Risky Biz News: Vo1d infects 1.3 million Android TV boxes

PLUS: Microsoft to support options for moving security products out of the kernel; Mastercard buys Recorded Future; Slovakia denies buying Pegasus.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Srsly Risky Biz: The three I's in Spyware

PLUS: Exposing Russia's disinformation apparatus

In this podcast Tom Uren and Patrick Gray talk about the structure of the spyware ecosystem. It’s concentrated, with lots of vendors in India, Israel and Italy. And its a small pool of talent, with many companies being founded by just a few individuals.

They also talk about the US government’s actions against Russia’s disinformation ecosystem. The US very clearly linked different ‘layers’ of that ecosystem directly to the Russian government. Employing influencers via cutouts also shows how Russian disinformation has responded as social media platforms have countered interference efforts.

This episode is also available on Youtube.

Risky Business #763 – Microsoft un-patches critical bug

PLUS: SpaceX capitulates on Brazil's X ban...

On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:

  • Russia’s disinformation peddlers face multifaceted sternness from the DoJ
  • Telegram is now law enforcement’s bestest new pal, all of a sudden
  • Iran’s banking industry arranges a payment plan for a ransom
  • Columbia investigates how it sent private jets full of cash to pay for Pegasus
  • Microsoft innovates with Un-Patch Tuesday
  • And much, much more.

This week’s sponsor is Kroll Cyber, and one of their incident responders Paul Wells joins to discuss that one weird trick that actually helps - preparing for an incident before hand, rather than learning all those hard lessons in the middle of a crisis.

This week’s episode is also available on Youtube.

Risky Biz News: UK NCA "on its knees" and bleeding staff

PLUS: Poland's Pegasus inquiry reaches a roadblock; Americans lost $5.6 billion to crypto-fraud last year; Poland disrupts cyber sabotage group.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Risky Biz News: Two security enhancements coming to Windows

PLUS: ColdRiver hacks Russian pro-democracy foundation; backdoor found in EV charger model; sextortionist brothers get long prison time after victim's suicide.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird.

You can find the newsletter version of this podcast here.

Sponsored: Sublime Security on generative AI attacks in the wild

And how to defend against them

In this Risky Business News sponsored interview, Tom Uren talks to Josh Kamdjou, founder and CEO of Sublime Security, about the spectrum of attacks that are taking advantage of generative AI. These range from taking basic attacks with a pinch of AI pixie dust to more complex attacks where AI is used to construct message threads with multiple personas.

Josh also talks about how different AI models can be used to identify these attacks even when they are novel.

Snake Oilers: Authentik, Dropzone and SlashID

An open source IDP, AI SOC agent and ITDR platform walk into a bar...

In this edition of Snake Oilers Patrick Gray gets pitches from three cybersecurity companies:

  • Authentik, an open source identity provider that a lot of large organisations are deploying on prem as an alternative to cloud-based IDPs
  • Dropzone AI, an LLM-based agent that can do the work of a Tier 1 SOC analyst
  • SlashID, an identity security company that can crunch your logs to find attackers

You can watch this edition of Snake Oilers on YouTube here.

Srsly Risky Biz: Using Exploits to Steal Exploits Is as Old as Time

PLUS: Iran has a good idea

In this podcast Tom Uren and Patrick Gray discuss Russia’s use of exploits from commercial spyware vendors. Bought through a front, or stolen with other bugs?

The also discuss Iran’s counter-intelligence innovations - if you apply for a job thats very clearly an Israeli front, then perhaps you’re not that trustworthy after all?

This episode is also available on Youtube.

Risky Business #762 -- Brazil nukes X, Iranian APTs deploy ransomware

PLUS: North Korean Chrome 0day gets burned...

On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:

  • Brazil’s supreme court bans X-formerly-Twitter,
  • Iranian cyber teams cooperate with ransomware crews
  • While North Koreans wield chrome-windows 0-day
  • Yubikey cloning attack is impressive, but doesn’t have us binning our keys quite yet
  • The White House is coming for your unsigned BGP announcements
  • And much, much more.

This week’s episode is sponsored by Okta, and specifically their Identity Security Posture Management product. Okta recently acquired Spera Security, and co-founder Ariel Kadyshevitch joins to talk through the messy reality of modern identity. Pat even gets the giggles at how terrible everything is!

You can also watch this episode on Youtube.

Risky Biz News: China ramps up US election disinformation

PLUS: White House weighs in on BGP security; TfL tells staff to work from home after cyberattack; Russia wants to block foreign web crawlers.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Kaitlyn Sawrey.

You can find the newsletter version of this podcast here.

Between Three Nerds: How the MSS became a cyber juggernaut

All about China's Ministry of State Security with Alex Joske

In this edition of Between Three Nerds Tom Uren and The Grugq talk to Alex Joske, author of a book about how the Chinese Ministry of State Security (MSS) has shaped Western perceptions of China. They discuss the MSS’s position in the Chinese bureaucracy, its increasing role in cyber espionage, its use of contractors and the PRC’s vulnerability disclosure laws.

Sponsored: GreyNoise launches private preview of Plasma sensors

Andrew Morris deploys one of the sensors while we're having a chat.

In this Risky Business News sponsor interview, Catalin Cimpanu talks with Andrew Morris, founder of security firm GreyNoise. Andrew introduces Plasma, a new GreyNoise product that can allow customers to deploy custom GreyNoise sensors anywhere they want—on perimeters, on internal networks, on DMZs, or anywhere else.

Srsly Risky Biz: Telegram's CEO released on bail, can't leave France

PLUS: Easy ways to identify North Korean job applicants...

In this podcast Tom Uren and Patrick Gray talk about Telegram’s founder and CEO Pavel Durov being bailed. They dive into the backstory behind the charges he’s facing and what it all might mean for other messaging platforms.

They also discuss a very handy list of straightforward ways to detect North Korean’s trying to sneak into remote work jobs.

Risky Business #761 – Telegram v frogs. Fight!

But muhhhh freeedommmsss!

On this week’s show, Patrick Gray and Adam Boileau discusses the week’s security news, including:

  • Telegram founder’s arrest in France
  • Volt Typhoon 0days some SD-WAN gear
  • Russia frets about Ukraine all up in Kursk’s webcams
  • Cybercriminals social engineer payment card NFC relay attacks in the wild
  • The slow burn of Active Directory name collisions
  • And much, much more.

This week’s episode is sponsored by Nucleus Security. Aaron Unterberger joins to discuss how vulnerability management starts out easy, but gets serious very quickly.

You can also watch this week’s show on Youtube.


SUBSCRIBE NOW:
Risky Business main podcast feed:
Listen on Apple Podcasts Listen on Overcast Listen on Pocket Casts Listen on Spotify Subscribe with RSS
Our extra podcasts feed:
Listen on Apple Podcasts Listen on Overcast Listen on Pocket Casts Listen on Spotify Subscribe with RSS
Subscribe to our newsletters: