Risky Business

By Risky Business MediaNews Technology Tech News

Ranking
27th
on Tech News
Favorites
201
Followers
Typical duration
61 min
per episode

Based on Podcast App listening data

Risky Business episodes

October 24, 2023Risky Business #726 -- Okta owned while Cisco takes a massive L
On this week’s show Patrick Gray talks through the news with Dmitri
Alperovitch, NSA Cybersecurity director Rob Joyce and NSA CCC director
Morgan Adamski. They discuss:
The Okta breach

40-50k feral Ciscos

Why the http/2 protocol flaw is a real headache

The Ragnar Locker takedown

What the NSA CCC has been thinking about
This week’s show is brought to you by Socket. Socket’s founder Feross
Aboukhadijeh joins us this week to talk about their actually-not-crazy
use of large language models in their product.
Show notes
Hackers Stole Access Tokens from Okta’s Support Unit – Krebs on Security

Almost 42K Cisco IOS XE devices exploited, no patch available | Cybersecurity Dive

Critical Atlassian Confluence CVE under exploit by prolific state-linked actor | Cybersecurity Dive

JetBrains vulnerability being exploited by North Korean gov’t hackers, Microsoft says

Citrix Netscaler patch for critical CVE bypassed by malicious hackers | Cybersecurity Dive

HTTP/2 Rapid Reset: A New Protocol Vulnerability Will Haunt the Web for Years | WIRED

How North Korean Workers Tricked U.S. Companies into Hiring Them and Secretly Funneled Their Earnings into Weapons Programs

Ragnar Locker takedown

Europol: ‘Key target’ in Ragnar Locker ransomware operation arrested in Paris

Hacker accused of breaching Finnish psychotherapy center facing 30,000 counts

The US Congress Was Targeted With Predator Spyware

Lloyd’s of London finds hypothetical cyberattack could cost world economy $3.5 trillion
57 min
October 12, 2023 Risky Biz Soap Box: Preventing MFA reset attacks
Patrick Gray speaks to Yubico’s Jerrod Chong about how organisations can better verify the identities of users when performing MFA resets. In other words, how to not get MGM’d.
He also talks about the chain-of-trust issues inherent to synchronisable passkey implementations.
32 min
October 10, 2023Risky Business #725 -- Microsoft knifes VBScript, passkeys the new default for Google accounts
On this week’s show Patrick Gray and Lina Lau discuss the week’s security news. They cover:
Microsoft has killed VBScript

Google to make passkeys the new default sign-in method

MGM losses to exceed $100m

Clorox has a bad quarter

Why a bug in cURL could be really bad news

Much, much more
This week’s show is brought to you by KSOC. Jimmy Mesta, KSOC’s co-founder and CTO, is this week’s sponsor guest. He talks to us about how we can start applying real, actual IAM to Kubernetes environments.
Show notes
Deprecated features in the Windows client - What's new in Windows | Microsoft Learn

Google Makes Passkeys Default, Stepping Up Its Push to Kill Passwords | WIRED

AWS kicks off cloud race to mandate MFA by default | Cybersecurity Dive

MGM Resorts’ Las Vegas area operations to take $100M hit from cyberattack | Cybersecurity Dive

Clorox warns of quarterly loss related to August cyberattack, production delays | Cybersecurity Dive

Blackbaud agrees to $49.5 million settlement with AGs of nearly all 50 states

Cybercrime gangs now deploying ransomware within 24 hours of hacking victims

Microsoft: Human-operated ransomware attacks tripled over past year

Ukraine, Israel, South Korea top list of most-targeted countries for cyberattacks

Microsoft: State-backed hackers grow in sophistication, aggressiveness | CyberScoop

67 X accounts spread coordinated Israel-Hamas disinformation: report

John Hultquist🌻 on X: "We are currently seeing pro-Iran information operations actors promoting content across various social media channels, in favor of Hamas and critical of Israel’s response to the attacks. 1/x" / X

Hacktivism erupts in response to Hamas-Israel war | TechCrunch

‘War has no rules’: Hacktivists scorn Red Cross’ new guidelines

Joe Truzman on X: "Israeli Police Spokesperson: The Cyber Unit of the Police at Lahav 433 has frozen accounts of cryptocurrencies that served Hamas' terrorist organization to solicit donations on social networks. The Cyber Unit of Lahav 433, in cooperation with the Ministry of Defense, the…" / X

Cloud giants sound alarm on record-breaking DDoS attacks | Cybersecurity Dive

Israel's Failure to Stop the Hamas Attack Shows the Danger of Too Much Surveillance | WIRED

