Risky Business – Details, episodes & analysis

On this week’s show, Patrick Gray and Adam Boileau discusses the week’s security news, including:

• Telegram founder’s arrest in France
• Volt Typhoon 0days some SD-WAN gear
• Russia frets about Ukraine all up in Kursk’s webcams
• Cybercriminals social engineer payment card NFC relay attacks in the wild
• The slow burn of Active Directory name collisions
• And much, much more.

This week’s episode is sponsored by Nucleus Security. Aaron Unterberger joins to discuss how vulnerability management starts out easy, but gets serious very quickly.

You can also watch this week’s show on Youtube.

• Pavel Durov: Telegram CEO's arrest part of larger investigation
• Keep Pavel Durov LOCKED UP
• Internet mogul Kim Dotcom to be extradited to the US, NZ justice minister says
• New 0-Day Attacks Linked to China’s ‘Volt Typhoon’ – Krebs on Security
• Oil industry giant Halliburton confirms 'issue' following reported cyberattack
• Seattle airport confronts 4th day of cyberattack outages | Cybersecurity Dive
• Russia calls for restrictions on surveillance cameras, dating apps in cities under attack from Ukraine
• In a Kyiv hangar, Ukraine launches a cyber range for everyone
• U.S. military, on Tinder, says to swipe left on Iran-backed militants - The Washington Post
• CISA officials credit Microsoft security log expansion for improved threat visibility | Cybersecurity Dive
• Suspect in $14 billion cryptocurrency pyramid scheme extradited to China
• Android malware used to steal ATM info from customers at three European banks
• Novel technique allows malicious apps to escape iOS and Android guardrails | Ars Technica
• Local Networks Go Global When Domain Names Collide – Krebs on Security
• Attack tool update impairs Windows computers
• SonicWall pushes patch for critical vulnerability in SonicOS platform | CyberScoop
• “YOLO” is not a valid hash construction

Mike Burgess is the director general of ASIO. But the thing about Mike is he’s actually a cybersecurity guy. He joined ASD, Australia’s NSA, back in 1995 when it was still the Defence Signals Directorate. He was there for 18 years before he bounced out to the private sector for a while to work as the CISO for Australia’s largest telco, Telstra. In 2017 he returned to ASD to run it, and in 2019 he was appointed director general of ASIO.

Back in April, Burgess made a series of comments on the topic of encrypted messaging during a Press Club speech in Canberra. Our right to privacy, he said, is not absolute, and he implied that if certain providers didn’t start helping Australian authorities out a little more, he’d use some of the provisions in Australia’s Assistance and Access bill to force them to provide access to certain content.

So I reached out to organise this interview to get some more detail from him about exactly what sort of cooperation he’s seeking and why.

This Soap Box edition of the show is with Mike Wiacek, the CEO and Founder of Stairwell.

Stairwell is a platform that creates something similar to an NDR, but for file analysis instead of network traffic. The idea is you get a copy of every unique file in your environment to the Stairwell platform, via a file forwarding agent. You get an inventory that lists where these files exist in your environment, at what times, and from there you can start doing analysis.

If you find a dodgy file you can do all the usual malware analysis type stuff, but you can also do things like immediately find out where else that file is in your organisation, or even where else it was. From there you can identify other files that are similar – variants of those files – and search for those. And you can unpack all this very, very quickly.

This is the type of tool that EDR companies use internally to do threat hunting, but it’s just for you and your org – you can drive it. And as you’ll hear, the idea of a transparent, customisable and programmable security stack is something that’s on-trend at the moment. Mike lays out the case that doing this sort of file analysis in your organisation makes a whole lot of sense.

In this podcast Alex Stamos, Chris Krebs and Patrick Gray discuss the relationship between cybercrime and the state, which is often more complicated than it should be.

While the US Government and its allies fight the scourge of ransomware, other governments are using it to either raise revenue or irritate their foes. North Korea sees ransomware as a money spinner, while the Kremlin enjoys poking the west in the eye with it.

Join us for a breakdown of the relationships between governments who should know better and the worst types of people on the planet.

