season in the ransomware village. Although my sources do not support this assessment, if true, there might be a simple explanation https://t.co/kM8lu6KbyY" / X
- Price of zero-day exploits rises as companies harden products against hackers | TechCrunch
- Mandiant spots advanced exploit activity in Ivanti devices | Cybersecurity Dive
- Pricing - Knocknoc
- ALPHV steps up laundering of Change Healthcare ransom payments | CyberScoop
- Extortion group threatens to sell Change Healthcare data | CyberScoop
- Attempted hack on NYC continues wave of cyberattacks against municipal governments
- Missouri county declares state of emergency amid suspected ransomware attack | Ars Technica
- Medusa cybercrime gang takes credit for another attack on US municipality
- Omni Hotels & Resorts hit by cyberattack | Cybersecurity Dive
- Targus says cyberattack is causing operational outage | TechCrunch
- German database company Genios confirms ransomware attack
- Researchers discover new ransomware gang ‘Muliaka’ attacking Russian businesses
- ‘An attack on the reputation of Palau’: officials question who was really behind ransomware incident
- 'They’re lying': Palau denies claims by ransomware gang over recent cyberattack
- Ukrainian security service’s cyber chief suspended following media investigation
- Russia seeks criminal charges against executives at flight booking service accused of failing to protect consumer data
- House hurtles toward showdown over expiring surveillance tools | CyberScoop
- D-Link tells customers to sunset actively exploited storage devices | Cybersecurity Dive
- A Vigilante Hacker Took Down North Korea’s Internet. Now He’s Taking Off His Mask | WIRED
- Ahoi Attacks
- Linux Kernel Patched For Branch History Injection "BHI" Intel CPU Vulnerability - Phoronix
- Ransomware gang’s new extortion trick? Calling the front desk | TechCrunch
- Evolving Threat Landscape: A Deep Dive into Multichannel Attacks Targeting Retailers | Proofpoint US
Snake Oilers: Kodex, ClearVector and Censys
In this edition of Snake Oilers you’ll hear pitches from three companies:
- Kodex: Makes a platform companies can use to interact with law enforcement (Solves the law enforcement impersonator problem, among others.)
- ClearVector: Cloud security startup from former FireEye/Mandiant SVP/CTO John Laliberte
- Censys: Scans the entire internet, identifies assets you didn’t know were yours, helps you track attacker infrastructure like C2
Risky Business #743 -- A chat about the xz backdoor with the guy who found it
On this week’s show Patrick and Adam discuss the week’s security news, including:
- The SSH backdoor that dreams (or nightmares) are made of
- Microsoft gets a solid spanking from the CSRB
- Ukraine uses an old Russian WinRAR bug to hack Russia
- Push-notifications and social-engineering combined-arms vs Apple
- And much, much more.
We have a special guest in this week’s show, Andres Freund, the Postgres developer who discovered the backdoor in the xz Linux compression library.
This week’s show is brought to you by Island, a company that makes a security-focussed enterprise browser. Island’s Bradon Rogers is this week’s sponsor guest and he’ll be joining us to talk about how people are swapping out their Virtual Desktop Infrastructure for enterprise-focussed browsers like theirs.
Show notes
- Risky Biz News: Supply chain attack in Linuxland
- oss-security - Re: backdoor in upstream xz/liblzma leading to ssh server compromise
- Andres Freund (Tech) on X: "@binitamshah FWIW, I didn't actually start looking due to the 500ms - I started looking when I saw failing ssh logins (by the usual automated attempts trying random user/password combinations) using a substantial amount of CPU. Only after that I noticed the slower logins." / X
- Andres Freund (Tech) on X: "@riskybusiness Absurdly enough, I was listening to the episode on a cooking break while writing the xz issue up. Couldn't make it up." / X
- GitHub - amlweems/xzbot: notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)
- research!rsc: The xz attack shell script
- DHS report rips Microsoft for ‘cascade’ of errors in China hack - The Washington Post
- Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Russian researchers say espionage operation using WinRAR bug is linked to Ukraine
- Recent ‘MFA Bombing’ Attacks Targeting Apple Users – Krebs on Security
- Ransomware gang leaks stolen Scottish healthcare patient data in extortion bid
- Ross Anderson, professor and famed author of ‘Security Engineering,’ passes away
Risky Business #742 -- China bans AMD and Intel, pivots to Linux on the desktop
On this week’s show Patrick and Adam discuss the week’s security news, including:
- FVEY protests China’s widespread hacking of western politicians
- China bans western CPUs, Windows and databases
- Apple’s leaky M-chip prefetcher
- Nigeria holds ex-IRS investigator hostage in Binance stoush
- Researchers bring Rowhammer to AMD Zen and DDR5
- And much, much more.
