Risky Business

Risky Business #798 -- Mexican cartel surveilled the FBI to identify, kill witnesses Jul 02, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

Australian airline Qantas looks like it got a Scattered Spider-ing
Microsoft works towards blunting the next CrowdStrike disaster
Changes are coming for Microsoft’s default enterprise app consenting setup
Synology downplays hardcoded passwords for its M365 cloud backup agent
The next Citrix Netscaler memory disclosure looks nasty
Drug cartels used technical surveillance to find, fix and finish FBI informants and witnesses

This week’s episode is sponsored by RAD Security. Co-founder Jimmy Mesta joins to talk through how they use AI automation to assess the security posture of sprawling cloud environments.

This episode is also available on Youtube.

Show notes

Risky Business #797 -- Stuxnet vs Massive Ordnance Penetrators Jun 25, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

We roll our eyes over the “16 billion credentials” leak hitting mainstream news
Some interesting cyber angles emerge from the conflict in Iran
Opensource maintainer of libxml2 is fed up with this hacker crap
Shockingly, there are yet more ways to trick people into pasting commands into Windows
Veeam “patches” its backup software RCE like it’s 2002 … by breaking the public PoC

This week’s episode is sponsored by Internet-wide honeypot reconnaissance platform, Greynoise. Founder Andrew Morris joins to talk about their journey spotting Chinese ORB-builders hacking thousands of ASUS routers, and why they’re destined for the woodchipper.

This episode is also available on Youtube.

Show notes

Risky Business #796 -- With special guest co-host Chris Krebs Jun 18, 2025

On this week’s show Patrick Gray and Adam Boileau are joined by special guest Chris Krebs to discuss the week’s cybersecurity news. They talk through:

Israeli “hacktivists” take out an Iranian state-owned bank
Scattered-spider and friends pivot into attacking insurers
Securing identities in a cloud-first world keeps us awake at night
Microsoft takes the “aas” out of SaaS for Europe, leaving us with just software!
An AI prompt injection into M365 exfils corporate data

This week’s episode is sponsored by Kroll’s Cyber practice. Kroll Cyber Associate Managing Director George Glass is based in London and talks through his experiences helping organisations in the UK deal with the Scattered Spider attacks.

This episode is also available on Youtube.

Show notes

Soap Box: AI has entered the SOC, and it ain't going anywhere Jun 16, 2025

In this sponsored Soap Box edition of the Risky Business podcast Patrick Gray chats with Dropzone AI founder Ed Wu about the role of LLMs in the SOC.

The debate about whether AI agents are going to wind up in the SOC is over, they’ve already arrived. But what are they good for? What are they NOT good for? And where else will we see AI popping up in security?

This episode is also available on Youtube.

Show notes

Risky Business #795 -- How The Com is hacking Salesforce tenants Jun 11, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

New York Times gets a little stolen Russian FSB data as a treat
iVerify spots possible evidence of iOS exploitation against the Harris-Walz campaign
Researcher figures out a trick to get Google account holders’ full names and phone numbers
Major US food distributor gets ransomwared
The Com’s social engineering of Salesforce app authorisations is a harbinger of our future problems
Australian Navy forgets New Zealand has computers, zaps Kiwis with their giant radar.

This week’s episode is sponsored by identity provider Okta. Long-time friend of the show Alex Tilley is Okta’s Global Threat Research Coordinator, and he joins to discuss how organisations can use both human and technical signals to spot North Koreans in their midst.

This episode is also available on Youtube.

Show notes

Risky Business #794 -- Psychic Panda outgunned by Fluffy Lizard and UNC56728242 Jun 04, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

Cyber firms agree to deconflict and cross-reference hacker group names
Russian nuclear facility blueprints gathered from public procurement websites
Someone audio deepfaked the White House Chief of Staff, but for the dumbest reasons
Germany identifies the Trickbot kingpin
Google spots China’s MSS using Calendar events for malware C2
Meta apps abuse localhost listeners to track web sessions.

This week’s episode is sponsored by automation vendor Tines. Its Field CISO, Matt Muller, joins the show to discuss an open letter penned by JP Morgan Chase’s CISO that pleads with Software as a Service suppliers to try to suck less at security.

This episode is also available on Youtube.

Show notes

Risky Business #793 -- Scattered Spider is hijacking MX records May 28, 2025

In this week’s edition of Risky Business Dmitri Alperovitch and Adam Boileau join Patrick Gray to talk through the week’s news, including:

EXCLUSIVE: A Scattered Spider-style crew is hijacking DNS MX entries and compromising enterprises within minutes
The SVG format brings the all horrors of HTML+JS to image files, and attackers have noticed
Brian Krebs eats a 6.3Tbps DDoS … ‘cause that’s how you demo your packet cannon
Law enforcement takes out Lumma Stealer, Qakbot, Danabot and some dark web drug traffickers
Iranian behind 2019 Baltimore ransomware mysteriously appears in North Carolina and pleads guilty
CISA’s leadership is fleeing in droves, even though the US needs them more than ever.

This week’s episode is sponsored by Thinkst Canary. Long time friend of the show Haroon Meer joins and talks through where he feels the industry is at, having just returned home from the AI-fueled hype at this year’s RSA conference.

This episode is also available on Youtube.

Show notes

Risky Business #792 -- Beware, Coinbase users. Crypto thieves are taking fingers now May 21, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

TeleMessage memory dumps show up on DDoSecrets
Coinbase contractor bribed to hand over user data
Telegram does seem to be actually cooperating with law enforcement
Britain’s legal aid service gets 15 years worth of applicant data stolen
Shocking no one, Ivanti were weaseling when they blamed latest bugs on a third party library

This week’s episode is sponsored by Prowler, who make an open source cloud security tool. Founder and original project developer Toni de la Fuente joins to talk through the flexibility that open tooling brings. Prowler is also adding support for SaaS platforms like M365, and of course, an AI assistant to help you write checks!

This episode is also available on Youtube.

Show notes

Risky Biz Soap Box: Push Security's browser-first twist on identity security May 16, 2025

In this wholly sponsored Soap Box edition of the show, Patrick Gray chats with Adam Bateman and Luke Jennings from Push Security.

Push has built an identity security platform that collects identity information and events from your users’ browsers. It can detect phish kits and shut down phishing attempts, protect SSO credentials, and find shadow/personal account that a user has spun up.

It’s extremely difficult to bypass. That’s because when you’re in the browser it doesn’t matter how a phishing link arrives, or how a threat actor has concealed it from your detection stack – if the user sees it, Push sees it.

There are solutions for protecting your users SSO credentials, like passkeys. But what about all the SaaS in your environment? Even if it’s enrolled into your SSO, are you sure that’s how your users are authenticating to it? What about the automation platforms your developers and admins use? What about data platforms like Snowflake? Are your using setting up passkeys for those accounts? How would you know, and what problems can it cause if those accounts are vulnerable?

This is a fun one!

This episode is also available on Youtube.

Show notes

Risky Business #791 -- Woof! Copilot for Sharepoint coughs up creds and keys May 14, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

Struggling to find that pesky passwords.xlsx in Sharepoint? Copilot has your back!
The ransomware ecosystem is finding life a bit tough lately
SAP Netweaver bug being used by Chinese APT crew
Academics keep just keep finding CPU side-channel attacks
And of course… bugs! Asus, Ivanti, Fortinet… and a Nissan LEAF?

This week’s episode is sponsored by Resourcely, who will soothe your Terraform pains. Founder and CEO Tracis McPeak joins to talk about how to get from a very red dashboard full of cloud problems to a workable future.

This episode is also available on Youtube.

Show notes

Wide World of Cyber: How state adversaries attack security vendors May 09, 2025

In this edition of the Wide World of Cyber podcast Patrick Gray talks to SentinelOne’s Steve Stone and Alex Stamos about how foreign adversaries are targeting security vendors, including them.

From North Korean IT workers to Chinese supply chain attacks, SentinelOne and its competitors are constantly fending off sophisticated hacking campaigns.

This edition of the Wide World of Cyber was recorded in front of a live audience in San Francisco, with Patrick attending via Zoom.

The Wide World of Cyber podcast series is a wholly sponsored co-production between SentinelOne and Risky Business Media.

This episode is also available on Youtube.

Show notes

Risky Business #790 -- Bye bye Signal-gate, hello TeleMessage-gate May 07, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

White House’s off-brand Israeli Signal fork logs cleartext messages with hard coded creds while getting hacked (twice). Just … Wow.
Ransomware attacks on UK retailers are linked, and Marks & Spencer has it extra bad
After six years dormant, a Magento eCommerce platform backdoor comes to life
The North Korean IT worker scam is truly webscale
NSO group owes Meta $168m for hacking WhatsApp

This week’s episode is sponsored by vulnerability management wranglers, Nucleus Security. Aaron Unterberger joins to talk through the complexities of tracking vulnerabilities in cloud components - left to the source, right to the deployments, and …sideways into the sidecars?

