Podcasts - Risky Business

Risky Business Podcast

April 02, 2015

Risky Business #360 -- The Great GitHub DDoS of 2015

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

In this week's show we chat with Arbor Networks' Roland Dobbins about the Great GitHub DDoS of 2015, Paul Asadoorian of Tenable Network Security about vulnerability management and, of course, Adam Boileau about the week's security news.

Don't forget you can now support the Risky Business page via our Patreon campaign. Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

DEA Agent Charged With Acting as a Paid Mole for Silk Road | WIRED
http://www.wired.com/2015/03/dea-agent-charged-acting-paid-mole-silk-road/

Silk Road Boss' First Murder-for-Hire Was His Mentor's Idea | WIRED
http://www.wired.com/2015/04/silk-road-boss-first-murder-attempt-mentors...

Feds Demand Reddit Identify Users of a Dark-Web Drug Forum | WIRED
http://www.wired.com/2015/03/dhs-reddit-dark-web-drug-forum/

Massive denial-of-service attack on GitHub tied to Chinese government | Ars Technica
http://arstechnica.com/security/2015/03/massive-denial-of-service-attack...

DDoS Attack on GitHub Linked to Earlier One Against GreatFire.org | Threatpost | The first stop for security news
https://threatpost.com/ddos-attack-on-github-linked-to-earlier-one-again...

Google Online Security Blog: Maintaining digital certificate security
http://googleonlinesecurity.blogspot.co.nz/2015/03/maintaining-digital-c...

New Obama Order Allows Sanctions Against Foreign Hackers | WIRED
http://www.wired.com/2015/04/new-obama-order-allows-sanctions-foreign-ha...

E-mail autofill blunder leaks personal details of G20 world leaders | Ars Technica
http://arstechnica.com/tech-policy/2015/03/e-mail-autofill-blunder-leaks...

Volatile Cedar APT Group First Operating Out of Lebanon | Threatpost | The first stop for security news
https://threatpost.com/volatile-cedar-apt-group-first-operating-out-of-l...

Bitcoin's Blockchain Offers Safe Haven For Malware And Child Abuse, Warns Interpol - Forbes
http://www.forbes.com/sites/thomasbrewster/2015/03/27/bitcoin-blockchain...

Energy companies around the world infected by newly discovered malware | Ars Technica
http://arstechnica.com/security/2015/03/energy-companies-around-the-worl...

Stolen Uber Customer Accounts Are for Sale on the Dark Web for $1 | Motherboard
http://motherboard.vice.com/read/stolen-uber-customer-accounts-are-for-s...

Noose around Internet's TLS system tightens with 2 new decryption attacks | Ars Technica
http://arstechnica.com/security/2015/03/noose-around-internets-tls-syste...

Google joins Apple, others in calling for spying controls, as Patriot Act vote nears - CNET
http://www.cnet.com/news/google-joins-apple-others-in-calling-for-spying...

NSA considered ending phone surveillance program -- report - CNET
http://www.cnet.com/news/nsa-considered-ending-phone-surveillance-progra...

Little Change in Online Behavior Following Snowden Revelations | Threatpost | The first stop for security news
https://threatpost.com/little-change-in-online-behavior-following-snowde...

Cross-dressing blokes storm NSA HQ: One shot dead, one hurt \u2022 The Register
http://www.theregister.co.uk/2015/03/30/nsa_hq_rammed/

New Firefox version says "might as well" to encrypting all Web traffic | Ars Technica
http://arstechnica.com/security/2015/04/new-firefox-version-says-might-a...

Verizon Allows Opt Out of UIDH Mobile Supercookie | Threatpost | The first stop for security news
https://threatpost.com/verizon-allows-opt-out-of-uidh-mobile-supercookie...

Multicast DNS Vulnerability Could Lead to DDOS Amplification | Threatpost | The first stop for security news
https://threatpost.com/multicast-dns-vulnerability-could-lead-to-ddos-am...

Google kills 200 ad-injecting Chrome extensions, says many are malware | Ars Technica
http://arstechnica.com/security/2015/04/google-kills-200-ad-injecting-ch...

'Revolution' Crimeware & EMV Replay Attacks - Krebs on Security
http://krebsonsecurity.com/2015/04/revolution-crimeware-emv-replay-attacks/

Sign Up at irs.gov Before Crooks Do It For You - Krebs on Security
http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-i...

Who Is the Antidetect Author? - Krebs on Security
http://krebsonsecurity.com/2015/03/who-is-the-antidetect-author/

Critical Vulnerabilities Affecting JSON Web Token Libraries | Threatpost | The first stop for security news
https://threatpost.com/critical-vulnerabilities-affect-json-web-token-li...

