Podcasts

Other Category

August 11, 2016

What I've been told about #censusfail

Presented by

Patrick Gray

CEO and Publisher

I have been able to cobble together the following by talking to my sources. Sorry this post is so brief, but I'm still trying to get this week's show out and I'm massively under the pump. So here it is: Set your faces to stunned.

IBM and the ABS were offered DDoS prevention services from their upstream provider, NextGen Networks, and said they didn't need it.
Their plan was to just ask NextGen to geoblock all traffic outside of Australia in the event of an attack.
This plan was activated when there was a small-scale attack against the census website.
Unfortunately another attack hit them from inside Australia. This was a straight up DNS reflection attack with a bit of ICMP thrown in for good measure. It filled up their firewall's state tables. Their solution was to reboot their firewall, which was operating in a pair.
They hadn't synced the ruleset when they rebooted the firewall so the secondary was essentially operating as a very expensive paperweight. This resulted in a short outage.
Some time later IBM's monitoring equipment spat out some alerts that were interpreted by the people receiving them as data exfiltration. Already jittery from the DDoS disaster and wonky firewalls, they became convinced they'd been owned and the DDoS attack was a distraction to draw their focus away from the exfil.
They pulled the pin and ASD was called in.
The IBM alerts were false positives incorrectly characterising offshore-bound system information/logs as exfil.
ASD still needs to roll incident response before they can send the website live again. Even though it was false positives that triggered the investigation, there still needs to be an investigation.

At least IBM got to bump their margins up a bit by not paying for the DDoS prevention though... amirite?!

Risky Business Podcast

August 11, 2016

Risky Business #422 -- #CensusFail, news with Adam and MOAR

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we talk about the week's security news with Adam Boileau and I spill on what my sources have told me about #censusfail.

This week's show is brought to you by Canary.tools. Canary is a fantastic bit of kit -- it's essentially an easily configurable, compact honeypot you can just drop on your network like a dropbox to detect attacks. No begging the data centre people for rack space, just drop it and go. We'll be talking to Canary.tools head honcho Haroon Meer this week about the disconnect between what some startups are pitching to venture capitalists versus what users actually need.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Census Australia 2016 fail: ABS says website was hacked
http://www.news.com.au/technology/census-fail-abs-spent-nearly-500000-on...

Patrick Gray on Twitter: "Analysis from trusted source of trusted source. Someone's getting fired. I'm a fucking journo and I'm not this dumb: https://t.co/gyQajFDQcQ"
https://twitter.com/riskybusiness/status/763189895292555264

'Angry, bitterly disappointed': Malcolm Turnbull lashes ABS for census failures
http://www.theage.com.au/federal-politics/political-news/angry-bitterly-...

Starting this fall, Apple will pay up to $200,000 for iOS and iCloud bugs | Ars Technica
http://arstechnica.com/apple/2016/08/starting-this-fall-apple-will-pay-u...

Zero-Day Hunters Will Pay Over Twice as Much as Apple's New Bug Bounty Programme | Motherboard
http://motherboard.vice.com/read/zero-day-hunters-will-pay-over-twice-as...

Linux bug leaves USA Today, other top sites vulnerable to serious hijacking attacks | Ars Technica
http://arstechnica.com/security/2016/08/linux-bug-leaves-usa-today-other...

Researchers crack open unusually advanced malware that hid for 5 years | Ars Technica
http://arstechnica.com/security/2016/08/researchers-crack-open-unusually...

Data Breach At Oracle's MICROS Point-of-Sale Division - Krebs on Security
http://krebsonsecurity.com/2016/08/data-breach-at-oracles-micros-point-o...

Apple, Intel, Google Employee Accounts Exposed in Data Breach of Developer Forum | Motherboard
http://motherboard.vice.com/read/apple-intel-google-employee-accounts-ex...

Copperhead OS: The startup that wants to solve Android's woeful security | Ars Technica
http://arstechnica.com/security/2016/08/copperhead-os-fix-android-security/

Major Qualcomm chip security flaws expose 900M Android users | Ars Technica
http://arstechnica.com/security/2016/08/qualcomm-chip-flaws-expose-900-m...

Hackers Could Break Into Your Monitor To Spy on You and Manipulate Your Pixels | Motherboard
http://motherboard.vice.com/read/hackers-could-break-into-your-monitor-t...

Hackers Make the First-Ever Ransomware for Smart Thermostats | Motherboard
http://motherboard.vice.com/read/internet-of-things-ransomware-smart-the...

Afraid of the Dark? Too Bad, Your Smart Bulbs Can Be Hacked | Motherboard
http://motherboard.vice.com/read/hackers-could-take-control-of-your-smar...

Good news-the robocalling scourge may not be unstoppable after all | Ars Technica
http://arstechnica.com/security/2016/08/good-news-the-robocalling-scourg...

IPv6 router bug: Juniper spins out hotfix to thwart DDoS attacks | Ars Technica
http://arstechnica.com/security/2016/08/ipv6-router-bug-juniper-cisco-dd...

PLC Blaster Worm Targets Industrial Control PLCs | Threatpost | The first stop for security news
https://threatpost.com/plc-blaster-worm-targets-industrial-control-syste...