This week’s show also features an excerpt from Pat’s interview with Senator Mark Warner - Scoot back one in your podcast feed to check out the full chat, or find it on Youtube.

This episode is available on Youtube too.

Show notes

BONUS INTERVIEW: Senator Mark Warner on Signalgate, Volt Typhoon and tariffs May 06, 2025

In this extended interview the Vice Chair of the Senate Select Committee on Intelligence, Senator Mark Warner, joins Risky Business host Patrick Gray to talk about:

The latest developments in the Signalgate scandal
Why America needs to be more aggressive in responding to Volt Typhoon
How tariffs are affecting American alliances
Why the Five Eyes alliance is sacrosanct

This episode is available on Youtube

Show notes

Risky Business #789 -- Apple's AirPlay vulns are surprisingly awful Apr 30, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

British retail stalwart Marks & Spencer gets cybered
South Korean telco sets out to replace all its subscriber SIMs after (we assume) it lost the keymat
It’s a good exploit week! Bugs in Apple Airplay, SAP webservers, Erlang SSH and CommVault backups
Juice jacking! No, really! Some researchers actually did it (so still not in the wild, then)
Anti-DOGE whistleblower sure sounds like he has a point

This week’s episode is sponsored by Knocknoc, who let you glue your firewalls to your single sign on. Knocknoc’s CEO Adam Pointon talks about the joy that having end-to-end IPv6 would bring for zero-trust access control. He also touches on people using Knocknoc inside their network to isolate critical systems.

Editors Note : Pat also gives Adam (Boileau) stick in the sponsor interview about the Risky Biz webserver not having IPv6 enabled, which fact-checking during the edit says is FAKE NEWS. Just uh, don’t look at how fresh that AAAA record in the DNS is, friends 😉

This episode is also available on Youtube.

Show notes

Snake Oilers: LimaCharlie, Honeywell Cyber Insights, CobaltStrike and Outflank Apr 28, 2025

In this edition of the Snake Oilers podcast, three sponsors come along to pitch their products:

LimaCharlie: A public cloud for SecOps
Honeywell Cyber Insights: An OT security/discovery solution
Fortra’s CobaltStrike and Outflank: Security tooling for red teamers

This episode is also available on Youtube.

Show notes

Snake Oilers: Pangea, Cosive and Sysdig Apr 17, 2025

In this edition of Snake Oilers three vendors pitch host Patrick Gray on their tech:

Pangea: Guardrails and security for AI agents and applications (https://pangea.cloud)

Worried about your AI apps going rogue, being mean to your customers or even disclosing sensitive information? Pangea exists to address these risks. Fascinating stuff.

Cosive: A threat intelligence company that can host your MISP server in AWS. CloudMISP! (https://www.cosive.com/snakeoilers)

Are you running a MISP server on some old hardware under a desk in your SOC? There’s a better way! Cosive can run it for you on AWS so you can just use it instead of wrestling with maintaining it. They also do some CTI consulting to help you get better use out of MISP.

Sysdig: A Linux runtime security platform (https://sysdig.com/)

The modern Windows network is an all-singing, all-dancing, perfectly orchestrated, EDR-protected ballet. The modern Linux production environment… isn’t. Find out how Sysdig can help you get some visibility and control over your Linux fleet.

This episode is also available on Youtube.

Show notes

Risky Business #788 -- Trump targets Chris Krebs, SentinelOne Apr 16, 2025

On this week’s show Patrick Gray talks to former NSA Cybersecurity Director Rob Joyce about Donald Trump’s unprecedented, unwarranted and completely bonkers political persecution of Chris Krebs and his employer SentinelOne.

They also talk through the week’s cybersecurity news, covering:

Mitre’s stewardship of the CVE database gets its funding DOGE’d
The US signs on to the Pall Mall anti-spyware agreement
China tries to play the nationstate cyber-attribution game, but comedically badly
Hackers run their malware inside the Windows sandbox, for security against EDR

This week’s episode is sponsored by open source identity provider Authentik. CEO Fletcher Heisler joins to talk through the increasing sprawl of the identity ecosystem.

This episode is also available on Youtube.

Show notes

Wide World of Cyber: How the Trump admin is changing the cybersecurity landscape Apr 10, 2025

In this podcast, Patrick Gray chats with SentinelOne’s Chris Krebs and Alex Stamos about the huge changes afoot in the United States government and what they mean for the threat environment. From the director of NSA being fired to massive job cuts at CISA and huge foreign policy shifts, tomorrow’s threat environment is going to be very different to today’s. Tune in to hear analysis from two of the best in the business!

This episode is also available on Youtube.

Show notes

Risky Business #787 -- Trump fires NSA director, CISA cuts inbound Apr 09, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

Oracle quietly cops to being hacked, but immediately pivots into pretending it didn’t matter
NSA and CyberCom leaders fired for not being MAGA enough
US Treasury had some dusty corners it hadn’t found China in yet, looked, found China in them
…which is a great time to discuss slashing CISA’s staffing
Ransomware crews and bullet proof hosting providers are getting rekt, and we love it
And Microsoft patches yet another logging 0-day being used in the wild.

This episode is sponsored by Yubico, makers of Yubikey hardware authentication tokens. Yubico’s Vice President of Solutions Architecture and Alliances Derek Hanson joins to discuss how the consumer-centric passkey ecosystem has become a real challenge for enterprises. One that Yubico is actually ideally positioned to solve.

This episode is also available on Youtube.

Show notes

Risky Business #786 -- Oracle is lying Apr 02, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

Yes, Oracle Health and Oracle Cloud did get hacked
The fallout from Signalgate continues
North Korean IT workers pivot to Europe
Honeypot data suggests a storm is brewing for Palo Alto VPNs
Canadian Anon gets arrested for hacking Texas GOP

This week’s episode is sponsored by Trail of Bits. Tjaden Hess, a Principal Security Engineer at Trail of Bits who specialises in cryptography, joins the show this week to talk about what a responsible crypto-currency exchange cold wallet setup looks like, and … contrasts that with Bybit.

This episode is also available on Youtube.

Show notes

Soap Box: Knocknoc glues your SSO to your firewalls for Just-in-Time network access Mar 27, 2025

In this Soap Box edition of Risky Business host Patrick Gray talks to Knocknoc CEO Adam Pointon about how to easily rein in attack surface by glueing your single sign-on service to your network controls.

Do your Palo Alto and Fortinet devices really need to be discoverable by ransomware crews? Does your file transfer appliance need to be open to the whole world? What about your SSH and RDP? Your Citrix? Your (gasp) Exchange Online servers??

You can do a lot with IP allowlisting and simple Identity Aware Proxies (IAPs) to minimise your exposure.

Knocknoc is a bit of a “Risky Business special”, too. Pat helped Knocknoc to raise a seed round through Decibel Partners where he’s a founder advisor. He also serves on Knocknoc’s board of directors.

This episode is also available on Youtube.

Show notes

Risky Business #785 -- Signal-gate is actually as bad as it looks Mar 26, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

Yes, the Trump admin really did just add a journo to their Yemen-attack-planning Signal group
The Github actions hack is smaller than we thought, but was targeting crypto
Remote code exec in Kubernetes, ouch
Oracle denies its cloud got owned, but that sure does look like customer keymat
Taiwanese hardware maker Clevo packs its private keys into bios update zip
US Treasury un-sanctions Tornado Cash, party time in Pyongyang?

This week’s episode is sponsored by runZero. Long time hackerman HD Moore joins to talk about how network vulnerability scanning has atrophied, and what he’s doing to bring it back en vogue. Do you miss early 2000s Nessus? HD knows it, he’s got you fam.

This episode is also available on Youtube.

Show notes

Risky Business #784 -- GitHub supply chain attack steals secrets from 23k projects Mar 19, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

Github Actions supply chain attack loots keys and secrets from 23k projects
Why a VC fund now owns a minority stake in Risky Business Media (!?!?)
China doxes Taiwanese military hackers
Microsoft thinks .lnk file whitespace trick isn’t worth patching but APTs sure love it
CISA delivers government efficiency by re-hiring fired staff… to put them on paid leave
…and Google acquires Wiz for $32bn

This week’s show is sponsored by Zero Networks, and they have sent along a happy customer to talk about their experience. Aaron Steinke is Head of Infrastructure at La Trobe Financial, an asset management firm in Australia. Aaron talks through bringing modern zero-trust goodness to the reality of a technology environment that’s been around 40 years.

