Risky Business #721 -- Why Storm-0558's Microsoft hack should have failed

<p>On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They cover:</p> <ul> <li>How Storm-0558 stole Microsoft’s signing key</li> <li>Cisco 0day being used by ransomware crews</li> <li>We were right about Elon stumbling into the Ukraine war</li> <li>Someone’s amazing image library 0day just got crushed</li> <li>Much, much more!</li> </ul> <p>This week’s show is brought to you by Nucleus Security. Co-founder Scott Kuffer is this week’s sponsor guest.</p> <p>Links to everything that we discussed are below and you can follow <a href="https://infosec.exchange/@riskybusiness">Patrick</a> or <a href="https://infosec.exchange/@metlstorm">Adam</a> on Mastodon if that’s your thing.</p> <div class="panel panel-default"> <div class="panel-heading"> <h3 class="panel-title">Show notes</h3> </div> <div class="panel-body"> <ul> <li><a href="https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/">Results of Major Technical Investigations for Storm-0558 Key Acquisition | MSRC Blog | Microsoft Security Response Center</a></li> <li><a href="https://techcrunch.com/2023/09/08/microsoft-hacker-china-government-storm-0558/">Microsoft reveals how hackers stole its email signing key… kind of | TechCrunch</a></li> <li><a href="https://cyberplace.social/@GossiTheDog/111022570574140684">Kevin Beaumont: &quot;One extra thing to highlight -…&quot; - Cyberplace</a></li> <li><a href="https://www.youtube.com/watch?v=KN6e1mqcB9s">Preventing Authentication Bypass: A Tale of Two Researchers - YouTube</a></li> <li><a href="https://www.cybersecuritydive.com/news/bec-phishing-kit-microsoft-365-business/692988/