- 1 Paul's Security Weekly - Episode 488
- 2 Announcements
- 3 Interview: David Koplovitz, ProXPN - 6:00-7:00PM
- 4 Technical Segment: Considerations for Using Intel SGX - 7:00PM-7:30PM
- 5 Security News - 7:30PM-8:30PM
Paul's Security Weekly - Episode 488
Recorded: November 3, 2016
- Jeffrey Man - Cryptanalyst, infosec analyst, pioneering ex-NSA pen tester, PCI specialist and certified security curmudgeon
- Jack Daniel - Works for Tenable Network Security and is a co-founder of Security BSides.
- Larry Pesce, Director of Research and Senior Managing Consultant at InGuardians
- Larry Pesce, Swami of Security, Oracle of the Online and Hotshot Of Hacking
- Larry Pesce, destroyer of embedded systems and injector of RF energy.
- Michael Santarcangelo - founder of SecurityCatalyst.com, author of Into the Breach, and creator of the leadership-driven Straight Talk Framework - with our favorite question, "What problem are you trying to solve?"
- Joff Thyer - SANS Instructor, Penetration Tester and Security Researcher with Black Hills Information Security.
- Joff Thyer, Geeking out with the best of them. Known to attract multiple waitresses with a single smile and utterance of g'day. Deployer of cocktail recipes in desperate situations. Hacker of many a thing! If it's got code running on it, it can be hacked.
- Joff Thyer, musician, proud father, and friend to many.
- Paul Asadoorian - He is probably the coolest guy around, but he won't tell you that. He is the kind of guy you want by your side when fighting off an army of 10,000 pygmies with poison arrows. He can tell you what color your underwear is by looking into your eyes. He can eat a cheeseburger in one bite. Scientists have said that he is so hot, he may be the main reason for global warming. His shit doesn't stink; in fact, it smells like car polish. He was refused entry to the USA because his biceps were classified as weapons of mass destruction. He is in the Guinness Book of World Records for completing the most somersaults in a row (126,253).
- Make sure you visit http://securityweekly.com/subscribe and subscribe to our new shows including Enterprise Security Weekly and Startup Security Weekly. You can also subscribe to all shows individually, as well as a main feed which contains this show, Hack Naked TV and Enterprise Security Weekly.
- Mention the survey! http://www.securityweekly.com/survey
Interview: David Koplovitz, ProXPN - 6:00-7:00PM
Over twenty years of experience in corporate leadership and management.
Developed agile products, created solutions, integrated systems and deployed technologies for both external and internal client initiatives.
Specialized in startups for the last 15 years with a focus on developing geographically diverse teams that deliver cost effective solutions with excellence.
- What are the use cases for ProXPN?
- How do you differentiate yourself in the market? (For our audience, why should they choose ProXPN over someone else?
- What are the best methods for evaluating VPN products?
- How can enterprises use your product?
- What are some of the technologies in use on the backend?
- Where do you see the VPN market going in 5 years?
- Three words to describe yourself
- If you were a serial killer, what would be your weapon of choice?
- If you wrote a book about yourself, what would the title be?
- In the popular game of ass grabby-grabby, do you prefer to go first or second?
- Choose two celebrities to be your parents.
Technical Segment: Considerations for Using Intel SGX - 7:00PM-7:30PM
Intel SGX is a newer method of implementing trusted computing.
- I like this comparison too: Architecturally Intel SGX is a little different from ARM TrustZone (TZ). With TZ we often think of a CPU which is in two halves i.e. the insecure world and the secure world. Communication with the secure world occurs from the insecure world via the SMC (Secure Monitor Call) instruction. In Intel SGX model we have one CPU which can have many secure enclaves (islands) (Source: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/january/intel-software-guard-extensions-sgx-a-researchers-primer/)
- You need to develop software that uses Intel SGX, Then this code, and associated data, would be protected during execution, even if an attacker were to gain administrative privs on the box
- You can only currently write apps in C/C++
- Everyone accessing the applications would need to run this software and on hardware that supports Intel SGX.
- This would mean that all systems on the network would need to be about a year old as SGX is only available on Skylake and later processors: https://github.com/ayeks/SGX-hardware
- You would only get true protection at both ends when every system on the network is running the software and has the SGX supported hardware
- There are validation methods in SGX, a remote enclave can create a cryptographic report, essentially letting others know that SGX is in use, so we can validate that a financial institution is in fact using SGX
- Bad news, while SGX enclaves are protected, it's similar to a firewall, they have to let things in an out in order to operate, and it's speculated that this is where attacks will occur
- More bad news, it's a doubled edged sword, applications used in the business can be protected, however so can malware. Malware can run in an SGX enclave, and essentially lock out the kernel, operating system and any anti-malware products
Security News - 7:30PM-8:30PM
- This Evil Office Printer Hijacks Your Cellphone Connection
- Three hospitals in England cancel operations over computer virus
- Cisco says it'll make IoT safe because it owns the network
- Ubiquiti all the things: how I finally fixed my dodgy wifi
- Its time to regulate baby monitors
- How Hackers Can Steal Your Cell Phone Pictures From Your Crock-Pot
- Belkins WeMo Gear Can Hack Android Phones
- New, fast-spreading IoT botnet hybridizes two less-effective strains to achieve quick dominance
- Fixing the communications breakdown between IT security and the board and c-suite
- Alarmed by Admiral's data grab? Wait until insurers can see the contents of your fridge
- Admiral Insurance to use algorithms to set insurance prices based on customers' Facebook posts
- Flipboard on Flipboard
- Google security head says Pixel is as secure as the iPhone
- Unsecured Internet of Things gadgets get hacked within 40 minutes of being connected to the net
- Webcams Used To Attack Twitter And Reddit Recalled
- Windows 10 Vulnerability AtomBombing Can Bypass Security Software
- Disappearing Messages Added to Signal App
- IoT Devices as Proxies for Cybercrime
- Telnet, SSH prod of death smashes Cisco broadband boxes offline
- How Hackers Plant False Flags to Hide Their Real Identities | Motherboard
- Nuclear Power Plant Disrupted by Cyber Attack
- JTAG Explained (finally!): Why "IoT" Makers, Software Security Folks, and Device Manufacturers Should Care - Senrio
- We're Not Going To Beat Cybercrime In Our Lifetime
- MITRE Will Give You $50k To Fingerprint Rogue IoT Devices
- IoT Malware Has Apparently Reached Almost All Countries
- Sex robots with warm skin to hit dating scene and could benefit relationships
- 4 cybersecurity trends you need to be aware of
- 4 cybersecurity trends you need to be aware of
- Yahoos CISO resigned in 2015 over secret e-mail search tool ordered by feds
- Hack Crashes Linux Distros with 48 Characters of Code
- IoTpocalyspe, but we can't talk about it properly
- Mirai tries to knock a country offline
- Oh, look, 2016 and vuln disclosure battles.
- Another look at this new "vulnerability disclosure" thing
- Hack the planet. Or your car, or toaster- legally now.
- The death of thought leadership
- Microsoft announces the end of life for EMET
- Oh hey, Beau Bullock kinda broke Office 365 two factor auth