Podcasts - Risky Business

Risky Business Podcast

June 25, 2015

Risky Business #371 -- Special guest Richard Bejtlich

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

In this week's feature interview we chat with Richard Bejtlich. He serves as the chief security strategist at FireEye. He's a nonresident fellow with the Brookings Institute and he joins me this week to talk about the OPM breach, honeypots, China and Edward Snowden.

This week's show is sponsored by Palo Alto Networks. This week's sponsor interview is with Ryan Olson of Palo's Threat Intelligence Unit 42 -- yes, that is a hitchhikers guide reference. He'll be joining us to discuss an APT campaign they uncovered in Asia -- it's called Lotus Blossom and it's yet another example of likely state sponsored APT activity targeting the region. Depressingly, it uses CVEs that start with 2012. Ugh.

Adam Boileau, as usual, joins us to discuss the week's security news.

Links to everything can be found in this week's show notes.

Links to everything are in this week's show notes.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Risky Business #371 -- Special guest Richard Bejtlich

0:00 / 72:54

Risky Business Podcast

June 18, 2015

Risky Business #370 -- Samsung screws the pooch in extravagant fashion

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we chat with Dan Guido of Trail of Bits about DARPA's Cyber Grand Challenge. There was a competition round last week and he tells us all about it.

Participants have to stand up simple network services on a LAN and keep them up. They also have to write attack code that targets other peoples services. When another participant attacks you, you have to defend against the attack and even patch your service so it's immune from the attacks it's being faced with... all of this is automated. You write your software before the event, drop it on the LAN and off you go. Dan tells us where the competition is at.

This week's show is brought to you by Tenable Network Security. Tenable CEO Ron Gula joins the show to talk about the OPM breach. He's encouraging Risky Business listeners to get in touch with their empathy in this instance -- sometimes politics stop organisations from being able to do the right thing when it comes to security. It's a great chat, so stick around for it.

Adam Boileau, as usual, joins us to discuss the week's security news.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

New exploit turns Samsung Galaxy phones into remote bugging devices | Ars Technica
http://arstechnica.com/security/2015/06/new-exploit-turns-samsung-galaxy...

Questions over Samsung's handling of security flaw in millions of smartphones
http://www.smh.com.au/digital-life/consumer-security/questions-over-sams...

Hack Brief: Password Manager LastPass Got Breached Hard | WIRED
http://www.wired.com/2015/06/hack-brief-password-manager-lastpass-got-br...

Catching Up on the OPM Breach - Krebs on Security
http://krebsonsecurity.com/2015/06/catching-up-on-the-opm-breach/

Encryption "would not have helped" at OPM, says DHS official | Ars Technica
http://arstechnica.com/security/2015/06/encryption-would-not-have-helped...

Report: Hack of government employee records discovered by product demo | Ars Technica
http://arstechnica.com/security/2015/06/report-hack-of-government-employ...

Attackers Stole Certificate From Foxconn to Hack Kaspersky With Duqu 2.0 | WIRED
http://www.wired.com/2015/06/foxconn-hack-kaspersky-duqu-2/

China and Russia Almost Definitely Have the Snowden Docs | WIRED
http://www.wired.com/2015/06/course-china-russia-snowden-documents/

Serious OS X and iOS flaws let hackers steal keychain, 1Password contents | Ars Technica
http://arstechnica.com/security/2015/06/serious-os-x-and-ios-flaws-let-h...

Blackhats exploiting MacKeeper hole to foist dangerous trojan \u2022 The Register
http://www.theregister.co.uk/2015/06/16/blackhats_exploiting_mackeeper_h...

US anti-fraud law makes deleting browser history a crime punishable by 20yrs in jail - RT USA
http://rt.com/usa/266389-browsing-history-obstruction-justice/

Hack Brief: The Cardinals May Have Hacked the Astros | WIRED
http://www.wired.com/2015/06/hack-brief-cardinals-astros/

Magazine publisher loses $1.5M in cyberfraud | New York Post
http://nypost.com/2015/06/16/magazine-publisher-swindled-out-of-1-5-mill...