Secure Golden Key Boot: (MS16-094 / CVE-2016-3287, and MS16-100 / CVE-2016-3320)
https://rol.im/securegoldenkeyboot/

Flip Feng Shui - VUSec
https://www.vusec.net/projects/flip-feng-shui/

FreeBSD \xb7 GitHub
https://gist.github.com/anonymous/e48209b03f1dd9625a992717e7b89c4f

Risky Business #422 -- #CensusFail, news with Adam and MOAR

0:00 / 57:24

Risky Business Podcast

August 06, 2016

Risky Business #421 -- Las Vegas edition with Dan Guido, Andy Greenberg and Zane Lackey

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we speak with Signal Sciences' co-founder Zane Lackey about hackers building defensive tools and software companies. Dan Guido and Andy Greenberg talk about car hacking and the week's security news, and Wade Woolwine of Rapid7 is in the sponsor slot talking about EDR/IDR software.

Show notes

Hackers Fool Tesla S's Autopilot to Hide and Spoof Obstacles | WIRED
https://www.wired.com/2016/08/hackers-fool-tesla-ss-autopilot-hide-spoof...

The Jeep Hackers Are Back to Prove Car Hacking Can Get Much Worse | WIRED
https://www.wired.com/2016/08/jeep-hackers-return-high-speed-steering-ac...

Hackers Hijack a Big Rig Truck's Accelerator and Brakes | WIRED
https://www.wired.com/2016/08/researchers-hack-big-rig-truck-hijack-acce...

LastPass Patches Ormandy Remote Compromise Flaw | Threatpost | The first stop for security news
https://threatpost.com/lastpass-patches-ormandy-remote-compromise-flaw/1...

Researchers Bypass Chip and Pin Protections at Black Hat | Threatpost | The first stop for security news
https://threatpost.com/researchers-bypass-chip-and-pin-protections-at-bl...

Oracle EBusiness Suite 'Massive' Attack Surface Assessed | Threatpost | The first stop for security news
https://threatpost.com/oracle-ebusiness-suite-massive-attack-surface-ass...

Yahoo Investigates 200 Million Alleged Accounts For Sale On Dark Web | Threatpost | The first stop for security news
https://threatpost.com/yahoo-investigates-200-million-alleged-accounts-f...

Report claims more than half of UK firms have been hit by ransomware | Ars Technica
http://arstechnica.com/security/2016/08/more-than-half-of-uk-firms-have-...

DNC staffers: FBI didn't tell us for months about possible Russian hack | Ars Technica
http://arstechnica.com/security/2016/08/dnc-staffers-fbi-didnt-tell-us-f...

New attack steals SSNs, e-mail addresses, and more from HTTPS pages | Ars Technica
http://arstechnica.com/security/2016/08/new-attack-steals-ssns-e-mail-ad...

Bitcoin value falls off cliff after $77M stolen in Hong Kong exchange hack | Ars Technica
http://arstechnica.com/security/2016/08/bitcoin-value-falls-off-cliff-af...

Social Security Administration Now Requires Two-Factor Authentication - Krebs on Security
http://krebsonsecurity.com/2016/08/social-security-administration-now-re...

The Administrator of the Dark Web's Infamous Hacking Market Has Vanished | Motherboard
http://motherboard.vice.com/read/the-administrator-of-the-dark-webs-infa...

Privacy Activists Launch Database to Track Global Sales of Surveillance Tech | Motherboard
http://motherboard.vice.com/read/privacy-activists-launch-database-to-tr...

How Drones Could Help Hackers Shut Down Power Plants | Motherboard
http://motherboard.vice.com/read/how-drones-could-help-hackers-shut-down...

Home
https://signalsciences.com/

rapid7 edr - Google Search
https://www.google.com/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF...

Risky Business #421 -- Las Vegas edition with Dan Guido, Andy Greenberg and Zane Lackey

0:00 / 49:08

Risky Business Podcast

July 29, 2016

Risky Business #420 -- What we don't know about Watergate 2.0

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're taking a look at the DNC leaks, but don't worry, we won't be getting bogged down in the same old angles. Instead, we're going to chat to Lorenzo Franceschi-Bicchierai from VICE motherboard about his experience in interviewing the Guccifer 2 persona.

Then we'll hear from Kevin Poulsen about what these latest developments mean for Wikileaks. It's a topic you're probably sick of hearing about this week, but stick with us, we've got some new angles, and they're relevant.

This week's sponsor interview is an absolute, certified, 24-carat cracker. Bromium is this week's sponsor and its CTO and co-founder, Simon Crosby, pops along to talk about his experience in dealing with the wrath of Tavis Ormandy. Tavis actually managed to dig a custom build of Bromium's software out of VirusTotal and find a really cool bug in it. But there's actually a fair bit more to that story and Simon fills us in.

Adam Boileau, as usual, joins us to discuss the week's security news headlines.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

WikiLeaks Dumps 'Erdogan Emails' After Turkey's Failed Coup | WIRED
https://www.wired.com/2016/07/wikileaks-dumps-erdogan-emails-turkeys-fai...

WikiLeaks Put Women in Turkey in Danger, for No Reason
http://www.huffingtonpost.com/zeynep-tufekci/wikileaks-erdogan-emails_b_...

