Episodes

  • Risky Business #768 -- CSRB will investigate China's Wiretap Hacks

    Risky Business #768 -- CSRB will investigate China's Wiretap Hacks
    Oct 30 2024
    On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including: CSRB to investigate China’s telco-wiretapping hacksEuro law enforcement takes down the Redline infostealerSomeone steals Fed crypto… and then tries to quietly sneak it back inRussia sentences REvil guys to … jail? Really?Apple private cloud compute gets a proper bug bounty programAnd much, much more. This week’s episode is sponsored by Material Security, who help navigate the mess of cloud productivity data security. Daniel Ayala - Chief Security and Trust Officer at Dotmatics - is a Material customer, and joins Pat and Material Security’s Rajan Kapoor to talk about how to wrangle securing data that ends up in corporate cloud email and file stores. This episode is also available on Youtube. Show notes Apple 10 day certificates Chinese hackers said to have collected audio of American calls U.S. Panel to Probe Cyber Failures in Massive Chinese Hack of Telecoms How a series of opsec failures led US authorities to the alleged developer of the Redline password-stealing malware Operation Magnus Hacker Returns $19.3 Million to Drained US Government Crypto Wallet Meet ZachXBT, the Masked Vigilante Tracking Down Billions in Crypto Scams and Thefts | WIRED Radar systems in Iran breached prior to Israel's Saturday counter-strike - report Delta sues CrowdStrike after widespread IT outage that caused thousands of cancellations Tens of thousands of taxpayer accounts hacked as CRA repeatedly paid out millions in bogus refunds Microsoft CEO asked board to cut pay in connection with security overhaul | Cybersecurity Dive Four REvil members sentenced to more than four years in prison Russia says it might build its own Linux community after removal of several kernel maintainers Nigerian court drops charges against detained Binance executive Tigran Gambaryan Apple will pay security researchers up to $1 million to hack its private AI cloud | TechCrunch SonicWall firewalls the common access point in spreading ransomware campaign | Cybersecurity Dive Fortinet zero-day attack spree hits at least 50 customers | Cybersecurity Dive Cisco warns actively exploited CVE can lead to DoS attacks against VPN services | Cybersecurity Dive Chinese influence operation targets US down-ballot races, Microsoft says | Reuters Exclusive: Accused Iranian hackers successfully peddle stolen Trump emails | Reuters Viral video of ripped-up Pennsylvania ballots is fake and Russian-made, intelligence agencies say Product Demo: Securing M365 and Google Workspace with Material Security
    Show more Show less
    52 mins
  • Risky Biz Soap Box: Thinkst Canary's decade of deception

    Risky Biz Soap Box: Thinkst Canary's decade of deception
    Oct 28 2024

    In this Soap Box edition of the podcast Patrick Gray chats with Thinkst Canary founder Haroon Meer about his “decade of deception”, including:

    • A history of Thinkst Canary including a recap of what they actually do
    • A look at why they’re still really the only major player in the deception game
    • A look at what companies like Microsoft are doing with deception
    • Why security startups should have conference booths
    Show more Show less
    38 mins
  • Risky Business #767 – SEC fines Check Point, Mimecast, Avaya and Unisys over hacks

    Risky Business #767 – SEC fines Check Point, Mimecast, Avaya and Unisys over hacks
    Oct 23 2024

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

    • SEC fines tech firms for downplaying the Solarwinds hacks
    • Anonymous Sudan still looks and quacks like a Russian duck
    • Apple proposes max 10 day TLS certificate life
    • Oopsie! Microsoft loses a bunch of cloud logs
    • Veeam and Fortinet are bad and should feel bad
    • North Koreans are good (at hacking)
    • And much, much more.

    This week’s episode is sponsored by Proofpoint. Chief Strategy Officer Ryan Kalember joins to talk about their work keeping up with prolific threat actor SocGholish.

    This episode is also available on Youtube.