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Widely used polyfill javascript gets hijacked by its new owners
• MacOS supply chain disaster bullet dodged
• That OpenSSH remote code exec OH MY <3
• Entrust gets its CA business kicked to the kerb by Google
• South Korean telco intentionally viruses 600k customers
• Microsoft continues to deeply underwhelm
• And much, much more.

This week’s episode is sponsored by Greynoise. Founder Andrew Morris joins to talk about ways to track attackers across NAT and VPNs, as well as how you can join in the fun of running an internet-scale honeypot network.

• Polyfill, Cloudflare trade barbs after reports of supply chain attack threatening 100k websites
• 3 million iOS and macOS apps were exposed to potent supply-chain attacks
• regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems (CVE-2024-6387)
• Google Online Security Blog: Sustaining Digital Certificate Security - Entrust Certificate Distrust
• TeamViewer: Hackers copied employee directory data and encrypted passwords
• South Korean telecom company attacks customers with malware — over 600,000 torrent users report missing files, strange folders, and disabled PCs | Tom's Hardware
• CDK eyes service restoration for all car dealers by Fourth of July
• ‘I don’t see it happening’: CISA chief dismisses ban on ransomware payments
• Patelco Credit Union ransomware attack halts banking services for nearly half a million members
• LockBit claims cyberattack on Croatia’s largest hospital
• Inside a Violent Gang's Ruthless Crypto-Stealing Home Invasion Spree
• Suspected Chinese gov’t hackers used ransomware as cover in attacks on Brazil presidency, Indian health org
• Nearly 4,000 arrested in global police crackdown on online scam networks
• USD 257 million seized in global police crackdown against online scams
• Microsoft alerts additional customers of state-linked threat group attacks
• Midnight Blizzard Microsoft Email Data Sharing Request: Legit? : r/Office365
• Polish Parliament strips official of immunity, clearing path for prosecution in spyware scandal
• Stolen credentials could unmask thousands of darknet child abuse website users
• WA man set up fake free wifi at Australian airports and on flights to steal people’s data, police allege
• Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
• iOS 17 lockdown mode blocking CarPlay? : r/ios

This is a sponsored Soap Box edition of the Risky Business podcast.

Abhishek Agrawal is the CEO and co-founder of Material Security, an email security company that locks down cloud email archives. Attackers have been raiding mailspools since hacking has existed, and with those mailspools now in the cloud with services like o365 and Google Workspace, guess where the attackers are going?

Material built a product that helps you lock up your email data, to archive and redact sensitive information. The idea is to really just limit what an attacker can do with email data if they pop an account.

Abhishek joined me to talk about a few things, like how non phishing resistant MFA is basically dead, how email content is very useful to security programs, and about how the gen AI won’t really change much on the defensive control side.

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Julian Assange finally cuts a deal, pleads guilty, and goes free
• USA to ban Kaspersky - even updates
• Car dealer SaaS provider CDK contemplates paying a ransom
• Intolerable healthcare ransomware attacks continue
• We revisit Windows proximity bugs via wifi and bluetooth
• And much, much more.

This week’s episode is sponsored by enterprise browser maker Island. Crowdstrike co-founder Dmitri Alperovitch is an investor in Island, and joins on its behalf to discuss why an enterprise browser is really starting to make sense.

• Julian Assange released from prison and has left UK, WikiLeaks says
• US to ban Kaspersky Lab software nationwide later this year
• Cyberattack on CDK Global stymies work at car dealerships across US
• Almost 200 cancer operations postponed as ransomware group publishes London hospitals data
• UK government weighs action against Russian hackers over NHS records theft
• South Africa’s national health lab hit with ransomware attack amid mpox outbreak
• Ransomware victims are becoming less likely to pay up | Cybersecurity Dive
• Lawmakers in Philippines push for probe into Pentagon's anti-vax propaganda operation | Reuters
• Telegram says it has 'about 30 engineers'; security experts say that's a red flag | TechCrunch
• Two bluetooth vulnerabilities in Windows
• Thread on reversing the patch
• Basic concept for the latest windows wifi driver CVE

On this week’s retreat special, the entire Risky Business team is together in a tropical paradise for the first time. The team takes a break from the infinity pool to discuss the week’s security news:

• Microsoft recalls Recall, but why did it have to be such a mess
• And a Windows kernel wifi code-exec, really?
• Passkeys and identity are hard
• Scattered Spider bigwig arrested in Spain
• The pentagon runs a deeply flawed info-op
• Is it time E2E crypto nerds accept their place in the world?
• And much, much more.

