Risky Business #664 -- The Spanish Prime Minister got Pegasus'd

PLUS: Why the FBI's transparency report is anything but…

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Spanish PM’s phone infected by Pegasus
  • Microsoft drops Ukraine research report
  • We can’t make heads or tails out of the FBI’s transparency report
  • France hit with coordinated fibre sabotage campaign
  • Why Musk’s algorithm pledge is meaningless
  • Much, much more

This week’s sponsor interview is with ExtraHop Networks’ CEO Patrick Dennis. He’s joining us this week to talk about how you can turn “Shield’s Up!” advice into something actionable.

Risky Business #663 -- Israel cracks down on spyware exports

PLUS: The VirusTotal infosec drama is actually quite funny…

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Israel Ministry of Defence is denying a lot of spyware export licences
  • Private detective in New York pleads guilty over BellTroX shenanigans
  • Scammers enrol stolen credit cards into Apple Pay
  • The Blackcat ransomware crew is very active right now
  • VirusTotal shells lol
  • Much, much more

This week’s sponsor interview is with Okta’s Brett Winterford, who talks in detail about the company’s brush with the Lapsus$ hacking crew. It’s unusual for a sponsor interview to be a must listen, but here we are.

Risky Business #662 -- It's a bad month to be an electricity grid

Cyberwar!... what is it good for? Absolutely somethin'

On this week’s show Patrick Gray, Adam Boileau and Dmitri Alperovitch discuss the week’s security news, including:

  • Ukraine foils Russian ICS hack
  • US Government burns someone’s ICS toolkit
  • China gets all up in India’s energy gridz
  • The Heroku/Hithub/Travis CI story is very confusing
  • US DOJ removes GRU malware from Watchguard boxes under Rule 41
  • North Korea behind $540m crypto hack
  • Much, much more

This week’s sponsor interview is with Scott Kuffer, co-founder of Nucleus Security, and Jared Semrau of Mandiant. They’ll be joining us to talk about how you can now plug Mandiant data into the Nucleus vulnerability scan aggregator.

Snake Oilers: Vectra, Google Security and SecureStack

Three vendors pitch their wares...

Snake Oilers isn’t our regular weekly podcast, it’s a wholly sponsored series we do at Risky.Biz where vendors come on to the show to pitch their products to you, the Risky Business listener. To be clear – everyone you hear in one of these editions, paid to be here.

We’ll hear from three vendors in this edition of Snake Oilers:

  • Kevin Kennedy from Vectra talks about the company’s cloud native detection – it crunches stuff like CloudTrail and AzureAD logs and correlates it with network event information
  • Paul McCarty from SecureStack on its software composition analysis and “SBOM plus” tool
  • Google Cloud’s Anton Chuvakin talks about cloud-based SIEMs like Chronicle

Risky Business #661 -- Viasat hack details firm up

PLUS: Why you shouldn't dismiss Spring4Shell as hype...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Why Spring4Shell isn’t all hype
  • How Viasat actually got owned
  • Russian war crimes likely extend to coercing sysadmis
  • Why lighter fluid and a box of matches is more effective than cyber in Belarus
  • Much, much more

This week’s sponsor interview is with Bernard Brantley, Corelight’s Chief Information Security Officer.

Corelight makes a network sensor you can use to plug in to your SIEM, among other things. It’s based on Zeek, the open source network sensor that Corelight maintains. Corelight is absolutely the industry standard for this sort of thing.

And they’ve just become the standard for something else, too: Microsoft Defender for IoT can now accept Corelight feeds. Bernard fills us in on that.

Snake Oilers: PentesterLab, AttackForge and Sysdig

Three splendid vendor pitches for you, our listeners...

Snake Oilers isn’t our regular weekly podcast, it’s a wholly sponsored series we do at Risky.Biz where vendors come on to the show to pitch their products to you, the Risky Business listener. To be clear – everyone you hear in one of these editions, paid to be here.

We’ll hear from three vendors in this edition of Snake Oilers:

  • Upskill your testers and developers with PentesterLab for US$20 a month
  • Manage penetration tests and reporting with AttackForge
  • How Sysdig can help herd your container cats (vuln management and detection for container environments)

Risky Business #660 -- Lapsus$ arrests, latest on Okta incident

PLUS: The REDSPICE must flow...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Some arrests of suspected Lapsus$ members in the UK
  • Why the Okta incident is probably a fizzer
  • Four FSB officers indicted over Triton/Trisis malware
  • Kim Zetter interviewed Intrusion Truth
  • Australian government to upsize ASD
  • Wave bye bye to Finfisher
  • Much, much more

This week’s sponsor interview is with Mike Wiacek from Stairwell.

Stairwell makes a product that catalogues the files in your environment and lets you slice and dice that data. That makes threat hunting pretty easy and Mike is joining the show this week to talk about why organisations of all stripes should be doing threat hunting.

