Srsly Risky Biz: China's superstar hackers

PLUS: Why the JCDC should be put out to pasture

In this podcast Tom Uren and Patrick Gray talk about a new report that explores how China’s vulnerability discovery and research ecosystem is linked to state sponsored espionage. This research finds that a relatively small number of people are responsible for an outsize contribution to vulnerability discovery.

They also talk about difficulties at CISA’s Joint Cyber Defence Collaborative initiative and why it should be retired.

Risky Business #752 -- Apple announcements thrill and terrify at the same time

PLUS: Ex-NSA boffin Rob Joyce joins for the news

On this week’s show Patrick Gray and Adam Boileau are joined by long-time NSA boffin Rob Joyce. Now Rob’s left the government service, he’s hobnobbing with us pundits, talking through the week’s news:

  • Apple announces a big leap for confidential cloud computing into the mass market
  • While at the same time, letting you just mosey around your iPhone from your Mac
  • Mandiant reports in about the Snowflake breach
  • Moody’s say credit ratings might consider cyber incidents
  • Microsoft fixes an Azure flaw with a… “comprehensive documentation update”
  • And much, much more.

This week’s show is sponsored by Yubico, maker of the Yubikey hardware authentication token. Jerrod Chong, Yubico’s COO and President joins to talk about the challenges of the passkey and hardware authenticator ecosystem.

Risky Biz News: Apple launches private cloud for AI workloads

PLUS: Ransomware gang goes after PHP servers; Chinese hackers breached 20k Fortinet devices; White House launches cybersecurity support for rural hospitals.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Between Two Nerds: The cyber Rorschach test

Lessons from Russia's cyber war

In this edition of Between Two Nerds Tom Uren and The Grugq talk about how the use of cyber operations in Ukraine is informative but information is incomplete. Rather than clarifying the role of cyber operations in conventional warfare there is still a lot of room for confirmation bias.

Risky Biz News: Microsoft relents on Windows 11 Recall

PLUS: Apple to add a password manager; DJI to disable flight data syncing for US drones; another stalkerware app gets hacked.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Sponsored: Panther on how the market is moving towards detection engineers

How Panther excels at spotting initial account compromise.

In this Risky Business News sponsor interview, Catalin Cimpanu talks with Panther Senior Engineering Manager Nicholas Hakmiller on how the IT market is adapting to the cybersecurity skill shortage by training regular software talent in detection engineering, how AI is not there yet, and how Panther excels at spotting initial account compromise.

Risky Biz News: Interpol plugs Red Notices leak

PLUS: Kaspersky says Apple didn't pay a bounty for Triangulation report; Medibank faces monumental fine; CISA gets the green light to enrich CVEs

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Srsly Risky Biz: Russian attacks on Europe double

Does disinformation come from a position of strength or weakness?

In this podcast Tom Uren and Patrick Gray talk about Russia’s escalating actions in Europe in the lead up to elections and the Paris Olympics. They combine disruptive cyber elements, disinformation and real-world covert action.

Risky Business #751 -- Snowflake, operation Endgame and Microsoft's looming FTC problem

PLUS: Joseph Cox joins the show to talk about his new book, Dark Wire...

On this week’s show Patrick Gray and Mark Piper discuss the week’s security news, including:

  • What on earth happened at Snowflake?
  • A look at operation Endgame
  • Check Point’s hilarious adventures with dot dot slash
  • Report says the FTC is looking at Microsoft’s security product bundling
  • More ransomware hits Russia
  • Much, much more

404 Media co-founder Joseph Cox is this week’s feature guest. He joins us to talk about his new book, Dark Wire, which is all about the FBI’s Anom sting.

This week’s show is brought to you by Resourcely. If your Terraform is a mess or your CSPM dashboards are lighting up with insane and stupid things, you should check out Resourcely. Its founder and CEO Travis McPeak will be along in this week’s sponsor interview to talk about all things Terraform.

Risky Biz News: Making Linux a CNA was a bad decision

PLUS: TikTok zero-day used to hack high-profile accounts; mysterious new APT targets China; Hungary's ruling party boycotts Russian hack investigation.

A short podcast updating listeners on the security news of the last few days, prepared by Catalin Cimpanu and read by Claire Aird.

Sponsored: Nucleus Security on vulnerability management trends, SLAs

Scott Kuffer talks about the interesting effect of SLAs on patch management

In this Risky Business News sponsor interview, Catalin Cimpanu talks with Nucleus Security co-founder and COO Scott Kuffer about recent trends the company has observed among customers when it came to patch management and how service level agreements (SLAs) became a sign of an organization’s security health.

Risky Biz News: Law enforcement disrupts six malware botnets

PLUS: Check Point patches zero-day; ISP loses 600,000 in data-wiping attack; Poland's secret surveillance program deemed illegal.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Srsly Risky Biz: Cyber Command is a half-ripe melon

PLUS: TikTok's influence report too little too late

In this podcast Tom Uren and Patrick Gray talk about continued discussion about the creation of a Cyber Force. It’s a discussion that won’t go away and shows there is an underlying feeling that Cyber Command could do better.

They also discuss how Scattered Spider is like Hollywood and how TikTok’s report on influence campaigns will do nothing to convince people it is not a national security risk.

Risky Business #750 -- Why Microsoft's Recall is an attacker's best friend

PLUS: Russian logistics firm stung by ransomware…

On this week’s show Patrick and Adam discuss the week’s security news, including:

  • Russian delivery company gets ransomware-wiper’d
  • A supply-chain attack targets video software used in US courts
  • Checkpoint firewalls get hacked, details as clear as mud
  • Microsoft Recall delights hackers
  • Aussie telco Optus gets told its IR report isn’t legal advice
  • Cyber insurer says you’re 5x more likely to get rekt if you have a Cisco ASA
  • And much, much more.

This week’s episode is sponsored by Kroll Cyber. Alex Cowperthwaite, Kroll’s technical director research and development for offence joins to talk about how his team attacks AI models, in ways both classic and new.

Risky Biz News: MediSecure asks for a government bailout; denied!

PLUS: US sanctions Chinese nationals behind proxy botnet; Check Point VPNs are under attack; FBI estimates Scattered Spider membership at 1K members.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Between Two Nerds: Ransomware and the state

It is just like World War I

In this edition of Between Two Nerds Tom Uren and The Grugq talk about the role of the state in tackling ransomware. They discuss why action has been slow and ineffective, and what it will take to truly change the situation.

Risky Biz News: Google throws out GlobalTrust certs

PLUS: Spyware vendor pcTattletale hacked; South Africa suspends child maintenance payments after hack; Russian IAB charged in the US.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Sponsored: Why directory services are always a dog's breakfast

SpecterOps on how the complexity or organisations results in vulnerability

In this Risky Business News sponsored interview, Tom Uren talks to Justin Kohler, VP of the Bloodhound team at SpecterOps about ‘attack paths’, the ways that malicious actors maneuver through Active Directory to elevate their privileges. They discuss how and why they arise and what you can do about them.