Risky Business #789 -- Apple's AirPlay vulns are surprisingly awful

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

• British retail stalwart Marks & Spencer gets cybered

• South Korean telco sets out to replace all its subscriber SIMs after (we assume) it lost the keymat

• It’s a good exploit week! Bugs in Apple Airplay, SAP webservers, Erlang SSH and CommVault backups

• Juice jacking! No, really! Some researchers actually did it (so still not in the wild, then)

• Anti-DOGE whistleblower sure sounds like he has a point

This week’s episode is sponsored by Knocknoc, who let you glue your firewalls to your single sign on. Knocknoc’s CEO Adam Pointon talks about the joy that having end-to-end IPv6 would bring for zero-trust access control. He also touches on people using Knocknoc inside their network to isolate critical systems.

Editors Note : Pat also gives Adam (Boileau) stick in the sponsor interview about the Risky Biz webserver not having IPv6 enabled, which fact-checking during the edit says is FAKE NEWS. Just uh, don’t look at how fresh that AAAA record in the DNS is, friends 😉

This episode is also available on Youtube (youtu.be/wke0U7WKI5o).

Show notes

• British retailer M&S confirms being hit by ‘cyber incident’ amid store delays | The Record from Recorded Future News (therecord.media/british-retailer-MS-confirms-c…)

• M&S cyber-attack linked to hacking group Scattered Spider | Marks & Spencer | The Guardian (theguardian.com/business/2025/apr/29/m-and-s-c…)

• Bina Puri shares, Warrant B close sharply lower day after hacking (theedgemalaysia.com/node/752925)

• Bina Puri, Pos Malaysia tumble following hacking incident | FMT (freemalaysiatoday.com/category/highlight/2025/…)

• Japan warns of hundreds of millions of dollars in unauthorized trades from hacked accounts | The Record from Recorded Future News (therecord.media/japan-warns-of-unauthorized-tr…)

• US conducts cyberattacks against major Chinese commercial encryption provider: report - Global Times (globaltimes.cn/page/202504/1333032.shtml)

• Iran says major cyberattack on infrastructure repelled | Iran International (iranintl.com/en/202504289343)

• Spain rules out cyber attack - but what could have caused power cut? (bbc.com/news/articles/c209yrl3258o)

• South Korea's SK Telecom begins SIM card replacement after data breach (france24.com/en/live-news/20250428-south-korea…)

• AirBorne: Wormable Zero-Click RCE in Apple AirPlay Puts Billions of Devices at Risk | Oligo Security | Oligo Security (oligo.security/blog/airborne)

• iOS and Android juice jacking defenses have been trivial to bypass for years - Ars Technica (arstechnica.com/security/2025/04/ios-and-andro…)

• How Android 16's new security mode will stop USB-based attacks - Android Authority (androidauthority.com/android-16-usb-data-advan…)

• Researchers warn of critical flaw found in Erlang OTP SSH | Cybersecurity Dive (cybersecuritydive.com/news/researchers-warn-of…)

• Critical vulnerability in SAP NetWeaver under threat of active exploitation | Cybersecurity Dive (cybersecuritydive.com/news/critical-vulnerabil…)

• CVE-2025-31324: Critical SAP Flaw Explained | Strobes (strobes.co/blog/cve-2025-31324-critical-sap-fl…)

• Fire In The Hole, We’re Breaching The Vault - Commvault Remote Code Execution (CVE-2025-34028) (labs.watchtowr.com/fire-in-the-hole-were-breac…)

• Risky Bulletin: NFC card malware keeps evolving in Russia, a bad omen for the future - Risky Business Media (risky.biz/risky-bulletin-nfc-card-malware-keep…)

• Hegseth had unsecured internet line in Pentagon for Signal, sources say | AP News (apnews.com/article/hegseth-signal-chat-dirty-i…)

• Whistleblower: DOGE Siphoned NLRB Case Data – Krebs on Security (krebsonsecurity.com/2025/04/whistleblower-doge…)

• whistlebloweraid.org/wp-content/uploads/2025/0…

• CISA gets a deputy director as it braces for major layoffs | Cybersecurity Dive (cybersecuritydive.com/news/cisa-deputy-directo…)

• Two top cyber officials resign from CISA | The Record from Recorded Future News (therecord.media/two-top-cyber-officials-resign…)

• Ex-CISA chief Chris Krebs leaving SentinelOne following Trump pressure | Reuters (reuters.com/technology/ex-cisa-chief-chris-kre…)

• Former cyber official targeted by Trump speaks out after cuts to digital defense (nbcnews.com/politics/national-security/chris-k…)

• Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today's Adversaries | SentinelOne (sentinelone.com/labs/top-tier-target-what-it-t…)

• ZachXBT on X: "Nine hours ago a suspicious transfer was made from a potential victim for 3520 BTC ($330.7M)" (x.com/zachxbt/status/1916756932763046273)