Risky Business Podcast Por Patrick Gray arte de portada

Risky Business

Risky Business

De: Patrick Gray
Escúchala gratis

Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.Copyright Risky Business Media 2007-2025 Política y Gobierno
Episodios
  • Risky Business #803 -- Oracle's CSO Mary Ann Davidson quietly departs

    Risky Business #803 -- Oracle's CSO Mary Ann Davidson quietly departs
    Aug 20 2025

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

    • Oracle’s long term CSO departs, and we’re not that sad about it
    • Canada’s House of Commons gets popped through a Microsoft bug
    • Russia degrades voice calls via Whatsapp and Telegram to push people towards Max
    • South-East Asian scam compounds are also behind child sextortion
    • Reports that the UK has backed down on Apple crypto are… strange
    • Oh and of course there’s a Fortinet bug! There’s always a Fortinet bug!

    This week’s episode is sponsored by open source identity provider Authentik. CEO Fletcher Heisler joins the show this week, and explains the journey of implementing SSO backed login on Windows, Mac and Linux. You’ll never guess which one was a few lines of PAM config, and which was a multi-month engineering project!

    This episode is also available on Youtube.

    Show notes
    • Is Oracle facing headwinds? After layoffs, its 4-decade veteran Chief Security Officer Mary Ann Davidson departs
    • Oracle CSO blasted over anti-security research rant - iTnews
    • New York lawsuit against Zelle creator alleges features allowed $1 billion in thefts | The Record from Recorded Future News
    • Mobile Phishers Target Brokerage Accounts in ‘Ramp and Dump’ Cashout Scheme – Krebs on Security
    • How we found TeaOnHer spilling users' driver's licenses in less than 10 minutes | TechCrunch
    • UK has backed down on demand to access US Apple user data, spy chief says
    • DNI Tulsi Gabbard on X: "As a result, the UK has agreed to drop its mandate for"
    • Hackers target Workday in social engineering attack
    • Russia curbs WhatsApp, Telegram calls to counter cybercrime | The Record from Recorded Future News
    • Hackers reportedly compromise Canadian House of Commons through Microsoft vulnerability | The Record from Recorded Future News
    • Norway police believe pro-Russian hackers were behind April dam sabotage | The Record from Recorded Future News
    • US agencies, international allies issue guidance on OT asset inventorying | Cybersecurity Dive
    • FortMajeure: Authentication Bypass in FortiWeb (CVE-2025-52970)
    • U.S. State Dept - Near Eastern Affairs on X: "He did not claim diplomatic immunity and was released by a state judge"
    • 493 Cases of Sextortion Against Children Linked to Notorious Scam Compounds | WIRED
    • .:: Phrack Magazine ::.
    • Accenture to buy Australian cyber security firm CyberCX - iTnews
    Más Menos
    58 m
  • Risky Biz Soap Box: How to measure vulnerability reachability

    Risky Biz Soap Box: How to measure vulnerability reachability
    Aug 14 2025

    In this Soap Box edition of the Risky Business podcast Patrick Gray chats with Socket founder Feross Aboukhadijeh about how to measure the reachability of vulnerabilities in applications.

    It’s great to know there’s a CVE in a library you’re using, but it’s even better if you can say whether or not that vulnerability actually impacts your application.

    They also talk about how Socket started out as a way to discover malicious packages in software projects, but these days it’s playing the CVE game as well.

    This episode is also available on Youtube.

    Show notes
      Más Menos
      36 m
    • Risky Business #802 -- Accessing internal Microsoft apps with your Hotmail creds

      Risky Business #802 -- Accessing internal Microsoft apps with your Hotmail creds
      Aug 13 2025
      On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including: CISA warns about the path from on-prem Exchange to the cloudMicrosoft awards a crisp zero dollar bill for a report about what a mess its internal Entra-authed apps areEveryone and their dog seems to have a shell in US Federal Court information systemsGoogle pays $250k for a Chrome sandbox escapeAttackers use javascript in adult SVG files to … farm facebook likes?!SonicWall says users aren’t getting hacked with an 0day… this time. This week’s episode is sponsored by SpecterOps. Chief product officer Justin Kohler talks about how the flagship Bloodhound tool has evolved to map attack paths anywhere. Bring your own applications, directories and systems into the graph, and join the identity attacks together. This episode is also available on Youtube. Show notes CISA, Microsoft issue alerts on ‘high-severity’ Exchange vulnerability | The Record from Recorded Future NewsAdvanced Active Directory to Entra ID lateral movement techniquesConsent & Compromise: Abusing Entra OAuth for Fun and Access to Internal Microsoft ApplicationsCartels may be able to target witnesses after major court hackFederal judiciary tightens digital security as it deals with ‘escalated cyberattacks’ | The Record from Recorded Future NewsCitrix NetScaler flaws lead to critical infrastructure breaches | Cybersecurity DiveDARPA touts value of AI-powered vulnerability detection as it announces competition winners | Cybersecurity DiveButtercup is now open-source!HTTP/1.1 must die: the desync endgameUS confirms takedown of BlackSuit ransomware gang that racked up $370 million in ransoms | The Record from Recorded Future NewsNorth Korean cyber-espionage group ScarCruft adds ransomware in recent attack | The Record from Recorded Future NewsAdult sites are stashing exploit code inside racy .svg files - Ars TechnicaGoogle pays 250k for Chromium sandbox escapeSonicWall says recent attack wave involved previously disclosed flaw, not zero-day | Cybersecurity DiveTwo groups exploit WinRAR flaws in separate cyber-espionage campaigns | The Record from Recorded Future NewsTornado Cash cofounder dodges money laundering conviction, found guilty of lesser charge | The Record from Recorded Future NewsHackers Hijacked Google’s Gemini AI With a Poisoned Calendar Invite to Take Over a Smart Home | WIREDMalware in Open VSX: These Vibes Are OffHow attackers are using Active Directory Federation Services to phish with legit office.com linksIntroducing our guide to phishing detection evasion techniquesThe State of Attack Path Management
      Más Menos
      1 h
    Todavía no hay opiniones