If you spend your days building, shipping, defending, or fixing systems, you already know how this goes. A new technique shows up in a research thread, someone drops a βhas anyone checked if weβre exposed?β comment, and suddenly youβre juggling risk, patches, logging gaps, and whatever tool is in the blast radius this week.
That day-to-day reality is why Rapid7 Labs is launching Hacktics and Telemetry, a bi-weekly video and audio podcast with episodes built to fit into a lunch break or a commute. Itβs hosted by Rapid7's Douglas McKee, bringing to the pod years of deep technical and leadership experience, then co-hosted by Jonah βCryptoCatβ Burgess β a strong researcher with a solid pulse on the cybersecurity community.
The format stays consistent on purpose. Each episode starts with a scan of whatβs emerging, shifts into a guest conversation, then closes with a short segment that ties the story back to mitigation and tooling. The goal is simple: move past theory, show whatβs happening with real examples, and leave you with something you can act on.
Doug and Jonah open by digging into two AI-centric stories from the past week. The first is PhoneLeak, described as data exfiltration in Gemini via phone call. Itβs the kind of uncomfortable example that forces practical questions: how do you defend against mobile clickjacking when it's disguised as a routine CAPTCHA? When an AI assistant has deep extensions into a user's workspace, how do you prevent malicious prompts from quietly accessing sensitive data like 2FA codes? And perhaps most importantly, how do defenders anticipate and monitor for bizarre, out-of-the-box exfiltration methodsβlike an AI bypassing SMS confirmations to leak data via DTMF tones on a phone call?
The second story comes from the other side of the AI conversation: an AI agent reportedly identifying an RCE in BeyondTrust remote support, plus discussion of older privileged remote access versions. More automation can mean faster discovery, which shrinks the window between βinteresting findingβ and βyou need to patch this.β That changes how defenders think about exposure, patch prioritization, and what βgood enoughβ means (and looks like) when it comes to monitoring.
In the guest segment, Greg Richardson (Global Advisory CISO & AI Thought Leader, 6 Levers AI) walks through how he uses AI agents in his workflow while keeping control tight. He talks about setting tasks while he sleeps, but the constraints are the point: access is locked down, the agent only touches files he explicitly provides, communication is limited, and token limits help cap the size of any mistake. He also makes a strong case for starting small, with one task at a time, instead of trying to automate dozens of things on day one.
To close out this inaugural episode, the team hits on a SolarWinds Help Desk vulnerability, then shares a quick look at Metasploit Pro 5.0 updates β including more granular payload selection and a walkthrough of the new UI.
If your idea of useful content includes threat trade-offs, concrete mitigations, and a bit of candid βhow this actually plays out,β youβre in the right place.
Catch the full episode below:
β
Download slides:Β https://www.activecountermeasures.com/presentations In this webcast we walk through the step-by-step defenses to stop the attackers in every step of the way we showed in Attack Tactics Part 5!!! Originally recorded [β¦]
The post Podcast: Attack Tactics 6! Return of the Blue Team appeared first on Black Hills Information Security, Inc..
Take a good look at Bitcoin right nowβ¦ these are the unlucky ones. These are the unfortunate souls who jumped on another overinflated balloon. But, does this Bitcoin crash completely [β¦]
The post BHIS Podcast: Blockchain and You! InfoSec Edition appeared first on Black Hills Information Security, Inc..
For this podcast we cover a couple of different topics. First, we talk about how to password spray in a non-attributable sort of way. Beau found a way to obfuscate [β¦]
The post PODCAST: RDP Logging Bypass and Azure Active Directory Recon appeared first on Black Hills Information Security, Inc..
In this webcast we cover some of the core tools we use all the time at Black Hills Information Security. However, thereβs a twist. We donβt talk about Nessus, Nmap, [β¦]
The post PODCAST: BHIS Sorta Top Used Tools of 2018 appeared first on Black Hills Information Security, Inc..
Yes.. Ethical Hacker Kids. The holidays are coming up! Here John & Jordan cover the different games, tools and gifts we can give kids that help teach them the trade. [β¦]
The post PODCAST: Raising Hacker Kids appeared first on Black Hills Information Security, Inc..
Over the past few months, we have discovered a couple trends that organizations seem to be missing. No silver bullets, just some general vulnerability issues we are seeing again and [β¦]
The post PODCAST: Blue Team-Apalooza appeared first on Black Hills Information Security, Inc..
John Strand shares some of his own journey into information security and also his ideas and tips for those wanting to get into the industry from the start, or those [β¦]
The post PODCAST: John Strandβs 5 Year Plan into InfoSec Part 2 appeared first on Black Hills Information Security, Inc..
Join special guest Chris Brenton, COO of Active Countermeasures, as he discusses the anatomy of beacons and why you need to be looking for them during a threat hunt. He [β¦]
The post PODCAST: Beacon Analysis appeared first on Black Hills Information Security, Inc..
Login