On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Germany issues stark warning to Kaspersky users
• Ukraine SATCOM hack keeps getting more interesting
• Russia to spin up its own CA, but it’s not what it seems
• Why the ransomware threat could get worse, then better
• Much, much more

This week’s show is brought to you by Fastly. Kelly Shortridge, Fastly’s Senior Principal Product Technologist, joins the show this week to tell us what modern security actually looks like. Kelly is always fascinating so we were thrilled she was in the sponsor chair this week.

On this week’s show Patrick Gray, Brian Krebs and Adam Boileau discuss the week’s security news, including:

• The Contileaks latest
• Belarus targeted refugee data. Was it behind the ICRC hack?
• How APT41 hacked America’s livestock
• SATCOM hack in Ukraine may bode ill for Musk
• Much, much more

Material Security’s co-founder Ryan Noon is this week’s sponsor guest. He joins the show to talk about a few things, how the building blocks for a whole new generation of security tooling – like large-scale data crunching tech – is now just available off the shelf. He also talks us through an integration Material has done with a groovy new SOAR platform called Tines.

On this week’s show Patrick Gray, Dmitri Alperovitch and Adam Boileau discuss the week’s security news, including:

• We expected a cyberwar but got an information war
• People with SDR kits are doing SIGINT in Ukraine
• Conti has imploded and it’s hilarious
• Much, much more

This week’s show is brought to you by Proofpoint. Sherrod DeGrippo, Proofpoint’s Vice President of Threat Research and Detection is this week’s sponsor guest. She joins us to talk about how there isn’t really any magic advice she can dispense to protect customers from Russian attacks.

There are some show notes below, but they’re not exhaustive.

These Soap Box editions of the show are entirely sponsored – that means everyone you hear in one of these episodes paid to be here.

In this edition we’re talking to Yubico’s Chief Solutions Officer Jerrod Chong. We do one of these Soap Box podcasts with Jerrod every year. Yubico, of course, is the maker of the Yubikey hardware security device.

In this chat with Jerrod we cover a few things – like the zero trust executive order, hardware-backed web transactions and how the industry leading the charge on security keys right now is actually the cryptocurrency space.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Ukraine sanctions may lead to Russia going “cyber feral”
• Brian Krebs links Red Cross breach to Iranian actor
• APT10 uses cred stuffing as misdirection
• Report: Global logistics behemoth Expeditors ransomwared
• NFT thefts still hilarious
• Inside the epic KlaySwap hack
• Much, much more

In this week’s sponsor interview Thinkst Canary’s Marco Slaviero talks about some work they’ve done on introducing a “Safety Net” against AWS token enumeration edge cases. That’s a very interesting interview.

There is no weekly news show this week. Instead, we’re running this feature interview with Michael Montoya, the CISO of Equinix. This isn’t a sponsored interview or anything like that, this podcast was prepared with support from the Hewlett Foundation’s Cyber Initiative.

Equinix has 9,000 staff and operates 220 data centres globally. Its annual revenue is in the order of USD$6bn. In September 2020 it was attacked by criminals who deployed the Netwalker ransomware on its corporate network. The attackers demanded a USD$4.5m ransom payment for service restoration and to keep the data they stole from the company private.

This interview has taken a while to organise, but when I first found out Michael was open to the idea of talking through the incident I jumped at it. It’s extremely rare for CISOs to be made available to talk about events like this, but it’s something that should happen more often. We can learn a lot by dissecting these types of incidents publicly. Enjoy!

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• A spate of ransomware attacks on European energy and transport
• Russian authorities extend cybercrime crackdown
• Irritating influencers arrested for laundering 2016 Bitfinex hack proceeds
• IRS abandons ID.me trial
• Microsoft disables macros by default, disables MSIX protocol handler
• Much, much more

This week’s show is brought to you by ExtraHop.

Extrahop’s Ted Driggs is this week’s sponsor guest – he was on the show about a year ago talking about how we should really start thinking about putting together software bills of behaviours as well as bills of material. Ted is back to tell us how that effort is progressing. As you’ll hear, a lot of the behavioural data on software already exists, but it’s being hoarded by different vendors.

These soap box podcasts are wholly sponsored – that means everyone you hear in one of these editions paid to be here. Today’s guest is Andrew Morris, the founder and CEO of Greynoise.

