ConversingLabs Podcast: Recent Episodes
ReversingLabs
ConversingLabs Podcast brings you conversations with the best and brightest minds in malware analysis, threat hunting, incident response and software assurance. Hosted by Paul Roberts, Cyber Content Lead at ReversingLabs, ConversingLabs digs into cutting edge topics that
In this episode of ConversingLabs, host Paul Roberts chats with Thomas Pace, the CEO & co-founder of the firmware security firm NetRise. Thomas and Paul talk about the shifting ground of threats and attacks as the Internet of Things grows and works its way into homes, businesses and industries - including critical infrastructure. They also talk about the growing specter of software supply chain threats and attacks.
In this episode, host Paul Roberts chats with Robert Martin of MITRE and Cassie Crossley of Schneider Electric about their session at this year’s RSA Conference. They explained how MITRE’s System of Trust can serve as a standard for software supply chain risk. The two also chatted with Paul about the greater issues facing software supply chains today, such as standardization and transparency.
In this episode, host Paul Roberts chats with Naveen Srinivasan, an OpenSSF Scorecard Maintainer, about his talk at this year’s RSA Conference on how to better trust open source software. In their conversation, Naveen explains how the OpenSSF Scorecard tool can help developers understand the security posture of open source dependencies.
The exploit known as Follina resurfaced in late May 2022 as researchers discovered its use in a phishing document campaign. ReversingLabs Malware Researcher Joseph Edwards hunted for Follina exploitation samples to observe what final payloads are being delivered in-the-wild.
He joins host Paul Roberts for this episode of ConversingLabs to share his findings and key takeaways. He also shares how your organization can defend itself against the exploit.
YARA rules have been a proven tool for threat detection and hunting. Organizations who want to be mindful of today’s most serious threats, such as wiper malware and ransomware, should be leveraging this tool however they can.
For this episode of ConversingLabs, we invited ReversingLabs Malware Researcher Hrvoje Samardžić plus Roman Hüssy of Abuse.ch, who told us about his company’s platform: YARAify. These two experts will also show how organizations can deploy YARA rules to benefit their threat analysis operations.
In this special edition episode, ConversingLabs host Paul Roberts interviewed researchers Iain Smart and Viktor Gazdag of NCC Group from the showroom floor at Black Hat 2022. Paul chatted with the researchers about their Black Hat session on compromises to CI/CD pipelines, being an integral part of software supply chain security.
A systemic issue impacting the cybersecurity community is the theft and unauthorized use of algorithms by corporate entities. This is an issue that Patrick Wardle, Founder of the Objective-See Foundation, has brought to the forefront as a speaker at this year’s Black Hat USA Conference.
His talk at Black Hat presented the techniques to spot unauthorized use, and he referenced these techniques in real-world examples. We chatted with Wardle about this systemic problem at large, and how the industry should move forward to minimize this issue.
At this year’s Black Hat Conference in Las Vegas, software supply chain security was top of mind for the InfoSec community. One of the biggest obstacles to improving the security of organizations and critical infrastructure is the poor state of software security. Alas: training developers to produce secure code is expensive, and time intensive. Or is it?
At this year’s conference, Adam Shostack, President of Shostack & Associates, described a new approach to scale secure development training and educate a developer workforce, keeping time and financial restraints in mind. We chatted with him one-on-one to learn his insights in this special edition episode.
ReversingLabs recently discovered a software supply chain attack known as IconBurst. This incident is a widespread campaign, consisting of the installation of malicious NPM modules that are harvesting sensitive data from forms embedded in mobile applications and websites.
Karlo Zanki, a Reverse Engineer at ReversingLabs, was the first to discover the attack. We invited him to join us for the second episode of ConversingLabs Season 2 to discuss his findings.
Learn more about IconBurst here: https://blog.reversinglabs.com/blog/iconburst-npm-software-supply-chain-attack-grabs-data-from-apps-websites
AstraLocker is a fork of the Babuk ransomware family. Babuk is a past Ransomware-as-a-Service (RaaS) threat group, selling ransomware tools to affiliate cybercriminals. AstraLocker 2.0 was first seen in March 2022, but new research has surfaced about its capabilities.
ReversingLabs Malware Researcher Joseph Edwards joined us for the first episode of ConversingLabs Season 2 to share his findings on AstraLocker. He also shared what organizations need to know to stay vigilant of this active cyber threat.
Bryson Bort of Scythe.io spoke with host Paul Roberts about the May 2021 Colonial Pipeline hack that caused a fuel shortage on America's southeastern coast. Bort tackles the question: “What the hell happened?” He mentions that the incident truly was a “watershed moment” for the industry, since this ransomware attack directly impacted the lives of everyday Americans.
But the bigger picture on Colonial also includes years of ignored warnings about the possibility of just such an attack. Now that the attack has happened, however, Bort worries that the cybersecurity industry is stuck in their echochamber trying to understand it, rather than conversing with other key players to get a better picture of this incident.
