Episodios

  • Risky Business #789 -- Apple's AirPlay vulns are surprisingly awful

    Risky Business #789 -- Apple's AirPlay vulns are surprisingly awful
    Apr 30 2025
    On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news: British retail stalwart Marks & Spencer gets cyberedSouth Korean telco sets out to replace all its subscriber SIMs after (we assume) it lost the keymatIt’s a good exploit week! Bugs in Apple Airplay, SAP webservers, Erlang SSH and CommVault backupsJuice jacking! No, really! Some researchers actually did it (so still not in the wild, then)Anti-DOGE whistleblower sure sounds like he has a point This week’s episode is sponsored by Knocknoc, who let you glue your firewalls to your single sign on. Knocknoc’s CEO Adam Pointon talks about the joy that having end-to-end IPv6 would bring for zero-trust access control. He also touches on people using Knocknoc inside their network to isolate critical systems. Editors Note : Pat also gives Adam (Boileau) stick in the sponsor interview about the Risky Biz webserver not having IPv6 enabled, which fact-checking during the edit says is FAKE NEWS. Just uh, don’t look at how fresh that AAAA record in the DNS is, friends 😉 This episode is also available on Youtube. Show notes British retailer M&S confirms being hit by ‘cyber incident’ amid store delays | The Record from Recorded Future NewsM&S cyber-attack linked to hacking group Scattered Spider | Marks & Spencer | The GuardianBina Puri shares, Warrant B close sharply lower day after hackingBina Puri, Pos Malaysia tumble following hacking incident | FMTJapan warns of hundreds of millions of dollars in unauthorized trades from hacked accounts | The Record from Recorded Future NewsUS conducts cyberattacks against major Chinese commercial encryption provider: report - Global TimesIran says major cyberattack on infrastructure repelled | Iran InternationalSpain rules out cyber attack - but what could have caused power cut?South Korea's SK Telecom begins SIM card replacement after data breachAirBorne: Wormable Zero-Click RCE in Apple AirPlay Puts Billions of Devices at Risk | Oligo Security | Oligo SecurityiOS and Android juice jacking defenses have been trivial to bypass for years - Ars TechnicaHow Android 16's new security mode will stop USB-based attacks - Android AuthorityResearchers warn of critical flaw found in Erlang OTP SSH | Cybersecurity DiveCritical vulnerability in SAP NetWeaver under threat of active exploitation | Cybersecurity DiveCVE-2025-31324: Critical SAP Flaw Explained | StrobesFire In The Hole, We’re Breaching The Vault - Commvault Remote Code Execution (CVE-2025-34028)Risky Bulletin: NFC card malware keeps evolving in Russia, a bad omen for the future - Risky Business MediaHegseth had unsecured internet line in Pentagon for Signal, sources say | AP NewsWhistleblower: DOGE Siphoned NLRB Case Data – Krebs on Security2025_0414_Berulis-Disclosure-with-Exhibits.s.pdfCISA gets a deputy director as it braces for major layoffs | Cybersecurity DiveTwo top cyber officials resign from CISA | The Record from Recorded Future NewsEx-CISA chief Chris Krebs leaving SentinelOne following Trump pressure | ReutersFormer cyber official targeted by Trump speaks out after cuts to digital defenseTop Tier Target | What It Takes to Defend a Cybersecurity Company from Today's Adversaries | SentinelOneZachXBT on X: "Nine hours ago a suspicious transfer was made from a potential victim for 3520 BTC ($330.7M)"
    Más Menos
    1 h y 3 m
  • Snake Oilers: LimaCharlie, Honeywell Cyber Insights, CobaltStrike and Outflank

    Snake Oilers: LimaCharlie, Honeywell Cyber Insights, CobaltStrike and Outflank
    Apr 28 2025

    In this edition of the Snake Oilers podcast, three sponsors come along to pitch their products:

    • LimaCharlie: A public cloud for SecOps
    • Honeywell Cyber Insights: An OT security/discovery solution
    • Fortra’s CobaltStrike and Outflank: Security tooling for red teamers

    This episode is also available on Youtube.

    Show notes
      Más Menos
      39 m
    • Snake Oilers: Pangea, Cosive and Sysdig

      Snake Oilers: Pangea, Cosive and Sysdig
      Apr 17 2025

      In this edition of Snake Oilers three vendors pitch host Patrick Gray on their tech:

      • Pangea: Guardrails and security for AI agents and applications (https://pangea.cloud)

      Worried about your AI apps going rogue, being mean to your customers or even disclosing sensitive information? Pangea exists to address these risks. Fascinating stuff.

      • Cosive: A threat intelligence company that can host your MISP server in AWS. CloudMISP! (https://www.cosive.com/snakeoilers)

      Are you running a MISP server on some old hardware under a desk in your SOC? There’s a better way! Cosive can run it for you on AWS so you can just use it instead of wrestling with maintaining it. They also do some CTI consulting to help you get better use out of MISP.

