Podcasts

This week’s show features Patrick Gray and Adam Boileau discussing the week’s security news, including:

• The Marriott, Quora, Dell and Sky Brazil data breaches
• Kashoggi associate to sue NSO Group
• Australia’s AA Bill set to pass
• NZ give Huawei the boot
• AutoCAD malware targets key verticals
• Republicans’ 2018 campaign hacked
• Czech government blames Russia for intrusions into key systems
• Horror-show bug in Kubernetes

This week’s show is brought to you by Duo Security, big thanks to Duo for that! In this week’s sponsor interview we’ll be chatting with Duo Security’s very own Dave Lewis about some Beyond Corp stuff. Beyond Corp is the enterprise computing model of the future and Dave will be along after this week’s news to talk about some of its finer points.

Links to everything that we discussed are below. (That’s why there are extras.) You can follow Patrick or Adam on Twitter if that’s your thing.

This is the first part of our final Snake Oilers edition for 2018.

Snake OIlers, for people don’t know it, is the podcast where vendors pay to come on to the show to promote their wares. This series actually turned out to be way more popular than we expected. People quite like listening to security companies actually explaining what they do in clear terms.

We have six vendors participating in this last round of Snake Oilers for the year – we’ve split the podcast into two podcasts containing three vendor pitches each, and in this part you’ll be hearing pitches from Rapid7, WhiteSource and Chronicle.

• Dan Kuykendall of Rapid7 talks InsightAppSec, its DAST solution.
• David Habusha of WhiteSource talks software composition analysis
• Brandon Levene of Chronicle on VirusTotal Enterprise

Part two is up next week!

We’ve got a slightly different edition of the show this week – Alex Stamos is filling in for Adam Boileau this week in the news slot.

Most of you know him as Facebook’s recently departed chief security officer. Alex also served as the CSO at Yahoo for a time, but his security career stretches back a long way. He co-founded iSEC Partners back in 2004, and before that he did some time with @Stake.

The @Stake mafia is everywhere.

These days Alex is an adjunct professor at Stanford University. He joined me to talk about the week’s security news, as well as to have a chat about the Edward Snowden disclosures, five years on.

This week’s show is brought to you by Thinkst Canary, big thanks to them for that. And instead of one of their staff being on the show this week in the sponsor chair, they asked me to interview this week’s sponsor guest, their customer, Mike Ruth, a security engineer with Cruise Automation.

Mike did a presentation at a conference called QCon recently all about automating the deployment of canary tokens at scale using some nifty CI/CD tricks. He’ll be joining us after the news to tell us all about that.

Items discussed in this week’s news:

• NSO Group busted to selling to Saudi Arabia
• NSO malware targets Mexican journalists
• Edward Snowden claims NSO connection in Khashoggi case
• Australia’s AA Bill latest
• npm supply-chain attack targets Bitcoiners
• Guardian reports Manafort met Assange, denials, lawsuits flying already
• UK parliament seizes Facebook documents
• Uber fined over 2016 breach coverup
• UK cops decline to charge bug reporter
• USPS finally fixes data exposure after Krebs intervention
• Rowhammer attack bypasses ECC protections
• Bloomberg is investigating its own reporting on Supermicro
• Magecart is everywhere
• Google, Mozilla plan browser access to file systems

Links to everything that we discussed are below and you can follow Patrick or Alex on Twitter if that’s your thing.

The Soap Box podcast series is a wholly sponsored podcast series we do here at Risky.Biz – vendors pay to participate. This Soap Box edition is brought to you by AttackIQ.

AttackIQ is a five-year-old company that makes an attack simulation platform. The idea is you agitate a network with suspicious traffic and activities, then measure what the response looks like on the other side. As you’ll hear, Stephan argues this is a better way to test your controls than trying to do it after an incident has been and gone.

Mostly people are using it to verify the effectiveness of their security controls. They already have endpoint security software, IDS, various monitoring bits and pieces, but quite often this stuff just isn’t tuned right. So, you throw some attack traffic and behaviour at your systems and see what bubbles up

One piece of work that has been absolutely vital to AttackIQ’s success is the MITRE ATT&CK Matrix. Like AttackIQ, the ATT&CK Matrix has been around for five years.

Stephan Chenette is AttackIQ’s CTO and he joined me to talk all about how they’re trying to use the ATT&CK Matrix to drive their whole outlook, and, conversely, how they’re spending time talking to MITRE about where the whole thing is going.

This edition of the show features Adam Boileau and Patrick Gray discussing the week’s security news:

• Cozy Bear is back, Fancy Bear has new tooling
• Russian government wants DNC lawsuit thrown out
• Cyber Command submitting samples to VirusTotal
• Google BGP shenanigans
• Australian/China Telecom BGP shenanigans
• All the recent Facebook drama
• More speculative execution bugs
• Julian Assange likely to be charged
• Vault7 leaker facing new charges
• Phineas Fisher investigation abandoned
• Bitcoin/Tether link probed by DoJ, btc in free-fall
• MUCH MOAR

This week’s show is brought to you by Proofpoint.