Notorious Hacker 'Phineas Fisher' Says He Hacked The Turkish Government | Motherboard
http://motherboard.vice.com/read/phineas-fisher-turkish-government-hack

ZeroBin
https://zerobin.net/?28625085e55bf0fb#QFl/7wV7jpgLG6aXm3YLzDtFklBTWZtJ3G...

bellingcat - "We've shot four people. Everything's fine." The Turkish Coup through the Eyes of its Plotters - bellingcat
https://www.bellingcat.com/news/mena/2016/07/24/the-turkey-coup-through-...

Snowden Designs a Device to Warn if Your iPhone's Radios Are Snitching | WIRED
https://www.wired.com/2016/07/snowden-designs-device-warn-iphones-radio-...

Edward Snowden on Twitter: "The aversion to sharing #NSA evidence is fear of revealing "sources and methods" of intel collection, but #XKEYSCORE is now publicly known."
https://twitter.com/Snowden/status/757577614873755648

Robert M. Lee on Twitter: "Since my colleagues are afraid to comment - @Snowden this is ridiculous. Also weren't you in T group. Just stop. https://t.co/6Gv5hK7qMi"
https://twitter.com/RobertMLee/status/757715572461219841

Keys to Chimera crypto ransomware allegedly leaked by rival crime gang | Ars Technica
http://arstechnica.com/security/2016/07/keys-to-chimera-crypto-ransomwar...

SentinelOne Offers $1 Million Guarantee To Stop Ransomware
http://www.darkreading.com/vulnerabilities---threats/sentinelone-offers-$1-million-guarantee-to-stop-ransomware/d/d-id/1326363

EFF Files Lawsuit Challenging DMCA's Restrictions Security Researchers | Threatpost | The first stop for security news
https://threatpost.com/eff-files-lawsuit-challenging-dmcas-restrictions-...

Malicious computers caught snooping on Tor-anonymized Dark Web sites | Ars Technica
http://arstechnica.com/security/2016/07/malicious-computers-caught-snoop...

Upcoming Tor Design Battles Hidden Services Snooping | Threatpost | The first stop for security news
https://threatpost.com/upcoming-tor-design-battles-hidden-services-snoop...

NIST Recommends SMS Two-Factor Authentication Deprecation | Threatpost | The first stop for security news
https://threatpost.com/nist-recommends-sms-two-factor-authentication-dep...

How I made LastPass give me all your passwords
https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-yo...

Yahoo Ordered to Explain Data Gathering Procedures in Deleted Email Case | Threatpost | The first stop for security news
https://threatpost.com/yahoo-ordered-to-explain-data-gathering-procedure...

Verizon to End Yahoo Survival Fight With $4.8 Billion Deal - Bloomberg
http://www.bloomberg.com/news/articles/2016-07-24/verizon-said-to-announ...

New attack bypasses HTTPS protection on Macs, Windows, and Linux | Ars Technica
http://arstechnica.com/security/2016/07/new-attack-that-cripples-https-c...

Pornhub Hack Earns Researchers $22,000 | Threatpost | The first stop for security news
https://threatpost.com/pornhub-hack-earns-researchers-22000/119450/

Firefox to Block Flash in August, Disable in 2017 | Threatpost | The first stop for security news
https://threatpost.com/firefox-to-block-flash-in-august-disable-in-2017/...

Alan on Twitter: "spend $150 on a fancy pet feeder that doesn't feed your cat when their servers are offline what a great design https://t.co/ZXMiGuWNFE"
https://twitter.com/alanzeino/status/758209842477604864

15 Vulnerabilities in SAP HANA Outlined | Threatpost | The first stop for security news
https://threatpost.com/15-vulnerabilities-in-sap-hana-outlined/119406/

Wikileaks Dismantling of DNC Is Clear Attack by Putin on Clinton | Observer
http://observer.com/2016/07/wikileaks-dismantling-of-dnc-is-clear-attack...

Why Does DNC Hacker 'Guccifer 2.0' Talk Like This? | Motherboard
https://motherboard.vice.com/read/why-does-dnc-hacker-guccifer-20-talk-l...

A Hat Tip to a White Hat | A Collection of Bromides on Infrastructure
https://blogs.bromium.com/2016/06/21/a-hat-tip-to-a-white-hat/

Risky Business #420 -- What we don't know about Watergate 2.0

0:00 / 58:25

Risky Business Podcast

July 22, 2016

Risky Business #419 -- Brian Krebs on future of bank cybercrime

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're catching up with Brian Krebs of Krebs On Security. He'll be talking to us about recent trends in cybercrime, and he's got a warning for security teams in the banking sector. He says things are going to get pretty sticky, and he's usually right on this stuff.

This week's show is brought to you by Bugcrowd, big thanks to them. And in the sponsor slot we're speaking with HD Moore, who recently joined the company's advisory board. I know HD well and I can tell you he was initially quite sceptical of bounties. So he joins us to talk about why he changed his mind and how he plans on helping Bugcrowd do stuff better.

Adam Boileau, as usual, joins us to discuss the week's security news headlines.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

WikiLeaks Dumps 'Erdogan Emails' After Turkey's Failed Coup | WIRED
https://www.wired.com/2016/07/wikileaks-dumps-erdogan-emails-turkeys-fai...

