Seriously Risky Biz: The CIA is too stupid to know it's stupid

PLUS: North Korea has a smartphone hacking scene...

In this episode of Seriously Risky Biz Patrick Gray and Tom Uren talk about the CIA’s catastrophically moronic covert communications system, the North Korean smartphone hacking scene and the significance of a Netwalker affiliate’s 20 year prison sentence.

Risky Business #681 -- It's Exchangehog Day

PLUS: How the CIA's terrible online opsec got its agents killed…

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • More Exchange 0days cause more havoc
  • A look at some earlier Exchange hack incidents
  • How the CIA got its agents killed with its truly awful online opsec
  • Ex NSA staffer arrested for espionage
  • Much, much more

This week’s show is brought to you by Proofpoint. Ryan Kalember, Proofpoint’s EVP of cybersecurity strategy, joins the show this week to talk about some overlooked detection opportunities – some simple stuff you can look for in your environment that should raise gigantic flashing red flags.

Seriously Risky Biz #12 -- Why Huawei is Germany's next Nordstream

PLUS: It's time to heavily regulate what data companies can store...

In this week’s edition of Seriously Risky Business Patrick Gray and Tom Uren talk about the Australian government’s response to the Optus hack, why Viasat was a massively significant attack despite a lack of clarity on how it affected battlefield communications, and how Germany’s late warning on Kaspersky software betrays larger problems with its strategic thinking.

Risky Biz Soap Box: Why Microsoft's Smart Application Control is very strange

PLUS: The challenges involved in controlling malicious browser extensions from endpoint software…

In this Soap Box podcast Patrick Gray interviews Airlock Digital CTO Daniel Schell and CEO David Cottingham about Microsoft’s new Smart Application Control feature, why controlling browser extensions via endpoint instrumentation is really hard and why PAM solutions don’t actually do allowlisting, even if they claim they do.

Risky Business #680 -- Uber, Rockstar Games hacker arrested

PLUS: Optus crook has a dramatic change of heart, wants to be friends...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Lapsus$’s Teapot arrested by UK police
  • Optus hacker issues grovelling apology after feeling AFP and ASD heat
  • Ukraine claims Russia is planning massive attacks on its infrastructure
  • RSOCKS bot herder begs for extradition to USA
  • Russians scammed when seeking military service exemptions
  • Much, much more

This week’s show is sponsored by Votiro. Ravi Srinivasan, Votiro’s CEO, joins the show this week to talk about how people are using content disarm and reconstruction.

Seriously Risky Biz: Chaos Is the New Normal

PLUS: China's vulnerability disclosure rules haven't changed much...

In this week’s edition of Seriously Risky Biz Patrick Gray and Tom Uren talk about the new chaotic normal. Should policymakers abandon efforts to wind back the cyber chaos or should they start focussing more on how to adapt to it? They also talk about some research from the Atlantic Council into Chinese vulnerability disclosure rules and their effect on the pipeline of vuln information from China to other countries.

Risky Business #679 -- A look at Uber's very bad week

PLUS: Microsoft Teams Electron app research is legitimately ooph...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • A look at how Uber got owned so hard
  • Why cleartext cookie storage in Microsoft Teams’ Electron-based app is actually a big deal
  • Russian official: Starlink is a legitimate military target
  • Wagner mercs get doxxed
  • Kiwi Farms having a bad time
  • Much, much more

In this week’s sponsor interview we’ll be chatting to Nucleus’s CEO Steve Carter about CISA’s KEV list. He has feelings about the KEV list – they’re mostly positive, but he also has a few reasonable gripes and he joins me to talk about them.

Between Two Nerds: On culture and SIGINT agencies

How and why do the SIGINT agency cultures vary between the USA, UK and China?

In this edition of Between Two Nerds Tom Uren and The Grugq talk about how SIGINT agencies in different regions have different cultures, and how these differences are rooted in the military traditions and hacker cultures of various countries.