Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.
Similar Podcasts
The Cynical Developer
A UK based Technology and Software Developer Podcast that helps you to improve your development knowledge and career,
through explaining the latest and greatest in development technology and providing you with what you need to succeed as a developer.
Elixir Outlaws
Elixir Outlaws is an informal discussion about interesting things happening in Elixir. Our goal is to capture the spirit of a conference hallway discussion in a podcast.
ThunderCast
An inside look at the making of Mozilla Thunderbird, and community-driven conversations with our friends in the open-source software space.
Feature interview: ASIO Director General Mike Burgess on encryption and access
Mike Burgess is the director general of ASIO. But the thing about Mike is he’s actually a cybersecurity guy. He joined ASD, Australia’s NSA, back in 1995 when it was still the Defence Signals Directorate. He was there for 18 years before he bounced out to the private sector for a while to work as the CISO for Australia’s largest telco, Telstra. In 2017 he returned to ASD to run it, and in 2019 he was appointed director general of ASIO. Back in April, Burgess made a series of comments on the topic of encrypted messaging during a Press Club speech in Canberra. Our right to privacy, he said, is not absolute, and he implied that if certain providers didn’t start helping Australian authorities out a little more, he’d use some of the provisions in Australia’s Assistance and Access bill to force them to provide access to certain content. So I reached out to organise this interview to get some more detail from him about exactly what sort of cooperation he’s seeking and why.
Risky Business #760 – Microsoft to make MFA mandatory
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news including: Microsoft did a good thing! Soon all Azure admins will require MFA The three billion row National Public Data breach mess, courtesy Florida Man US govt confirms that it was Iran that hacked the Trump campaign Is TP-Link the next Huawei, or just not very good at computers? Major Chinese RFID card maker has hardcoded backdoors And much, much more. This week’s episode is sponsored by Specter Ops, makers of Bloodhound Enterprise. VP of Products Justin Kohler joins to talk about how they’ve joined their on-prem AD and cloud Entra attack path graphs, so you can map out that juicy, real-world attack surface. Show notes Announcing mandatory multi-factor authentication for Azure sign-in | Microsoft Azure Blog phishing resistant mfa - Google Search Microsoft will require MFA for all Azure users NationalPublicData.com Hack Exposes a Nation’s Data – Krebs on Security National Public Data Published Its Own Passwords – Krebs on Security Bloomberg Law How the government's proposed 'Trust Exchange' digital ID scheme would work - ABC News German Cyber Agency Wants Changes in Microsoft, CrowdStrike Products After Tech Outage - WSJ Joint ODNI, FBI, and CISA Statement on Iranian Election Influence Efforts — FBI Crypto firm says hacker locked all employees out of Google products for four days ZachXBT on X: "Seven hours ago a suspicious transfer was made from a potential victim for 4064 BTC ($238M)" / X Bitcoin News Today: $238 Million Bitcoin Heist Linked to Genesis Global Trading Routers from China-based TP-Link a national security threat, US lawmakers claim Hardware backdoors found in Chinese smart cards Unmasking Styx Stealer: How a Hacker's Slip Led to an Intelligence Treasure Trove - Check Point Research Hardware backdoors found in Chinese smart cards Man who hacked Hawaii state registry to forge his own death certificate sentenced to 81 months
Wide World of Cyber: 2024 election interference, the media and Iran's hack and leak
In this conversation Risky Business host Patrick Gray speaks with SentinelOne’s Chris Krebs and Alex Stamos about what sort of cyber enabled interference we can expect in the 2024 US presidential race. Alex was the CISO at Facebook during the 2016 election, and Chris Krebs was responsible for US election security as the director of CISA in 2020. Watch the video version of this episode on Youtube.