Data-stealing component of 'Stegoloader' hides in PNG images - SC Magazine
http://www.scmagazine.com/stegoloader-malware-uses-png-files-to-hide-dat...

AdBlock aims to send filthy malverts on one-way LSD trip \u2022 The Register
http://www.theregister.co.uk/2015/06/17/adblock_revamps_for_enterprise_l...

Vapourware no more: Let's Encrypt announces first cert dates \u2022 The Register
http://www.theregister.co.uk/2015/06/17/vapourware_no_more_lets_encrypt_...

Google extends vulnerability bounties to Android; offers up to $30,000 | Ars Technica
http://arstechnica.com/security/2015/06/google-extends-vulnerability-bou...

Wikipedia goes all-HTTPS, starting immediately | Ars Technica
http://arstechnica.com/security/2015/06/wikipedia-goes-all-https-startin...

Cisco Patches IPv6 Vulnerability in Carrier Routers | Threatpost | The first stop for security news
https://threatpost.com/cisco-patches-ipv6-vulnerability-in-carrier-grade...

ProjectVault/orp \xb7 GitHub
https://github.com/projectvault/orp

devstreaming.apple.com/videos/wwdc/2015/706nu20qkag/706/706_security_and_your_apps.pdf
http://devstreaming.apple.com/videos/wwdc/2015/706nu20qkag/706/706_secur...

DROP LEGS | triple j Unearthed
https://www.triplejunearthed.com/artist/drop-legs

Risky Business #370 -- Samsung screws the pooch in extravagant fashion

0:00 / 57:55

Risky Business Podcast

June 11, 2015

Risky Business #369 -- Kaspersky pwned by Duqu, bye bye 215 and more

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we speak with Laura Bell about scanning people for vulnerabilities. Who in your organisation do you most need to worry about protecting? Well, it's not who you think. She'll be along soon to discuss that.

This week's show is brought to you by Rapid7.

Rapid7's SVP of Products and Engineering Lee Weiner will be along in this week's sponsor interview to talk about how to get security and IT departments both thinking about risk-based approaches to patching. Hey, sure, you've got 8,000 boxes that can all be Heartbleeded, but do you need to worry about all of them right now? Or just the accessible ones with all the customer data on them?

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Kaspersky Finds New Nation-State Attack-In Its Own Network | WIRED
http://www.wired.com/2015/06/kaspersky-finds-new-nation-state-attack-net...

The Senate Finally Passes NSA Surveillance Reform | WIRED
http://www.wired.com/2015/06/senate-finally-passes-bit-nsa-reform/

Senate Shoots Down All Bad Amendments to the NSA Reform Bill | WIRED
http://www.wired.com/2015/06/senate-shoots-bad-amendments-nsa-reform-bill/

Federal agency hit by Chinese hackers, around 4 million employees affected | Ars Technica
http://arstechnica.com/security/2015/06/federal-agency-hit-by-chinese-ha...

Why the "biggest government hack ever" got past the feds | Ars Technica
http://arstechnica.com/security/2015/06/why-the-biggest-government-hack-...

New Snowden documents reveal secret memos expanding spying | Ars Technica
http://arstechnica.com/tech-policy/2015/06/new-snowden-documents-reveal-...

All U.S. United Flights Grounded Over Mysterious Problem | WIRED
http://www.wired.com/2015/06/united-flights-grounded-mysterious-problem/

Exclusive: U.S. tried Stuxnet-style campaign against North Korea but failed - sources | Reuters
http://www.reuters.com/article/2015/05/29/us-usa-northkorea-stuxnet-idUS...

TV5 Monde attack 'by Russia-based hackers' - BBC News
http://www.bbc.com/news/world-europe-33072034

Nonlinear warfare - A new system of political control 2014 Adam Curtis - YouTube
https://www.youtube.com/watch?v=tyop0d30UqQ

Vladislav Surkov - Wikipedia, the free encyclopedia
http://en.wikipedia.org/wiki/Vladislav_Surkov

California senate wants warrants to be required for phone searches
http://www.engadget.com/2015/06/04/california-warrant-phone-search-bill/

Intercepted WhatsApp messages led to Belgian terror arrests [Updated] | Ars Technica
http://arstechnica.com/tech-policy/2015/06/intercepted-whatsapp-messages...