Turkey Blocks WikiLeaks After Dump of Government Emails | Motherboard
http://motherboard.vice.com/read/turkey-erdogan-blocks-wikileaks-after-d...

Ethereum Inventor: We Got 'Very Lucky' In Gamble to Save $56M From Hacker | Motherboard
http://motherboard.vice.com/read/ethereum-56m-hacker-the-dao-vitalik-but...

Clever Tool Shields Your Car From Hacks by Watching Its Internal Clocks | WIRED
https://www.wired.com/2016/07/clever-tool-shields-car-hacks-watching-int...

Big Privacy Ruling Says Feds Can't Grab Data Abroad With a Warrant | WIRED
https://www.wired.com/2016/07/big-privacy-ruling-says-feds-cant-grab-dat...

Baseball exec gets 46 months in prison after guessing rival team's password | Ars Technica
http://arstechnica.com/tech-policy/2016/07/baseball-exec-gets-46-months-...

FDIC was hacked by China, and CIO covered it up | Ars Technica
http://arstechnica.com/security/2016/07/fdic-was-hacked-by-china-and-cio...

Hacker 'Phineas Fisher' Speaks on Camera for the First Time-Through a Puppet | Motherboard
http://motherboard.vice.com/read/hacker-phineas-fisher-hacking-team-puppet

Hacker Claims to Have Sold Leaked Terrorism Watchlist 'World-Check' For $20,000 | Motherboard
http://motherboard.vice.com/read/hacker-leaked-terrorism-watchlist-world...

Two Million Passwords Breached in Ubuntu Hack | Threatpost | The first stop for security news
https://threatpost.com/two-million-passwords-breached-in-ubuntu-hack/119...

'Prominent' Admin of Top ISIS Forum Hacked | Motherboard
http://motherboard.vice.com/read/prominent-admin-of-top-isis-jihadi-foru...

Activists Release Nearly 100 Years of TIME Magazine Issues For Free | Motherboard
http://motherboard.vice.com/read/activists-release-nearly-100-years-of-t...

httpoxy
https://httpoxy.org/

Software flaw puts mobile phones and networks at risk of complete takeover | Ars Technica
http://arstechnica.com/security/2016/07/software-flaw-puts-mobile-phones...

Google Chrome Malware Leads to Sketchy Facebook Likes | Threatpost | The first stop for security news
https://threatpost.com/google-chrome-malware-leads-to-sketchy-facebook-l...

Oracle Fixes 276 Vulnerabilites in July Critical Patch Update | Threatpost | The first stop for security news
https://threatpost.com/oracle-patches-record-276-vulnerabilities-with-ju...

Apple Fixes Vulnerabilities Across OS X, iOS, Safari | Threatpost | The first stop for security news
https://threatpost.com/apple-fixes-vulnerabilities-across-os-x-ios-safar...

Cisco Talos - Talos 2016 0171
http://www.talosintelligence.com/reports/TALOS-2016-0171/

Crypto flaw made it easy for attackers to snoop on Juniper customers | Ars Technica
http://arstechnica.com/security/2016/07/crypto-flaw-made-it-easy-for-att...

Meet The Cyber Mercenaries Selling Spyware To Governments | Motherboard
http://motherboard.vice.com/read/meet-the-cyber-mercenaries-selling-spyw...

Carbanak Gang Tied to Russian Security Firm? - Krebs on Security
http://krebsonsecurity.com/2016/07/carbanak-gang-tied-to-russian-securit...

Risky Business #419 -- Brian Krebs on future of bank cybercrime

0:00 / 54:48

Risky Business Podcast

July 15, 2016

Risky Business #418 -- The rise of the crypto-Taliban

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're chatting with The Grugq about secure messaging. Facebook has announced it's rolling out an end-to-end encryption feature and the reaction to this wonderful announcement has been somewhat bizarre. We'll be talking to Grugq about why crypto absolutists are hating on companies that are rolling out non-default e2e features. We'll also talk about a couple of interesting case studies in which e2e encryption did absolutely nothing for the people using it.

This week's show is brought to you by Sensepost, an absolutely fantastic security firm that operates in England and South Africa. Sensepost has been an academy for security luminaries over the years. Haroon Meer of Thinkst was an early stage employee, Maltego creator Roelof Temmingh was a co-founder.

So, they're smart. And one of the things SensePost does is security training at BlackHat in Las Vegas. They've been doing this for 15 years and Sensepost's Daniel Cuthbert will be joining us in this week's sponsor interview to talk about what courses they're offering and who winds up actually taking them. The really interesting part is it's not always security professionals in those courses.

Adam Boileau, as usual, joins us to discuss the week's security news headlines.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

iOS version of Pok\xe9mon Go is a possible privacy trainwreck [Updated] | Ars Technica
http://arstechnica.com/gaming/2016/07/pokemon-go-on-ios-gets-full-access...

Malicious Pok\xe9mon Go Features Backdoor, RAT | Threatpost | The first stop for security news
https://threatpost.com/malicious-pokemon-go-app-installs-backdoor-on-and...

Chrysler Launches Detroit's First 'Bug Bounty' for Hackers | WIRED
https://www.wired.com/2016/07/chrysler-launches-detroits-first-bug-bount...

