Risky Business

Risky Business #789 -- Apple's AirPlay vulns are surprisingly awful

Listen Later

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

  • British retail stalwart Marks & Spencer gets cybered
  • South Korean telco sets out to replace all its subscriber SIMs after (we assume) it lost the keymat
  • It’s a good exploit week! Bugs in Apple Airplay, SAP webservers, Erlang SSH and CommVault backups
  • Juice jacking! No, really! Some researchers actually did it (so still not in the wild, then)
  • Anti-DOGE whistleblower sure sounds like he has a point

    • This week’s episode is sponsored by Knocknoc, who let you glue your firewalls to your single sign on. Knocknoc’s CEO Adam Pointon talks about the joy that having end-to-end IPv6 would bring for zero-trust access control. He also touches on people using Knocknoc inside their network to isolate critical systems.

    Editors Note : Pat also gives Adam (Boileau) stick in the sponsor interview about the Risky Biz webserver not having IPv6 enabled, which fact-checking during the edit says is FAKE NEWS. Just uh, don’t look at how fresh that AAAA record in the DNS is, friends 😉

    This episode is also available on Youtube.

    Show notes
    • British retailer M&S confirms being hit by ‘cyber incident’ amid store delays | The Record from Recorded Future News
    • M&S cyber-attack linked to hacking group Scattered Spider | Marks & Spencer | The Guardian
    • Bina Puri shares, Warrant B close sharply lower day after hacking
    • Bina Puri, Pos Malaysia tumble following hacking incident | FMT
    • Japan warns of hundreds of millions of dollars in unauthorized trades from hacked accounts | The Record from Recorded Future News
    • US conducts cyberattacks against major Chinese commercial encryption provider: report - Global Times
    • Iran says major cyberattack on infrastructure repelled | Iran International
    • Spain rules out cyber attack - but what could have caused power cut?
    • South Korea's SK Telecom begins SIM card replacement after data breach
    • AirBorne: Wormable Zero-Click RCE in Apple AirPlay Puts Billions of Devices at Risk | Oligo Security | Oligo Security
    • iOS and Android juice jacking defenses have been trivial to bypass for years - Ars Technica
    • How Android 16's new security mode will stop USB-based attacks - Android Authority
    • Researchers warn of critical flaw found in Erlang OTP SSH | Cybersecurity Dive
    • Critical vulnerability in SAP NetWeaver under threat of active exploitation | Cybersecurity Dive
    • CVE-2025-31324: Critical SAP Flaw Explained | Strobes
    • Fire In The Hole, We’re Breaching The Vault - Commvault Remote Code Execution (CVE-2025-34028)
    • Risky Bulletin: NFC card malware keeps evolving in Russia, a bad omen for the future - Risky Business Media
    • Hegseth had unsecured internet line in Pentagon for Signal, sources say | AP News
    • Whistleblower: DOGE Siphoned NLRB Case Data – Krebs on Security
    • 2025_0414_Berulis-Disclosure-with-Exhibits.s.pdf
    • CISA gets a deputy director as it braces for major layoffs | Cybersecurity Dive
    • Two top cyber officials resign from CISA | The Record from Recorded Future News
    • Ex-CISA chief Chris Krebs leaving SentinelOne following Trump pressure | Reuters
    • Former cyber official targeted by Trump speaks out after cuts to digital defense
    • Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today's Adversaries | SentinelOne
    • ZachXBT on X: "Nine hours ago a suspicious transfer was made from a potential victim for 3520 BTC ($330.7M)"
      • ...more
      View all episodesView all episodes
      Download on the App Store
      Risky BusinessBy Patrick Gray
      • 4.6
      • 4.6
      • 4.6
      • 4.6
      • 4.6

      4.6

      353 ratings

      More shows like Risky Business

      View all
      Security Now (Audio) by TWiT

      Security Now (Audio)

      1,965 Listeners

      SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast) by Johannes B. Ullrich

      SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

      628 Listeners

      Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec by Jerry Bell and Andrew Kalat

      Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

      367 Listeners

      Hacked by Hacked

      Hacked

      179 Listeners

      CyberWire Daily by N2K Networks

      CyberWire Daily

      1,014 Listeners

      Smashing Security by Graham Cluley & Carole Theriault

      Smashing Security

      314 Listeners

      Click Here by Recorded Future News

      Click Here

      388 Listeners

      Malicious Life by Malicious Life

      Malicious Life

      927 Listeners

      Darknet Diaries by Jack Rhysider

      Darknet Diaries

      7,844 Listeners

      Cybersecurity Today by Jim Love

      Cybersecurity Today

      165 Listeners

      CISO Series Podcast by David Spark, Mike Johnson, and Andy Ellis

      CISO Series Podcast

      186 Listeners

      Hacking Humans by N2K Networks

      Hacking Humans

      313 Listeners

      Defense in Depth by David Spark, Steve Zalewski, Geoff Belknap

      Defense in Depth

      78 Listeners

      Cyber Security Headlines by CISO Series

      Cyber Security Headlines

      118 Listeners

      Risky Bulletin by risky.biz

      Risky Bulletin

      33 Listeners