It's been a while huh? Apologies for our absence, but the team are back with a run through of everything we've got going on at Black Hat - from our 10 year birthday celebrations, the interesting lightning talks in our booth, and Joe Marshall's "Backdoors and Breaches" game. Come and visit us at Cisco Booth 1732 and Splunk Booth 1940.Before that, Matt encourages Mitch and Lurene to join him in the joy of Tekkno Train by Electric Callboy (Choo Choo!) and Mitch explains why his son has developed a huge potty mouth, with no sense of irony. Lurene also reveals insights into creating a university curriculum for cyber weapons development.Stick around for an illumunating discussion on how AI could affect a Furby. Just don't google "Long Furbie". You just googled it didn't you? Ah man, we warned you...

Power grid security expert Joe Marshall joins the crew today to talk all things, well, power grid security. But not before he gets an impromptu pop quiz from Matt in the roundtable.Joe then tells some stories from his days working in electric utility,  deploying new systems and his experiences with pentesting teams ("Wow, y'all need to stop!"). Plus, the team ask Joe about  the risks with both aging infrastructure versus newer, smarter based infrastructure. And what happens when threat actors target critical infrastructure?

Matt, Mitch and Lurene discuss if the internet is better or worse today than it was 20 years ago.  This leads them to discuss their various career paths, with Lurene talking about how she got into vulnerability exploitation and how Matt got into threat intelligence. And why neither of those paths would be recommended today. Lurene and Matt then clash about threat research and and the importance of approaching things from a "how do I be a problem" perspective.

You will no doubt have seen the advisories published over the last few weeks concerning Volt Typhoon's malicious activities. In this episode, JJ Cummings joins the crew to discuss the background to this threat actor, their impact on the threat landscape, and the covertly strategic (and specific) nature of their operations. The team also discusses their recommendations for defenders, particularly for critical infrastructure organizations.The CISA statement on Volt Typhoon can be found here https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a

Matt, Mitch and Lurene sit down to discuss “random stuff from Reddit” (don’t be put off – they’re all genuinely interesting security questions!). Topics range from password managers and how password security guidance has become outdated, how to ‘self-learn’ in cybersecurity, and thoughtful approaches towards security incidents. Before that, the team comes up with a prank to pull on their co-workers and bring some joy and chaos to Webex meetings. And Lurene reflects on what advice she would give high schoolers today. As Matt says at the end of the episode, we want to hear from you! Get in touch at [email protected]'s the video 'Hi Ren' that Matt mentions at the outset https://www.youtube.com/watch?v=s_nc1IVoMxc

Mitch, Matt and Lurene were almost about to be in the same physical space at the same time to record an episode, and then Lurene couldn't make it...so we made this instead! Mitch is joined by Azim Khodjibaev from the Talos Threat Intelligence and Interdiction team to rapid-fire interview a bunch of Talos employees who happened to be around the Maryland office. Hear from teammates from all walks of life and areas of expertise about what they've loved working on in 2023 and how they feel their work has changed the broader security landscape. 

We recorded this episode AFTER Thanksgiving, so you'll need to forgive us for the amount of Thanksgiving talk that doesn't actually apply until Thanksgiving 2024. It all evens out in the end because the annual "Ranksgiving" from special guest David Liebenberg results in the creation of TurkeyLurkey Man. Then, TurkeyLurkey Man helps the rest of the gang recap the top malware and attacker trends from 2023. If you'd like to read more, download the full Talos Year in Review report here. We also discussed the recent CNN article and Talos blog post on our work to protect Ukraine's power grid. 

It's that time of the quarter again when we sit down to look at what we learned over the past three months. Caitlin Huey from the Talos Threat Interdiction Team joins the show for this special look at the latest Talos Incident Response Quarterly Trends report. Caitlin's team helps compile these reports and digs through mountains of data to find out what defenders can learn from what Talos IR is seeing live in the field. If you want to learn more about this report, you can read it on our blog, or watch the Talos IR On Air video here.

This episode of Beers with Talos has a very special guest: Our old friend Nigel Houghton. He's one of the OG BWTers and is back with two-plus years' worth of hot takes to get off his chest. Nigel starts out by delivering his long-awaited update on his beloved Mighty Red. But he, Mitch, Matt and Lurene do eventually get to cybersecurity talk, including things like:The challenge of keeping mountains of cybersecurity data and sharing it with partners.The importance of context around that data when it is shared.How better context leads to better detection methods.Weird Elon Musk guys. 

We know we're like two weeks late to the Barbie party, but the whole Beers with Talos crew has seen it now so we had to talk about it. Expect a lot of "Barbie" talk up at the top. After that, though, we dive into how to set up deception systems and establish your environment to make it harder for an intruder to get in. The goal here is to make it so that attackers have to waste time and resources trying to get in but ultimately come away empty-handed. We talk about why this is important for the systems we build and why the security community doesn't talk enough about this approach. 

In this special episode, Matt is flying solo while he interviews Rachel Tobac, the CEO of SocialProof Security. Rachel's company helps individuals and companies keep their data safe by offering various training and penetration testing opportunities, all related to social engineering attacks and risks. Ahead of BlackHat and DEFCON, Matt wanted to talk to Rachel because they first met at DEFCON a few years ago, where she was a second-place finisher in the Social Engineering Capture the Flag contest for three years in a row. Matt and Rachel discuss the current types of social engineering tactics that adversaries use and the importance of increasing the volume and types of opportunities that exist for women in cybersecurity and privacy. Rachel is the chair of the board for the non-profit Women in Security and Privacy (WISP) where she works to advance women to lead in the fields. She's currently working on sending a delegation of women to BlackHat later this month. 

The Beers with Talos Crew is back to a team of four this week, with special guest Nick Biasini joining the show to talk about Mercenary Groups and the spyware they're creating. This episode, we talk about the current spyware landscape, and how it encompasses "mercenary" groups like the NSO Group and Intellexa, and state-sponsored actors looking to track high-profile targets. Nick's team recently published multiple pieces about this topic and they are actively researching spyware. If listeners suspect their system(s) may have been compromised by commercial spyware, please consider notifying Talos’ research team at [email protected] to assist in furthering the community’s knowledge of these threats.

Mitch was out for this recording, so Hazel Burton, the newest addition to Team Talos, stepped in to host this episode! She, Lurene and Matt got together for Mental Health Awareness Month and share stories and advice with one another. Cybersecurity is a notoriously rough field for burnout and an imbalance between work and life, so they share some tips they use to decompress after a long day and how they ignore their inner critics. 

Our second of two episodes recorded live at the RSA Conference, Mitch and Lurene are joined by Nick Biasini from Talos Outreach and AJ Shipley, a vice president of product management for Cisco Secure. The four of them recap Nick and AJ's talk they gave at RSA and discuss the centralization of cybersecurity. AJ shares some important insights about the product side of cybersecurity, and how everyone in the space needs to be better focused on stopping the bad guys versus competing against one another. They also cover the announcement of Cisco's newest flagship cybersecurity product: Cisco XDR.

This is the first of two episodes we have coming out that we recorded live at the RSA Conference. In this edition of Beers with Talos, we welcome Mick Baccio, a security strategist for Splunk, to talk about all things RSA. At this point in the week, we had hit the halfway point of RSA and were pretty tired already, so bear with us — don't expect any hardcore security takes here. That being said, we do gather 'round to share stories, and reflect on RSA and the security community as a whole. There's no link for it yet, but buy Mick's book when it comes out! 

This episode discusses network resilience, hardware hygiene, and the recently disclosed Jaguar Tooth campaign. J.J. joins the show and the usual cast to discuss the recent attacks against out-of-date and unpatched wireless routers from sophisticated, state-sponsored actors. J.J., Matt and Lurene detail the research around these campaigns and advice for anyone to improve their network hygiene. If you'd like to talk to the BWT crew more about this topic, they'll be at RSA this week with two live episodes and generally hanging around the Cisco booth. Important links for this episode:Talos blog post on Jaguar ToothCisco's advice on appropriate network hygieneCisco PSIRT blog post on Jaguar Tooth.Cisco Software Checker

Everyone fears the dreaded 10-out-of-10 CVSS severity score on a vulnerability with "critical" written somewhere on the advisory. But does that number even matter to an attacker or hypothetical defender? Matt, Mitch and Lurene discuss the various ways the security community classifies vulnerabilities and how potential targets can use that information to their advantage. They discuss patching strategies, potential security holes that attackers look for and real-world cases of vulnerabilities that have led to breaches or cyber attacks.Other suggested talking points:Band jam sessionsConference season getting underwayWhether Tom Petty's music is actually complex

(Recorded Jan. 27, 2023)No Matt this episode, so we have two guests in the rotating chair(s): Nick Biasini and David Liebenberg. Lurene, Mitch and our two esteemed companions talk about the human problem of ransomware. Lurene says getting rid of email altogether is the best option — but since that doesn't seem likely anytime soon, what are some other options for enterprises and companies to avoid being hit with the latest phishing scam? Other suggested talking points:Wawa vs. SheetzWhy everyone has a "Dave in Accounting"Lurene being way ahead of the curve on Twitter's slow demise

With this episode, we set out to discuss the first annual Cisco Talos Year in Review report - a look back at the major threats, trends, and topics from 2022 and what we should take forward into 2023.   Our guest Dave Liebenberg runs the team behind this report and joins us to discuss *why* his team undertook this effort, and some of the finer points of the report findings.  The Year in Review is broken down into four major parts, and Talos will be releasing "topic focus reports" to zoom in on each through February.  ...BUT...  in reality, we spent the first 20 minutes of the show ranking Thanksgiving foods by awesomeness - henceforth, Ranksgiving - and it was too much fun to cut.  If you don't want to be angered or surprised where turkey lands on the list, skip to the 20 minute mark.  The #1 spot is definitely a hot take that could upset some listeners, just like it upset to the previous long-standing title holder. Check out the Year in Review page (https://blog.talosintelligence.com/year-in-review) for the full Year in Review report,  topic summary reports, livestreams, podcasts, and other content starting December 14th.  

