Episode476

From Paul's Security Weekly
Jump to: navigation, search

Paul's Security Weekly - Episode 476

Recorded: August 10, 2016

Episode Audio

MP3

Announcements

Interview: Lance James - 6:00PM-7:00PM

Lance James serves as Chief Scientist at Flashpoint where he heads up research and engages in thought leadership. Prior to joining Flashpoint, Mr. James was the Head of Cyber Intelligence at Deloitte & Touche LLP.

An internationally renowned information security specialist, Mr. James has more than fifteen years of experience in programming, network security, digital forensics, malware research, cryptography design, cryptanalysis, counterintelligence, and protocol exploitation. He provides advisory services to a wide range of government agencies and Fortune 500 organizations including America’s top financial services institutions. Credited with the identification of Zeus and other malware, Mr. James is an active contributor to the evolution of security practices and counterintelligence tactics and strategies.

Mr. James was the founding force behind the CryptoLocker Working Group, where he and his team of researchers were acknowledged for their critical role in disrupting CryptoLocker as part of an FBI-led takedown operation. Over the years, he has championed other takedowns of criminal organizations through his strategic alliances with industry, academia, and law enforcement.

LanceJames.jpg
  1. Three words to describe yourself
  2. If you were a serial killer, what would be your weapon of choice?
  3. If you wrote a book about yourself, what would the title be?
  4. In the popular game of ass grabby-grabby, do you prefer to go first or second?
  5. Choose two celebrities to be your parents.

Technical SegmentL: TachyonNet - 7:00PM-7:30PM


TachyonNet is a multi-threaded Python tool that has the ability to listen on all 65535 TCP/UDP ports, as well as listen for ICMP traffic. It will log the first 8192 bytes (by default) of any initial communication received. In the TCP case, it will immediately send a TCP RESET to abort the connection after the first TCP segment of bytes is received. TachyonNet has the ability to syslog all received connections as well as log in plaintext the actual bytes received.

Full Code For Download (and documentation) here: [TachyonNet http://bit.ly/TachyonNet]

Security News - 7:30PM-8:00PM

Paul's Stories

  1. Frequent Password Changes Is a Bad Security Idea - Like what I always said about password change policies: "The UNC researchers said if people have to change their passwords every 90 days, they tend to use a pattern and they do what we call a transformation,"
  2. Facebook’s favorite hacker is back – with an ironic security hole
  3. "Raucous Ruckus router ruckus roundly rumbles: Infosec bod says Wi-Fi kit is weak - Funny, years ago I found similar bugs in a similar vendor.
  4. "Patch vBulletin - Just don't run this softare, like ever.
  5. "Linux malware? That'll never happen. Ok
  6. The Pwnies Have Been Awarded - Uhm, so, best song this year, is well, EPIC: https://www.youtube.com/watch?v=ZNeFHimR4lQ
  7. Apple Starts A Bug Bounty Program - At the Black Hat hacking conference, Apple announced a list of vulnerabilities that would command big bounties, including $25,000 for ways around Apple’s digital compartments and into its customers’ data, $50,000 for bugs that give hackers a way into iCloud data, and $200,000 to turn over critical vulnerabilities in Apple’s firmware — the software that lies closest to the bare metal of the machine.
  8. Rise Of The Hacking Machines
  9. How Many Zero-Day Vulns Is Uncle Sam Sitting On? - Healey acknowledged that we'd probably never know the true number of zero days hoarded by all government agencies. Research shows it's probably not as many as people think. Curious to get more details, other than budget analysis, on how they draw these conclusions. Also, just how many 0days does one government need to be successul and acheive their goals? I mean, if you got one good MS 0day, you can go pretty far.
  10. Flaw In Samsung Pay Lets Hackers Wirelessly Skim Credit Cards - Someone claims to be able to collect and spoof the payment auth token, creates a video and Samsung says, "Samsung Pay is built with the most advanced security features, assuring all payment credentials are encrypted and kept safe, coupled with the Samsung Knox security platform," and has not fixed it. WTF.
  11. Big Red Alert: Oracle's MICROS Payment Terminal Biz Hacked - Oops: Investigative journo Brian Krebs suspects the infiltration affected as many as 700 computers within Oracle and is the work of a Russian malware gang targeting POS systems.#Project Sauron Malware Was Hidden For Five Years - State sponsored We may never know for sure. It can disguise itself as benign files and does not operate in predictable ways, making it harder to detect. Experts from Kaspersky Lab and Symantec said it allows the attacker to spy on infected computers.
  12. Half Of All Connected Cars Have Security Vulnerabilities - Car manufacturers suck at security, is anyone shocked by this?
  13. Microsoft Proves Backdoor Keys Are A Terrible Idea - on devices that do not allow you to disable Secure Boot even if you have administrator rights – such as ARM-based Windows RT tablets – it is now possible to sidestep this block and run, say, GNU/Linux or Android. Freakin' sweet!
  14. Nobody Knows What Cyberattacks Really Cost - Future studies, the agency says, should be "done throughout a unified analysis, based on a well-structured methodology, and considering all critical variables that define the EU cyber-space" in order to reflect "the real situation". So, yes, thank you captain obvious, its hard, we get it, and we need standards, some practical advice would be great.

Larry's Stories

  1. MS includes secure boot backdoor, then releases keys
  2. VW (and others) only use crypto keys for Remote Keyless entry for 100million+ vehicles
  3. Carlos adds users to his test AD domain
  4. About the DEF CON 24 Wireless network - a response to the Register article
  5. What is old is new again - TCP spoofing sequence number style
  6. Apple launches (invite only) bug bounty program
  7. Profiling clients using SSL/TLS
  8. Council of 9 DEF CON badge challenge writeup

Joff's Stories

Jack's Stories

Kevin's Stories

Michael's (Santa) Stories