Paint it black: Revisiting the Blackphone and its cloudy future | Ars Technica
http://arstechnica.com/information-technology/2016/07/paint-it-black-rev...

Tor Project, a Digital Privacy Group, Reboots With New Board - The New York Times
http://www.nytimes.com/2016/07/14/technology/tor-project-a-digital-priva...

MIT Anonymity Network Riffle Promises Efficiency, Security | Threatpost | The first stop for security news
https://threatpost.com/mit-anonymity-network-riffle-promises-efficiency-...

Putin signs new anti-terror law in Russia. Edward Snowden is upset. - The Washington Post
https://www.washingtonpost.com/world/europe/putin-signs-law-to-bolster-r...

VPN Company Claims Russian Government Seized Its Servers | Motherboard
http://motherboard.vice.com/read/vpn-company-private-internet-access-cla...

Google Tests New Crypto in Chrome to Fend Off Quantum Attacks | WIRED
https://www.wired.com/2016/07/google-tests-new-crypto-chrome-fend-off-qu...

Now it's easy to see if leaked passwords work on other sites | Ars Technica
http://arstechnica.com/security/2016/07/password-reuse-tool-makes-it-eas...

Florida U boffins think they've defeated all ransomware \u2022 The Register
http://www.theregister.co.uk/2016/07/12/ransomware_defeated/

Nation-backed malware that infected energy firm is 1 of 2016's sneakiest | Ars Technica
http://arstechnica.com/security/2016/07/nation-backed-malware-that-infec...

Criminal Forums Ban Hacker Linked to Myspace, LinkedIn Breaches | Motherboard
http://motherboard.vice.com/read/criminal-forums-ban-hacker-linked-to-my...

Taiwan banks suspend Wincor Nixdorf ATM withdrawals after crooks st...
https://www.finextra.com/newsarticle/29161/taiwan-banks-suspend-wincor-n...

Hacker Finds Bug to Edit or Delete Any Medium Post | Motherboard
http://motherboard.vice.com/read/hacker-finds-bug-to-edit-or-delete-any-...

20-year-old Windows bug lets printers install malware-patch now | Ars Technica
http://arstechnica.com/security/2016/07/20-year-old-windows-bug-lets-pri...

D-Link Wi-Fi Camera Flaw Extends to 120 Products | Threatpost | The first stop for security news
https://threatpost.com/d-link-wi-fi-camera-flaw-extends-to-120-products/...

TP-Link forgets to register domain name, leaves config pages open to hijack | Ars Technica
http://arstechnica.com/security/2016/07/tp-link-forgets-to-register-doma...

July 2016 Adobe Flash Player Patches | Threatpost | The first stop for security news
https://threatpost.com/adobe-patches-52-vulnerabilities-in-flash-player/...

Facebook Messenger End-to-End Encryption Not On By Default | Threatpost | The first stop for security news
https://threatpost.com/facebook-messenger-end-to-end-encryption-not-on-b...

'Secret Conversations:' End-to-End Encryption Comes to Facebook Messenger | WIRED
https://www.wired.com/2016/07/secret-conversations-end-end-encryption-fa...

Kylie Auldist - Sensational - YouTube
https://www.youtube.com/watch?v=MqDDceJleh0

SensePost | Sensepost at blackhat & defcon 2016
https://www.sensepost.com/blog/2016/sensepost-at-blackhat-defcon-2016/

Risky Business #418 -- The rise of the crypto-Taliban

0:00 / 64:14

Risky Business Podcast

July 08, 2016

Risky Business #417 -- PlayPen ruling to let FBI off leash?

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

In this week's feature interview we're chatting with Stanford's very own Jennifer Granick about a recent ruling in a Virginia court that appears to give the FBI permission to hack into any computer it wants, sans warrant. Well that's what the headlines are screaming, anyway. But as you'll hear, it's not quite that black and white.

This week's edition of the show is brought to you by Senetas, big thanks to them. We'll of course be hearing from Senetas founder and CTO Julian Fay later on in this week's sponsor segment. He's joining us to talk about the latest guidance from NIST with regard to moving towards quantum resistant encryption. You've heard Julian and I discuss why NIST thinks the industry should do this, now we're going to talk about the how.

Adam Boileau, as usual, joins us to discuss the week's security news headlines.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

FBI - Statement by FBI Director James B. Comey on the Investigation of Secretary Hillary Clinton's Use of a Personal E-Mail System
https://www.fbi.gov/news/pressrel/press-releases/statement-by-fbi-direct...

Infidelity website Ashley Madison facing FTC probe, CEO apologizes | Reuters
http://www.reuters.com/article/us-ashleymadison-cyber-idUSKCN0ZL09J

Chelsea Manning 'rushed to hospital after trying to take own life' | Americas | News | The Independent
http://www.independent.co.uk/news/world/americas/chelsea-manning-rushed-...

Sorry Privacy Lovers, The Blackphone Is Flirting With Failure - Forbes
http://www.forbes.com/sites/thomasbrewster/2016/07/06/silent-circle-blac...

Researchers Sue the Government Over Computer Hacking Law | WIRED
https://www.wired.com/2016/06/researchers-sue-government-computer-hackin...