    Show notes
    • Four cyber companies fined for SolarWinds disclosure failures
    • U.S. charges Sudanese men with running powerful cyberattack-for-hire gang
    • Hacker Charged With Seeking to Kill Using Cyberattacks on Hospitals | WIRED
    • Risky Biz News: Anonymous Sudan's Russia Links Are (Still) Obvious
    • Microsoft confirms partial loss of security log data on multiple platforms | Cybersecurity Dive
    • Risky Biz News: Apple wants to reduce the lifespan of TLS certificates to 10 days
    • Encrypted Chat App ‘Session’ Leaves Australia After Visit From Police
    • Crypto platform Radiant Capital says $50 million in digital coins stolen following account compromises
    • North Korean hackers use newly discovered Linux malware to raid ATMs - Ars Technica
    • Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach – Krebs on Security
    • Here’s how SIM swap in alleged bitcoin pump-and-dump scheme worked - Ars Technica
    • Critical Veeam CVE actively exploited in ransomware attacks | Cybersecurity Dive
    • FortiGate admins report active exploitation 0-day. Vendor isn’t talking. - Ars Technica
    • Hackers reportedly impersonate cyber firm ESET to target organizations in Israel
    • The latest in North Korea’s fake IT worker scheme: Extorting the employers
    Show more Show less
    1 hr and 2 mins
  • Risky Business #766 – China hacks America's lawful intercept systems

    Risky Business #766 – China hacks America's lawful intercept systems
    Oct 16 2024

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s infosec news, including:

    • Chinese spooks all up in western telco lawful intercept
    • Jerks ruin the Internet Archive’s day
    • Microsoft drops a great report with a bad chart
    • The feds make their own crypto currency and get it pumped
    • Forti-, Palo- and Ivanti-fail
    • And much, much more.

    This week’s episode is sponsored by detection-as-code vendor Panther. Casey Hill, Panther’s Director Product Management joins to discuss why the old “just bung it all in a data lake and… ???… “ approach hasn’t worked out, and what smart teams do to handle their logs.

    This episode is also available on [Youtube].(https://youtu.be/86zy6DcwtbE)

    Show notes
    • White House forms emergency team to deal with China espionage hack - The Washington Post
    • DDoS attacks on Internet Archive continue after data breach impacting 31 million
    • Microsoft Digital Defense Report 2024
    • Ransomware encryption down amid surge of attacks, Microsoft says | CyberScoop
    • Russian court websites down after breach claimed by pro-Ukraine hackers
    • Ukrainian anti-corruption agency reportedly finds no violations in disclosures of top cyber official
    • Trump campaign turns to secure hardware after hacking incident | Reuters
    • FBI creates its own crypto token to nab suspects in alleged fraud scheme
    • District of Massachusetts | Eighteen Individuals and Entities Charged in International Operation Targeting Widespread Fraud and Manipulation in the Cryptocurrency Markets | United States Department of Justice
    • Critical CVE in 4 Fortinet products actively exploited | Cybersecurity Dive
    • Fortinet FortiGate CVE-2024-23113 - A Super Complex Vulnerability In A Super Secure Appliance In 2024
    • Palo Alto Expedition: From N-Day to Full Compromise
    • Ivanti up against another attack spree as hackers target its endpoint manager | Cybersecurity Dive
    • 1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies · GitHub
    • Recently-patched Firefox bug exploited against Tor browser users
    • Two never-before-seen tools, from same group, infect air-gapped devices - Ars Technica
    • A Single Cloud Compromise Can Feed an Army of AI Sex Bots – Krebs on Security
    • Opinion | The Cyber Sleuth - Washington Post
    Show more Show less
    54 mins
  • Snake Oilers: Sandfly Security, Permiso and Wiz

    Snake Oilers: Sandfly Security, Permiso and Wiz
    Oct 1 2024

    In this edition of Snake Oilers we hear pitches from three security vendors:

