Risky Business - Risky Business #810 -- Data extortion attacks have a silver lining

Starting point is 00:00:00 Hey everyone and welcome back to risky business. My name's Patrick Gray and yeah, I'm on deck again after a couple of weeks off. I had a terrific break and consider myself extremely lucky that I can take basically all of the school holidays off to hang out with my kids. One of the reasons I was able to do that this break is because Amberly Jack stepped in for me to fill in for me and host the first ever edition of risky business that didn't have me in it and she did a terrific job so I just wanted to start today's show by saying Amberly thank you so much for doing that and yeah universally awesome feedback as well and you know the week before that Adam was away so this is our first show together in like

Starting point is 00:00:45 four weeks which is yeah so it's cool we've missed it so we're back on deck before we get into it though just one thing I wanted to mention this week is we are hiring we're probably not really looking to urgently onboard anyone but we are looking for someone to join us who can act as an interviewer and as a podcaster and someone who's also got you know plenty of knowledge about cyber security and you know the products that make up the cyber security industry if this is something that you are interested in doing if you want to apply to work with us we're most interested in people who are based anywhere from the east coast of Australia to

Starting point is 00:01:25 the west coast of the United States New Zealand pretty much the perfect location time zone wise. So if you want to apply to that for that just email your resume to editorial at risky.biz and include a video of yourself and this can just be shot straight into a into a phone like self-shot video explaining to us what you think a big problem in enterprise security is and that'll just give us a sense of how you speak to a camera, how you speak to a microphone. So yeah if it's something you're interested in pursuing do get in touch with us and yeah On to this week's show now, and this week's show is brought to you by Stairwell.

Starting point is 00:02:03 And Mike Weiasek, who is the founder of Stairwell, will be along in this week's sponsor interview a little bit later on talking about how a bunch of people these days are licensing the Stairwell API and they're using it for Seam enrichment much in the same way that people would use virus total. So that is an interesting conversation and it is coming up later. But first up, of course, it is time for a check of the week's security news with Adam. missed you dude no well it's good to be back like there's a lot of

Starting point is 00:02:30 lot of interesting stuff to talk about some great bugs too which I always enjoy yeah it's funny right we got a we got a whole bug section at the end of the show but like a big thing that's been happening I guess really all year

Starting point is 00:02:42 but it seems to have hit fever pitch at the moment is just all of these data extortion attacks right so we've got clop going nuts with some oracle bugs and then we've got what are they calling

Starting point is 00:02:53 they're calling themselves ironically what is it the lapsis shiny scattered hunters scattered lapsus hunter yeah so like the com with its usual kind of set of hats on yes yeah yeah and a sense of humor about it and they've been going around and what socially engineering people's sales force data that's been obviously happening for months now but some of that data is now starting to leak big news here in australia where uh quantis data on like 5.7 million customers or something i'd be one of them uh has leaked but look it's just i mean it's just mayhem out there right yeah yeah it really

Starting point is 00:03:24 is. And we're, you know, the kind of stuff happening in so many directions. We've seen, you know, some new data leaks that's coming up with data that previously we hadn't seen publicized, you know, some arrests, some kind of doxing generally of Com kids. But yeah, it's a real mess out there. Yeah, so we've seen this FBI take down of yet one more breach forums, right? So it's breach forums, not breached forums, and I don't know if there's like 17 of these as well, as they were with breach forums. What do we know here? So this was a leak site that was being set up to distribute data from Salesforce. They called it breached forums, or breach forums, which I think is just at this point

Starting point is 00:04:05 basically a running joke because it'll just confuse us, poor pundits, you have to talk about it. But they were going to stand up, Scatter Spider crew, the comm crew, whoever, were going to stand up a site to release a bunch of data. They'd set up a clear net and a dark website. That got seized by the FBI, or at least take it. you know, the FBI seized banner put on top of it. It looks like they had compromised the servers behind it because it was also the onion site, the dark web site was also,

Starting point is 00:04:36 had been defaced, I guess, defaced by law enforcement. Since then, the kids have, you know, kind of taken back their onion site. I think the clear web one, the domain is long gone, the registrarers pulled it or whatever. So, yeah, they were setting up to leaks and data, got kind of gazumped by the FBI. And, you know, that may have set it back a little bit, but I'm sure we'll see the data come out, nevertheless. I mean, this is something that occurred to me when the news first broke here about the Qantas data leaking,

Starting point is 00:05:02 which is that somewhere in government, someone was signing a piece of paper authorising ASD, AFB, joint task forces or whatever, to go and destroy that data, right? Like, search and destroy for large corpuses of data, you know, leaked in a country like Australia, like that is going to result in shells getting popped. Like, that's down a policy right now. And I just thought that, you know, that my mind went there immediately on hearing the news. I thought, you know, I just found that interesting. Yeah, it's certainly, like the world has changed a little bit around, you know, both data extortion

Starting point is 00:05:33 and, like, I guess the impact that has on the wider ransomware, you know, like locking things up for ransom. But, yeah, like that kind of calculus is different than perhaps it would have been five or six years ago. And the idea that, you know, we see law enforcement, you know, showing up in leak sites and spooks in some case, you know, going around and destroying data. Like, it's a, it's an interesting development. And, you know, it's probably still better than ransomware. I think it makes more sense than the other way around, right? Like, I never thought it made sense that you would have, like in the case of Qantas,

Starting point is 00:06:04 it's a very important company that used to be, I think it was state owned, right, at some point, and then privatized. And, you know, it's a very big deal. And the idea that someone would steal heaps of customer data and just post it and the government would just go, ah, well, you know, what are you going to do? Like, that's the part that seemed crazy. I think the idea that we've got authorities like really actively, aggressively and quickly going after this sort of leak data, that's a good thing.

Risky Business - Risky Business #810 -- Data extortion attacks have a silver lining

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.