Risky Business #735 -- AnyDesk fails the transparency test

PLUS: CISA's executive assistant director for cybersecurity drops by...

In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:

  • Thought eels were slippery? Check out AnyDesk’s PR!
  • Why Microsoft’s 365 is a nightmare to secure
  • Cloudflare’s needlessly hostile blog post
  • US Government introduces “Disneyland ban” for spyware peddlers
  • Much, much more…

This week’s feature guest is Eric Goldstein, the executive assistant director for cybersecurity at CISA. He’s joining the show to talk about CISA’s demand that US government agencies unplug their Ivanti appliances. He also chimes in on why the US government is so rattled by Volt Typhoon and addresses a recent report from Politico that claims CISA’s Joint Cyber Defense Collaborative is a bit of a shambles.

This week’s sponsor guest is Dan Guido from Trail of Bits. He joins us to talk about their new Testing Handbook. Trail of Bits does a bunch of audit work and they’ve committed to trying to make bug discovery a one time thing – if you find that bug once, you shouldn’t have to manually find it on another client engagement. Semgrep for the win!

Risky Biz News: Two Iranian cyber groups doxed in a week

PLUS: CIA Vault7 leaker gets prison time; Gen. Haugh takes over as NSA and Cyber Command lead; AnyDesk grapples with security breach.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast click here.

Risky Biz News: Ivanti finally releases zero-day patches

PLUS: Hackers steal data on hundreds of Mexican journalists; State Farm sued because of a ransomware gang's lies; and Proofpoint and Okta lay off staff.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast click here.

Srsly Risky Biz: US data dumpster fire singes NSA

PLUS: What to do about the PRC

In this podcast Patrick Gray and Tom Uren talk about how the NSA suffered collateral damage from the US’s lax data privacy environment.

They also discuss how to respond to aggressive adversaries, how the current SEC cyber security disclosure regime is pointless and finally admit they occasionally get things wrong.

Risky Business #734 -- The number of hacked Microsoft 365 customers is skyrocketing

PLUS: Australia's assistant foreign minister Tim Watts joins the show to talk about the Ermakov sanctions...

In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:

  • More details on sanctioned Medibank hacker Aleksandr Ermakov
  • More details on alleged Scattered Spider hacker Noah Michael Urban
  • RUMINT that the number of Microsoft customers impacted by the SVR oauth/365 campaign is huge
  • Ron Wyden did something useful…
  • …then did something stupid
  • Ivanti’s clown car collides with dumpster fire
  • Much, much more

This week’s feature guest is Australia’s assistant foreign minister (and cybersecurity tragic) Tim Watts. He joins us to talk about why the Australian government sanctioned Aleksandr Ermakob.

Sublime Security founder and CEO Josh Kamdjou is this week’s sponsor guest. He joins us to talk about combating QR-code phishing.

REPOSTED: Sponsored: Talking with Island on how enterprise browsers could replace some technology stacks

Modern enterprise browsers go far beyond group policies, look to control the "last mile."

NOTE: We initially published the wrong mp3 for this episode. It has been corrected!

In this Risky Business News sponsor interview, Catalin Cimpanu talks with Bradon Rogers, Chief Customer Officer at enterprise browser Island, on how a modern enterprise browser solution like Island can be used to replace, complement, or enhance some enterprise security tools or technology stacks.

Srsly Risky Biz: How the SEC's new cyber disclosure rules are shaking out

PLUS: How private sector involvement is key for the CSRB

In this podcast Patrick Gray and Tom Uren talk about how the SEC’s new disclosure rules that mean companies have four days to report cyber security incidents once they’ve formally decided that they are material. So far, companies are very much erring on the side of caution.

They also look at the criticism of the CSRB’s board composition. Tom thinks these critiques are misguided. The cyber security landscape is so fractured that if the board were made up of faceless bureaucrats it would get very limited traction.

Risky Biz News: SVR hackers also breached HPE

PLUS: New Chinese APT caught performing AitM attacks; Ukraine hacktivists wipe Russian satellite imagery processing center; major RCE bug patched in Jenkins.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast click here.

Risky Business #733 -- Say cheese, motherf---er

Australia sanctions and doxxes the Medibank hacker, publishes webcam trophy shots...

In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news.

  • Microsoft honks its clown car horn
  • Australia’s hounds, released, catch their man
  • The beginning of the end for Scattered Spider
  • SEC was SIM swapped but had MFA off any way
  • Ivanti learns a lesson…
  • … while Progress does not
  • and much more

DHS undersecretary for policy and Cyber Safety Review Board head Rob Silvers is this week’s feature guest. He joins the show to talk about how the CSRB handles possible conflicts of interests from board members with industry day jobs.

In this week’s sponsor interview Resourcely’s founder Travis McPeak talks about why we need to help developers with “paved roads” instead of relying on dashboard products to tell us when things have gone wrong.

Risky Biz News: SVR hackers breach Microsoft

PLUS: Chinese APT secretly exploited VMWare zero-day for months; BreachForums admin sentenced; and Zloader returns

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast click here.