This one weird trick deletes any YouTube flick in just a few clicks \u2022 The Register
http://www.theregister.co.uk/2015/04/01/simple_trick_to_delete_any_youtu...

Trailer: Shades of Black - The Valhalla Lights story
https://www.youtube.com/watch?v=ZQdLyNNgYcA

Risky Business #360 -- The Great GitHub DDoS of 2015

0:00 / 0:00

Risky Business Podcast

March 26, 2015

Risky Business #359 -- Whisper? More like shout!

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

This week Risky Business takes you behind the scenes of a spat between the makers of the Whisper App and Stephen Ridley's company Xipiter.

Ridley's crew say they found some 24-carat-facepalm security problems with the app, subsequently publishing a blog post and video detailing the bugs. You'd think whisper would patch the bugs and move on. But no, they decided to accuse Xipiter of making the whole thing up, even going so far as to accuse them of doctoring their proof of concept video!

Stephen Ridley will join the show to discuss all of that.

This week's show is brought to you by FireEye, makers of fine, fine security software and appliances. And this week's guest is Steve Miller. Steve is American, he came from the Mandiant side of FireEye's business, but he's moved to Sydney to head up security operations for FireEye in APJ! We'll be talking to him about some tales from the incident response trenches and how really good target profiling has become a standard part of the contemporary attacker's MO.

Don't forget you can now support the Risky Business page via our Patreon campaign. Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

You can become a Risky Business patron here:
https://www.patreon.com/riskybusiness

News:

Islamic State doxes US soldiers, airmen, calls on supporters to kill them | Ars Technica
http://arstechnica.com/tech-policy/2015/03/islamic-state-doxes-us-soldie...

All four major browsers take a stomping at Pwn2Own hacking competition | Ars Technica
http://arstechnica.com/security/2015/03/all-four-major-browsers-take-a-s...

Google warns of unauthorized TLS certificates trusted by almost all OSes [Updated] | Ars Technica
http://arstechnica.com/security/2015/03/google-warns-of-unauthorized-tls...

Windows 10 to make the Secure Boot alt-OS lock out a reality | Ars Technica
http://arstechnica.com/information-technology/2015/03/windows-10-to-make...

Google Adds Deceptive Software to Safe Browsing API | Threatpost | The first stop for security news
https://threatpost.com/google-adds-deceptive-software-to-safe-browsing-a...

MRIs show our brains shutting down when we see security prompts | Ars Technica
http://arstechnica.com/security/2015/03/mris-show-our-brains-shutting-do...

Stealing Data From Computers Using Heat | WIRED
http://www.wired.com/2015/03/stealing-data-computers-using-heat/

Hacking BIOS Chips Isn't Just the NSA's Domain Anymore | WIRED
http://www.wired.com/2015/03/researchers-uncover-way-hack-bios-undermine...

Tax Fraud Advice, Straight from the Scammers - Krebs on Security
http://krebsonsecurity.com/2015/03/tax-fraud-advice-straight-from-the-sc...

Malicious user hides trojan links in cloned Steam Greenlight pages | Ars Technica
http://arstechnica.com/gaming/2015/03/malicious-user-hides-trojan-links-...

Twitch resets user passwords following breach | Ars Technica
http://arstechnica.com/security/2015/03/twitch-resets-user-passwords-fol...

Hilton Honors Flaw Exposed All Accounts - Krebs on Security
http://krebsonsecurity.com/2015/03/hilton-honors-flaw-exposed-all-accounts/

Target to pay $10 million to victims of data breach - CNET
http://www.cnet.com/news/target-to-pay-10-million-to-victims-of-data-bre...

A $60 Gadget That Makes Car Hacking Far Easier | WIRED
http://www.wired.com/2015/03/60-gadget-thatll-make-car-hacking-easier-ever/

Dridex Campaign Evades Detection with AutoClose Function | Threatpost | The first stop for security news
https://threatpost.com/latest-dridex-campaign-evades-detection-with-auto...

Adobe CVE-2011-2461 Remains Exploitable Via Flex Four Years After Patch | Threatpost | The first stop for security news
https://threatpost.com/adobe-cve-2011-2461-remains-exploitable-four-year...

Cisco Small Business IP Phones Open to Remote Eavesdropping | Threatpost | The first stop for security news
https://threatpost.com/cisco-small-business-ip-phones-open-to-remote-eav...

Default Setting in Windows 7, 8.1 Could Allow Privilege Escalation | Threatpost | The first stop for security news
https://threatpost.com/default-setting-in-windows-7-8-1-could-allow-priv...

Instagram API Bug Could Allow Malware Downloads | Threatpost | The first stop for security news
https://threatpost.com/instagram-api-bug-could-allow-malicious-file-down...

