App Store

Google Play

DK - Details page - Device banner - 894x1036

Nyd den ubegrænsede adgang til tusindvis af spændende e- og lydbøger - helt gratis

Lyt når som helst, hvor som helst 

Patrick Gray

Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.

Risky Business

In this interview Patrick Gray talks to Yubico’s COO and President Jerrod Chong about a new Yubikey feature: pre-registration.

You can now ship pre-registered Yubikeys to your staff so you don’t need to rely on your staff to enrol them. They’ve achieved this with really slick Okta and Entra ID integrations.

Jerrod also talks about a recent trip to Singapore and concerns he has about the cybersecurity of critical infrastructure in the energy sector.

Risky Biz Soapbox: Enterprise Yubikeys can now be pre-registered

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

 • Cleo file transfer products have a remote code exec, here we go again!

 • Snowflake phases out password-based auth

 • Chinese Sophos-exploit-dev company gets sanctioned

 • Romania’s election gets rolled back after Tiktok changed the outcome

 • AMD’s encrypted VM tech bamboozled by RAM with one extra address bit

 • Some cool OpenWRT research

 • And much, much more.

This week’s episode is sponsored by Thinkst, who love sneaky canary token traps. Jacob Torrey previews an upcoming Blackhat talk filled with interesting operating system tricks you can use to trigger canaries in your environment. You wont believe the third trick! Attackers hate him!

This episode is also available on Youtube.

 
 
 Show notes
 
 
 Cleo Software Actively Being Exploited in the Wild CVE-2024-50623 | Huntress
 
 Blue Yonder investigating data leak claim following ransomware attack | Cybersecurity Dive
 
 Snowflake to phase out single-factor authentication by late 2025 | Cybersecurity Dive
 
 Treasury Sanctions Cybersecurity Company Involved in Compromise of Firewall Products and Attempted Ransomware Attacks | U.S. Department of the Treasury
 
 Another teenage hacker charged as feds continue Scattered Spider crackdown | The Record from Recorded Future News
 
 Germany arrests suspected admin of country’s largest criminal marketplace | The Record from Recorded Future News
 
 FCC, for first time, proposes cybersecurity rules tied to wiretapping law | CyberScoop
 
 Russian state hackers abuse Cloudflare services to spy on Ukrainian targets | The Record from Recorded Future News
 
 Cloudflare’s pages.dev and workers.dev Domains Increasingly Abused for
 
 Romania annuls presidential election over alleged Russian interference | The Record from Recorded Future News
 
 EU demands TikTok 'freeze and preserve data' over alleged Russian interference in Romanian elections | The Record from Recorded Future News
 
 Research Note: Meta’s Role in Romania’s 2024 Presidential Election - CheckFirst
 
 Key electricity distributor in Romania warns of ‘cyber attack in progress’ | The Record from Recorded Future News
 
 Backdoor slipped into popular code library, drains ~$155k from digital wallets - Ars Technica
 
 AMD’s trusted execution environment blown wide open by new BadRAM attack - Ars Technica
 
 New dog, old tricks: DaMAgeCard attack targets memory directly thru SD card reader – PT SWARM
 
 Telegram partners with child safety group to scan content for sexual abuse material
 
 Apple hit with $1.2B lawsuit after killing controversial CSAM-detecting tool - Ars Technica
 
 Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection - Flatt Security Research
 
 How do I turn on the Do Not Track feature? | Firefox Help

Risky Business #774 -- Cleo file transfer appliances under widespread attack

In this edition of the Wild World of Cyber podcast Patrick Gray sits down with SentinelOne’s Chief Intelligence and Public Policy Officer Chris Krebs to talk all about Chinese cyber operations.

They look at the Salt Typhoon and Volt Typhoon campaigns, the last 20 years of Chinese operations, and the evolution of the cyber roles of China’s Ministry of State Security and People’s Liberation Army.

It’s a very dense hour of conversation!

This podcast was recorded in front of an audience at the Museum of Contemporary Art in Sydney.

This episode is also available on Youtube.