Sen. McCain: How to Get Silicon Valley to Help the Pentagon | WIRED
http://www.wired.com/2015/06/sen-mccain-get-silicon-valley-help-pentagon/

Feds Want to ID Web Trolls Who 'Threatened' Silk Road Judge | WIRED
http://www.wired.com/2015/06/feds-want-id-web-trolls-threatened-silk-roa...

This Hacked Kids' Toy Opens Garage Doors in Seconds | WIRED
http://www.wired.com/2015/06/hacked-kids-toy-opens-garage-doors-seconds/

'MEDJACK' tactic allows cyber criminals to enter healthcare networks undetected - SC Magazine
http://www.scmagazine.com/trapx-profiles-medjack-threat/article/418811/

Bitcoin blackmail gang start hurling DDoSes at Scandinavia \u2022 The Register
http://www.theregister.co.uk/2015/06/09/ddos_blackmail_gang_scandinavian...

iiNet investigates alleged theft of customer database - Security - News - iTnews.com.au
http://www.itnews.com.au/News/404959,iinet-investigates-alleged-theft-of...

Crypto flaws in Blockchain Android app sent bitcoins to the wrong address | Ars Technica
http://arstechnica.com/security/2015/05/crypto-flaws-in-blockchain-andro...

Beware of the text message that crashes iPhones | Ars Technica
http://arstechnica.com/security/2015/05/beware-of-the-text-message-that-...

US Army website defaced by Syrian Electronic Army [Updated] | Ars Technica
http://arstechnica.com/security/2015/06/us-army-website-defaced-by-syria...

Assume your GitHub account is hacked, users with weak crypto keys told | Ars Technica
http://arstechnica.com/security/2015/06/assume-your-github-account-is-ha...

June 2015 Adobe Flash Player Security Update | Threatpost | The first stop for security news
https://threatpost.com/adobe-patches-13-vulnerabilities-in-flash-player/...

June 2015 Microsoft Patch Tuesday Security Bulletins | Threatpost | The first stop for security news
https://threatpost.com/critical-ie-update-one-of-eight-microsoft-securit...

FAQs
http://www.bis.doc.gov/index.php/policy-guidance/faqs#subcat200

SafeStack - Agile Application Security
http://safestack.io/

IT Security & Analytics, Pen Testing, Compliance - Rapid7
http://www.rapid7.com/

The Isley Brothers - Fight The Power (Part 1 & 2) (1975) - YouTube
https://www.youtube.com/watch?v=wO2ebiuV3hU

Risky Business #369 -- Kaspersky pwned by Duqu, bye bye 215 and more

0:00 / 64:37

Risky Business Podcast

June 05, 2015

Risky Business #368 -- AusCERT edition: Brian Krebs, Eva Galperin and more!

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

This week's edition of the show is a special edition recorded at AusCERT's 2015 conference on the Gold Coast, brought to you by Datacom TSS.

In it, we speak with:

\t* Brian Krebs, who talks about the weird symbiotic relationship he has with the criminal underworld
\t* Eva Galperin of the EFF talks Wassenaar
\t* David Litchfield who discusses his new database security tool
\t* Datacom TSS practice manager Lou Robertson on outcomes-based security service contracts

I hope you enjoy it!

Risky Business #368 -- AusCERT edition: Brian Krebs, Eva Galperin and more!

0:00 / 63:20

Risky Business Podcast

May 28, 2015

Risky Business #367 -- Tor Project lead Roger Dingledine

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

This week's show is a bit different. I've prepared it while in South Africa. I've been here for two weeks now, one week of holidays and another week at the ITWeb Security Summit in Johannesburg.

While here I got a chance to meet and interview Roger Dingledine, the Tor Project leader, about the future of hidden services, the Anonabox controversy, and the possibility of major browser manufactures integrating Tor into their private browsing modes. That's this week's feature.

This week's news guest is Haroon Meer of Thinkst.