This week’s show is brought to you by Corelight… Corelight’s CEO Brian Dye will be along in this week’s sponsor interview to make a really compelling case for something that shouldn’t exist… which is NDR in cloud environments.

• Microsoft shelves Recall feature release after security uproar
• Microsoft’s Recall puts the Biden administration’s cyber credibility on the line | CyberScoop
• Microsoft’s cybersecurity vulnerabilities endanger America
• US lawmakers grill Microsoft president over China ties, hacks | Reuters
• Microsoft Refused to Fix Flaw Years Before SolarWinds Hack — ProPublica
• CVE-2024-30078 - Security Update Guide - Microsoft - Windows Wi-Fi Driver Remote Code Execution Vulnerability
• Security bug allows anyone to spoof Microsoft employee emails | TechCrunch
• Patrick Gray on X: "I was wrong about some things I said about iCloud accounts in this week’s show and I’ll tell you all exactly how I was wrong in next week’s show"
• Passkeys in Microsoft Authenticator and Entra ID
• Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED
• MFA plays a rising role in major attacks, research finds | Cybersecurity Dive
• Luke Jennings on LinkedIn: saas-attacks/techniques/ghost_logins/description.md at main ·…
• Alleged Boss of ‘Scattered Spider’ Hacking Group Arrested – Krebs on Security
• EXPOSED: Identities of Iranian Hackers Targeting Israel and Other Countries Revealed | Matzav.com
• Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating | Ars Technica
• Windows flaw may have been exploited with Black Basta ransomware before it was patched
• Crown Equipment Corporation victim of a Ransomware attack | Born's Tech and Windows World
• City governments in Michigan, New York face shutdowns after ransomware attacks
• Cleveland confirms ransomware attack as City Hall remains closed
• Authorities investigating extended ‘network outage’ at organization that runs TheBus
• Pentagon ran secret anti-vax campaign to incite fear of China vaccines
• Shashank Joshi on X: "Just finished “Information Operations”, a new book by @TathamSteve. Includes this anecdote on a British effort to stop children throwing stones at a base in Afghanistan. “LRGR was the abbreviation for the Long-Range Gonad Reducer.” https://t.co/zmoxb45Cgz"
• Dmitri Alperovitch on X: "@shashj They also allegedly hacked the email of the lieutenant leading the medical service of the 960th unit and retrieved the medical certificates of 150 officers and enlisted personnel"
• Signal president Meredith Whittaker criticizes EU attempts to tackle child abuse material

On this week’s show Patrick Gray and Adam Boileau are joined by long-time NSA boffin Rob Joyce. Now Rob’s left the government service, he’s hobnobbing with us pundits, talking through the week’s news:

• Apple announces a big leap for confidential cloud computing into the mass market
• While at the same time, letting you just mosey around your iPhone from your Mac
• Mandiant reports in about the Snowflake breach
• Moody’s say credit ratings might consider cyber incidents
• Microsoft fixes an Azure flaw with a… “comprehensive documentation update”
• And much, much more.

This week’s show is sponsored by Yubico, maker of the Yubikey hardware authentication token. Jerrod Chong, Yubico’s COO and President joins to talk about the challenges of the passkey and hardware authenticator ecosystem.