This episode is also available on Youtube.

Show notes

Risky Business #783 -- Evil webcam ransomwares entire Windows network Mar 12, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news with special guest Rob Joyce, a Former Special Assistant to the US President and Director of Cybersecurity for NSA.

They talk through:

A realistic bluetooth-proximity phishing attack against Passkeys
A very patient ransomware actor encrypts an entire enterprise with a puny linux webcam processor
The ESP32 backdoor that is neither a door nor at the back
The X DDoS that Elon said was Ukraine is claimed by pro-Palestinian hacktivists
Years later, LastPass hackers are still emptying crypto-wallets
…and it turns out North Korea nailed {Safe}Wallet with a malicious docker image. Nice!

Rob Joyce recently testified to the US House Select Committee on the Chinese Communist Party, and he explains why DOGE kicking probationary employees to the curb is “devastating” for the national security staff pipeline.

This week’s episode is sponsored by SpecterOps, makers of the BloodHound identity attack path mapping tool. Chief Product Officer Justin Kohler and Principal Security Researcher Lee Chagolla-Christensen discuss their pragmatic approach to disabling NTLM authentication in Active Directory using BloodHound’s insight.

This episode is also available on Youtube.

Show notes

Risky Business #782 -- Are the USA and Russia cyber friends now? Mar 05, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

Did the US decide to stop caring about Russian cyber, or not?
Adam stans hard for North Korea’s massive ByBit crypto-theft
Cellebrite firing Serbia is an example of the system working
Starlink keeps scam compounds in Myanmar running
Biggest DDoS botnet yet pushes over 6Tbps

This week’s episode is sponsored by network visibility company Corelight. Vincent Stoffer, field CTO at Corelight joins to talk through where eyes on your network can spot attackers like Salt and Volt Typhoon.

This episode is also available on Youtube.

Show notes

Risky Business #781 -- How Bybit oopsied $1.4bn Feb 26, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

North Korea pulls off a 1.5 billion dollar crypto heist
Apple pulls Advanced Data Protection from the UK
Black Basta ransomware gang’s internal chats leak
Russians snoop on Signal with QR codes
And Myanmar ships thousands of freed scam compound workers to Thailand

Regular guest Lina Lau joins to discuss her work reading Chinese incident response reports on WeChat, and how that has people thinking that … she outed the NSA?

This week’s episode is sponsored by Airlock Digital, and allow-listing tragics Daniel Schell and David Cottingham are along with an amusing tale of using Windows’ own allow-listing software to block EDR from loading.

This episode is also available on Youtube.

Show notes

Wide World of Cyber: DeepSeek lobs an AI hand grenade Feb 21, 2025

In this episode of the Wide World of Cyber podcast Risky Business host Patrick Gray chats with SentinelOne’s Chris Krebs and Alex Stamos about AI, DeepSeek, and regulation.

From its bad transport security to its Chinese ownership and the economic implications of China “entering the chat”, everyone’s freaking out over this new model. But should they be?

Pat, Alex and Chris dissect the model’s significance, the politics of it all and how AI regulation in Europe, the US and China will shape the future of LLMs.

This episode is also available on Youtube.

Show notes

Risky Business #780 -- ASD torched Zservers data while admins were drunk Feb 19, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

Australian spooks scrubbed Medibank data off Zservers bulletproof hosting
Why device code phishing is the latest trick in confusing poor users about cloud authentication
Cloudflare gets blocked in Spain, but only on weekends and because of… football?
Palo Alto has yet another dumb bug
Adam gushes about Qualys’ latest OpenSSH vulns

Enterprise browser maker Island is this week’s sponsor and Chief Customer Officer Bradon Rogers joins the show to talk about how the adoption of AI everywhere is causing headaches.

This episode is also available on Youtube.

Show notes

Risky Biz Soap Box: Run your own open source IDP with Authentik Feb 14, 2025

In this SoapBox edition of the show Patrick Gray chats to Fletcher Heisler, the CEO of open-source identity provider Authentik.

The whole idea of Authentik is you can take control of an essential IT and security function: identity. Because Authentik is open source it’s extremely flexible, and if you’re running it yourself, you get to decide where your IDP should sit in your architecture. You can run it on prem if you’re an emergency call centre or you’re operating an airgapped network, or you can spin it up in your cloud environment if you’re a typical enterprise.

Fletcher talks through the reasons Authentik users are decoupling themselves from the major SaaS Identity Providers, and the flexibility that comes from being able to assemble exactly what you need.

This episode is also available on Youtube.

Show notes

Risky Business #779 -- DOGE staffer linked to The Com Feb 12, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

Musk’s DOGE kid has a history with The Com
Paragon fires Italy as a spyware customer
Thailand cuts power to scam compounds…
… and arrests Phobos/8Base Russian cybercrims
The CyberCX DFIR report shows non-U2F MFA is well and truly over
And much, much more.

This week’s episode is sponsored by Dropzone.AI. They make an AI SOC analysis platform that relieves your analysts of the necessary but tedious work, so they can focus on the value of human insight. Dropzone’s founder and CEO Edward Wu joins to talk about how they approach the problem.

This episode is also available on Youtube.

Show notes

Risky Business #778 -- Musk's child soldiers seize control of FedGov IT systems Feb 05, 2025

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

DeepSeek leaves an unauthed database on the internet
Russia hacked UK prime minister’s personal mail
Australia sanctions a Telegram group… which is more sensible than it sounds
Medical device backdoor turns out to be just poorly thought out upgrade feature
Google abuses weak hashing to patch AMD CPU microcode
And much, much more.

This week’s episode is sponsored by email security boffins Sublime. Their co-founder and CEO Josh Kamdjou joins to talk about how attackers’ abuse of legitimate services like Docusign is a challenge for email security vendors.

This episode is also available on Youtube.

Show notes

Risky Business #777 -- It's SonicWall's turn Jan 29, 2025

Coming to you from the same room in Risky Business headquarters Patrick Gray and Adam Boileau discuss the week’s cybersecurity news. They talk through:

Sonicwall firewalls hand out remote code exec like candy
Mastercard make a slapstick-grade mistake with their DNS
The data breach at PowerSchool and other niche SaaS providers
Academic research proposes taking down Europe’s power grid
Apple CPUs get a new speculative execution side channel
And much, much more.

This week’s episode is sponsored by Push Security, who make an identity security product that runs inside browsers. Luke Jennings joins to discuss some of the pitfalls of federated authentication, like attackers using unexpected identity providers to log in to your apps.

This episode is also available on Youtube.

Show notes

Risky Business #776 -- Trump will flex American cyber muscles Jan 22, 2025

Risky Business returns for its 19th year! Patrick Gray and Adam Boileau discuss the week’s cybersecurity news and there is a whole bunch of it. They discuss:

The incoming Trump administration guts the CSRB
Biden’s last cyber Executive Order has sensible things in it
China’s breach of the US Treasury gets our reluctant admiration
Ross Ulbricht - the Dread Pirate Roberts of Silk Road fame - gets his Trump pardon
New year, same shameful comedy Forti- and Ivanti- bugs
US soldier behind the Snowflake hacks faces charges after a solid Krebs-ing
And much, much (much! after a month off) more.

This week’s episode is sponsored by Sandfly Security, who make a Linux EDR solution. Founder Craig Rowland joins to talk about how the Linux ecosystem struggles with its lack of standardised approaches to detection and response. If you’ve got a telco full of unix, and people are asking how much Salt Typhoon you’ve got in there… Sandfly’s tools are probably what you’re looking for.

If you like your Business like us… - Risky - then we’re hiring! We’re looking for someone to help with audio and video production for our work, manage our socials, and if you’re also into the Cybers… even better. Position is remote, with a preference for timezones amenable to Australia/NZ. Drop us a line: editorial at risky.biz.

This episode is also available on Youtube.

Show notes

Risky Biz Soap Box: Cool compliance tricks with the Island enterprise browser Dec 20, 2024

In this sponsored Soap Box edition of the show Patrick Gray talks to Island CEO Michael Fey about some of the cool tricks in the Island enterprise browser. You can use it to tick off so many compliance boxes, and not just cybersecurity boxes.

This is largely a conversation about compliance, but it’s actually interesting and fun. These are words we never thought we’d type!

You can find Island at https://island.io/

This episode is also available on Youtube.