    • Sandfly Security: An agentless Linux security platform that actually sounds very cool
    • Permiso: An identity security platform founded by ex FireEye folks
    • Wiz: The cloud security giant is getting in on code security scanning

    You can watch this edition of Snake Oilers on YouTube here.
    Show more Show less
    40 mins
  • Risky Business #765 -- The Kaspersky switcheroo

    Risky Business #765 -- The Kaspersky switcheroo
    Sep 25 2024

    Patrick Gray and Adam Boileau discuss the week’s infosec news with everyone’s favourite ex-NSA big-brain, Rob Joyce. They talk through:

    • Musk and Durov bow to government pressure
    • Tiktok rushes to ban authoritarian propagandists
    • The US doesn’t want Chinese software in its cars
    • Kaspersky replaces itself with an AV no one has ever heard of
    • Aussie police chalk up another crimephone takedown
    • Press Win-R Ctrl-V to prove you’re human
    • And much, much more.

    This week’s show is brought to you by Stairwell, and Stairwell’s founder Mike Wiacek will be along to talk about how people are using their platform to hunt down detection resistant malware.

    A video version of this episode is also available on Youtube.

    Show notes
    • Elon Musk backs down in his fight with Brazilian judges to restore X | Elon Musk | The Guardian
    • Telegram says it will share phone numbers and IP addresses of ‘bad actors’ to authorities
    • Jane Lytvynenko on X: "Ukrainian cybersecurity officials are limiting the use of Telegram for military, critical infrastructure, and other authorities. Budanov said he has “substantiated data” on Ru authorities having access to personal messages on TG, including removed ones. https://t.co/xOcnf7am9R" / X
    • TikTok blocks dozens of Kremlin-backed media accounts
    • Biden administration proposes rule banning Chinese, Russian connected vehicles and parts
    • Some Kaspersky customers receive surprise forced-update to new antivirus software | TechCrunch
    • Russian cyber firm Dr.Web says services are restored after ‘targeted cyberattack’
    • Police announce takedown and arrest mastermind behind criminal comms platform 'Ghost'
    • Turning Everyday Gadgets into Bombs is a Bad Idea « bunnie's blog
    • Iranian-linked election interference operation shows signs of recent access | CyberScoop
    • Republicans demand FBI hearing on Iran theft of Trump documents
    • Ermittlungen im Darknet: Strafverfolger hebeln Tor-Anonymisierung aus | tagesschau.de
    • DOJ charges hackers for stealing $230 million in crypto from individual
    • This Windows PowerShell Phish Has Scary Potential – Krebs on Security
    • You can now use Apple’s best iPhone Mirroring feature on your Mac and iPhone | TechRadar
    Show more Show less
    1 hr and 6 mins
  • Risky Business #764 -- Mossad expands into telecommunications services

