Risky Business - Patrick Gray

Risky Business #679 -- A look at Uber's very bad week Sep 21, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

A look at how Uber got owned so hard
Why cleartext cookie storage in Microsoft Teams’ Electron-based app is actually a big deal
Russian official: Starlink is a legitimate military target
Wagner mercs get doxxed
Kiwi Farms having a bad time
Much, much more

In this week’s sponsor interview we’ll be chatting to Nucleus’s CEO Steve Carter about CISA’s KEV list. He has feelings about the KEV list – they’re mostly positive, but he also has a few reasonable gripes and he joins me to talk about them.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Biz Soap Box: Haroon Meer on "sensitive command tokens" Sep 15, 2022

In this edition of the Soap Box podcast Patrick Gray talks to Haroon Meer about Thinkst Canary’s new sensitive command token. It’s a great way to detect intruders on your Windows systems. Haroon also talks about how to use canaries strategically.

Show notes

Risky Business #678 -- Iranians Gone Wild Sep 14, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Albania suffers under another crippling Iranian attack
Iran’s APT42 using clever, multi-persona phishing
State Department cyber snitching program paying off
Former NSA director Gen. Keith Alexander sued over alleged IronNet pump and dump
Mudge fronts US Senate Judiciary Committee
Much, much more…

This week’s show is brought to you by Stairwell. Mike Wiacek, Stairwell’s founder and CEO is this week’s sponsor guest and he talks about why they’ve pushed their Inception platform beyond YARA hunting. You can see a demo of Inception on our YouTube product demo page.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Business #677 -- A day late and a dollar short: China doxxes NSA op Sep 07, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

China’s super spies figure out Rob Joyce ran TAO ops
FBI, French authorities fly to Montenegro to investigate ransomware attack
NEWSFLASH: Cloudflare are still a bunch of Nazi cuddlers
SIM swap drama spills into real world shootings, firebombings
Yandex Taxi hack clogs Moscow streets
The TikTok breach that wasn’t
Project Raven veterans get wings clipped
Why recent BGP hijacks are getting a bit concerning
Much, much more

This week’s show is brought to you by Corelight, the company that maintains Zeek. Corleight’s Federal CTO Jean Schaffer joins us in this week’s sponsor interview to talk about whether or not the White House’s executive order on Zero Trust is actually changing anything.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Business #676 -- Okta, Authy users among Twilio hack targets Aug 31, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

The Twilio breach was actually a big deal
How a Belarusian Cyber Partisans hack burned a GRU illegal
Who wants 25m hashed passwords from Russia?
An NFT we can get behind
How attackers are using game anti-cheat drivers to defeat EDR
Much, much more

This week’s sponsor interview is with Mike Benjamin, the VP of security research at Fastly. He pops in to argue that your red team needs to actually consider how your apps will cope with bot-driven attacks.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Business #675 -- The problem with Mudge's whistleblowing complaint Aug 24, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

A deep look at Mudge’s sensational whistleblower complaint against Twitter
Brazilian Federal Police raid Lapsus$ crew
NSO CEO to stand down (again), 100 staff to be let go
Signal users impacted in Twilio incident
Tornado Cash OFACs around and finds out
Much, much more

This week’s show is brought to you by Greynoise. Its founder, Andrew Morris, joins the show with a stinging critique of the wider threat intelligence industry. Don’t miss that one.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Biz Soap Box: Okta's Brett Winterford on session cookie theft and mitigations Aug 09, 2022

In this edition of the Soap Box podcast Okta’s APAC CISO and former Risky Biz editor Brett Winterford talks about how attackers are getting much better at swiping session cookies via realtime phishing and malware.

He also talks about some mitigation strategies to combat this threat and introduces the concept of continuous authentication.

