Risky Business

These Soap Box podcasts are a wholly sponsored series of podcasts we do here at Risky.Biz, so everyone you hear on the Soap Box podcast paid to be here.

But that’s ok, because we’ve got some great sponsors. This podcast is brought to you by Yubico, makes of the Yubikey devices. These podcasts with Yubico have basically turned into an annual thing. Jerrod Chong is the Chief Solutions Officer at Yubico and he joined me for this conversation about what’s new in Yubico-land. They’ve launched some new stuff, including Yubikeys with lightning adapters for iOS devices, and Jerrod also talks about hardware 2FA moving increasingly to the mainstream.

If you’re reading this within 48 hours of this podcast going live, you can get yourself a $20 discount on any two of the new series 5 Yubikeys by visiting this link and using the code ‘Risky19’.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Apple jailbreakers partying in the streets

Donald Trump targets Crowdstrike over 4chan conspiracy nonsense

Ransomware absolutely everywhere this week

Horror-show VxWorks bugs are popping up in other stacks

OnApp fixes mother of all misconfigurations

More SIM card issues

Much, much more

In this week’s sponsor interview we chat with Mr Sandbox himself, VMRay’s Carsten Willems. He’s along to talk about VMRay’s involvement in a machine-learning bypass competition that happened at DEFCON earlier this year.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

In this edition of the Snake Oilers podcast host Patrick Gray speaks to:

Richard Bejtlich of Corelight

Richard talks about Zeek, formerly Bro, and how enterprises can use it to capture useful network information for analysis, forensics and detection purposes. Richard is an industry luminary and it’s a great interview.

Marshal Webb of PATH Networks

Marshal explains how new technology like eBPF and XDP mean it’s possible to build DDoS mitigation rigs out of commodity hardware. That means DDoS mitigation is about to get a whole lot cheaper, and PATH is in pole position in this soon-to-be disrupted market.

Chris Triolo from Respond Software

Respond Software makes a decision agent for the modern SOC. They are aiming to completely replace level 1 SOC analysts so those resources can be freed up to do higher-value work. They’re offering free live and retroactive trials of their software, and it definitely belongs in the “why not take it out for a spin” category.

Some links to the company websites and blogs are below!

On this week’s show Patrick and Adam discuss the week’s security news, including:

Tibetans targeted in mobile malware campaign

Iran denies cyber-attack nobody was asking about

More news from the Middle East

26 nations open UN General Assembly with statement on cyber norms

Fedex sued over company’s NotPetya response, exec share sales

Why “quantum supremacy” isn’t a big deal. Yet.

Much, much more

In this week’s sponsor interview we talk to Cody Wood of Signal Sciences about http request smuggling. What it is and why it’s a nightmare to fix.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick and Adam discuss the week’s security news, including:

US Treasury targets DPRK APT crews

Russia owned FBI counter surveillance team radio comms

New details on 2016 attack against Ukraine power grid

US Government to sue Edward Snowden for memoir profits

Did RCMP intelligence director tip Phantom Secure on investigation?

Much, much more!

This week’s sponsor interview is with Casey Ellis of Bugcrowd. It’s an interesting chat with Casey this week. He was at the Billington cyber conference a couple of weeks ago and he had a bunch of interesting discussions there with people in the aerospace sector.

Between recent Black Hat presentations on 787 security and the trouble Boeing has had with it’s 737-MAX, software security and resiliency is all of a sudden on the agenda in aerospace. Casey drops by to talk about all of that.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Paige Thompson pleads not guilty to CapitalOne hack

German government probes FinFisher

Bluekeep Metasploit module dropped

DPRK samples hit VT, courtesy of our friends in the USA

Apple releases awful statement about mass exploitation of its devices

Much more

This week’s show is brought to you by Blackberry Cylance. In this week’s sponsor interview we’ll be talking about US Cybercommand dropping some sweet, sweet APT28 samples on VirusTotal back in May. We’ll talk a little bit about that malware, and also have a more general discussion about CYBERCOM VT drops with Cylance research staffers Steve Barnes and Josh Lemos.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

The Soap Box podcast series is a fully sponsored podcast series we do here at Risky.Biz, and that means that everyone you hear in it paid to be featured.

This edition of the Soap Box podcast is brought to you by AttackIQ and in in it we talk to its CISO and VP of customer success Chris Kennedy. And we’ll be discussing a topic of that frankly should be talked about a bit more: the MITRE ATT&CK framework.

We also talk about attack simulation and which security controls are most commonly and catastrophically misconfigured. If you’re a CISO you’ll like this one.

Alex Stamos is our news co-host this week. Patrick and Alex discuss all the week’s security news, including:

Mass exploitation of iOS devices by Chinese govt

Telegram moves to nix phone number enumeration “feature”

USA targeted Iranian maritime awareness system

Existence of Stuxnet mole revealed by Kim Zetter

@jack gets hacked

Much, much more

This week’s sponsor interview is with Michelle Price of AustCyber. AustCyber is the organisation here in Australia that aims to build out the Australian cyber security industry and skills base, and Michelle pops in this week to tell us all about the upcoming Australian Cyber Week.

Links to everything are below in the show notes.

On this week’s show Adam Boileau and Patrick Gray discuss the week’s security news, including:

Fortinet, Pulse Security VPNs are being exploited in wild

Imperva’s cloud WAF gets colossally owned

US authorities fear ransomware attacks against election systems

Apple fixes re-introduced jailbreak bug

Telegram design choice puts HK protestors at risk

Researcher drops two 0days in Valve’s Steam client after bounty spat

Much, much more

This week’s sponsor guest is Ryan Kalember, EVP of cybersecurity strategy with Proofpoint. Ryan is stopping by this week to touch on a couple of topics. He’ll tell us why Proofpoint didn’t attribute a recent malware campaign targeting US utilities to APT10 despite there being some pretty APT10-like tradecraft used in that particular campaign.

He’ll also talk a bit about how thread hijacking is a giant pain in the ass. That’s where attackers take over a mailbox, then just jump right in replying to existing mail threads. Detecting that is hard, of course, because it’s internal mail. It’s a great little mixed bag interview.

Enjoy!

We used to think of companies like Bugcrowd as offering a very simple service: managed bug bounties. But these days that’s a bit too simplistic. All the “bounty” companies are offering more comprehensive and specific products these days. In this edition of the Soap Box podcast Bugcrowd CTO Casey Ellis joins the show to talk through what the future looks like in crowdsourced security. Matching individual hackers’ skills to individual gigs and launching new services like Bugcrowd for Marketplaces will be a big part of that future.