<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" encoding="UTF-8" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:admin="http://webns.net/mvcb/" xmlns:atom="http://www.w3.org/2005/Atom/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:googleplay="http://www.google.com/schemas/play-podcasts/1.0" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd" xmlns:fireside="http://fireside.fm/modules/rss/fireside">
  <channel>
    <fireside:hostname>web02.fireside.fm</fireside:hostname>
    <fireside:genDate>Sat, 25 Apr 2026 01:56:26 -0500</fireside:genDate>
    <generator>Fireside (https://fireside.fm)</generator>
    <title>Three Buddy Problem - Episodes Tagged with “Sophos”</title>
    <link>https://securityconversations.fireside.fm/tags/sophos</link>
    <pubDate>Sat, 09 Nov 2024 11:00:00 -0700</pubDate>
    <description>The Three Buddy Problem is a popular Security Conversations podcast that goes beyond industry talking points to discuss what others won’t -- nation-state malware, attribution, cyberwar, ethics, privacy, and the messy realities of securing computers and corporate networks. 
Hosted by three veteran security pros -- journalist Ryan Naraine and malware paleontologists Costin Raiu and Juan Andres Guerrero-Saade -- the weekly show attracts a highly engaged audience of security researchers, corporate defenders, CISOs, and policymakers.
&lt;a href="https://twitter.com/ryanaraine"&gt;Connect with Ryan on Twitter&lt;/a&gt; (Open DMs).
</description>
    <language>en-us</language>
    <itunes:type>episodic</itunes:type>
    <itunes:subtitle>A Security Conversations podcast</itunes:subtitle>
    <itunes:author>Security Conversations</itunes:author>
    <itunes:summary>The Three Buddy Problem is a popular Security Conversations podcast that goes beyond industry talking points to discuss what others won’t -- nation-state malware, attribution, cyberwar, ethics, privacy, and the messy realities of securing computers and corporate networks. 
Hosted by three veteran security pros -- journalist Ryan Naraine and malware paleontologists Costin Raiu and Juan Andres Guerrero-Saade -- the weekly show attracts a highly engaged audience of security researchers, corporate defenders, CISOs, and policymakers.
&lt;a href="https://twitter.com/ryanaraine"&gt;Connect with Ryan on Twitter&lt;/a&gt; (Open DMs).
</itunes:summary>
    <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/5/5f0c01ff-49f1-4c51-a8f8-f14c0d9bc72e/cover.jpg?v=15"/>
    <itunes:explicit>no</itunes:explicit>
    <itunes:keywords>cybersecurity, ciso, infosec, security, hacking, information security, research</itunes:keywords>
    <itunes:owner>
      <itunes:name>Security Conversations</itunes:name>
      <itunes:email>naraine@gmail.com</itunes:email>
    </itunes:owner>
<itunes:category text="Technology"/>
<itunes:category text="News">
  <itunes:category text="Tech News"/>
</itunes:category>
<itunes:category text="Technology"/>
<item>
  <title>Mysterious rebooting iPhones, EDR vendors spying on hackers, Bitcoin 'meatspace' attacks</title>
  <link>http://securityconversations.fireside.fm/tbp-ep20</link>
  <guid isPermaLink="false">4b7375c6-6a49-4e92-8bd1-e706a996e883</guid>
  <pubDate>Sat, 09 Nov 2024 11:00:00 -0700</pubDate>
  <author>Security Conversations</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/5f0c01ff-49f1-4c51-a8f8-f14c0d9bc72e/4b7375c6-6a49-4e92-8bd1-e706a996e883.mp3" length="76955697" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>Security Conversations</itunes:author>
  <itunes:subtitle>Three Buddy Problem Episode 20:  We revisit the ‘hack-back’ debate, the threshold for spying on adversaries, Palo Alto watching EDR bypass research to track threat actors, hot nuggets in Project Zero’s Clem Lecinge’s Hexacon talk, Apple’s new iOS update rebooting iPhones in law enforcement custody, the mysterious GoblinRAT backdoor, and physical ‘meatspace’ Bitcoin attacks and more details on North Korean cryptocurrency theft.