      • Sysdig: A Linux runtime security platform (https://sysdig.com/)

      The modern Windows network is an all-singing, all-dancing, perfectly orchestrated, EDR-protected ballet. The modern Linux production environment… isn’t. Find out how Sysdig can help you get some visibility and control over your Linux fleet.

      This episode is also available on Youtube.

      Show notes
        Más Menos
        48 m
      • Risky Business #788 -- Trump targets Chris Krebs, SentinelOne

        Risky Business #788 -- Trump targets Chris Krebs, SentinelOne
        Apr 16 2025

        On this week’s show Patrick Gray talks to former NSA Cybersecurity Director Rob Joyce about Donald Trump’s unprecedented, unwarranted and completely bonkers political persecution of Chris Krebs and his employer SentinelOne.

        They also talk through the week’s cybersecurity news, covering:

        • Mitre’s stewardship of the CVE database gets its funding DOGE’d
        • The US signs on to the Pall Mall anti-spyware agreement
        • China tries to play the nationstate cyber-attribution game, but comedically badly
        • Hackers run their malware inside the Windows sandbox, for security against EDR

        This week’s episode is sponsored by open source identity provider Authentik. CEO Fletcher Heisler joins to talk through the increasing sprawl of the identity ecosystem.

        This episode is also available on Youtube.

        Show notes
        • Cybersecurity industry falls silent as Trump turns ire on SentinelOne | Reuters
        • U.S. cyber defenders shaken by Trump's attack on their former boss
        • Trump Revenge Tour Targets Cyber Leaders, Elections – Krebs on Security
        • Wyden to block Trump's CISA nominee until agency releases report on telecoms’ ‘negligent cybersecurity’ | The Record from Recorded Future News
        • Gabbard sets up DOGE-style team to cut costs, uncover intel ‘weaponization’
        • MITRE Warns CVE Program Faces Disruption Amid US Funding Uncertainty
        • US to sign Pall Mall pact aimed at countering spyware abuses | The Record from Recorded Future News
        • Court document reveals locations of WhatsApp victims targeted by NSO spyware | TechCrunch
        • Spyware Maker NSO Group Is Paving a Path Back Into Trump’s America | WIRED
        • NCSC shares technical details of spyware targeting Uyghur, Tibetan and Taiwanese groups | The Record from Recorded Future News
        • Risky Bulletin: Chinese APT abuses Windows Sandbox to go invisible on infected hosts
        • China escalates cyber fight with U.S., names alleged NSA hackers
        • Researcher uncovers dozens of sketchy Chrome extensions with 4 million installs - Ars Technica
        • China-based SMS Phishing Triad Pivots to Banks – Krebs on Security
        • Risky Bulletin: CA/B Forum approves 47-days TLS certs
        • Ransomware in het mkb: Cybercriminelen verhogen losgeld bij cyberverzekering
        • 4chan Is Down Following What Looks to Be a Major Hack Spurred By Meme War
        Más Menos
        54 m
      • Wide World of Cyber: How the Trump admin is changing the cybersecurity landscape

        Wide World of Cyber: How the Trump admin is changing the cybersecurity landscape
        Apr 10 2025

        In this podcast, Patrick Gray chats with SentinelOne’s Chris Krebs and Alex Stamos about the huge changes afoot in the United States government and what they mean for the threat environment. From the director of NSA being fired to massive job cuts at CISA and huge foreign policy shifts, tomorrow’s threat environment is going to be very different to today’s. Tune in to hear analysis from two of the best in the business!

        This episode is also available on Youtube.

        Show notes
          Más Menos
          43 m
        • Risky Business #787 -- Trump fires NSA director, CISA cuts inbound