Over 100 Snooping Tor Nodes Have Been Spying on Dark Web Sites | Motherboard
http://motherboard.vice.com/read/over-100-snooping-tor-nodes-have-been-s...

These Maps Show What the Dark Web Looks Like | Motherboard
http://motherboard.vice.com/read/these-maps-show-what-the-dark-web-looks...

After hiatus, in-the-wild Mac backdoors are suddenly back | Ars Technica
http://arstechnica.com/security/2016/07/after-hiatus-in-the-wild-mac-bac...

How a Hacker Is Gaming the Media to Extort His Victims | Motherboard
http://motherboard.vice.com/read/how-a-hacker-is-gaming-the-media-to-ext...

Scope of ThinkPwn UEFI Zero Day Expands | Threatpost | The first stop for security news
https://threatpost.com/scope-of-thinkpwn-uefi-zero-day-expands/119027/

HummingBad Android Malware Connected to YiSpecter iOS Attacks | Threatpost | The first stop for security news
https://threatpost.com/chinese-ad-firm-raking-in-300k-a-month-through-ad...

Android's full-disk encryption just got much weaker-here's why | Ars Technica
http://arstechnica.com/security/2016/07/androids-full-disk-encryption-ju...

Most Post-Intrusion Cyber Attacks Involve Everyday Admin Tools | Threatpost | The first stop for security news
https://threatpost.com/most-post-intrusion-cyber-attacks-involve-everyda...

SSD Advisory - Wget Arbitrary Commands Execution - SecuriTeam Blogs
https://blogs.securiteam.com/index.php/archives/2701

DOJ Deploys Highly-Questionable Legal Arguments In Attempt To Save FBI's Hacking Warrants | Techdirt
https://www.techdirt.com/articles/20160503/17463334339/doj-deploys-highl...

Another Court Finds FBI's NIT Warrants To Be Invalid, But Credits Agents' 'Good Faith' To Deny Suppression | Techdirt
https://www.techdirt.com/articles/20160523/09060034525/another-court-fin...

U.S. court rules that FBI can hack into a computer without a warrant | PCWorld
http://www.pcworld.com/article/3088354/security/us-court-rules-that-fbi-...

Senetas
http://www.senetas.com/

Risky Business #417 -- PlayPen ruling to let FBI off leash?

0:00 / 57:13

Risky Business Podcast

July 01, 2016

Risky Business #416 -- Post holiday carnage edition

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we'll be catching up on the news of the last few weeks with Adam Boileau, then it's straight into the sponsor segment.

And we're really lucky this week to have Dan Guido joining us from the sponsor's chair. Dan is a semi regular feature guest on Risky Business. He is of course the head honcho over at Trail of Bits, a very interesting security problem solving organisation. He'll be along to talk about some developer tools they've just open sourced for iOS, to preview DARPA's Cyber Grand challenge final at DEFCON and to discuss an investment hack/secure has made into a company building serious host based protection agents out of osquery, the endpoint visibility tool created by Facebook.

One of Trail of Bits current gigs is actually developing osquery for Facebook, and Dan is pretty excited about it. Find out why after the news...

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

If you only read one item from this week's notes, make it this excellent write up from Matt Levine on the DAO fiasco:
http://www.bloomberg.com/view/articles/2016-06-17/blockchain-company-s-s...

Hackers invade Dems' servers, steal entire Trump opposition file | Ars Technica
http://arstechnica.com/security/2016/06/hackers-invade-dems-servers-stea...

"Guccifer" leak of DNC Trump research has a Russian's fingerprints on it | Ars Technica
http://arstechnica.com/security/2016/06/guccifer-leak-of-dnc-trump-resea...

A Chaotic Whodunnit Follows the DNC's Trump Research Hack | WIRED
https://www.wired.com/2016/06/chaotic-whodunnit-follows-dncs-trump-resea...

Hack Brief: Russia's Breach of the DNC Is About More Than Trump's Dirt | WIRED
https://www.wired.com/2016/06/hack-brief-russias-breach-dnc-trumps-dirt/

EXCLUSIVE: Brexit '2nd Referendum Petition' A 4 Chan Prank: BBC Report It As Real | Heat Street
https://heatst.com/uk/exclusive-brexit-2nd-referendum-petition-a-4-chan-...

Bitcoin rival Ethereum fights for its survival after $50 million heist | Ars Technica
http://arstechnica.com/security/2016/06/bitcoin-rival-ethereum-fights-fo...

Anti-Surveillance Measure Quashed: Orlando Massacre Cited as Reason | Threatpost | The first stop for security news
https://threatpost.com/anti-surveillance-measure-quashed-orlando-massacr...

Senate Narrowly Rejects Controversial FBI Surveillance Expansion-For Now
https://theintercept.com/2016/06/22/senate-narrowly-rejects-controversia...

Bangladesh unlikely to extend FireEye contract for heist probe | Reuters
http://www.reuters.com/article/us-cyber-heist-bangladesh-idUSKCN0Z81U6

Ukrainian bank cyber-heist: Hackers take off with $10m
http://www.ibtimes.co.uk/ukrainian-bank-cyber-heist-hackers-compromise-s...