Sherrod DeGrippo, Proofpoint’s director of threat research and detection is this week’s sponsor guest. Surprisingly, she tells us that ransomware via email is a dead duck.

Links to everything that we discussed are below. (That’s why there are extras.) You can follow Patrick or Adam on Twitter if that’s your thing.

We’ve got a great podcast for you this week. Tanya Janca will be talking about some volunteer work she’s been doing with a Canadian government panel on getting security content into children’s school curriculums.

In this week’s sponsor interview we’ll be talking with Ferruh Mavituna of Netsparker.

They launched Netsparker Cloud a while ago so now they have some decent telemetry I wanted to ask Ferruh what he’s found surprising now he’s sitting on a mountain of scan results. The types of bugs being turned up aren’t really a surprise, but the extent to which old software is a problem was actually pretty surprising to him. He knew it was bad, he says, but he didn’t know it’s this bad.

Adam Boileau, as usual, joins the show this week to talk about all the week’s security news:

• More Chinese MSS officers indicted by the US DoJ
• ASD chief speaks publicly on 5G Huawei ban
• China playing funny buggers with BGP
• Russia is still messing with the US during the midterms
• Facebook boots more Iranian influence pages
• New privacy features in Signal
• Plus much, much more!

Links to everything that we discussed are below, including the discussions that were edited out. (That’s why there are extras.) You can follow Patrick or Adam on Twitter if that’s your thing.

Soap Box is the wholly sponsored podcast series we do where vendors pay to participate. They sometimes want to talk about their products, other times they want to talk about general ecosystem stuff, other times they want to talk about research they’ve done.

And that’s what’s happening today! Olabode Anise is a data scientist at Duo Security. He and his colleague Jordan Wright put together a talk for Black Hat this year all about Twitter bots. It was called Don’t @ me, hunting Twitter bots at scale.

As you’ll hear, finding bots on Twitter at scale isn’t that hard, but doing so with 100% confidence isn’t as easy as you’d think.

You can check out a blog post from Olabode in the show note below.

This edition of the show features Adam Boileau and Patrick Gray discussing the week’s security news:

• CYBERCOM doxing Russian operators. No, really.
• Arrest over Russian midterm info-op
• Bloomberg dumpster fire is now a tyre fire
• Equifax insider sentenced for insider trading
• Twitter releases bot dataset
• Saudi insider responsible for 2015 Twitter breach
• Trisis/Triton now linked to Russia
• Kaspersky doxes NSA op
• Risky Business cited by Senate Estimates, AA Bill faces possible delay
• Much, much more!

This week’s show is sponsored by Cylance, and this week’s sponsor interview is with Josh Lemos.

That’s an interesting chat – Cylance has succeeded in applying machine learning to classifying binaries, but what next? Where does it make sense to apply machine learning next, from their point of view? As you’ll hear, a binary classifier is one thing, but applying ML to something like endpoint detection and response or network traffic is actually a lot more complicated.

Links to everything that we discussed are below, including the discussions that were edited out. (That’s why there are extras.) You can follow Patrick or Adam on Twitter if that’s your thing.

This edition of the show features Adam Boileau and Patrick Gray discussing the week’s security news:

• More info on the Facebook token hack
• Facebook boots “Russian Cambridge Analytica” off platform
• Chinese MSS officer extradited to USA after being lured to Belgium
• NotPetya linked to Sandworm crew
• Czech intelligence services kill Hezbollah APT
• Pentagon travel records pwnt
• No, Khashoggi’s Apple Watch didn’t record his death
• Apple takes aim at Australia’s AA Bill
• US voter records for sale in hack forums
• PHP 5 support ends soon, netpocalypse to commence shortly afterward
• The world’s most hilarious libssh bug
• PLUS MOAR

This week’s show is sponsored by Senrio.

Senrio is best known for doing IoT identification, classification, visualisation and anomaly detection, but they’ve now applied the same approach to general IT. Stephen will be along later in the show to talk about what they’ve been able to engineer here. I’ve actually been working with them on this (in a limited capacity) for a few months and it’s very interesting stuff.

So yeah he’s talking about a feature release, then he’ll be releasing some open source tooling that mine your network metadata and spot interactive shells in your environment, which is handy, and then he’s going to preview some free training he’s doing with some other very well respected security people in New York soon.

Links to everything that we discussed are below, including the discussions that were edited out. (That’s why there are extras.) You can follow Patrick or Adam on Twitter if that’s your thing.

This edition of the show features Adam Boileau and Patrick Gray discussing the week’s security news:

• Bloomberg’s shaky, disputed report on hardware back doors
• A look back on other false reports about imaginary incidents published by Bloomberg
• GRU operations doxed by GCHQ
• DOJ charges Russian intelligence officers
• APT crews targeting MSPs
• Google+ API exposure the final straw
• Enterprise TLS interception gear is woefully insecure

Links to everything that we discussed are below, including the discussions that were edited out. (That’s why there are extras.) You can follow Patrick or Adam on Twitter if that’s your thing.