OpenSSL Patches High Severity DOS Vulnerability | Threatpost | The first stop for security news
https://threatpost.com/openssl-mystery-patch-is-no-heartbleed/111708

Android hijacking bug may allow attackers to install password-stealers | Ars Technica
http://arstechnica.com/security/2015/03/android-hijacking-bug-may-allow-...

Background on The Guardian vs Whisper:

Corrections and clarifications | News | The Guardian
http://www.theguardian.com/news/2015/mar/11/corrections-and-clarifications

The Whisper Campaign That Torched A Guardian Story - BuzzFeed News
http://www.buzzfeed.com/mathonan/the-whisper-campaign-that-torched-a-gua...

"a confederacy of 'privacy' dunces": what we found under the hood of an 'anonymous' chat app used by millions - Xipiter
http://www.xipiter.com/musings/a-confederacy-of-privacy-dunces-what-we-f...

Music!

Pendulum - ABC News Theme Remix Full Version + Download - YouTube
https://www.youtube.com/watch?v=8XbQsjRc7L0

Risky Business #359 -- Whisper? More like shout!

0:00 / 0:00

Risky Business Podcast

March 19, 2015

Risky Business #358 -- HD Moore and Haroon Meer play "king for a day"

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we chat with Rapid7's HD Moore (feature) and Thinkst head honcho Haroon Meer (sponsor) about the big-picture changes that could see enterprise security actually change. They're both high-level interviews with two of the industry's sharpest.

Don't forget to check out this week's Risky Business video!

Don't forget you can now support the Risky Business page via our Patreon campaign. Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Have you checked out this week's Risky Business YouTube video?
https://www.youtube.com/watch?v=TY0mBzP7qw8

German Police Just Made a Gigantic Dark-Web Drug Bust | WIRED
http://www.wired.com/2015/03/evolution-shiny-flakes-bust-heroin-cocaine-...

The Dark Web's Top Drug Market, Evolution, Just Vanished | WIRED
http://www.wired.com/2015/03/evolution-disappeared-bitcoin-scam-dark-web/

Hackers May Have Taken Medical Records From Insurer Premera | WIRED
http://www.wired.com/2015/03/hackers-may-taken-medical-records-insurer-p...

Bogus SSL certificate for Windows Live could allow man-in-the-middle hacks | Ars Technica
http://arstechnica.com/security/2015/03/bogus-ssl-certificate-for-window...

Man who obtained Windows Live cert said his warnings went unanswered | Ars Technica
http://arstechnica.com/security/2015/03/man-who-obtained-windows-live-ce...

Microsoft takes 4 years to recover privileged TLS certificate addresses | Ars Technica
http://arstechnica.com/security/2015/03/microsoft-takes-4-years-to-recov...

Obama Administration Seeks More Legal Power to Disrupt Botnets | Threatpost | The first stop for security news
https://threatpost.com/obama-administration-seeks-more-legal-power-to-di...

CISA Cybersecurity Bill Advances Despite Privacy Concerns | WIRED
http://www.wired.com/2015/03/cisa-cybersecurity-bill-advances-despite-pr...

Mobile Android, iOS Apps Still Vulnerable to FREAK Attacks | Threatpost | The first stop for security news
https://threatpost.com/mobile-android-ios-apps-still-vulnerable-to-freak...

Shared Keys Simplify, Cheapen FREAK Attacks | Threatpost | The first stop for security news
https://threatpost.com/shared-keys-simplify-cheapen-freak-attacks/111668

Yahoo Previews End To End Email Encryption | Threatpost | The first stop for security news
https://threatpost.com/yahoo-previews-end-to-end-email-encryption-extens...

Yahoo wants to let you forget your Yahoo password - CNET
http://www.cnet.com/news/yahoo-wants-to-let-you-forget-your-yahoo-password/

Guardian backtracks, says Whisper doesn't spy on its users after all | Ars Technica
http://arstechnica.com/security/2015/03/guardian-backtracks-says-whisper...

Strange snafu hijacks UK nuke maker's traffic, routes it through Ukraine | Ars Technica
http://arstechnica.com/security/2015/03/mysterious-snafu-hijacks-uk-nuke...

South Korea claims North hacked nuclear data | Ars Technica
http://arstechnica.com/security/2015/03/south-korea-claims-north-hacked-...

Hey Twitter, Killing Anonymity's a Dumb Way to Fight Trolls | WIRED
http://www.wired.com/2015/03/hey-twitter-killing-anonymitys-dumb-way-fig...

Facebook Messenger will now let you send money to friends | The Verge
http://www.theverge.com/2015/3/17/8235781/facebook-messanger-payments-se...