Cast: Ryan Naraine (SecurityWeek), Juan Andres Guerrero-Saade (SentinelLabs), Costin Raiu (Art of Noh).</itunes:subtitle>
  <itunes:duration>1:37:00</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/5/5f0c01ff-49f1-4c51-a8f8-f14c0d9bc72e/episodes/4/4b7375c6-6a49-4e92-8bd1-e706a996e883/cover.jpg?v=1"/>
  <description>Three Buddy Problem - Episode 20:  We revisit the ‘hack-back’ debate, the threshold for spying on adversaries, Palo Alto watching EDR bypass research to track threat actors, hot nuggets in Project Zero’s Clem Lecinge’s Hexacon talk, Apple’s new iOS update rebooting iPhones in law enforcement custody, the mysterious GoblinRAT backdoor, and physical ‘meatspace’ Bitcoin attacks and more details on North Korean cryptocurrency theft.
Cast: Juan Andres Guerrero-Saade (https://twitter.com/juanandres_gs) (SentinelLabs), Costin Raiu (https://twitter.com/craiu) (Art of Noh) and Ryan Naraine (https://twitter.com/ryanaraine) (SecurityWeek).
</description>
  <itunes:keywords>Keywords  cybersecurity, EDR software, Google Project Zero, telemetry, threat intelligence, information sharing, security research, exploitation techniques, legal considerations, transparency, EDR, Windows Defender, telemetry, security research, Apple, malware analysis, privacy, law enforcement, cybersecurity, antivirus, Salt Typhoon, Chinese APTs, cyber threats, Goblin Rat, Bitcoin attacks, North Korea, espionage, cybersecurity, iOS vulnerabilities, surveillance</itunes:keywords>
  <content:encoded>
    <![CDATA[<p><strong>Three Buddy Problem - Episode 20</strong>:  We revisit the ‘hack-back’ debate, the threshold for spying on adversaries, Palo Alto watching EDR bypass research to track threat actors, hot nuggets in Project Zero’s Clem Lecinge’s Hexacon talk, Apple’s new iOS update rebooting iPhones in law enforcement custody, the mysterious GoblinRAT backdoor, and physical ‘meatspace’ Bitcoin attacks and more details on North Korean cryptocurrency theft.</p>

<p><strong>Cast:</strong> <a href="https://twitter.com/juanandres_gs" rel="nofollow">Juan Andres Guerrero-Saade</a> (SentinelLabs), <a href="https://twitter.com/craiu" rel="nofollow">Costin Raiu</a> (Art of Noh) and <a href="https://twitter.com/ryanaraine" rel="nofollow">Ryan Naraine</a> (SecurityWeek).</p><p>Links:</p><ul><li><a title="Transcript (unedited, AI-generated)" rel="nofollow" href="https://docs.google.com/document/d/1_R5EC39CoxPRz67njLfqKVLjq8bdkdh6h7l7UwaVHAE/edit?usp=sharing">Transcript (unedited, AI-generated)</a></li><li><a title="iPhones mysteriously rebooting themselves" rel="nofollow" href="https://archive.vn/JMEbq">iPhones mysteriously rebooting themselves</a></li><li><a title="Apple quietly ships iPhone reboot code" rel="nofollow" href="https://archive.ph/lpoLQ">Apple quietly ships iPhone reboot code</a></li><li><a title="FBI on China hacking US presidential campaigns iPhones" rel="nofollow" href="https://archive.ph/iAQzO">FBI on China hacking US presidential campaigns iPhones</a></li><li><a title="Chinese hackers Targeted Phones of Trump, Vance, Harris Campaigns" rel="nofollow" href="https://www.wsj.com/politics/national-security/chinese-hackers-targeted-phones-of-trump-vance-and-harris-campaign-e04abbdf?mod=article_inline">Chinese hackers Targeted Phones of Trump, Vance, Harris Campaigns</a></li><li><a title="Palo Alto: EDR Bypass Testing Reveals Threat Actor&#39;s Toolkit" rel="nofollow" href="https://unit42.paloaltonetworks.com/edr-bypass-extortion-attempt-thwarted/">Palo Alto: EDR Bypass Testing Reveals Threat Actor's Toolkit</a></li><li><a title="Palo Alto CVE-2024-5910 marked as exploited" rel="nofollow" href="https://security.paloaltonetworks.com/CVE-2024-5910">Palo Alto CVE-2024-5910 marked as exploited</a></li><li><a title="Toronto crypto company CEO kidnapped" rel="nofollow" href="https://www.cbc.ca/news/canada/toronto/kidnapping-toronto-businessman-cryptocurrency-1.7376679">Toronto crypto company CEO kidnapped</a></li><li><a title="A list of known &#39;meatspace&#39; crypto attacks" rel="nofollow" href="https://github.com/jlopp/physical-bitcoin-attacks">A list of known 'meatspace' crypto attacks</a></li><li><a title="North Korea