Greynoise is one of those companies that has a brief that sounds simple but is actually quite hard to execute on. They detect malicious mass scanning on the Internet so their customers can plug that data into their SOC to see if the IP they just got an alert on is something targeting them or something targeting the whole internet.

You don’t even need to be a customer to get some use out of Greynoise. If you want to know about an IP you’ve seen an alert for just head over to greynoise.io and drop it into the search box – magic awaits.

Greynoise makes its money by selling API access to its service, basically, and its customers mostly use it for SIEM enrichment. But as you’ll hear, Andrew says the company is looking at moving toward actually blocking this type of mass scanning from hitting customer environments, and is even looking at working with telcos to scrub the most egregious stuff from the internet entirely. His rationale is actually pretty simple – he wants to narrow the aperture through which mass scanning can fit through. He wants to make it harder.

But this interview isn’t just about what Greynoise doing, it’s also about the current state of mass scanning.

On this week’s show Patrick Gray, Tom Uren and Joe Slowik discuss the week’s security news, including:

• Why China’s Olympics app is probably not spyware
• New DDoS record set at 3.47Tbps
• USG goes all in on Zero Trust
• Dmitry Medvedev makes all the right noises on ransomware cooperation
• Iranian APT crew dabbles in ransomware
• German fuel distribution ransomwared
• The latest on NSO
• Much, much more

This week’s show is brought to you by Google Cloud. Anton Chuvakin, the head of security solution strategy at Google Cloud will be along in this week’s sponsor interview to talk about why SIEM vendors – including Google Cloud – are gobbling up SOAR platforms in acquisitions.

Links to everything that we discussed are below and you can follow Patrick, Tom or Joeon Twitter if that’s your thing.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Belarusian Cyber Partisans ransom train network
• A look at developments in Ukraine
• Merck wins NotPetya insurance lawsuit
• US VC firm in talks to acquire NSO Group
• Much, much more

This week’s show is brought to you by Trail of Bits, the security engineering firm. Dan Guido joins us this week week to talk about zkdocs, a bunch of documentation Trail of Bits put together to provide guidance on how to implement some of these newfangled concepts – like zero knowledge proofs – that are popular in blockchain and cryptoland.

On this week’s show Patrick Gray, Adam Boileau and Dmitri Alperovitch discuss the week’s security news, including:

• Russia arrests REvil crew
• Ukraine government hit in messy hacks
• White House hosts open source pow-wow, but is it pointless?
• US cyber reporting law will come back from the dead
• Report: Israeli police targeted activists with NSO but without warrants
• Much, much more

This week’s sponsor interview is with HD Moore, the founder of Rumble. We’re talking through what how he and his team helped customers respond to the log4j drama. They quickly added the capability to scan customer’s environments for log4shell-affected tech. When asset discovery meets rapid vuln response!

In this edition of the soap box we’re chatting with Steve Miller, a senior researcher at Stairwell. Steve has a long history doing this sort of stuff. He worked inside various bits of the US government doing cyber things, and also spent a decent chunk of his career at Mandiant.

His new employer, Stairwell, makes a platform that collects information about all files present in your environment and let’s you do some fancy stuff with that information. You’ll hear a little bit more about what they do in this interview, but we’re not really talking that much about Stairwell in this interview. It’s more about the evolution of threat intel.

As you’ll hear, Steve said the first iteration of the commercial threat intel space was very much born of govvies jumping out and bringing their thinking with them, but the space is evolving. The take away from this interview is that threat intelligence is more something that you do, not something you just blindly consume.

On this week’s show Patrick Gray, Katie Nickels and Joe Slowik discuss the week’s security news, including:

• US Government warns of impending critical infrastructure hacks
• Log4j bug in VMWare gets a workout
• Ex Uber CSO Joe Sullivan facing wire fraud charges
• Signal to push ahead on cryptocurrency payments
• Italian literary nerd busted for running one man APT operation
• Much, much more

This week’s show is brought to you by Okta. Marc Rogers is the executive director of cybersecurity there and he’s joining us this week to talk about the log4j bug and some adjacent issues. He’s working on a paper with IST about the bug and what it all means, and he’s joining us this week to talk about why the log4j drama was different.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• The log4j bug wrap
• The ransomware wrap
• The human rights and surveillance industry wrap
• Research and carnage wrap

This week’s show is brought to you by Airlock Digital. They make allowlisting software that has mostly been used in Windows environments, but as you’re about to hear they’ve now got a very, very nice solution for the bigger Linux distros, and their Mac agent is going to be launched in a few weeks.

