Risky Business #710 -- Why your corporate VPN will get you owned

<p>On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:</p> <ul> <li>Fortinet 0day Groundhog Day</li> <li>CISA’s new binding directive on exposed management interfaces</li> <li>Confirmed: US intelligence buying commercially available data</li> <li>MOVEit drama rolls on</li> <li>Much, much more</li> </ul> <p>This week’s show is brought to you by Red Canary. Chris Rothe is this week’s sponsor guest and he joins us to talk about how MDR providers are helping customers deal with cloud monitoring.</p> <p>Links to everything that we discussed are below and you can follow <a href="https://infosec.exchange/@riskybusiness">Patrick</a> or <a href="https://infosec.exchange/@metlstorm">Adam</a> on Mastodon if that’s your thing.</p> <div class="panel panel-default"> <div class="panel-heading"> <h3 class="panel-title">Show notes</h3> </div> <div class="panel-body"> <ul> <li><a href="https://www.securityweek.com/fortinet-warns-customers-of-possible-zero-day-exploited-in-limited-attacks/">Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks - SecurityWeek</a></li> <li><a href="https://krebsonsecurity.com/2023/06/barracuda-urges-replacing-not-patching-its-email-security-gateways/">Barracuda Urges Replacing — Not Patching — Its Email Security Gateways – Krebs on Security</a></li> <li><a href="https://therecord.media/moveit-announces-new-vulnerability-minnesota-breached">MOVEit announces second vulnerability; Minnesota schools agency breached with original bug</a></li> <li><a href="https://therecord.media/ofcom-cyberattack-uk-regulator-moveit-vulnerability">Confidential data downloaded from UK regulator Ofcom in cyberattack</a></li>