- 1 Paul's Security Weekly - Episode 488
- 2 Announcements
- 3 Interview: David Koplovitz, ProXPN - 6:00-7:00PM
- 4 Technical Segment: Considerations for Using Intel SGX - 7:00PM-7:30PM
- 5 Security News - 7:30PM-8:30PM
Paul's Security Weekly - Episode 488
Recorded: November 3, 2016
- Michael Santarcangelo - founder of SecurityCatalyst.com, author of Into the Breach, and creator of the leadership-driven Straight Talk Framework - with our favorite question, "What problem are you trying to solve?"
- Joff Thyer - SANS Instructor, Penetration Tester and Security Researcher with Black Hills Information Security.
- Paul Asadoorian -Embedded Device Researcher, Security Podcaster, CEO of Offensive Countermeasures
- Make sure you visit http://securityweekly.com/subscribe and subscribe to our new shows including Enterprise Security Weekly and Startup Security Weekly. You can also subscribe to all shows individually, as well as a main feed which contains this show, Hack Naked TV and Enterprise Security Weekly.
- Mention the survey! http://www.securityweekly.com/survey
Interview: David Koplovitz, ProXPN - 6:00-7:00PM
Over twenty years of experience in corporate leadership and management.
Developed agile products, created solutions, integrated systems and deployed technologies for both external and internal client initiatives.
Specialized in startups for the last 15 years with a focus on developing geographically diverse teams that deliver cost effective solutions with excellence.
- What are the use cases for ProXPN?
- How do you differentiate yourself in the market? (For our audience, why should they choose ProXPN over someone else?
- What are the best methods for evaluating VPN products?
- How can enterprises use your product?
- What are some of the technologies in use on the backend?
- Where do you see the VPN market going in 5 years?
- Three words to describe yourself
- If you were a serial killer, what would be your weapon of choice?
- If you wrote a book about yourself, what would the title be?
- In the popular game of ass grabby-grabby, do you prefer to go first or second?
- Choose two celebrities to be your parents.
Technical Segment: Considerations for Using Intel SGX - 7:00PM-7:30PM
Intel SGX is a newer method of implementing trusted computing.
- I like this comparison too: Architecturally Intel SGX is a little different from ARM TrustZone (TZ). With TZ we often think of a CPU which is in two halves i.e. the insecure world and the secure world. Communication with the secure world occurs from the insecure world via the SMC (Secure Monitor Call) instruction. In Intel SGX model we have one CPU which can have many secure enclaves (islands) (Source: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/january/intel-software-guard-extensions-sgx-a-researchers-primer/)
- You need to develop software that uses Intel SGX, Then this code, and associated data, would be protected during execution, even if an attacker were to gain administrative privs on the box
- You can only currently write apps in C/C++
- Everyone accessing the applications would need to run this software and on hardware that supports Intel SGX.
- This would mean that all systems on the network would need to be about a year old as SGX is only available on Skylake and later processors: https://github.com/ayeks/SGX-hardware
- You would only get true protection at both ends when every system on the network is running the software and has the SGX supported hardware
- There are validation methods in SGX, a remote enclave can create a cryptographic report, essentially letting others know that SGX is in use, so we can validate that a financial institution is in fact using SGX
- Bad news, while SGX enclaves are protected, it's similar to a firewall, they have to let things in an out in order to operate, and it's speculated that this is where attacks will occur
- More bad news, it's a doubled edged sword, applications used in the business can be protected, however so can malware. Malware can run in an SGX enclave, and essentially lock out the kernel, operating system and any anti-malware products
Security News - 7:30PM-8:30PM
- This Evil Office Printer Hijacks Your Cellphone Connection
- Three hospitals in England cancel operations over computer virus
- Cisco says it'll make IoT safe because it owns the network
- Ubiquiti all the things: how I finally fixed my dodgy wifi
- Its time to regulate baby monitors
- How Hackers Can Steal Your Cell Phone Pictures From Your Crock-Pot
- Belkins WeMo Gear Can Hack Android Phones
- New, fast-spreading IoT botnet hybridizes two less-effective strains to achieve quick dominance
- Fixing the communications breakdown between IT security and the board and c-suite
- Alarmed by Admiral's data grab? Wait until insurers can see the contents of your fridge
- Admiral Insurance to use algorithms to set insurance prices based on customers' Facebook posts
- Flipboard on Flipboard
- Google security head says Pixel is as secure as the iPhone
- Unsecured Internet of Things gadgets get hacked within 40 minutes of being connected to the net
- Webcams Used To Attack Twitter And Reddit Recalled
- Windows 10 Vulnerability AtomBombing Can Bypass Security Software
- Disappearing Messages Added to Signal App
- IoT Devices as Proxies for Cybercrime
- Telnet, SSH prod of death smashes Cisco broadband boxes offline
- How Hackers Plant False Flags to Hide Their Real Identities | Motherboard
- Nuclear Power Plant Disrupted by Cyber Attack
- JTAG Explained (finally!): Why "IoT" Makers, Software Security Folks, and Device Manufacturers Should Care - Senrio
- We're Not Going To Beat Cybercrime In Our Lifetime
- MITRE Will Give You $50k To Fingerprint Rogue IoT Devices
- IoT Malware Has Apparently Reached Almost All Countries
- Sex robots with warm skin to hit dating scene and could benefit relationships
- 4 cybersecurity trends you need to be aware of
- 4 cybersecurity trends you need to be aware of
- Yahoos CISO resigned in 2015 over secret e-mail search tool ordered by feds
- Hack Crashes Linux Distros with 48 Characters of Code
- IoTpocalyspe, but we can't talk about it properly
- Mirai tries to knock a country offline
- Oh, look, 2016 and vuln disclosure battles.
- Another look at this new "vulnerability disclosure" thing
- Hack the planet. Or your car, or toaster- legally now.
- The death of thought leadership
- Microsoft announces the end of life for EMET
- Oh hey, Beau Bullock kinda broke Office 365 two factor auth