Risky Business

Risky Business #784 -- GitHub supply chain attack steals secrets from 23k projects

Listen Later

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

  • Github Actions supply chain attack loots keys and secrets from 23k projects
  • Why a VC fund now owns a minority stake in Risky Business Media (!?!?)
  • China doxes Taiwanese military hackers
  • Microsoft thinks .lnk file whitespace trick isn’t worth patching but APTs sure love it
  • CISA delivers government efficiency by re-hiring fired staff… to put them on paid leave
  • …and Google acquires Wiz for $32bn

    • This week’s show is sponsored by Zero Networks, and they have sent along a happy customer to talk about their experience. Aaron Steinke is Head of Infrastructure at La Trobe Financial, an asset management firm in Australia. Aaron talks through bringing modern zero-trust goodness to the reality of a technology environment that’s been around 40 years.

    This episode is also available on Youtube.

    Show notes
    • Risky Bulletin: GitHub supply chain attack prints everyone's secrets in build logs - Risky Business Media
    • China says Taiwan's military is behind PoisonIvy APT
    • China identifies Taiwanese hackers allegedly behind cyberattacks and espionage | The Record from Recorded Future News
    • Crypto exchange OKX shuts down tool used by North Korean hackers to launder stolen funds | The Record from Recorded Future News
    • Lazarus Group deceives developers with 6 new malicious npm packages | CyberScoop
    • Poisoned Windows shortcuts found to be a favorite of Chinese, Russian, N. Korean state hackers | The Record from Recorded Future News
    • 'Mora_001' ransomware gang exploiting Fortinet bug spotlighted by CISA in January | The Record from Recorded Future News
    • Black Basta uses brute-forcing tool to attack edge devices | Cybersecurity Dive
    • Alleged Russian LockBit developer extradited from Israel, appears in New Jersey court | The Record from Recorded Future News
    • CISA works to contact probationary employees for reinstatement after court order - Nextgov/FCW
    • ‘People Are Scared’: Inside CISA as It Reels From Trump’s Purge | WIRED
    • The Wiretap: CISA Staff Are Cautiously Optimistic About Trump’s Pick For Director
    • White House instructs agencies to avoid firing cybersecurity staff, email says | Reuters
    • Signal no longer cooperating with Ukraine on Russian cyberthreats, official says | The Record from Recorded Future News
    • Telegram CEO Pavel Durov allowed to leave France amid investigation
    • Appellate court upholds sentence for former Uber cyber executive Joe Sullivan | The Record from Recorded Future News
    • Google buys cloud security provider Wiz for $32 billion | The Record from Recorded Future News
    • Pat Gray, Founder of Risky Business, Joins Decibel as Founder Advisor - Decibel
      • ...more
      View all episodesView all episodes
      Download on the App Store
      Risky BusinessBy Patrick Gray
      • 4.6
      • 4.6
      • 4.6
      • 4.6
      • 4.6

      4.6

      352 ratings

      More shows like Risky Business

      View all
      Security Now (Audio) by TWiT

      Security Now (Audio)

      1,960 Listeners

      SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast) by Johannes B. Ullrich

      SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

      634 Listeners

      Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec by Jerry Bell and Andrew Kalat

      Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

      369 Listeners

      Hacked by Hacked

      Hacked

      176 Listeners

      CyberWire Daily by N2K Networks

      CyberWire Daily

      1,011 Listeners

      Smashing Security by Graham Cluley & Carole Theriault

      Smashing Security

      312 Listeners

      Click Here by Recorded Future News

      Click Here

      386 Listeners

      Malicious Life by Malicious Life

      Malicious Life

      923 Listeners

      Darknet Diaries by Jack Rhysider

      Darknet Diaries

      7,852 Listeners

      Cybersecurity Today by Jim Love

      Cybersecurity Today

      143 Listeners

      CISO Series Podcast by David Spark, Mike Johnson, and Andy Ellis

      CISO Series Podcast

      182 Listeners

      Hacking Humans by N2K Networks

      Hacking Humans

      308 Listeners

      Defense in Depth by David Spark, Steve Zalewski, Geoff Belknap

      Defense in Depth

      71 Listeners

      Cyber Security Headlines by CISO Series

      Cyber Security Headlines

      118 Listeners

      Risky Bulletin by risky.biz

      Risky Bulletin

      33 Listeners