Microsoft's Windows Hello will make your face, finger or iris the new sign-in - CNET
http://www.cnet.com/news/microsoft-introduces-windows-hello-for-signing-...

Authorities Closing In on Hackers Who Stole Data From JPMorgan Chase - NYTimes.com
http://www.nytimes.com/2015/03/16/business/dealbook/authorities-closing-...

BlackBerry takes another shot at a tablet -- sort of - CNET
http://www.cnet.com/news/blackberry-takes-another-shot-at-a-tablet-sort-of/

State Department takes network offline for security scrub - CNET
http://www.cnet.com/news/state-department-takes-network-offline-for-secu...

Google Apps bug exposes some users' personal info - CNET
http://www.cnet.com/news/bug-in-google-apps-exposes-some-users-personal-...

Stealthy, Persistent DLL Hijacking Works Against OS X | Threatpost | The first stop for security news
https://threatpost.com/stealthy-persistent-dll-hijacking-works-against-o...

Google Fix for Android Memory Leakage Issue In The Works | Threatpost | The first stop for security news
https://threatpost.com/google-aware-of-memory-leakage-issue-in-android-5...

Samsung Patches Social Media Vulnerability in Millions of Devices | Threatpost | The first stop for security news
https://threatpost.com/after-delays-samsung-patches-social-media-vulnera...

MS Update 3033929 Causing Reboot Loop - Krebs on Security
http://krebsonsecurity.com/2015/03/ms-update-3033929-causing-reboot-loop/

OpenSSL Patch to Plug Severe Security Holes - Krebs on Security
http://krebsonsecurity.com/2015/03/openssl-patch-to-plug-severe-security...

Apple Safari WebKit Vulnerabilities Patched | Threatpost | The first stop for security news
https://threatpost.com/apple-patches-webkit-vulnerabilities-in-safari/11...

D-Link Patches Two Vulnerabilities in Router Firmware | Threatpost | The first stop for security news
https://threatpost.com/d-link-patches-two-remotely-exploitable-bugs-in-f...

Adobe Flash Update Plugs 11 Security Holes - Krebs on Security
http://krebsonsecurity.com/2015/03/adobe-flash-update-plugs-11-security-...

ThinkstScapes
http://thinkst.com/thinkstscapes.html

Phish5 - Five minutes from start to phish
https://phish5.com/

The Bamboos - I Got Burned feat Tim Rogers - YouTube
https://www.youtube.com/watch?v=ASS_naRGRZY

Risky Business #358 -- HD Moore and Haroon Meer play "king for a day"

0:00 / 0:00

Other Category

March 17, 2015

Risky Business on YouTube! Episode 3: Victim shaming

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

The infosec industry has failed to protect the Internet and networks attached to it. So why do people who work in it engage in victim-shaming?

Risky Business Podcast

March 12, 2015

Risky Business #357 -- Mark Dowd talks Rowhammer

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're having a chat with Mark Dowd about the so-called Rowhammer exploit. And yeah, if you haven't heard about this one you're in for a treat. It's among the most badass research I've ever seen. You know, you can skin a cat with a knife, or you can do what the Google Project Zero team did and skin it with 300 synchronised lasers.

[NOTE: It's been pointed out that the post on the Project Zero blog is actually a guest post. The work was done by Googlers and published on the Google Zero blog, but these researchers aren't actually a part of the Project Zero team. Sorry for the confusion.]

In this week's sponsor episode we're chatting with Joseph Sokoly of Tenable Network Security about bugs like Freak. The fact is, if you're operating a web property and you were running your SSL config correctly, Freak wouldn't be a risk to your users when they're using your service.

But a lot of organisations just don't bother running best-practice configs. Why not? They're too busy putting out fires in their vuln management programs to deal with the low-hangers. Joseph stops by soon to talk about that.

(Joseph is also one of the voices of the Southern Fried Security Podcast. Check it out here, because I'm guessing if you're reading this you like security podcasts!)

Show notes

Patched Windows PC remained vulnerable to Stuxnet USB exploits since 2010 | Ars Technica
http://arstechnica.com/security/2015/03/patched-windows-pc-remained-vuln...

Stuxnet leak probe stalls for fear of confirming US-Israel involvement | Ars Technica
http://arstechnica.com/tech-policy/2015/03/stuxnet-leak-probe-stalls-for...

UK man arrested on suspicion of US Department of Defense hacking | Ars Technica
http://arstechnica.com/tech-policy/2015/03/uk-man-arrested-on-suspicion-...

iSpy: The CIA Campaign to Steal Apple's Secrets
https://firstlook.org/theintercept/2015/03/10/ispy-cia-campaign-steal-ap...

