Risky Business

By Risky Business MediaNews Technology Tech News

Ranking
27th
on Tech News
Favorites
201
Followers
Typical duration
61 min
per episode

Based on Podcast App listening data

Risky Business episodes

August 29, 2023Risky Business #719 -- FBI vapes 700,000 Qakbot infections
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
The FBI takes down Qakbot, steals operators’ bitcoins ha ha

Danish hosting provider completely destroyed in ransomware attack

Sophisticated Russian cyber attack on Polish trains. Well. Not really.

Microsoft revokes cert then revokes its revocation

Much, much more!
This week’s show is brought to you by Proofpoint. Ryan Kalember, Proofpoint’s EVP of cybersecurity strategy Ryan Kalember is this week’s sponsor guest.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
US says it and partners have taken down notorious 'Qakbot' hacking network | Reuters

Danish cloud host says customers ‘lost all data’ after ransomware attack | TechCrunch

VDP Platform 2022 Annual Report Showcases Platform’s Success | CISA

Proposed bill would require vulnerability disclosure policies for all federal contractors

The Cheap Radio Hack That Disrupted Poland's Railway System | WIRED

Two suspects arrested following Poland railway hack

‘Incredible concern and anger’ among Metropolitan Police after hackers breach data

New malware from North Korea’s Lazarus used against healthcare industry

North Korea’s Lazarus hackers behind recent crypto heists: FBI

US arrests Tornado Cash co-founder, sanctions another who remains at large

Kroll Employee SIM-Swapped for Crypto Investor Data – Krebs on Security

(2) Risky Biz News: WinRAR zero-day used to hack stock and crypto traders

Microsoft signing keys keep getting hijacked, to the delight of Chinese threat actors | Ars Technica

Renegade certificate removed from Windows. Then it returns. Microsoft stays silent. | Ars Technica

Barracuda ESG zero-day exploit still under way after patches fail | Cybersecurity Dive

Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868) | Mandiant

Unpacking the MOVEit Breach: Statistics and Analysis

The DEA Accidentally Sent $50,000 Of Seized Cryptocurrency To A Scammer

Akira Ransomware Targeting VPNs without Multi-Factor Authentication - Cisco Blogs

Ransomware attack dwell times fall, pressuring companies to quickly respond | Cybersecurity Dive

British court convicts two teen Lapsus$ members of hacking tech firms

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders. – Krebs on Security

Apple security updates could be banned by British government
55 min
August 22, 2023Risky Business #718 -- Chaos and carnage, business as usual
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
(NOTE: This podcast was initially pushed out into the Risky Business News podcast feed in error. Sorry about that!)
US Government warnings to private space sector on cyber risk

Ukrainian hackers dump the inbox of Russian Duma deputy chair

Absentee voting in Ecuador’s election disrupted by DDoS attack

South Korea warns of Chinese “spy chips”

Much, much more!
This week’s show is brought to you by Airlock Digital. Its co-founders Daniel Schell and David Cottingham join this week’s show to talk about Powershell Constrained Language mode.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
Risky Biz News: US warns space sector of hacks, spying, IP theft, and sabotage

Safeguarding the US Space Industry - DocumentCloud

Ukrainian hackers claim to leak emails of Russian parliament deputy chief

Feature Interview: How Sandworm prepared Ukraine for a cyber war - Risky Business

British intelligence is tipping off ransomware targets to disrupt attacks

Ecuador’s national election agency says cyberattacks caused absentee voting issues

Chinese-made 'spy chip' found in Korean state-run weather agency system : r/korea

[단독]중국산 기상장비에 ‘스파이칩’ 첫 발견 | 채널A 뉴스

Legitimate software tainted in attacks on Hong Kong organizations, report says

Chinese hackers accused of targeting Southeast Asian gambling sector

Risky Biz News: PowerShell's official package repo is a supply chain mess

Zoom’s AI terms overhaul sets stage for broader data use scrutiny | Cybersecurity Dive

Fifty minutes to hack ChatGPT: Inside the DEF CON competition to break AI | CyberScoop

Ivanti: Customers ‘impacted’ by new zero-day vulnerability

CISA, experts warn of Citrix vulnerabilities being exploited by hackers

Zero Networks Connect - Zero Networks | Contain The Next Breach

Australia’s .au domain administrator denies data breach after ransomware posting

Hackers are increasingly hiding within services such as Slack and Trello to deploy malware | CyberScoop

‘Extreme’ user abuse leads AnonFiles operators to shut down hosting service

Millions stolen from crypto platforms Exactly Protocol and Harbor Protocol

Windows feature that resets system clocks based on random data is wreaking havoc | Ars Technica

