Risky Business

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

The log4j bug wrap

The ransomware wrap

The human rights and surveillance industry wrap

Research and carnage wrap

This week’s show is brought to you by Airlock Digital. They make allowlisting software that has mostly been used in Windows environments, but as you’re about to hear they’ve now got a very, very nice solution for the bigger Linux distros, and their Mac agent is going to be launched in a few weeks.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

This isn’t the normal weekly news episode of the show, if you’re looking for the regular weekly Risky Business podcast, scroll one back in your podcast feed. This is a Soap Box edition, a wholly sponsored podcast brought to you in this instance by Thinkst Canary.

For those who don’t know, Thinkst makes hardware and virtual honeypots you can put on your network or into your cloud environments – they’ll start chirping if an attacker interacts with them. They’re a low cost and extremely effective detection tool. But you might not know that Thinkst also operates canarytokens.org where you can go set up a bunch of honeytokens for free. Hundreds of thousands of people are using canarytokens.org, but Thinkst doesn’t charge anything for it, it’s free to use. They’ll even give you a docker container of the whole thing so you can run it yourself.

Our guest today is Thinkst’s founder and infosec legend Haroon Meer. He spent a chunk of his career at the South African security consultancy SensePost before founding Thinkst Applied Research and eventually launching Canary.Tools. In this interview we talk about what the industry is getting wrong, supply chain security, effective detections and more. But I started off by asking him why Thinkst hasn’t tried to monetise canarytokens.org given how many people use it.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

NSO Group tools found on US embassy staff phones in Uganda

Mitto is up to shady bidnez

Ubiquiti “whistleblower” charged over hack

Hounds everywhere

Planned Parenthood breached

Much, much more

This week’s sponsor interview is with Andrew Morris of Greynoise.

Greynoise has a bunch of sensors out there on the Internets, so they can tell you when and IP that’s hitting you is also hitting everyone else. If you work in a SOC, you know this is very useful. Greynoise has just signed a $30m deal with the US Department of Defense. As Andrew will explain in just a moment, this means if you work in a DoD agency it’s now very easy for you to get a subscription. In this interview I also talk to Andrew about his adventures chasing down one of the people spamming Internet attached receipt printers with the antiwork manifesto from Reddit.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Israel slashes number of countries it will export cyber tools to

Interpol takes down 1,000 Internet fraudsters

Ransomware crews lying low?

When the tabloids do cyber the results are sometimes awesome

Much, much more…

This week’s sponsor interview is with Ryan Kalember of Proofpoint. He’s the EVP of Cybersecurity Strategy there and he’s joining me this week to talk about how investment activity in cybersecurity is basically leaving everyone who isn’t a mega enterprise behind.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Apple sues NSO Group and it’s all a bit weird

Israel charges defence minister’s house cleaner with Iranian hacker collusion (really)

USA charges two Iranians over “Proud Boy” emails

Cyber insurers nope out of comprehensive coverage

Prodaft shells Conti, drops report like it’s a Normal Thing

Much, much more

This week’s show is sponsored by VMRay. We’ll be chatting with one of VMRay’s customers in this week’s sponsor interview. Jim Byrge works on the CSIRT team at Valvoline, and he’ll be along to talk about how they replaced their ageing, in-house developed SOAR platform with commercial tools. It was still harder than it should be in 2021, but they got there in the end.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

In this edition of the Risky Biz Soap Box podcast we chat with Sean Leach, the Chief Product Architect at Fastly, about the history and current status of the DDoS ecosystem. Despite never really making money for criminals, DDoS attacks are still a problem.

CDNs have soaked up a lot of the problem, so DDoS crews are getting creative. Do you know where you’re vulnerable?

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Watering hole attacks are getting much better

How Israel’s government used NSO to strengthen its diplomatic ties

Randori sat on some PAN 0day. This is fine.

Facebook outs state-backed ops

FBi has unfortunate incident with its mail boxes

Much, much more

This week’s sponsor interview is with HD Moore. He’s the founder of Rumble, the network asset discovery scanner, and he’s joining us to talk about some new tricks he’s added to the product, like integrations with cloud service APIs and external discovery products like Censys.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

In this edition of the Soap Box podcast we’re chatting with Jake King. Jake is a co-founder of Cmd Security, a Linux Security startup that was recently acquired by Elastic.

Cmd’s technology basically started out as a control and visibility tool for Linux systems that could restrict user actions. But over time, the product evolved to be more detection and response oriented.

In this interview we talk to Jake about why Cmd wound up where it is, product wise, and what customers can expect now his company has been swept up by Elastic as a part of its broader push into XDR, or Extended Detection and Response.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

US sanctions NSO, Candiru, COSEINC and Positive Technologies

We wrap up the action in ransomware

Why exploit tournaments are boring in America and exciting in China

More malicious npm packages in the wild

Pentagon updates CMMC to 2.0

Much, much more

We’ll hear from Corelight’s CISO Bernard Brantley in this week’s sponsor interview. We’re talking about how attackers think in graphs and defenders think in lists.. Microsoft’s John Lambert wrote a post about that back in 2015, and Bernard joins the show this week to talk about why it’s just as relevant as ever. Stick around for that one.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Someone took down Iranian fuel stations

Papua New Guinea ransomware attack is pretty grim stuff

Russia’s SVR still going berserk in cloudtown

China Telecom America gets the boot

Much, much more

We’ll be hearing from Senetas CEO Andrew Wilson in this week’s sponsor interview. He’s joining us to talk about how the global semiconductor shortage is making him a very, very sad panda.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.