On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• Apple frustrates law enforcement with iOS auto-reboot
• CISA says most KEV vulnerabilities in 2023 were first used as zero days
• Russians roll incident response on some sweet Linux spookware
• Regular users can create mailboxes in M365?
• Tor tracks down the source of its joe-job abuse complaints
• And much, much more.

This week’s feature guest is former FBI agent Chris Tarbell, who arrested Silk Road operator Ross Ulbricht way back in 2013. As suggestions swirl that an incoming Trump administration might release Ulbricht, Chris talks about the reality of the Dread Pirate Roberts.

This episode is sponsored by software supply chain security firm Socket.dev. Founder Feross Aboukhadijeh thinks that we need a CVE-like catalogue for supply-chain attacks, and he makes a solid argument.

The show is also available on Youtube.

Show notes

• Jason Koebler: "New: We’ve confirmed Apple quietly introduced a feature in the new iOS that is preventing cops from hacking iPhones that they have confiscated as evidence. Apple really did say ACAB www.404media.co/apple-quietl..." — Bluesky
• Apple Quietly Introduced iPhone Reboot Code Which is Locking Out Cops
• Exclusive | U.S. Agency Warns Employees About Phone Use Amid Ongoing China Hack - WSJ
• Surge in exploits of zero-day vulnerabilities is ‘new normal’ warns Five Eyes alliance
• The Elusive GoblinRAT: How a Linux Backdoor Infiltrated Government Infrastructures
• Microsoft Bookings – Facilitating Impersonation | Cyberis Limited
• TrustedSec | EKUwu: Not just another AD CS ESC
• Russia’s internet watchdog blocks thousands of websites that use Cloudflare's privacy service
• Defending the Tor network: Mitigating IP spoofing against Tor | The Tor Project
• Law enforcement operation takes down 22,000 malicious IP addresses worldwide - Ars Technica
• Press Conference - Parliament House, Canberra | Prime Minister of Australia
• DHS nominee Kristi Noem stood alone for rejecting department cyber grants to state, local governments | CyberScoop
• Patrick Gray: "Allies will feel comfortable until these guys get fired in their first 100 days for opposing Trump’s proposed annexation of Iceland or something. People have forgotten… Trump is out of his gourd" — Bluesky

In this edition of the Risky Business Soap Box we’re talking all about email security with Sublime Security co-founder Josh Kamdjou.

Email security is one of the oldest product categories in security, but as you’ll hear, Josh thinks the incumbents are just doing it wrong. He joins Risky Business host Patrick Gray for this interview about Sublime’s origin story and its new approach to email security.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• Sophos drops implants on Chinese firewall exploit devs
• Microsoft workshops better just-in-time Windows admin privileges
• Snowflake hacker arrested in Canada
• Okta has a fun, but not very impactful auth-bypass bug
• Russians bring dumb-but-smart RDP client attacks
• And much, much more.

Special guest Sophos CISO Ross McKerchar joined us to talk about its “hacking back” campaign. The full interview is available on Youtube for those who want to really live vicariously through Sophos doing what every vendor probably wants to do.

This week’s episode is sponsored by attack surface mapping vendor runZero. Founder and CEO HD Moore joins to talk about marrying up the outside and inside views of your network.

You can also watch this episode on Youtube

Show notes

• Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory
• Does bcrypt have a maximum password length? - Information Security Stack Exchange
• Local Administrator Protection | Privilege Protection
• Inside Sophos' 5-Year War With the Chinese Hackers Hijacking Its Devices | WIRED
• A Deeper Look at FortiJump (FortiManager CVE-2024-47575) | Bishop Fox
• Man Arrested for Snowflake Hacking Spree Faces US Extradition | WIRED
• Google uses large language model to discover real-world vulnerability
• GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI
• Thousands of hacked TP-Link routers used in yearslong account takeover attacks - Ars Technica
• CISA warns of foreign threat group launching spearphishing campaign using malicious RDP files | Cybersecurity Dive
• Chinese state-backed hackers breached 20 Canadian government networks over four years, agency warns
• India-Canada row: Canadian officials confess to leaking 'intel' against India to Washington Post - India Today
• Amid diplomatic row, Canada names India in ‘cyberthreat adversary’ list, accuses it of ‘likely spying’ | World News - The Indian Express
• The Untold Story of Trump's Failed Attempt to Overthrow Venezuela's President | WIRED
• Risky Biz News: The mystery at Mango Park
• North Korean hackers seen collaborating with Play ransomware group, researchers say

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• CSRB to investigate China’s telco-wiretapping hacks
• Euro law enforcement takes down the Redline infostealer
• Someone steals Fed crypto… and then tries to quietly sneak it back in
• Russia sentences REvil guys to … jail? Really?
• Apple private cloud compute gets a proper bug bounty program
• And much, much more.