Authorities Arrest an IT Worker From the Panama Papers Law Firm | WIRED
https://www.wired.com/2016/06/worker-panama-papers-law-firm-arrested/

800-pound Comodo tries to trademark upstart rival's "Let's Encrypt" name | Ars Technica
http://arstechnica.com/tech-policy/2016/06/800-pound-comodo-tries-to-tra...

IRS Re-Enables 'Get Transcript' Feature - Krebs on Security
http://krebsonsecurity.com/2016/06/irs-re-enables-get-transcript-feature/

Rise of Darknet Stokes Fear of The Insider - Krebs on Security
http://krebsonsecurity.com/2016/06/rise-of-darknet-stokes-fear-of-the-in...

Citing Attack, GoToMyPC Resets All Passwords - Krebs on Security
http://krebsonsecurity.com/2016/06/citing-attack-gotomypc-resets-all-pas...

Thousands of Hacked Government and Corporate Servers Selling for $6 on Black Market | WIRED
https://www.wired.com/2016/06/xdedic-server-trading-forum-kaspersky/

655,000 Healthcare Records Being Sold on Dark Web | Threatpost | The first stop for security news
https://threatpost.com/655000-healthcare-records-being-sold-on-dark-web/...

Large botnet of CCTV devices knock the snot out of jewelry website | Ars Technica
http://arstechnica.com/security/2016/06/large-botnet-of-cctv-devices-kno...

Report: FBI Doing Poor Job Securing 411 Million Facial Recognition Photos | Threatpost | The first stop for security news
https://threatpost.com/report-fbi-doing-poor-job-securing-411-million-fa...

iOS 10 beta still encrypts user data, but not the kernel | Ars Technica
http://arstechnica.com/apple/2016/06/ios-10-beta-still-encrypts-user-dat...

"Godless" apps, some found in Google Play, can root 90% of Android phones | Ars Technica
http://arstechnica.com/security/2016/06/godless-apps-some-found-in-googl...

$90K Windows Zero Day Gets a Price Cut | Threatpost | The first stop for security news
https://threatpost.com/90k-windows-zero-day-gets-a-price-cut/118594/

Patched BadTunnel Windows Bug Has 'Extensive' Impact | Threatpost | The first stop for security news
https://threatpost.com/patched-badtunnel-windows-bug-has-extensive-impac...

High-severity bugs in 25 Symantec/Norton products imperil millions | Ars Technica
http://arstechnica.com/security/2016/06/25-symantec-products-open-to-wor...

Apple Patches AirPort Remote Code Execution Flaw | Threatpost | The first stop for security news
https://threatpost.com/apple-patches-airport-remote-code-execution-flaw/...

A Bug in Chrome Makes It Easy to Pirate Movies | WIRED
https://www.wired.com/2016/06/bug-chrome-makes-easy-pirate-movies/

7 Ways the Cops Will Bust You on the Dark Web | Motherboard
http://motherboard.vice.com/read/7-ways-the-cops-will-bust-you-on-the-da...

Trail of bits stuff, including links to new open source dev tools:
----------------------------------------------------------------------------

Trail of Bits | Home
https://www.trailofbits.com/

Trail of Bits | Products
https://www.trailofbits.com/products/#mast

Tidas \xb7 GitHub
https://github.com/tidas

GitHub - trailofbits/SecureEnclaveCrypto: Crypto with the Secure Enclave
https://github.com/trailofbits/SecureEnclaveCrypto

Risky Business #416 -- Post holiday carnage edition

0:00 / 49:19

Risky Business Podcast

June 10, 2016

Risky Business #415 -- Lauri Love talks extradition

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're chatting with Lauri Love. Lauri is an activist facing extradition to the United States where prosecutors hope to charge him with a raft of offences relating to attacks against US government computers... he'll tell us about what's going on with his extradition hearing and why he really, really doesn't want to go to the USA.

This week's show is sponsored by Tenable Network Security, big thanks to them. If you're looking for some vulnerability scanning and management software you really should talk to Tenable!

In this week's sponsor interview we're chatting with Chris Cleary. He's a director of business development at Tenable. His focus is on the US federal government, so we'll be chatting to him about the fallout from the OPM breach, one year on. There have been some significant changes to the way things are done, Chris says, but it's too soon to see if they'll pan out as intended.

Adam Boileau, as always, stops by to discuss the week's news headlines.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Jacob Appelbaum Has Allegedly Engaged in Sexual Misconduct for Over a Decade
http://gizmodo.com/jacob-appelbaum-has-allegedly-engaged-in-sexual-misco...

Eyewitnesses Recount Tor Developer Jacob Appelbaum's Unwanted Sexual Advances
http://gizmodo.com/eyewitnesses-recount-tor-developer-jacob-appelbaum-s-...

He said, they said - hypatia dot ca
https://hypatia.ca/2016/06/07/he-said-they-said/

Jacob Appelbaum
http://jacobappelbaum.net/

Jacob Appelbaum allegedly intimidated victims into silence and anonymity | The Daily Dot
http://www.dailydot.com/politics/jacob-appelbaum-tor-project-suspension-...

What Jake Appelbaum did to me - Medium
https://medium.com/@nickf4rr/hi-im-nick-farr-nickf4rr-35c32f13da4d#.eqfi...