This week’s show is brought to you by Thinkst Canary. Its founder Haroon Meer joins this week’s show to make a passionate case that security vendors don’t all have to go for explosive growth. Slow and steady with a focus on excellent and relevant products will win the race, he says.
Show notes
- Justice Department indicts 7 accused in 14-year hack campaign by Chinese gov
- Parliament network breached in China-led cyberattack, Judith Collins reveals
- China blocks use of Intel and AMD chips in government computers
- Announcement of Safety and Reliability Evaluation Results (No. 1, 2023)
- Unpatchable vulnerability in Apple chip leaks secret encryption keys | Ars Technica
- How Ukraine is using mobile phones on 6ft poles to stop drones
- Russian military intelligence may have deployed wiper against multiple Ukrainian ISPs | CyberScoop
- US penalizes Russian fintech firms that helped others evade sanctions
- UN probing 58 alleged crypto heists by North Korea worth $3 billion
- Detained execs, a bold escape, and tax evasion charges: Nigeria takes aim at Binance
- The DOJ Puts Apple's iMessage Encryption in the Antitrust Crosshairs | WIRED
- Mark Zuckerberg told Facebook execs to 'figure out' how to track encrypted usage on rival apps like Snap and YouTube, unsealed documents show
- ‘Far-reaching’ hack stole information from Python developers
- ZenHammer: Rowhammer Attacks on AMD Zen-based Platforms
- One Man’s Army of Streaming Bots Reveals a Whole Industry’s Problem
- Apex Legends hacker said he hacked tournament games ‘for fun’ | TechCrunch
Risky Biz Soap Box: Why Azure vulns should get CVEs
In this Soap Box edition of the podcast Patrick Gray talks to Nucleus Security co-founder Scott Kuffer about whether or not cloud service vulnerabilities should get CVEs, what on earth is happening with NIST’s National Vulnerability Database (NVD) and more.
Risky Business #741 -- The Mintlify breach and modern supply chains
On this week’s show Patrick and Adam discuss the week’s security news, including:
- Turns out AI is still bad code review after all,
- Mintlify loses a bunch of Github tokens,
- Everything old is new again with the UDP loop DoS,
- Know-your-(recon satellite)-customer is hard,
- Microsoft takes away Russia’s powershell, solving living off the land,
- And much, much more
This week’s show is brought to you by Material Security. In this week’s sponsor interview we speak with Material’s Rajan Kapoor, VP of Customer Experience at Material. We’re also joined by Chaim Sanders, who heads Security and Privacy at Lyft.