Risky Biz Soap Box: Why allowlisting is ready for prime time

Airlock Digital talk Microsoft tooling versus specialist software…

Airlock Digital co-founders Daniel Schell and Dave Cottingham join host Patrick Gray to talk about:

  • What an effective allowlisting program looks like
  • Why the third party allowlisting industry failed the first time
  • What you can achieve with Microsoft tooling versus specialist tools
  • How much effort is involved to do this right

Risky Business #659 -- Okta and Microsoft meet LAPSUS$

PLUS: Why Elon Musk's Starlink is now a military target...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Okta’s somewhat awful comms around its LAPSUS$ incident
  • Inside Microsoft’s brush with the same group
  • How Elon Musk’s Starlink service is being used to drop bombs on Russian tanks
  • US, UK governments warn of impending Russian cyberdoom
  • Much, much more…

This week’s sponsor interview is with Paul Lanzi, co-founder of Remediant. Paul joins the show this week to talk about cyber insurance. It’s a topic that has come up a lot for us lately – ransomware has borderline sunk the current cyber insurance model as payments ballooned and payouts made a lot of insurers adjust premiums to the. But all is not lost – Paul says this blowup means the insurance industry is actually adapting and could wind up being a driver of better security practices.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Risky Business #658 -- Germany sounds alarm on Kaspersky software

PLUS: More on the Ukraine SATCOM hack...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Germany issues stark warning to Kaspersky users
  • Ukraine SATCOM hack keeps getting more interesting
  • Russia to spin up its own CA, but it’s not what it seems
  • Why the ransomware threat could get worse, then better
  • Much, much more

This week’s show is brought to you by Fastly. Kelly Shortridge, Fastly’s Senior Principal Product Technologist, joins the show this week to tell us what modern security actually looks like. Kelly is always fascinating so we were thrilled she was in the sponsor chair this week.

Risky Business #657 -- Belarus targets refugee data

PLUS: Brian Krebs joins the news to talk Contileaks...

On this week’s show Patrick Gray, Brian Krebs and Adam Boileau discuss the week’s security news, including:

  • The Contileaks latest
  • Belarus targeted refugee data. Was it behind the ICRC hack?
  • How APT41 hacked America’s livestock
  • SATCOM hack in Ukraine may bode ill for Musk
  • Much, much more

Material Security’s co-founder Ryan Noon is this week’s sponsor guest. He joins the show to talk about a few things, how the building blocks for a whole new generation of security tooling – like large-scale data crunching tech – is now just available off the shelf. He also talks us through an integration Material has done with a groovy new SOAR platform called Tines.

Risky Business #656 – We expected a cyberwar but got an infowar

PLUS: The Conti implosion is as hilarious as we’d hoped for…

On this week’s show Patrick Gray, Dmitri Alperovitch and Adam Boileau discuss the week’s security news, including:

  • We expected a cyberwar but got an information war
  • People with SDR kits are doing SIGINT in Ukraine
  • Conti has imploded and it’s hilarious
  • Much, much more

This week’s show is brought to you by Proofpoint. Sherrod DeGrippo, Proofpoint’s Vice President of Threat Research and Detection is this week’s sponsor guest. She joins us to talk about how there isn’t really any magic advice she can dispense to protect customers from Russian attacks.

There are some show notes below, but they’re not exhaustive.

Risky Biz Soap Box: US Government will embrace "phishing resistant MFA"

PLUS: Why the cryptocurrency ecosystem is all about hardware security keys...

These Soap Box editions of the show are entirely sponsored – that means everyone you hear in one of these episodes paid to be here.

In this edition we’re talking to Yubico’s Chief Solutions Officer Jerrod Chong. We do one of these Soap Box podcasts with Jerrod every year. Yubico, of course, is the maker of the Yubikey hardware security device.

In this chat with Jerrod we cover a few things – like the zero trust executive order, hardware-backed web transactions and how the industry leading the charge on security keys right now is actually the cryptocurrency space.

Risky Business #655 -- USG: Expect Russian cyber drama

When the sanctions fly, so will the packets...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Ukraine sanctions may lead to Russia going “cyber feral”
  • Brian Krebs links Red Cross breach to Iranian actor
  • APT10 uses cred stuffing as misdirection
  • Report: Global logistics behemoth Expeditors ransomwared
  • NFT thefts still hilarious
  • Inside the epic KlaySwap hack
  • Much, much more

In this week’s sponsor interview Thinkst Canary’s Marco Slaviero talks about some work they’ve done on introducing a “Safety Net” against AWS token enumeration edge cases. That’s a very interesting interview.

Risky Biz Feature: "Everyone has a plan until they get punched in the face"

A look inside the Equinix ransomware incident with its CISO...

There is no weekly news show this week. Instead, we’re running this feature interview with Michael Montoya, the CISO of Equinix. This isn’t a sponsored interview or anything like that, this podcast was prepared with support from the Hewlett Foundation’s Cyber Initiative.

Equinix has 9,000 staff and operates 220 data centres globally. Its annual revenue is in the order of USD$6bn. In September 2020 it was attacked by criminals who deployed the Netwalker ransomware on its corporate network. The attackers demanded a USD$4.5m ransom payment for service restoration and to keep the data they stole from the company private.

This interview has taken a while to organise, but when I first found out Michael was open to the idea of talking through the incident I jumped at it. It’s extremely rare for CISOs to be made available to talk about events like this, but it’s something that should happen more often. We can learn a lot by dissecting these types of incidents publicly. Enjoy!