Errata Security: No, the CIA isn't stealing Apple's secrets
http://blog.erratasec.com/2015/03/no-cia-isnt-stealing-apples-secrets.ht...

Australia to prosecute Heartbleed pentest in desperation to pin charges on Anonymous radio host | ZDNet
http://www.zdnet.com/article/australia-to-prosecute-heartbleed-pentest-i...

OpenSSL Security Audit Ready to Start | Threatpost | The first stop for security news
https://threatpost.com/openssl-security-audit-ready-to-start/111538

Anthem Refuses Audit Following Massive Breach | Threatpost | The first stop for security news
https://threatpost.com/anthem-refusing-oig-security-audit-following-brea...

Why Clinton's Private Email Server Was Such a Security Fail | WIRED
http://www.wired.com/2015/03/clintons-email-server-vulnerable/

Hillary Clinton Says Her Email Was Secure; She Can't Know | WIRED
http://www.wired.com/2015/03/hillary-clinton-says-email-secure-cant-know/

Feds Indict Three in 2011 Epsilon Hack - Krebs on Security
http://krebsonsecurity.com/2015/03/feds-indict-three-in-2011-epsilon-hack/

Stop Spying on Wikipedia Users - NYTimes.com
http://www.nytimes.com/2015/03/10/opinion/stop-spying-on-wikipedia-users...

Litecoin-mining code found in BitTorrent app, freeloaders hit the roof \u2022 The Register
http://www.theregister.co.uk/2015/03/07/utorrent_epic_scale_mining_softw...

Adobe Starts Vulnerability Disclosure Program on HackerOne | Threatpost | The first stop for security news
https://threatpost.com/adobe-starts-vulnerability-disclosure-program-on-...

Apple Fixes FREAK Bug, iCloud Flaw in iOS 8.2 | Threatpost | The first stop for security news
https://threatpost.com/apple-fixes-freak-bug-icloud-flaw-in-ios-8-2/111553

Yahoo Patches Critical Small Business, eCommerce Bugs | Threatpost | The first stop for security news
https://threatpost.com/yahoo-patches-critical-ecommerce-small-business-v...

Dropbox Patches Remotely Exploitable Vulnerability in SDK | Threatpost | The first stop for security news
https://threatpost.com/dropbox-patches-remotely-exploitable-vulnerabilit...

Facebook Users Open to Attack Via Several Security Bugs | Threatpost | The first stop for security news
https://threatpost.com/facebook-users-open-to-attack-via-several-securit...

Patch Tuesday patches FREAK, Universal XSS | Ars Technica
http://arstechnica.com/information-technology/2015/03/patch-tuesday-patc...

Microsoft Fixes Stuxnet Bug, Again - Krebs on Security
http://krebsonsecurity.com/2015/03/microsoft-fixes-stuxnet-bug-again/

You Am I - Soldiers - YouTube
https://www.youtube.com/watch?v=P1SV4v_qtBI

Rowhammer
http://www.rowhammer.com/

Risky Business #357 -- Mark Dowd talks Rowhammer

0:00 / 0:00

Risky Business Podcast

March 09, 2015

Risky Business Extra: Senator Scott Ludlam on mandatory metadata retention

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

Senator Scott Ludlam of the Greens party is the only Australian politician kicking up a stink about the government's metadata retention bill. And we're glad about that, it's a pretty defective bill, even if some recent amendments recommended by the Parliamentary Joint Committee on Intelligence and Security (PJCIS) have made it much more palatable.

Scott was passing through my town last week campaigning on behalf of the local Greens state election candidate for Ballina -- the NSW election is coming up at the end of March. So, we caught up and did this interview all about the latest with the bill and the politics behind it.

The Green's full metadata video is here.

Check out the full text of Scott's senate speech here.

Risky Business Extra: Senator Scott Ludlam on mandatory metadata retention

0:00 / 0:00

Risky Business Podcast

March 05, 2015

Risky Business #356 -- Crypto Wars 2.0 with guest Alex Stamos

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

This week's feature interview is with Alex Stamos, CISO of Yahoo. Alex did a fantastic AppSec keynote in early February that I wanted to ask him about, so we booked this interview a couple of weeks ago.

Then, last week, Alex made the news. Big time.

While on a panel with Admiral Mike Rogers, Alex challenged the NSA chief on the government's apparent desire to mandate the introduction of interception capabilities into products made by technology companies.

Alex asked if companies that agreed to introduce back doors for the US government should also agree to provide similar back doors to other countries as well, ones that might not be democratic. From there, there was some to and fro.

It was a cordial exchange but it was written up as a stoush.

Alex joined me via Skype to discuss that exchange, security at scale and bug bounties.

