Sign up to save your podcasts
Or
Share Risky Business
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Risky Business
Based on Podcast App listening data
Risky Business episodes
- Risky Business #741 -- The Mintlify breach and modern supply chains
On this week’s show Patrick and Adam discuss the week’s security news, including:
- Turns out AI is still bad code review after all,
- Mintlify loses a bunch of Github tokens,
- Everything old is new again with the UDP loop DoS,
- Know-your-(recon satellite)-customer is hard,
- Microsoft takes away Russia’s powershell, solving living off the land,
- And much, much more
This week’s show is brought to you by Material Security. In this week’s sponsor interview we speak with Material’s Rajan Kapoor, VP of Customer Experience at Material. We’re also joined by Chaim Sanders, who heads Security and Privacy at Lyft.
Show notes- Anthropic’s CISO drinks the AI kool aid - backpedals frantically on security analysis claim
- Incident report on March 13, 2024 - Mintlify
- Loop DoS: New Denial-of-Service attack targets application-layer protocols
- State of IP Spoofing
- Pharmaceutical development company investigating cyberattack after LockBit posting
- Exclusive: After LockBit’s takedown, its purported leader vows to hack on
- Russian-Canadian hacker sentenced for global ransomware scheme to be extradited | CTV News
- A Suspicious Pattern Alarming the Ukrainian Military - The Atlantic
- Exclusive: Musk's SpaceX is building spy satellite network for US intelligence agency, sources say | Reuters
- Elon Musk’s SpaceX Forges Closer Ties With U.S. Spy and Military Agencies - WSJ
- Russians will no longer be able to access Microsoft cloud services, business intelligence tools
- Rostelecom blocks the SIP protocol for clients of Russian hosters / Sudo Null IT News
- Researchers spot updated version of malware that hit Viasat | CyberScoop
- Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks | Trend Micro (US)
- PRC State-Sponsored Cyber Activity: Actions for Critical Infrastructure Leaders | CISA
- US is still chasing down pieces of Chinese hacking operation, NSA official says
- 875 workers rescued in Tarlac POGO raid | Philippine News Agency
- Fujitsu says it found malware on its corporate network, warns of possible data breach | Ars Technica
- Mike Lindell must pay a Nevada man after election data dispute - The Washington Post
53 min - Risky Business #740 -- Midnight Blizzard's Microsoft hack isn't over
On this week’s show Patrick and Adam discuss the week’s security news, including:
- Weather forecast in Redmond is still for blizzards at midnight
- Maybe Change Healthcare wasn’t just crying nation-state wolf
- Hackers abuse e-prescription systems to sell drugs
- CISA goes above and beyond to relate to its constituency by getting its Ivantis owned
- VMware drinks from the Tianfu Cup
- Much, much more
This week’s feature guest is John P Carlin. He was principal associate deputy attorney general under Deputy Attorney General Lisa Monaco for about 18 months in 2021 and 2022, and also served as Robert Mueller’s chief of staff when he was FBI director.
John is joining us this week to talk about all things SEC. He wrote the recent Amicus Brief that says the SEC needs to be careful in its action against Solarwinds. He’ll also be talking to us more generally about these new SEC disclosure requirements, which are in full swing.
Rad founder Jimmy Mesta will along in this week’s sponsor segment to talk about some really interesting work they’ve done in baselining cloud workloads. It’s the sort of thing that sounds simple that really, really isn’t.