Thinkst is actually this week's sponsor as well. But as Haroon is a super smart guy who also happens to be funny and eloquent, I invited him to do this week's news segment with me from the conference centre in Midrand.

For the sponsor segment Haroon filled us in on his latest invention, Canary.

It's a honeypot you put on your LAN that can detect all sorts of lateral movement. It's an awesome idea and you'll get the skinny in this week's sponsor interview!

Show notes

Proposed U.S. Wassenaar Rules on Intrusion Software | Threatpost | The first stop for security news
https://threatpost.com/head-scratching-begins-on-proposed-wassenaar-expo...

Researchers Wary of Wassenaar Arrangement Proposed Rules | Threatpost | The first stop for security news
https://threatpost.com/security-researchers-wary-of-proposed-wassenaar-r...

US aims to limit zero-day sales to Five Eyes - Security - News - iTnews.com.au
http://www.itnews.com.au/News/404272,us-aims-to-limit-zero-day-sales-to-...

New Logjam Attack on Diffie-Hellman Threatens Security of Browsers, VPNs | Threatpost | The first stop for security news
https://threatpost.com/new-logjam-attack-on-diffie-hellman-threatens-sec...

HTTPS-crippling attack threatens tens of thousands of Web and mail servers | Ars Technica
http://arstechnica.com/security/2015/05/https-crippling-attack-threatens...

Feds Say That Banned Researcher Commandeered a Plane | WIRED
http://www.wired.com/2015/05/feds-say-banned-researcher-commandeered-plane/

Alleged plane hacker said he pierced Boeing jet's firewall in 2012 | Ars Technica
http://arstechnica.com/security/2015/05/alleged-plane-hacker-said-he-pie...

Is It Possible for Passengers to Hack Commercial Aircraft? | WIRED
http://www.wired.com/2015/05/possible-passengers-hack-commercial-aircraft/

Silk Road Prosecutors Ask Judge to 'Send a Message' In Ulbricht Sentencing | WIRED
http://www.wired.com/2015/05/silk-road-prosecutors-ask-judge-send-messag...

Silk Road from the inside: Moderator SSBD tells his story | All Things VICE
http://allthingsvice.com/2015/05/27/silk-road-from-the-inside-moderator-...

Database of 4 million Adult Friend Finder users leaked for all to see | Ars Technica
http://arstechnica.com/security/2015/05/database-of-4-million-adult-frie...

Five Eyes spies sought to subvert Google, Samsung app stores - Security - News - iTnews.com.au
http://www.itnews.com.au/News/404297,five-eyes-spies-sought-to-subvert-g...

IRS system mined for over 100,000 taxpayer records by fraudsters [Updated] | Ars Technica
http://arstechnica.com/security/2015/05/report-irs-admits-its-been-hacke...

Researcher who exploits bug in Starbucks gift cards gets rebuke, not love | Ars Technica
http://arstechnica.com/security/2015/05/researcher-who-exploits-bug-in-s...

'90s-style security flaw puts "millions" of routers at risk | Ars Technica
http://arstechnica.com/security/2015/05/90s-style-security-flaw-puts-mil...

The Moose is loose: Linux-based worm turns routers into social network bots | Ars Technica
http://arstechnica.com/security/2015/05/the-moose-is-loose-linux-based-w...

Flawed Android factory reset leaves crypto and login keys ripe for picking | Ars Technica
http://arstechnica.com/security/2015/05/flawed-android-factory-reset-lea...

SQL Attack Results in Breach of Telstra Telecom Pacnet | Threatpost | The first stop for security news
https://threatpost.com/sql-attack-results-in-breach-of-telstra-owned-tel...

"The media is always lying" hacked WaPo website says | Ars Technica
http://arstechnica.com/security/2015/05/the-media-is-always-lying-hacked...

Penn State severs engineering network after "incredibly serious" intrusion | Ars Technica
http://arstechnica.com/security/2015/05/penn-state-severs-engineering-ne...

Researcher turns tables, discloses unpatched bugs in Google cloud platform | Ars Technica
http://arstechnica.com/security/2015/05/researcher-turns-tables-disclose...