Show notes

Defending against session hijacking

Risky Business #674 -- "Free money" exploit spawns $150m blockchain feeding frenzy Aug 03, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Taiwan tensions fail to conjure the cyber apocalypse
Crypto bridge exploit results in $150m feeding frenzy
Chainalysis evidence to be challenged in court
Post-quantum NIST candidate algorithm gets smoked
DSIRF’s Russia links
Much, much more

This week’s sponsor interview is with Jerrod Chong from Yubico. He’s joining the show to talk about why consumer-focussed implementations of Webauthn like Apple’s Passkeys aren’t a great enterprise solution.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Business #673 -- When throwing computers into a woodchipper is standard IR Jul 27, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Why Entrust being ransomwared is good news
UEFI bootkits turn hardware into landfill
Microsoft resumes macro blocking rollout
Pat and Adam talk about why plugging your IDP into legacy apps is a dreadful idea
Much, much more

This week’s sponsor guest is Paul “The Voice” Lanzi of Remediant. He’s popping along to talk about the emergence of a new product category – Identity Threat Detection and Response, or ITDR.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Business #672 -- "Expected behaviour" is in the eye of the beholder Jul 20, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

A look at the DHS Cyber Safety Review Board’s Log4j report
Joshua Schulte no longer the “alleged” Vault7 leaker
Chinese APT crews targeted US political journalists before Jan 6
Ransomware gangs make leak sites searchable
Why recovering plaintext passwords from Okta is expected behaviour
US Government seizes North Korean ransomware payment
Much, much more

This week’s show is brought to you by Trail of Bits. Dan Guido is this week’s sponsor guest and he’ll tell us about work Trail of Bits did for DARPA on investigating blockchain security fundamentals.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Business #671 -- The case for an American-owned NSO Group Jul 13, 2022

On this week’s show Patrick Gray and guest cohost Dmitri Alperovitch discuss the week’s security news, including:

Why an American defence contractor acquiring NSO Group would be a nonproliferation win
A look at Microsoft’s botched macro measures
iPhone’s Lockdown Mode
Ukraine goes big on Yubikeys
Aerojet Rocketdyne pays millions over poor security controls, CISO whistleblower gets bag of cash
Much, much more

This week’s show is sponsored by Proofpoint. Ryan Kalember, Proofpoint’s Executive Vice President of Cybersecurity Strategy, joins us in this week’s sponsor interview to talk about changes he’s observed in the criminal ecosystem.

NOTE: This podcast contains an error. We say that iOS Lockdown Mode prevents users from using an MDM profile on their devices. It doesn’t, it just stops new MDM profiles from being loaded while in Lockdown Mode, so corporate users will be able to turn it on just fine.

Links to everything that we discussed are below and you can follow Patrick or Dmitri on Twitter if that’s your thing.

Show notes

Risky Biz Soap Box: Running a global vulnerability management program Jul 11, 2022

Today’s soap box is brought to you by Nucleus Security.

Nucleus makes a platform that ingests vulnerability scan information from all your vuln scanning tech so that you can do things like assign different vulnerabilities to different teams to manage and remediate. Send these ones to infrastructure, send these ones to app teams, send everything up and down this stack to this department etc.

If you want to see Nucleus in action I have recorded a demo and it’s on our YouTube product demos page, I’ve linked through to it in the show notes for this podcast.

Our guest in this episode is Scott Kuffer, co-founder of Nucleus, and the topic is running a vulnerability management program in a very large enterprise.

Show notes

Nucleus Security Product Demo on Risky Biz YouTube Channel

Risky Business #670 -- China's world record data breach Jul 06, 2022

On this week’s show Patrick Gray and guest cohost Mark Piper discuss the week’s security news, including:

A billion records leaked in China
China to develop desktop operating system
HackerOne fires insider for stealing hackers’ work and bounties
FSB officer charged with stealing hacker’s bitcoin
Why Microsoft is wrong on Russia and Ukraine
Much, much more

Red Canary’s Adam Mashinchi and Brian Donohue will be along in this week’s sponsor interview to talk about Atomic Red Team, the open source adversary emulation framework they help to maintain.

Links to everything that we discussed are below and you can follow Patrick on Twitter if that’s your thing.

