In this edition of the Soap Box podcast we’re going to be talking about a great topic – living off the land. The recent Volt Typhoon report out of Microsoft chronicled the adventures of a Chinese APT crew in US critical infrastructure. But one of the most fascinating aspects of the Volt Typhoon campaign was that the attackers almost exclusively used so-called living off the land techniques. So the question becomes – what can you do about an attacker in your environment who has privilege and isn’t using malware? Guests David Cottingham and Daniel Schell, the CEO and CTO of Airlock Digital, join the show to talk it through.

Risky Business

Risky Biz Soap Box: Defeating Living of the Land

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover: Albanian authorities raid MEK over Iran hacks Microsoft admits “Anonymous Sudan” took down its services US Government puts $10m bounty on CL0P A deeper look at the Barracuda hack campaign Much, much more This week’s show is brought to you by Material Security. We’ll be hearing from one of Material’s friends – Courtney Healey, senior manager of insider threat at Coinbase – in this week’s sponsor interview. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing. Show notes Police raid Iranian opposition camp in Albania, seize computers | AP News Risky Biz News: Microsoft embarrassingly admits it got DDoSed into the ground by Anonymous Sudan Anonymous Sudan and Killnet strike again, target EIB Pro-Russian hackers remain active amid Ukraine counteroffensive | CyberScoop Hackers infect Russian-speaking gamers with fake WannaCry ransomware US puts $10M bounty on Clop as federal agencies confirm data compromises | Cybersecurity Dive (1) Catherine Herridge on Twitter: "Tonight, sources tell @cbsnews senior government officials are racing to limit impact - of what one cyber expert calls - potentially the largest theft + extortion event in recent history. USG official says no evidence to date US MIL or INTEL compromised. https://t.co/R4f6naFqFx" / Twitter U.S. government says several agencies hacked as part of broader cyberattack Clop names a dozen MOVEit victims, but holds back details | Cybersecurity Dive Another MOVEit vulnerability found, as state and federal agencies reveal breaches | Cybersecurity Dive Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China | Mandiant New DOJ unit will focus on prosecuting nation-state cybercrime EU states told to restrict Huawei and ZTE from 5G networks ‘without delay’ The US Navy, NATO, and NASA Are Using a Shady Chinese Company’s Encryption Chips | WIRED Widow of slain Saudi journalist Jamal Khashoggi files suit against Pegasus spyware maker Jamal Khashoggi’s wife to sue NSO Group over Pegasus spyware | Jamal Khashoggi | The Guardian Bipartisan bill would protect Americans’ data from export abroad District of Nebraska | Massachusetts Man Sentenced for Computer Intrusion | United States Department of Justice I Was Sentenced to 18 Months in Prison for Hacking Back - My Story | HackerNoon CID-FLYER-TEMPLATE New FCC privacy task force takes aim at data breaches, SIM-swaps | CyberScoop Bloodied Macbooks and Stacks of Cash: Inside the Increasingly Violent Discord Servers Where Kids Flaunt Their Crimes Russian National Arrested and Charged with Conspiring to Commit LockBit Ransomware Attacks Against U.S. and Foreign Businesses | OPA | Department of Justice BrianKrebs: "Haha love it when a data ranso…" - Infosec Exchange 