 
 
 Show notes

Wide World of Cyber: SentinelOne's Chris Krebs on Chinese cyber operations

On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

 • The SEC’s cyber incident reporting isn’t very exciting after all

 • China Telecom on the way to being thrown out of the US

 • The NSA/Cybercom might get two separate hats

 • The Cl0p ransomware crew are back and taking responsibility for the Cleo hacks

 • (Yet another) File upload bug in Struts makes Java admins weep

 • And much, much more.

This episode is sponsored by SpecterOps, who run a pretty top notch offsec/pentest team when they’re not busy making the Bloodhound Enterprise identity attack path enumeration software. SpecterOps’ Robby Winchester joins to talk about how pentest has changed, and how their customers get value from their testing.

This episode is also available Youtube.

 
 
 Show notes
 
 
 SEC cyber incident reporting rule generates 71 filings in 11 months | Cybersecurity Dive
 
 US senators, green groups call for accountability over hacking of Exxon critics | Reuters
 
 Biden Administration Takes First Step to Retaliate Against China Over Hack - The New York Times
 
 Unfinished business for Trump: Ending the Cyber Command and NSA 'dual hat' | The Record from Recorded Future News
 
 EU opens investigation into TikTok and the Romanian election – POLITICO
 
 Clop ransomware claims responsibility for Cleo data theft attacks
 
 CISA warns of ransomware gangs exploiting Cleo, CyberPanel bugs | The Record from Recorded Future News
 
 CVE-2024-55956 | AttackerKB
 
 Apache issues patches for critical Struts 2 RCE bug • The Register
 
 Japanese game and anime publisher reportedly pays $3 million ransom to Russia-linked hackers | The Record from Recorded Future News
 
 Israeli spyware firm Paragon acquired by US investment group, report says | Reuters
 
 How Cryptocurrency Turns to Cash in Russian Banks – Krebs on Security
 
 Arizona man arrested for alleged involvement in violent online terror networks | CyberScoop
 
 Russia bans Viber, claiming app facilitates terrorism and drug trafficking | The Record from Recorded Future News

Risky Business #775 -- Cl0p is back, SEC hack disclosures disappoint

In this sponsored Soap Box edition of the show Patrick Gray talks to Island CEO Michael Fey about some of the cool tricks in the Island enterprise browser. You can use it to tick off so many compliance boxes, and not just cybersecurity boxes.

This is largely a conversation about compliance, but it’s actually interesting and fun. These are words we never thought we’d type!

You can find Island at https://island.io/

This episode is also available on Youtube.

 
 
 Show notes

Risky Biz Soap Box: Cool compliance tricks with the Island enterprise browser

Risky Business returns for its 19th year! Patrick Gray and Adam Boileau discuss the week’s cybersecurity news and there is a whole bunch of it. They discuss:

 • The incoming Trump administration guts the CSRB

 • Biden’s last cyber Executive Order has sensible things in it

 • China’s breach of the US Treasury gets our reluctant admiration

 • Ross Ulbricht - the Dread Pirate Roberts of Silk Road fame - gets his Trump pardon

 • New year, same shameful comedy Forti- and Ivanti- bugs

 • US soldier behind the Snowflake hacks faces charges after a solid Krebs-ing

 • And much, much (much! after a month off) more.

This week’s episode is sponsored by Sandfly Security, who make a Linux EDR solution. Founder Craig Rowland joins to talk about how the Linux ecosystem struggles with its lack of standardised approaches to detection and response. If you’ve got a telco full of unix, and people are asking how much Salt Typhoon you’ve got in there… Sandfly’s tools are probably what you’re looking for.

If you like your Business like us… - Risky - then we’re hiring! We’re looking for someone to help with audio and video production for our work, manage our socials, and if you’re also into the Cybers… even better. Position is remote, with a preference for timezones amenable to Australia/NZ. Drop us a line: editorial at risky.biz.

This episode is also available on Youtube.

