Podcasts

On this week’s show, Patrick Gray talks to Joe Slowik and Dmitri Alperovitch about the APT campaign that impacted the US government and FireEye via SolarWinds’ supply chain.

Alex Stamos also joins the show to chime in more generally on supply chain interference before discussing some other news, like:

• Apple losing (most of) its case against Corellium
• Assange won’t be extradited… yet
• Adobe has finally killed Flash, and killed it good

On this week’s show Patrick and Adam Boileau discuss the week’s security news, including:

• FireEye’s Very Bad Week
• Russian bears all up in your VMwares
• Chris Krebs sues Trump campaign
• Foxconn ransomware
• So much more

Soap Box podcasts like this one are wholly sponsored. This edition of the Soap Box is brought to you by VMRay. They make a virtualised sandbox that initially found a market with DFIR professionals, but these days is being used for all sorts of things.

VMRay’s cofounders – CEO Carsten Willems and CTO Ralf Hund – joined host Patrick Gray to talk through the history of the sandbox tech arms race.

On this week’s show Patrick and Adam Boileau discuss the week’s security news, including:

• ORIGINAL: Ransomware insurance payouts are looking pretty unsustainable
• Trump lawyer calls for Chris Krebs’ execution
• Hunger relief charity loses $1m to BEC
• Supreme court weighs CFAA
• Much, much more!

On this week’s show Patrick and Mark Piper discuss the week’s security news, including:

• UK unveils Cyber Force
• US passes surprisingly sane IoT security law
• Symantec drops some APT10 research
• MobileIron bugs getting a decent workout courtesy of state-backed attackers
• Much, much more…

This is not an edition of the weekly news show, scroll back one episode in your podcast feed if you’re looking for that. Rhis is a wholly sponsored podcast brought to you by Bugcrowd.

Bugcrowd’s CEO Ashish Gupta joins us in this edition of the Soap Box. He’s been the CEO over there for about three years, taking the reins from our friend Casey Ellis who moved into the CTO position.

As you’re about to hear, the bug bounty companies have moved on from the days when they just provided the simple service of running bug bounty competitions for their clients. What’s emerging is a much more nuanced product mix designed to extract as much usefulness as possible out of the testers registered on their platforms.

On this week’s show Patrick and Adam discuss the week’s security news, including:

• CISA director Chris Krebs fired
• Trump ramps up his disinformation campaign
• TikTok ban stalls
• BlackBerry discovers new hacker-for-hire crew
• DNS cache poisoning is back. But do we really care?
• Much, much more

Payment data is being pitched as another tool to help contact tracing professionals squash outbreaks of COVID-19.

On this week’s show Patrick and Adam discuss the week’s security news, including:

• Zoom settles with FTC over misleading E2EE claim
• Some poor sod had to give up $1bn in Bitcoin
• Solaris SSH 0day? Let’s party like it’s 1999
• Samy Kamkar’s latest trick: NAT Slipstreaming
• Australia’s hardcore critical infrastructure protection bill
• Much, much more

Judging by what gets put on show, we can no longer safely assume US superiority in exploit development.