Risky Business #759 – Why Iran's hack and leak will amount to naught
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news and recap the best research presented at Black Hat and DEF CON in Las Vegas last week. They cover: Iran tries an election hack’n’leak like its still 2016 Crowdstrike takes home the Pwnie for Epic Fail at DEF CON UK healthcare SaaS faces six million pound fine for lack of MFA US circuit courts disagree on geofence warrants Our roundup of juicy Blackhat/DEF CON research And much, much more. This week’s episode is sponsored by Trail of Bits. CEO Dan Guido is fresh back from the DARPA AI Cyber Challenge at DEF CON, where the Trail of Bits team moved through into the finals. Dan talks through the challenge of finding, reporting and fixing bugs with AI systems. You can also watch this week’s show on Youtube. Show notes Trump campaign points finger at Iranian hackers for documents leak FBI says it's investigating efforts to hack Trump and Biden-Harris campaigns Iranian hackers ramping up US election interference, Microsoft warns State Dept puts $10 million bounty on IRGC-CEC hackers CrowdStrike snafu was a ‘dress rehearsal’ for critical infrastructure disruptions, CISA director says | Cybersecurity Dive Dominic White 👾 on X: "CrowdStrike accepting the @PwnieAwards for “most epic fail” at @defcon. Class act. https://t.co/e7IgYosHAE" / X Russia's Kursk region suffers 'massive' DDoS attack amid Ukraine offensive Elon Musk on X: "@markpinc Yeah" / X Progress Software says SEC declines to pursue action related to MOVEit exploitation spree | Cybersecurity Dive NHS software supplier Advanced faces £6m fine over ransomware attack failings Security bugs in ransomware leak sites helped save six companies from paying hefty ransoms | TechCrunch 5th Circuit rules geofence warrants illegal in win for phone users’ privacy | Ars Technica Customs and Border Protection agents need a warrant to search your phone - The Verge Hackers could spy on cell phone users by abusing 5G baseband flaws, researchers say | TechCrunch ‘Sinkclose’ Flaw in Hundreds of Millions of AMD Chips Allows Deep, Virtually Unfixable Infections | WIRED Downgrade Attacks Using Windows Updates | SafeBreach Listen to the whispers: web timing attacks that actually work | PortSwigger Research Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server! | DEVCORE Trail of Bits Advances to AIxCC Finals | Trail of Bits Blog
Soap Box: Making security tech more people friendly
In this sponsored Soap Box edition of the show we talk to Proofpoint’s Chief Strategy Officer Ryan Kalember about making security tech more people centric. We often talk about how we can use signals from users to drive some of our security tech. But what about using our security tech to drive user behaviour? Ryan thinks there are some opportunities here, particularly around identity security.
Risky Business #758 – Crowdstrike's postmortem underwhelms
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including: Crowdstrike talks loud in its postmortem, but says very little Digicert fears the CA-Browser Forum, gets lawsuit from a customer Dmitri Alperovitch joins the show to talk about the Russian prisoner swap Cloudflare continues to harbour scum and villainy Professional ransomware crew … is an improvement? And much, much more. This week’s episode is sponsored by Thinkst Canary. Marko Slaviero joins to discuss the unfashionable choice they made in hosting their platform one-VM-per-customer. Show notes CrowdStrike investors file class action suit following global IT outage | Cybersecurity Dive CrowdStrike rebukes Delta’s negligence claims in fiery letter | Cybersecurity Dive Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf Sparks fly when lawyers meet a certificate revocation crt.sh | Alegeus U.S. releases Russian hackers in Evan Gershkovich prisoner swap U.S. Trades Cybercriminals to Russia in Prisoner Swap – Krebs on Security Who are the two major hackers Russia just received in a prisoner swap? | Ars Technica Hackers remotely wipe 13,000 students’ iPads and Chromebooks after breaching safety software Mobile Guardian Device Management Application to be removed | MOE Ford wants patent for tech allowing cars to surveil and report speeding drivers I'm Sorry, Dave, You're Speeding | WIRED Cloudflare once again comes under pressure for enabling abusive sites | Ars Technica Low-Drama ‘Dark Angels’ Reap Record Ransoms – Krebs on Security Bumble and Hinge allowed stalkers to pinpoint users’ locations down to 2 meters, researchers say | TechCrunch Unfashionably secure: why we use isolated VMs – Thinkst Thoughts Defending AI Model Files from Unauthorized Access with Canaries | NVIDIA Technical Blog
Risky Business #757 – The ClownStrike cleanup continues
