Risky Business Podcast

Snake Oilers: Get Signal Sciences in your CDN, automate canary generation and cloud your SIEM! Three solid pitches in this edition…

In this edition of the Snake Oilers we’ll hear pitches from three vendors:

• Brian Joe from Fastly talks about its integration of the Signal Sciences WAF into its CDN
• Ben Whitham and Dan Holman talk about HoneyTrace, a canary creation and monitoring automation play
• Anton Chuvakin from Google Cloud talks about cloud native SIEMs

Links to everything we talked about are in the show notes.

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• Apple backs down on CSAM measures
• FTC shuts down spouseware company
• REvil is back!
• Confluence boxes are getting owned a lot
• Trickbot crew member arrested in South Korea
• The Juniper/NSA backdoor story just keeps on truckin’

This week’s show is brought to you by Thinkst Canary. Thinkst’s Jacob Torrey is this week’s sponsor guest. He pops by to tell us about the relaunch of Thinkstscapes, a fantastic quarterly publication that analyses security research.

(Editor’s note: Dmitri Alperovitch is a guest in this podcast and wishes to express his gratitude to Matthew Green of Johns Hopkins University for helping guide him on the Juniper story.)

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• More info on the Belarusian Cyber Patriots
• How infosec overhyped election security risks
• Is data ransoming dying?
• All about the Azure Cosmos DB drama
• Much, much more…

In this week’s sponsor interview Airlock Digital’s Daniel Schell and David Cottingham join the show to talk about EDR bypasses. They are a thing.

In this edition of the Soap Box podcast we’ll be hearing from Ryan Kalember, the EVP of cybersecurity strategy at Proofpoint, a company best known for being an email filtering giant.

Proofpoint’s biggest challenger in that space is Microsoft, and if you’ve been paying attention you’d know that Microsoft is doing an absolutely massive push into the security space. It claims security is a $10bn revenue centre for the company, which is a bit of a screwy situation given a lot of the insecurity its security products mitigate is introduced through deficiencies in its core products.

And, largely, that’s what this interview is about – the screwy incentives that are driving Microsoft’s decisionmaking. More emphasis on security product development, and less effort on securing its core products.

Of course it’s self-serving for Ryan and Proofpoint to give Microsoft a kicking, given Redmond is its primary competitor. But the thing is, Ryan makes some very good points.

We talk about the incentives thing, and then we talk about why active directory is a trashfire and why the replication of the domain trust model in AzureAD is going to eventually bite us all in the ass. The circle of life, enterprise computing fail edition. Enjoy.

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• T-Mobile owned hard
• USA no fly list winds up on unsecured ElasticSearch in Bahrain… because reasons
• Facebook scrambles to secure Afghani accounts
• Hacker steals and returns $600 from de-fi platform
• Healthcare sector struggles with ransomware attacks
• A very sweet TCP-based amplification technique that will be A Problem
• Much, much more

Evan Sultanik and Dan Guido will be joining us to talk about Fickling – a tool developed by Trail of Bits to do unnatural things to the Python Pickle files that are heavily used as a means to share machine learning models. The machine learning supply chain is really quite wobbly, and they’ll be joining us later to talk about that.

I am stoked to be publishing this interview. This Soap Box is brought to you by Rumble, the asset discovery company founded by HD Moore. For those of you who don’t know, HD is a security legend, having done all sorts of amazing research over the years and creating Metasploit all the way back in 2003.

This guy, as you’ll hear, vibrates at a slightly higher frequency than the rest of us. He’s one of those people who’s not only insanely talented, but he’s also insanely hardworking, which is why we get to have nice things like Metsaploit and, now, Rumble.

So: What is Rumble? It’s is an active asset discovery tool. You set it loose on your network and it shows you what’s there… but this isn’t your grandma’s portscanner. This thing can see through walls and around corners, and what it finds will genuinely blow you away. A couple of weeks ago a guy by the name of Tom Lawrence did an awesome 15 minute demo of Rumble for his YouTube channel.

I would highly recommend you watch it, even before you listen to this podcast. He does a fantastic job of demoing the product and showing that it’s able to make sense of what it sees to a very surprising degree. Tom demos it on a small network, but yeah, it scales – HD says Rumble counts a Fortune 5 among its customers.

Anyway, what HD has done with Rumble is create a tool – a lightweight scanner you can run from basically anywhere in a network – that will show you networks you didn’t know existed, it’ll identify devices with ridiculous granularity… it can even tell you if a windows box has EDR on it or a wireless card installed, all with an unauthenticated network scan.

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• The United States backing away from “releasing the hounds”
• Apple has dropped its lawsuit against Corellium
• “Activists” dox Belarusian security apparatus
• Another sign hiding IR reports behind legal privilege is looking shaky
• Apple implements new child protection tech
• Much, much more

After this week’s news we’ll hear from Matt Cauthorn from ExtraHop Networks in this week’s sponsor interview. We’ll be talking about ransomware hack and leak and about how ransomware crews are losing credibility. You used to be able to actually trust them to just unlock you or keep your data private, but that’s not so much the case anymore.

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• US President Joe Biden says next shooting war will result from cyber incident
• The Sun tabloid reports UK government weighing “cyber strike” against Iran
• Australia, UK and USA release list of most commonly used CVEs
• NSA drops Kubernetes security guide
• Much, much more!

This week’s show is brought to you by Cmd Security. It makes what can best be described as a security agent for Linux. It can handle everything from user action restriction to IDR functionality, and Cmd’s co-founder Jake King will be along in this week’s sponsor slot to talk about what he’s seeing out there in Linux land. Jake says there’s a big cloud modernisation push happening right now as people re-architect their “legacy cloud” infrastructure into more modern setups.

In this sponsored edition of the Risky Biz Soap Box podcast VMRay’s VP of Products Uriel Cohen joins me to talk about its Email Threat Defender product.

They’ve glued some automated sandbox analysis to their fancy phishing/link analysis/detection tech and they’re pitching it as a secondary control. That means no, they’re not trying to replace big services like Proofpoint or Microsoft’s upper tier filtering, but as a seat belt to catch things that slip the net.

We talk about what they’re trying to do, look at the limitations of static and dynamic detection and talk about all sorts of other stuff too. Enjoy!

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• Analysis suggests the Kaseya REvil incident was actually a bit of a fizzer
• They also obtained a decrypt key and no one knows how
• EU to follow US Treasury on Bitcoin controls
• Israeli Government has eyes on NSO fallout
• PetitPotam Active Directory technique is very bad news
• Much, much more…

This week’s show is brought to you by Remediant. Remediant makes a PAM solution that’s, well, quite different from the traditional password-vault style solutions. That’s put them in an interesting situation lately with Gartner. Remediant scored an honourable mention as a PAM to take note of, alongside Microsoft, but the thing is they don’t even qualify as a PAM vendor under Gartner’s own criteria. This might mean the analyst firms need to re-jig the way they evaluate and rank tech given there are so many more ways to skin cats these days. Remediant co-founder Paul Lanzi will join me in this week’s sponsor slot to talk through all of that.