 
 
 Show notes
 
 
 POLITICO Pro | Article | Acting DHS chief ousts CSRB experts, other department advisers
 
 Treasury’s sanctions office hacked by Chinese government, officials say 
 
 Strengthening America’s Resilience Against the PRC Cyber Threats | CISA
 
 AT&T, Verizon say they evicted Salt Typhoon from their networks
 
 Risky Bulletin: Looking at Biden's last cyber executive order - Risky Business
 
 Internet-connected devices can now have a label that rates their security | Reuters
 
 US sanctions prominent Chinese cyber company for role in Flax Typhoon attacks
 
 FCC ‘rip and replace’ provision for Chinese tech tops cyber provisions in defense bill
 
 CIA nominee tells Senate he, too, wants to go on cyber offense | CyberScoop
 
 Trump tells Justice Department not to enforce TikTok ban for 75 days
 
 Judge rules NSO Group is liable for spyware hacks targeting 1,400 WhatsApp user devices | The Record from Recorded Future News
 
 Unpacking WhatsApp’s Legal Triumph Over NSO Group | Lawfare
 
 Time to check if you ran any of these 33 malicious Chrome extensions
 
 Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls - Arctic Wolf
 
 Ongoing attacks on Ivanti VPNs install a ton of sneaky, well-written malware
 
 Researchers warn of active exploitation of critical Apache Struts 2 flaw 
 
 DOJ deletes China-linked PlugX malware off more than 4,200 US computers
 
 Russian internet provider confirms its network was ‘destroyed’ following attack claimed by Ukrainian hackers | The Record from Recorded Future News
 
 Ukraine restores state registers after suspected Russian cyberattack | The Record from Recorded Future News
 
 Hackers claim to breach Russian state agency managing property, land records | The Record from Recorded Future News
 
 U.S. Army Soldier Arrested in AT&T, Verizon Extortions – Krebs on Security

Risky Business #776 -- Trump will flex American cyber muscles

Coming to you from the same room in Risky Business headquarters Patrick Gray and Adam Boileau discuss the week’s cybersecurity news. They talk through:

 • Sonicwall firewalls hand out remote code exec like candy

 • Mastercard make a slapstick-grade mistake with their DNS

 • The data breach at PowerSchool and other niche SaaS providers

 • Academic research proposes taking down Europe’s power grid

 • Apple CPUs get a new speculative execution side channel

 • And much, much more.

This week’s episode is sponsored by Push Security, who make an identity security product that runs inside browsers. Luke Jennings joins to discuss some of the pitfalls of federated authentication, like attackers using unexpected identity providers to log in to your apps.

This episode is also available on Youtube.

 
 
 Show notes
 
 
 SonicWall warns hackers targeting critical vulnerability in SMA 1000 series appliances | Cybersecurity Dive
 
 MasterCard DNS Error Went Unnoticed for Years – Krebs on Security
 
 Data breach hitting PowerSchool looks very, very bad - Ars Technica
 
 OpenAI rival DeepSeek limits registration after ‘large-scale malicious attacks’ | The Record from Recorded Future News
 
 Hackers imitate Kremlin-linked group to target Russian entities | The Record from Recorded Future News
 
 UK to examine undersea cable vulnerability as Russian spy ship spotted in British waters | The Record from Recorded Future News
 
 Questions grow over whether Baltic Sea cable damage was sabotage or accidental | The Record from Recorded Future News
 
 Researchers say new attack could take down the European power grid - Ars Technica
 
 At least $69 million stolen from crypto platform Phemex in suspected cyberattack | The Record from Recorded Future News
 
 BreachForums admin to be resentenced after appeals court slams supervised release | The Record from Recorded Future News
 
 Apple chips can be hacked to leak secrets from Gmail, iCloud, and more - Ars Technica
 
 Apple fixes zero-day flaw affecting all devices | TechCrunch
 
 I’m Lovin’ It: Exploiting McDonald’s APIs to hijack deliveries and order food for a penny
 
 Government websites vanish under Trump, from the Constitution to DEI
 
 Trail of Bits: Director, Technical Marketing
 
 Push Security: Security Researcher (remote in the USA)
 
 A new class of phishing: Verification phishing and cross-IdP impersonation

Risky Business #777 -- It's SonicWall's turn

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:

 • Russia’s FSB uncovers “NSA malware” on iPhones

 • Cl0p mass harvests data from MOVEit file transfer servers

 • ASD discloses a bunch of operations against ISIS, criminals

 • Why China’s prepositioning is probably… prepositioning

 • Much, much more

This week’s show is brought to you by Thinkst Canary. Marco Slaviero is this week’s sponsor guest and he joins us to talk about indirect LLM prompt injection and the latest Canary release.

Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.

 
 
 Show notes
 
 
 Russia says US hacked thousands of Apple phones in spy plot | Reuters
 
 Risky Biz News: Russia's FSB says NSA hacked iPhones in cyber-espionage campaign
 
 Russia wants 2 million phones with home-grown Aurora OS for use by officials
 
 Доверенная мобильная среда. Мобильная операционная система «Аврора» — Ростелеком
 
 Why China's Latest APT Campaign is Legitimately Worrying
 
 War crimes committed through cyberspace must not escape international justice, says Estonian president
 
 Hacks Against Ukraine's Emergency Response Services Rise During Bombings | WIRED
 
 How Australian cyber spies used 'Rickrolling' to disrupt Islamic State militants in Iraq - ABC News
 
 Australian intelligence's secret hand in bringing down the Bali bombers - ABC News
 
 Microsoft Threat Intelligence on Twitter: "Microsoft is attributing attacks exploiting the CVE-2023-34362 MOVEit Transfer 0-day vulnerability to Lace Tempest, known for ransomware operations & running the Clop extortion site. The threat actor has used similar vulnerabilities in the past to steal data & extort victims. https://t.co/q73WtGru7j" / Twitter
 
 What we know about the MOVEit vulnerability and compromises | Cybersecurity Dive
 
 metlstorm: "Great, so now I have to roll i…" - Infosec Exchange
 
 Dave Aitel: "@riskybusiness @chort honestly…" - Infosec Exchange
 
 Critical Barracuda 0-day was used to backdoor networks for 8 months | Ars Technica
 
 Millions of Gigabyte Motherboards Were Sold With a Firmware Backdoor | WIRED
 
 Ask Fitis, the Bear: Real Crooks Sign Their Malware – Krebs on Security
 
 Wayback Machine
 
 Discord Admins Hacked by Malicious Bookmarks – Krebs on Security
 
 Google’s Android and Chrome extensions are a very sad place. Here’s why | Ars Technica
 
 How university cybersecurity clinics can help cities fight ransomware | CyberScoop
 
 Atomic - Crypto Wallet on Twitter: "We have received reports of wallets being compromised. We are doing all we can to investigate and analyse the situation. As we have more information, we will share it accordingly. For any questions and concerns, contact support@atomicwallet.io" / Twitter
 
 BrianKrebs: "Russian news outlet Kommersant…" - Infosec Exchange
 
 Thinkst

Risky Business #709 -- Cl0p goes berserk with MOVEit 0day

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:

 • Fortinet 0day Groundhog Day

 • CISA’s new binding directive on exposed management interfaces

 • Confirmed: US intelligence buying commercially available data

 • MOVEit drama rolls on

 • Much, much more

This week’s show is brought to you by Red Canary. Chris Rothe is this week’s sponsor guest and he joins us to talk about how MDR providers are helping customers deal with cloud monitoring.

Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.

 
 
 Show notes
 
 
 Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks - SecurityWeek
 
 Barracuda Urges Replacing — Not Patching — Its Email Security Gateways – Krebs on Security
 
 MOVEit announces second vulnerability; Minnesota schools agency breached with original bug
 
 Confidential data downloaded from UK regulator Ofcom in cyberattack
 
 Ransomware group Clop issues extortion notice to ‘hundreds’ of victims
 
 Another huge US medical data breach confirmed after Fortra mass-hack | TechCrunch
 
 CISA orders US civilian agencies to remove tools from public-facing internet
 
 Microsoft says Azure disrupted after a week of repeated service outages | Cybersecurity Dive
 
 Microsoft says Azure outage was caused by ‘anomalous’ traffic spike
 
 Microsoft investigating threat actor claims following multiple outages in 365, OneDrive | Cybersecurity Dive
 
 Risky Biz News: Ukrainian hackers wipe equipment of major Russian telco
 
 U.S. Spy Agencies Buy Vast Quantities of Americans’ Personal Data, U.S. Says - WSJ
 
 The US Is Openly Stockpiling Dirt on All Its Citizens | WIRED
 
 Srsly Risky Biz: Thursday, July 29 - by Tom Uren
 
 National security officials make case for keeping surveillance powers to skeptical Congress - The Washington Post
 
 Senators say Biden administration isn’t close on overhauling surveillance law
 
 Russian nationals accused of Mt. Gox bitcoin heist, shifting stolen funds to BTC-e
 
 North Korean hacking group Lazarus linked to $35 million cryptocurrency heist
 
 North Korean hackers stole $100 million in recent cryptocurrency heist -analysts | Reuters
 
 An Illinois hospital links closure to ransomware attack
 
 Security professional's tweet forces big change to Google email authentication | CyberScoop
 
 Can you trust ChatGPT’s package recommendations?
 