Google Fixes Sandbox Escape in Chrome | Threatpost | The first stop for security news
https://threatpost.com/google-fixes-sandbox-escape-in-chrome/112899

Apple Releases Patches For a Watch | Threatpost | The first stop for security news
https://threatpost.com/apple-releases-patches-for-a-watch/112920

Risky Business #83 -- The Military Digital Complex | Risky Business
http://risky.biz/netcasts/risky-business/risky-business-83-military-digi...

Why changes to Wassenaar make oppression and surveillance easier, not harder
http://addxorrol.blogspot.com/2015/05/why-changes-to-wassenaar-make.html

Canary box aims to lure hackers into honeypots before they make headlines | Ars Technica
http://arstechnica.com/security/2015/05/canary-box-aims-to-lure-hackers-...

Canary - know when it matters
https://canary.tools/

Risky Business #367 -- Tor Project lead Roger Dingledine

0:00 / 55:45

Risky Business Podcast

May 14, 2015

Risky Business #366 -- Software defined networking security

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're chatting with Dave Jorm of IIX -- International Internet Exchange. We're previewing his upcoming AusCERT talk all about software defined networking security. It's fancy tech, but there are some interesting little quirks CSOs should definitely be across.

This week's show is sponsored by Senetas, big thanks to them. Senetas CTO Julian Fay is this week's sponsor guest. We talk about those horrible Open Smart Grid bugs and a few other things, that's coming up later.

Adam Boileau, as usual, joins the show to discuss the week's news headlines.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Venom VM bug called "perfect" for NSA, or for stealing bitcoins and passwords | Ars Technica
http://arstechnica.com/security/2015/05/venom-vm-bug-called-perfect-for-...

Extremely serious virtual machine bug threatens cloud providers everywhere | Ars Technica
http://arstechnica.com/security/2015/05/extremely-serious-virtual-machin...

Cybersecurity firm accused of staging data breaches to extort clients
http://www.engadget.com/2015/05/09/tiversa-whistleblower/

US Government Labeled Al Jazeera Journalist as Al Qaeda
https://firstlook.org/theintercept/2015/05/08/u-s-government-designated-...

Court Rules NSA Bulk Data Collection Was Never Authorized By Congress | WIRED
http://www.wired.com/2015/05/breaking-news-federal-court-rules-nsa-bulk-...

GPU-based rootkit and keylogger offer superior stealth and computing power | Ars Technica
http://arstechnica.com/security/2015/05/gpu-based-rootkit-and-keylogger-...

$7500 DDoS extortion hitting Aussie, Kiwi enterprises \u2022 The Register
http://www.theregister.co.uk/2015/05/08/ddos_hitting_oz_nz/

Microsoft Brings Perfect Forward Secrecy to Windows | Threatpost | The first stop for security news
https://threatpost.com/new-crypto-suites-bring-perfect-forward-secrecy-t...

Tor Cloud Shut Down Amid Lack of Support | Threatpost | The first stop for security news
https://threatpost.com/tor-cloud-shut-down-amid-lack-of-support/112725

MacKeeper Zero Day Patched | Threatpost | The first stop for security news
https://threatpost.com/mackeeper-patches-remote-code-execution-zero-day/...

Remotely Exploitable Vulnerabilities in SAP Compression Algorithms | Threatpost | The first stop for security news
https://threatpost.com/remotely-exploitable-vulnerabilities-in-sap-compr...

Adobe, Microsoft Push Critical Security Fixes - Krebs on Security
http://krebsonsecurity.com/2015/05/adobe-microsoft-push-critical-securit...

Home Automation Protocol Z-Way Vulnerable to Remote Attacks | Threatpost | The first stop for security news
https://threatpost.com/home-automation-protocol-z-way-vulnerable-to-remo...

SDN and Security - David Jorm | ONOS
http://onosproject.org/2015/04/03/sdn-and-security-david-jorm/

CloudRouter\xae | Router Distribution for the Cloud
https://cloudrouter.org/

Meeting Snowden in Princeton | Light Blue Touchpaper
https://www.lightbluetouchpaper.org/2015/05/02/meeting-snowden-in-prince...