Show notes
- Anthropic’s CISO drinks the AI kool aid - backpedals frantically on security analysis claim
- Incident report on March 13, 2024 - Mintlify
- Loop DoS: New Denial-of-Service attack targets application-layer protocols
- State of IP Spoofing
- Pharmaceutical development company investigating cyberattack after LockBit posting
- Exclusive: After LockBit’s takedown, its purported leader vows to hack on
- Russian-Canadian hacker sentenced for global ransomware scheme to be extradited | CTV News
- A Suspicious Pattern Alarming the Ukrainian Military - The Atlantic
- Exclusive: Musk's SpaceX is building spy satellite network for US intelligence agency, sources say | Reuters
- Elon Musk’s SpaceX Forges Closer Ties With U.S. Spy and Military Agencies - WSJ
- Russians will no longer be able to access Microsoft cloud services, business intelligence tools
- Rostelecom blocks the SIP protocol for clients of Russian hosters / Sudo Null IT News
- Researchers spot updated version of malware that hit Viasat | CyberScoop
- Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks | Trend Micro (US)
- PRC State-Sponsored Cyber Activity: Actions for Critical Infrastructure Leaders | CISA
- US is still chasing down pieces of Chinese hacking operation, NSA official says
- 875 workers rescued in Tarlac POGO raid | Philippine News Agency
- Fujitsu says it found malware on its corporate network, warns of possible data breach | Ars Technica
- Mike Lindell must pay a Nevada man after election data dispute - The Washington Post
Risky Business #740 -- Midnight Blizzard's Microsoft hack isn't over
On this week’s show Patrick and Adam discuss the week’s security news, including:
- Weather forecast in Redmond is still for blizzards at midnight
- Maybe Change Healthcare wasn’t just crying nation-state wolf
- Hackers abuse e-prescription systems to sell drugs
- CISA goes above and beyond to relate to its constituency by getting its Ivantis owned
- VMware drinks from the Tianfu Cup
- Much, much more
This week’s feature guest is John P Carlin. He was principal associate deputy attorney general under Deputy Attorney General Lisa Monaco for about 18 months in 2021 and 2022, and also served as Robert Mueller’s chief of staff when he was FBI director.
John is joining us this week to talk about all things SEC. He wrote the recent Amicus Brief that says the SEC needs to be careful in its action against Solarwinds. He’ll also be talking to us more generally about these new SEC disclosure requirements, which are in full swing.
Rad founder Jimmy Mesta will along in this week’s sponsor segment to talk about some really interesting work they’ve done in baselining cloud workloads. It’s the sort of thing that sounds simple that really, really isn’t.
Show notes
- Risky Biz News: The aftermath of Microsoft's SVR hack is rearing its ugly head
- Swindled Blackcat affiliate wants money from Change Healthcare ransom - Blog | Menlo Security
- BlackCat Ransomware Group Implodes After Apparent $22M Payment by Change Healthcare – Krebs on Security
- Change Healthcare systems expected to come back online in mid-March | Cybersecurity Dive
- LockBit takes credit for February shutdown of South African pension fund
- Ransomware gang claims to have made $3.4 million after attacking children’s hospital
- Jason D. Clinton on X: "Fully automated vulnerability research is changing the cybersecurity landscape Claude 3 Opus is capable of reading source code and identifying complex security vulnerabilities used by APTs. But scaling is still a challenge. Demo: https://t.co/UfLNGdkLp8 This is beginner-level… https://t.co/mMQb2vYln1" / X
- Jason Koebler on X: "Hackers are hacking doctors, then using their digital prescription portals to "legitimately" prescribe themselves & their customers adderall, oxy, and other prescription drugs https://t.co/6elTKQnXSB" / X
- How Hackers Dox Doctors to Order Mountains of Oxy and Adderall
- CISA forced to take two systems offline last month after Ivanti compromise
- VMware sandbox escape bugs are so critical, patches are released for end-of-life products | Ars Technica
- A Close Up Look at the Consumer Data Broker Radaris – Krebs on Security
- Brief of Amici Curiae Former Government Officials
- Securities and Exchange Commission v Solarwinds Corp
Risky Business #739 -- ALPHV exit scams while Change Healthcare burns
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- The serious consequences from the Change Healthcare ransomware, and the need for a … nastier response
- Predator spyware maker getting a stern sanctioning
- A German military WebEx meeting gets snooped
- Mem-corrpution is still king
- And much, much more
In this week’s sponsor interview Patrick Gray speaks to Karl McGuinness, Okta’s chief architect, about some new security improvements they’ve built into their IDP.
Show notes
- U.S. Air Force employee charged with giving classified information to woman he met on dating site
- Ransomware attack on U.S. health care payment processor ‘most serious incident of its kind’
- AlphV’s hit on Change Healthcare strikes a sour note for defenders | Cybersecurity Dive
- Office of Public Affairs | Justice Department Disrupts Prolific ALPHV/Blackcat Ransomware Variant | United States Department of Justice
- Developing: AlphV allegedly scammed Change Healthcare and its own affiliate (1)
- Hackers Behind the Change Healthcare Ransomware Attack Just Received a $22 Million Payment | WIRED
- Ciaran Martin on X: "“We have to find a way of making a ransom ban work” - me for @thetimes
- US launches antitrust investigation into UnitedHealth, WSJ reports | Reuters
- Brett Callow on X: "#Lockbit has de-listed Fulton County.