This isn’t the normal weekly news episode of the show, if you’re looking for the regular weekly Risky Business podcast, scroll one back in your podcast feed. This is a Soap Box edition, a wholly sponsored podcast brought to you in this instance by Thinkst Canary.

For those who don’t know, Thinkst makes hardware and virtual honeypots you can put on your network or into your cloud environments – they’ll start chirping if an attacker interacts with them. They’re a low cost and extremely effective detection tool. But you might not know that Thinkst also operates canarytokens.org where you can go set up a bunch of honeytokens for free. Hundreds of thousands of people are using canarytokens.org, but Thinkst doesn’t charge anything for it, it’s free to use. They’ll even give you a docker container of the whole thing so you can run it yourself.

Our guest today is Thinkst’s founder and infosec legend Haroon Meer. He spent a chunk of his career at the South African security consultancy SensePost before founding Thinkst Applied Research and eventually launching Canary.Tools. In this interview we talk about what the industry is getting wrong, supply chain security, effective detections and more. But I started off by asking him why Thinkst hasn’t tried to monetise canarytokens.org given how many people use it.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• NSO Group tools found on US embassy staff phones in Uganda
• Mitto is up to shady bidnez
• Ubiquiti “whistleblower” charged over hack
• Hounds everywhere
• Planned Parenthood breached
• Much, much more

This week’s sponsor interview is with Andrew Morris of Greynoise.

Greynoise has a bunch of sensors out there on the Internets, so they can tell you when and IP that’s hitting you is also hitting everyone else. If you work in a SOC, you know this is very useful. Greynoise has just signed a $30m deal with the US Department of Defense. As Andrew will explain in just a moment, this means if you work in a DoD agency it’s now very easy for you to get a subscription. In this interview I also talk to Andrew about his adventures chasing down one of the people spamming Internet attached receipt printers with the antiwork manifesto from Reddit.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Israel slashes number of countries it will export cyber tools to
• Interpol takes down 1,000 Internet fraudsters
• Ransomware crews lying low?
• When the tabloids do cyber the results are sometimes awesome
• Much, much more…

This week’s sponsor interview is with Ryan Kalember of Proofpoint. He’s the EVP of Cybersecurity Strategy there and he’s joining me this week to talk about how investment activity in cybersecurity is basically leaving everyone who isn’t a mega enterprise behind.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Apple sues NSO Group and it’s all a bit weird
• Israel charges defence minister’s house cleaner with Iranian hacker collusion (really)
• USA charges two Iranians over “Proud Boy” emails
• Cyber insurers nope out of comprehensive coverage
• Prodaft shells Conti, drops report like it’s a Normal Thing
• Much, much more

This week’s show is sponsored by VMRay. We’ll be chatting with one of VMRay’s customers in this week’s sponsor interview. Jim Byrge works on the CSIRT team at Valvoline, and he’ll be along to talk about how they replaced their ageing, in-house developed SOAR platform with commercial tools. It was still harder than it should be in 2021, but they got there in the end.

In this edition of the Risky Biz Soap Box podcast we chat with Sean Leach, the Chief Product Architect at Fastly, about the history and current status of the DDoS ecosystem. Despite never really making money for criminals, DDoS attacks are still a problem.

CDNs have soaked up a lot of the problem, so DDoS crews are getting creative. Do you know where you’re vulnerable?

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Watering hole attacks are getting much better
• How Israel’s government used NSO to strengthen its diplomatic ties
• Randori sat on some PAN 0day. This is fine.
• Facebook outs state-backed ops
• FBi has unfortunate incident with its mail boxes
• Much, much more

This week’s sponsor interview is with HD Moore. He’s the founder of Rumble, the network asset discovery scanner, and he’s joining us to talk about some new tricks he’s added to the product, like integrations with cloud service APIs and external discovery products like Censys.