Risky Business #711 -- Albanian authorities raid MEK camp over Iran hacks

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover: Fortinet 0day Groundhog Day CISA’s new binding directive on exposed management interfaces Confirmed: US intelligence buying commercially available data MOVEit drama rolls on Much, much more This week’s show is brought to you by Red Canary. Chris Rothe is this week’s sponsor guest and he joins us to talk about how MDR providers are helping customers deal with cloud monitoring. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing. Show notes Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks - SecurityWeek Barracuda Urges Replacing — Not Patching — Its Email Security Gateways – Krebs on Security MOVEit announces second vulnerability; Minnesota schools agency breached with original bug Confidential data downloaded from UK regulator Ofcom in cyberattack Ransomware group Clop issues extortion notice to ‘hundreds’ of victims Another huge US medical data breach confirmed after Fortra mass-hack | TechCrunch CISA orders US civilian agencies to remove tools from public-facing internet Microsoft says Azure disrupted after a week of repeated service outages | Cybersecurity Dive Microsoft says Azure outage was caused by ‘anomalous’ traffic spike Microsoft investigating threat actor claims following multiple outages in 365, OneDrive | Cybersecurity Dive Risky Biz News: Ukrainian hackers wipe equipment of major Russian telco U.S. Spy Agencies Buy Vast Quantities of Americans’ Personal Data, U.S. Says - WSJ The US Is Openly Stockpiling Dirt on All Its Citizens | WIRED Srsly Risky Biz: Thursday, July 29 - by Tom Uren National security officials make case for keeping surveillance powers to skeptical Congress - The Washington Post Senators say Biden administration isn’t close on overhauling surveillance law Russian nationals accused of Mt. Gox bitcoin heist, shifting stolen funds to BTC-e North Korean hacking group Lazarus linked to $35 million cryptocurrency heist North Korean hackers stole $100 million in recent cryptocurrency heist -analysts | Reuters An Illinois hospital links closure to ransomware attack Security professional&#39;s tweet forces big change to Google email authentication | CyberScoop Can you trust ChatGPT’s package recommendations? LastPass CEO reflects on lessons learned, regrets and moving forward from a cyberattack | Cybersecurity Dive 

Risky Business #710 -- Why your corporate VPN will get you owned

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover: Russia’s FSB uncovers “NSA malware” on iPhones Cl0p mass harvests data from MOVEit file transfer servers ASD discloses a bunch of operations against ISIS, criminals Why China’s prepositioning is probably… prepositioning Much, much more This week’s show is brought to you by Thinkst Canary. Marco Slaviero is this week’s sponsor guest and he joins us to talk about indirect LLM prompt injection and the latest Canary release. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing. Show notes Russia says US hacked thousands of Apple phones in spy plot | Reuters Risky Biz News: Russia&#39;s FSB says NSA hacked iPhones in cyber-espionage campaign Russia wants 2 million phones with home-grown Aurora OS for use by officials Доверенная мобильная среда. Мобильная операционная система «Аврора» — Ростелеком Why China&#39;s Latest APT Campaign is Legitimately Worrying War crimes committed through cyberspace must not escape international justice, says Estonian president Hacks Against Ukraine&#39;s Emergency Response Services Rise During Bombings | WIRED How Australian cyber spies used &#39;Rickrolling&#39; to disrupt Islamic State militants in Iraq - ABC News Australian intelligence&#39;s secret hand in bringing down the Bali bombers - ABC News Microsoft Threat Intelligence on Twitter: "Microsoft is attributing attacks exploiting the CVE-2023-34362 MOVEit Transfer 0-day vulnerability to Lace Tempest, known for ransomware operations & running the Clop extortion site. The threat actor has used similar vulnerabilities in the past to steal data & extort victims. https://t.co/q73WtGru7j" / Twitter What we know about the MOVEit vulnerability and compromises | Cybersecurity Dive metlstorm: "Great, so now I have to roll i…" - Infosec Exchange Dave Aitel: "@riskybusiness @chort honestly…" - Infosec Exchange Critical Barracuda 0-day was used to backdoor networks for 8 months | Ars Technica Millions of Gigabyte Motherboards Were Sold With a Firmware Backdoor | WIRED Ask Fitis, the Bear: Real Crooks Sign Their Malware – Krebs on Security Wayback Machine Discord Admins Hacked by Malicious Bookmarks – Krebs on Security Google’s Android and Chrome extensions are a very sad place. Here’s why | Ars Technica How university cybersecurity clinics can help cities fight ransomware | CyberScoop Atomic - Crypto Wallet on Twitter: "We have received reports of wallets being compromised. We are doing all we can to investigate and analyse the situation. As we have more information, we will share it accordingly. For any questions and concerns, contact support@atomicwallet.io" / Twitter BrianKrebs: "Russian news outlet Kommersant…" - Infosec Exchange Thinkst 