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including: The insurance industry’s reaction to CrowdStrike’s mess Google’s Workspace email validation flaw and its consequences for OAuth’d applications Is the VMWare ESX group membership feature a CVE or an FYI? Secureboot continues to under-deliver North Korea’s revenue neutral intelligence services And much, much more This episode is sponsored by allowlisting software vendor Airlock Digital. Airlock uses a kernel driver on Windows, so Chief Executive David Cottingham joined to discuss what the CrowdStrike kernel driver bug drama means for security vendors. This episode is also available on Youtube. If you want to ruin the magic of radio and see the faces behind the show, well, now you can! Show notes Business interruption claims will drive insurance losses linked to CrowdStrike IT disruption | Cybersecurity Dive Delta hires David Boies to seek damages from CrowdStrike, Microsoft CrowdStrike disruption direct losses to reach $5.4B for Fortune 500, study finds | Cybersecurity Dive (1145) Why CrowdStrike's Baffling BSOD Disaster Was Avoidable - YouTube CrowdStrike offers a $10 apology gift card to say sorry for outage | TechCrunch Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services – Krebs on Security Hackers exploit VMware vulnerability that gives them hypervisor admin | Ars Technica Microsoft calls out apparent ESXi vulnerability that some researchers say is a ‘nothing burger’ | CyberScoop AMI Platform Key leak undermines Secure Boot on 800+ PC models Chrome will now prompt some users to send passwords for suspicious files | Ars Technica Google Online Security Blog: Improving the security of Chrome cookies on Windows A Senate Bill Would Radically Improve Voting Machine Security | WIRED U.S. told Philippines it made ‘missteps’ in secret anti-vax propaganda effort | Reuters Cyber firm KnowBe4 hired a fake IT worker from North Korea | CyberScoop North Korean hacker used hospital ransomware attacks to fund espionage | CyberScoop North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs North Korean hacking group makes waves to gain Mandiant, FBI spotlight | CyberScoop ServiceNow spots sales opportunities post-CrowdStrike outage | Cybersecurity Dive Chaining Three Bugs to Access All Your ServiceNow Data Cyber Supply Chain Risk Management Conference (CySCRM) 2024 | Conference | PNNL
Wide World of Cyber: Why we should show CrowdStrike no mercy
In this episode of Wide World of Cyber, Risky Business host Patrick Gray discusses the recent CrowdStrike incident and its implications for security software that operates in kernel space with Chris Krebs and Alex Stamos of SentinelOne, a CrowdStrike Competitor. The conversation also delves into Microsoft’s role in this whole disaster and the potential changes it could make to its operating system to prevent similar incidents in the future. A video version of this episode is also available on Youtube!
Risky Business #756 -- Move fast and break everything
The Risky Biz main show returns from a break to the traditional internet-melting mess that happens whenever Patrick Gray takes a holiday. Pat and Adam Boileau talk through the week’s security news, including: Oh Crowdstrike, no, oh no, honey, no AT&T stored call records on Snowflake and you’ll never guess what happened next Squarespace buys Google Domains and makes a hash of it Some but not all of the SECs case against Solarwinds gets thrown out Pity the incident responders digging through a terabyte of Disney Slack dumps Internet Explorer rises from the grave, and it wants SHELLS RAAAAARGH SSHHEEELLLS And much, much more. This week’s show is brought to you by Sublime Security, a flexible and modern email security platform. If you’re sick of using a black box email security solution, Sublime is a terrific option for you. Show notes Risky Biz News: CrowdStrike faulty update affects 8.5 million Windows systems Low-level cybercriminals are pouncing on CrowdStrike-connected outage | CyberScoop CrowdStrike says flawed update was live for 78 minutes | Cybersecurity Dive Crooks Steal Phone, SMS Records for Nearly All AT&T Customers – Krebs on Security Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks – Krebs on Security Teenage suspect in MGM Resorts hack arrested in Britain Majority of SEC civil fraud case against SolarWinds dismissed, but core remains | Cybersecurity Dive How Russia-Linked Malware Cut Heat to 600 Ukrainian Buildings in Deep Winter | WIRED Kaspersky Lab Closing U.S. Division; Laying Off Workers Hackers Claim to Have Leaked 1.1 TB of Disney Slack Messages | WIRED Wallets tied to CDK ransom group received $25 million two days after attack | CyberScoop UnitedHealth’s cyberattack response costs to surpass $2.3B this year | Cybersecurity Dive Ransomware ecosystem fragmenting under law enforcement pressure and distrust Threat actors exploited Windows 0-day for more than a year before Microsoft fixed it | Ars Technica
Risky Biz Soap Box: Mike Wiacek on lazy mode threat hunting
This Soap Box edition of the show is with Mike Wiacek, the CEO and Founder of Stairwell. Stairwell is a platform that creates something similar to an NDR, but for file analysis instead of network traffic. The idea is you get a copy of every unique file in your environment to the Stairwell platform, via a file forwarding agent. You get an inventory that lists where these files exist in your environment, at what times, and from there you can start doing analysis. If you find a dodgy file you can do all the usual malware analysis type stuff, but you can also do things like immediately find out where else that file is in your organisation, or even where else it was. From there you can identify other files that are similar – variants of those files – and search for those. And you can unpack all this very, very quickly. This is the type of tool that EDR companies use internally to do threat hunting, but it’s just for you and your org – you can drive it. And as you’ll hear, the idea of a transparent, customisable and programmable security stack is something that’s on-trend at the moment. Mike lays out the case that doing this sort of file analysis in your organisation makes a whole lot of sense.
