S3 Ep102: Cutting through cybersecurity news hype

·21 min·2 clips

What do the Uber breach, Rockstar hack, and the mysterious Lapsus Dollar group reveal about cybersecurity hype?

The episode opens with Paul Ducklin and Chester Wisniewski discussing the ongoing saga of the Uber and Rockstar Games breaches, allegedly connected to the cybercrime group Lapsus Dollar. They note the arrest of a 17-year-old in Oxfordshire but caution against jumping to conclusions, emphasizing the lack of verified facts. The conversation shifts to multi-factor authentication lessons from the Uber breach, where push notification fatigue allowed access. Next, they cover the Optus breach in Australia, where an unauthenticated API endpoint exposed data of over 9 million customers, including passport and driver's license details. The hosts compare this to past incidents like the AT&T hack by Weave and discuss law enforcement involvement. They then explore ransomware trends, noting some groups now exfiltrate and wipe data instead of encrypting it, highlighting the need for behavioral monitoring. The episode critiques media sensationalism around a WhatsApp vulnerability, distinguishing between actual zero-days and proactive patches. Chester mentions a $100,000 bug bounty for an OpenSea vulnerability as an example of responsible disclosure. Finally, they analyze Morgan Stanley's $35 million fine for failing to wipe hard disks containing client data, which resurfaced years later, stressing the importance of encryption and proper disposal. The hosts wrap up by emphasizing prevention over reaction in cybersecurity.

As heard by us

Breach reporting that stays measured and lands on the controls that matter.

Naked Security keeps a disciplined focus on what can be verified, using the Uber breach, the Rockstar Games/Take-Two Interactive hack, and the still-uncertain Lapsus Dollar story to anchor a measured account.

Read the full review in PlayNext →

Why you'd press play

If hype makes your security news feel like a tabloid, this one sorts the Uber, Rockstar, Lapsus Dollar, and Optus mess into something usable.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Naked Security