Show notes- Risky Biz News: The aftermath of Microsoft's SVR hack is rearing its ugly head
- Swindled Blackcat affiliate wants money from Change Healthcare ransom - Blog | Menlo Security
- BlackCat Ransomware Group Implodes After Apparent $22M Payment by Change Healthcare – Krebs on Security
- Change Healthcare systems expected to come back online in mid-March | Cybersecurity Dive
- LockBit takes credit for February shutdown of South African pension fund
- Ransomware gang claims to have made $3.4 million after attacking children’s hospital
- Jason D. Clinton on X: "Fully automated vulnerability research is changing the cybersecurity landscape Claude 3 Opus is capable of reading source code and identifying complex security vulnerabilities used by APTs. But scaling is still a challenge. Demo: https://t.co/UfLNGdkLp8 This is beginner-level… https://t.co/mMQb2vYln1" / X
- Jason Koebler on X: "Hackers are hacking doctors, then using their digital prescription portals to "legitimately" prescribe themselves & their customers adderall, oxy, and other prescription drugs https://t.co/6elTKQnXSB" / X
- How Hackers Dox Doctors to Order Mountains of Oxy and Adderall
- CISA forced to take two systems offline last month after Ivanti compromise
- VMware sandbox escape bugs are so critical, patches are released for end-of-life products | Ars Technica
- A Close Up Look at the Consumer Data Broker Radaris – Krebs on Security
- Brief of Amici Curiae Former Government Officials
- Securities and Exchange Commission v Solarwinds Corp
1 hr 5 min - Risky Business #739 -- ALPHV exit scams while Change Healthcare burns
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- The serious consequences from the Change Healthcare ransomware, and the need for a … nastier response
- Predator spyware maker getting a stern sanctioning
- A German military WebEx meeting gets snooped
- Mem-corrpution is still king
- And much, much more
In this week’s sponsor interview Patrick Gray speaks to Karl McGuinness, Okta’s chief architect, about some new security improvements they’ve built into their IDP.
Show notes- U.S. Air Force employee charged with giving classified information to woman he met on dating site
- Ransomware attack on U.S. health care payment processor ‘most serious incident of its kind’
- AlphV’s hit on Change Healthcare strikes a sour note for defenders | Cybersecurity Dive
- Office of Public Affairs | Justice Department Disrupts Prolific ALPHV/Blackcat Ransomware Variant | United States Department of Justice
- Developing: AlphV allegedly scammed Change Healthcare and its own affiliate (1)
- Hackers Behind the Change Healthcare Ransomware Attack Just Received a $22 Million Payment | WIRED
- Ciaran Martin on X: "“We have to find a way of making a ransom ban work” - me for @thetimes
- US launches antitrust investigation into UnitedHealth, WSJ reports | Reuters
- Brett Callow on X: "#Lockbit has de-listed Fulton County.
- Predator spyware endures even after widespread exposure, analysis shows | CyberScoop
- Predator spyware infrastructure taken down after exposure | CyberScoop
- U.S. bans maker of spyware that targeted a senator's phone
- Spyware maker NSO Group ordered to turn over Pegasus code in WhatsApp case
- Whatsapp Inc vs NSO Group
- Russia’s chief propagandist leaks intercepted German military Webex conversation
- The White House's Oddly Specific, and Really Quite Good, Software Engineering Advice
- A leaky database spilled 2FA codes for the world’s tech giants | TechCrunch
- In ConnectWise attacks, Play and LockBit ransomware exploits developed quickly | Cybersecurity Dive
- How to Secure the SaaS Apps of the Future | Okta Security
1 hr - Risky Business #738 -- LockBit is down but not out. Yet.
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- LockBit gets back up after takedown
- Russia arrests Medibank hacker… for something else
- ConnectWise gives out free updates, but customers aren’t happy
- Microsoft gives in to demands for more logs
- Sandvine gets entity-listed
- And much much more.
Dmitri Alperovitch also joins the show to discuss Starlink, Starshield and a row with Congress about its availability in Taiwan.
In this week’s sponsor interview, Airlock Digital’s Daniel Schell talks about his adventures with WDAC, and Dave Cottingham predicts Windows 12 will go all in on signed code.