- Predator spyware endures even after widespread exposure, analysis shows | CyberScoop
- Predator spyware infrastructure taken down after exposure | CyberScoop
- U.S. bans maker of spyware that targeted a senator's phone
- Spyware maker NSO Group ordered to turn over Pegasus code in WhatsApp case
- Whatsapp Inc vs NSO Group
- Russia’s chief propagandist leaks intercepted German military Webex conversation
- The White House's Oddly Specific, and Really Quite Good, Software Engineering Advice
- A leaky database spilled 2FA codes for the world’s tech giants | TechCrunch
- In ConnectWise attacks, Play and LockBit ransomware exploits developed quickly | Cybersecurity Dive
- How to Secure the SaaS Apps of the Future | Okta Security
Risky Business #738 -- LockBit is down but not out. Yet.
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- LockBit gets back up after takedown
- Russia arrests Medibank hacker… for something else
- ConnectWise gives out free updates, but customers aren’t happy
- Microsoft gives in to demands for more logs
- Sandvine gets entity-listed
- And much much more.
Dmitri Alperovitch also joins the show to discuss Starlink, Starshield and a row with Congress about its availability in Taiwan.
In this week’s sponsor interview, Airlock Digital’s Daniel Schell talks about his adventures with WDAC, and Dave Cottingham predicts Windows 12 will go all in on signed code.
Show notes
- LockBit group revives operations after takedown | Cybersecurity Dive
- Lockbit ransomware group administrative staff have released a lengthy response to the FBI and bystanders
- FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga. – Krebs on Security
- Russia detains hacker behind Australia’s Medibank attack
- Russia arrests three alleged SugarLocker ransomware members
- Change Healthcare incident drags on as report pins it on ransomware group
- Ransomware Groups Are Bouncing Back Faster From Law Enforcement Busts
- ‘Alarming’ cyberattack hits Canada’s federal police, criminal investigation launched
- ConnectWise ScreenConnect faces new attacks involving LockBit ransomware | Cybersecurity Dive
- Microsoft rolls out expanded logging six months after Chinese breach | CyberScoop
- Sandvine added to US Entity List
- Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections
- FACT SHEET: ONCD Report Calls for Adoption of Memory Safe Programming Languages and Addressing the Hard Research Problem of Software Measurability
- Risky Biz News: Backdoor code found in Tornado Cash
- House China committee demands Elon Musk open SpaceX Starshield internet to U.S. troops in Taiwan
- The UK Is GPS-Tagging Thousands of Migrants | WIRED
- How the Pentagon Learned to Use Targeted Ads to Find Its Targets—and Vladimir Putin | WIRED
- New Biden order would stem flow of Americans’ sensitive data to China - The Washington Post
Risky Business #737 -- LockBit gets absolutely rekt
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- LockBit has been taken down by law enforcement
- Some mega-juicy leaks out of Chinese offsec/APT contractor I-SOON
- GRU gets its Moobot network shutdown
- Signal adding usernames is… complicated
- Much, much more
In this week’s sponsor interview Devicie’s Tom Plant joins the show to talk about problems orgs run into when it comes to Windows policies. There’s an expectation out there that Windows policies are set and forget, but sadly, this is not so.
Show notes
- Feds Seize LockBit Ransomware Websites, Offer Decryption Tools, Troll Affiliates – Krebs on Security
- Law enforcement disrupt world’s biggest ransomware operation
- Shanghai Anxun’s information is unreliable and is a trap for national government agencies.