Risky Business #709 -- Cl0p goes berserk with MOVEit 0day

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover: China’s lolbin-powered intrusions into critical infrastructure Trend Micro backs BlackBerry’s Cuba call Anonymous Sudan shakes down Scandanavian Airlines Iranian opposition party MEK publishes gargantuan leak Much, much more This week’s show is brought to you by Kubernetes security company KSOC. Jimmy Mesta is this week’s sponsor guest and he joins us to talk about the big security challenges in Kubernetes. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing. Show notes Volt Typhoon targets US critical infrastructure with living-off-the-land techniques | Microsoft Security Blog (1) New Messages! U.S. warns China could hack infrastructure, including pipelines, rail systems | Reuters Factbox: What is Volt Typhoon, the alleged China-backed hacking group? | Reuters Chinese Malware Hits Systems on Guam. Is Taiwan the Real Target? - The New York Times COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises | Mandiant Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ Goals Hacker group Anonymous Sudan demands $3 million from Scandinavian Airlines Iranian dissidents take over high-security servers of regime presidency | Iran-linked hackers Agrius deploying new ransomware against Israeli orgs Exclusive: Chinese hackers attacked Kenyan government as debt strains grew | Reuters Risky Biz News: PyPI to enforce 2FA, reduce stored IP addresses NSO spyware used in Armenia-Azerbaijan conflict, report finds Mercenary mayhem: A technical analysis of Intellexa&#39;s PREDATOR spyware SMS pumping fraud: take care how you configure MFA - TechHQ Full Disclosure: Printerlogic multiple vulnerabilities Barracuda Networks issue added to CISA vulnerability list Barracuda patches actively exploited zero-day vulnerability in email gateways | Cybersecurity Dive Developing: RaidForums users db leaked Phishing Domains Tanked After Meta Sued Freenom – Krebs on Security Broad coalition of advocacy groups urges Slack to protect users&#39; messages from eavesdropping | CyberScoop 

Risky Business #708 – China's lolbin-powered adventures in US critical infrastructure

In this Soap Box podcast Patrick Gray talks to George Glass, the threat intelligence operations leader in the Cyber Risk practice at Kroll. They talk about all sorts of things, like: How the ransomware ecosystem is evolving into “ma and pa” operations Some killer detections they’ve figured out What separates the good networks from the bad ones Why EDR is of limited value if you’re not actually monitoring it Why not letting MDRs do the R part of their job is really, really, really dumb 

Risky Biz Soap Box: Why your EDR won't save you

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover: Germans charge FinFisher executives The got FBI busted misusing 702 data Special guest Chris Krebs talks China, new CISA mandates and more New research breaks Android fingerprint auth Much, much more This week’s show is brought to you by Trail of Bits. Dan Guido is this week’s sponsor guest and he joins us to talk about the work Trail of Bits is doing in securing AI systems, and making them safe. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing. Show notes Congress looks to expand CISA&#39;s role, adding responsibilities for satellites and open source software | CyberScoop Biden nominates Lt. Gen. Timothy Haugh for top position at NSA, Cyber Command Unsere Strafanzeige: Staatsanwaltschaft erhebt Anklage gegen FinFisher The Real Risks in Google’s New .Zip and .Mov Domains | WIRED FBI misused controversial surveillance tool to investigate Jan. 6 protesters Suspicion stalks Genesis Market’s competitors following FBI takedown Crimephones Are a Cop&#39;s Best Friend - by Tom Uren The Underground History of Turla, Russia&#39;s Most Ingenious Hacker Group | WIRED Some Of Russia’s Most Dangerous Cybercriminals Just Had Their Malware Dealer Unmasked Shifting tactics fuel surge in Business Email Compromise Treasury Department sanctions entities tied to North Korean IT scams, hacking | CyberScoop Chinese Labs Are Selling Fentanyl Ingredients for Millions in Crypto | WIRED Leaked EU Document Shows Spain Wants to Ban End-to-End Encryption | WIRED Here’s how long it takes new BrutePrint attack to unlock 10 different smartphones | Ars Technica It took 48 hours, but the mystery of the mass Asus router outage is solved | Ars Technica Popular Android TV boxes sold on Amazon are laced with malware | TechCrunch Teen hacker charged in scheme to siphon funds from sports betting accounts Researchers tie FIN7 cybercrime family to Clop ransomware German arms company Rheinmetall confirms Black Basta ransomware group behind cyberattack Dallas courts still closed 2 weeks post-ransomware attack | Cybersecurity Dive Health insurer says patients’ information was stolen in ransomware attack Patients angered after Oklahoma allergy clinic blames cyberattack for shutdown UK steel industry supplier Vesuvius says ‘cyber incident’ cost £3.5 million Researchers infiltrate Qilin ransomware group, finding lucrative affiliate payouts A different kind of ransomware demand: Donate to charity to get your data back | CyberScoop Joe Tidy on Twitter: "A bizarre one from Reading courts - an IT Security worker pleads guilty to piggy-backing off a cyber attack against his own firm. Liles switched the ransom payment details to his own Bitcoin wallet and changed the hacker&#39;s email to secretly apply pressured on bosses to pay up. https://t.co/Ze4yAJA6vM" / Twitter ChatGPT Scams Are Infiltrating Apple&#39;s App Store and Google Play | WIRED 