Edward Snowden on X: "Netanyahu nurtured a zillion-dollar industry selling spying tools to despots that use them to break into the iPhones of critics, elected opponents, human rights lawyers, and even students (these are all real examples). Turns out they're not very useful for spying on Hamas, tho.…" / X

HTTP/2 Zero-Day Vulnerability Results in Record-Breaking DDoS Attacks

NVD - CVE-2023-44487

Maintainers warn of vulnerability affecting foundational open-source tool

23andMe user data targeting Ashkenazi Jews leaked online

23andMe User Data Stolen in Credential Stuffing Attack

Thousands of WordPress sites have been hacked through tagDiv plugin vulnerability | Ars Technica

From AI with love: Scammers integrate ChatGPT into dating-app tool

Inside FTX’s All-Night Race to Stop a $1 Billion Crypto Heist | WIRED
45 min
October 03, 2023Risky Business #724 -- Exploitation moves away from Microsoft, Google and Apple products
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
Ransomware crews target WS_FTP and Jetbrains servers

Global energy supply shapes up as big target

The Dossier Center drops another banger

Indian nationalists DDoS Canadian targets

A look at the Exim drama

Much, much more
This week’s show is brought to you by Kroll Cyber. George Glass is this week’s sponsor guest.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
Multiple exploits hit Progress Software’s WS_FTP Server | Cybersecurity Dive

Progress Software discloses 8 vulnerabilities in one of its other file-transfer services | Cybersecurity Dive

Progress Software says business impact ‘minimal’ from MOVEit attack spree | Cybersecurity Dive

NEXTA on X:

Гостайна по электричеству - Досье

Russian flight booking system suffers ‘massive’ cyberattack

Cyberattacks hit military, Parliament websites as India-based group targets Canada | CBC News

NATO investigating breach, leak of internal documents | CyberScoop

Chinese hackers stole emails from US State Dept in Microsoft breach, Senate staffer says | Reuters

FBI warns energy sector of likely increase in targeting by Chinese, Russian hackers

Cisco routers abused by China-linked hackers against US, Japan companies | Cybersecurity Dive

Suspected China-based hackers target Middle Eastern telecom, Asian government

North Korean hackers posed as Meta recruiter on LinkedIn | CyberScoop

Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company

Ransomware gangs destroying data, using multiple strains during attacks: FBI

Critical vulnerabilities in Exim threaten over 250k email servers worldwide | Ars Technica

NSA is creating a hub for AI security, Nakasone says

Privacy watchdog recommends court approval for FBI searches of spy data | CyberScoop

Vulnerable Arm GPU drivers under active exploitation. Patches may not be available | Ars Technica

‘Snatch’ Ransom Group Exposes Visitor IP Addresses – Krebs on Security

IronNet, founded by former NSA director, shuts down and lays off staff | TechCrunch
55 min
September 27, 2023Risky Business #723 -- MGM and Caesars: Western youths are working with ransomware gangs
On this week’s show Patrick Gray and Dmitri Alperovitch discuss the week’s security news. They cover:
How western youths are working with Russian ransomware crews

Russia has changed its targeting in Ukraine

A massive breach of historical Russian flight information is god’s gift to OSINT orgs

Cisco buys Splunk for $28bn

Much, much more
This week’s show is brought to you by Panther. Its field CISO Ken Westin is this week’s sponsor guest.
Links to everything that we discussed are below.
Show notes
MGM Resorts says hotel, casino operations back up and running | Cybersecurity Dive

MGM Resorts warns customers of fraud as it faces class action lawsuits | Cybersecurity Dive

mgmkirwan - DocumentCloud

Cross-Tenant Impersonation: Prevention and Detection | Okta Security

'Power, influence, notoriety': The Gen-Z hackers who struck MGM, Caesars | Reuters

Youth hacking ring at the center of cybercrime spree | CyberScoop

UK logistics firm blames ransomware attack for insolvency, 730 redundancies

Philippines state health org struggling to recover from ransomware attack

Bermuda’s premier attributes system outages to ‘Russia-based’ attackers

Russian hackers target Ukrainian government systems involved in war crimes investigations

(4) Oleg Shakirov on X: "Huge data breach in Russia A previously unknown group claims it stole data from Russia's major flight booking system Sirena Travel. The whole dataset includes 665 mil entries and spans 16 years; they posted a sample with 3 mil lines. I was able to verify one flight. Looks legit" / X

Hackers break into Russian database with data on hundreds of millions of flights

Canada blames border checkpoint outages on cyberattack

Air Canada says hackers accessed limited employee records during cyberattack

3 iOS 0-days, a cellular network compromise, and HTTP used to infect an iPhone | Ars Technica

