Our coverage of AusCERT's 2010 conference is sponsored by Microsoft, and there's a few Microsofties floating about here. Two of them, Karl Hanmore and Steve Adegbite, prepared this presentation, titled "Engagement between National and Government CERTs and the vendor community -- benefits and challenges."

In this podcast you'll hear a presentation by Frank Stajano of the University of Cambridge. In it he discusses seven principles for systems security derived from understanding scam victims.

In this podcast we chat to two guys from Australian-based security firm Stratsec.

In this interview we check in with a bit of a legend, Whitfield Diffie. He's universally credited as one of the creators of public key infrastructure, and he was the opening keynote speaker at the AusCERT conference.

In this sponsor podcast you'll hear an excerpt from Crispin Cowan's talk. Crispin works for Microsoft, but he used to be a vocal Microsoft critic and Linux fundamentalist.

In this podcast you'll hear me speaking with Assurance.com.au's Neal Wise about the seven deadly sins of mobility. Neal's a penetration tester and a complete and utter wireless nerd. He's a regular on the show and as it turns out he's a standby speaker for this year's AusCERT conference. If anyone winds up too hungover on Wednesday to speak, Neal will step in.

This week's show is sponsored by Check Point Software.

This week's feature interview is with Matt Olney of Sourcefire's vulnerability research team. These guys have put a bunch of work into a new open source tool that can grab files, like PDFs, off the wire, scan them for dodgy stuff and trigger Snort alerts.

In this RB2 podcast, sponsored by Symantec, Lateral Security's Adam Boileau and Mark Piper talk Web application hacking tools. What's hot? What's not? Web Scarab, Burp or CAT? Which for what? Play to find out!

H D Moore is this week's feature guest. The company he works for, Rapid7, will soon release a commercial version of Metasploit.

On this week's show we have a chat to Paul Ducklin about what he sees as questionable ethics behind some mobile malware research.

In this edition of the RB2 podcast we're chatting with Declan Ingram from Securus Global about an interesting report that was recently released by analysis house Forrester.

Risky Business 2 is sponsored exclusively by Symantec.

This week we speak to iDefense analyst Kim Zenz, who's currently based in Moscow. We'll be getting an update on what the bad guys are up to in the former USSR, after all it's usually a good indicator of what they'll get up to in Western countries in the not too distant future.

While not the worst kind of data leak, the mistake has left the vendor somewhat red faced and contrite. Following enquiries from Risky.Biz last week the company e-mailed the users affected by the blunder.

There's no feature interview in this week's show -- it has an empty middle, just like an Easter egg!

This week we chat with Assistant Commissioner Neil Gaughan of Australia's Federal Police about trends in fraud.

This week we've got Brian Snow on the show again. Brian had a 34 year career with the NSA in the States -- when he retired just a few years ago he was the technical director of Information Assurance there.

Sourcefire partners in the Asia Pacific region have been bombarded with abusive e-mails purporting to come from Ammar Hindi, the company's APAC and Japan managing director.

Hindi isn't sending the mail. The company suspects the messages are the work of a disgruntled ex-employee based in Singapore. "We have strong suspicions who it is, but haven't been able to establish it definitively," a source close to the matter told Risky.Biz. "It was our hope that they'd lose interest and move on, but after every period of quiet, another wave goes off."

The e-mails appear designed to cause embarrassment to Hindi. "Mother f--ker! Wake up your idea and be more productive with more f--king sales order of Sourcefire in the next 30days so that Sourcefire can have a f--king good Q1 2010 under my charge," says of the e-mails, sent from a Gmail account set up in Hindi's name.

"Wake up your f--king idea and focus on f--king Sourcefire sales only or else you are not my f--king good partner for APAC," reads another.

One partner interviewed by Risky.Biz says the e-mails are a particularly bad look for an information security software company. "Because its Sourcefire... it is worse in that they should be more responsible in protecting information," he says. "But at the same time, its only email addresses to partners which are probably available to most staffers. Any disgruntled employee could have easily taken some or all of this info prior to walking into an exit interview or to resign."

The partner expressed surprise that Sourcefire hasn't reached out to those affected to explain the situation. For its part, sources within Sourcefire say they don't want to respond as it may encourage the alleged offender.

All of the e-mails target Hindi, according to the source, and the company is making slow progress in pinning down the alleged offender. "The [legal] tools that are available to us are relatively blunt," the source says.

Impersonation is a form of fraud in many jurisdictions, the source says, but in others the behaviour is harder to pigeonhole into a specific offence.

"John Doe" court actions have been filed against the sender of the e-mails in various jurisdictions, the source says, and the company is working hard to prove the identity of the miscreant. "We'll keep plugging away until we can develop a record and hand it over to the police," the source says.

Until that happens, it seems Sourcefire partners will have to cope with the occasional, expletive-laden, poorly-written rant.

Follow Patrick Gray on Twitter here.

Anonymous comments enabled.

On this week's show we're having an extended chat with our good mate Greg Shipley.