It's time for this week's sponsor interview now with Julian Fay, CTO and co-founder of Senetas, makers of fine, fine hardware security equipment.

Julian joined me this week to discuss a raft of crypto news, starting off with the Freak vulnerability, which, as best I can tell, isn't actually a giant fireball heading towards earth, despite what some of the tech press might be saying.

Don't forget you can now support the Risky Business page via our Patreon campaign. Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Google quietly backs away from encrypting new Lollipop devices by default [Updated] | Ars Technica
http://arstechnica.com/gadgets/2015/03/google-quietly-backs-away-from-en...

Buyout puts supersecure Blackphone in one company's hands - CNET
http://www.cnet.com/news/silent-circle-buys-out-secure-blackphone-hardwa...

There's Now a Free iPhone App That Encrypts Calls and Texts | WIRED
http://www.wired.com/2015/03/iphone-app-encrypted-voice-texts/

Sailfish Secure wants to be an Android alternative safe from spies' prying eyes - CNET
http://www.cnet.com/news/sailfish-secure-wants-to-be-an-android-alternat...

Tim Cook to governments: Lay off our privacy - CNET
http://www.cnet.com/news/tim-cook-to-governments-lay-off-our-privacy/

US court rubber-stamps dragnet metadata surveillance (again) \u2022 The Register
http://www.theregister.co.uk/2015/03/02/dragnet_metadata_surveillance_ex...

Komodia Certificate Manipulation Enabled Man-In-The-Middle Attacks | Threatpost | The first stop for security news
http://threatpost.com/komodia-certificate-manipulation-likely-led-to-man...

Lenovo.com hijack reportedly pulled off by hack on upstream registrar | Ars Technica
http://arstechnica.com/security/2015/02/lenovo-com-hijack-reportedly-pul...

More IoT insecurity: This Blu-ray disc pwns PCs and DVD players | Ars Technica
http://arstechnica.com/security/2015/03/more-iot-insecurity-this-blu-ray...

In major goof, Uber stored sensitive database key on public GitHub page | Ars Technica
http://arstechnica.com/security/2015/03/in-major-goof-uber-stored-sensit...

50,000 Uber driver names, license numbers exposed in a data breach | Ars Technica
http://arstechnica.com/business/2015/02/50000-uber-driver-names-license-...

Apple Pay a haven for 'rampant' credit card fraud, say experts \u2022 The Register
http://www.theregister.co.uk/2015/03/03/apple_pay_plastic_fraud/

Credit Card Breach at Mandarin Oriental - Krebs on Security
http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-orien...

Iran hacks America where it hurts: Las Vegas casinos \u2022 The Register
http://www.theregister.co.uk/2015/02/27/iran_behind_us_casino_hack/

Alleged Aussie Anon hauled in for Indonesia phone tap hacking spat \u2022 The Register
http://www.theregister.co.uk/2015/02/27/alledged_aussie_anon_hauled_in_f...

Hospital Sues Bank of America Over Million-Dollar Cyberheist - Krebs on Security
http://krebsonsecurity.com/2015/03/hospital-sues-bank-of-america-over-mi...

Natural Grocers Investigating Card Breach - Krebs on Security
http://krebsonsecurity.com/2015/03/natural-grocers-investigating-card-br...

Government moves quickly to adopt metadata retention law review recommendations
http://www.smh.com.au/it-pro/government-it/government-moves-quickly-to-a...

Federal MPs hit in phone prank | Herald Sun
http://www.heraldsun.com.au/news/federal-mps-hit-in-phone-prank/story-fn...

Seagate Business NAS Firmware Vulnerabilities Disclosed | Threatpost | The first stop for security news
http://threatpost.com/seagate-business-nas-firmware-vulnerabilities-disc...

D-Link Working on Firmware Updates for Three Critical Bugs | Threatpost | The first stop for security news
http://threatpost.com/d-link-working-on-firmware-updates-for-three-criti...

Spam Uses Default Passwords to Hack Routers - Krebs on Security
http://krebsonsecurity.com/2015/02/spam-uses-default-passwords-to-hack-r...

Firefox 37 to Include New OneCRL Certificate Blocklist | Threatpost | The first stop for security news
http://threatpost.com/firefox-37-to-include-new-onecrl-certificate-block...

Patrick Gray on the State of Security and State Security | Threatpost | The first stop for security news
http://threatpost.com/patrick-gray-on-the-state-of-security-and-state-se...

New Zealand Spies on Neighbors in Secret 'Five Eyes' Global Surveillance - The Intercept
https://firstlook.org/theintercept/2015/03/04/new-zealand-gcsb-surveilla...