We are (finally) talking about the recent OpenSSL vulnerability as we had to redo this EP.  In our infinite podcasting wisdom, we took a stab at it roughly 2 hours before the embargo expired and coverage was released - which is obviously is a very silly idea in hindsight. After we cover the current issue at hand, Lurene leads us through the surface levels of how vulns can be exploited in the heap or stack, and the different perspective and processes in practice by offensive security experts.  If you want to walk away with a new view of vulns and exploits, stay for the whole hour.Here is a great write up from DataDog on OpenSSL vulnerability CVE-2022-3602.

Mitch was trying to preserve his voice, so Matt is driving the bus during this episode — hang on! In this edition, we're talking about script kiddies (unfortunately, not "kitties.") These are basically adversaries with an extreme base level of computer knowledge who use basic scripts to carry out cyber attacks. How can we avoid these attacks, even if they'll look like benign activity in your environment? 

At the onset of Russia's invasion of Ukraine, many experts and government officials expected there to be two fronts of the war — one on the ground in Ukraine and one in cyberspace. But all things considered, we haven't seen as much offensive cyber warfare come from either side of this conflict this year. J.J. Cummings from Talos Threat Intelligence and Interdiction joins the show again to share his experience from working hands-on with networks in Ukraine. He, Lurene, Mitch and Matt discuss why there haven't been as many offensive attacks as we were expecting, or if they're just happening in the background and no one's talking about it.Other suggested talking points include:What is the "Texas" of other continents?Drama inside the Conti ransomware gang.Why Matt definitely doesn't spend too much time on Twitter.How sad should we be about the Queen of England dying?Some helpful links:HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine from SentinelOneAcidRain | A Modem Wiper Rains Down on Europe from SentinelOneTranslated: Talos' insights from the recently leaked Conti ransomware playbookVictoria & Albert Museum in Discussions to Return Artifacts to GhanaUkraine Independence Day: Talos update

We're excited to add to the growing Beers with Talos family with the addition of Lurene Grenier to the squad. Lurene joins her first episode and hits the ground running talking about her current role within Talos. She, Mitch and Matt talk about the major differences between exploit development and vulnerability discovery, and how Lurene started her career in exploit development. While exploit development might sound like the stereotypical thing a "basement hacker" does, it's actually very important to the security arena and something a hobbyist can easily turn into a career. Other talking points:Unsolicited marketing advice for Pennsylvania government agencies.Dunking on the Tampa Bay Rays.Why Lurene is always right.$8 million worth of exploit development for Apple products.

We wanted to start off the new year by reflecting on 2021 with Talos Incident Response. The one thing many cyber attacks had in common? People.There are issues that arise any time humans are involved, whether it’s being tempted by a phish or someone making simple human errors. So, Matt, Mitch and Liz discuss how logs are crucial during the worst-case scenario and look at how to remove human error as much as possible from the equation.Outside of initial infection vectors, there are plenty of other lessons learned from 2021 that we can take into incident response this year.

We’re all still pretty exhausted from our work in Ukraine. But that hasn’t slowed down any of the threat actors, unfortunately. So we enlisted special guest Nick Biasini to dive into the BlackCat ransomware group to discuss how it potentially is or isn’t connected to BlackMatter/DarkSide. These ransomware-as-a-service groups surprisingly run like regular companies, and even have the same problems with employee retention! Plus, Matt and Liz provide updates on their work in helping to defend Ukrainian networks and organizations.Other talking points:- How to pronounce the company “Nike”- Surprisingly safe-for-work videos on Omegle- Avoiding burnout when everything is on fire

We mainly spend this episode doing some catching up because it’s been a while since we recorded. But on the actual, helpful, front, we discuss a recently released list of the vulnerabilities that are most often exploited in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency.It’s particularly interesting to compare the lists from 2020 and 2021 to see how threat actors have changed up their tactics and parse through all the information to tell you what you need to know. It’s also important to question these types of reports and how helpful they are to defenders.This is also a great episode for any Snort fans out there who are interested in the old days of writing rules for some Y2K-era malware.

This is our first episode sans-Craig, but we didn’t wait long to find his replacement! Tune in as we add a new host to the crew. Then, we talk about drama on the ransomware landscape among as-a-service groups. Please note, we recorded this episode before everything dropped on Log4J. We are recording an emergency episode as we speak on this and will be releasing it later this week.

We recorded this special episode live and actually in person last week at the RSA Conference, and we have a special treat for the listeners. The ever-elusive Matt Watchinski, Talos’ fearless leader, joins the show. We mainly spend some time talking about Talos’ work defending Ukraine during the invasion of Russia. Tomorrow, be on the lookout for a more laid-back podcast in the Security Stories feed, because the BWT crew stuck around to record a special episode with them, too.

Our rotation of special guests continues on with Nate Pors from Talos Incident Response. Nate has been following several different attacks in which attackers bypassed multi-factor authentication with “prompt bombing” and other techniques. The crew discusses what the security community can do to make MFA safer and how to improve user education about using the technology. Plus, Matt gets an opportunity to eat some humble pie regarding the FBI and the removal of wireless router malware, so that’s always exciting.

We’re dropping two episodes today. This is undoubtedly the less serious of the two, as it was recorded prior to the invasion of Ukraine. Check out Ep. #118 for more on that situation. In this episode, though, we got to talk about Talos’ involvement at the Super Bowl. Mitch welcomes on Brett Ellis, who was at SoFi Stadium in Los Angeles to help defend “The Big Game,” of Talos Incident Response to discuss his experience. He, JJ and Liz talk about what goes into securing these major global events and talk about what it’s like to have to come in and handle someone else’s networking equipment and then parachute out. If you want to learn more about Talos and Cisco Secure at the Super Bowl, you can read Cisco’s announcement.

[Re-uploaded to fix an audio gap.] Yes, we’ve been sitting on this one for a while. But it’s worth it, we promise! We wanted to wait until we had more news to share, so it’s finally time to announce that Craig has left us. We will absolutely miss Craig, but look forward to the next act of Beers with Talos now that 2/5ths of the original crew is gone. We take the time to reminisce with Craig about his time at Talos and talk about this new trend of “bandwidth-sharing” applications. Stay tuned to BWT Ep. #112 where we’ll debut with a new host!

Log4j was a big enough deal that we finally decided to host a live show. Mitch, Matt, Liz and special guest JJ Cummings from our Threat Intel team got together to update everyone on where things stand with this critical vulnerabilities. It’s not all doom and gloom though, Matt at least brought some memes!

Summer hacking, happened so fast….We’ve been trying to enjoy our summer, but supply chain attacks just had to go and ruin the fun. So Mitch got back from fishing and decided to pull the guys together to discuss the Kaseya supply chain attack. We cover this major event BWT-style, and talk phony patches, mitigation strategies, and unsolicited advice for Kaseya’s CISO. For more, you can also watch our recent live stream with Nick Biasini covering everything you need to know about this attack.Also, if you want more Beers with Talos (and you’re listening to this the day it’s released) join us over on the Cisco Twitter account on Thursday, Aug. 5 for a #TalosTakeover. We can’t believe they’re letting us do this, either.

(Uploaded again, this time with the correct music!) The OG Beers with Talos folks are dropping like flies, because now we also have to say goodbye to Joel! We know this has been quite the roller coaster for listeners, but we appreciate you all sticking with us through all these changes. We take some time in Joel’s farewell to discuss “Rent,” as only BWT could, and burnout in cybersecurity.