Show notes

Risky Business #669 -- Finally, an ICS attack that made stuff explode! Jun 29, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Activists who are totally not Israeli military hackers make Iranian steel mills firebally
Chinese APT crews use ransomware to muddy attribution
Attackers are now ransoming cloud access
Chinese APTs using building control systems for persistence and stealth
USA, UK and NZ govts issue PowerShell advice
Much, much more

This week’s show is brought to you by Material Security. JJ Agha, CISO at Compass, joins the show to talk about how he’s using it to make phishing triage and automation less traumatic.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Biz Soap Box: HD Moore on taking Rumble to the cloud Jun 26, 2022

Today’s Soap Box guest is an industry legend – Metasploit creator HD Moore. He’s here to tell us more about what’s happening with his latest creation, Rumble Network Discovery.

If you’re not familiar with Rumble, well, you should be. It’s a network scanner that you just set loose and it will go and find all the devices on your network. It has a freaky ability to see around corners, finding devices it can’t even connect to directly because HD and his team have done some really crazy work on pulling device information out of obscure protocol queries and things like that. It takes a few minutes to set up a scan with Rumble, so it’s infinitely easier than trying to do passive network discovery on the network or pull data from other solutions.

But Rumble isn’t just a network scanner anymore. They’ve been doing basic cloud asset inventory since the early days, but as you’ll hear it’s an area they’ve really been putting a lot of work into lately. Another big thing they’ve worked on is ICS and OT fingerprinting techniques that won’t actually cause those devices to command things to explode, so that’s nice.

Risky Business #668 -- Microsoft is hiding its Azure security problems Jun 22, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Paige Thompson guilty of Capital One hack
Microsoft is hiding serious Azure security issues
New Australian government lobbying for Julian Assange
How to ransomware documents in the cloud
Microsoft stops Windows 10/11 downloads in Russia
Belarusian cyber partisans obtain spy agency’s audio recordings
Much, much more

This week’s edition of the show is brought to you by Gigamon. Josh Day, Gigamon’s Director of applied threat research team, will be along in this week’s sponsor interview to talk about detecting badness on your network in encrypted traffic.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Business #667 -- "Shields Up" for cyber's forever war Jun 13, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

“Shields Up” advice is now provably meaningless
Russia to ditch offshore comms apps like WhatsApp
Evil Corp’s Lockbit sanctions evasion attempt backfires
Binance is a cesspit of shady financial dealings
Apple’s passkey release foreshadows FIDO mass adoption
Much, much more

This week’s sponsor interview is about Elastic’s teardown on some really interesting APT linux malware called BPFdoor. Jake King and Colson Wilhoit joined the show for that interview.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Business #666 -- The msdt RTF of DOOM May 31, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

The msdt/office lolbinapalooza
Microsoft to introduce sensible defaults to Azure
Twitter fined $150m for sms 2fa spam
It turns out npm got owned in that Heroku/Travis CI thing
AWS cred-stealing supply chain attack was research your honour, I swear!
Much, much more

We’ll be chatting with Airlock Digital co-founder and CTO Daniel Schell in this week’s sponsor interview. He’ll be walking us through some of his own research into how to own Microsoft boxes via document-embedded office add-ins.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

Risky Business -- #665 You can ransomware whole countries now May 25, 2022

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Conti’s war against Costa Rica
DoJ revises CFAA guidance
Naughty kids get access to DEA portal
A look at a Russian disinfo tool
PyPI and PHP supply chain drama
Much, much more

This week’s show is brought to you by Thinkst Canary. Its founder Haroon Meer will join us in this week’s sponsor interview to talk about what might happen to infosec programs now the world economy is getting all funky.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Show notes

SAMPLE PODCAST: Risky Biz News: FSB-linked DDoS tool could also be used for disinformation campaigns May 20, 2022

The following is a sample of our latest podcast, Risky Business News, which is published into a new RSS feed. It’s a short podcast published three times a week that updates listeners on the security news of the last few days, as prepared and presented by Catalin Cimpanu. You can find the newsletter version of this podcast here.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Risky Business – Patrick Gray

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Related Podcasts

Links

Stay Connected