Show notes

Risky Business #775 -- Cl0p is back, SEC hack disclosures disappoint Dec 18, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

The SEC’s cyber incident reporting isn’t very exciting after all
China Telecom on the way to being thrown out of the US
The NSA/Cybercom might get two separate hats
The Cl0p ransomware crew are back and taking responsibility for the Cleo hacks
(Yet another) File upload bug in Struts makes Java admins weep
And much, much more.

This episode is sponsored by SpecterOps, who run a pretty top notch offsec/pentest team when they’re not busy making the Bloodhound Enterprise identity attack path enumeration software. SpecterOps’ Robby Winchester joins to talk about how pentest has changed, and how their customers get value from their testing.

This episode is also available Youtube.

Show notes

Wide World of Cyber: SentinelOne's Chris Krebs on Chinese cyber operations Dec 13, 2024

In this edition of the Wild World of Cyber podcast Patrick Gray sits down with SentinelOne’s Chief Intelligence and Public Policy Officer Chris Krebs to talk all about Chinese cyber operations.

They look at the Salt Typhoon and Volt Typhoon campaigns, the last 20 years of Chinese operations, and the evolution of the cyber roles of China’s Ministry of State Security and People’s Liberation Army.

It’s a very dense hour of conversation!

This podcast was recorded in front of an audience at the Museum of Contemporary Art in Sydney.

This episode is also available on Youtube.

Show notes

Risky Business #774 -- Cleo file transfer appliances under widespread attack Dec 11, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

Cleo file transfer products have a remote code exec, here we go again!
Snowflake phases out password-based auth
Chinese Sophos-exploit-dev company gets sanctioned
Romania’s election gets rolled back after Tiktok changed the outcome
AMD’s encrypted VM tech bamboozled by RAM with one extra address bit
Some cool OpenWRT research
And much, much more.

This week’s episode is sponsored by Thinkst, who love sneaky canary token traps. Jacob Torrey previews an upcoming Blackhat talk filled with interesting operating system tricks you can use to trigger canaries in your environment. You wont believe the third trick! Attackers hate him!

This episode is also available on Youtube.

Show notes

Risky Biz Soapbox: Enterprise Yubikeys can now be pre-registered Dec 09, 2024

In this interview Patrick Gray talks to Yubico’s COO and President Jerrod Chong about a new Yubikey feature: pre-registration.

You can now ship pre-registered Yubikeys to your staff so you don’t need to rely on your staff to enrol them. They’ve achieved this with really slick Okta and Entra ID integrations.

Jerrod also talks about a recent trip to Singapore and concerns he has about the cybersecurity of critical infrastructure in the energy sector.

Risky Business #773 -- Cybercriminals are dropping like flies in Russia Dec 04, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

The FTC decides its time to take another look at Microsoft
Exxon’s opponents targeted by hackers
Russian hackers keep getting sentenced and it confuses us
The Feds recommend Signal, because throwing hackers out of telcos ain’t gonna happen
A South Korean set-top-box manufacturer shipped a DDoS client for corpo-combat
And much, much more.

This week’s sponsor interview with Vijit Nair from Corelight. We talk to him about doing detection in cloud environments, and how the varied nature of cloud systems makes the old ways - network monitoring - useful in new and interesting ways.

If you’re in Sydney, Pat is recording a live episode of the Wide World of Cyber with Chris Krebs on 5 December. There might still be tickets left!

This episode is also available on Youtube.

Show notes

Risky Business #772 -- Salt Typhoon is truly a national security disaster Nov 27, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

A ransomware attack has crippled US supply chain software provider Blue Yonder
Russian spies hack nearby wifi to get to their targets, but that doesn’t seem surprising?
Salt Typhoon’s attacks on telcos are hard to solve and big on impact
China’s surveillance state workers sell their access at home
Palo Alto is bad and should feel bad
And much, much more.

In this week’s sponsor interview Patrick Gray chats with Matt Muller from Tines about Gartner’s “spicy take” that the SOAR category is dead. SOAR is dead! Long live SOAR!

This episode is also available on Youtube.

Show notes

Risky Business #771 -- Palo Alto's firewall 0days are very, very stupid Nov 20, 2024

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

Microsoft introduces some sensible sounding post-Crowdstrike changes
Palo Alto patches hella-stupid bugs in its firewall management webapp
CISA head Jen Easterly to depart as Trump arrives
AI grandma tarpits phone scammers in family-tech-support hell
Academic research supports your gut-reaction; phishing training doesn’t work
And much, much more.

This week’s episode is sponsored by Greynoise. The always excitable Andrew Morris joins to remind us that the edge-device vulnerabilities Pat and Adam complain about on the show are in fact actually even worse than we make them out to be. Andrew also tells us about a zero-day Greynoise’ AI system truffle-pigged out of their data set.

This episode is also available on Youtube.

Show notes

Risky Business #770 -- A Russian IR guy discovers extremely cool spookware Nov 13, 2024

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

Apple frustrates law enforcement with iOS auto-reboot
CISA says most KEV vulnerabilities in 2023 were first used as zero days
Russians roll incident response on some sweet Linux spookware
Regular users can create mailboxes in M365?
Tor tracks down the source of its joe-job abuse complaints
And much, much more.

This week’s feature guest is former FBI agent Chris Tarbell, who arrested Silk Road operator Ross Ulbricht way back in 2013. As suggestions swirl that an incoming Trump administration might release Ulbricht, Chris talks about the reality of the Dread Pirate Roberts.

This episode is sponsored by software supply chain security firm Socket.dev. Founder Feross Aboukhadijeh thinks that we need a CVE-like catalogue for supply-chain attacks, and he makes a solid argument.

The show is also available on Youtube.

Show notes

Risky Biz Soap Box: Why black box email security is dead Nov 11, 2024

In this edition of the Risky Business Soap Box we’re talking all about email security with Sublime Security co-founder Josh Kamdjou.

Email security is one of the oldest product categories in security, but as you’ll hear, Josh thinks the incumbents are just doing it wrong. He joins Risky Business host Patrick Gray for this interview about Sublime’s origin story and its new approach to email security.

Risky Business #769 -- Sophos drops implants on Chinese exploit devs Nov 06, 2024

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

Sophos drops implants on Chinese firewall exploit devs
Microsoft workshops better just-in-time Windows admin privileges
Snowflake hacker arrested in Canada
Okta has a fun, but not very impactful auth-bypass bug
Russians bring dumb-but-smart RDP client attacks
And much, much more.

Special guest Sophos CISO Ross McKerchar joined us to talk about its “hacking back” campaign. The full interview is available on Youtube for those who want to really live vicariously through Sophos doing what every vendor probably wants to do.

This week’s episode is sponsored by attack surface mapping vendor runZero. Founder and CEO HD Moore joins to talk about marrying up the outside and inside views of your network.

You can also watch this episode on Youtube

Show notes

Risky Business #768 -- CSRB will investigate China's Wiretap Hacks Oct 30, 2024

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

CSRB to investigate China’s telco-wiretapping hacks
Euro law enforcement takes down the Redline infostealer
Someone steals Fed crypto… and then tries to quietly sneak it back in
Russia sentences REvil guys to … jail? Really?
Apple private cloud compute gets a proper bug bounty program
And much, much more.

This week’s episode is sponsored by Material Security, who help navigate the mess of cloud productivity data security. Daniel Ayala - Chief Security and Trust Officer at Dotmatics - is a Material customer, and joins Pat and Material Security’s Rajan Kapoor to talk about how to wrangle securing data that ends up in corporate cloud email and file stores.

This episode is also available on Youtube.

Show notes

Risky Biz Soap Box: Thinkst Canary's decade of deception Oct 28, 2024

In this Soap Box edition of the podcast Patrick Gray chats with Thinkst Canary founder Haroon Meer about his “decade of deception”, including:

A history of Thinkst Canary including a recap of what they actually do
A look at why they’re still really the only major player in the deception game
A look at what companies like Microsoft are doing with deception
Why security startups should have conference booths

Risky Business #767 – SEC fines Check Point, Mimecast, Avaya and Unisys over hacks Oct 23, 2024

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

SEC fines tech firms for downplaying the Solarwinds hacks
Anonymous Sudan still looks and quacks like a Russian duck
Apple proposes max 10 day TLS certificate life
Oopsie! Microsoft loses a bunch of cloud logs
Veeam and Fortinet are bad and should feel bad
North Koreans are good (at hacking)
And much, much more.

This week’s episode is sponsored by Proofpoint. Chief Strategy Officer Ryan Kalember joins to talk about their work keeping up with prolific threat actor SocGholish.

This episode is also available on Youtube.