This week’s episode is sponsored by Material Security, who help navigate the mess of cloud productivity data security. Daniel Ayala - Chief Security and Trust Officer at Dotmatics - is a Material customer, and joins Pat and Material Security’s Rajan Kapoor to talk about how to wrangle securing data that ends up in corporate cloud email and file stores.

This episode is also available on Youtube.

Show notes

• Apple 10 day certificates
• Chinese hackers said to have collected audio of American calls
• U.S. Panel to Probe Cyber Failures in Massive Chinese Hack of Telecoms
• How a series of opsec failures led US authorities to the alleged developer of the Redline password-stealing malware
• Operation Magnus
• Hacker Returns $19.3 Million to Drained US Government Crypto Wallet
• Meet ZachXBT, the Masked Vigilante Tracking Down Billions in Crypto Scams and Thefts | WIRED
• Radar systems in Iran breached prior to Israel's Saturday counter-strike - report
• Delta sues CrowdStrike after widespread IT outage that caused thousands of cancellations
• Tens of thousands of taxpayer accounts hacked as CRA repeatedly paid out millions in bogus refunds
• Microsoft CEO asked board to cut pay in connection with security overhaul | Cybersecurity Dive
• Four REvil members sentenced to more than four years in prison
• Russia says it might build its own Linux community after removal of several kernel maintainers
• Nigerian court drops charges against detained Binance executive Tigran Gambaryan
• Apple will pay security researchers up to $1 million to hack its private AI cloud | TechCrunch
• SonicWall firewalls the common access point in spreading ransomware campaign | Cybersecurity Dive
• Fortinet zero-day attack spree hits at least 50 customers | Cybersecurity Dive
• Cisco warns actively exploited CVE can lead to DoS attacks against VPN services | Cybersecurity Dive
• Chinese influence operation targets US down-ballot races, Microsoft says | Reuters
• Exclusive: Accused Iranian hackers successfully peddle stolen Trump emails | Reuters
• Viral video of ripped-up Pennsylvania ballots is fake and Russian-made, intelligence agencies say
• Product Demo: Securing M365 and Google Workspace with Material Security

In this Soap Box edition of the podcast Patrick Gray chats with Thinkst Canary founder Haroon Meer about his “decade of deception”, including:

• A history of Thinkst Canary including a recap of what they actually do
• A look at why they’re still really the only major player in the deception game
• A look at what companies like Microsoft are doing with deception
• Why security startups should have conference booths

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• SEC fines tech firms for downplaying the Solarwinds hacks
• Anonymous Sudan still looks and quacks like a Russian duck
• Apple proposes max 10 day TLS certificate life
• Oopsie! Microsoft loses a bunch of cloud logs
• Veeam and Fortinet are bad and should feel bad
• North Koreans are good (at hacking)
• And much, much more.

This week’s episode is sponsored by Proofpoint. Chief Strategy Officer Ryan Kalember joins to talk about their work keeping up with prolific threat actor SocGholish.

This episode is also available on Youtube.

Show notes

• Four cyber companies fined for SolarWinds disclosure failures
• U.S. charges Sudanese men with running powerful cyberattack-for-hire gang
• Hacker Charged With Seeking to Kill Using Cyberattacks on Hospitals | WIRED
• Risky Biz News: Anonymous Sudan's Russia Links Are (Still) Obvious
• Microsoft confirms partial loss of security log data on multiple platforms | Cybersecurity Dive
• Risky Biz News: Apple wants to reduce the lifespan of TLS certificates to 10 days
• Encrypted Chat App ‘Session’ Leaves Australia After Visit From Police
• Crypto platform Radiant Capital says $50 million in digital coins stolen following account compromises
• North Korean hackers use newly discovered Linux malware to raid ATMs - Ars Technica
• Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach – Krebs on Security
• Here’s how SIM swap in alleged bitcoin pump-and-dump scheme worked - Ars Technica
• Critical Veeam CVE actively exploited in ransomware attacks | Cybersecurity Dive
• FortiGate admins report active exploitation 0-day. Vendor isn’t talking. - Ars Technica
• Hackers reportedly impersonate cyber firm ESET to target organizations in Israel
• The latest in North Korea’s fake IT worker scheme: Extorting the employers

On this week’s show Patrick Gray and Adam Boileau discuss the week’s infosec news, including:

• Chinese spooks all up in western telco lawful intercept
• Jerks ruin the Internet Archive’s day
• Microsoft drops a great report with a bad chart
• The feds make their own crypto currency and get it pumped
• Forti-, Palo- and Ivanti-fail
• And much, much more.