Did a Journalist Violate Hacking Law to Leak Fox News Clips? The Government Thinks He Did.
52 min
August 20, 2023 Feature Interview: How Sandworm prepared Ukraine for a cyber war
In this joint Risky Business and Geopolitics Decanted feature interview, Patrick Gray and Dmitri Alperovitch talk to Illia Vitiuk, the Head of the Department of Cyber and Information Security of the Security Service of Ukraine (SBU) about the cyber dimension to Russia’s invasion.
From turning off Ukraine’s power grid with a cyber attack in 2015 to the Viasat hack in 2022, Russia’s intelligence services are world renowned for executing creative destructive cyber campaigns. Despite this, after a year and a half of Russia waging war on Ukraine its power grid is up, its telcos are functioning and its banks are still processing transactions.
How has Ukraine been able to withstand Russia’s onslaught in the cyber domain? Vitiuk joins us to reveal insights into how Russian intelligence services are operating in Ukraine, and how the SBU is countering them.
53 min
August 15, 2023Risky Business #717 -- The kids are okay. At ripping your face off.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
More victims identified in Chinese breach of Microsoft email accounts

Cyber Safety Review Board to investigate Microsoft

We got some stuff wrong last week

More details on Viasat hack revealed

Special guest Heather Adkins talks about the CSRB’s Lapsus$ report

Much, much more
This week’s show is brought to you by RunZero. Its co-founder HD Moore is this week’s sponsor guest.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
Chinese Microsoft hackers also hit GOP Rep. Don Bacon of Nebraska - The Washington Post

US cyber board to investigate Microsoft hack of government emails | TechCrunch

Richard: "@briankrebs @metlstorm @riskyb…" - Mastodon.Radio

Mastodon.Radio

An SSRF, privileged AWS keys and the Capital One breach | by Riyaz Walikar | Appsecco

Chamber of Commerce urges SEC to delay cyber rule implementation | Cybersecurity Dive

Satellite hack on eve of Ukraine war was a coordinated, multi-pronged assault | CyberScoop

Microsoft to freeze license extensions for Russian companies

Takedown of Lolek bulletproof hosting service includes arrests, NetWalker indictment

Ransomware Diaries V. 3: LockBit's Secrets

How the FBI goes after DDoS cyberattackers | TechCrunch

Meet the Brains Behind the Malware-Friendly AI Chat Service ‘WormGPT’ – Krebs on Security

Multiple zero days found affecting crypto platforms

Lawmakers press FCC for action on Chinese-made cellular modules

Panasonic Warns That IoT Malware Attack Cycles Are Accelerating | WIRED

Rapid7 to cut 18% of workforce, shutter certain offices | Cybersecurity Dive

SecureWorks layoffs affect 15% staff | TechCrunch

Researcher says they were behind iPhone popups at Def Con | TechCrunch

Review of the Attacks Associated with LAPSUS$ and Related Threat Groups

US should crack down on SIM swapping following Lapsus$ attacks: DHS review

Kevin Collier: "Def Con is over and nobody hac…" - Infosec Exchange
1 hr 2 min
August 08, 2023Risky Business #716 -- This ain't your grandma's cloud
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
Tenable gives Microsoft a spray over Azure bug fix delay, quality

Lateral movement fun via Azure Active Directory Cross-Tenant Synchronization

Ransomware targets hospitals, special needs schools

Japan’s cybersecurity has some catching up to do

Much, much more
This week’s show is brought to you by Corelight. Brian Dye, Corelight’s CEO, is this week’s sponsor guest.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
Tenable CEO accuses Microsoft of negligence in addressing security flaw | CyberScoop

Microsoft resolves vulnerability following criticism from Tenable CEO

New Microsoft Azure AD CTS feature can be abused for lateral movement

Hackers force hospital system to take its national computer system offline

Israeli hospital redirects new patients following ransomware attack

Russia-linked cybercriminals target school for children with learning difficulties

Hackers accessed 16 years of Colorado public school student data in June ransomware attack

Marine industry giant Brunswick Corporation lost $85 million in cyberattack, CEO confirms

China hacked Japan’s classified defense cyber networks, officials say - The Washington Post

Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile Engineering Company - SentinelOne

Ukraine says it thwarted attempt to breach military tablets

The Mystery of Chernobyl’s Post-Invasion Radiation Spikes | WIRED

Radiation Spikes at Chernobyl: A Mystery Few Seem Interested in Solving

U.K. election regulator says hackers had access for over a year but elections still secure

Exclusive: DHS Used Clearview AI Facial Recognition In Thousands Of Child Exploitation Cold Cases

Eight Months Pregnant and Arrested After False Facial Recognition Match - The New York Times

