Podcasts

Today we’re chatting with Citizen Lab Senior Researcher John Scott-Railton about the work they did investigating the Indian hacker-for-hire firm BellTrox.

For those of you who didn’t catch the news, The Citizen Lab, which operates out of the Munk School of Global Affairs at the University of Toronto, dropped a huge report a couple of weeks back that lays Belltrox’s operations bare. As you’ll hear this company attempted to hack tens of thousands of email accounts belonging to everyone from government officials to hedge fund managers and activists.

On this week’s show Patrick and Adam discuss the week’s security news, including:

• Facebook commissioned custom 0day to de-cloak child sex predator
• IP stack bugs to plague IoT, ICS for years
• Sandworm was doxxed by the NSA and hardly anyone noticed
• Congress demands answers on 2015 Juniper NetScreen back door investigation
• Amazon, Microsoft join moratorium on sale of facial recognition to police
• Much, much more

Threat hunters studying the IoCs released in the NSA’s May 2020 advisory on recent Sandworm activity have used them to identify a large amount of infrastructure that looks custom-made to conduct credential phishing attacks against email and social media accounts used in Western countries.

On this week’s show Patrick and Adam discuss the week’s security news, including:

• Full scale of Indian hacker-for-hire firm revealed
• IBM exits facial recognition
• Contact tracing apps flop
• Much, much more

Researchers have exposed gaps in the security and privacy design of OmniBallot - another online voting system used in the United States. It has no privacy policy, and curiously sends user voting preferences to a central server even when a user chooses to print out a completed ballot to return by mail.

There are sound reasons why anxious governments are tasking signals intelligence services to track the progress of COVID-19 vaccines and treatments.

The Soap Box podcasts we run here at Risky.Biz are wholly sponsored affairs – everyone you hear in a soap box podcast, paid to be here.

The idea is vendors get to come on to the show and chat about their products, what their stuff does, the thinking behind it, so on and so on.

Today we’re hearing from Justin McCarthy of strongDM.

strongDM is a bit of a niche player – essentially what they do is make a product that provisions secure access to engineers who need to access various back end services.

On this week’s show Patrick and Adam discuss the week’s security news, including:

• Google TAG implicates Indian hacker-for-hire outfits in espionage
• NSA warns of Sandworm Exim exploitation
• Huawei CFO extradition process to continue
• Black lives matter
• F–k police brutality

The NSA warns that Sandworm, one of Russia’s most formidable offensive cyber operations, has been exploiting a known flaw in the Exim mail transfer agent (MTA) in attacks for at least 10 months. Sandworm - part of Russia’s GRU intelligence unit - were fingered for NotPetya and crippling wiper attacks on Ukraine’s power grid. You don’t want these guys up in your business.

When litigants suing Capital One sought a forensic incident response report into its 2019 data breach, the bank played a reliable card: the report was commissioned by its outside law firm, and therefore subject to attorney-client privilege.

In a surprising move, this week a US District Court rejected the bank’s claim to privilege and demanded the document be handed over, in what appears to set an unsettling precedent.