- China spy agency renews foreign cyber intelligence warning after data breaches
- US Justice Department says it disrupted Russian intelligence hacking network | Reuters
- Several Ukrainian media outlets attacked by Russian hackers
- Polish PM says previous ruling party used Pegasus spyware against ‘very long’ list of victims
- Hackers are targeting Asian bank accounts using stolen facial recognition data
- Signal Finally Rolls Out Usernames, So You Can Keep Your Phone Number Private | WIRED
- Code injection or backdoor: A new look at Ivanti’s CVE-2021-44529
- “the "AB" trigger has similar vibes to the Unreal IRCd and ProFTPD backdoors of the same timeframe.”
- FLATLINED: ANALYZING PULSE SECURE FIRMWARE AND BYPASSING INTEGRITY CHECKING
- CVSS 10 RCE in Screen Connect
- National Security Agency Announces Retirement of Cybersecurity Director
- Hunting M365 Invaders: Navigating the Shadows of Midnight Blizzard
Soap Box: A deep dive on how Russia's SVR is hacking Microsoft 365 tenants
The need to properly secure Entra ID tenants has been made pretty obvious this year thanks to a large-scale attack on them by Russia’s SVR intelligence agency. In this interview Andy Robbins from SpecterOps, the maker of Bloodhound Enterprise, talks through how he thinks those attacks actually went down, about how if you’re an o365 customer you’re using Entra ID whether you like it or not, and about how you can lock down your Entra ID tenant.
Risky Business #736 -- Azure misconfigurations are 2024's looming threat
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- Somehow there are still more Ivanti and Fortinet exploits
- Volt Typhoon have been at it for years
- Starlink in Ukraine gets complicated
- Canadians hate poor Flipper
- Much, much more…
In this week’s sponsor interview Feross Aboukhadijeh from Socket joins the show to talk about the sheer volume of malicious packages being committed to code repositories and why older SCA tools aren’t well equipped to deal with them.
Show notes
- Microsoft Azure customers hit by phishing, account takeover attacks | Cybersecurity Dive
- Ivanti publishes urgent warning about new vulnerability
- How is Pulse Secure Formed
- Attackers hit more networking gear, this time a critical Fortinet CVE | Cybersecurity Dive
- End Of General Availability of the free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)
- Coker: ONCD is studying ‘liability regimes’ for software flaws
- Chinese hackers spent 5 years in US infrastructure, ready to attack
- CISA, FBI warn of China-linked hackers pre-positioning for ‘destructive cyberattacks against US critical infrastructure’
- Russia using Starlink
- Canada declares Flipper Zero public enemy No. 1 in car-theft crackdown | Ars Technica
- Health insurance data breach affects nearly half of France’s population, privacy regulator warns
- Hackers attack 25 Romanian hospitals
- Catalin on the Rhysider ransomware decrypter going public
- A password manager LastPass calls “fraudulent” booted from App Store | Ars Technica
- From Cybercrime Saul Goodman to the Russian GRU – Krebs on Security
Soap Box: How to dismantle Volt Typhoon-style relay networks
In this Soap Box interview Greynoise founder and absolute legend Andrew Morris joins the show to talk about:
- Why Greynoise hasn’t seen a substantial drop off in Volt Typhoon’s network of compromised routers after the US Government’s takedown action
- How vendors are using Greynoise as an early warning system to identify exploitation of their products
- How he’s using large language models to reverse exploitation attempts into actual exploits
It truly is a great conversation, we hope you enjoy it!
Risky Business #735 -- AnyDesk fails the transparency test
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- Thought eels were slippery? Check out AnyDesk’s PR!
- Why Microsoft’s 365 is a nightmare to secure
- Cloudflare’s needlessly hostile blog post
- US Government introduces “Disneyland ban” for spyware peddlers
- Much, much more…
This week’s feature guest is Eric Goldstein, the executive assistant director for cybersecurity at CISA. He’s joining the show to talk about CISA’s demand that US government agencies unplug their Ivanti appliances. He also chimes in on why the US government is so rattled by Volt Typhoon and addresses a recent report from Politico that claims CISA’s Joint Cyber Defense Collaborative is a bit of a shambles.
This week’s sponsor guest is Dan Guido from Trail of Bits. He joins us to talk about their new Testing Handbook. Trail of Bits does a bunch of audit work and they’ve committed to trying to make bug discovery a one time thing – if you find that bug once, you shouldn’t have to manually find it on another client engagement. Semgrep for the win!