Tor Developer Jacob Appelbaum Resigns Amid Sex Abuse Claims | WIRED
https://www.wired.com/2016/06/tor-developer-jacob-appelbaum-resigns-amid...

Jacob Appelbaum allegedly intimidated victims into silence and anonymity | The Daily Dot
http://www.dailydot.com/politics/jacob-appelbaum-tor-project-suspension-...

Statement | The Tor Blog
https://blog.torproject.org/blog/statement

TwitLonger - When you talk too much for Twitter
http://www.twitlonger.com/show/n_1soorlp

No internet for Singapore public servants - BBC News
http://www.bbc.com/news/world-asia-36476422

TeamViewer confirms number of abused user accounts is "significant" | Ars Technica
http://arstechnica.com/security/2016/06/teamviewer-says-theres-no-eviden...

Mark Zuckerberg's Twitter, Pinterest accounts compromised | Ars Technica
http://arstechnica.com/security/2016/06/mark-zuckerberg-twitter-pinteres...

FTC's chief technologist gets her mobile phone number hijacked by ID thief | Ars Technica
http://arstechnica.com/tech-policy/2016/06/ftcs-chief-technologist-gets-...

University pays almost $16,000 to recover crucial data held hostage | Ars Technica
http://arstechnica.com/security/2016/06/university-pays-almost-16000-to-...

100M Credentials From 'Russian Facebook' VK.com For Sale | Threatpost | The first stop for security news
https://threatpost.com/100m-russian-facebook-credentials-for-sale/118483/

\u200bOne of the World's Largest Botnets Has Vanished | Motherboard
http://motherboard.vice.com/read/one-of-the-worlds-largest-botnets-has-v...

The Troubling Metadata Sharing Program That Was Just Revealed in the UK | Motherboard
http://motherboard.vice.com/read/gchq-gives-uk-police-access-to-metadata...

It Takes Mere Minutes to Make a Fake, Potentially Malicious Facebook Ad | Motherboard
http://motherboard.vice.com/read/it-takes-mere-minutes-to-make-a-fake-po...

There's a Stuxnet Copycat, and We Have No Idea Where It Came From | Motherboard
http://motherboard.vice.com/read/theres-a-stuxnet-copycat-and-we-have-no...

ISIS worries that fake Android apps are spying on its ranks
http://www.engadget.com/2016/06/05/isis-worries-about-fake-android-apps/

IT Admin Faces Felony for Deleting Files Under Flawed Hacking Law | WIRED
https://www.wired.com/2016/06/admin-faces-felony-deleting-files-flawed-h...

WordPress plugin with 10,000+ installations being exploited in the wild | Ars Technica
http://arstechnica.com/security/2016/06/10000-wordpress-sites-imperilled...

New Angler Exploits Bypass EMET Mitigations | Threatpost | The first stop for security news
https://threatpost.com/new-angler-exploits-bypass-emet-mitigations/118485/

NTP Patches Flaws That Enable DDoS | Threatpost | The first stop for security news
https://threatpost.com/ntp-patches-flaws-that-enable-ddos/118470/

June 2016 Android Security Bulletin | Threatpost | The first stop for security news
https://threatpost.com/latest-android-security-bulletin-heavy-on-critica...

Lenovo Tells Users to Uninstall Vulnerable Updater | Threatpost | The first stop for security news
https://threatpost.com/lenovo-tells-users-to-uninstall-vulnerable-update...

Uber Pays Researcher $10K for Login Bypass Exploit | Threatpost | The first stop for security news
https://threatpost.com/uber-pays-researcher-10k-for-login-bypass-exploit...

Facebook Messenger Vulnerability Patched | Threatpost | The first stop for security news
https://threatpost.com/facebook-messenger-vulnerability-patched/118511/

Risky Business #415 -- Lauri Love talks extradition

0:00 / 62:24

Risky Business Podcast

June 03, 2016

Risky Business #414 - Trading on OSINT for fun and profit

Presented by

On this week's show we're chatting with Australian security researcher Nik Cubrilovic. He's been doing some fascinating research into using OSINT techniques to obtain market-sensitive information. It's OSINT for fun and profit! That's this week's feature.

In this week's sponsor interview we chat with Marco Slaviero, lead researcher from Thinkst Applied Research. Thinkst is, of course, the company behind Canary.tools, and Marco is along this week to talk about some free services and tools Thinkst has developed. You may have heard Haroon Meer talking about honey tokens on a previous episode. Well, the team at Thinkst have created some new honeytokens that use Microsoft's cryptoAPI to do all sorts of really funky stuff.

Adam Boileau, as always, stops by to discuss the week's news headlines.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Risky Business #414 - Trading on OSINT for fun and profit

0:00 / 0:00

Other Category

August 11, 2016

Risky Business Podcast

August 11, 2016

Show notes

Risky Business Podcast

August 06, 2016

Show notes

Risky Business Podcast

July 29, 2016

Show notes

Risky Business Podcast

July 22, 2016

Show notes

Risky Business Podcast

July 15, 2016

Show notes

Risky Business Podcast

July 08, 2016

Show notes

Risky Business Podcast

July 01, 2016

Show notes

Risky Business Podcast

June 10, 2016

Show notes

Risky Business Podcast

June 03, 2016

Brought to you by Thinkst