crypto thieves targets macOS" rel="nofollow" href="https://www.sentinelone.com/labs/bluenoroff-hidden-risk-threat-actor-targets-macs-with-fake-crypto-news-and-novel-persistence/">North Korea crypto thieves targets macOS</a></li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p><strong>Three Buddy Problem - Episode 20</strong>:  We revisit the ‘hack-back’ debate, the threshold for spying on adversaries, Palo Alto watching EDR bypass research to track threat actors, hot nuggets in Project Zero’s Clem Lecinge’s Hexacon talk, Apple’s new iOS update rebooting iPhones in law enforcement custody, the mysterious GoblinRAT backdoor, and physical ‘meatspace’ Bitcoin attacks and more details on North Korean cryptocurrency theft.</p>

<p><strong>Cast:</strong> <a href="https://twitter.com/juanandres_gs" rel="nofollow">Juan Andres Guerrero-Saade</a> (SentinelLabs), <a href="https://twitter.com/craiu" rel="nofollow">Costin Raiu</a> (Art of Noh) and <a href="https://twitter.com/ryanaraine" rel="nofollow">Ryan Naraine</a> (SecurityWeek).</p><p>Links:</p><ul><li><a title="Transcript (unedited, AI-generated)" rel="nofollow" href="https://docs.google.com/document/d/1_R5EC39CoxPRz67njLfqKVLjq8bdkdh6h7l7UwaVHAE/edit?usp=sharing">Transcript (unedited, AI-generated)</a></li><li><a title="iPhones mysteriously rebooting themselves" rel="nofollow" href="https://archive.vn/JMEbq">iPhones mysteriously rebooting themselves</a></li><li><a title="Apple quietly ships iPhone reboot code" rel="nofollow" href="https://archive.ph/lpoLQ">Apple quietly ships iPhone reboot code</a></li><li><a title="FBI on China hacking US presidential campaigns iPhones" rel="nofollow" href="https://archive.ph/iAQzO">FBI on China hacking US presidential campaigns iPhones</a></li><li><a title="Chinese hackers Targeted Phones of Trump, Vance, Harris Campaigns" rel="nofollow" href="https://www.wsj.com/politics/national-security/chinese-hackers-targeted-phones-of-trump-vance-and-harris-campaign-e04abbdf?mod=article_inline">Chinese hackers Targeted Phones of Trump, Vance, Harris Campaigns</a></li><li><a title="Palo Alto: EDR Bypass Testing Reveals Threat Actor&#39;s Toolkit" rel="nofollow" href="https://unit42.paloaltonetworks.com/edr-bypass-extortion-attempt-thwarted/">Palo Alto: EDR Bypass Testing Reveals Threat Actor's Toolkit</a></li><li><a title="Palo Alto CVE-2024-5910 marked as exploited" rel="nofollow" href="https://security.paloaltonetworks.com/CVE-2024-5910">Palo Alto CVE-2024-5910 marked as exploited</a></li><li><a title="Toronto crypto company CEO kidnapped" rel="nofollow" href="https://www.cbc.ca/news/canada/toronto/kidnapping-toronto-businessman-cryptocurrency-1.7376679">Toronto crypto company CEO kidnapped</a></li><li><a title="A list of known &#39;meatspace&#39; crypto attacks" rel="nofollow" href="https://github.com/jlopp/physical-bitcoin-attacks">A list of known 'meatspace' crypto attacks</a></li><li><a title="North Korea crypto thieves targets macOS" rel="nofollow" href="https://www.sentinelone.com/labs/bluenoroff-hidden-risk-threat-actor-targets-macs-with-fake-crypto-news-and-novel-persistence/">North Korea crypto thieves targets macOS</a></li></ul>]]>
  </itunes:summary>
</item>
<item>
  <title>The Sophos kernel implant, 'hack-back' implications, CIA malware in Venezuela</title>
  <link>http://securityconversations.fireside.fm/tbp-ep19</link>
  <guid isPermaLink="false">afe08ad2-3625-4575-aaae-280d146e474c</guid>
  <pubDate>Sun, 03 Nov 2024 12:00:00 -0700</pubDate>
  <author>Security Conversations</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/5f0c01ff-49f1-4c51-a8f8-f14c0d9bc72e/afe08ad2-3625-4575-aaae-280d146e474c.mp3" length="89415224" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>Security Conversations</itunes:author>
  <itunes:subtitle>Three Buddy Problem Episode 19:  We explore Ivan Kwiatkowski’s essay on the limits of threat intelligence, Sophos using kernel implants to surveil Chinese hackers, the concept of ‘hack-back’ and legal implications, geopolitical layers of cyber espionage, CIA malware in Venezuela, Vatican/Mossad mentioned in high-profile Italy hacks, and Canada bracing for .gov attacks from India.