This was admittedly a tough one to record. In the middle of us trying to respond to the situation in Ukraine, we felt it was important to let our listeners in a bit. Matt, JJ and Liz discuss the work they and their teams are doing in Ukraine to protect critical systems there and keep users online. We also talk about the human side of things, and why it’s important for folks in cybersecurity to think about self care during this time.If you want to stay up to date on Talos’ work in Ukraine and our ongoing research about cybersecurity concerns in the region, continually check cs.co/TalosUA. Here are some additional links to Talos research and Cisco announcements:Livestream with Cisco ThousandEyes, Cisco Secure and Cisco TalosSpam campaigns leveraging Ukraine themes to spread malware, steal cryptocurrencyCisco’s statement on standing with Ukraine

You’re not going to believe this, but everyone actually agreed on something in this episode. And no, it’s not regarding the best flavor of beef jerky. In this episode, we discuss a new category of threat actors that we’re choosing to call privateers. The guys discuss why this classification is much needed in the security community, the previous research on this topic, and the ways private security firms can partner with public intelligence agencies to protect against this type of threat. You can find complete show notes and links over on the Talos blog.

Most of the Beers with Talos folks are refreshed after a summer vacation. But don’t assume that means they actually prepared for this episode. This is more of a free-flowing episode, where we discuss cyber conflict between nations — one of the many things that keep Matt up at night. They go back and forth discussing what a “cyber war” could actually look like, and what crosses the line into conflict versus traditional “hacktivism.”

Recorded May 11, 2020 – Craig wins MVP of the podcast for his attempts to avoid discussing… something. Anyway, we went a little long on this podcast, but stick with us as we wind through the recent Executive Order on cybersecurity, and then discuss another… interesting take on how we should then combat these new threats. I feel almost obligated to let you know before you listen, it’s a letter of marque take, and oddly, we all agreed on something.Full show notes on the Talos blog

We wanted to prep for the RSA/Cisco Live stretch of June by looking back on security conferences past. Mitch, Matt and Liz got together to talk about their best and worst conference memories. Plus, Mitch has an overview of everything Talos is doing at RSA and Cisco Live, including a LIVE episode of Beers with Talos next week at RSA. There is a little security talk at least, as we also cover the latest goings on between the Conti ransomware group and Costa Rica’s government.

We’ve all heard that popular refrain by now: “Well I have nothing to hide so I don’t care if the government sees my data.” This week, we tell these people they are completely wrong. Ashlee Benge joins the show to discuss her upcoming BlackHat talk on the types of data and personal information health apps track. This has taken on special importance in the overturning of Roe vs. Wade in the U.S, making many forms of abortion illegal in many states. Ashlee talks about how women’s health apps may be compelled to cooperate with law enforcement agencies now after the Supreme Court ruling. We also have a complete rundown of all things Talos happening at BlackHat next week.Also, this is unfortunately Liz’s last episode with Beers with Talos. Please bear with us as we figure out the next chapter of the show. Don’t worry though, we’re not going anywhere!

Most people would expect us to approach the Winter Olympics from a security perspective. Why are athletes using burner phones? Are we worried about any state-sponsored attacks? Not this year, folks! Instead, we rank each country’s curling uniforms, discuss the origins of ski jumping and debate which events would be the most difficult to compete in.On the actual cybersecurity front, we did carve out some time to discuss two state-sponsored threat actors Talos has written about recently: AridViper and MuddyWater. We look at the maldocs involved in these campaigns and their targets. Matt also expounds on his multiple Twitter threads around the current situation in Ukraine.

Re-uploaded on July 22, 2022 to fix audio issues —We’re back from RSA, Cisco Live and COVID breaks (yes, those things are all absolutely related). Paul Eubanks joins the show to talk about his recent blog post on unmasking ransomware actors on the dark web. He’ll go over several different tactics he and his team use to remove actors’ anonymity that’s so important when actors are working on these websites. Liz provides her take on this from an Incident Response perspective, and Matt semi-pays attention as he ponders how much he hates The Carpenters.

This is a very different episode in that it isn’t really a BWT episode at all. Hazel Burton from the Security Stories podcast invited Matt and Mitch to come on with the leader of Talos, Matt Watchinski. The idea was to chat with Hazel and her co-hosts Ben and Sana about burnout from three levels of a security research team. What followed as we all started talking was real and unfiltered conversation from many very different points of view. We talked about what has worked, what hasn’t, and our own struggles with self-care while trying to take care of our respective teams, families, and friends – hopefully some of our collective experience is useful to you.Original broadcast - Security Stories podcast, ep 27

Recorded March 30, 2021 – What better way to discuss supply chain attacks than to have Matt demonstrate how easily you can blend your payload into normal operations via Twitter shenanigans? We’re talking about (surprise!) supply chain attacks and how their rise to prevalence is notable, albeit expected. Supply chain gets linked in with privacy concerns as we round out the ep discussing the Signal/Cellebrite situation. Listen to the episode before you read Matt’s tweet (linkedin the full show notes) and see if you can pick the words that were part of his little reindeer game. Your prize is the achievement of a job well done. See the full show notes on the Talos blog

Recorded March 2021 – ICS and SCADA systems are deeply embedded all around us in critical infrastructure. Today we talk about some of the inherent issues in infrastructure security and take a wide-ranging look at the ICS- and SCADA-specific issues found there. Joe Marshall from the Talos Outreach group joins to share his insights on the space and how donuts are the ultimate career track switching tool. Oh- and Matt’s cat discovers jerky.Full show notes on the Talos blog

We’ve been quiet for a minute, but we have a few new EPs ready to go, starting with some of your questions from Twitter. And yes, one of the first questions concerns Craig and the robots. Do you have a question you’d like to ask us for the next listener questions episode? Send us a tweet (links below). Ask us anything security related or something else entirely. It’s your question, I’m not going to tell you what to ask. Full show notes on the Talos blog

Recorded January 8, 2020 – It’s hard to believe that we have made 100 episodes of BWT. It easily feels like two or three times that many. This is a long winded show, as we welcome back our buddy Nigel for this special milestone. As an unintentional nod to our early episodes, the opening roundtable gets way off track and we basically host an “In-between” ep in the middle of a regular show. We also dig into supply chain attacks, in light of the recent SolarWinds incident, delving into defensive and IR strategies. Finally, we take a trip into the past remembering some of our favorite moments from the past 100 times I’ve written these show notes.Full show notes on the Talos blog

This EP was recorded toward the end of the year and lived a quiet, but meaningful life in the production queue patiently waiting it’s turn to get released. In this Ep, we dig into a discussion on passwords and some of the issues both conceptually and in practice. Passwords aren’t inherently problematic, but how they are used…sometimes is. We discuss best practices to share with your friends and also touch on MFA (and SMS as an option of last resort). Craig seems to think lock analogies are key to understanding everything. The session was 2 hours long and this is the balance remaining after decency and standards review.All of us want to thank you for listening and making three years and (almost)100 episodes of Beers with Talos possible. Cheers. Full show notes on the Talos blog

Recorded early November, 2020 – This is an EP we recorded in early November but got pushed back in the end of year shuffle to make production schedules work. We’re happy to put this one out now with somewhat belated takes on (somewhat recent) health care ransomware attacks. We discuss a few key questions that are rather evergreen. Why is health care targeted in this way (and other verticals for that matter)? What defines a “high value” target to a ransomware actor? How can targeted entities better defend themselves?Full notes on the Talos blog

Recorded November 24, 2020 –On this EP, Mitch and Matt are joined by Wendy Nather to discuss the newly released Cisco Security Outcomes Study. The results and findings of the research are interesting and somewhat surprising. As often happens with most good research, we end up asking more questions - in this case, geared toward the nature of the relationships found in the data. Special thanks to Wendy for coming on and joining us. As usual, her insight is stellar and she is much more entertaining than the rest of us.Full show notes on the Talos blog

We got delayed with the holidays and PTO, but here is a long awaited ep. The rest of the year is on deck to release through the holidays, so fret not. In this EP we talk about QR codes becoming pervasive as easily deployed “touchless tech” (and how they could help the robots try to kill Craig), and then we take a look at some recent DOJ and APT activity that begs the question: is bringing charges against foreign APT actors anything more than a symbolic gesture? Full show notes on the Talos blog

Recorded October. 9, 2020 –We are running a short bench today after Nigel’s retirement and Joel being on vacation. We start off talking about how specific use cases don’t equate to the death of entire defensive technologies, despite the frequent assertions otherwise you may find on Twitter. The key to defense in depth is that no silver bullet stops everything - nothing is surprising here.The big focus of this EP, leading into the 2020 election is, of course, election security. We recap some important points from our research and go over materials we have put together for election officials and voters alike. Please take a minute to go though the links in the extended show notes on the Talos blog for a full list of Talos elections security and disinformation resources.