Snowden revelations / The price of the Five Eyes club: Mass spying on friendly nations - National - NZ Herald News
http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11411759

"FREAK" flaw in Android and Apple devices cripples HTTPS crypto protection | Ars Technica
http://arstechnica.com/security/2015/03/freak-flaw-in-android-and-apple-...

Surveillance-based manipulation: How Facebook or Google could tilt elections | Ars Technica
http://arstechnica.com/security/2015/02/surveillance-based-manipulation-...

House committee subpoenas Clinton emails in Benghazi probe
http://bigstory.ap.org/article/b78ba433af3a45209668f745158d994c/clinton-...

AppSec is Eating Security - Opening Keynote - AppSec California 2015 - Alex Stamos - YouTube
https://www.youtube.com/watch?v=-1kZMn1RueI

Here's how the clash between the NSA Director and a senior Yahoo executive went down. - The Washington Post
http://www.washingtonpost.com/blogs/the-switch/wp/2015/02/23/heres-how-t...

Senetas
http://www.senetas.com/

Rainy Day Women | triple j Unearthed
https://www.triplejunearthed.com/artist/rainy-day-women

Risky Business #356 -- Crypto Wars 2.0 with guest Alex Stamos

0:00 / 0:00

Risky Business Podcast

February 26, 2015

Risky Business #355 -- Gemalto op exposes cellphone crypto flaws

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're speaking with Philippe Langlois. You may remember him as the founder of Qualys in the 90s, but these days he's the CEO and founder of P1 Security, a telecommunications security firm. He'll be joining us to discuss the NSA and GCHQ operation against SIM card manufacturer Gemalto.

Last week The Intercept reported on some Snowden dox that said NSA and GCHQ were basically scooping up SIM card private keys from anywhere they could, including from within Gemalto's network. Because cellphone encryption schemes are symmetric, this is bad. It's very, very bad. We'll talk to Philippe about that.

This week's show is sponsored by Palo Alto Networks, big thanks to them. PAN CSO Rick Howard will be along in this week's sponsor interview to talk about one of his passion projects, the Cybersecurity Canon. It's basically his book club idea that PAN is now sponsoring and it's got a LOT of potential. Find out how you can get involved in this week's sponsor interview, with big thanks to Palo Alto Networks.

Don't forget you can now support the Risky Business page via our Patreon campaign. Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle
https://firstlook.org/theintercept/2015/02/19/great-sim-heist/

PCS Harvesting at Scale - The Intercept
https://firstlook.org/theintercept/document/2015/02/19/pcs-harvesting-sc...

Gemalto Doesn't Know What It Doesn't Know - The Intercept
https://firstlook.org/theintercept/2015/02/25/gemalto-doesnt-know-doesnt...

Lenovo Superfish Certificate Password Cracked | Threatpost | The first stop for security news
http://threatpost.com/lenovo-superfish-certificate-password-cracked/111165

Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections [Updated] | Ars Technica
http://arstechnica.com/security/2015/02/lenovo-pcs-ship-with-man-in-the-...

How to remove the Superfish malware: What Lenovo doesn't tell you | Ars Technica
http://arstechnica.com/security/2015/02/how-to-remove-the-superfish-malw...

Get your Snort rules here: SuperFish Detection - SquareLemon
http://blog.squarelemon.com/blog/2015/02/20/superfish-detection/

------------------------
Support Risky Business on Patreon:
https://patreon.com/riskybusiness
------------------------

Security software found using Superfish-style code, as attacks get simpler | Ars Technica
http://arstechnica.com/security/2015/02/security-software-found-using-su...

Here's how the clash between the NSA Director and a senior Yahoo executive went down. - The Washington Post
http://www.washingtonpost.com/blogs/the-switch/wp/2015/02/23/heres-how-t...

Spies Can Track You Just by Watching Your Phone's Power Use | WIRED
http://www.wired.com/2015/02/powerspy-phone-tracking/

LenoLOL! 'Lizard Squad HACKS lenovo.com' \u2022 The Register
http://www.theregister.co.uk/2015/02/25/thought_things_couldnt_get_worse...

TrueCrypt Audit Cryptanalysis Handed Off to NCC Group | Threatpost | The first stop for security news
http://threatpost.com/truecrypt-audit-stirs-back-to-life/111162

Moxie Marlinspike >> Blog >> GPG And Me
http://www.thoughtcrime.org/blog/gpg-and-me/

Hackers Cut in Line at the Burning Man Ticket Sale-And Get Caught | WIRED
http://www.wired.com/2015/02/hacking-burning-man-tickets/

How Hackers Abused Tor To Rob Blockchain, Steal Bitcoin, Target Private Email And Get Away With It - Forbes
http://www.forbes.com/sites/thomasbrewster/2015/02/24/blockchain-and-dar...