This week’s episode is sponsored by detection-as-code vendor Panther. Casey Hill, Panther’s Director Product Management joins to discuss why the old “just bung it all in a data lake and… ???… “ approach hasn’t worked out, and what smart teams do to handle their logs.

This episode is also available on [Youtube].(https://youtu.be/86zy6DcwtbE)

Show notes

• White House forms emergency team to deal with China espionage hack - The Washington Post
• DDoS attacks on Internet Archive continue after data breach impacting 31 million
• Microsoft Digital Defense Report 2024
• Ransomware encryption down amid surge of attacks, Microsoft says | CyberScoop
• Russian court websites down after breach claimed by pro-Ukraine hackers
• Ukrainian anti-corruption agency reportedly finds no violations in disclosures of top cyber official
• Trump campaign turns to secure hardware after hacking incident | Reuters
• FBI creates its own crypto token to nab suspects in alleged fraud scheme
• District of Massachusetts | Eighteen Individuals and Entities Charged in International Operation Targeting Widespread Fraud and Manipulation in the Cryptocurrency Markets | United States Department of Justice
• Critical CVE in 4 Fortinet products actively exploited | Cybersecurity Dive
• Fortinet FortiGate CVE-2024-23113 - A Super Complex Vulnerability In A Super Secure Appliance In 2024
• Palo Alto Expedition: From N-Day to Full Compromise
• Ivanti up against another attack spree as hackers target its endpoint manager | Cybersecurity Dive
• 1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies · GitHub
• Recently-patched Firefox bug exploited against Tor browser users
• Two never-before-seen tools, from same group, infect air-gapped devices - Ars Technica
• A Single Cloud Compromise Can Feed an Army of AI Sex Bots – Krebs on Security
• Opinion | The Cyber Sleuth - Washington Post

In this edition of Snake Oilers we hear pitches from three security vendors:

• Sandfly Security: An agentless Linux security platform that actually sounds very cool
• Permiso: An identity security platform founded by ex FireEye folks
• Wiz: The cloud security giant is getting in on code security scanning

You can watch this edition of Snake Oilers on YouTube here.

Patrick Gray and Adam Boileau discuss the week’s infosec news with everyone’s favourite ex-NSA big-brain, Rob Joyce. They talk through:

• Musk and Durov bow to government pressure
• Tiktok rushes to ban authoritarian propagandists
• The US doesn’t want Chinese software in its cars
• Kaspersky replaces itself with an AV no one has ever heard of
• Aussie police chalk up another crimephone takedown
• Press Win-R Ctrl-V to prove you’re human
• And much, much more.

This week’s show is brought to you by Stairwell, and Stairwell’s founder Mike Wiacek will be along to talk about how people are using their platform to hunt down detection resistant malware.

A video version of this episode is also available on Youtube.

Show notes

• Elon Musk backs down in his fight with Brazilian judges to restore X | Elon Musk | The Guardian
• Telegram says it will share phone numbers and IP addresses of ‘bad actors’ to authorities
• Jane Lytvynenko on X: "Ukrainian cybersecurity officials are limiting the use of Telegram for military, critical infrastructure, and other authorities. Budanov said he has “substantiated data” on Ru authorities having access to personal messages on TG, including removed ones. https://t.co/xOcnf7am9R" / X
• TikTok blocks dozens of Kremlin-backed media accounts
• Biden administration proposes rule banning Chinese, Russian connected vehicles and parts
• Some Kaspersky customers receive surprise forced-update to new antivirus software | TechCrunch
• Russian cyber firm Dr.Web says services are restored after ‘targeted cyberattack’
• Police announce takedown and arrest mastermind behind criminal comms platform 'Ghost'
• Turning Everyday Gadgets into Bombs is a Bad Idea « bunnie's blog
• Iranian-linked election interference operation shows signs of recent access | CyberScoop
• Republicans demand FBI hearing on Iran theft of Trump documents
• Ermittlungen im Darknet: Strafverfolger hebeln Tor-Anonymisierung aus | tagesschau.de
• DOJ charges hackers for stealing $230 million in crypto from individual
• This Windows PowerShell Phish Has Scary Potential – Krebs on Security
• You can now use Apple’s best iPhone Mirroring feature on your Mac and iPhone | TechRadar

On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:

• Hezbollah’s attempts to avoid SIGINT with pagers ends in explosions
• The US shines many bright lights on RT’s disinfo role
• Australia counters Chinese bullying in the Pacific
• Valid accounts are the most prevalent entry point, says CISA’s data
• Ivanti and Fortinet vie for worst vendor of the week
• Krebs writes up the shift towards charging The Com with terrorism
• And much, much more…

This week’s episode is sponsored by Push Security, who bring security visibility to where it needs to be these days – the browser. Luke Jennings joins this week’s show to discuss how phish-kit crews are driving the arms race forward, and how detection has to adapt and go where the users are.