Show notes

Risky Business #766 – China hacks America's lawful intercept systems Oct 16, 2024

On this week’s show Patrick Gray and Adam Boileau discuss the week’s infosec news, including:

Chinese spooks all up in western telco lawful intercept
Jerks ruin the Internet Archive’s day
Microsoft drops a great report with a bad chart
The feds make their own crypto currency and get it pumped
Forti-, Palo- and Ivanti-fail
And much, much more.

This week’s episode is sponsored by detection-as-code vendor Panther. Casey Hill, Panther’s Director Product Management joins to discuss why the old “just bung it all in a data lake and… ???… “ approach hasn’t worked out, and what smart teams do to handle their logs.

This episode is also available on [Youtube].(https://youtu.be/86zy6DcwtbE)

Show notes

Snake Oilers: Sandfly Security, Permiso and Wiz Oct 02, 2024

In this edition of Snake Oilers we hear pitches from three security vendors:

Sandfly Security: An agentless Linux security platform that actually sounds very cool
Permiso: An identity security platform founded by ex FireEye folks
Wiz: The cloud security giant is getting in on code security scanning

You can watch this edition of Snake Oilers on YouTube here.

Risky Business #765 -- The Kaspersky switcheroo Sep 25, 2024

Patrick Gray and Adam Boileau discuss the week’s infosec news with everyone’s favourite ex-NSA big-brain, Rob Joyce. They talk through:

Musk and Durov bow to government pressure
Tiktok rushes to ban authoritarian propagandists
The US doesn’t want Chinese software in its cars
Kaspersky replaces itself with an AV no one has ever heard of
Aussie police chalk up another crimephone takedown
Press Win-R Ctrl-V to prove you’re human
And much, much more.

This week’s show is brought to you by Stairwell, and Stairwell’s founder Mike Wiacek will be along to talk about how people are using their platform to hunt down detection resistant malware.

A video version of this episode is also available on Youtube.

Show notes

Risky Business #764 -- Mossad expands into telecommunications services Sep 18, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:

Hezbollah’s attempts to avoid SIGINT with pagers ends in explosions
The US shines many bright lights on RT’s disinfo role
Australia counters Chinese bullying in the Pacific
Valid accounts are the most prevalent entry point, says CISA’s data
Ivanti and Fortinet vie for worst vendor of the week
Krebs writes up the shift towards charging The Com with terrorism
And much, much more…

This week’s episode is sponsored by Push Security, who bring security visibility to where it needs to be these days – the browser. Luke Jennings joins this week’s show to discuss how phish-kit crews are driving the arms race forward, and how detection has to adapt and go where the users are.

This episode is also available on Youtube.

Show notes

Risky Business #763 – Microsoft un-patches critical bug Sep 11, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:

Russia’s disinformation peddlers face multifaceted sternness from the DoJ
Telegram is now law enforcement’s bestest new pal, all of a sudden
Iran’s banking industry arranges a payment plan for a ransom
Columbia investigates how it sent private jets full of cash to pay for Pegasus
Microsoft innovates with Un-Patch Tuesday
And much, much more.

This week’s sponsor is Kroll Cyber, and one of their incident responders Paul Wells joins to discuss that one weird trick that actually helps - preparing for an incident before hand, rather than learning all those hard lessons in the middle of a crisis.

This week’s episode is also available on Youtube.

Show notes

Snake Oilers: Authentik, Dropzone and SlashID Sep 06, 2024

In this edition of Snake Oilers Patrick Gray gets pitches from three cybersecurity companies:

Authentik, an open source identity provider that a lot of large organisations are deploying on prem as an alternative to cloud-based IDPs
Dropzone AI, an LLM-based agent that can do the work of a Tier 1 SOC analyst
SlashID, an identity security company that can crunch your logs to find attackers

You can watch this edition of Snake Oilers on YouTube here.

Show notes

Risky Business #762 -- Brazil nukes X, Iranian APTs deploy ransomware Sep 04, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:

Brazil’s supreme court bans X-formerly-Twitter,
Iranian cyber teams cooperate with ransomware crews
While North Koreans wield chrome-windows 0-day
Yubikey cloning attack is impressive, but doesn’t have us binning our keys quite yet
The White House is coming for your unsigned BGP announcements
And much, much more.

This week’s episode is sponsored by Okta, and specifically their Identity Security Posture Management product. Okta recently acquired Spera Security, and co-founder Ariel Kadyshevitch joins to talk through the messy reality of modern identity. Pat even gets the giggles at how terrible everything is!

You can also watch this episode on Youtube.

Show notes

Risky Business #761 – Telegram v frogs. Fight! Aug 28, 2024

On this week’s show, Patrick Gray and Adam Boileau discusses the week’s security news, including:

Telegram founder’s arrest in France
Volt Typhoon 0days some SD-WAN gear
Russia frets about Ukraine all up in Kursk’s webcams
Cybercriminals social engineer payment card NFC relay attacks in the wild
The slow burn of Active Directory name collisions
And much, much more.

This week’s episode is sponsored by Nucleus Security. Aaron Unterberger joins to discuss how vulnerability management starts out easy, but gets serious very quickly.

You can also watch this week’s show on Youtube.

Show notes

Feature interview: ASIO Director General Mike Burgess on encryption and access Aug 26, 2024

Mike Burgess is the director general of ASIO. But the thing about Mike is he’s actually a cybersecurity guy. He joined ASD, Australia’s NSA, back in 1995 when it was still the Defence Signals Directorate. He was there for 18 years before he bounced out to the private sector for a while to work as the CISO for Australia’s largest telco, Telstra. In 2017 he returned to ASD to run it, and in 2019 he was appointed director general of ASIO.

Back in April, Burgess made a series of comments on the topic of encrypted messaging during a Press Club speech in Canberra. Our right to privacy, he said, is not absolute, and he implied that if certain providers didn’t start helping Australian authorities out a little more, he’d use some of the provisions in Australia’s Assistance and Access bill to force them to provide access to certain content.

So I reached out to organise this interview to get some more detail from him about exactly what sort of cooperation he’s seeking and why.

Risky Business #760 – Microsoft to make MFA mandatory Aug 21, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news including:

Microsoft did a good thing! Soon all Azure admins will require MFA
The three billion row National Public Data breach mess, courtesy Florida Man
US govt confirms that it was Iran that hacked the Trump campaign
Is TP-Link the next Huawei, or just not very good at computers?
Major Chinese RFID card maker has hardcoded backdoors
And much, much more.

This week’s episode is sponsored by Specter Ops, makers of Bloodhound Enterprise. VP of Products Justin Kohler joins to talk about how they’ve joined their on-prem AD and cloud Entra attack path graphs, so you can map out that juicy, real-world attack surface.

Show notes

Wide World of Cyber: 2024 election interference, the media and Iran's hack and leak Aug 19, 2024

In this conversation Risky Business host Patrick Gray speaks with SentinelOne’s Chris Krebs and Alex Stamos about what sort of cyber enabled interference we can expect in the 2024 US presidential race.

Alex was the CISO at Facebook during the 2016 election, and Chris Krebs was responsible for US election security as the director of CISA in 2020.

Watch the video version of this episode on Youtube.

Risky Business #759 – Why Iran's hack and leak will amount to naught Aug 14, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news and recap the best research presented at Black Hat and DEF CON in Las Vegas last week. They cover:

Iran tries an election hack’n’leak like its still 2016
Crowdstrike takes home the Pwnie for Epic Fail at DEF CON
UK healthcare SaaS faces six million pound fine for lack of MFA
US circuit courts disagree on geofence warrants
Our roundup of juicy Blackhat/DEF CON research
And much, much more.

This week’s episode is sponsored by Trail of Bits. CEO Dan Guido is fresh back from the DARPA AI Cyber Challenge at DEF CON, where the Trail of Bits team moved through into the finals. Dan talks through the challenge of finding, reporting and fixing bugs with AI systems.

You can also watch this week’s show on Youtube.

Show notes

Soap Box: Making security tech more people friendly Aug 12, 2024

In this sponsored Soap Box edition of the show we talk to Proofpoint’s Chief Strategy Officer Ryan Kalember about making security tech more people centric.

We often talk about how we can use signals from users to drive some of our security tech. But what about using our security tech to drive user behaviour?

Ryan thinks there are some opportunities here, particularly around identity security.

Risky Business #758 – Crowdstrike's postmortem underwhelms Aug 07, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:

Crowdstrike talks loud in its postmortem, but says very little
Digicert fears the CA-Browser Forum, gets lawsuit from a customer
Dmitri Alperovitch joins the show to talk about the Russian prisoner swap
Cloudflare continues to harbour scum and villainy
Professional ransomware crew … is an improvement?
And much, much more.