Risky Business #707 -- Inside China's information lockdown with Chris Krebs

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover: Wazawaka charged, sanctioned PlugwalkJoe extradited, pleads guilty BlackBerry thinks Cuba ransomware is a front for Russian intelligence Anonymous Sudan pops up in Israel Microsoft’s Outlook patch fail Much, much more This week’s show is brought to you by Bloodhound Enterprise. Andy Robbins is this week’s sponsor guest. He talks about how graph theory could help us to uncover more lolbins. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing. Show notes Alleged Babuk ransomware gang leader ‘Wazawaka’ indicted, sanctioned by US Who is the Network Access Broker ‘Wazawaka?’ – Krebs on Security British man involved in Twitter hack extradited to US, pleads guilty to numerous cybercrimes Cybercriminals who targeted Ukraine are actually Russian government hackers, researchers say | TechCrunch Slapdash attempt to hack rocket sirens may be cause for serious alarm about Iran | The Times of Israel Twitter’s Encrypted DMs Are Deeply Inferior to Signal and WhatsApp | WIRED Twitter under fire for restricting content before Turkish presidential election - CBS News Three opposition media outlets hit by cyber attack Patrick Gray on Twitter: "https://t.co/n5b7wPjI6Y https://t.co/UmDbHbhEcS" / Twitter (1) Patrick Gray on Twitter: "Switched to a domain validated username at the other place. Very easy. https://t.co/U46zABPnJl" / Twitter Emerging ransomware group quickly hits 4 critical infrastructure providers | Cybersecurity Dive A ransomware source code leak spawned at least 10 ‘Babuk’ imitators, researchers say Philadelphia Inquirer unable to go to print due to ‘cyber incident’ Hackers attempt to extort Dragos and its executives in suspected ransomware attempt | CyberScoop Dallas says it &#39;will likely take weeks to get back to full functionality&#39; after ransomware attack Swiss tech giant ABB confirms ‘IT security incident’ CISA: Bl00dy Ransomware Gang using printer vulnerability to attack schools Capita says responding to ransomware attack will cost up to £20 million National Gallery of Canada recovering from ransomware incident Yum Brands faces class action suits from employees after ransomware attack | Cybersecurity Dive Knocking down Hive: How the FBI ran its own ransomware decryption operation Leak of MSI UEFI signing keys stokes fears of “doomsday” supply chain attack | Ars Technica FBI nukes Russian Snake data theft malware with self-destruct command The FBI’s New Malware Eradication Service Is on Thin Legal Ice Cisco warns of new ‘Greatness’ phishing-as-a-service tool seen in the wild VMware’s ‘target-rich environment’ is growing more volatile, CrowdStrike warns | Cybersecurity Dive UK&#39;s National Crime Agency wins major legal challenge over Encrochat hack Inside the Italian Mafia’s Encrypted Phone of Choice Microsoft releases fix for patched Outlook issue exploited by Russian hackers Scammer Made Thousands Selling &#39;Leaked&#39; Frank Ocean Tracks That Were Fake, AI-Generated 

