Risky Business #616 -- Exchange 0day party time for Chinese APT crew

But it's not supply chain-related, so it's no big deal, right?

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Chinese APT crew goes berserk with Exchange 0day
  • Russia hacks Ukraine and USA, India hacks China, China hacks India
  • The NYTimes got something big wrong again (shock horror)
  • CANVAS exploit pack leaks, including their sweet, sweet Spectre exploit
  • Atlantic Council report into offensive capability vendors/contractors
  • Your vCentre gear it probably already on fire: find out why!
  • Much, much more

This week’s show is brought to you by Yubico, the makers of the Yubikey.

Risky Biz Soap Box: ExtraHop CTO and co-founder Jesse Rothstein

SolarWinds NDR alerts were often trees falling in the woods...

This is a sponsored podcast featuring ExtraHop’s co-founder and CTO Jesse Rothstein. ExtraHop is a Network Detection and Response (NDR) vendor that started out offering network health and monitoring tools before being pulled into the security space by its own customers.

Jesse joined host Patrick Gray to talk about the SolarWinds compromise from a Network Detection and Response vendor’s perspective, about cloud security and monitoring, some of ExtraHop’s backstory and more. Enjoy!

Risky Business #615 -- Dependency confusion is, uh, pretty bad

PLUS: US floats new RU sanctions, TikTok gets stay of execution...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • USA floats new sanctions against Russia
  • TikTok, WeChat get stay of execution
  • Dependency confusion is ugh
  • US indicts Lazarus crypto-thieves
  • France ties Sandworm crew to Centreon intrusion
  • MORE

This week’s show is brought to you by Thinkst Canary. Thinkst’s founder Haroon Meer is this week’s sponsor guest and he joins us to have a very Haroon-style conversation. We talk about how security controls and detections often fall over when things happen that take place outside of our assumptions: trojaned software updates, attackers hiding in unconventional places like monitors, things like that. That’s a great conversation.

Accellion customers are getting ransom notices

The Risky Biz newsletter for February 16, 2021...

The five most recent listings on the leak site of the CL0P ransomware group have two things in common. One, and most obviously, they are being extorted. And two, they’ve deployed Accellion file transfer appliances to send large files in their recent past.

Risky Biz Feature Podcast: A primer on Microsoft cloud security

Everything you want to know about Azure AD but were afraid to ask...

Recent attacks by SVR against US targets have mostly been written up under the moniker of the “SolarWinds campaign”. In our view, that’s inaccurate. The defining characteristic of this campaign wasn’t the SolarWinds supply chain stuff, it was the abuse of Microsoft cloud services.

My understanding of how contemporary cloud services work isn’t actually as good as it should be. And that got me thinking – if my understanding isn’t that great, then there’s probably a lot of other people out there who don’t quite grok this stuff, particularly on the policy side. So, I set out to prepare a primer on Microsoft cloud security.

Our guest in this podcast is Dirk-Jan Mollema. He works at Fox-IT in the Netherlands and is one of their core researchers on Azure AD and Active Directory Security. What you’re about to listen to, essentially, is me picking his brain so I can wrap my own head around this stuff. The hope is that some of you will learn along with me!

Risky Business #614 -- So was it Florida Man or an Iranian APT?

World's crappiest ICS threat actor rumbled by Sheriff Bob and team...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • The latest on the attempted Florida water poisoning incident
  • How to abuse Google Sync services for great victory
  • Why Signal’s TLS proxies for Iranians are probably a bad idea
  • OG username brokers targeted by social media legal army
  • Much, much more

This week’s sponsor interview is with Dan Guido of Trail of Bits. They’ve released an enterprise version of their iVerify tool. It’s a security tool for iOS (an Android version is in beta) that lets organisations monitor things like patch levels and passcode compliance without actually requiring the installation of MDM profiles. It’s an enterprise mobile security tool for orgs that don’t need or want full MDM.

Hackers attempt to poison American town's water supply

The Risky Biz newsletter for February 9, 2021...

Somebody used a simple remote access tool to pump up the supply of chemicals into the water supply to a small town in Florida. Was it Florida Man or Iranian APT? Either is possible, but one would be a curiosity, the other an international incident.

Risky Business #613 -- It's time to check your Accellion logs

PLUS: Hobbyists and cops vape Emotet...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Emotet is… gone?
  • Accellion FTAs were owned everywhere, not just in ANZ
  • US courts air-gap sensitive filings in wake of Holiday Bear attacks
  • iOS 14 brings iMessage security improvements
  • Much, much more

Proofpoint’s Sherrod DeGrippo is this week’s sponsor guest. She joins the show to talk about Emotet’s demise, Trickbot’s survival, BEC, ransomware and more.