New ‘Downfall’ Flaw Exposes Valuable Data in Generations of Intel Chips | WIRED

New Inception attack leaks sensitive data from all AMD Zen CPUs

Spyware maker LetMeSpy shuts down after hacker deletes server data | TechCrunch

‘Crypto couple’ pleads guilty to money laundering, as husband admits to carrying out Bitfinex hack

Google Online Security Blog: Android 14 introduces first-of-its-kind cellular connectivity security features

Risky Biz News: Russian bill will hide the PII data of military, police, and intelligence agents
56 min
August 01, 2023Risky Business #715 -- Pressure mounts on Microsoft to explain itself
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
Ron Wyden’s “please explain” letter to Microsoft

Chinese APT crews prepositioning to disrupt US military logistics

China claims US hacked its seismology sensors

Ivanti/MobileIron exploitation going vertical

Much, much more
This week’s show is brought to you by Stairwell. Mike Wiacek, Stairwell’s founder and CEO, is this week’s sponsor guest. He’s joined by Eric Foster, Stairwell’s VP of Business Development.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
Wyden letter to CISA, DOJ, FTC re 2023 Microsoft breach

Senator calls on DOJ to investigate alleged China hack of Microsoft cloud tools

U.S. Hunts Chinese Malware That Could Disrupt American Military Operations - The New York Times

Multiple Chinese APTs establish major beachheads inside sensitive infrastructure | Ars Technica

John Hultquist🌻 on Twitter: "We found this actor in land, air, and sea transportation targets which could be leveraged for a serious disruption to logistics." / X

China accuses U.S. of hacking earthquake monitoring equipment

Exclusive: Pentagon Investigates ‘Critical Compromise’ Of Air Force Communications Systems

CISA: Ivanti hacks targeting Norway began in April

US, Australia cyber agencies warn IDOR security flaws can be exploited ‘at scale’ | TechCrunch

Ivanti warns of second vulnerability used in attacks on Norway gov’t

Andrew Morris on Twitter: "Exploitation of Ivanti EPMM (MobileIron Core) CVE-2023-35078 is currently popping off https://t.co/tkRoWqvtv1 https://t.co/XOaWEZ3U3X" / X

Trail of Bits | Products

US contractor says info of up to 10 million leaked in MOVEit breach

British ambulances unable to access patient records system following cyberattack

Valid account credentials are behind most cyber intrusions, CISA finds | Cybersecurity Dive

An Unexpected Endorsement for WebAuthn | Okta Security

SEC votes to overhaul disclosure rules for material cyber events | Cybersecurity Dive

White House unveils ‘whole of society’ push to expand cybersecurity workforce

Section 702 surveillance powers are necessary, but FBI access needs limits, panel says

The NSA Is Lobbying Congress to Save a Phone Surveillance 'Loophole' | WIRED

Kazakhstan refuses to extradite detained Russian cyber expert to US

Russia Sends Cybersecurity CEO to Jail for 14 Years – Krebs on Security

Millions stolen from crypto platforms through exploited ‘Vyper’ vulnerability

A New Attack Impacts ChatGPT—and No One Knows How to Stop It | WIRED

Cloud company assisted 17 different government hacking groups, U.S. researchers say | Reuters

No evidence ransomware victims with cyber insurance pay up more often, UK report says

‘Worm-like’ botnet malware targeting popular Redis storage tool

Hackers are infecting Call of Duty players with a self-spreading malware | TechCrunch

Bug in Minecraft mods allows hackers to exploit players' devices
1 hr
July 26, 2023 Feature interview: Australia's Cyber Security Minister Clare O'Neil
In this interview Patrick Gray speaks to Australia’s Home Affairs and Cyber Security Minister Clare O’Neil and NCSC founding director Ciaran Martin about the government’s upcoming cybersecurity strategy, releasing the hounds and more.
41 min
July 25, 2023Risky Business #714 -- Microsoft vs Wiz: pistols at dawn
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
The dust-up between Microsoft and Wiz

MobileIron/Ivanti 0day hoses Norwegian government agencies

That’ll do TETRA, that’ll do…

Microsoft finally agrees to offer decent logging without price gouging

Much, much more
This week’s show is brought to you by Resoucely. Travis McPeak, Resourcely’s co-founder and CEO, is this week’s sponsor guest.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
Hackers exploited Ivanti zero-day to breach Norway’s government

Citrix zero day exposes critical infrastructure, one provider hit | Cybersecurity Dive

Interview with the ETSI Standards Organization That Created TETRA "Backdoor"

Researchers Find ‘Backdoor’ in Encrypted Police and Military Radios

Microsoft attackers may have data access beyond Outlook, researchers warn | Cybersecurity Dive

Risky Biz News: Microsoft feels the heat, gives customers access to more cloud security logs