Recorded Sept. 25, 2020 –Today is Nigel’s last episode as a regular host of BWT. Join us in wishing him a happy transition to his next chapter - as we all know, Nigel won’t ever actually retire. Today’s show is us chatting with Nigel - about his career and his take on the industry as he entered, and now as he moves on to whatever comes next. Every aspect of Talos is better off because Nigel was here, as well as so many of the people he impacted along the way.We will all miss your daily presence, but we are excited to see what you come up with next. Cheers.Full show notes on the Talos blog

On today’s show we take several of the larger security myths that are often heard around things like patching vulnerabilities - specifically the notion that more patches indicate less secure software. We also talk about other “common knowledge”-esque bits of advice we’ve all often come across. We could do a whole episode on silver bullets that (spoiler alert) weren’t. Let us know some of your favorite silver flashes on Twitter or drop us an email.Full show notes on the Talos Blog

Disinformation is front and center right now. As disinformation efforts constantly increase, platforms struggle to contain the problem without giving the appearance of censuring or controlling all information present. A Talos research team recently published some findings on the building blocks of disinformation campaigns (available via link below). Special guest Kendall McKay joins us to discuss the research she co-authored with her team in Talos. We go over exactly what defines disinformation and the most pervasive sources. We also look at who these actors are and how they operate at scale while remaining hidden. Full show notes on the Talos blog

Recorded August 14, 2020 –Let’s talk about FUD - it’s not enough to just say FUD sucks. Let’s talk about exactly how and why producers of FUD are garbage nightmare monster people. We also cover how they are actually damaging themselves, not just the people and organizations that buy their hype. We have rather strong opinions on this, so we invited Meredith Corley, an actual professional on the topic, to break it down for us all. Meredith is our Security communications and PR Director (previously of Duo and Blackhat fame) and takes us through spotting, defusing, and refuting FUD in the security community.Full show notes on the [Talos blog}(https://blog.talosintelligence.com/2020/09/beers-with-talos-ep-91-get-fud-out.html)

Recorded July 31, 2020 –This week in BWT land, we’re discussing hacktivism - from the unintended consequences to the tropes perpetuated by Hollywood. Regardless of the reason or cause, hacktivism often wields DDoS and web defacement as easily deployed tools. We discuss some instances where using code as a weapon without deeper understanding can have disastrous consequences. The crew also digs deeper into the ethical considerations of hacktivism, pseudo anonymity, and the intended impact of civil disobedience on civil society.Full show notes on the Talos Blog

Recorded July 17, 2020 –The gang’s all back this week, and we take on what happens when you get pwnd, hacked, or your data is leaked. It happens to all of us eventually, one quick moment connecting to public wifi, clicking on a bad link when you just aren’t paying enough attention, or your account data is leaked through no real fault of your own. So, what do you do first when it happens to you? Sure, this is a fundamental review for some, but you can thank us the next time your brother’s co-worker’s uncle calls you because: “these hackers” - and you can just send a link to this episode. (If you were sent this link from your niece or nephew, I’m sorry you had to find out this way, but no worries, we got you).Full show notes on the Talos blog

Nigel is out this week, but we have a couple light and breezy topics on the docket: 0-day research and the institutions of democracy. FUN STUFF!! First, we chat about 0-day research tools and the questions raised around them, contrasted to the time before security research was widely accepted. We spend the last half of the show discussing some of the findings and finer points of Matt’s recently released research paper on election security “What to expect when you’re electing”.

Has it been 3 years already? We have a great episode to celebrate! We start off chatting about the origins of BWT and what made it… I don’t know… the way that it is. We also have some great guests. Hazel and Ben from the Security Stories podcast come by to talk about another anniversary of note to all of us - NotPetya. We also chat about what makes storytelling a powerful tool (even in security), and atypical paths to careers in cybersecurity. While we are talking about communication, we wrap up this ep discussing and sharing what worked (and still works) for Talos over the series of critical response events that included NotPetya and one of our very first podcast episodes.Full show notes on the Talos blog

Recorded June 5, 2020 –Prod. Note: Things are a hot mess right now and the team thinks that there are voices you have needed to hear more than ours, so we held back on releasing a few episodes. This is the last of those withheld eps, please pardon any weeks-old info. Be safe, be kind, and listen to each other. Black lives matter.This was a difficult show to make in light of the events the week prior. We were all in a mood along with the rest of the US and the world, and it showed. There was no amount of editing that could save that Roundtable. Regardless, we dig into vulnerabilities and exploits this episode starting with looking at the top 10 most exploited vulns from a recent CISA report (Full disclosure: Talos assisted in the creation of that report). We start to dig into some deeper convos around pentesting platforms and exploit stability that are sure to come back up soon. Full show notes on the Talos blog

Recorded May 29, 2020 – Prod. Note: Things are a hot mess right now and the team thinks that there are voices you have needed to hear more than ours, so we held back on releasing a few episodes. We are releasing those now, please pardon any weeks-old info. Be safe, be kind, and listen to each other. Black lives matter.This is the last of the In-Between episodes. Thanks for having fun with this non-security miniseries across a span of weeks that I am not even going to try and neatly sum up in snarky podcast notes. We started this miniseries as a fun way for us to stay connected and put some extra podcasts in your playlist as we all got used to new routines and staying at home. We can’t keep that pace forever, so here is where the In-Between wraps. The questions you’ve sent us on Twitter have been amazing, you can expect to see that become a recurring thing. I hope that you’ve enjoyed these episodes as much as we enjoyed making them. From all of us, thank you for listening and stay safe - Cheers.Full show notes on the Talos blog

Recorded May 26, 2020 – Prod. Note: Things are a hot mess right now and the team thinks that there are voices you have needed to hear more than ours, so we held back on releasing a few episodes. We are releasing those now, please pardon any weeks-old info. Be safe, be kind, and listen to each other. Black lives matter.You, our audience, have asked this question a lot - in person, on Twitter, in DMs, and one of you even sent me InMail - so we spend a whole EP talking about advancing your career in the middle stages - whether you are interested in jumping on the management track or rising to the top of the engineering/technical hill, there are certain skills, relationships, and habits that will make your quest more effective. Quest? Wow, I have really been playing too many games lately.Full show notes on the Talos blog

Recorded May 15, 2020 –Prod. Note: Things are a hot mess right now and the team thinks that there are voices you have needed to hear more than ours, so we held back on releasing a few episodes. We are releasing those now, please pardon any weeks-old info. Be safe, be kind, and listen to each other. Black lives matter.Sammi (inexplicably) continues tolerating hanging out with the rest of the crew on the The In-Between. As usual, we avoid discussing security at all costs. These EPs are all about keeping in touch and catching up to chat. We talk about cool stuff we are watching to occupy our time and JOEL DID HIS ONE JOB! so, we are taking your (amazing) questions from Twitter. Keep sending your questions for our regular episodes as well — @TalosSecurity #BWT.

Brad Garnett from Cisco Talos Incident Response joins us today to talk about DFIR, the Talos Quarterly Trends Report, and how a high-speed police chase on reality TV kick-started his DFIR career. That’s not even clickbait, for real. After Brads drops a quick IR trends briefing on us, the crew drills down on some key findings. (IDK what that means either, but there were good questions asked and great discussions in response).We are taking your questions from Twitter so keep sending them for the next “The In-Between” episode — @TalosSecurity #BWT.

Recorded May 1, 2020 –Sammi is back and the rest of the crew is here to hang out, chat, and as is The In-Between Way - avoid discussing security at all. These EPs are all about just keeping in touch and having some fun. Despite Joel forgetting his one. job. on this podcast, we are taking your (sometimes crazy) questions from Twitter on these episodes, so keep sending them for the next “The In-Between” episode — @TalosSecurity #BWT.Full show notes on the Talos blog

Matt isn’t with us today, but the rest of the crew discusses current security issues in our new WFH environment, including some more-than-the-basics advice on how to protect yourself and your organization’s data while working wherever. We go a bit more in depth on VPN and explain how VPNs work, how they protect you, and more importantly, how they DON’T protect you. The key takeaway of this podcast, however, is that we need to start a campaign to formally recognize the legitimacy of Social Mulligans (this counts as a trademark, right?)Send us your questions for the next “Quittin’ Time” episode — @TalosSecurity #BWT.Full show notes on the Talos Blog

We are renaming these episodes - “Quittin’ time” was okay and all, but “The In-between” better captures what these eps are. Compared to our normally named eps, you can expect the same lack of actual security content presented in Vol. 1, just a shorter format. You seem to enjoy us taking your (sometimes crazy) questions from Twitter, so keep sending them! We are doing these extra episodes because we need to laugh and have some fun right now, and hopefully give you the same little break from reality - we want you to come on in and have a laugh on us.Send us your questions for the next “The In-Between” episode — @TalosSecurity #BWT.Full show notes on the Talos blog

We have a couple great topics today - and only one of them is a COVID-19 related topic. So, it turns out that you can fake fingerprints - the good news is that it takes a lot of time, equipment, and expertise. It is much easier for a criminal to just make you unlock it yourself. We have also seen an unprecedented level of collaboration and righteous anger across all vendors responding to COVID-based scams. Literally everyone is just watching, documenting, and hunting anything even tangentially related to the current health crisis. The challenge is that all the cooks are in the kitchen, which is really a good problem to have…Send us your questions for the next “Quittin’ Time” ep! — @TalosSecurity #BWT.Full show notes on the Talos Blog

Recorded April 3, 2020 – We’re kinda bored. We figured you are too. So we decided to get together between normal recordings to help save you from the bottom of the Netflix barrel. It gets weird down there. These Quittin’ Time eps are just the crew hanging out for a bit without a security topic agenda. Sans. None of that. Honestly, if you’re not a fan of the banter in the Roundtable and Closing Thoughts segments, this …probably isn’t your cup of tea. Anyway, we have fun getting together and feeling more normal for a bit, we hope you have fun listening to the heavily edited version of that. Send us your questions for the next QT ep - @TalosSecurity #BWT.Full show notes available on the Talos blog.