Cast: Ryan Naraine (SecurityWeek), Juan Andres Guerrero-Saade (SentinelLabs), Costin Raiu (Art of Noh).</itunes:subtitle>
  <itunes:duration>1:54:14</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/5/5f0c01ff-49f1-4c51-a8f8-f14c0d9bc72e/episodes/a/afe08ad2-3625-4575-aaae-280d146e474c/cover.jpg?v=1"/>
  <description>Three Buddy Problem - Episode 19:   We explore Ivan Kwiatkowski’s essay on the limits of threat intelligence, Sophos using kernel implants to surveil Chinese hackers, the concept of ‘hack-back’ and legal implications, geopolitical layers of cyber espionage, CIA malware in Venezuela, Vatican/Mossad mentioned in high-profile Italy hacks, and Canada bracing for .gov attacks from India.
Cast: Juan Andres Guerrero-Saade (https://twitter.com/juanandres_gs) (SentinelLabs), Costin Raiu (https://twitter.com/craiu) (Art of Noh) and Ryan Naraine (https://twitter.com/ryanaraine) (SecurityWeek).
</description>
  <itunes:keywords>Sophos, implants, firewall devices, appliances, China, Chengdu, CIA, Fortinet, Ivanti, Barracuda, India, Canada</itunes:keywords>
  <content:encoded>
    <![CDATA[<p><strong>Three Buddy Problem - Episode 19</strong>:   We explore Ivan Kwiatkowski’s essay on the limits of threat intelligence, Sophos using kernel implants to surveil Chinese hackers, the concept of ‘hack-back’ and legal implications, geopolitical layers of cyber espionage, CIA malware in Venezuela, Vatican/Mossad mentioned in high-profile Italy hacks, and Canada bracing for .gov attacks from India.</p>

<p><strong>Cast:</strong> <a href="https://twitter.com/juanandres_gs" rel="nofollow">Juan Andres Guerrero-Saade</a> (SentinelLabs), <a href="https://twitter.com/craiu" rel="nofollow">Costin Raiu</a> (Art of Noh) and <a href="https://twitter.com/ryanaraine" rel="nofollow">Ryan Naraine</a> (SecurityWeek).</p><p>Links:</p><ul><li><a title="Transcript (unedited, AI-generated)" rel="nofollow" href="https://docs.google.com/document/d/1U8q76wqVXIs9Sdc8vuqAr2S9CtknvnYryxS6l0IALv8/edit?usp=sharing">Transcript (unedited, AI-generated)</a></li><li><a title="Ivan Kwiatkowski: Threat intel truths inside" rel="nofollow" href="https://blog.kwiatkowski.fr/threat-intel-truths-inside">Ivan Kwiatkowski: Threat intel truths inside</a></li><li><a title="JAG-S LABScon keynote" rel="nofollow" href="https://securityconversations.com/episode/ep13-the-consolation-of-threat-intel-jag-s-labscon-keynote/">JAG-S LABScon keynote</a></li><li><a title="Sophos Used Custom Implants to Surveil Chinese Hackers" rel="nofollow" href="https://www.securityweek.com/sophos-used-custom-implants-to-surveil-chinese-hackers-targeting-firewall-zero-days/">Sophos Used Custom Implants to Surveil Chinese Hackers</a></li><li><a title="Sophos Pacific Rim report" rel="nofollow" href="https://www.sophos.com/en-us/content/pacific-rim">Sophos Pacific Rim report</a></li><li><a title="NCSC details ‘Pygmy Goat’ network backdoor" rel="nofollow" href="https://www.securityweek.com/ncsc-details-pygmy-goat-backdoor-planted-on-hacked-sophos-firewall-devices/">NCSC details ‘Pygmy Goat’ network backdoor</a></li><li><a title="NCSC &#39;Pygmy Goat&#39; report" rel="nofollow" href="https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf">NCSC 'Pygmy Goat' report</a></li><li><a title="Massive hack-for-hire scandal rocks Italian political elites – POLITICO" rel="nofollow" href="https://www.politico.eu/article/hacking-scandal-italy-matteo-renzi-sergio-mattarella-equalize-nunzio-samuele-calamucci/">Massive hack-for-hire scandal rocks Italian political elites – POLITICO</a></li><li><a title="Vatican, Israel implicated in Italy hacking scandal" rel="nofollow" href="https://www.politico.eu/article/vatican-israel-italian-hacking-scandal-uk-lithuania-equalize/">Vatican, Israel implicated in Italy hacking scandal</a></li><li><a title="Wired on CIA hack of Venezuela military payroll system" rel="nofollow" href="https://www.wired.com/story/trump-cia-venezuela-maduro-regime-change-plot/?utm_medium=social&amp;mbid=social_twitter&amp;utm_social-type=owned&amp;utm_source=twitter&amp;utm_brand=wired">Wired on CIA hack of Venezuela military payroll system</a></li><li><a title="Is Now on VT!" rel="nofollow" href="https://x.com/Now_on_VT">Is Now on VT!