Yes, you have to update your Apple devices again, because spyware is bad | TechCrunch

GPUs from all major suppliers are vulnerable to new pixel-stealing attack | Ars Technica

CISA's catalog of must-patch vulnerabilities crosses the 1,000 bug mark after 2 years

Hong Kong crypto business Mixin says hackers stole $200 million in assets

Cisco to buy Splunk for $28B | Cybersecurity Dive

British Army general says UK now conducting ‘hunt forward’ operations

World on the Brink: How America Can Beat China in the Race for the Twenty-First Century: Alperovitch, Dmitri, Graff, Garrett M.: 9781541704091: Amazon.com: Books

Starlink in Ukraine: Why the Story Is Not So Simple | Geopolitics Decanted by Silverado
58 min
September 21, 2023Snake Oilers: Sublime Security, VulnCheck and Devicie
In this edition of Snake Oilers you’ll hear product pitches from:
Sublime Security: e-mail security for people who want to tune their detections

VulnCheck: Provides vulnerability intelligence to governments, large enterprises and vendors

Devicie: Manage your devices with Intune without pulling your hair out
Show notes
sublime.security

VulnCheck - Outpace Adversaries

Cloud-native device management platform | Devicie
40 min
September 19, 2023Risky Business #722 -- Microsoft embraces Zero Trust... Authentication?
On this week’s show Patrick Gray, Adam Boileau and Lina Lau discuss the week’s security news. They cover:
Microsoft’s 38TB oopsie

MGM’s Okta compromised, was this what Okta was warning us about?

Why we need a cyber knife fight

Google Authenticator sync abused in the wild

Much, much more
This week’s show is brought to you by Push Security. Co-founder Adam Bateman is this week’s sponsor guest.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
Microsoft AI researchers exposed sensitive signing keys, internal messages | CyberScoop

Wiz on X: "🚨 BREAKING: Wiz Research discovers a massive 38TB data leak by Microsoft AI researchers, including 30,000+ internal Teams messages. Here's what you need to know 🧵 https://t.co/2V8u9IekGV" / X

Microsoft mitigated exposure of internal information in a storage account due to overly-permissive SAS token | MSRC Blog | Microsoft Security Response Center

(6) Microsoft's Security Culture Just Isn't up to Scratch

Threat actors claim to have compromised MGM Resorts’ Okta environment | Cybersecurity Dive

MGM, Caesars attacks raise new concerns about social engineering tactics | Cybersecurity Dive

I Gambled in MGM's Hacked Casinos

‘Scattered Spider’ group launches ransomware attacks while expanding targets in hospitality, retail

MGM Resorts disruption linked to recent attacks against hospitality industry | Cybersecurity Dive

Caesars Entertainment says it was also a victim of a cyberattack

Clorox warns of product shortages a month after disclosing cyberattack | Cybersecurity Dive

DHS: Ransomware attackers headed for second most profitable year

(1) chrisrohlf on X: "I can think of multiple occasions where well respected experts assured the world that taking offensive actions would put an end to this ransomware problem. Unfortunately 1) it won’t end that easily and 2) they’re still seen as experts. This is an economics problem that is enabled…" / X

White House urging dozens of countries to publicly commit to not pay ransoms

Cyberattack on Kansas town affects email, phone, payment systems

Major trucking software provider confirms ransomware incident

Several Colombian government ministries hampered by ransomware attack

Manchester police officers’ data stolen following ransomware attack on supplier

Upstate New York nonprofit hospitals still facing issues after LockBit ransomware attack

Evidence points to North Korea in CoinEx cryptocurrency hack, analysts say

How Google Authenticator made one company’s network breach much, much worse | Ars Technica

Chinese Spies Infected Dozens of Networks With Thumb Drive Malware | WIRED

Mozilla, CISA urge users to patch Firefox security flaw

UK passes the Online Safety Bill — and no, it doesn’t ban end-to-end encryption

Exiled Russian journalist hacked using NSO Group spyware | Hacking | The Guardian

Три журналиста рассказали, что получали оповещение от Apple о хакерской атаке. Такое же приходило Галине Тимченко, в телефоне которой нашли шпионскую программу Pegasus — Meduza

War crimes tribunal ICC says it has been hacked | Reuters

XINTRA - Cybersecurity Training

CrikeyCon 2022 - Lina Lau - Inside the Persistent Mind of a Chinese APT - YouTube