• Apple makes a password manager play in a heavily targeted market | Cybersecurity Dive
• macOS Sequoia takes productivity and intelligence on Mac to new heights - Apple
• The Wiretap: Apple’s AI Announcement Promises Big Security Boosts–Not Everyone Is Convinced
• Matthew Green on X: "Ok there are probably half a dozen more technical details in the blog post. It’s a very thoughtful design. Indeed, if you gave an excellent team a huge pile of money and told them to build the best “private” cloud in the world, it would probably look like this. 14/" / X
• Risky Biz News: Microsoft budges on Windows 11 Recall
• Tenable finds an Azure flaw, Microsoft calls it a feature • The Register
• LendingTree confirms that cloud services attack potentially affected subsidiary
• Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica
• 7,000 LockBit decryption keys now in the hands of the FBI, offering victims hope | Ars Technica
• Urgent call for O-type blood donations following London hospitals ransomware attack
• Darknet site for Qilin gang, suspected in London hospitals ransomware attack, goes down
• Cyberattacks pose mounting risks to creditworthiness: Moody’s | Cybersecurity Dive
• Apple refused to pay bug bounty to Russian cybersecurity firm Kaspersky Lab
• FCC moves ahead on internet routing security rules | CyberScoop
• House Republicans propose eliminating funding for election security | CyberScoop
• New DJI policy: No flight record syncing for US drone pilots
• Semiconductor giants Nvidia and Arm warn of new flaws in their graphics processors
• Critical PHP CVE is under attack — research shows it’s easy to exploit | Cybersecurity Dive
• A US Company Enabled a North Korean Scam That Raised Money for WMDs | WIRED

On this week’s show Patrick Gray and Mark Piper discuss the week’s security news, including:

• What on earth happened at Snowflake?
• A look at operation Endgame
• Check Point’s hilarious adventures with dot dot slash
• Report says the FTC is looking at Microsoft’s security product bundling
• More ransomware hits Russia
• Much, much more

404 Media co-founder Joseph Cox is this week’s feature guest. He joins us to talk about his new book, Dark Wire, which is all about the FBI’s Anom sting.

This week’s show is brought to you by Resourcely. If your Terraform is a mess or your CSPM dashboards are lighting up with insane and stupid things, you should check out Resourcely. Its founder and CEO Travis McPeak will be along in this week’s sponsor interview to talk about all things Terraform.

• The Snowflake breach and the need for mandatory MFA
• Snowflake at centre of world’s largest data breach | by Kevin Beaumont | Jun, 2024 | DoublePulsar
• Cloud company Snowflake denies that reported breach originated with its products
• ‘Operation Endgame’ Hits Malware Delivery Platforms – Krebs on Security
• Treasury Sanctions Creators of 911 S5 Proxy Botnet – Krebs on Security
• TikTok warns of exploit aimed at 'high-profile accounts’
• SEC clarifies intent of cybersecurity breach disclosure rules after initial filings | Cybersecurity Dive
• SEC.gov | Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents[*]
• Nurses at Ascension hospital in Michigan raise alarms about safety following ransomware attack
• London hospitals declare emergency following ransomware attack | Ars Technica
• North Korea’s ‘Moonstone Sleet’ using fake tank game, custom ransomware in attacks
• OpenAI models used in nation-state influence campaigns, company says
• National Vulnerability Database | NIST
• More than 600,000 routers knocked out in October by Chalubo malware
• Hackers steal $305M from DMM Bitcoin crypto exchange | TechCrunch
• Germany's main opposition party hit by ‘serious’ cyberattack
• Cyberattack disrupts operations of supermarkets across Russia
• Rare earths miner targeted in cyber attack prior to removal of Chinese investors - ABC News
• Check Point - Wrong Check Point (CVE-2024-24919)
• Kevin Beaumont: "The latest Risky Business epis…" - Infosec Exchange
• This Hacker Tool Extracts All the Data Collected by Windows’ New Recall AI | WIRED
• FTC-industry talks over possible Microsoft probe raised recent hacking incidents - Nextgov/FCW
• Tim Schofield 🏴󠁧󠁢󠁥󠁮󠁧󠁿 🇬🇧 🇪🇺🗺: "@riskybusiness @metlstorm I d…" - Infosec Exchange
• Dark Wire: The Incredible True Story of the Largest Sting Operation Ever: Cox, Joseph: 9781541702691: Amazon.com: Books
• Distant Field Labs