Open Smart Grid Protocol Homegrown Crypto Weaknesses | Threatpost | The first stop for security news
https://threatpost.com/weak-homegrown-crypto-dooms-open-smart-grid-proto...

Zuluboy - Mbombela (A Twist of Bayethe) - YouTube
https://www.youtube.com/watch?v=KFS4cSmzjYY

Risky Business #366 -- Software defined networking security

0:00 / 58:25

Other Category

May 13, 2015

Serious Business #3 -- Sy Hersh can't melt steel beams

Presented by

Patrick Gray

CEO and Publisher

As usual for Serious Business I'm joined by AJ+ satirist, Australian comedian Dan Ilic, to discuss a few topical items of the last week, and boy, we've got some good stuff for you.. we're talking about journalist Seymour Hersh's latest investigative work -- is it pure fiction? We're talking about DeflateGate, we're talking Elon Musk being a douche and we're talking MAD MAX, Fury Road...

Serious Business #3 -- Sy Hersh can't melt steel beams

0:00 / 32:14

Risky Business Podcast

May 07, 2015

Risky Business #365 -- Defence in derpth

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

This week's show is brought to you by BugCrowd -- crowdsourced security testing. Bugcrowd founder and CEO Casey Ellis will join us in this week's sponsor interview to tell us about the latest trends in bounties and crowdsourced security.

He's got some useful info. It turns out bounty participants are getting better at doing OSINT collection to win when testing. So yeah, creds and stuff in Github and repos that shouldn't be there are giving these guys easy wins... we'll also talk about the latest trends in terms of who's running bounty programs -- it's not just companies testing web and mobile apps these days, they're doing a bunch more work on IoT and installable software. It's a solid trend.

There's no feature interview in this week's show because, well, it was a pretty slow week. I was expecting last week's US House hearing into possible US responses to encryption technology to give me heaps of feature material for this week's show, but it was actually a bit of a fizzer, which is pretty awesome, actually.

Adam Boileau, as usual, joins the show to discuss the week's news headlines.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Windows Update for Business Uproots Patch Tuesday | Threatpost | The first stop for security news
https://threatpost.com/patch-tuesday-facelift-end-of-an-era/112640

A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent\u2026
https://blogs.windows.com/msedgedev/2015/05/06/a-break-from-the-past-par...

Windows 10 bombshell: Microsoft to KILL OFF Patch Tuesday \u2022 The Register
http://www.theregister.co.uk/2015/05/04/microsoft_windows_10_updates/

With Lock Research, Another Battle Brews in the War Over Security Holes | WIRED
http://www.wired.com/2015/05/lock-research-another-battle-brews-war-secu...

Vulnerability-Riddled Drug Pumps Open to Takeover | Threatpost | The first stop for security news
https://threatpost.com/vulnerability-riddled-drug-pumps-open-to-takeover...

Interpol alerted as teenage hacker from Perth flees to Europe | The Australian
http://www.theaustralian.com.au/news/nation/interpol-alerted-as-teenage-...

Programmer Convicted in Bizarre Goldman Sachs Case-Again | WIRED
http://www.wired.com/2015/05/programmer-convicted-bizarre-goldman-sachs-...

WikiLeaks Finally Brings Back Its Submission System for Your Secrets | WIRED
http://www.wired.com/2015/05/wikileaks-finally-brings-back-submission-sy...

How Selerity reported Twitter's earnings-before Twitter did | Ars Technica
http://arstechnica.com/business/2015/05/how-selerity-reported-twitters-2...

'Just follow the damn Constitution!' FBI, DoJ skewered over demands for crypto backdoors \u2022 The Register
http://www.theregister.co.uk/2015/05/01/congress_gives_bipartisan_bolloc...

Congress, Crypto and Craziness | Threatpost | The first stop for security news
https://threatpost.com/congress-crypto-and-craziness/112508

Zuck'ed up: Facebook opens up free internet in India - but bans HTTPS \u2022 The Register
http://www.theregister.co.uk/2015/05/04/internet_org_facebook/

Foiling Pump Skimmers With GPS - Krebs on Security
http://krebsonsecurity.com/2015/05/foiling-pump-skimmers-with-gps/

PayIvy Sells Your Online Accounts Via PayPal - Krebs on Security
http://krebsonsecurity.com/2015/05/payivy-sells-your-online-accounts-via...