Risky Biz News: JumpCloud compromised by APT group

North Korean hackers breached a US tech company to steal crypto | Reuters

North Korean hackers targeting JumpCloud mistakenly exposed their IP addresses, researchers say | TechCrunch

Cyberattack on GitHub customers linked to North Korean hackers, Microsoft says

Latest North Korean hack targeting cryptocurrency shows troubling evolution, experts say | CyberScoop

White House secures safety commitments from 7 AI companies | Cybersecurity Dive

Renewable technologies add risk to the US electric grid, experts warn | CyberScoop

Statement on Labor’s rush to renewables leaves Australia vulnerable to catastrophic cyber attack

Zenbleed

Firmware vulnerabilities in millions of computers could give hackers superuser status | Ars Technica

Satellites Are Rife With Basic Security Flaws | WIRED

Russia’s vast telecom surveillance system crippled by withdrawal of Western tech, report says

Apple issues third mobile OS update after zero-click spyware campaign | CyberScoop

Apple slams UK surveillance-bill proposals - BBC News

Bill that Would Stop the Government Buying Data Without a Warrant Passes Key Hurdle

Kevin Mitnick Obituary - Las Vegas, NV
1 hr 2 min
July 20, 2023 Risky Biz Soap Box: BEC actors embrace LLMs to attack Japan
This Soap Box edition of the podcast is sponsored by Proofpoint.
Proofpoint offers email security and DLP products and services, and they’re probably best known for being the biggest email security company on the planet.
That means they process a LOT of emails in the hopes of throttling the number of malicious emails that organisations have to deal with, whether that’s malware, phishing or BEC.
So, with that in mind, what role could large language models play in email security?
Now that the initial ChatGPT hype has died off a little, we spoke with Proofpoint’s VP of cybersecurity strategy Ryan Kalember about large language models and how they’re going to help defenders and attackers alike.
43 min
July 18, 2023Risky Business #713 -- Microsoft activates PR weasels after State Department hack
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:
Microsoft’s weasel-word response to the State Department email hack

JumpCloud got owned, maybe by DPRK

Citrix 0day is getting stuff rekt

Two more spyware firms sanctioned by USA

Scammers list fake phone numbers for major airlines on Google Maps

Much, much more
This week’s show is brought to you by security focussed enterprise browser maker Island. Dan Amiga, Island’s CTO and co-founder, is this week’s sponsor guest. He talks about why widespread enterprise browser deployment is inevitable.
Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.
Show notes
China-based hackers breach email accounts at State Department

Microsoft hardens key issuance systems after state-backed hackers breach Outlook accounts | Cybersecurity Dive

Microsoft takes pains to obscure role in 0-days that caused email breach | Ars Technica

Stealth Mode: Chinese Cyber Espionage Actors Continue to Evolve Tactics to Avoid Detection | Mandiant

Hackers target Pakistani government, bank and telecom provider with China-made malware

Risky Biz News: JumpCloud compromised by APT group

Exploited 0-days, an incomplete fix, and a botched disclosure: Infosec snafu reigns | Ars Technica

CISA warns of dangerous Rockwell industrial bug being exploited by gov’t group

Rockwell Automation, Honeywell warned of critical vulnerabilities in industrial products | Cybersecurity Dive

CISA gives US civilian agencies until August 1 to resolve four Microsoft vulnerabilities

Google fixes ‘Bad.Build’ vulnerability affecting Cloud Build service

White House unveils consumer labeling program to strengthen IoT security | Cybersecurity Dive

Senate bill crafted with DEA targets end-to-end encryption, requires online companies to report drug activity

Two more foreign spyware firms blacklisted by US

Phone numbers for airlines listed on Google directed to scammers

By criminals, for criminals: AI tool easily generates ‘remarkably persuasive’ fraud emails

Itamar Golan 🤓 on Twitter: "A malicious LLM-based tool known as WormGPT 🪱 is rapidly gaining traction in underground forums. This tool empowers attackers to automate sophisticated phishing and BEC (Business Email Compromise) attacks, leveraging personalized fake emails to significantly enhance success… https://t.co/fAcrYhT696" / Twitter

FCC chair proposes $200M investment to boost K-12 cybersecurity | Cybersecurity Dive

Fed ends Capital One breach-related enforcement action | Cybersecurity Dive

Norwegian Refugee Council hit by cyberattack

Belarus-linked hacks on Ukraine, Poland began at least a year ago, report says

Albania’s PM complains US is not providing country with cyberdefense funds

VirusTotal: Datenleck offenbart Kunden der Google-Sicherheitsplattform - DER SPIEGEL

Genesis Market sold to anonymous buyer despite FBI disruption
1 hr

About Risky Business

From the publisher's feed

Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for…