This episode is also available on Youtube.

Show notes

• Israel planted explosives in Hezbollah's Taiwan-made pagers, sources say | Reuters
• How Hezbollah used pagers and couriers to counter Israel's high tech surveillance | Reuters
• Biden administration unveils new evidence of RT’s key role in Russian intelligence operations globally | CNN Politics
• Meta bans RT days after U.S. accused Russian outlet of disinformation
• U.S. to file charges in Trump campaign hacking case, officials say
• China suspected of hacking diplomatic body for Pacific islands region
• Chinese-made port cranes in US included 'backdoor' modems, House report says
• Stolen account info still chief risk for federal agencies, annual CISA audit finds
• Notice of Recent Security Incident | Fortinet Blog
• WordPress.org to require two-factor authentication for plugin developers | CyberScoop
• Multiple attacks force CISA to order agencies to upgrade or remove end-of-life Ivanti appliance
• Ivanti Endpoint Manager and Ivanti Endpoint Manager Security Suite and Ivanti Cloud Service Application (CSA) - End Of Life (EOL)
• The Dark Nexus Between Harm Groups and ‘The Com’ – Krebs on Security
• Feds sentence 12 crypto thieves behind SIM swaps, home invasions
• Ex-CrowdStrike employees detail rising technical errors before July outage | Semafor
• Post-CrowdStrike Fallout: Microsoft Redesigning EDR Vendor Access to Windows Kernel - SecurityWeek
• Apple seeks dismissal of its NSO Group lawsuit, citing risk of exposing ‘vital security information’
• US hits Intellexa spyware maker with more sanctions
• (1) BolivarCucuta on X: "Encuentran muerto al ciudadano israelí Yariv Bokor en Medellín En un apartamento de El Poblado, Medellín, fue encontrado sin vida el ciudadano israelí Yariv Bokor, con aparentes signos de violencia. Bokor estaba vinculado a la empresa Sandvine, la cual tiene relación con NSO https://t.co/EeY1os1omW" / X
• Instagram to bolster privacy and safety features for millions of teen users
• Mastercard buys Recorded Future for $2.65 billion | CyberScoop

On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:

• Russia’s disinformation peddlers face multifaceted sternness from the DoJ
• Telegram is now law enforcement’s bestest new pal, all of a sudden
• Iran’s banking industry arranges a payment plan for a ransom
• Columbia investigates how it sent private jets full of cash to pay for Pegasus
• Microsoft innovates with Un-Patch Tuesday
• And much, much more.

This week’s sponsor is Kroll Cyber, and one of their incident responders Paul Wells joins to discuss that one weird trick that actually helps - preparing for an incident before hand, rather than learning all those hard lessons in the middle of a crisis.

This week’s episode is also available on Youtube.

Show notes

• Risky Biz News: Doppelganger gets a kick in the butt from Uncle Sam
• Russia focusing on American social media stars to covertly influence voters | Reuters
• Russian pro-democracy nonprofit investigates alleged data breach by Kremlin-backed hackers
• Biden administration hits Russia with sanctions over efforts to manipulate U.S. opinion ahead of the election
• US hits Chinese companies with new sanctions over Russia-Ukraine war
• Elon Musk’s Starlink backtracks to comply with Brazil’s ban on X | Elon Musk | The Guardian
• Why It's So Hard to Fully Block X in Brazil | WIRED
• Durov says Telegram will tackle criticism of how it moderates content | Reuters
• Navalny allies accuse Telegram and other platforms of censorship | Economy News | Al Jazeera
• How India tamed Twitter and set a global standard for online censorship - The Washington Post
• 2 white supremacists tried to spark race war by soliciting murder and hate crimes on Telegram, feds say
• Matthew Garrett: "Why clone a yubikey when you c…" - Nondeterministic Computer
• Iran pays millions in ransom to end massive cyberattack on banks, officials say – POLITICO
• Four Delaware men charged in international sextortion scheme that netted nearly $2 million | CyberScoop
• Colombian president suggests prior administration illegally sent $11 million in cash to Israel for spyware
• Poland’s constitutional court finds commission investigating use of Pegasus spyware unconstitutional | Notes From Poland
• CISA says SonicWall bug being exploited as experts warn of ransomware gang use
• SonicWall SSLVPN access control flaw is now exploited in attacks
• Bug Left Some Windows PCs Dangerously Unpatched – Krebs on Security