Google Research Reveals Profitable, Pervasive Ad Injector Ecosystem | Threatpost | The first stop for security news
https://threatpost.com/google-research-reveals-profitable-pervasive-ad-i...

Microsoft LAPS Tool Addresss Local Admin Password Problem | Threatpost | The first stop for security news
https://threatpost.com/microsoft-laps-tool-tackles-common-local-admin-pa...

Netflix Releases FIDO Incident Response Tool | Threatpost | The first stop for security news
https://threatpost.com/netflix-releases-fido-incident-response-tool/112618

Google Updates Password Alert Extension, But Some Bypasses Still Work | Threatpost | The first stop for security news
https://threatpost.com/google-updates-password-alert-extension-but-some-...

Super secretive malware wipes hard drive to prevent analysis | Ars Technica
http://arstechnica.com/security/2015/05/super-secretive-malware-wipes-ha...

Dyre Banking Trojan Avoids Sandbox Detection | Threatpost | The first stop for security news
https://threatpost.com/dyre-banking-trojan-jumps-out-of-sandbox/112533

The BACKRONYM MySQL Vulnerability - Blog - Duo Security
https://www.duosecurity.com/blog/backronym-mysql-vulnerability

Behold: the drop-dead simple exploit that nukes Google's Password Alert | Ars Technica
http://arstechnica.com/security/2015/04/behold-the-drop-dead-simply-expl...

Actively exploited WordPress bug puts millions of sites at risk | Ars Technica
http://arstechnica.com/security/2015/05/actively-exploited-wordpress-bug...

Spam-blasting malware infects thousands of Linux and FreeBSD servers | Ars Technica
http://arstechnica.com/security/2015/04/spam-blasting-malware-infects-th...

Lenovo System Update Vulnerabilities Patched | Threatpost | The first stop for security news
https://threatpost.com/lenovo-patches-vulnerabilities-in-system-update-s...

Sally Beauty Card Breach, Part Deux? - Krebs on Security
http://krebsonsecurity.com/2015/05/sally-beauty-card-breach-part-deux/

02 - Mammal - Think - YouTube
https://www.youtube.com/watch?v=mCQXqHr9CwE

Risky Business #365 -- Defence in derpth

0:00 / 52:16

Other Category

May 05, 2015

Serious Business #2 -- Can we stop it with the Muhammad cartoons already?

Presented by

Patrick Gray

CEO and Publisher

In this edition of Serious Business, Australia's Most Hated Man (tm) Dan Ilic and I speak about the (failed) shooting attack against a group of very silly Americans who got together to denigrate Islam.

We also speak about Apple's stupid watch. I should warn you, too, I don't edit this podcast for bad language and there are f-bombs aplenty. So if you have your kids in your car and you don't want them hearing my awful, awful language, please turn off this podcast now.

Serious Business #2 -- Can we stop it with the Muhammad cartoons already?

0:00 / 24:06

Risky Business Podcast

April 30, 2015

Risky Business #364 -- The cuckoo's carton

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

In this week's feature interview we chat with John Strand, a SANS instructor and co-host of Security Weekly's Webcasts. He runs Black Hills information security and he's a maintainer of the ADHD Linux distro -- it's essentially a curation of active defence tools that you can use to do some funky stuff. But in this case active defence doesn't mean popping shells on boxes in China, it's more about annoying the absolute shit out of your adversaries.

In this week's sponsor interview we're chatting with Chris Gatford, HackLabs' founder and head honcho, all about something that came up last week -- software defined radio security testing. Is there a market for that sort of thing like last week's guest Balint Seeber suggested?

Well, yes and no. That interview is coming up at the end of the show.

Adam Boileau, as usual, stops in to discuss the week's news headlines.

Links to everything are in this week's show notes.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Risky Business #364 -- The cuckoo's carton

0:00 / 53:24