Wide World of Cyber: State directed cybercrime
In this podcast Alex Stamos, Chris Krebs and Patrick Gray discuss the relationship between cybercrime and the state, which is often more complicated than it should be. While the US Government and its allies fight the scourge of ransomware, other governments are using it to either raise revenue or irritate their foes. North Korea sees ransomware as a money spinner, while the Kremlin enjoys poking the west in the eye with it. Join us for a breakdown of the relationships between governments who should know better and the worst types of people on the planet.
Risky Business #755 -- SSH 0day! Polyfill drama! Entrust crushed!
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including: Widely used polyfill javascript gets hijacked by its new owners MacOS supply chain disaster bullet dodged That OpenSSH remote code exec OH MY <3 Entrust gets its CA business kicked to the kerb by Google South Korean telco intentionally viruses 600k customers Microsoft continues to deeply underwhelm And much, much more. This week’s episode is sponsored by Greynoise. Founder Andrew Morris joins to talk about ways to track attackers across NAT and VPNs, as well as how you can join in the fun of running an internet-scale honeypot network. Show notes Polyfill, Cloudflare trade barbs after reports of supply chain attack threatening 100k websites 3 million iOS and macOS apps were exposed to potent supply-chain attacks regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems (CVE-2024-6387) Google Online Security Blog: Sustaining Digital Certificate Security - Entrust Certificate Distrust TeamViewer: Hackers copied employee directory data and encrypted passwords South Korean telecom company attacks customers with malware — over 600,000 torrent users report missing files, strange folders, and disabled PCs | Tom's Hardware CDK eyes service restoration for all car dealers by Fourth of July ‘I don’t see it happening’: CISA chief dismisses ban on ransomware payments Patelco Credit Union ransomware attack halts banking services for nearly half a million members LockBit claims cyberattack on Croatia’s largest hospital Inside a Violent Gang's Ruthless Crypto-Stealing Home Invasion Spree Suspected Chinese gov’t hackers used ransomware as cover in attacks on Brazil presidency, Indian health org Nearly 4,000 arrested in global police crackdown on online scam networks USD 257 million seized in global police crackdown against online scams Microsoft alerts additional customers of state-linked threat group attacks Midnight Blizzard Microsoft Email Data Sharing Request: Legit? : r/Office365 Polish Parliament strips official of immunity, clearing path for prosecution in spyware scandal Stolen credentials could unmask thousands of darknet child abuse website users WA man set up fake free wifi at Australian airports and on flights to steal people’s data, police allege Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws iOS 17 lockdown mode blocking CarPlay? : r/ios
Risky Biz Soap Box: Why AI shouldn't really change your security controls
This is a sponsored Soap Box edition of the Risky Business podcast. Abhishek Agrawal is the CEO and co-founder of Material Security, an email security company that locks down cloud email archives. Attackers have been raiding mailspools since hacking has existed, and with those mailspools now in the cloud with services like o365 and Google Workspace, guess where the attackers are going? Material built a product that helps you lock up your email data, to archive and redact sensitive information. The idea is to really just limit what an attacker can do with email data if they pop an account. Abhishek joined me to talk about a few things, like how non phishing resistant MFA is basically dead, how email content is very useful to security programs, and about how the gen AI won’t really change much on the defensive control side.