Risky Business #706 -- Why BlackBerry thinks Cuba ransomware is a Russian front

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover: Joe Sullivan’s sentencing MSI key material leak Merck to be paid in NotPetya claim The FBI takes down Turla’s Snake malware operation Much, much more This week’s show is brought to you by Gigamon. Chaim Mazal, Gigamon’s CSO, is this week’s sponsor guest. He’s talking about how the company’s gear is acting as a data source for network security products. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing. Show notes Former Uber CSO avoids prison time for ransomware coverup | Cybersecurity Dive Merck cyber coverage upheld in NotPetya decision, seen as victory for policyholders | Cybersecurity Dive Home / Twitter Hunting Russian Intelligence “Snake” Malware | CISA Justice Department Announces Court-Authorized Disruption of Snake Malware Network Controlled by Russia’s Federal Security Service | OPA | Department of Justice Iranian state-sponsored hackers exploiting printer vulnerability Iran: Fake It Till You Make It - by Tom Uren Hacktivists Target Iran’s Foreign Ministry, Leak Trove Of Data New Cactus ransomware encrypts itself to evade antivirus White House considers ban on ransom payments, with caveats | Cybersecurity Dive Hamas armed wing announces suspension of bitcoin fundraising | Reuters FBI, Ukraine seize cryptocurrency exchanges for abetting cybercriminals Dallas still recovering from ransomware on eve of municipal election | Cybersecurity Dive Dallas restores core emergency dispatch systems | Cybersecurity Dive Hackers hijacked a university&#39;s emergency system to threaten students and faculty Organizations slow to patch GoAnywhere MFT vulnerability even after Clop ransomware attacks $10M Is Yours If You Can Get This Guy to Leave Russia – Krebs on Security Coming to DEF CON 31: Hacking AI models | CyberScoop Google Is Rolling Out Passkeys, the Password-Killing Tech, to All Accounts | WIRED US Court Rules for Corellium in Apple Copyright Case SafeGraph Lands US Air Force Contract After Targeting Abortion Clinics | WIRED 

Risky Business #705 -- USA's Turla takedown marks a shift in tactics

In this edition of Snake Oilers: Travis McPeak pitches Resourcely’s automagic Terraform cloud-provisioning technology Ken Westin pitches Panther – a cloud-native SIEM developed by former practitioners Brian Kenyon from Island talks about the company’s enterprise browser Enjoy! Show notes Resourcely | Cloud resource creation and management Panther | A Cloud SIEM Platform for Modern Security Teams Island | The Enterprise Browser 

