NewsTech NewsTechnologyBusiness News

Three Buddy Problem

Security Conversations

The Three Buddy Problem is a popular Security Conversations podcast that goes beyond industry talking points to discuss what others won’t -- nation-state malware, attribution, cyberwar, ethics, privacy, and the messy realities of securing computers and corporate networks. Hosted by three veteran security pros -- journalist Ryan Naraine and malware paleontologists Costin Raiu and Juan Andres Guerrero-Saade -- the weekly show attracts a highly engaged audience of security researchers, corporate defenders, CISOs, and policymakers. Connect with Ryan on Twitter (Open DMs).

Play

Open in

37 episodes
Avg 1 hr 49 min
English

Episodes 37

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

Friday · 2 hr 50 min
The Great Binance $6.34 Billion Crypto Heist
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem - Episode 118: On the show this week, the buddies dig into the $6.34 billion Binance heist, the largest crypto hack ever, walking through its multi-chain laundering, the North Korea fingerprints, and whether offensive AI quietly helped pull it off. Plus, thoughts on Sam Altman's swipe at local hardware
October 28 · 35 min
Lumen's Michael Horka on China's 'Silent Train' Router Hacking
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). SECURITY CONVERSATIONS: Black Lotus Labs researcher Michael Horka joins the show to discuss Silent Train, a Volt Typhoon framework that spins up four-to-six-hop chains of hijacked SOHO routers in about two minutes and wipes every hop when the day's session ends. We discuss how ORB networks differ from botnets, why Silent
October 24 · 1 hr 52 min
PHP2Shell Meltdown: AI Found It. Who's Going to Patch It?
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem - Episode 117: This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap. Plus, why patching hasn't kept up with AI bug finding, a failure
October 18 · 3 hr 26 min
Who's Hacking Supermarket Fridges in France?
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem - Episode 116: This week, the buddies dig into a mystery hack that cooked French supermarket fridges, cyberattacks against food supply networks, and why this smells like nation-state sabotage in Europe? Plus, a fresh Ivanti zero-day chain, Anthropic's self-replicating IoT research and defender-hostile
October 12 · 1 hr 5 min
Katie Moussouris on AI-as-malware, the monitoring gap, and an NTSB for AI
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem x Offensive AI Con: Luta Security chief Katie Moussouris makes the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators, after OpenAI's DNS tunneling escape and the 52 days it took to notice a model had wandered into Australian government systems. Along the way
October 12 · 54 min
NCSC's Ollie Whitehouse: 'The Biggest Correction of Technical Debt Ever'
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem x Offensive AI Con: Ollie Whitehouse, CTO of the UK's National Cyber Security Centre, joins us to explain how Britain is preparing for an AI-driven patch wave and why the NCSC is pressing edge-device vendors to finally ship real telemetry. Plus, we dig into rogue AI agents wandering into a Five Eyes ne
October 9 · 54 min
Aaron Grattafiori Explains How LLMs Hunt Patch Variants at Scale
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem x Offensive AI Con: Umbriel AI's Aaron Grattafiori breaks down the new offensive-security playbook: using LLMs for patch variant analysis, why the vuln apocalypse hasn't become an exploit apocalypse, and how the death of security through obscurity puts closed-source binaries and firmware within reach.
October 9 · 1 hr 37 min
Joel Todoroff on How Offensive AI Is Rewiring Western Government Ops
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem x Offensive AI Con: Former US intelligence and national security official Joel Todoroff joins us live from OffensiveAIcon to explain why his new startup Phyle is building AI for the recon and targeting work that happens long before anyone fires an exploit. We get into bribable sysadmins, the military f
October 7 · 1 hr 8 min
Valentina Palmiotti (chompie) on Vulnpocalypse, Matching Mythos on a Budget
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem x Offensive AI Con: Live from OAIC, IBM X-Force's Valentina Palmiotti (chompie) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain. Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2O
October 2 · 2 hr 33 min
Why is Anthropic Afraid of GLM 5.3?