This week’s episode is sponsored by Thinkst Canary. Marko Slaviero joins to discuss the unfashionable choice they made in hosting their platform one-VM-per-customer.

Show notes

Risky Business #757 – The ClownStrike cleanup continues Jul 31, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:

The insurance industry’s reaction to CrowdStrike’s mess
Google’s Workspace email validation flaw and its consequences for OAuth’d applications
Is the VMWare ESX group membership feature a CVE or an FYI?
Secureboot continues to under-deliver
North Korea’s revenue neutral intelligence services
And much, much more

This episode is sponsored by allowlisting software vendor Airlock Digital. Airlock uses a kernel driver on Windows, so Chief Executive David Cottingham joined to discuss what the CrowdStrike kernel driver bug drama means for security vendors.

This episode is also available on Youtube. If you want to ruin the magic of radio and see the faces behind the show, well, now you can!

Show notes

Wide World of Cyber: Why we should show CrowdStrike no mercy Jul 30, 2024

In this episode of Wide World of Cyber, Risky Business host Patrick Gray discusses the recent CrowdStrike incident and its implications for security software that operates in kernel space with Chris Krebs and Alex Stamos of SentinelOne, a CrowdStrike Competitor. The conversation also delves into Microsoft’s role in this whole disaster and the potential changes it could make to its operating system to prevent similar incidents in the future.

A video version of this episode is also available on Youtube!

Risky Business #756 -- Move fast and break everything Jul 24, 2024

The Risky Biz main show returns from a break to the traditional internet-melting mess that happens whenever Patrick Gray takes a holiday. Pat and Adam Boileau talk through the week’s security news, including:

Oh Crowdstrike, no, oh no, honey, no
AT&T stored call records on Snowflake and you’ll never guess what happened next
Squarespace buys Google Domains and makes a hash of it
Some but not all of the SECs case against Solarwinds gets thrown out
Pity the incident responders digging through a terabyte of Disney Slack dumps
Internet Explorer rises from the grave, and it wants SHELLS RAAAAARGH SSHHEEELLLS
And much, much more.

This week’s show is brought to you by Sublime Security, a flexible and modern email security platform. If you’re sick of using a black box email security solution, Sublime is a terrific option for you.

Show notes

Risky Biz Soap Box: Mike Wiacek on lazy mode threat hunting Jul 17, 2024

This Soap Box edition of the show is with Mike Wiacek, the CEO and Founder of Stairwell.

Stairwell is a platform that creates something similar to an NDR, but for file analysis instead of network traffic. The idea is you get a copy of every unique file in your environment to the Stairwell platform, via a file forwarding agent. You get an inventory that lists where these files exist in your environment, at what times, and from there you can start doing analysis.

If you find a dodgy file you can do all the usual malware analysis type stuff, but you can also do things like immediately find out where else that file is in your organisation, or even where else it was. From there you can identify other files that are similar – variants of those files – and search for those. And you can unpack all this very, very quickly.

This is the type of tool that EDR companies use internally to do threat hunting, but it’s just for you and your org – you can drive it. And as you’ll hear, the idea of a transparent, customisable and programmable security stack is something that’s on-trend at the moment. Mike lays out the case that doing this sort of file analysis in your organisation makes a whole lot of sense.

Wide World of Cyber: State directed cybercrime Jul 10, 2024

In this podcast Alex Stamos, Chris Krebs and Patrick Gray discuss the relationship between cybercrime and the state, which is often more complicated than it should be.

While the US Government and its allies fight the scourge of ransomware, other governments are using it to either raise revenue or irritate their foes. North Korea sees ransomware as a money spinner, while the Kremlin enjoys poking the west in the eye with it.

Join us for a breakdown of the relationships between governments who should know better and the worst types of people on the planet.

Risky Business #755 -- SSH 0day! Polyfill drama! Entrust crushed! Jul 03, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:

Widely used polyfill javascript gets hijacked by its new owners
MacOS supply chain disaster bullet dodged
That OpenSSH remote code exec OH MY <3
Entrust gets its CA business kicked to the kerb by Google
South Korean telco intentionally viruses 600k customers
Microsoft continues to deeply underwhelm
And much, much more.

This week’s episode is sponsored by Greynoise. Founder Andrew Morris joins to talk about ways to track attackers across NAT and VPNs, as well as how you can join in the fun of running an internet-scale honeypot network.

Show notes

Risky Biz Soap Box: Why AI shouldn't really change your security controls Jun 28, 2024

This is a sponsored Soap Box edition of the Risky Business podcast.

Abhishek Agrawal is the CEO and co-founder of Material Security, an email security company that locks down cloud email archives. Attackers have been raiding mailspools since hacking has existed, and with those mailspools now in the cloud with services like o365 and Google Workspace, guess where the attackers are going?

Material built a product that helps you lock up your email data, to archive and redact sensitive information. The idea is to really just limit what an attacker can do with email data if they pop an account.

Abhishek joined me to talk about a few things, like how non phishing resistant MFA is basically dead, how email content is very useful to security programs, and about how the gen AI won’t really change much on the defensive control side.

Risky Business #754 -- Assange pleads guilty to espionage, walks free Jun 26, 2024

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:

Julian Assange finally cuts a deal, pleads guilty, and goes free
USA to ban Kaspersky - even updates
Car dealer SaaS provider CDK contemplates paying a ransom
Intolerable healthcare ransomware attacks continue
We revisit Windows proximity bugs via wifi and bluetooth
And much, much more.

This week’s episode is sponsored by enterprise browser maker Island. Crowdstrike co-founder Dmitri Alperovitch is an investor in Island, and joins on its behalf to discuss why an enterprise browser is really starting to make sense.

Show notes

Risky Business #753 – Congress and vuln researchers maul Microsoft Jun 19, 2024

On this week’s retreat special, the entire Risky Business team is together in a tropical paradise for the first time. The team takes a break from the infinity pool to discuss the week’s security news:

Microsoft recalls Recall, but why did it have to be such a mess
And a Windows kernel wifi code-exec, really?
Passkeys and identity are hard
Scattered Spider bigwig arrested in Spain
The pentagon runs a deeply flawed info-op
Is it time E2E crypto nerds accept their place in the world?
And much, much more.

This week’s show is brought to you by Corelight… Corelight’s CEO Brian Dye will be along in this week’s sponsor interview to make a really compelling case for something that shouldn’t exist… which is NDR in cloud environments.

Show notes

Risky Business #752 -- Apple announcements thrill and terrify at the same time Jun 12, 2024

On this week’s show Patrick Gray and Adam Boileau are joined by long-time NSA boffin Rob Joyce. Now Rob’s left the government service, he’s hobnobbing with us pundits, talking through the week’s news:

Apple announces a big leap for confidential cloud computing into the mass market
While at the same time, letting you just mosey around your iPhone from your Mac
Mandiant reports in about the Snowflake breach
Moody’s say credit ratings might consider cyber incidents
Microsoft fixes an Azure flaw with a… “comprehensive documentation update”
And much, much more.

This week’s show is sponsored by Yubico, maker of the Yubikey hardware authentication token. Jerrod Chong, Yubico’s COO and President joins to talk about the challenges of the passkey and hardware authenticator ecosystem.

Show notes

Risky Business #751 -- Snowflake, operation Endgame and Microsoft's looming FTC problem Jun 05, 2024

On this week’s show Patrick Gray and Mark Piper discuss the week’s security news, including:

What on earth happened at Snowflake?
A look at operation Endgame
Check Point’s hilarious adventures with dot dot slash
Report says the FTC is looking at Microsoft’s security product bundling
More ransomware hits Russia
Much, much more

404 Media co-founder Joseph Cox is this week’s feature guest. He joins us to talk about his new book, Dark Wire, which is all about the FBI’s Anom sting.

This week’s show is brought to you by Resourcely. If your Terraform is a mess or your CSPM dashboards are lighting up with insane and stupid things, you should check out Resourcely. Its founder and CEO Travis McPeak will be along in this week’s sponsor interview to talk about all things Terraform.

Show notes

Risky Business #750 -- Why Microsoft's Recall is an attacker's best friend May 29, 2024

On this week’s show Patrick and Adam discuss the week’s security news, including:

Russian delivery company gets ransomware-wiper’d
A supply-chain attack targets video software used in US courts
Checkpoint firewalls get hacked, details as clear as mud
Microsoft Recall delights hackers
Aussie telco Optus gets told its IR report isn’t legal advice
Cyber insurer says you’re 5x more likely to get rekt if you have a Cisco ASA
And much, much more.

