Risky Business Podcast

On this week's edition of the show we take a look at the security of Apple's iTunes store. If you haven't heard the news, it seems a rogue app developer was able to bill Apple customers for apps they never bought.

We'll find out just how well the Apple app store was put together in the first place when we speak with Karl Chaffey. He works for a mobile development company and put together an interesting lightning talk for last year's Kiwicon conference which was all about the iTunes store.

Also this week we'll be chatting with Veracode's director of product management Tim Jarrett in our sponsor interview. We'll be talking about how to keep things nice when you're maintaining live code... how much automated scanning should you do? How much manual testing?

Adam Boileau is the week's news guest.

WARNING: This week we missed some bad language during the edit... so hide this filthy podcast from your children's innocent ears.

On this week's show we're chatting with the head of Australia's Internet Industry Association (IIA), Peter Coroneos, about the government's plan to force internet users here to use antivirus software or be kicked off the tubes!

Peter was the architect of Australia's just released voluntary code for ISPs, but he'll be along soon to talk about why he thinks regulation here is actually a BAD idea. That's coming up soon.

In this week's sponsor interview we chat with Tenable Network Security CEO Ron Gula about APTs, or Advanced Persistent Threats. Are APTs a big deal? Are they real? Is this marketing hype? What's going on?

That's this week's sponsor interview, and it's coming up later.

Adam Boileau, as always, joins the show to discuss the week's news headlines.

In this week's show we have a chat with iDefense threat analyst Kimberly Zenz.

Apparently Russian cybercrooks love to use ICQ, so US-based investigators are worried about the planned sale of ICQ to a Russia-based company called Digital Sky.

Kimberly's specialty is the Russian cybercrime scene, and apparently this mooted sale is interesting for a number of reasons. She joins the show to explain!

Adam Boileau is this week's news guest, and Vitaly Kamlyuk of Kaspersky Labs is this week's sponsor guest. In it we discuss the number of malware samples with valid authenticode signatures that are popping up.

With a system this loose is there actually a point to signing code?

On this week's show we take a look at Australia's CERT wars. The Australian government has more or less declared AusCERT dead. It says its new group, CERT Australia, which is run out of the Attorney General's Department, will act as the sole point of contact for organisations in Australia when seeking CERT services or coordination.

AusCERT doesn't see it that way. Its general manager, Graham Ingram, fronts this week's program to claim it's business as usual for the member-funded NGO. We also have a chat with our secret squirrel, an anonymous source close to the war.

Mark Dowd is this week's news guest, filling in for Adam Boileau this week. Adam's off presenting at Syscan in Singapore, but he'll be back on deck next week.

In this week's sponsor interview we speak with Check Point's Engineering Services Manager Aviv Abramovich about using logging as a deterrent to data theft.

In this week's feature interview we chat with Adrian Lamo. Best known as the "homeless hacker," Lamo is in the news again over his decision to inform on US Army Specialist Bradley Manning, the alleged leaker of the so-called "Collateral Murder" video published by Wikileaks in April.

Manning is now in detention in Kuwait. We ask Lamo why he turned him in.

Also this week, Veracode co-founder and chief scientist Christien Rioux joins the show to talk about some fresh approaches to information security and cloud computing in our sponsor interview. Sounds boring. Isn't.

Adam Boileau, of course, joins us to discuss the week's news.

On this week's show we take a look at reports that Google is set to banish Microsoft Windows from its operating system over security concerns.

The tech giant says running Windows is just too risky. Google was, after all, famously owned in the Aurora incident through holes in Internet Explorer 6.

But our guest this week, Neohapsis CTO Greg Shipley, says getting owned by a hole in a nine year old browser is probably a sign that your desktop management is the problem, not the platform you've chosen.

Also this week, Marcus Ranum joins us to talk about what he describes ad the non-existent meme that is "Cyberwar". That's this week's sponsor interview.

Adam Boileau, as always, checks in to discuss the week's news.

Our feature guest this week Azimuth Security's Mark Dowd.

Mark is widely regarded as one of the best vulnerability researchers in the industry. He's published remote flaws in software like Sendmail and SSH, he's even created new classes of bugs. Remember that cross platform Flash bug a while ago? That was him, too.

So it's no surprise that when Google wanted someone to look over the security architecture of its Chrome browser, they turned to Mark. He went over Chrome with a fine tooth comb, uncovering some bugs as he went. But as you'll hear, Mark says the basic architecture of Chrome's sandbox is solid.

In this week's sponsor interview with speak with Eugene Kaspersky about the future of security on mobile devices. Kaspersky believes that mobile devices in the future will be much more complicated than they are now, and that will mean the current model of application verification won't last. People will always go to the more open platforms, he says.

Adam Boileau, as always, joins us for a discussion of the week's news headlines.

This week's show is sponsored by Check Point Software.

In it we check in with Belgium-based security guy, spare-time researcher and noodler Didier Stevens.

We're talking to Didier about a weird little project he unveiled a couple of months ago. He's taken the source code from the command interpreter from ReactOS and compiled it into a DLL that he can shove into memory.

That way he gets shell without launching a new process. I got him on the show to ask him what the hell's wrong with Meterpreter for that sort of thing.

We'll also be joined by Check Point's Dan Baucaut in this week's sponsor interview. It used to be that outsourcing your firewall management was all the rage, but is it still popular and does it still make sense? Did it ever make sense?

As always, Adam Boileau is the week's news guest.

This week's feature interview is with Matt Olney of Sourcefire's vulnerability research team. These guys have put a bunch of work into a new open source tool that can grab files, like PDFs, off the wire, scan them for dodgy stuff and trigger Snort alerts.

It's called Near Real Time detection and it might just have legs.

This week's edition of the show is brought to you by Tenable Network Security, and as is our custom here at Risky.Biz HQ we chat with Tenable's CEO and industry stalwart Ron Gula in this week's sponsor interview. In it we discuss McAfee's borked update of a couple of weeks ago, logic bugs in the cloud and more.

Adam Boileau, as usual, drops in to discuss the week's news headlines.

You can find more info on NRT here.

H D Moore is this week's feature guest. The company he works for, Rapid7, will soon release a commercial version of Metasploit.

Risky Business asks HD about the new product and discusses the controversy that may arise from the commercialisation of the open source project.

Vitaly Kamlyuk from Kaspersky Lab is this week's sponsor guest. In the interview Vitaly expresses concerns that some legitimate research -- his, at times, included -- is playing into the hands of the bad guys.

And Adam Boileau is this week's news guest.

BTW Risky Business rules.