</a></li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p><strong>Three Buddy Problem - Episode 19</strong>:   We explore Ivan Kwiatkowski’s essay on the limits of threat intelligence, Sophos using kernel implants to surveil Chinese hackers, the concept of ‘hack-back’ and legal implications, geopolitical layers of cyber espionage, CIA malware in Venezuela, Vatican/Mossad mentioned in high-profile Italy hacks, and Canada bracing for .gov attacks from India.</p>

<p><strong>Cast:</strong> <a href="https://twitter.com/juanandres_gs" rel="nofollow">Juan Andres Guerrero-Saade</a> (SentinelLabs), <a href="https://twitter.com/craiu" rel="nofollow">Costin Raiu</a> (Art of Noh) and <a href="https://twitter.com/ryanaraine" rel="nofollow">Ryan Naraine</a> (SecurityWeek).</p><p>Links:</p><ul><li><a title="Transcript (unedited, AI-generated)" rel="nofollow" href="https://docs.google.com/document/d/1U8q76wqVXIs9Sdc8vuqAr2S9CtknvnYryxS6l0IALv8/edit?usp=sharing">Transcript (unedited, AI-generated)</a></li><li><a title="Ivan Kwiatkowski: Threat intel truths inside" rel="nofollow" href="https://blog.kwiatkowski.fr/threat-intel-truths-inside">Ivan Kwiatkowski: Threat intel truths inside</a></li><li><a title="JAG-S LABScon keynote" rel="nofollow" href="https://securityconversations.com/episode/ep13-the-consolation-of-threat-intel-jag-s-labscon-keynote/">JAG-S LABScon keynote</a></li><li><a title="Sophos Used Custom Implants to Surveil Chinese Hackers" rel="nofollow" href="https://www.securityweek.com/sophos-used-custom-implants-to-surveil-chinese-hackers-targeting-firewall-zero-days/">Sophos Used Custom Implants to Surveil Chinese Hackers</a></li><li><a title="Sophos Pacific Rim report" rel="nofollow" href="https://www.sophos.com/en-us/content/pacific-rim">Sophos Pacific Rim report</a></li><li><a title="NCSC details ‘Pygmy Goat’ network backdoor" rel="nofollow" href="https://www.securityweek.com/ncsc-details-pygmy-goat-backdoor-planted-on-hacked-sophos-firewall-devices/">NCSC details ‘Pygmy Goat’ network backdoor</a></li><li><a title="NCSC &#39;Pygmy Goat&#39; report" rel="nofollow" href="https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf">NCSC 'Pygmy Goat' report</a></li><li><a title="Massive hack-for-hire scandal rocks Italian political elites – POLITICO" rel="nofollow" href="https://www.politico.eu/article/hacking-scandal-italy-matteo-renzi-sergio-mattarella-equalize-nunzio-samuele-calamucci/">Massive hack-for-hire scandal rocks Italian political elites – POLITICO</a></li><li><a title="Vatican, Israel implicated in Italy hacking scandal" rel="nofollow" href="https://www.politico.eu/article/vatican-israel-italian-hacking-scandal-uk-lithuania-equalize/">Vatican, Israel implicated in Italy hacking scandal</a></li><li><a title="Wired on CIA hack of Venezuela military payroll system" rel="nofollow" href="https://www.wired.com/story/trump-cia-venezuela-maduro-regime-change-plot/?utm_medium=social&amp;mbid=social_twitter&amp;utm_social-type=owned&amp;utm_source=twitter&amp;utm_brand=wired">Wired on CIA hack of Venezuela military payroll system</a></li><li><a title="Is Now on VT!" rel="nofollow" href="https://x.com/Now_on_VT">Is Now on VT!</a></li></ul>]]>
  </itunes:summary>
</item>
  </channel>
</rss>
