Risky Business Podcast

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Widely used polyfill javascript gets hijacked by its new owners
• MacOS supply chain disaster bullet dodged
• That OpenSSH remote code exec OH MY <3
• Entrust gets its CA business kicked to the kerb by Google
• South Korean telco intentionally viruses 600k customers
• Microsoft continues to deeply underwhelm
• And much, much more.

This week’s episode is sponsored by Greynoise. Founder Andrew Morris joins to talk about ways to track attackers across NAT and VPNs, as well as how you can join in the fun of running an internet-scale honeypot network.

This is a sponsored Soap Box edition of the Risky Business podcast.

Abhishek Agrawal is the CEO and co-founder of Material Security, an email security company that locks down cloud email archives. Attackers have been raiding mailspools since hacking has existed, and with those mailspools now in the cloud with services like o365 and Google Workspace, guess where the attackers are going?

Material built a product that helps you lock up your email data, to archive and redact sensitive information. The idea is to really just limit what an attacker can do with email data if they pop an account.

Abhishek joined me to talk about a few things, like how non phishing resistant MFA is basically dead, how email content is very useful to security programs, and about how the gen AI won’t really change much on the defensive control side.

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Julian Assange finally cuts a deal, pleads guilty, and goes free
• USA to ban Kaspersky - even updates
• Car dealer SaaS provider CDK contemplates paying a ransom
• Intolerable healthcare ransomware attacks continue
• We revisit Windows proximity bugs via wifi and bluetooth
• And much, much more.

This week’s episode is sponsored by enterprise browser maker Island. Crowdstrike co-founder Dmitri Alperovitch is an investor in Island, and joins on its behalf to discuss why an enterprise browser is really starting to make sense.

On this week’s retreat special, the entire Risky Business team is together in a tropical paradise for the first time. The team takes a break from the infinity pool to discuss the week’s security news:

• Microsoft recalls Recall, but why did it have to be such a mess
• And a Windows kernel wifi code-exec, really?
• Passkeys and identity are hard
• Scattered Spider bigwig arrested in Spain
• The pentagon runs a deeply flawed info-op
• Is it time E2E crypto nerds accept their place in the world?
• And much, much more.

This week’s show is brought to you by Corelight… Corelight’s CEO Brian Dye will be along in this week’s sponsor interview to make a really compelling case for something that shouldn’t exist… which is NDR in cloud environments.

On this week’s show Patrick Gray and Adam Boileau are joined by long-time NSA boffin Rob Joyce. Now Rob’s left the government service, he’s hobnobbing with us pundits, talking through the week’s news:

• Apple announces a big leap for confidential cloud computing into the mass market
• While at the same time, letting you just mosey around your iPhone from your Mac
• Mandiant reports in about the Snowflake breach
• Moody’s say credit ratings might consider cyber incidents
• Microsoft fixes an Azure flaw with a… “comprehensive documentation update”
• And much, much more.

This week’s show is sponsored by Yubico, maker of the Yubikey hardware authentication token. Jerrod Chong, Yubico’s COO and President joins to talk about the challenges of the passkey and hardware authenticator ecosystem.

On this week’s show Patrick Gray and Mark Piper discuss the week’s security news, including:

• What on earth happened at Snowflake?
• A look at operation Endgame
• Check Point’s hilarious adventures with dot dot slash
• Report says the FTC is looking at Microsoft’s security product bundling
• More ransomware hits Russia
• Much, much more

404 Media co-founder Joseph Cox is this week’s feature guest. He joins us to talk about his new book, Dark Wire, which is all about the FBI’s Anom sting.

This week’s show is brought to you by Resourcely. If your Terraform is a mess or your CSPM dashboards are lighting up with insane and stupid things, you should check out Resourcely. Its founder and CEO Travis McPeak will be along in this week’s sponsor interview to talk about all things Terraform.

On this week’s show Patrick and Adam discuss the week’s security news, including:

• Russian delivery company gets ransomware-wiper’d
• A supply-chain attack targets video software used in US courts
• Checkpoint firewalls get hacked, details as clear as mud
• Microsoft Recall delights hackers
• Aussie telco Optus gets told its IR report isn’t legal advice
• Cyber insurer says you’re 5x more likely to get rekt if you have a Cisco ASA
• And much, much more.

This week’s episode is sponsored by Kroll Cyber. Alex Cowperthwaite, Kroll’s technical director research and development for offence joins to talk about how his team attacks AI models, in ways both classic and new.

This week’s episode was recorded in front of a live audience at AusCERT’s 2024 conference. Pat and Adam talked through:

• Google starts using security as a marketing tool against Microsoft, along with steep discounts
• Microsoft announces a creepy desktop recording AI
• UK govt proposes ransom payment controls
• Arizona woman runs a laptop farm for North Korea
• Julian Assange just keeps on with his malarky
• And much, much more

This week’s episode is sponsored by Tines. Its CEO Eoin Hinchy joins the show to talk about how AI can be genuinely useful in automation.

In this podcast SentinelOne’s Chief Trust officer Alex Stamos and its Chief Intelligence and Public Policy Officer Chris Krebs join Patrick Gray to talk all about AI.

It’s been a year and a half since ChatGPT landed and freaked everyone out. Since then, AI has really entrenched itself as the next big thing. It’s popping up everywhere, and the use cases for cybersecurity are starting to come into focus.

Threat actors and defenders are using this stuff already, but it’s early days and as you’ll hear, things are really going to change, and fast.

This week Patrick Gray and Adam Boileau along special guest Lina Lau discuss the week’s news, including:

• The ongoing Ascension healthcare disruption, and
• Whether its reasonable for healthcare orgs to be pushing back
• Platforming cybercriminals for interviews
• Own the libs by… not using E2EE messaging?
• CISA’s secure by design, we want to believe!
• The $64billion scale of indusrialised fraud
• And much, much more.

This week’s sponsor is network discovery specialist, Run Zero. Director of research Rob King joins to talk about the weird and wonderful delights in their new Research Report.