    Risky Business #764 -- Mossad expands into telecommunications services
    Sep 18 2024
    On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including: Hezbollah’s attempts to avoid SIGINT with pagers ends in explosionsThe US shines many bright lights on RT’s disinfo roleAustralia counters Chinese bullying in the PacificValid accounts are the most prevalent entry point, says CISA’s dataIvanti and Fortinet vie for worst vendor of the weekKrebs writes up the shift towards charging The Com with terrorismAnd much, much more… This week’s episode is sponsored by Push Security, who bring security visibility to where it needs to be these days – the browser. Luke Jennings joins this week’s show to discuss how phish-kit crews are driving the arms race forward, and how detection has to adapt and go where the users are. This episode is also available on Youtube. Show notes Israel planted explosives in Hezbollah's Taiwan-made pagers, sources say | Reuters How Hezbollah used pagers and couriers to counter Israel's high tech surveillance | Reuters Biden administration unveils new evidence of RT’s key role in Russian intelligence operations globally | CNN Politics Meta bans RT days after U.S. accused Russian outlet of disinformation U.S. to file charges in Trump campaign hacking case, officials say China suspected of hacking diplomatic body for Pacific islands region Chinese-made port cranes in US included 'backdoor' modems, House report says Stolen account info still chief risk for federal agencies, annual CISA audit finds Notice of Recent Security Incident | Fortinet Blog WordPress.org to require two-factor authentication for plugin developers | CyberScoop Multiple attacks force CISA to order agencies to upgrade or remove end-of-life Ivanti appliance Ivanti Endpoint Manager and Ivanti Endpoint Manager Security Suite and Ivanti Cloud Service Application (CSA) - End Of Life (EOL) The Dark Nexus Between Harm Groups and ‘The Com’ – Krebs on Security Feds sentence 12 crypto thieves behind SIM swaps, home invasions Ex-CrowdStrike employees detail rising technical errors before July outage | Semafor Post-CrowdStrike Fallout: Microsoft Redesigning EDR Vendor Access to Windows Kernel - SecurityWeek Apple seeks dismissal of its NSO Group lawsuit, citing risk of exposing ‘vital security information’ US hits Intellexa spyware maker with more sanctions (1) BolivarCucuta on X: "Encuentran muerto al ciudadano israelí Yariv Bokor en Medellín En un apartamento de El Poblado, Medellín, fue encontrado sin vida el ciudadano israelí Yariv Bokor, con aparentes signos de violencia. Bokor estaba vinculado a la empresa Sandvine, la cual tiene relación con NSO https://t.co/EeY1os1omW" / X Instagram to bolster privacy and safety features for millions of teen users Mastercard buys Recorded Future for $2.65 billion | CyberScoop
    Show more Show less
    1 hr and 3 mins
  • Risky Business #763 – Microsoft un-patches critical bug

    Risky Business #763 – Microsoft un-patches critical bug
    Sep 11 2024
    On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including: Russia’s disinformation peddlers face multifaceted sternness from the DoJTelegram is now law enforcement’s bestest new pal, all of a suddenIran’s banking industry arranges a payment plan for a ransomColumbia investigates how it sent private jets full of cash to pay for PegasusMicrosoft innovates with Un-Patch TuesdayAnd much, much more. This week’s sponsor is Kroll Cyber, and one of their incident responders Paul Wells joins to discuss that one weird trick that actually helps - preparing for an incident before hand, rather than learning all those hard lessons in the middle of a crisis. This week’s episode is also available on Youtube. Show notes Risky Biz News: Doppelganger gets a kick in the butt from Uncle SamRussia focusing on American social media stars to covertly influence voters | ReutersRussian pro-democracy nonprofit investigates alleged data breach by Kremlin-backed hackersBiden administration hits Russia with sanctions over efforts to manipulate U.S. opinion ahead of the electionUS hits Chinese companies with new sanctions over Russia-Ukraine warElon Musk’s Starlink backtracks to comply with Brazil’s ban on X | Elon Musk | The GuardianWhy It's So Hard to Fully Block X in Brazil | WIREDDurov says Telegram will tackle criticism of how it moderates content | ReutersNavalny allies accuse Telegram and other platforms of censorship | Economy News | Al JazeeraHow India tamed Twitter and set a global standard for online censorship - The Washington Post2 white supremacists tried to spark race war by soliciting murder and hate crimes on Telegram, feds sayMatthew Garrett: "Why clone a yubikey when you c…" - Nondeterministic ComputerIran pays millions in ransom to end massive cyberattack on banks, officials say – POLITICOFour Delaware men charged in international sextortion scheme that netted nearly $2 million | CyberScoopColombian president suggests prior administration illegally sent $11 million in cash to Israel for spywarePoland’s constitutional court finds commission investigating use of Pegasus spyware unconstitutional | Notes From PolandCISA says SonicWall bug being exploited as experts warn of ransomware gang useSonicWall SSLVPN access control flaw is now exploited in attacksBug Left Some Windows PCs Dangerously Unpatched – Krebs on Security
    Show more Show less
    52 mins