          Risky Business #787 -- Trump fires NSA director, CISA cuts inbound
          Apr 9 2025
          On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news: Oracle quietly cops to being hacked, but immediately pivots into pretending it didn’t matterNSA and CyberCom leaders fired for not being MAGA enoughUS Treasury had some dusty corners it hadn’t found China in yet, looked, found China in them…which is a great time to discuss slashing CISA’s staffingRansomware crews and bullet proof hosting providers are getting rekt, and we love itAnd Microsoft patches yet another logging 0-day being used in the wild. This episode is sponsored by Yubico, makers of Yubikey hardware authentication tokens. Yubico’s Vice President of Solutions Architecture and Alliances Derek Hanson joins to discuss how the consumer-centric passkey ecosystem has become a real challenge for enterprises. One that Yubico is actually ideally positioned to solve. Show notes Oracle privately confirms Cloud breach to customers Oracle have finally issued a written notification to customers about their cybersecurity incident. Head of NSA and US Cyber Command reportedly fired | Cybersecurity Dive Trump fires numerous National Security Council staff - The Washington Post Trump administration under scrutiny as it puts major round of CISA cuts on the table | Cybersecurity Dive Hackers Spied on US Bank Regulators’ Emails for Over a Year - Bloomberg This is how Jeffrey Goldberg got added to the Signal chat Cybercriminals are trying to loot Australian pension accounts in new campaign | The Record from Recorded Future News $500,000 stolen in Australian super fund data breach | Superannuation | The Guardian Australian regulator pulls licenses of 95 companies in effort to crack down on investment scams | The Record from Recorded Future News Everest ransomware group’s darknet site offline following defacement | The Record from Recorded Future News On March 28, 2025, a threat actor leaked internal data from Medialand, a major bulletproof hosting (BPH) provider long linked to Yalishanda (LARVA-34). There's a ransomware group named DragonForce going around hacking its rivals. After Mamona and BlackLock, the group has now hacked RansomHub The DragonForce ransomware group hacked two rivals this month CISA, experts warn of Crush file transfer attacks as ransomware gang makes threats | The Record from Recorded Future News Kill Security Campaign Targets CrushFTP Servers National Vulnerability Database | NIST Microsoft patches zero-day actively exploited in string of ransomware attacks | CyberScoop Exploitation of CLFS zero-day leads to ransomware activity | Microsoft Security Blog Is The Sofistication In The Room With Us? - X-Forwarded-For and Ivanti Connect Secure (CVE-2025-22457)
          Más Menos
          53 m
        • Risky Business #786 -- Oracle is lying

          Risky Business #786 -- Oracle is lying
          Apr 2 2025
          On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news: Yes, Oracle Health and Oracle Cloud did get hackedThe fallout from Signalgate continuesNorth Korean IT workers pivot to EuropeHoneypot data suggests a storm is brewing for Palo Alto VPNsCanadian Anon gets arrested for hacking Texas GOP This week’s episode is sponsored by Trail of Bits. Tjaden Hess, a Principal Security Engineer at Trail of Bits who specialises in cryptography, joins the show this week to talk about what a responsible crypto-currency exchange cold wallet setup looks like, and … contrasts that with Bybit. This episode is also available on Youtube. Show notes Oracle Health breach compromises patient data at US hospitalsFBI probes Oracle hack tied to healthcare extortion: Report - Becker's Hospital Review | Healthcare News & AnalysisOracle Still Denies Breach as Researchers PersistHacker linked to Oracle Cloud intrusion threatens to sell stolen data | Cybersecurity DivePublius on X: "🚨 SIGNAL SCANDAL: Katherine Maher, the leftist NPR CEO, is currently the Chair of the Board of Signal! WHAT ARE THE ODDS? https://t.co/jWNTeAt3Jz" / XMike Waltz Is Losing Support Inside the White House - WSJWaltz and staff used Gmail for government communications, officials say - The Washington PostPete Hegseth, Mike Waltz, Tulsi Gabbard: Private Data and Passwords of Senior U.S. Security Officials Found Online - DER SPIEGELEven More Venmo Accounts Tied to Trump Officials in Signal Group Chat Left Data Public | WIREDYou Need to Use Signal's Nickname FeatureSignalGate Is Driving the Most US Downloads of Signal Ever | WIREDWickr - WikipediaWhen Getting Phished Puts You in Mortal Danger – Krebs on SecurityDPRK IT Workers Expanding in Scope and Scale | Google Cloud BlogHow the FBI Tracked, and Froze, Millions Sent to Criminals in Massive Caesars Casino HackDefense contractor to pay $4.6 million over third-party provider’s security weakness | The Record from Recorded Future NewsSurge in Palo Alto Networks Scanner Activity Indicates Possible Upcoming ThreatsCISA warns new malware targeting Ivanti zero-day vulnerability | Cybersecurity DiveCanadian hacker arrested for allegedly stealing data from Texas Republican Party | The Record from Recorded Future NewsBritish intel intern pleads guilty to smuggling top secret data out of protected facility | The Record from Recorded Future News
          Más Menos
          55 m
        • Soap Box: Knocknoc glues your SSO to your firewalls for Just-in-Time network access

          Soap Box: Knocknoc glues your SSO to your firewalls for Just-in-Time network access
          Mar 26 2025

          In this Soap Box edition of Risky Business host Patrick Gray talks to Knocknoc CEO Adam Pointon about how to easily rein in attack surface by glueing your single sign-on service to your network controls.

          Do your Palo Alto and Fortinet devices really need to be discoverable by ransomware crews? Does your file transfer appliance need to be open to the whole world? What about your SSH and RDP? Your Citrix? Your (gasp) Exchange Online servers??

          You can do a lot with IP allowlisting and simple Identity Aware Proxies (IAPs) to minimise your exposure.

          Knocknoc is a bit of a “Risky Business special”, too. Pat helped Knocknoc to raise a seed round through Decibel Partners where he’s a founder advisor. He also serves on Knocknoc’s board of directors.

          This episode is also available on Youtube.

          Show notes
            Más Menos
            31 m
          adbl_web_global_use_to_activate_webcro768_stickypopup