Our goal is always to talk to you about what’s on our minds. Right now, we are pretty sure we all have the same thing on our minds. In addition to our regular show material, we want to talk through some of the things that we are dealing with professionally and personally in the hopes that it applies and is useful to you. To that end, we asked Sammi Seaman (our Education coordinator and resident mega-extrovert) to stop by and chat with us about the challenges of working from home and shifting the way we work. We aren’t breaking any massive news and threats this week, rather we are talking about what the industry is thinking about. As a heads up, we are increasing episodes from biweekly to weekly, and rotating in different topics while we’re all stuck at home. Hopefully, this is helpful for you and us both.Drop us a tweet and let us know what is on your mind. Be safe, and wash your hands, you filthy animals. Full show notes on the Talos blog.

Recorded 3/13/20 - Of course we have to talk about the implications of Coronavirus to the way business and security are getting done. While everything about the COVID-19 pandemic seems to be a fluid situation, a rare constant has been the same rehashed disaster scams. But that could quickly change with the mass shift toward remote work. This episode takes a look at both securing that shift as well as practical advice for those of us finding ourselves as newly remote employees. Full show notes on the Talos blog

Recorded 3/02/20 - We open up the show with a sugary sweet poem before talking about RSA and our annual trip through the startup hall. Matt expertly segues the crew into talking about the impact the security industry can have on public-interest technologies and civil society - both in the industry sense as well as in the interpersonal sense. FInally, we take a look at opposing mindsets and approaches, discussing how partnering with an adversarial approach is not near the oxymoron it seems.Full show notes on the Talos blog

Recorded 2/19/20 - Craig made an oopsie. He sends his apologies for the echo-chamber reverb. We had no idea until he sent in his audio for mixing, we would never do this to you intentionally. This is a shorter ep focusing on software licencing and features as well as vulnerability disclosure. Join us to talk about vendors abilities to disable feature sets and owning versus using products. We further chat about vulnerabilities and how a vendor with no security advisories is often seen as a “more secure” option, when in fact, that can mean the exact opposite.Full show notes on the Talos blog

Recorded 1/31/20 - When a vulnerability is released, regardless if it has a website and logo or not, we need to understand the risk to the network and what defense options are possible before the patch is ready for production. Can you defend against the vulnerability or do you go straight for known exploits? What happens if an exploit occurs? Also discussed: Talos begins releasing Threat Assessment Reports based on IR engagement data and known prevalent threats. Snort has a new series of training and lab videos available for Snort 2 and Snort3.Full show notes on the Talos blog

Recorded 1/20/20 - Powershell is a frequent flyer in security headlines - a powerful and oft wielded tool for attackers and defenders alike. This ep takes a look at Powershell and how to help ensure its security posture as an effective management tool. We also look at the missing-the-forrest-for-the-trees concept of behind being concerned about the latest shiny ATP before all else.Full show notes on the Talos blog

Recorded 1/6/20 - There is a looming cyber conflict on the horizon between the US and Iran. We use all our time this week to discuss the situation at hand and take a hard look at what you should have already done foundationally. The crew offers insight and analysis of what nation-state cyber conflict looks like and what you can do to elevate your security strategy to the next level in an uncertain time of increased suspicion.Full show notes on the Talos blog

Recorded 12/20/19 - In a shorter year-end EP, we take a look back and a look forward. It seems everyone else wants to break out the crystal ball this time of year and prognosticate the coming year’s threat landscape. We don’t have one of those, so we used a Magic 8-ball, but we’re pretty confident the results are as-good or better. However, most of the EP is dedicated to going through the notable security events of the past year. We take a look at the lasting effects and lessons learned from 2019’s biggest threats.Full show notes on the Talos blog

Recorded 12/9/19 - We have a big announcement to make today! Check your feed for a few Ep’s of a new podcast from Talos - “Talos Takes”. On this Ep of BWT, we welcome Joe Marshall to the table - Joe is a Talos ICS/IoT tech lead and he stops by to discuss issues in the IoT space - macro and micro, from both the vendor and user perspectives. Check out the crew’s advice on staying secure in this IoT gift giving season.We will see you in the new year, and thanks for listening in 2019. Merry Christmas and Happy Holidays to all!!!Full show notes on the Talos blog

Craig is out sick/injured/fighting robots (actually all three), so we brought in Sean Mason from Talos IR to talk shop today and give you the inside scoop on IR (and Sean’s next-level beard care regimen). How do incidents affect the enterprise and consumers? How has the advent of widespread ransomware fundamentally shifted the burden of responsibility in the c-suite and what have been the outcomes? What does a responder have in the bag when they arrive on-site?Full show notes on the Talos blog

Recorded 11/8/19 - Joel is out on PTO, so Mitch, Matt, Nigel, and Craig carry the banner this EP discussing how attackers approach targets like investors looks at portfolio. We also talk about how the most recent off-cycle elections in the US give us a glimpse of improvements and changes in election security. Finally, we take a quick look at popular scams and how attackers use seasonality to increase the relevance of their scam for emotional response.Full notes on the Talos Blog

Recorded 10/25/19 - Today is a bit different. We normally keep things pretty neutral on this show (not really), but today is all about the new service Talos is launching - say hello to Talos Incident Response. Amy Henderson from the Talos Intel and Interdiction group joins us as we discuss the full circle of threat intelligence - from global visibility to hyper local context, and how IR allows those feed each other to the improvement of both. Listen to the announcement as we discuss what IR is, what it means in general, and what Talos brings to that equation. We hope you are half as excited as we are, because that is still pretty dang excited. Lastly, Craig isn’t with us today, but you get to decide his fate for being dishonest with you, dear listeners. We will deliver you justice.Full show notes - and more in-depth info on the Talos blog

Recorded 10/10/19 - This EP lives up to it’s name, by trying to only take on a minimal topic and then becoming completely convoluted. We start of with an extended round table (I even cut like half of it out) and then start talking about the trials and tribulations of making things too complex - from software to network design. If the devil is in the details, then the danger is in there being too many of them. We take two simple examples - PDF readers and a trip to the doctors office - and look at how the complexity jammed into the tech around these two things is where things become disturbingly dangerous.Full show notes on the Talos blog

Recorded 9/27/19 - We are down Matt and Joel today, so Mitch, Craig, and Nigel are taking you through this EP. We cover some recent posts from Talos with Divergent and Tortoiseshell. Turns out, people get a bit excited when you target US veterans with malware - even other malware authors thinks that’s scummy. That takes us into a chat about social engineering in general and we end up talking about some interesting stuff with unpatchable vulns and why deleting /var on install could be described as a bad idea for a Chrome update.Full show notes on the Talos blog

Recorded 9/13/19 - In one of our rantier episodes of late, the BWT crew dives into the ongoing insidiousness that is cryptomining with Watchbog, and then we turn our attention to some idiot that thinks charging people $50 to bypass MFA on their own machines is a swell idea, because nothing bad can happen there, right? RIGHT?! Finally, we take a look at some recent breaches and the trend of attempting to downplay the severity of a breach because the data ex-fil wasn’t “vital or important”. Again, what can go wrong with that line of thinking? This is fine. Everything is just fine. Security is solved, we can go home now.Full show notes on the Talos blog

Recorded 8/30/19 - In this extra-sized EP, we cover a lot - starting with Retadup, and discussing the intricate workings of why it’s a bead idea to execute code on other computers without permission when you have no idea what that computer is doing. WannaCry is making some headlines again, but this time it isn’t WannaCry and frankly it’s not news. From the mobile ecosystem os battleground, Google’s Project0 announced several vulns in iOS that have been discovered being exploited in the wild, with some of the exploit chains leveraging 0-day. Most important development of the week is that journalists are now quoting Matt of his Twitter timeline and this is certain to end well.Full show notes available on the Talos blog