SaaS attack techniques

SaaS attack matrix: The shadow workflow’s evil twin

SaaS Attack: How to SAMLjack a poisoned tenant

SAMLjacking a poisoned tenant demo - YouTube

SaaS Attacks: Shadow workflows + Evil twin integration demo - YouTube
1 hr
September 12, 2023Risky Business #721 -- Why Storm-0558's Microsoft hack should have failed
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
How Storm-0558 stole Microsoft’s signing key

Cisco 0day being used by ransomware crews

We were right about Elon stumbling into the Ukraine war

Someone’s amazing image library 0day just got crushed

Much, much more!
This week’s show is brought to you by Nucleus Security. Co-founder Scott Kuffer is this week’s sponsor guest.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
Results of Major Technical Investigations for Storm-0558 Key Acquisition | MSRC Blog | Microsoft Security Response Center

Microsoft reveals how hackers stole its email signing key… kind of | TechCrunch

Kevin Beaumont: "One extra thing to highlight -…" - Cyberplace

Preventing Authentication Bypass: A Tale of Two Researchers - YouTube

BEC phishing kit hits thousands of Microsoft 365 business accounts | Cybersecurity Dive

Microsoft Teams phishing attack pushes DarkGate malware

CISA warns of attacks using Microsoft Word, Adobe bugs

New Emergency Chrome Security Update After Critical iOS 16.6.1 Release

Mozilla patches Firefox, Thunderbird against zero-day exploited in attacks

Cisco security appliance 0-day is under attack by ransomware crooks | Ars Technica

Cisco BroadWorks vulnerability snags highest CVSS score | Cybersecurity Dive

High-profile CVEs turn up in vulnerability exploit sales | Cybersecurity Dive

MGM Resorts takes systems offline following cyberattack

Save the Children International hit with cyberattack, but says operations weren’t impacted

Sri Lankan government loses months of data following ransomware attack

(6) Risky Biz News: US and UK dox and sanction 11 more Trickbot/Conti members. Charges included too.

Opinion | The untold story of Elon Musk’s support for Ukraine - The Washington Post

Elon Musk on X:

SpaceX unveils Starshield, a military variation of Starlink satellites

China-Linked Hackers Breached a Power Grid—Again | WIRED

Just waiting for a mate - YouTube

North Korea-backed hackers target security researchers with 0-day | Ars Technica

Cars are collecting data on par with Big Tech, watchdog report finds

Crypto Town Hall on X: "Crypto Kingpin's Downfall: 11,196 Years Behind Bars!"https://t.co/1RCNJ8um4c" / X
59 min
September 07, 2023Snake Oilers: ConductorOne, Bloodhound Enterprise and Zero Networks
In this edition of Snake Oilers you’ll hear product pitches from:
ConductorOne: PAM, account cycle management and access auditing for cloud and SaaS accounts

Bloodhound Enterprise: Enumerate attack paths in your environment and shut them down

Zero Networks: Agentless: heavily automated microsegmentation and a VPN product that won’t get you insta-owned
Show notes
ConductorOne - Identity security & access control

Home - BloodHound Enterprise

Microsegmentation in a Matter of Minutes | Zero Networks
40 min
September 05, 2023Risky Business #720 -- How cloud identity provider federation features can get you mega-owned
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
Why everyone should pay attention to some recent attacks on Okta customers

Why third party comms apps are risky af

Why are Russian espionage opps using Tor for C2?

Surveillance firms abuse Fiji Telco Digicel’s SS7 access

Much, much more!
This week’s show is brought to you by Gigamon. Mark Jow, Gigamon’s EMEA Technical Director is this week’s sponsor guest.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
Cross-Tenant Impersonation: Prevention and Detection | Okta Security

BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps

NCSC-MAR-Infamous-Chisel.pdf

Ukraine says an energy facility disrupted a Fancy Bear intrusion

Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach – Krebs on Security

Telstra-owned Pacific mobile network likely exploited by spies for hire - ABC News

CISA, MITRE shore up operational tech networks with adversary emulation platform

LogicMonitor customers hit by hackers, because of default passwords | TechCrunch

Barracuda thought it drove 0-day hackers out of customers’ networks. It was wrong. | Ars Technica

Why is .US Being Used to Phish So Many of Us? – Krebs on Security

UK cyber agency announces Ollie Whitehouse as its first ever CTO

Embattled consulting firm PwC swept up in global cyber breach of file service MOVEit by cybercrime group C10p

ONLINE-SCAM-OPERATIONS-2582023.pdf

Unmasking Trickbot, One of the World’s Top Cybercrime Gangs | WIRED
57 min

About Risky Business

From the publisher's feed

Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for…