Show notes
- AnyDesk initiates extensive credentials reset following cyberattack | Cybersecurity Dive
- AnyDesk says software ‘safe to use’ after cyberattack
- Former CIA officer who gave WikiLeaks state secrets gets 40-year sentence
- Arrests in $400M SIM-Swap Tied to Heist at FTX? – Krebs on Security
- Microsoft Breach — What Happened? What Should Azure Admins Do? | by Andy Robbins | Feb, 2024 | Posts By SpecterOps Team Members
- Cloudflare hit by follow-on attack from previous Okta breach | Cybersecurity Dive
- Thanksgiving 2023 security incident
- US announces visa restriction policy targeting spyware abuses
- Announcement of a Visa Restriction Policy to Promote Accountability for the Misuse of Commercial Spyware - United States Department of State
- Deputy Prime Minister hosts first global conference targeting ‘hackers for hire’ and malicious use of commercial cyber tools - GOV.UK
- New Google TAG report: How Commercial Surveillance Vendors work
- A Startup Allegedly ‘Hacked the World.’ Then Came the Censorship—and Now the Backlash | WIRED
- American businessman settles hacking case in UK against law firm
- Crime bosses behind Myanmar cyber ‘fraud dens’ handed over to Chinese government
- Another Chicago hospital announces cyberattack
- Deepfake scammer walks off with $25 million in first-of-its-kind AI heist | Ars Technica
- As if 2 Ivanti vulnerabilities under exploit weren’t bad enough, now there are 3 | Ars Technica
- Two new Ivanti bugs discovered as CISA warns of hackers bypassing mitigations
- Agencies using vulnerable Ivanti products have until Saturday to disconnect them | Ars Technica
- The far right is scaring away Washington's private hacker army - POLITICO
- Our thoughts on AIxCC’s competition format | Trail of Bits Blog
- How CISA can improve OSS security | Trail of Bits Blog
- Securing open-source infrastructure with OSTIF | Trail of Bits Blog
- Announcing the Trail of Bits Testing Handbook | Trail of Bits Blog
- 30 new Semgrep rules: Ansible, Java, Kotlin, shell scripts, and more | Trail of Bits Blog
- Publishing Trail of Bits’ CodeQL queries | Trail of Bits Blog
- The Unguarded Moment (2002 Digital Remaster) - YouTube
- Boy Swallows Universe | Official Trailer | Netflix - YouTube
Risky Business #734 -- The number of hacked Microsoft 365 customers is skyrocketing
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- More details on sanctioned Medibank hacker Aleksandr Ermakov
- More details on alleged Scattered Spider hacker Noah Michael Urban
- RUMINT that the number of Microsoft customers impacted by the SVR oauth/365 campaign is huge
- Ron Wyden did something useful…
- …then did something stupid
- Ivanti’s clown car collides with dumpster fire
- Much, much more
This week’s feature guest is Australia’s assistant foreign minister (and cybersecurity tragic) Tim Watts. He joins us to talk about why the Australian government sanctioned Aleksandr Ermakob.
Sublime Security founder and CEO Josh Kamdjou is this week’s sponsor guest. He joins us to talk about combating QR-code phishing.
Show notes
- Exclusive: US disabled Chinese hacking network targeting critical infrastructure | Reuters
- Medibank’s Attacker: IT Businessman, Claimed Psychologist… | Intel471
- Who is Alleged Medibank Hacker Aleksandr Ermakov? – Krebs on Security
- Fla. Man Charged in SIM-Swapping Spree is Key Suspect in Hacker Groups Oktapus, Scattered Spider – Krebs on Security
- Microsoft says Russian hackers also targeted other organizations | TechCrunch
- HPE hit by a monthslong cyberattack on its cloud-based email | Cybersecurity Dive
- (99+) Microsoft's Dangerous Addiction To Security Revenue | LinkedIn
- Microsoft critics accuse the firm of ‘negligence’ in latest breach | CyberScoop
- N.S.A. Buys Americans’ Internet Data Without Warrants, Letter Says - The New York Times
- Trading platform EquiLend down following cyberattack | Cybersecurity Dive
- Ivanti Connect Secure zero-day patches delayed | Cybersecurity Dive
- Popular CI/CD tool Jenkins discloses critical CVE | Cybersecurity Dive
- MOVEit liabilities mount for Progress Software | Cybersecurity Dive
- Tim Watts bio:
- Pennywise - Down Under [Men at Work Cover] - YouTube
Risky Business #733 -- Say cheese, motherf---er
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news.