Hacker Claims Feds Hit Him With 44 Felonies When He Refused to Be an FBI Spy | WIRED
http://www.wired.com/2015/02/hacker-claims-feds-hit-44-felonies-refused-...

Accused British hacker, wanted for crimes in US, won't give up crypto keys | Ars Technica
http://arstechnica.com/tech-policy/2015/02/accused-british-hacker-wanted...

LinkedIn premium users to get $1 each in password-leak settlement | Ars Technica
http://arstechnica.com/tech-policy/2015/02/linkedin-premium-users-to-get...

FBI: $3M Bounty for ZeuS Trojan Author - Krebs on Security
http://krebsonsecurity.com/2015/02/fbi-3m-bounty-for-zeus-trojan-author/

Europol cracks down on botnet infecting 3.2 million computers | Ars Technica
http://arstechnica.com/tech-policy/2015/02/europol-cracks-down-on-botnet...

Snowden's favourite Linux - Tails - rushes sec-fix version to market \u2022 The Register
http://www.theregister.co.uk/2015/02/25/tails_project_rushes_secfix_vers...

Cybersecurity Canon
https://www.paloaltonetworks.com/threat-research/cybercanon.html

P1 Security
http://www.p1sec.com/corp/

The Shins - Phantom Limb [OFFICIAL VIDEO] - YouTube
https://www.youtube.com/watch?v=OkITsv3Nk6M

Risky Business #355 -- Gemalto op exposes cellphone crypto flaws

0:00 / 0:00

Risky Business Podcast

February 20, 2015

Risky Business #354 -- Breaking exploit automation

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're chatting with Assured Information Security senior research engineer Jacob Torrey about some work he's due to present at SysCAN and Infiltrate. It's called HARES, and it's basically a pretty impressive party trick that makes reverse engineering malware payloads a lot harder.

He's also been following some work around some compile-time tricks that make software builds unique. This can make your 0day a lot less useful because exploit has to be custom built for each target... think of it as a compile-time ASLR trick, but better.

NOTE: Originally this post said the compile-time tricks were Jacob's research. They're not, I got that mixed up. Soz. Been crook this week and I guess I've been a bit sloppy. The podcast still contains the incorrect assertion that the research Jacob is talking about is his own. I'll put a clarifying statement in next week's show. - Pat

This week's show is brought to you by BugCrowd, crowdsourced bug bounties. And we'll be chatting with Bugcrowd founder and CEO Casey Ellis about some interesting stuff this week -- like how to you take bug reports from people who don't speak english? Will a video do it?

We also chat about some comments made by Alex Stamos, the CISO of Yahoo, in a recent AppSec conference keynote. He says bug bounty crowds need to chill out; that until a few years ago they would have gone to prison for running SQLMap against a target and now they're
getting paid. He also says the CFAA makes bounty programs legally risky for participants and we're one prosecution away from blowing the whole model up.

We'll find out what Casey thinks about that.

Adam Boileau, as usual, joins us to discuss the week's news headlines.

Don't forget you can now support the Risky Business page via our Patreon campaign. Oh, and do add Patrick and Adam on Twitter if that's your thing.

Risky Business #354 -- Breaking exploit automation

0:00 / 0:00

Risky Business Podcast

February 12, 2015

Risky Business #353 -- Andy Greenberg: Why I feel sorry for Ross Ulbricht

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

This week's feature interview is with Andy Greenberg, senior writer with WIRED. He's covered Silk Road from the get go, even scoring an in depth interview with DPR before he was caught and unmasked as Ross Ulbricht. He attended every day of Ulbricht's trial and says he was there every minute the jury was.

He joined me via Skype earlier this week to talk about the trial of Ross Ulbricht, the future of underground markets and the disconnect between Ross Ulbricht's real life and online personas.

In fact, that disconnect is so great that Andy actually feels sorry for Ross Ulbricht, despite the allegation that as the Dread Pirate Roberts he commissioned as many as six murders for hire.

This week's show is brought to you by a new sponsor, Intralinks! These guys have a background doing very specialist work in facilitating mergers and acquisitions, but they're pushing into the enterprise space with a really interesting product which you can think of as an enterprise-grade file sharing service with built in IRM.

Intralinks Richard Anstey joins us a bit later on for a chat about the security challenge presented by file sharing services, and what some solutions might look like. And I've gotta say, even though we talk about their product a bit, it's a very interesting interview.

Don't forget you can now support the Risky Business page via our Patreon campaign. Oh, and do add Patrick and Adam on Twitter if that's your thing.

Risky Business #353 -- Andy Greenberg: Why I feel sorry for Ross Ulbricht

0:00 / 0:00