Risky Business #754 -- Assange pleads guilty to espionage, walks free
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including: Julian Assange finally cuts a deal, pleads guilty, and goes free USA to ban Kaspersky - even updates Car dealer SaaS provider CDK contemplates paying a ransom Intolerable healthcare ransomware attacks continue We revisit Windows proximity bugs via wifi and bluetooth And much, much more. This week’s episode is sponsored by enterprise browser maker Island. Crowdstrike co-founder Dmitri Alperovitch is an investor in Island, and joins on its behalf to discuss why an enterprise browser is really starting to make sense. Show notes Julian Assange released from prison and has left UK, WikiLeaks says US to ban Kaspersky Lab software nationwide later this year Cyberattack on CDK Global stymies work at car dealerships across US Almost 200 cancer operations postponed as ransomware group publishes London hospitals data UK government weighs action against Russian hackers over NHS records theft South Africa’s national health lab hit with ransomware attack amid mpox outbreak Ransomware victims are becoming less likely to pay up | Cybersecurity Dive Lawmakers in Philippines push for probe into Pentagon's anti-vax propaganda operation | Reuters Telegram says it has 'about 30 engineers'; security experts say that's a red flag | TechCrunch Two bluetooth vulnerabilities in Windows Thread on reversing the patch Basic concept for the latest windows wifi driver CVE
Risky Business #753 – Congress and vuln researchers maul Microsoft
On this week’s retreat special, the entire Risky Business team is together in a tropical paradise for the first time. The team takes a break from the infinity pool to discuss the week’s security news: Microsoft recalls Recall, but why did it have to be such a mess And a Windows kernel wifi code-exec, really? Passkeys and identity are hard Scattered Spider bigwig arrested in Spain The pentagon runs a deeply flawed info-op Is it time E2E crypto nerds accept their place in the world? And much, much more. This week’s show is brought to you by Corelight… Corelight’s CEO Brian Dye will be along in this week’s sponsor interview to make a really compelling case for something that shouldn’t exist… which is NDR in cloud environments. Show notes Microsoft shelves Recall feature release after security uproar Microsoft’s Recall puts the Biden administration’s cyber credibility on the line | CyberScoop Microsoft’s cybersecurity vulnerabilities endanger America US lawmakers grill Microsoft president over China ties, hacks | Reuters Microsoft Refused to Fix Flaw Years Before SolarWinds Hack — ProPublica CVE-2024-30078 - Security Update Guide - Microsoft - Windows Wi-Fi Driver Remote Code Execution Vulnerability Security bug allows anyone to spoof Microsoft employee emails | TechCrunch Patrick Gray on X: "I was wrong about some things I said about iCloud accounts in this week’s show and I’ll tell you all exactly how I was wrong in next week’s show" Passkeys in Microsoft Authenticator and Entra ID Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED MFA plays a rising role in major attacks, research finds | Cybersecurity Dive Luke Jennings on LinkedIn: saas-attacks/techniques/ghost_logins/description.md at main ·… Alleged Boss of ‘Scattered Spider’ Hacking Group Arrested – Krebs on Security EXPOSED: Identities of Iranian Hackers Targeting Israel and Other Countries Revealed | Matzav.com Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating | Ars Technica Windows flaw may have been exploited with Black Basta ransomware before it was patched Crown Equipment Corporation victim of a Ransomware attack | Born's Tech and Windows World City governments in Michigan, New York face shutdowns after ransomware attacks Cleveland confirms ransomware attack as City Hall remains closed Authorities investigating extended ‘network outage’ at organization that runs TheBus Pentagon ran secret anti-vax campaign to incite fear of China vaccines Shashank Joshi on X: "Just finished “Information Operations”, a new book by @TathamSteve. Includes this anecdote on a British effort to stop children throwing stones at a base in Afghanistan. “LRGR was the abbreviation for the Long-Range Gonad Reducer.” https://t.co/zmoxb45Cgz" Dmitri Alperovitch on X: "@shashj They also allegedly hacked the email of the lieutenant leading the medical service of the 960th unit and retrieved the medical certificates of 150 officers and enlisted personnel" Signal president Meredith Whittaker criticizes EU attempts to tackle child abuse material