- Microsoft honks its clown car horn
- Australia’s hounds, released, catch their man
- The beginning of the end for Scattered Spider
- SEC was SIM swapped but had MFA off any way
- Ivanti learns a lesson…
- … while Progress does not
- and much more
DHS undersecretary for policy and Cyber Safety Review Board head Rob Silvers is this week’s feature guest. He joins the show to talk about how the CSRB handles possible conflicts of interests from board members with industry day jobs.
In this week’s sponsor interview Resourcely’s founder Travis McPeak talks about why we need to help developers with “paved roads” instead of relying on dashboard products to tell us when things have gone wrong.
Show notes
- Microsoft network breached through password-spraying by Russia-state hackers | Ars Technica
- Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard | MSRC Blog | Microsoft Security Response Center
- Medibank cyber attack: The weakness that saw Medibank hacker Aleksandr Ermakov exposed | Exclusive
- Russian man identified as Medibank hacker, hit with sanctions by Australian government - ABC News
- Middle District of Florida | Palm Coast Man Arrested For Wire Fraud And Aggravated Identity Theft Charges | United States Department of Justice
- SEC.gov | SECGov X Account
- Owner of BreachedForums sentenced to time served plus 20 years supervised release with special conditions
- CISA issues emergency directive for federal agencies to mitigate Ivanti vulnerabilities | Cybersecurity Dive
- Ivanti Connect Secure exploitation accelerates as Moody’s calls impact credit negative | Cybersecurity Dive
- Progress Software shakes off MOVEit’s financial consequences, maintains customers | Cybersecurity Dive
- Cyberattack on Ukraine’s largest telecom provider will cost it about $100 million
- Ransomware attacks leave small business owners feeling suicidal, report says
- Canadian Man Stuck in Triangle of E-Commerce Fraud – Krebs on Security
- Experts call for US Cyber Safety Review Board rethink • The Register
Risky Business #732 — We are CRUSHED
On this week’s SURPRISE edition, Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
- Their disappointment over last week’s SEC Twitter hack
- China rainbow-tables Airdrop
- Enterprise bugs galore…
- … and why patching fast is hard when there isn’t even a patch yet
- UEFI flaws get trad-BIOS-era vendor response
- and much, much more…
This week’s show is unsponsored, we’re just here for the fun of it.
Show notes
- The SEC’s Official X Account Was ‘Compromised’ and Used to Post Fake Bitcoin News | WIRED
- Apple AirDrop leaks user data like a sieve. Chinese authorities say they’re scooping it up. | Ars Technica
- FireChat – the messaging app that’s powering the Hong Kong protests
- End-of-life Cisco routers targeted by China’s Volt Typhoon group
- Ivanti Connect Secure attacks part of deliberate espionage operation | Cybersecurity Dive
- Ivanti Connect Secure VPN Exploitation Goes Global
- NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-6548 and CVE-2023-6549
- Aria Automation Missing Access Control Vulnerability (CVE-2023-34063)
- Security Bulletin - January 16 2024
- Stable Channel Update for Desktop
- “MyFlaw” — Cross Platform 0-Day RCE Vulnerability Discovered in Opera’s Browser
- PixieFail: Nine vulnerabilities in Tianocore's EDK II IPv6 network stack.
