Trust Issues and Intelligence Operations

Three Buddy Problem - Episode 41: Costin and Juanito join the show from Black Hat Asia in Singapore. We discuss Bunnie Huang's keynote on hardware supply chains and a classification system to establish a grounded perspective on trust in hardware, Ivanti's misdiagnosis of a critical VPN applicance flaw and Mandiant reporting on a Chinese APT exploiting Ivanti devices. Plus, breaking news on the sudden firing of NSA director and head of Cyber Command Tim Haugh.

We also discuss Microsoft touting AI's value in finding open-source bootloader bugs, Silent Push report on a RUssian APT impersonating the CIA, a backdoor in a popular Chinese robot dog, and Chinese dominance of the robotics market.

Cast: Juan Andres Guerrero-Saade, Costin Raiu and Ryan Naraine.

Links:

• Transcript (unedited, AI-generated)
• National Security Agency chief ousted after far-right activist urged his removal
• Mandiant: China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability
• Ivanti security bulletin (CVE-2025-22457)
• Chinese APT exploits misdiagnosed RCE in Ivanti VPNs
• Another exploited 0day in Apple iOS
• Android version of Lockdown Mode coming
• Microsoft: Using AI to find open-source bootloader flaws
• Indiana University cybersecurity "safe" after FBI home searches
• Silent Push: Russians impersonate CIA to target Ukraine sympathizers
• Unitree Go1 robot dog backdoor documentation
• America is missing in the robotics race
• Automated AI Reverse Engineering with MCP for IDA and Ghidra
• Bunny Huang: Perspectives on trust in hardware supply chains