Recorded 8/16/19 - The understatement of the day would be the guys were in some kind of mood today… There is no explaining the way they are sometimes. We ended up discussing a lot of the awesome things that went on at Blackhat and DEFCON… like the time Matt and Mitch got ejected from the Aviation Village for recognizing the prowess of the greatest plane ever built. BRRRRRRT. And also the time Joel ejected himself from the Cisco party. Deeper in the EP we get into threat intelligence – what is it, how to find the intel you need, and how to leverage it to create value. Full show notes on the Talos blog

Recorded 8/2/19 - Yes, I know what today’s date is. We got really busy last week and I am sorry that the podcast is late. Really, I wish I wasn’t writing these notes at 12:#0r4-j3pofw…. What? Anyway, we talk about malvertising and dig into that ecosystem a bit looking at some of the competing priorities (hint: none of them are your privacy). We also discuss BlueKeep making its debut in Canvas and surely soon to follow in other fine pen testing platforms. We use that opportunity to review a little bit of RDP knowledge and defense. We’re recording again tomorrow and I really don’t want to hear what my co-hosts will say if this isn’t out by then, so I’m going to go hit publish now. Full show notes on the Talos blog

Recorded 7/19/19 - Wow, we packed a lot in this one: election security, burner phones, social app ToS, and maybe the worst opsec of all time - of course, Nigel blames Canada for all of it. Fair warning, this EP set a new record for beeps and train horns, so you have been warned. We primarily take a look at how an attacker would see disrupting democracy (and not in the cool startup way) by looking at the available attack surface with their intentions in mind. We also lay out some cases where burner devices make sense and where they might not. We close up with some helpful tips to enjoy a massive con like BlackHat or DEFCON. But seriously, that was a lot of beeps. Full show notes on the Talos blog

Recorded 7/8/19 - Matt skipped today’s podcast in favor of a meeting - for real. The rest of the crew carried on to discuss a few of this week’s hot button issues - municipalities paying (or not paying) the ransom, NASA JPL reporting APT breached their network via a rouge Pi (in true Mr. Robot fashion), and looking at rouge devices in general. Next EP will be our last before Black Hat and DEFCON, so tune in to find out where you can find Talos!Full show notes on the Talos blog

Recorded 6/24/19 - Back in the studio for EP 56 and off the top, Matt got some new toy for his side hustle as a Twitch star - I still can’t figure out exactly how he did what he did, but it was not helpful from a producer’s perspective. It’s repaired, but still enough to apologize for. This is why we can’t have nice things. We discuss the issues around the AMCA data heist - a breach that caused a bankruptcy - and the complexity of securely moving sensitive data, like PII and HIPAA data, to the cloud. As we get deeper, we end up discussing the issues inherent in medical data - namely, its sensitivity and data security issues so systemic in nature that not even HIPAA can help.Full notes on the Talos blog

Recorded 6/12/19 - God knows why, but we bring you another live EP from the Talos Threat Research Summit at Cisco Live US in San Diego, CA. We are joined by TTRS keynote speaker (as is tradition) Liz Wharton. Catch the highlights of the show and stick around for hot takes from the live audience. Thanks to everyone who showed up to the recording, especially those brave enough to step up to the mic at the end. This is our annual reminder of why we don’t do this more often.Full show notes on the Talos blog

Recorded 5/24/19 - There is another Blue(x) to talk about and guess what? YES, YOU STILL NEED TO PATCH. We talk about RDP, the source of this vuln, and whether or not exploits exist for it (hint: they do). There is a quick look back at last year on the anniversary of VPNFilter, and we also tackle 0-days again through the lens of Project Zero’s timeline of 0-days found in the wild.Also, Craig hasn’t seen the end of John Wick 3 yet, so feel free to tweet him spoilers. If you are in San Diego for Cisco Live, come find us to see a live recording of the podcast!Full show notes on the Talos blog

Recorded 5/10/19 - Election security has been a dominant headline for some time, so it’s high time we take a look at what that landscape looks like - where we are today, and how we got there in the first place (hint: there were deeper unintended consequences than Shiny Happy People on REM’s “Out of Time” album). We anticipate gathering some first-time listeners due to the topic of this podcast… to you we say welcome - and yes, it’s always like this. Matt kicks us off today discussing the greatest nerd rock band of all time - Ninja Sex Party. If you haven’t heard of them, you are in the wrong and should fix that quickly. Full show notes on the Talos blog

Recorded 4/26/19 - Since Craig decided to skip the podcast today, we decided to invite one of Austin’s top actual security experts, Wendy Nather, to stop by. After Mitch is done being a fanboy, Wendy breaks down zero-trust, beyond the marketing story of a world without a perimeter. We spend most of the time discussing what zero trust looks like as security model and how it can be implemented in the real world. We also dive into usability and “good enough” security. Full show notes available on the Talos blog

Recorded 4/12/19 - Today we rip through a few other things to spend most of our time discussing Sea Turtle - the latest DNS hijacking campaign uncovered by Talos. Also, Joel causes the biggest blockchain outburst in some time. Special thanks for today’s podcast goes to Danny Adamantis, Talos researcher on the Sea Turtle campaign. Danny was going to be with us today, but experienced some technical issues that prevented that from happening. RIP Danny’s mic 4-12-19. Full show notes on the Talos blog

Recorded 3/29/19 - Matt and Joel are both on the road this week, and Omar Santos from Cisco PSIRT joins the crew to discuss malware posing as ransomware and defending against supply chain attacks. We go deeper on the Talos story exposing criminal groups operating in the open on social media platforms like Facebook - and the implications of criminal groups leveraging social networking. Facebook has removed the disclosed groups, so we discuss the best-effort ways to play whack-a-mole with bad guys on the open web. Full show notes on the Talos blog

Recorded 3/15/19 - We recorded this after coming back from RSA, with some on-location highlights included! This EP opens a bit more thought provoking than we typically do, and we move toward discussing POS malware, like Glitch. After the RSA highlights, we discuss OpSec fails, and Nigel becomes a Burning Man convert after learning there are people there on drugs with rockets that he watch for funsies. Full show notes on the Talos blog

Recorded 3/1/19 - This is a super short EP - we are trying to get it our for RSA and Matt is MIA today. We are covering the basics of loaders (and the difference between loaders and trojans). We also talk about some RSA activities we have coming at RSA!!Full show notes on the Talos blog.

Recorded 2/15/19 - We are joined by special guest Michelle Dennedy, VP and Chief Privacy Officer at Cisco. This is a long EP that is worth every minute - covering everything from the modern privacy landscape, privacy as a fundamental human right, and all the ways you didn’t know underwear can protect you. We were a bit concerned about having a VP on, but after Michelle knocked us around a bit we figured out what was up… however, if this is the last EP you see listed, I think we all know what happened. Full show notes on the Talos blog

Recorded 2/1/19 - Today we discuss threats that bridge the gap between violating privacy and classic cybersecurity threats - malware and systems that are tracking voices of dissent and using their own devices as recon tools against them. The two cases cited in this EP are ExileRAT, a trojan delivered via malicious Office docs targeting supporters of the Tibetan government-in-exile; and Karma, a zero-touch toolkit used by at least one nation-state to remotely surveil essentially all the valuable data in their targets iPhones. We are going to continue this topic on the next episode as we continue to dig deeper into the idea of privacy as a fundamental human right with a very special guest (hint: it’s Michelle Dennedy) so make sure to catch the next EP as well.Full show notes on the Talos Blog

Recorded 1/18/19 - We have a extended roundtable today (even more than usual) because we accidentally discussed some relevant security topics in the meantime. Eventually, we move on to talk about recent releases, primarily the Pylocky decryptor and more IoT vulnerabilities. We move on to discuss what’s going on in the SoHo device space, with some specific advice and a lot of rage. This EP closes out discussing the release of Holger’s DDR plug-in (download available) and reminding everyone of the TTRS CFP (closing soon!)Full show notes on the Talos blog

Recorded 1/7/18 - Most of the EP (after an extended Roundtable - we all had a lot to get out after time off), we look back at the 2018 Year-in-Malware Review – Olympic Destroyer, VPNFilter, MDM and other unique, large-scale, or otherwise interesting bits of malware that Talos encountered. We also discuss the things we would love to see conference talks about in the new year. Of course, we use that to announce the CFP for Talos Threat Research Summit 2019. If you do defense and want to talk to other defenders, make sure to submit!Full show notes on the Talos blog

Recorded 12/7/18 - Several of us are under the weather, but the show must go on. We did our best, as always. After running through some recent research, we spend a good bit of this EP looking through the lens of a recent breach at the first things a new security leader should get a handle on - what questions need to be answered? What information and practices are day-1 vital? We wrap up taking a look at a slew of vulns Talos uncovered in secure messaging apps.Full show notes on the Talos blog

