Risky Business Podcast

On this week's show we have a chat to Paul Ducklin about what he sees as questionable ethics behind some mobile malware research.

Researchers from Rutgers University and Veracode have written mobile phone malware or trojans; the latter even released the source code to their BlackBerry trojan. But what purpose does this serve, asks Duck. Is there any benefit at all to be had from writing and releasing trojans, even if they are written for academic purposes?

This week's sponsor interview is with Check Point's Fredrik Borjesson, and Adam Boileau is the week's feature guest.

This week we speak to iDefense analyst Kim Zenz, who's currently based in Moscow. We'll be getting an update on what the bad guys are up to in the former USSR, after all it's usually a good indicator of what they'll get up to in Western countries in the not too distant future.

After that we'll check in with Chris Wysopal, aka Weld Pond. He's the CTO of Veraocde and joins us to talk about the company's first ever state of software security report which is a surprisingly engaging read. That's this week's sponsor interview.

Adam Boileau, as usual, sheds his beardy McUNIXguy perspective on the week's news.

Here is a link to the APNIC stuff Adam and I talk about in the show.

There's no feature interview in this week's show -- it has an empty middle, just like an Easter egg!

Between me getting bumped out with a cold for a couple of days last week and this being a four day week, I just couldn't pull one together in time. Apologies.

So on this week's show we've got an extra long news segment with Adam Boileau, which is a bunch of fun.

In it we discuss:

• Aurora not all it's cracked up to be
• RIP SCO
• Claims of a Vietnamese government sponsored botnet. (WTF?)
• The march of China's great firewall
• When two networks are better than one
• A $100 kit for sniffing wireless keyboards

PLUS!

• Cisco's latest round of ghastly bugs
• Apple's latest round of ghastly bugs
• Microsoft's latest round of ghastly bugs

We also have an interesting chat with Ron Gula, chief executive of Tenable Network Security, in this week's sponsor interview. The topic is vulnerability scoring and knowing when a vulnerability scan is actually pointless.

This week we chat with Assistant Commissioner Neil Gaughan of Australia's Federal Police about trends in fraud.

We'll also have a bit of a chat about all things Gumblar with Vitaly Kamlyuk of Kaspersky Lab in Japan in this week's sponsor interview. Vitaly's been having a bunch of fun with the creators of Gumblar. In fact, it seems the guys behind the system have gotten so sick of Vitaly and his buddies profiling the Gumblar systems from their Japanese offices that they've blackholed the entire country of Japan to slow him down.

It's a bumper news session this week -- Albert Gonzalez has been sentenced for his TJX hack, spooks have been busted man-in-the-middling SSL connections, someone's released DNS tunnelling shellcode for Metasploit (yummy), etc and so on, so forth etc.

Link to DNS tunnelling shellcode stuff here.

Link to the IE8 exploit paper mentioned by Adam is here.

This week we've got Brian Snow on the show again. Brian had a 34 year career with the NSA in the States -- when he retired just a few years ago he was the technical director of Information Assurance there.

He's joining the show this week to talk about PKI, and specifically, why PKI hasn't taken off like we all thought it would. Brian actually has a pretty decent explanation for why things like federated identity never took off in the early to mid naughties like we all thought it would.

That's after the news.

Also this week we chat with Matt Moynahan, Veracode's chief executive. We're talking to Matt about the testing of applications sold via things like Apple's app store and Google's equivalent. That's our sponsor interview.

Adam Boileau, as usual, is this week's news guest.

On this week's show we're having an extended chat with our good mate Greg Shipley.

Greg's best known as the CTO of Chicago-based information security consultancy Neohapsis, and he'll be joining us to talk about what was on the agenda at the RSA conference. Apparently it's cloud, cloud, cloud... but what does that actually mean, mean, mean? Greg will be along soon to discuss, he's always good.

There will be no sponsor interview this week -- the team at Check Point are snowed under at the moment so we just didn't get an interview organised, but that's cool, because it leaves more time for me and Greg to talk about stuff.

Adam Boileau joins us for the news this week.

Risky Business is hosted by the team at Virtual.Offis in Sydney but sponsored, this week, by Tenable Network Security.

This week's feature guest is H D Moore, who'll be joining us to talk about some fun stuff he's been doing with NTP. Believe it or not you can use NTP to do massive recon on the Intertubez. H D has built a database of millions of hosts by querying NTP boxens. It's cool.

Tenable Network Security CEO Ron Gula joins us in this week's sponsor interview, and Adam "Beardy McUNIXguy" Boileau drops in to discuss the week's news.

This week's edition of Risky Business is brought to you by Kaspersky and hosted by Virtual.Offis.

This week we take a look at patch management and ask why it still sucks. Security professionals have been advising their clients to sort out their patching processes for more than ten years, but it's still at the top of many, many a post-audit report.

We chat to Securosis analyst Rich Mogull about his research on patch management.

In this week's sponsor interview with chat with Kaspersky Labs' Vitaly Kamlyuk about the next generation of ransomware doing the rounds in the Russian Federation. Let's hope it doesn't wind up here!

Adam Boileau, as always, is this week's news guest.

On this week's show we're joined by a very special guest -- Brian Snow.

Until his recent retirement, Brian was the technical director of information assurance for the United States National Security Agency. So, in other words he knows a few things about information security and in this week's show we cover a bunch of stuff with him -- everything from Google's recent trouble in China to e-voting, to cyrpto trust models and more.

That's after the news.

In this week's sponsor interview Veracode's Tyler Shields joins us to chat about the Blackberry proof of concept spyware he's created... apparently it's still not too hard to get custom malware installed on to the Blackberry and Tyler will tell us all about it!

On this week's show we'll be checking the news with Adam Boileau, as we always do, then we're going to have a chat with Brett Moore of Insomnia Security.

A bug Brett found featured in the most recent patch Tuesday release, so we thought we'd get him on the line and get the latest scuttlebut from the world of vulnerability research. Where are the new bugs popping up? What are the trends? What can we expect?

That's after the news.

We stick with the vulnerabilities theme in this week's sponsor interview with Fred Borjesson of Check Point Software here in Australia. We're speaking to Fred about software vendors' rather annoying habit of sitting on bugs.

That IE6 bug that popped every man and his dog over the southern summer had been reported to Microsoft a long time before those attacks -- should we be angry that it took that long? Or would the attackers just found another bug Microsoft didn't know about for their attacks?