- LeftoverLocals: Listening to LLM responses through leaked GPU local memory
- Bigpanzi TV Botnet
- Southeast Asian casino industry supercharging cyber fraud, UN says
Risky Business #731 -- SEC Twitter hack moves Bitcoin price
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
- SEC Twitter account hack moves bitcoin price
- Kaspersky admires Triangulation hackers’ fine work
- Telcos hacked all over
- Israel hacks Iranian gasoline pumps again
- Iran up in Albania, Sudan, Egypt and Tanzania
- and much, much more…
This week’s show is brought to you by Nucleus Security. Co-founder Scott Kuffer joins us to talk about why patch management is more nuanced than just “patch fast!”
Show notes
- U.S. Securities and Exchange Commission on X: "The @SECGov X account was compromised, and an unauthorized post was posted. The SEC has not approved the listing and trading of spot bitcoin exchange-traded products." / X
- Mandiant, the security firm Google bought for $5.4 billion, gets its X account hacked | Ars Technica
- 4-year campaign backdoored iPhones using possibly the most advanced exploit ever | Ars Technica
- Spyware attack chain used previously unknown iPhone hardware feature, report says
- "Dutch engineer carried out Iranian nuclear sabotage": VK - DutchNews.nl
- Russian hackers infiltrated Ukrainian telecom giant months before cyberattack
- Ukraine telecom cyberattack one of ‘highest-impact’ hacks of the war
- Pro-Ukraine hackers claim breach of Russian internet provider
- Ukraine says Russia hacked web cameras to spy on targets in Kyiv
- Optus outage: Banks, telcos to be quizzed at Senate hearing
- A “ridiculously weak” password causes disaster for Spain’s No. 2 mobile carrier | Ars Technica
- Albanian parliament, telecom company hit by cyberattacks
- Paraguay military warns of ‘significant impact’ of ransomware after attack on internet provider
- Iran confirms nationwide cyberattack on gas stations
- Hackers disrupt Beirut airport with anti-Hezbollah message
- Telecom organizations in Africa targeted by Iran-linked hackers
- Myanmar rebels take control of ‘pig butchering’ scam city amid Chinese pressure on junta
- AlphV ransomware site is “seized” by the FBI. Then it’s “unseized.” And so on. | Ars Technica
- BreachForums administrator detained after violating parole
- Autistic teen behind spate of Lapsus$ hacks sentenced to indefinite hospital stay
- Global law enforcement seizes $300 million, arrests 3,500 involved in transnational cybercrime operation
- Toronto Zoo says it remains open after ransomware attack
- Central Bank of Lesotho facing outages after cyberattack
- Kansas City-area hospital transfers patients, reschedules appointments after cyberattack
- Cyberattack on Massachusetts hospital disrupted records system, emergency services
- LockBit claims November attack on New Jersey hospital that disrupted patient care
- First American becomes latest real estate industry giant hit with cyberattack
- Ivanti warns of critical vulnerability in its popular line of endpoint protection software | Ars Technica
- US officials say Russian targeting JetBrains servers for potential SolarWinds-style operations | Reuters
- SSH protects the world’s most sensitive networks. It just got a lot weaker | Ars Technica
- LastPass enforces 12-character master password lengths | Cybersecurity Dive
- FTC soliciting contest submissions to help tackle voice cloning technology
- Biden signs short-term FISA extension before year-end deadline
- Foone: "The 37C3 talk on TEA1 encrypti…" - Infosec Exchange
- Crypto hedge fund CEO may not exist; probe finds no record of identity | Ars Technica
Risky Business #730 -- Apple, Facebook go all in on e2ee
In this week’s edition of the show Patrick Gray and guest co-host Dmitri Alperovitch discuss:
- Major telco in Ukraine taken down by Russia
- Apple and Facebook go all in on e2ee
- Why 702 reauthorisation is looking a bit sketchy
- The USG wants your push notifications
- The year in review, plus some predictions for 2024
This week’s show is brought to you by Thinkst Canary. Haroon Meer, Thinkst’s founder, is this week’s sponsor guest. He joins us to talk about APT groups pivoting to living-off-the-land techniques.
Fler poddar
Podcasten Risky Business är skapad av Patrick Gray. Podcastens innehåll och bilderna på den här sidan hämtas med hjälp av det offentliga podcastflödet (RSS).
En liten tjänst av I'm With Friends. Finns även på engelska.