Srsly Risky Biz: The problem with big tech

PLUS: Know Your Customer and the malicious use of cloud infrastructure

In this podcast Tom Uren and Adam Boileau talk about how there is a growing consensus between regulators and lawmakers on the key problems of modern tech companies.

They also dive into how to deal with malicious foreign actors buying their way onto domestic cloud infrastructure and how drones are actually just like modern cars.

Risky Business #746 – Microsoft takes your security seriously*

PLUS: Governments vs Tech, FIGHT!

On this week’s show Patrick and Adam discuss the week’s security news, including:

  • Microsoft reassures* us that they take security very seriously*
  • Cisco ASA firewalls get sneakily backdoored, but no one’s quite sure how
  • Change Healthcare was 1FA Citrix all along
  • The FTC, FCC and other government sticks get waved at tech
  • Lizard Squad Finn who hacked the Vastaamo therapy chain gets sentenced
  • And much, much more.

This week’s sponsor is Zero Networks, who make a network micro-segmentation product that is actually usable. Zero Networks CEO Benny Lakunishok joins us to talk through why firewalling everything everywhere is finally workable.

* You’ll forgive us for being… a tad sceptical.

Between Two Nerds: Busting 0day Myths

0days don't get burnt, just democratised

In this edition of Between Two Nerds Tom Uren and The Grugq look at the life cycle of 0days, dissect the conventional wisdom and talk about how 0days are never truly ‘burnt’.

Snake Oilers: Push Security, Knocknoc and iVerify

Get real identity security, protect your border devices, catch Pegasus...

In this edition of Snake Oilers we’ll be hearing from:

  • Push Security: A browser plugin-based security company that combats identity-based attacks. (Much more compelling that it sounds in this description.)
  • Knocknoc: The tool Risky Business uses to protect our own applications and services. (Restrict network/port access to users who are authenticated via SSO.)
  • iVerify: Mobile security and threat hunting for iOS and Android. (Caught Pegasus in the wild!)

Risky Biz News: Cyber Partisans hack Belarus KGB

PLUS: Avast gets a €14 million GDPR fine; new Pathfinder side-channel attack; Ukrainian hackers wipe another Russian telco.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird. You can find the newsletter version of this podcast here.

Sponsored: Open source software's increasing vulnerability

Socket CEO Feross Aboukhadijeh on how to defend open source

In this Risky Business News sponsored interview, Tom Uren talks to CEO and founder of Socket, Feross Aboukhadijeh about the open source software and supply chain security. Feross says the software ecosystem has evolved in ways that make it more vulnerable to trust-based attacks (such as seen in XZ Utils) and discusses what can be done to defend against this type of supply chain subversion.

Risky Biz News: Cisco zero-day fun time is here!

PLUS: PlugX USB worm infects 2.5 million devices.; El Salvador crypto-service hacked; US takes down another crypto-mixing service.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Patrick Gray. You can find the newsletter version of this podcast here.

Srsly Risky Biz: Sandworm an inspiration for hostile actors

PLUS: Who's number one on the World Cybercrime Index?

In this podcast Adam Boileau and Tom Uren talk about what there is to learn from Mandiant’s report into the GRU Sandworm crew. Are the Russians a model for other actors, or just a get-‘er-done bunch of pragmatists?

They also talk about an attempt to build a World Cybercrime Index, assessing different national cybercrime specialisations.

Special Edition: Chris Krebs, Alex Stamos and Patrick Gray

A conversation about tech supply chains and sovereignty...

In this special edition of the Risky Business podcast Patrick Gray chats with former Facebook CSO Alex Stamos and founding CISA director Chris Krebs about sovereignty and technology.

China and Russia are doing their level best to yeet American tech from their supply chains – hardware, software and cloud services. They’ll be rebuilding these supply chains – for government systems, at least – from components that they have complete visibility into, and control over.

Meanwhile, America’s government faces different supply chain challenges. It has a supply chain that won’t be weaponised against it by its adversaries, but it lacks the same sort of visibility and control that its adversaries will eventually achieve over their supply chains. So where does this leave the west? Where does it leave China and Russia?

Sponsored: Pushing back the frontiers of vulnerability research

Trail of Bits' Dan Guido on DARPA's AI cyber challenge

In this Risky Business News sponsored interview, Tom Uren talks to Dan Guido, the CEO of security research company Trail of Bits. Dan and Tom discuss DARPA’s upcoming AI cyber challenge, in which Trail of Bits will compete to solve very difficult bug discovery challenges. They also talk about Trail of Bits’ approach to making some of its own tools available to the community.

Risky Biz News: Authorities take down LabHost PhaaS

PLUS: Akira ransomware group made $42 million in a year; "highly profitable trader" found guilty at trial; Kubernetes clusters hacked via OpenMetadata bugs.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu and read by Claire Aird. You can find the newsletter version of this podcast here.

Srsly Risky Biz: Why the compromise of open source projects is inevitable

PLUS: Microsoft dependency is a strategic risk

In this podcast Patrick Gray and Tom Uren talk about how open source software is inherently vulnerable to malicious ‘good samaritan’ attacks and what to do about it.

They also talk about a recent breach at data analytics company Sisense, how dependency on Microsoft is a strategic risk, and US Cyber Command’s view of the world.