Risky Biz Soap Box: Email is a target, not just a vector

Protecting e-mail at rest with Material Security...

These Soap Box editions of the show are wholly sponsored, which means everyone you hear in one of these editions, paid to be here.

This edition of the show is brought to you by Material Security. Basically what they do is lock up your cloud-based email. They use Google and Microsoft’s APIs to redact sensitive information from your mail spool – or even redact entire messages from your spool, like, say, anything over a month old – and then kick you up to an auth challenge when you want to access that mail.

It’s a product that recognises that email isn’t just a vector – often it’s an attacker’s target.

Risky Business #612 -- DPRK slides into researcher DMs

You had me at "umm, do you research vulnerability?"

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • DPRK offers free 0day to researchers, with a pretty significant catch
  • SonicWall gets owned because it runs SonicWall gear. Big mistake.
  • Chinese trains didn’t stop running because Flash died :(
  • Dominion to sue Rudy Giuliani for $1.3bn over insecurity claims
  • The sudo bug. Lol.

This week’s show is brought to you by Cmd Security, the Linux security company. Its focus has traditionally been on restricting the type of bash commands users can enter. It’s like a control plane for Linux systems. But some of its customers manage their Linux endpoints through different, non-bash entry points. So they’ve added some features to their product to deal with that, which has also resulted in them having an IDR capability. It’s all pretty sensible stuff though, and Cmd co-founder and CEO Jake King will be along to talk us through all of that.

SonicWall's dog food bites

The Risky Biz newsletter for January 26, 2021

SonicWall customers are on high alert after the company disclosed its internal network was compromised in an attack that abused vulnerabilities in its own SSL-VPN remote access products.

Risky Business #611 -- MalwareBytes the latest "Holiday Bear" victim

More like o36-yikes, amirite?

On this week’s show Dmitri Alperovitch, Sherrod DeGrippo and Joe Slowik join host Patrick Gray to talk through the week’s news:

  • MalwareBytes the latest victim in the increasingly poorly-named “SolarWinds campaign”
  • FireEye issues helpful guidance, tools, to help orgs detect “golden SAML” and related techniques
  • Rob Joyce, Anne Neuberger, Michael Sulmeyer all get promoted! Wooo!
  • Much, much more

Idiot-fuel: hackers post COVID-19 vaccine docs online

The Risky Biz newsletter for January 19, 2021...

COVID-19 vaccine documents stolen from Europe’s pharmaceutical regulator were altered before being published in a cybercrime forum, in what now looks like an effort to erode trust in Europe’s COVID-19 vaccination program.

Risky Business #610 -- Propellerheads in dark on JetBrains

PLUS: Mimecast gets Russia'd and more...

Joe Slowik and Katie Nickels are guest co-hosts in this week’s edition of the show. They join Patrick Gray to talk about:

  • Mimecast having some stolen certificate, errr, “problems”
  • The confusing reports about JetBrains
  • Analysis of the malware used in the SolarWinds campaign
  • Australian man arrested in Germany and charged with running DarkMarket
  • The Great Deplatforming of 2021

Risky Biz Soap Box: Mapping NIST 800-53 to MITRE ATT&CK

Turning a standard into something more tangible...

These Soap Box editions of the show are wholly sponsored. If that’s not your thing and you’re looking for the weekly news edition of the show, just scroll one show back in your feed.

This soap box edition is brought to you by AttackIQ. They make a Breach and Attack Simulation platform that’s designed to test the effectiveness of your security controls by simulating bad things in your environment.

Carl Wright and Jonathan Reiber are joining us in this edition of the show. These days he’s AttackIQ’s senior director of cybersecurity and strategy but he previously served as a former Chief Strategy Officer for Cyber Policy in the Office of the Secretary of Defense.

They joined the show to talk through their work in mapping NIST 800-53 to the MITRE ATT&CK framework. Enjoy!

JetBrains stories generate heat, shed little light

The Risky Biz newsletter for January 12, 2021...

Two of America’s most respected mastheads allege that attackers were able to poison a SolarWinds software update in early 2020 via the company’s use of JetBrains TeamCity, but there’s some critical details missing in this story.

Risky Business #609 -- It's not NotPetya

Kicking off 2021 with a bucket of cold water...

On this week’s show, Patrick Gray talks to Joe Slowik and Dmitri Alperovitch about the APT campaign that impacted the US government and FireEye via SolarWinds’ supply chain.

Alex Stamos also joins the show to chime in more generally on supply chain interference before discussing some other news, like:

  • Apple losing (most of) its case against Corellium
  • Assange won’t be extradited… yet
  • Adobe has finally killed Flash, and killed it good