Exclusive: Sandworm's Exim hacks reveal wider Russian activity

The Risky Biz newsletter for June 16, 2020...

Threat hunters studying the IoCs released in the NSA’s May 2020 advisory on recent Sandworm activity have used them to identify a large amount of infrastructure that looks custom-made to conduct credential phishing attacks against email and social media accounts used in Western countries.

Risky Biz Soap Box: A better way to provision access to production environments

Co-founder and CTO of strongDM, Justin McCarthy, pops in for a chat...

The Soap Box podcasts we run here at Risky.Biz are wholly sponsored affairs – everyone you hear in a soap box podcast, paid to be here.

The idea is vendors get to come on to the show and chat about their products, what their stuff does, the thinking behind it, so on and so on.

Today we’re hearing from Justin McCarthy of strongDM.

strongDM is a bit of a niche player – essentially what they do is make a product that provisions secure access to engineers who need to access various back end services.

Risky Business #586 -- Google TAGs Indian mercenaries

PLUS: Risky Biz editor Brett Winterford joins the show to talk incident response and legal privilege...

On this week’s show Patrick and Adam discuss the week’s security news, including:

  • Google TAG implicates Indian hacker-for-hire outfits in espionage
  • NSA warns of Sandworm Exim exploitation
  • Huawei CFO extradition process to continue
  • Black lives matter
  • F–k police brutality

Sandworm tapping unpatched mail servers, Capital One forced to hand over IR reports, and more...

The Risky Biz newsletter for June 2, 2020...

The NSA warns that Sandworm, one of Russia’s most formidable offensive cyber operations, has been exploiting a known flaw in the Exim mail transfer agent (MTA) in attacks for at least 10 months. Sandworm - part of Russia’s GRU intelligence unit - were fingered for NotPetya and crippling wiper attacks on Ukraine’s power grid. You don’t want these guys up in your business.

Surprise Capital One court decision spells trouble for incident response

Security incident? Prepare to be surrounded by even more lawyers than usual...

When litigants suing Capital One sought a forensic incident response report into its 2019 data breach, the bank played a reliable card: the report was commissioned by its outside law firm, and therefore subject to attorney-client privilege.

In a surprising move, this week a US District Court rejected the bank’s claim to privilege and demanded the document be handed over, in what appears to set an unsettling precedent.

Feature Podcast: Releasing the hounds with Bobby Chesney

PLUS: Mieke Eoyang talks cybercrime enforcement...

Regular listeners to the podcast would know that for the last year or so, my cohost Adam Boileau and I have been talking a lot about how governments might involve non law enforcement agencies in a response to the big game ransomware epidemic. To discuss that, we’re joined by Bobby Chesney, the co-founder of the Lawfare blog and a very highly respected figure in US national security circles.

UK changes course on Huawei

The Risky Biz newsletter for April 27, 2020...

The United Kingdom is pulling together a plan to remove Huawei from its mobile networks within the next three years, following the lead of Australia and the United States.

Risky Business #585 -- UK mulls Huawei ban, NGOs urge COVID-19 hack de-escalation

PLUS: German authorities warn of Russian infrastructure attacks...

On this week’s show Patrick and Adam discuss the week’s security news, including:

  • German intelligence warns of widespread Russian infrastructure hacks
  • NGOs urge COVID-19 hack de-escalation
  • UK mulls total Huawei ban… we think it’s a done deal
  • DHS warning on 5G “moronavirus”
  • Wen jailbreak? NOW JAILBREAK
  • iOS 14 leaks
  • Much, much more…

Wuhan lab dossier debunked

The Risky Biz newsletter for May 19, 2020...

Russia has some competition in the disinformation game. The US administration’s claim that the COVID-19 outbreak was caused by a laboratory accident was based on a report that has now been thoroughly debunked.

All roads lead to CISA to secure .gov

Chris Krebs' empire has big plans for securing the US Federal Government. He's also got some outsized expectations to manage.

The US Government has spent a decade and tens of billions trying to centralise cybersecurity capability across civilian agencies, without much success. So why now are policymakers so buzzed about CISA?

Risky Biz Soap Box: ExtraHop CTO Jesse Rothstein talks network monitoring

Spotting rogue network usage in the COVID-19 age with ExtraHop...

This isn’t the normal, weekly Risky Business podcast, Soap Box is the wholly sponsored podcast series we do here at Risky.Biz where vendors pay us money to come on to the show and talk about topics that interest them.

Today we’re speaking with Jesse Rothstein, the co-founder and CTO of ExtraHop Networks. ExtraHop is a network security play, but they started off more in the application monitoring and performance space before gradually moving into security over time.

In this interview Jesse talks about network security monitoring, ExtraHop’s history, and what people are using the ExtraHop tech to do during the COVID-19 crisis.

Risky Business #583 -- COVID-19 collection intensifies, tensions mount

PLUS: All the other security news...

On this week’s show Patrick and Adam discuss the week’s security news, including:

  • US takes aim at China over vaccine hax
  • ??? takes aim at Iranian port infrastructure over ???
  • Iran attacks Gilead pharma
  • Zoom acquires Keybase
  • Thunderbolt research discussed
  • US to drop more DPRK malware
  • Ransomware targets European hospital group
  • Australian flu vaccine distribution disrupted by ransomware
  • More!

Attacks on healthcare are crossing all the red lines

The Srsly Risky Biz Newsletter for May 12, 2020...

The ongoing march of destructive attacks on medical organisations and a frenzy of espionage interest in COVID-19 vaccine and treatment research is testing the restraint of several governments. This week’s Seriously Risky Biz newsletter and our livestream discuss the ethical and policy dilemmas this race poses.

Risky Business #582 -- Germans indict APT28 operator

PLUS: Groundhog day for Toll Group...

On this week’s show Patrick and Adam discuss the week’s security news, including:

  • Salt framework 1Day wreaks havoc
  • Toll Group hit with ransomware attack. Again.
  • Germans indict APT28 operator
  • Ransomware a key word in SEC filings
  • Much, much more!

Ransomware is now officially on the board agenda

The Srsly Risky Biz Newsletter for May 5, 2020...

How’s this for a cogent data point: Catalin Cimpanu at ZDNet had the curiosity and foresight to search for the word ‘ransomware’ in recent SEC filings. Cimpanu found that over 1000 public US companies now list ransomware attacks as a forward-looking risk.

It wasn’t long ago that a company getting popped in a ransomware attack would rate a mention on the Risky Business podcast. Today, it takes a novel attack to raise an eyebrow. 

Australia’s COVID-19 app is buggy, not yet operational

The Morrison Government erred in rushing app release...

The Australian Government has placed uptake of its COVID-19 contact tracing app front and centre of its strategy to walk back lockdown measures, despite mounting evidence it isn’t fit for purpose.

On Friday, Australia’s Prime Minister Scott Morrison framed uptake of the government’s contact tracing app as one of a few remaining pre-conditions before lockdown measures would be lifted.

However, according to multiple reports, the government’s COVIDSafe app is barely functional on iOS devices, state health authorities don’t yet have access to the contact tracing data it was designed to collect and the app is interfering with some Bluetooth-based medical devices.