Show notes- LockBit group revives operations after takedown | Cybersecurity Dive
- Lockbit ransomware group administrative staff have released a lengthy response to the FBI and bystanders
- FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga. – Krebs on Security
- Russia detains hacker behind Australia’s Medibank attack
- Russia arrests three alleged SugarLocker ransomware members
- Change Healthcare incident drags on as report pins it on ransomware group
- Ransomware Groups Are Bouncing Back Faster From Law Enforcement Busts
- ‘Alarming’ cyberattack hits Canada’s federal police, criminal investigation launched
- ConnectWise ScreenConnect faces new attacks involving LockBit ransomware | Cybersecurity Dive
- Microsoft rolls out expanded logging six months after Chinese breach | CyberScoop
- Sandvine added to US Entity List
- Earth Lusca Uses Geopolitical Lure to Target Taiwan Before Elections
- FACT SHEET: ONCD Report Calls for Adoption of Memory Safe Programming Languages and Addressing the Hard Research Problem of Software Measurability
- Risky Biz News: Backdoor code found in Tornado Cash
- House China committee demands Elon Musk open SpaceX Starshield internet to U.S. troops in Taiwan
- The UK Is GPS-Tagging Thousands of Migrants | WIRED
- How the Pentagon Learned to Use Targeted Ads to Find Its Targets—and Vladimir Putin | WIRED
- New Biden order would stem flow of Americans’ sensitive data to China - The Washington Post
56 min - Risky Business #737 -- LockBit gets absolutely rekt
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- LockBit has been taken down by law enforcement
- Some mega-juicy leaks out of Chinese offsec/APT contractor I-SOON
- GRU gets its Moobot network shutdown
- Signal adding usernames is… complicated
- Much, much more
In this week’s sponsor interview Devicie’s Tom Plant joins the show to talk about problems orgs run into when it comes to Windows policies. There’s an expectation out there that Windows policies are set and forget, but sadly, this is not so.
Show notes- Feds Seize LockBit Ransomware Websites, Offer Decryption Tools, Troll Affiliates – Krebs on Security
- Law enforcement disrupt world’s biggest ransomware operation
- Shanghai Anxun’s information is unreliable and is a trap for national government agencies.
- China spy agency renews foreign cyber intelligence warning after data breaches
- US Justice Department says it disrupted Russian intelligence hacking network | Reuters
- Several Ukrainian media outlets attacked by Russian hackers
- Polish PM says previous ruling party used Pegasus spyware against ‘very long’ list of victims
- Hackers are targeting Asian bank accounts using stolen facial recognition data
- Signal Finally Rolls Out Usernames, So You Can Keep Your Phone Number Private | WIRED
- Code injection or backdoor: A new look at Ivanti’s CVE-2021-44529
- “the "AB" trigger has similar vibes to the Unreal IRCd and ProFTPD backdoors of the same timeframe.”
- FLATLINED: ANALYZING PULSE SECURE FIRMWARE AND BYPASSING INTEGRITY CHECKING
- CVSS 10 RCE in Screen Connect
- National Security Agency Announces Retirement of Cybersecurity Director
- Hunting M365 Invaders: Navigating the Shadows of Midnight Blizzard
59 min - Soap Box: A deep dive on how Russia's SVR is hacking Microsoft 365 tenants
The need to properly secure Entra ID tenants has been made pretty obvious this year thanks to a large-scale attack on them by Russia’s SVR intelligence agency. In this interview Andy Robbins from SpecterOps, the maker of Bloodhound Enterprise, talks through how he thinks those attacks actually went down, about how if you’re an o365 customer you’re using Entra ID whether you like it or not, and about how you can lock down your Entra ID tenant.
40 min - Risky Business #736 -- Azure misconfigurations are 2024's looming threat
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- Somehow there are still more Ivanti and Fortinet exploits
- Volt Typhoon have been at it for years
- Starlink in Ukraine gets complicated
- Canadians hate poor Flipper
- Much, much more…
In this week’s sponsor interview Feross Aboukhadijeh from Socket joins the show to talk about the sheer volume of malicious packages being committed to code repositories and why older SCA tools aren’t well equipped to deal with them.
Show notes- Microsoft Azure customers hit by phishing, account takeover attacks | Cybersecurity Dive
- Ivanti publishes urgent warning about new vulnerability
- How is Pulse Secure Formed
- Attackers hit more networking gear, this time a critical Fortinet CVE | Cybersecurity Dive
- End Of General Availability of the free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)
- Coker: ONCD is studying ‘liability regimes’ for software flaws
- Chinese hackers spent 5 years in US infrastructure, ready to attack
- CISA, FBI warn of China-linked hackers pre-positioning for ‘destructive cyberattacks against US critical infrastructure’
- Russia using Starlink
- Canada declares Flipper Zero public enemy No. 1 in car-theft crackdown | Ars Technica
- Health insurance data breach affects nearly half of France’s population, privacy regulator warns
- Hackers attack 25 Romanian hospitals
- Catalin on the Rhysider ransomware decrypter going public
- A password manager LastPass calls “fraudulent” booted from App Store | Ars Technica
- From Cybercrime Saul Goodman to the Russian GRU – Krebs on Security
54 min - Soap Box: How to dismantle Volt Typhoon-style relay networks
In this Soap Box interview Greynoise founder and absolute legend Andrew Morris joins the show to talk about:
- Why Greynoise hasn’t seen a substantial drop off in Volt Typhoon’s network of compromised routers after the US Government’s takedown action
- How vendors are using Greynoise as an early warning system to identify exploitation of their products
- How he’s using large language models to reverse exploitation attempts into actual exploits
It truly is a great conversation, we hope you enjoy it!
38 min - Risky Business #735 -- AnyDesk fails the transparency test
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- Thought eels were slippery? Check out AnyDesk’s PR!
- Why Microsoft’s 365 is a nightmare to secure
- Cloudflare’s needlessly hostile blog post
- US Government introduces “Disneyland ban” for spyware peddlers
- Much, much more…
This week’s feature guest is Eric Goldstein, the executive assistant director for cybersecurity at CISA. He’s joining the show to talk about CISA’s demand that US government agencies unplug their Ivanti appliances. He also chimes in on why the US government is so rattled by Volt Typhoon and addresses a recent report from Politico that claims CISA’s Joint Cyber Defense Collaborative is a bit of a shambles.
This week’s sponsor guest is Dan Guido from Trail of Bits. He joins us to talk about their new Testing Handbook. Trail of Bits does a bunch of audit work and they’ve committed to trying to make bug discovery a one time thing – if you find that bug once, you shouldn’t have to manually find it on another client engagement. Semgrep for the win!
Show notes- AnyDesk initiates extensive credentials reset following cyberattack | Cybersecurity Dive
- AnyDesk says software ‘safe to use’ after cyberattack
- Former CIA officer who gave WikiLeaks state secrets gets 40-year sentence
- Arrests in $400M SIM-Swap Tied to Heist at FTX? – Krebs on Security
- Microsoft Breach — What Happened? What Should Azure Admins Do? | by Andy Robbins | Feb, 2024 | Posts By SpecterOps Team Members
- Cloudflare hit by follow-on attack from previous Okta breach | Cybersecurity Dive
- Thanksgiving 2023 security incident
- US announces visa restriction policy targeting spyware abuses
- Announcement of a Visa Restriction Policy to Promote Accountability for the Misuse of Commercial Spyware - United States Department of State
- Deputy Prime Minister hosts first global conference targeting ‘hackers for hire’ and malicious use of commercial cyber tools - GOV.UK
- New Google TAG report: How Commercial Surveillance Vendors work
- A Startup Allegedly ‘Hacked the World.’ Then Came the Censorship—and Now the Backlash | WIRED
- American businessman settles hacking case in UK against law firm