Snake Oilers: Resourcely, Panther and Island

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover: Rob Joyce weighs in on AI and offsec Mysterious hacker doxes Russian intelligence agency bitcoin wallets Wired deep dives on SolarWinds AmeriCold food logistics giant suffers incident Iranian authorities roll low-tech spyware Much, much more This week’s show is brought to you by Greynoise. Its founder and CEO Andrew Morris is this week’s sponsor guest. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing. Show notes NSA Cybersecurity Director Says ‘Buckle Up’ for Generative AI | WIRED 3 areas of generative AI the NSA is watching in cybersecurity | Cybersecurity Dive NSA cyber director warns of ransomware attacks on Ukraine, Western supply chains Palantir Demos AI to Fight Wars But Says It Will Be Totally Ethical Don’t Worry About It (1) Alex Banks on Twitter: "Yesterday Palantir announced its Artificial Intelligence Platform. Here&#39;s how it transforms the future of military and defence: https://t.co/TcgN29wN19" / Twitter Russian Bitcoin (BTC) Wallets Allegedly Exposed by Apparent Hacker DOJ Detected SolarWinds Breach Months Before Public Disclosure | WIRED SolarWinds: The Untold Story of the Boldest Supply-Chain Hack | WIRED Cold storage company Americold reports cyberattack to SEC CISA seeks public comment on software security attestation form | Cybersecurity Dive Secure Software Development Attestation Form Instructions DHS pushes Congress to formally establish Cyber Safety Review Board First draft of controversial UN Cybercrime Treaty slated for June Return of the EARN IT Act rekindles encryption debate at critical moment for privacy-protecting apps | CyberScoop Apple releases first ‘rapid’ security fixes for iPhones, iPads and Macs | TechCrunch BouldSpy: Android Spyware Tied to Iranian Police Targets Minorities | Lookout Evasive Panda APT group delivers malware via updates for popular Chinese software | WeLiveSecurity Hackers are breaking into AT&T email accounts to steal cryptocurrency | TechCrunch CISA, FDA warn of new Illumina DNA device vulnerability Apple and Google Set Joint Standards to Stop AirTag Stalking Many Public Salesforce Sites are Leaking Private Data – Krebs on Security Brother of man who ran Helix cryptocurrency mixer jailed for stealing 712 bitcoin Nearly 300 arrested in sprawling international dark web drug market takedown | CyberScoop Students’ psychological reports, abuse allegations leaked by ransomware hackers Mandiant CEO’s 7 tips for cyber defense | Cybersecurity Dive I Regret to Inform You That Bluesky Is Fun | WIRED 

Risky Business #704 -- Why LLMs aren't an exploit bonanza

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover: The supply chain attack in the supply chain attack Russia has a China dependency problem Recent research into TLS resumption flaws Google and Intel team up on hardware hacking DHS will hack enterprise kit Much, much more This week’s show is brought to you by Corelight. Brian Dye, Corelight’s CEO, is this week’s sponsor guest. He’s talking about the (actually sensible) ChatGPT-driven features Corelight has built into its NDR platform. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing. Show notes Software Maker 3CX Was Compromised in First-of-its-Kind Threaded Supply-Chain Hack - Updated Russia China Worries Set Out in Private Memo on Tech Risk - Bloomberg Hackers to show they can take over a European Space Agency satellite DOJ urges CISOs to continue working with law enforcement ahead of Uber security chief’s sentencing To combat cybercrime, US law enforcement increasingly prioritizes disruption | CyberScoop Collaboration between CISA, Cyber Command thwarted dangerous cyberattacks, officials said | CyberScoop US gov’t stopped Iranian hackers who ‘gained access’ to 2020 election infrastructure Bill proposes new DHS centers for testing security of critical government tech UK says ‘Wagner-like cyber groups’ attacking critical infrastructure Russia&#39;s digital warriors adapt to support the war effort in Ukraine, Google threat researchers say | CyberScoop Bipartisan legislation aims to ‘arm Taiwan to the teeth in the cyber domain’ Ex-NSA boss won $700,000 Saudi consulting deal after Khashoggi death - The Washington Post U.S. approves massive arms sale to Saudi Arabia, United Arab Emirates to counter Iran | PBS NewsHour Intel Let Google Cloud Hack Its New Secure Chips and Found 10 Bugs | WIRED Google’s Authenticator App Now Lets You Sync 2FA Codes Across Devices | WIRED We Really Need to Talk About Session Tickets | System Security Group Internet protocol vulnerability opens door to ‘massive’ DoS amplification attacks Exploit released for 9.8-severity PaperCut flaw already under attack | Ars Technica Finding PaperCut MF and NG servers DC health exchange breach traced back to misconfigured Amazon server Ukraine remains Russia’s biggest cyber focus in 2023 The hacker Bassterlord in his own words: Portrait of an access broker as a young man Hacker Group Names Are Now Absurdly Out of Control | WIRED 

Risky Business #703 -- Russia whines about its tech dependence on China

Snake Oilers isn’t our regular weekly podcast, it’s a wholly sponsored series we do at Risky.Biz where vendors come on to the show to pitch their products to you, the Risky Business listener. To be clear – everyone you hear in one of these editions, paid to be here. We’ll hear from three vendors in this edition of Snake Oilers: Socket.dev, a software supply chain product that currently deploys as a GitHub addon Teleport, a company that makes a secure access gateway/single sign on product for engineers to securely access infrastructure Mandiant joins us to pitch its Purple Team engagement product Enjoy! Show notes Socket - Secure your supply chain. Ship with confidence. Teleport: Identity-Native Infrastructure Access. Faster. More Secure. Purple Team Assessment | Improve Detection & Response 

