Videos

In this edition of Between Two Nerds, Tom Uren and The Grugq talk about the United State’s Vulnerabilities Equities Program, which balances the need for intelligence collection with need to protect the public. The government recently revealed that in 2023 it released 39 vulnerabilities, but what does this really tell us?

In this SoapBox edition of the show Patrick Gray chats to Fletcher Heisler, the CEO of open-source identity provider Authentik.

The whole idea of Authentik is you can take control of an essential IT and security function: identity. Because Authentik is open source it’s extremely flexible, and if you’re running it yourself, you get to decide where your IDP should sit in your architecture.

You can run it on prem if you’re an emergency call centre or you’re operating an airgapped network, or you can spin it up in your cloud environment if you’re a typical enterprise.

Fletcher talks through th…

In this podcast Tom Uren and Patrick Gray talk about Apple’s refusal to obey a UK government order to provide the capability to access to encrypted iCloud data. Its the latest round in the ongoing government vs technology fights over warrant-proof encryption, and again it looks like governments will lose.

They also talk about good news in the fight against ransomware. Government actions are putting pressure on the cyber criminal ecosystem, splintering groups and even making it hard to for crooks to convert cryptocurrency to hard cash.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• Musk’s DOGE kid has a history with The Com
• Paragon fires Italy as a spyware customer
• Thailand cuts power to scam compounds…
• … and arrests Phobos/8Base Russian cybercrims
• The CyberCX DFIR report shows non-U2F MFA is well and truly over
• And much, much more.

This week’s episode is sponsored by Dropzone.AI. They make an AI SOC analysis platform that relieves your analysts of the necessary but tedious work, so they can focus on the value of human insight. Dropzone’s founder and CEO Edward Wu joins to talk about how they approach the problem….

In this edition of Between Two Nerds Tom Uren and The Grugq talk about Israeli spyware vendor Paragon, how and why it positions itself to sell to the US market, and how its capabilities might work.

In this podcast Tom Uren and Patrick Gray talk about the cyber espionage implications of Chinese AI firm DeepSeek’s recently released models. They will certainly be picked up by various APT crews to try and accelerate their campaigns.

They also discuss the UK NCSC’s attempt to quantify ‘comedy bugs’ and whether EU sanctions against Russian military intelligence officers for a five-year-old cyber espionage campaign targeting Estonia are pointless.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• DeepSeek leaves an unauthed database on the internet
• Russia hacked UK prime minister’s personal mail
• Australia sanctions a Telegram group… which is more sensible than it sounds
• Medical device backdoor turns out to be just poorly thought out upgrade feature
• Google abuses weak hashing to patch AMD CPU microcode
• And much, much more.

This week’s episode is sponsored by email security boffins Sublime. Their co-founder and CEO Josh Kamdjou joins to talk about how attackers’ abuse of legitimate services like Docusign is a challenge for email security vendors. …

In this edition of Between Two Nerds Tom Uren and The Grugq talk about how the compromise of US telecommunications companies by Chinese hackers has very little to do with US government lawful intercept laws.

In this product demo Airlock Digital co-founders Daniel Schell and David Cottingham show Risky Business host Patrick Gray around the latest version of the company’s allowlisting software.

Airlock allows customers to control what executes in their environment. From applications to DLLs to scripts to Windows lolbins.

It is a terrific product that allows organisations to successfully implement allowlisting at massive scale. It is deployed in environments with 100,000+ endpoints.

Risky Business #777 – It’s SonicWall’s turn

Coming to you from the same room in Risky Business headquarters Patrick Gray and Adam Boileau discuss the week’s cybersecurity news. They talk through:

Sonicwall firewalls hand out remote code exec like candy Mastercard make a slapstick-grade mistake with their DNS The data breach at PowerSchool and other niche SaaS providers Academic research proposes taking down Europe’s power grid Apple CPUs get a new speculative execution side channel And much, much more.

This week’s episode is sponsored by Push Security, who make an identity security product that runs inside browsers. Luke Jennings joins to discuss some of the pitfalls of federated authentication, like attackers using unexpected identity providers to log in to your apps. …