Recorded 11/16/18 - Cyber moonshot, baby! It’s just like that time the US raced everyone to the moon, except completely different and in-no-way related! Do we need a “cyber moonshot”? Is the plan that was just released the way to get there? …and holy crap if Craig didn’t actually prepare for this podcast with notes and everything.We genuinely hope that you enjoy our rants over the Thanksgiving holiday break (for our American friends) or just at work like usual for the rest of you that don’t have a four day weekend ahead. We are genuinely grateful for you, listeners, as the entire reason that we get to keep doing this podcast. We enjoy having fun spreading the word on security and calling out excellence where we find it.Full show notes on the Talos blog

Recorded 10/19/18 - In celebration of EP40 and hitting over 1 million downloads(!!!), we go XL. This EP is a little long, we go a bit deeper than usual to discuss a few things that are highly unusual - namely, the XL patches dropped by Oracle, and the XL questions surrounding the Bloomberg/SuperMicro story. We also talk about a few mobile threats we have seen and what we have brewing in the mobile threat space.Full show notes available on the Talos blog

Recorded 10/5/18 - Quick chat to get to know this week’s special guests from the Talos Outreach team - Paul Rascagneres, Vanja Svajcer, and Warren Mercer. We discuss everyone’s work being presented at Virus Bulletin, and Paul and Warren being nominated the Péter Szőr Award. We also cover a lot of vuln discovery work recently released around various PDF softwareFull show notes available on the Talos Blog

Recorded 9/21/18 - The whole crew is back together! On the agenda today - VPNFilter part III, now with more known third stage payloads! As much as we have talked about multi-part posts, you know we wouldn’t post if it wasn’t important (on the blog, that is. That rule obvs doesn’t apply here) We are also releasing a related open source tool - WInbox Protocol Dissector. Finally, delve into an AV avoiding DDE and jump off into defense in depth.Full show notes on the Talos blog.

Recorded 9/7/18 - We have Joel back this week (and he is very happy to have himself back), but we lost Matt and we’re still wishing Nigel a speedy recovery from becoming bionic. This EP, we cover the latest findings in Talos MDM research and go over the exciting changes in the newly released Snort 3 beta (your move, Valve.). Bill reprises his role from last week as sentient seat filler that makes good jokes.See the full show notes on the Talos blog.

Recorded 8/24/18 - We’re finally back in the studio after Hacker Summer Camp! Sadly, due to summer vacations and becoming bionic, we are missing Joel and Nigel respectively. We end up discussing most of our topics through the lens of Matt’s frequent Twitter polls. We also find out he bribes followers with free sporks. Craig brings the discussion on the details of Remcos, and go through some interesting points on the emerging grey markets in security software and vuln disco. The crew closes this episode discussing the hypothetical merits of perfect patching versus perfect visibility.Full show notes on the Talos Blog

Recorded 8/8/18 - We decided to broadcast while we were all together at Black Hat - and invited everyone over for lunch and beers. Since we had a room full of people, we made this EP “choose your own podcast” and tooks topics from the audience. Neil Jenkins from the Cyber Threat Alliance came by to bestow befitting superhero swag on Matt and Adam for their work on VPNFilter. Headlining this event is our very special guest - Dave Bittner from The CyberWire. Full show notes podcast blog post

Recorded 7/20/18 - This week, we touch on several topics, but we spend the lion’s share of the EP discussing MDM. We are joined by Aaron Woland and spend a great deal of time discussing how these attacks work and how these are attacks happen to users of all devices across platforms. We talk about the differences in how MDM is handled across different OS flavors, and the similarities in how the attacks happen (hint: users ignoring the warnings). Click here for the full show notes on the blog

Recorded 6/13/18 - Still live in Orlando, just this time from the lovely lobby bar at the convention center hotel. We are joined by Lurene Grenier to dig a bit deeper on her keynote from TTRS. Lurene is here to give you the offensive view of attacking your network. If you want a hot take on defense from someone who is pure offense, well… buckle up and break out your cord cutting scissors. You are already saying “We can’t do that!” Lurene is telling you that if you decide to take this seriously enough, you can and should.Full show notes on the Talos blog

Recorded 6/12/18 - Special episode for two reasons! To start, we are recording one-take live from CiscoTV Studio B at Cisco Live in Orlando, FL. - which leads to the second reason, there is video of this episode in the show notes blog post! Join us as we cover the VPNFilter update Talos released June 6th and we recap the inaugural Cisco Talos Threat Research Summit. Check out the full show notes Ed. Note - This is what no content editing looks like

Recorded 5/25/18 - As you can expect, this EP focuses on VPNFilter. We discuss how we got involved, why Talos made the decision to disclose when we did, and we cover many details of the malware itself. There is a lot of background to this ongoing discussion. Take a peek behind the curtain of the defense against this attack as we cover many different aspects of the malware, the attack, and the mitigation. Show notes on the Talos Blog

Recorded 5/11/18 - First and foremost, we recorded this EP one day before our “birthday”. We want to thank everyone, especially you (the listeners), who have let us do this for the last year racking up over half a million downloads!In this EP, we welcome special guest Nick Biasini from Talos Outreach - we set out to talk about several topics, but spend most of our time with Nick around the idea of building a stronger culture of cybersecurity and what it would take to raise the baseline. We are missing Matt this week, and hope he had an amazing time following the DMB tour up to Burlington or whatever he was doing.

Recorded 4/27/18 - Special guest intro this week from Chippah. We chat about what defines an “APT”, the recent BGP attacks, and the progress of GravityRAT. We also get an update on Vuln Discovery and the spate of recent releases. Matt has specific feelings about USB-C and his new computer.

Recorded 4/13/18 - We just upgraded all our gear, so naturally we had a straight tech meltdown this week and we saved it the best we could. Matt will sound way better next week. Promise. We cover Smart Installer. Again. But that leads down a discussion of security versus convenience that leads to us discussing the process of vuln disclosure - how vendor discussions, release dates, and policies work in the real world. Seriously, we grounded Matt’s computer for misbehaving with the audio.

Recorded 3/29/18 - Joel is sitting out this week and Bill Largent from the Outreach team fills in. We are pretty sure he was just wrong late trying to live on Joel Mean Time, which is now a GitHub project thanks to Moses (link below). We cover a wide range in this episode, so stay with us! We chat about the Talos Threat Research Summit coming in June, we wonder where the carrots to match the sticks in security are, and the value of finding your own damn vulns. The last part of the show starts with discussing GoScanSSH which ends up being a discussion on the larger battle for the edge.

Recorded 3/13/18 - LIVE from San Jose, CA. First of all - we still have a podcast and jobs, so ostensibly, we did okay hosting the meeting event we talked about last time. There may have even been an award involved, just sayin’. Since we were all in one place together and we didn’t get fired, we decided to do our podcast live after the meeting for an audience. We are joined by Talos Sr. Director Matt Watchinski this episode, discussing such existential questions as “why security?” and more concrete things like nation state vs. cybercriminal actors and their differing motivations. We also discuss router security and network devices as a preferred attack vector for advanced actors. Special bonus: Matt beats perhaps the last laugh out of the dead horse that is Paul Revere himself. #CantBooShowNotes

Recorded 3/2/18 - Craig is out this week, but the rest of the crew goes through COINHORDER and Memcached and takes a deeper look at authentication and passwords. We cover an overview of reflection attacks and how some passwords schemes that are meant to protect, actually cause harm. We also bid you farewell, since our next episode is supposed to be live after the crew hosts a meeting that stands a not-insignificant chance of getting us all fired. Wish us luck - and send us questions that can make Craig pose to really important Cisco executives.

Recorded 2/16/18 - This week, Mitch learns about starting a show without Matt with no other plans to control Craig in place. The team discusses Olympic Destroyer and then takes on attribution in light of recent developments with Nyetya. We look at what attribution actually takes and the ease and commonality of planting false flags.

Recorded 2/2/18 - Guests two EPs in a row! We are joined by Omar Santos from Cisco PSIRT to discuss CVE-2018-0101, the Cisco ASA Remote Code Execution and Denial of Service Vulnerability. See the PSIRT post below for latest updates. We also discuss Crypto miners overtaking ransomware, a Flash 0-day carrying a known ROKRAT payload (huh??), and we couldn’t escape discussing Autosploit because Rob Joyce faved one of Craig’s tweets.

It is a packed episode this time! We are joined by Edmund from the Talos Outreach Group to chat about Threat Modeling after we make our way through attribution and Group 123, hipster artisanal patching (hand flipped bits!), and spend a good bit of time talking about how Talos identifies the cream of the crop when we are hiring.