This week’s episode is sponsored by Kroll Cyber. Alex Cowperthwaite, Kroll’s technical director research and development for offence joins to talk about how his team attacks AI models, in ways both classic and new.

Show notes

Risky Business #749 -- Google answer to Microsoft's insecurity? Buy Google stuff! May 23, 2024

This week’s episode was recorded in front of a live audience at AusCERT’s 2024 conference. Pat and Adam talked through:

Google starts using security as a marketing tool against Microsoft, along with steep discounts
Microsoft announces a creepy desktop recording AI
UK govt proposes ransom payment controls
Arizona woman runs a laptop farm for North Korea
Julian Assange just keeps on with his malarky
And much, much more

This week’s episode is sponsored by Tines. Its CEO Eoin Hinchy joins the show to talk about how AI can be genuinely useful in automation.

Show notes

Wide World of Cyber: Krebs and Stamos on How AI Will Change Cybersecurity May 17, 2024

In this podcast SentinelOne’s Chief Trust officer Alex Stamos and its Chief Intelligence and Public Policy Officer Chris Krebs join Patrick Gray to talk all about AI.

It’s been a year and a half since ChatGPT landed and freaked everyone out. Since then, AI has really entrenched itself as the next big thing. It’s popping up everywhere, and the use cases for cybersecurity are starting to come into focus.

Threat actors and defenders are using this stuff already, but it’s early days and as you’ll hear, things are really going to change, and fast.

Risky Business #748 -- New cyber rules for US healthcare are coming May 15, 2024

This week Patrick Gray and Adam Boileau along special guest Lina Lau discuss the week’s news, including:

The ongoing Ascension healthcare disruption, and
Whether its reasonable for healthcare orgs to be pushing back
Platforming cybercriminals for interviews
Own the libs by… not using E2EE messaging?
CISA’s secure by design, we want to believe!
The $64billion scale of indusrialised fraud
And much, much more.

This week’s sponsor is network discovery specialist, Run Zero. Director of research Rob King joins to talk about the weird and wonderful delights in their new Research Report.

Show notes

Risky Business #747 -- Lockbit Leader Has A Very Bad Day May 08, 2024

Patrick dials in from RSA in San Francisco to discuss the week’s security news with Adam, including:

The west doxxes LockbitSupp, who must now hide his hundred million dollars
Revil hacker behind Kasaya breach gets 14 years
Microsoft makes some positive sounding* noises on security
A fun flaw in nearly all VPN clients
Gitlab admins continue their never-ending incident response
And much, much more.

This week’s sponsor is Stairwell. Long time infosec researcher Silas Cutler joins us to talk through his adventures in attacker C2 systems, and how this feeds into Stairwell’s data.

* we’re still sceptical they’ll get it right, but they do at least seem to realise how deep the doo-doo they’re in is… Pat speculates they have … tentacles, and a regulatory-threat-gland.

Show notes

Risky Business #746 – Microsoft takes your security seriously* May 01, 2024

On this week’s show Patrick and Adam discuss the week’s security news, including:

Microsoft reassures* us that they take security very seriously*
Cisco ASA firewalls get sneakily backdoored, but no one’s quite sure how
Change Healthcare was 1FA Citrix all along
The FTC, FCC and other government sticks get waved at tech
Lizard Squad Finn who hacked the Vastaamo therapy chain gets sentenced
And much, much more.

This week’s sponsor is Zero Networks, who make a network micro-segmentation product that is actually usable. Zero Networks CEO Benny Lakunishok joins us to talk through why firewalling everything everywhere is finally workable.

* You’ll forgive us for being… a tad sceptical.

Show notes

Snake Oilers: Push Security, Knocknoc and iVerify Apr 29, 2024

In this edition of Snake Oilers we’ll be hearing from:

Push Security: A browser plugin-based security company that combats identity-based attacks. (Much more compelling that it sounds in this description.)
Knocknoc: The tool Risky Business uses to protect our own applications and services. (Restrict network/port access to users who are authenticated via SSO.)
iVerify: Mobile security and threat hunting for iOS and Android. (Caught Pegasus in the wild!)

Special Edition: Chris Krebs, Alex Stamos and Patrick Gray Apr 24, 2024

In this special edition of the Risky Business podcast Patrick Gray chats with former Facebook CSO Alex Stamos and founding CISA director Chris Krebs about sovereignty and technology.

China and Russia are doing their level best to yeet American tech from their supply chains – hardware, software and cloud services. They’ll be rebuilding these supply chains – for government systems, at least – from components that they have complete visibility into, and control over.

Meanwhile, America’s government faces different supply chain challenges. It has a supply chain that won’t be weaponised against it by its adversaries, but it lacks the same sort of visibility and control that its adversaries will eventually achieve over their supply chains. So where does this leave the west? Where does it leave China and Russia?

Risky Business #745 – Tales from the PANageddon Apr 17, 2024

On this week’s show Patrick and Adam discuss the week’s security news, including:

Palo Alto’s firewalls have a ../ bad day
Sisense’s bucket full of creds gets kicked over
United Healthcare draws the ire of congress
FISA 702 reauthorisation finally moves forward
Apple warns about “mercenary exploitation” but what’s the India link?
And much, much, more

This week’s sponsor is Panther, a platform that does detection as code on massive amounts of data. Panther’s founder Jack Naglieri is this week’s sponsor guest, and we spoke with him about some common detection-as-code approaches.

Show notes

Risky Business #744 -- Ransomware upstarts jostle in Lockbit's absence Apr 10, 2024

On this week’s show Patrick and Adam discuss the week’s security news, including:

Ransomware: down but not out
Zero day prices on the rise…
… and what it means for enterprise software
Geopolitical conflict comes to computers in Palau
Ukraine cyber chief Illia Vitiuk suspended
More x86 microarchitectural bad times
And much much more

Proofpoint’s chief strategy officer Ryan Kalember is this week’s sponsor guest. He takes aim at some recent vendor trends, like security companies describing themselves as “platforms”.

Show notes

Snake Oilers: Kodex, ClearVector and Censys Apr 05, 2024

In this edition of Snake Oilers you’ll hear pitches from three companies:

Kodex: Makes a platform companies can use to interact with law enforcement (Solves the law enforcement impersonator problem, among others.)
ClearVector: Cloud security startup from former FireEye/Mandiant SVP/CTO John Laliberte
Censys: Scans the entire internet, identifies assets you didn’t know were yours, helps you track attacker infrastructure like C2

Risky Business #743 -- A chat about the xz backdoor with the guy who found it Apr 03, 2024

On this week’s show Patrick and Adam discuss the week’s security news, including:

The SSH backdoor that dreams (or nightmares) are made of
Microsoft gets a solid spanking from the CSRB
Ukraine uses an old Russian WinRAR bug to hack Russia
Push-notifications and social-engineering combined-arms vs Apple
And much, much more.

We have a special guest in this week’s show, Andres Freund, the Postgres developer who discovered the backdoor in the xz Linux compression library.

This week’s show is brought to you by Island, a company that makes a security-focussed enterprise browser. Island’s Bradon Rogers is this week’s sponsor guest and he’ll be joining us to talk about how people are swapping out their Virtual Desktop Infrastructure for enterprise-focussed browsers like theirs.

Show notes

Risky Business #742 -- China bans AMD and Intel, pivots to Linux on the desktop Mar 27, 2024

On this week’s show Patrick and Adam discuss the week’s security news, including:

FVEY protests China’s widespread hacking of western politicians
China bans western CPUs, Windows and databases
Apple’s leaky M-chip prefetcher
Nigeria holds ex-IRS investigator hostage in Binance stoush
Researchers bring Rowhammer to AMD Zen and DDR5
And much, much more.

This week’s show is brought to you by Thinkst Canary. Its founder Haroon Meer joins this week’s show to make a passionate case that security vendors don’t all have to go for explosive growth. Slow and steady with a focus on excellent and relevant products will win the race, he says.

Show notes

Risky Biz Soap Box: Why Azure vulns should get CVEs Mar 22, 2024

In this Soap Box edition of the podcast Patrick Gray talks to Nucleus Security co-founder Scott Kuffer about whether or not cloud service vulnerabilities should get CVEs, what on earth is happening with NIST’s National Vulnerability Database (NVD) and more.

Risky Business #741 -- The Mintlify breach and modern supply chains Mar 20, 2024

On this week’s show Patrick and Adam discuss the week’s security news, including:

Turns out AI is still bad code review after all,
Mintlify loses a bunch of Github tokens,
Everything old is new again with the UDP loop DoS,
Know-your-(recon satellite)-customer is hard,
Microsoft takes away Russia’s powershell, solving living off the land,
And much, much more

This week’s show is brought to you by Material Security. In this week’s sponsor interview we speak with Material’s Rajan Kapoor, VP of Customer Experience at Material. We’re also joined by Chaim Sanders, who heads Security and Privacy at Lyft.