Snake Oilers: Socket, Teleport and Mandiant's Purple Team

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover: Why 3CX was the dumbest supply chain attack we’ve seen Why Wiz’s AzureAD research was a showstopper that didn’t get the attention it deserved How attackers are burning down cloud infrastructure The latest from the world of spyware Much, much more This week’s show is brought to you by Nucleus Security. Chris Hughes from Aquia is this week’s sponsor guest. He appeared at Nucleus Security’s invitation. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing. Show notes Massive 3CX Supply-Chain Hack Targeted Cryptocurrency Firms | WIRED 3CX support tells customers to investigate malware warnings themselves | Ars Technica North Korean hackers linked to 3CX supply-chain attack, investigation finds BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover | Wiz Blog Microsoft leads effort to disrupt illicit use of Cobalt Strike, a dangerous hacking tool in the wrong hands | CyberScoop MERCURY and DEV-1084: Destructive attack on hybrid environment - Microsoft Security Blog CISA, Cisco highlight Russian military targeting of router vulnerabilities Israeli spyware software surveilling journalists, politicians Mercenary spyware hacked iPhone victims with rogue calendar invites, researchers say | TechCrunch Israeli Spyware Maker QuaDream Closes, Fires All Employees - National Security & Cyber - Haaretz.com Hackers used spyware made in Spain to target users in the UAE, Google says | TechCrunch Apple’s high security mode blocked NSO spyware, researchers say | TechCrunch US commits $25 million to Costa Rica for Conti ransomware recovery State Department, Congress working on formal program for US cyber aid CISA and partners issue secure-by-design principles for software manufacturers | FedScoop Time to Designate Space Systems as Critical Infrastructure Apple’s Macs Have Long Escaped Ransomware. That May Be Changing | WIRED Cyber company Darktrace gets caught up in LockBit gang&#39;s apparent blunder Payments giant says it is investigating ransomware incident that caused POS outage Cyberattack causing treatment delays at Canadian hospital German arms manufacturer Rheinmetall confirms cyberattack Hackers using Log4j bug to profit from victim IP addresses through ‘proxyjacking’ scheme Police arrest almost 120 people globally following Genesis Market takedown FBI accessed Genesis Market&#39;s backend servers as part of takedown LinkedIn Verification Now Lets You Verify Your Job and Account | WIRED Tech industry’s pain is NSA’s gain, cyber leader says about layoffs QueueJumper: Critical Unauthenticated RCE Vulnerability in MSMQ Service - Check Point Research Microsoft shifts to a new threat actor naming taxonomy - Microsoft Security Blog Leaked Pentagon Document Claims Russian Hacktivists Breached Canadian Gas Pipeline Company Did someone really hack into the Oldsmar, Florida, water treatment plant? New details suggest maybe not. | CyberScoop From Discord to 4chan: The Improbable Journey of a US Intelligence Leak - bellingcat U.S. intel agencies may change how they monitor social media, chatrooms after missing leaked U.S. documents for weeks Taiwan highly vulnerable to Chinese air attack, leaked documents show - The Washington Post Pentagon document leak raises questions about internal security - The Washington Post Leaked secret documents detail additional Chinese spy balloons - The Washington Post 

Risky Business #702 -- 3CX: It's like SolarWinds, but stupider

In this Soap Box edition of the show, Thinkst Canary founder Haroon Meer joins us to talk about why the sudden pullback in venture funding in infosec is actually a good thing. He thinks this will give founders licence to slow down and actually focus on making good products, instead of trying to build a company around vapourware or a minimum viable product.

Risky Biz Soap Box: Haroon Meer on why the VC apocalypse is great news

Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.

hubhopper

Risky Business

hubhopper