Risky Business #821 -- Wiz researchers could have owned every AWS customer

In this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, joined by a special guest. BBC World Cyber Correspondent Joe Tidy is a long time listener and he pops in for a ride-along in the news segment plus a chat about his new book.

This week news includes:

• Did the US cyber Venezuela’s power grid, or do they just want us to think they coulda?

• US govt might boycott the RSAC Conference ‘cause Jen Easterly being CEO makes them mad

• MS Patch Tuesday fixes CVSS5.5 bug and … stops you shutting down

• Wiz pulls off cloud stunt hack that ends with control of everyone’s AWS console

• Millions of Bluetooth devices that use Google’s Fast Pairing will pair with anyone, any time

• GNU inet-tools’ telnetd parties like it’s 2007, and brings -f root unauthed remote login back

Thinkst is this week’s sponsor, and long time friend of the show Haroon Meer joins. As always they’re polishing their Canary tokens - adding breadcrumbs to lead you to them - but they’re also a bunch of giant nerds who now run South Africa’s Computer Olympiad.

This episode is also available on Youtube (youtu.be/R_jyEjsckTY).

Show notes

• Cyberattack in Venezuela Demonstrated Precision of U.S. Capabilities - The New York Times (nytimes.com/2026/01/15/us/politics/cyberattack…)

• Why I’m withholding certainty that “precise” US cyber-op disrupted Venezuelan electricity - Ars Technica (arstechnica.com/security/2026/01/unnamed-offic…)

• Layered Ambiguity: US Cyber Capabilities in the Raid to Extract Maduro from Venezuela | Royal United Services Institute (rusi.org/explore-our-research/publications/com…)

• Former CISA Director Jen Easterly Will Lead RSAC Conference | WIRED (wired.com/story/former-cisa-director-jen-easte…)

• Trump officials consider skipping premier cyber conference after Biden-era cyber leader named CEO - Nextgov/FCW (nextgov.com/people/2026/01/trump-officials-con…)

• Federal agencies ordered to patch Microsoft Desktop Windows Manager bug | The Record from Recorded Future News (therecord.media/desktop-windows-manager-vulner…)

• Windows 11 shutdown bug forces Microsoft into damage control • The Register (theregister.com/2026/01/19/windows_11_shutdown…)

• CodeBreach: Supply Chain Vuln & AWS CodeBuild Misconfig | Wiz Blog (wiz.io/blog/wiz-research-codebreach-vulnerabil…)

• Critical flaw in AWS Console risked compromise of build environment | Cybersecurity Dive (cybersecuritydive.com/news/critical-flaw-in-aw…)

• Never-before-seen Linux malware is “far more advanced than typical” - Ars Technica (arstechnica.com/security/2026/01/never-before-…)

• VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun - Check Point Research (research.checkpoint.com/2026/voidlink-early-ai…)

• Hundreds of Millions of Audio Devices Need a Patch to Prevent Wireless Hacking and Tracking | WIRED (wired.com/story/google-fast-pair-bluetooth-aud…)

• Critical flaw in Fortinet FortiSIEM targeted in exploitation threat | Cybersecurity Dive (cybersecuritydive.com/news/critical-flaw-in-fo…)

• CVE-2025-64155: 3 Years of Remotely Rooting the FortiSIEM (horizon3.ai/attack-research/disclosures/cve-20…)

• A single click mounted a covert, multistage attack against Copilot - Ars Technica (arstechnica.com/security/2026/01/a-single-clic…)

• Police raid homes of alleged Black Basta hackers, hunt suspected Russian ringleader | The Record from Recorded Future News (therecord.media/police-raid-homes-of-alleged-b…)

• Jordanian initial access broker pleads guilty to helping target 50 companies | The Record from Recorded Future News (therecord.media/guilty-plea-initial-access-bro…)

• Supreme Court hacker posted stolen government data on Instagram | TechCrunch (techcrunch.com/2026/01/16/supreme-court-hacker…)

• oss-sec: GNU InetUtils Security Advisory: remote authentication by-pass in telnetd (seclists.org/oss-sec/2026/q1/89)

• How crypto criminals stole $700 million from people - often using age-old tricks (bbc.com/news/articles/c93w30gl5jno)

• Ctrl + Alt + Chaos: How Teenage Hackers Hijack the Internet (amazon.com/Ctrl-Alt-Chaos-Teenage-Internet/dp/…)