Risky Biz News: Feds seize BreachForums again

PLUS: Microsoft to require MFA for all Azure accounts; US arrests woman for running laptops for DPRK IT workers; major hack at Australian healthcare org.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Wide World of Cyber: Krebs and Stamos on How AI Will Change Cybersecurity

The broader geopolitical implications of the AI boom are serious, too...

In this podcast SentinelOne’s Chief Trust officer Alex Stamos and its Chief Intelligence and Public Policy Officer Chris Krebs join Patrick Gray to talk all about AI.

It’s been a year and a half since ChatGPT landed and freaked everyone out. Since then, AI has really entrenched itself as the next big thing. It’s popping up everywhere, and the use cases for cybersecurity are starting to come into focus.

Threat actors and defenders are using this stuff already, but it’s early days and as you’ll hear, things are really going to change, and fast.

Srsly Risky Biz: The proliferation of spyware in Southeast Asia

PLUS: When cybersecurity regulation punishes the weak

In this podcast Tom Uren and Patrick Gray talk about Amnesty International’s research into Indonesia’s use of spyware implicated in human rights abuses.

They also talk about proposed regulation that would dock payments to US hospitals that don’t meet minimum cyber security standards and why the idea needs some tweaking.

Risky Business #748 -- New cyber rules for US healthcare are coming

PLUS: The Signal vs Telegram spat is cybersecurity's horse paste controversy...

This week Patrick Gray and Adam Boileau along special guest Lina Lau discuss the week’s news, including:

  • The ongoing Ascension healthcare disruption, and
  • Whether its reasonable for healthcare orgs to be pushing back
  • Platforming cybercriminals for interviews
  • Own the libs by… not using E2EE messaging?
  • CISA’s secure by design, we want to believe!
  • The $64billion scale of indusrialised fraud
  • And much, much more.

This week’s sponsor is network discovery specialist, Run Zero. Director of research Rob King joins to talk about the weird and wonderful delights in their new Research Report.

Between Two (Other) Nerds: Signalling, Cyber Signalling is Dead

PLUS: Lawyers get comfy with the lead-pipe ransomware response...

The regular two nerds have the week off, but the former Director of the CIA’s Center for Cyber Intelligence Andy Boyd joins Patrick Gray for a rollicking conversation in front of a live audience in San Francisco. Grugq and Tom return next week!

Sponsored: Giving authorisation the Okta treatment

Authorisation-as-a-service at global scale

In this Risky Business News sponsored interview, Adam Boileau talks to Okta’s Cassio Sampaio about how cloud-native applications can move authorisation into a centralised model. This brings real benefits for consistency, control and auditing in distributed applications, beyond just the authentication part Okta is normally known for.

Srsly Risky Biz: 'Security' the new marketing mantra

PLUS: Making life very difficult for a ransomware ringleader

In this podcast Tom Uren and Adam Boileau talk about how Microsoft’s reprioritisation of security after recent breaches and a scathing CSRB report seem to be influencing other companies. They are now touting their security chops, so could it be that security is actually becoming a competitive advantage?

They also talk about law enforcement trying to make life difficult for the LockBit ringleader and how the Change Healthcare disaster had deeper underlying causes beyond “no MFA on Citrix”.

Risky Business #747 -- Lockbit Leader Has A Very Bad Day

PLUS: Microsoft maybe - just a little bit - does want to be better?

Patrick dials in from RSA in San Francisco to discuss the week’s security news with Adam, including:

  • The west doxxes LockbitSupp, who must now hide his hundred million dollars
  • Revil hacker behind Kasaya breach gets 14 years
  • Microsoft makes some positive sounding* noises on security
  • A fun flaw in nearly all VPN clients
  • Gitlab admins continue their never-ending incident response
  • And much, much more.

This week’s sponsor is Stairwell. Long time infosec researcher Silas Cutler joins us to talk through his adventures in attacker C2 systems, and how this feeds into Stairwell’s data.

* we’re still sceptical they’ll get it right, but they do at least seem to realise how deep the doo-doo they’re in is… Pat speculates they have … tentacles, and a regulatory-threat-gland.

Srsly Risky Biz: The problem with big tech

PLUS: Know Your Customer and the malicious use of cloud infrastructure

In this podcast Tom Uren and Adam Boileau talk about how there is a growing consensus between regulators and lawmakers on the key problems of modern tech companies.

They also dive into how to deal with malicious foreign actors buying their way onto domestic cloud infrastructure and how drones are actually just like modern cars.

Risky Business #746 – Microsoft takes your security seriously*

PLUS: Governments vs Tech, FIGHT!

On this week’s show Patrick and Adam discuss the week’s security news, including:

  • Microsoft reassures* us that they take security very seriously*
  • Cisco ASA firewalls get sneakily backdoored, but no one’s quite sure how
  • Change Healthcare was 1FA Citrix all along
  • The FTC, FCC and other government sticks get waved at tech
  • Lizard Squad Finn who hacked the Vastaamo therapy chain gets sentenced
  • And much, much more.

This week’s sponsor is Zero Networks, who make a network micro-segmentation product that is actually usable. Zero Networks CEO Benny Lakunishok joins us to talk through why firewalling everything everywhere is finally workable.

* You’ll forgive us for being… a tad sceptical.

Between Two Nerds: Busting 0day Myths

0days don't get burnt, just democratised

In this edition of Between Two Nerds Tom Uren and The Grugq look at the life cycle of 0days, dissect the conventional wisdom and talk about how 0days are never truly ‘burnt’.