- Crime bosses behind Myanmar cyber ‘fraud dens’ handed over to Chinese government
- Another Chicago hospital announces cyberattack
- Deepfake scammer walks off with $25 million in first-of-its-kind AI heist | Ars Technica
- As if 2 Ivanti vulnerabilities under exploit weren’t bad enough, now there are 3 | Ars Technica
- Two new Ivanti bugs discovered as CISA warns of hackers bypassing mitigations
- Agencies using vulnerable Ivanti products have until Saturday to disconnect them | Ars Technica
- The far right is scaring away Washington's private hacker army - POLITICO
- Our thoughts on AIxCC’s competition format | Trail of Bits Blog
- How CISA can improve OSS security | Trail of Bits Blog
- Securing open-source infrastructure with OSTIF | Trail of Bits Blog
- Announcing the Trail of Bits Testing Handbook | Trail of Bits Blog
- 30 new Semgrep rules: Ansible, Java, Kotlin, shell scripts, and more | Trail of Bits Blog
- Publishing Trail of Bits’ CodeQL queries | Trail of Bits Blog
- The Unguarded Moment (2002 Digital Remaster) - YouTube
- Boy Swallows Universe | Official Trailer | Netflix - YouTube
1 hr 3 min - Risky Business #734 -- The number of hacked Microsoft 365 customers is skyrocketing
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
- More details on sanctioned Medibank hacker Aleksandr Ermakov
- More details on alleged Scattered Spider hacker Noah Michael Urban
- RUMINT that the number of Microsoft customers impacted by the SVR oauth/365 campaign is huge
- Ron Wyden did something useful…
- …then did something stupid
- Ivanti’s clown car collides with dumpster fire
- Much, much more
This week’s feature guest is Australia’s assistant foreign minister (and cybersecurity tragic) Tim Watts. He joins us to talk about why the Australian government sanctioned Aleksandr Ermakob.
Sublime Security founder and CEO Josh Kamdjou is this week’s sponsor guest. He joins us to talk about combating QR-code phishing.
Show notes- Exclusive: US disabled Chinese hacking network targeting critical infrastructure | Reuters
- Medibank’s Attacker: IT Businessman, Claimed Psychologist… | Intel471
- Who is Alleged Medibank Hacker Aleksandr Ermakov? – Krebs on Security
- Fla. Man Charged in SIM-Swapping Spree is Key Suspect in Hacker Groups Oktapus, Scattered Spider – Krebs on Security
- Microsoft says Russian hackers also targeted other organizations | TechCrunch
- HPE hit by a monthslong cyberattack on its cloud-based email | Cybersecurity Dive
- (99+) Microsoft's Dangerous Addiction To Security Revenue | LinkedIn
- Microsoft critics accuse the firm of ‘negligence’ in latest breach | CyberScoop
- N.S.A. Buys Americans’ Internet Data Without Warrants, Letter Says - The New York Times
- Trading platform EquiLend down following cyberattack | Cybersecurity Dive
- Ivanti Connect Secure zero-day patches delayed | Cybersecurity Dive
- Popular CI/CD tool Jenkins discloses critical CVE | Cybersecurity Dive
- MOVEit liabilities mount for Progress Software | Cybersecurity Dive
- Tim Watts bio:
- Pennywise - Down Under [Men at Work Cover] - YouTube
1 hr 3 min
About Risky Business
From the publisher's feed
Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for…
information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.
Best of Risky Business
Ranked by our users in the last 21 days
More shows like Risky Business
Hacked
189 Listeners
Security Now (Audio)
2,008 Listeners
Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec
373 Listeners
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
650 Listeners
CyberWire Daily
1,025 Listeners
Smashing Security
318 Listeners
Click Here
417 Listeners
Darknet Diaries
8,064 Listeners
Cybersecurity Today
178 Listeners
Hacking Humans
314 Listeners
CISO Series Podcast
193 Listeners
Defense in Depth
73 Listeners
Cybersecurity Headlines
138 Listeners
Risky Bulletin
47 Listeners
Hacker And The Fed
167 Listeners