Show notes

Risky Business #740 -- Midnight Blizzard's Microsoft hack isn't over Mar 13, 2024

On this week’s show Patrick and Adam discuss the week’s security news, including:

Weather forecast in Redmond is still for blizzards at midnight
Maybe Change Healthcare wasn’t just crying nation-state wolf
Hackers abuse e-prescription systems to sell drugs
CISA goes above and beyond to relate to its constituency by getting its Ivantis owned
VMware drinks from the Tianfu Cup
Much, much more

This week’s feature guest is John P Carlin. He was principal associate deputy attorney general under Deputy Attorney General Lisa Monaco for about 18 months in 2021 and 2022, and also served as Robert Mueller’s chief of staff when he was FBI director.

John is joining us this week to talk about all things SEC. He wrote the recent Amicus Brief that says the SEC needs to be careful in its action against Solarwinds. He’ll also be talking to us more generally about these new SEC disclosure requirements, which are in full swing.

Rad founder Jimmy Mesta will along in this week’s sponsor segment to talk about some really interesting work they’ve done in baselining cloud workloads. It’s the sort of thing that sounds simple that really, really isn’t.

Show notes

Risky Business #739 -- ALPHV exit scams while Change Healthcare burns Mar 06, 2024

In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:

The serious consequences from the Change Healthcare ransomware, and the need for a … nastier response
Predator spyware maker getting a stern sanctioning
A German military WebEx meeting gets snooped
Mem-corrpution is still king
And much, much more

In this week’s sponsor interview Patrick Gray speaks to Karl McGuinness, Okta’s chief architect, about some new security improvements they’ve built into their IDP.

Show notes

Risky Business #738 -- LockBit is down but not out. Yet. Feb 28, 2024

In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:

LockBit gets back up after takedown
Russia arrests Medibank hacker… for something else
ConnectWise gives out free updates, but customers aren’t happy
Microsoft gives in to demands for more logs
Sandvine gets entity-listed
And much much more.

Dmitri Alperovitch also joins the show to discuss Starlink, Starshield and a row with Congress about its availability in Taiwan.

In this week’s sponsor interview, Airlock Digital’s Daniel Schell talks about his adventures with WDAC, and Dave Cottingham predicts Windows 12 will go all in on signed code.

Show notes

Risky Business #737 -- LockBit gets absolutely rekt Feb 21, 2024

In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:

LockBit has been taken down by law enforcement
Some mega-juicy leaks out of Chinese offsec/APT contractor I-SOON
GRU gets its Moobot network shutdown
Signal adding usernames is… complicated
Much, much more

In this week’s sponsor interview Devicie’s Tom Plant joins the show to talk about problems orgs run into when it comes to Windows policies. There’s an expectation out there that Windows policies are set and forget, but sadly, this is not so.

Show notes

Soap Box: A deep dive on how Russia's SVR is hacking Microsoft 365 tenants Feb 19, 2024

The need to properly secure Entra ID tenants has been made pretty obvious this year thanks to a large-scale attack on them by Russia’s SVR intelligence agency. In this interview Andy Robbins from SpecterOps, the maker of Bloodhound Enterprise, talks through how he thinks those attacks actually went down, about how if you’re an o365 customer you’re using Entra ID whether you like it or not, and about how you can lock down your Entra ID tenant.

Risky Business #736 -- Azure misconfigurations are 2024's looming threat Feb 14, 2024

In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:

Somehow there are still more Ivanti and Fortinet exploits
Volt Typhoon have been at it for years
Starlink in Ukraine gets complicated
Canadians hate poor Flipper
Much, much more…

In this week’s sponsor interview Feross Aboukhadijeh from Socket joins the show to talk about the sheer volume of malicious packages being committed to code repositories and why older SCA tools aren’t well equipped to deal with them.

Show notes

Soap Box: How to dismantle Volt Typhoon-style relay networks Feb 12, 2024

In this Soap Box interview Greynoise founder and absolute legend Andrew Morris joins the show to talk about:

Why Greynoise hasn’t seen a substantial drop off in Volt Typhoon’s network of compromised routers after the US Government’s takedown action
How vendors are using Greynoise as an early warning system to identify exploitation of their products
How he’s using large language models to reverse exploitation attempts into actual exploits

It truly is a great conversation, we hope you enjoy it!

Risky Business #735 -- AnyDesk fails the transparency test Feb 07, 2024

In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:

Thought eels were slippery? Check out AnyDesk’s PR!
Why Microsoft’s 365 is a nightmare to secure
Cloudflare’s needlessly hostile blog post
US Government introduces “Disneyland ban” for spyware peddlers
Much, much more…

This week’s feature guest is Eric Goldstein, the executive assistant director for cybersecurity at CISA. He’s joining the show to talk about CISA’s demand that US government agencies unplug their Ivanti appliances. He also chimes in on why the US government is so rattled by Volt Typhoon and addresses a recent report from Politico that claims CISA’s Joint Cyber Defense Collaborative is a bit of a shambles.

This week’s sponsor guest is Dan Guido from Trail of Bits. He joins us to talk about their new Testing Handbook. Trail of Bits does a bunch of audit work and they’ve committed to trying to make bug discovery a one time thing – if you find that bug once, you shouldn’t have to manually find it on another client engagement. Semgrep for the win!

Show notes

Risky Business #734 -- The number of hacked Microsoft 365 customers is skyrocketing Jan 31, 2024

In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:

More details on sanctioned Medibank hacker Aleksandr Ermakov
More details on alleged Scattered Spider hacker Noah Michael Urban
RUMINT that the number of Microsoft customers impacted by the SVR oauth/365 campaign is huge
Ron Wyden did something useful…
…then did something stupid
Ivanti’s clown car collides with dumpster fire
Much, much more

This week’s feature guest is Australia’s assistant foreign minister (and cybersecurity tragic) Tim Watts. He joins us to talk about why the Australian government sanctioned Aleksandr Ermakob.

Sublime Security founder and CEO Josh Kamdjou is this week’s sponsor guest. He joins us to talk about combating QR-code phishing.

Show notes

Risky Business #733 -- Say cheese, motherf---er Jan 24, 2024

In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news.

Microsoft honks its clown car horn
Australia’s hounds, released, catch their man
The beginning of the end for Scattered Spider
SEC was SIM swapped but had MFA off any way
Ivanti learns a lesson…
… while Progress does not
and much more

DHS undersecretary for policy and Cyber Safety Review Board head Rob Silvers is this week’s feature guest. He joins the show to talk about how the CSRB handles possible conflicts of interests from board members with industry day jobs.

In this week’s sponsor interview Resourcely’s founder Travis McPeak talks about why we need to help developers with “paved roads” instead of relying on dashboard products to tell us when things have gone wrong.

Show notes

Risky Business #732 — We are CRUSHED Jan 17, 2024

On this week’s SURPRISE edition, Patrick Gray and Adam Boileau discuss the week’s security news. They cover:

Their disappointment over last week’s SEC Twitter hack
China rainbow-tables Airdrop
Enterprise bugs galore…
… and why patching fast is hard when there isn’t even a patch yet
UEFI flaws get trad-BIOS-era vendor response
and much, much more…

This week’s show is unsponsored, we’re just here for the fun of it.

Show notes

Risky Business #731 -- SEC Twitter hack moves Bitcoin price Jan 10, 2024

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:

SEC Twitter account hack moves bitcoin price
Kaspersky admires Triangulation hackers’ fine work
Telcos hacked all over
Israel hacks Iranian gasoline pumps again
Iran up in Albania, Sudan, Egypt and Tanzania
and much, much more…

This week’s show is brought to you by Nucleus Security. Co-founder Scott Kuffer joins us to talk about why patch management is more nuanced than just “patch fast!”

Show notes

Risky Business #730 -- Apple, Facebook go all in on e2ee Dec 13, 2023

In this week’s edition of the show Patrick Gray and guest co-host Dmitri Alperovitch discuss:

Major telco in Ukraine taken down by Russia
Apple and Facebook go all in on e2ee
Why 702 reauthorisation is looking a bit sketchy
The USG wants your push notifications
The year in review, plus some predictions for 2024

This week’s show is brought to you by Thinkst Canary. Haroon Meer, Thinkst’s founder, is this week’s sponsor guest. He joins us to talk about APT groups pivoting to living-off-the-land techniques.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes

Show notes