This is easily our best podcast of 2018 (so far). The crew discusses the recent spike in crypto-mania sweeping the globe and also goes in-depth on how vulnerability discovery plays a critical role in overall security. Plus, the crew all (shockingly) have different takes on Spectre/Meltdown and Craig decides to up the ante with the killer robots.

Quotes intended, we think you know why. Mitch takes control to present the best of the first (partial) year of the podcast. He covers some of our guests, some of our favorite non-security bits, and a look back at our in-the-moment view of some of the top stories of the year.Things you can look forward to: Mitch struggling through sailing solo with bad bits and unnecessary ukulele music, and a not-at-all-contrived apology for permanently deleting the hilarious fallout from an embarrassing faux pas. …but the clips are really good!

It’s the last full episode of the year! Thanks to you and the diligent work of Matt’s loving mother, the first 17 EPs of Beers with Talos were downloaded over 200,000 times in 2017! To show our gratitude, we are giving you not one, but TWO roundtables this week and even a special bonus rant! Also, Mitch can’t say words good, and Craig reads us stories from the blog!

Matt hijacks the Roundtable to tell us which Spice Girl each host is, because where else does a PR gimmick from KFC lead? Also, what’s worse than clicking a search result and getting a slideshow listicle? Getting a trojan payload when searching for banking forms (but that is the only thing that is worse - ARE YOU LISTENING BUZZFEED?). We also discuss the misnaming of troll farms and how patching and proper network segmentation are your friends - unlike anyone who publishes clickbait slideshows - STILL LOOKING AT YOU, BUZZFEED)

The crew takes on Apache OpenOffice vulns and when you need one CVE versus one hundred. We spend a lot of time discussing signal to noise ratio and Twitter canaries getting things wrong. Of course, we also discuss Bad Rabbit, its relationship to Nyetya, and why OpenOffice vulns are a worry, even to businesses that are run like hippie communes. As per usual, we mostly just make bad jokes.

In this EP, we take on interviewing and finding a job with technical questions and tests (hint: don’t oversell yourself, and make sure your mute button actually works). We also talk about enabling users with security as opposed to hobbling them. When Craig brings up the Google Home Mini beta test issues, he ends up taking a ration over his choices in handling the situation. We also discuss some clever new phishing techniques that insert malware links mid-conversation with a trusted party.

We haven’t gone around the table and introduced ourselves in some time (about 50k downloads ago), so we take the time we usually complain about things at the top of the show to do that. We have seen a massive amount of “top-tier” threats in the last six months or so. While it might seem like comparing apples and oranges (hint: it is), the crew takes a stab at ranking these recent threats/attacks: CCleaner, Deloitte, Equifax, Nyetya, SEC, Shamoon2, WannaCry. Shockingly, all of us have a different ranking. What’s your list look like?Regarding response: Consistency matters, don’t be clever. We discuss some recent unbelievably boneheaded things we have seen in security response. More importantly, we discuss how you SHOULD respond to an incident.Remember: Complexity kills. Unfortunately, it doesn’t kill thought leaders

Struts - when to patch and when to patch with a vengeance. In light of the Equifax breach, we discuss how patching can make you live better days, Never look back and say, Could have been me. Naturally, that covo leads into the biggest story of the week around Pwning the Supply Chain - CCleaner, Python, and Nyetya style. Avast made some mistakes, but every tech company is susceptible to supply chain attacks. What can companies do to protect themselves and how can users adopt a stronger security posture in this area? We also talk Ex$ploit Economy - Valuing exploits by supply and demand. Zerodium has an extensive price list, what can we discern about the availability and difficulty of various exploits using basic economics?

Matt runs the ship this week in Mitch’s absence. Craig and Nigel are joined by Bill Largent and Joel was… in a meeting? The crew discusses ambulance chasing and crying wolf in the security industry and also what the security press is doing to perpetuate questionable reporting. We also chat at length about what exactly goes into vulnerability discovery, chaining exploits, and the months of work to get to those “12 seconds” of glory at Pwn2Own.Did we mention the internet ate our attempted episode last week? Sorry about that. We do our best to make up for missing a week this time. But man, that was a great episode you missed…

Off the top: Better late than never? On top of being distributed all around the planet this week, we had some technical issues with our recording platform. Matt’s audio remained a challenge; it is rough this week. Bear with us, the audio quality will be back to what you have come to expect next episode. If you would like to speak to the manager, please hold. The last several years have seen a continuing surge in booters, DDOS, and combined exploit campaigns for-hire coming out of Asia and other regions. What does this tell us about the continued “professionalization” of the cyber criminal enterprise? We also discuss “hacking back” - some say it should be legal. Most people who know what they are talking about seem to think otherwise.

The BlackHat/DEFCON recovery episode. This one may be a touch rough, with some great gems. We discuss why music in 1994 was so terrible, including a BWT rendition of some classic Ace of Bass. The FIRST tool is discussed in some detail, how using our IDA Pro plug-in saves time a reduces duplication of effort. A vital topic in this EP is Matt’s post “On Conveying Doubt” how can intel professionals couch our findings in the appropriate amount of certainty.We discuss Warren’s amazing shorts ad nauseam (thanks Sammi for the submission!!) and also talk about ClamAV 0.99.3 release and what you’ll find inside.Main topic - what is the value in the mega-cons? Are they getting too big? Has the value increased, decreased, or just changed with growth?

This is a special episode, we are joined by long-time friend of Talos, Dr. Adam J. O’Donnell, PhD. Adam is the founder/co-founder of many amazing technologies, including Immunet and had created the core technologies of many tools on the frontlines of cybe rwarfare. He gives us a candid look at his process in building security technologies, his interest in the arts, and why you should let him know about any heart conditions before going out for the evening.This is our last podcast before BlackHat and DEFCON as well - we have some great info on how to get catch Talos at Security Summer Camp 2017 as well a preview of the winning submission of the #ShortsForWarren competition. Poor, poor Warren. He made a bad decision letting us do this.Craig and Joel split time in this episode, because Joel had meetings and Craig was having a BBQ he didn’t invite us to.

Nyetya, NotPetya, PetrWrap, ExPetr, whatever you want to call it - although Nyetya is clearly the most clever name, not that Warren and I came up with it or anything - has wrecked havoc on the Ukraine and multinational companies doing business there. This episode takes a deep look at the threat, the vectors used, and how it worked. We also discuss how organizations can protect themselves from this and similar threats that we will likely see in the future.Feedback question: Send us links to the shorts Warren (@SecurityBeard) should wear the to Talos party at BlackHat. If we pick your submission, we will send you a Talos loot drop! Tweet us @TalosSecurity #Shorts4Warren or email [email protected]

Special guest and Talos team member Sean Baird comes by to discuss the Fake News Challenge - and the Talos team, Solat in the Swen, taking first place in stage 1. Nigel displays a disturbing lack of faith in Python. Joel and Matthew both provide an insane amount of valuable commentary compared to previous episodes. The part of Matthew Olney is being played by Kate Nolan. Joel Esler is being played by Dave Maynor.Feedback question: Why should we let Joel back on the podcast? Tweet us @TalosSecurity

The team discusses how to get into threat intel and join a team like Talos. There are many routes to enter the Talos, but no exits. Seriously, they won’t let me leave. Passwords, vaults, and other access controls are discussed more in-depth as well.Mitch opens the show discussing poor life choices like drinking with folks from Norn Iron, Nigel divulges details of his life-long obsession with men in shorts, Matt forces his team to endure war games in suburban Baltimore, Joel threatens to have a mental breakdown over buzzwords, and Craig turns his roundtable segment into a full topic…shocking, I know. Feedback question: What SHOULD Nigel be tweeting?Tweet us @TalosSecurity, use #BWT or email us [email protected].

The crew talks about the potential of Samba echoing WannaCry and blocking SMB ports (but you already did that, RIGHT?). Also, get a history lesson and proper usage guidance on words like 0-day, backdoor, and other terms that the industry loves to hype and abuse for extra clicks.Feedback question: What is stuck in Joel’s head? Tweet us @TalosSecurity or email us [email protected]

Friday May 12 brought us the WannaCry/wcrypt ransomware worm. In this podcast dedicated entirely to WannaCry, Craig, Joel and Mitch are joined by Matt Olney, head of the threat intelligence group at Talos, and Warren Mercer, Talos Tech Lead. We discuss what we know so far and what we can expect to see in the near future.

Discussion around what’s real and what’s not with recent FCC decisions, FUD in the security press, ROKRAT hitting selected targets in South Korea, and if software itself can be illegal. Bonus topic: Mayor Joel was once a real thing.

Craig, Nigel, Joel and Mitch discuss spam resurgence via Necurs waking up, vuln dev in niche spaces, Crypt010cker, and hacking video games as a gateway drug for researchers.

Four guys from Talos talking about breaking IoT, responsible vulnerability disclosure, and finding new malware…written in Go.