 LastPass CEO reflects on lessons learned, regrets and moving forward from a cyberattack | Cybersecurity Dive

Risky Business #710 -- Why your corporate VPN will get you owned

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:

 • Albanian authorities raid MEK over Iran hacks

 • Microsoft admits “Anonymous Sudan” took down its services

 • US Government puts $10m bounty on CL0P

 • A deeper look at the Barracuda hack campaign

 • Much, much more

This week’s show is brought to you by Material Security. We’ll be hearing from one of Material’s friends – Courtney Healey, senior manager of insider threat at Coinbase – in this week’s sponsor interview.

Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.

 
 
 Show notes
 
 
 Police raid Iranian opposition camp in Albania, seize computers | AP News
 
 Risky Biz News: Microsoft embarrassingly admits it got DDoSed into the ground by Anonymous Sudan
 
 Anonymous Sudan and Killnet strike again, target EIB
 
 Pro-Russian hackers remain active amid Ukraine counteroffensive | CyberScoop
 
 Hackers infect Russian-speaking gamers with fake WannaCry ransomware
 
 US puts $10M bounty on Clop as federal agencies confirm data compromises | Cybersecurity Dive
 
 (1) Catherine Herridge on Twitter: "Tonight, sources tell @cbsnews senior government officials are racing to limit impact - of what one cyber expert calls - potentially the largest theft + extortion event in recent history. USG official says no evidence to date US MIL or INTEL compromised. https://t.co/R4f6naFqFx" / Twitter
 
 U.S. government says several agencies hacked as part of broader cyberattack
 
 Clop names a dozen MOVEit victims, but holds back details | Cybersecurity Dive
 
 Another MOVEit vulnerability found, as state and federal agencies reveal breaches | Cybersecurity Dive
 
 Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China | Mandiant
 
 New DOJ unit will focus on prosecuting nation-state cybercrime
 
 EU states told to restrict Huawei and ZTE from 5G networks ‘without delay’
 
 The US Navy, NATO, and NASA Are Using a Shady Chinese Company’s Encryption Chips | WIRED
 
 Widow of slain Saudi journalist Jamal Khashoggi files suit against Pegasus spyware maker
 
 Jamal Khashoggi’s wife to sue NSO Group over Pegasus spyware | Jamal Khashoggi | The Guardian
 
 Bipartisan bill would protect Americans’ data from export abroad
 
 District of Nebraska | Massachusetts Man Sentenced for Computer Intrusion | United States Department of Justice
 
 I Was Sentenced to 18 Months in Prison for Hacking Back - My Story | HackerNoon
 
 CID-FLYER-TEMPLATE
 
 New FCC privacy task force takes aim at data breaches, SIM-swaps | CyberScoop
 
 Bloodied Macbooks and Stacks of Cash: Inside the Increasingly Violent Discord Servers Where Kids Flaunt Their Crimes
 
 Russian National Arrested and Charged with Conspiring to Commit LockBit Ransomware Attacks Against U.S. and Foreign Businesses | OPA | Department of Justice
 
 BrianKrebs: "Haha love it when a data ranso…" - Infosec Exchange

Risky Business #711 -- Albanian authorities raid MEK camp over Iran hacks

In this conversation Risky Business host Patrick Gray speaks with SentinelOne’s Chris Krebs and Alex Stamos about what sort of cyber enabled interference we can expect in the 2024 US presidential race.

Alex was the CISO at Facebook during the 2016 election, and Chris Krebs was responsible for US election security as the director of CISA in 2020.

Watch the video version of this episode on Youtube.

Wide World of Cyber: 2024 election interference, the media and Iran's hack and leak

Lyt når som helst, hvor som helst

Other podcasts you might like ...