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem - Episode 115: We into Anthropic's Frontier Red Team fear-mongering on Zhipu's open-weight GLM 5.3 model and wonder why the AI labs' cyber programs do so little for defenders. Plus, Citrix NetScaler zero-days, a new iOS zero-day tied to WhatsApp, AI agents that act on your behalf, and whether security
September 25 · 2 hr 16 min
Kernel Exploits in the iOS App Store, ShinyHunters Inside the FBI
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem - Episode 114: We dig into TypeSafe AI's Jev and the new class of System One models, a new Transluce report on rogue OpenAI agents probing an Australian Medicare portal, Irregular's role in the latest Gemini test breakout, Hacktron's takeover of OpenAI employee accounts and the messy disclosure fight tha
September 11 · 2 hr 37 min
AI Doomers, Death Cults, and a Million-Dollar WeChat Worm Exploit
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem - Episode 113: On the show this week, the buddies dig into an Anthropic researcher quitting with a warning that AI could kill us all, the San Francisco "death cult" and their motives, and agent swarms leaving junk on public wikis and university URL shorteners. Plus, a high-quality Anthropic's threat rep
September 4 · 2 hr 7 min
Three Secret AI Civilizations Rose and Fell. Nobody Checked the Logs.
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem - Episode 112: The 'OpenAI hacks Hugging Face' fallout has turned into a story about AI civilizations rising from the ashes, politicians calling for super-intelligence bans, and the emergence of well-funding non-profits doing AI safety work. Who are these people and what's their security expertise? Pl
August 28 · 2 hr 27 min
A Thousand Agents Walk Into Hugging Face
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem - Episode 111: OpenAI finally published a technical Hugging Face post-mortem, and Costin's verdict is blunt. He reads it as a document written for policymakers rather than for the blue teams who have to survive a thousand-agent swarm. We also dig into NVIDIA's $12.9 billion acquisition of Hugging Face,
August 21 · 2 hr 11 min
Inside the EncroChat law-enforcement implant, Irregular's AI sandbox failure
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem - Episode 110: We dig into Computer Weekly's scoop on the EncroChat hack and news that the French law enforcement implant was cobbled together from GitHub. Plus, Irregular, the $450M startup running sandboxes for OpenAI, Anthropic and Meta, drones over Romania's gas platforms, OpenAI's two-week training
August 17 · 2 hr 23 min
A tiny 12 KB Windows backdoor, one victim, and a dead domain
(Presented by State of Statecraft: A security and intelligence conference that brings together multiple disciplines, backgrounds, and nationalities to share research into the covert activities of nation-states and other malign actors. Three Buddy Problem - Episode 109: The buddies dig into a new White House memo handing vetted private companies real offensive cyber authorities, and Costin explains why a stack of ransomware takedown cases has been sitting on a shelf waiting for exactly this.
August 8 · 2 hr 14 min
Inside OpenAI's Black Hat Confession
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals). Three Buddy Problem - Episode 108: OpenAI got on the Black Hat stage and walked through how its own agent swarm hacked Hugging Face. We discuss and struggle to decide whether to clap or panic. Plus, why only the attacker can do forensics now, frontier models being built as cyber-weapons on purpose, APT29's "Dark Hotel" c
July 31 · 3 hr 26 min
Proofpoint's Greg Lesnewich on Laundry Bear, ‘Half-Click’ Exploits, and Magnets of Threats
(Presented by Thinkst Canary. Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.) Three Buddy Problem - Episode 107: Proofpoint's Greg Lesnewich joins the show to break down Laundry Bear, t
July 28 · 34 min
Validin's Kenneth Kinion on What Separates Useful Threat Intel From Noise
Security Conversations: Kenneth Kinion, founder and CEO of Validin, joins Ryan Naraine on the show to unpack what "internet intelligence" really means for the analysts and responders chasing malicious infrastructure. We trace his path from Georgia Tech through Microsoft and Amazon to the frustrations that led to the creation of Validin, the competition from big AI, the value of AI-powered tools to speed up infrastructure hunting, and why defenders keep falling further behind fast-moving attacke
July 23 · 2 hr 16 min
OpenAI's models breached Hugging Face, reward hacking ethics, benchmarking fast16
(Presented by Thinkst Canary. Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.) Three Buddy Problem - Episode 106: We dig into the news that OpenAI's models were the "autonomous agent" th

Showing 1–20 of 37 episodes