In this conversation, Steve Lipner of SAFECODE explains what secure software is, and recounts his own experiences on Microsoft’s Software Security Development Lifecycle Team as the point of the spear in Microsoft’s Trustworthy Computing Initiative. Lipner stresses that secure software must come from within (so to speak). Outside consultants may be able to promote best practices, but they will never be able to grasp what needs fixing. That’s why an organization’s developers need to be trained and motivated to write secure code, which means seeing mistakes as they write code and throughout the entire development process.
Lipner also talks about the Biden Administration’s Executive Order (EO) on Improving the Nation’s Cybersecurity, released in May 2021. Lipner believes that the impact of the EO is still a work in progress. He’s particularly a “fan” of Section 4 of the EO, which lists the requirements for a robust software security program.
In this conversation, Robert Martin of MITRE talks about how the software supply chain is highly complicated, due to an increasing number of things in society becoming cyber-enabled. He and MITRE created the System of Trust (SoT) so that organizations can consider the most important aspects of the software supply chain, giving a more holistic context into the chain’s subsets. The SoT’s goal is to promote transparency, allowing developers to see all of the players in the supply chain.
Martin explained how software is not written neatly end to end, but rather is built with drivers, dependencies, and frameworks that give the supply chain depth and magnitude. If software practitioners are not given visibility into this complicated picture, they will miss the software supply chain risks that pose a threat to their organizations. He stresses that Software Bills of Materials (SBOMs) should be included in this effort, but that practitioners should refer to the SoT in order to best utilize an SBOM, giving them the best chance of mitigating software supply chain risks.
NPM dependency confusion has emerged as a potent software supply chain attack vector via platforms like npm, with malicious packages surreptitiously added to these repositories, maintained by leading firms.
In this episode, we're joined by ReversingLabs Reverse Engineer Karlo Zanki to dig into some of our recent findings that show dependency confusion attacks are being used to advance what appear to be targeted supply chain attacks. We will also talk about how development organizations can monitor for and prevent these kinds of attacks.
Even small organizations are sitting on top of a wealth of threat intel: their own IT environment. It’s essential for enterprises of all kinds to understand how to tap into this intelligence to better protect their operations.
In this episode, we chatted with ReversingLabs’ very own Hrvoje Samardžić and Independent Malware Hunter Luigi De Mori/JAMESWT (@JAMESWT_MHT) about what kinds of internal threat intelligence are the most useful, where to find it, and how to leverage this data to improve your organization’s defenses.
Emotet is one of the most prolific pieces of malware on the Internet. What started as software designed to hijack online banking sessions is now a Swiss Army Knife of ill intent, including features for botnets, spam distribution and malicious downloads.
Even worse, Emotet has been embraced by one of the Internet’s most dangerous groups: Conti (aka Wizard Spider), the Russia-based ransomware outfit responsible for more than 1,000 attacks worldwide. That means detecting this threat could be your best chance to stop a devastating ransomware attack in its early stages.
In this podcast, we dig deep on the Emotet malware with two noted experts: Dado Horvat of ReversingLabs and Dragan Damjanovic of KPMG to talk about the evolution of the threat and the latest Emotet IOCs.
The Conti ransomware group —a.k.a. Wizard Spider; a.k.a. TrickBot; a.k.a Ryuk—is one of the most prolific ransomware gangs around. It is believed to have been active, in various incarnations, since about 2016. Just in the last year, Conti is believed to be responsible for high profile attacks, including the city government in Tulsa, Oklahoma and Ireland's Health Executive service in May, 2021.
Even as leading ransomware groups like REvil and Darkside have folded in recent months, Conti is getting renewed attention from cybersecurity experts. The group, CISA warns, has been linked to more than 1,000 attacks on U.S. and international organizations while “Conti cyber threat actors remain active.”
Why? In our latest episode of the ConversingLabs Podcast, ConversingLabs host Paul Roberts sat down with Yelisey Boguslavskiy, a co-founder of the threat intelligence firm AdvIntel, to talk about Conti’s evolution in recent years, and why the group continues to be such a potent threat.
According to Boguslavskiy, Conti’s continued vitality reflects a long-running practice of tightly controlled and highly vertical business operations. That runs counter to the predominant “ransomware as a service” model of “quantity over quality:" farming work out to pretty much anyone interested in making a buck and counting on a small number of scores from a large base of attacks. “This is something Conti never really followed in their methodology,” Boguslavskiy said.
Even before Russian tanks began rolling across Ukraine’s borders on February 24, the cyber war on the country had begun. In the days before the kinetic war began, a string of attacks battered Ukrainian government, defense and civil society websites and networks. Among them: massive denial of service attacks and targeted malware attacks.
In this episode of ConversingLabs, host Paul Roberts speaks with Mislav Boroš, a malware analyst at ReversingLabs about HermeticWiper and IsaacWiper, two novel pieces of malware deployed against targets in Ukraine in the lead up to- and early days of Russia's invasion.