Episode456

From Paul's Security Weekly
Jump to: navigation, search

Episode Audio

Interview with Jared Atkinson - 6:00PM-7:00PM

Jared Atkinson is the Hunt Capability Lead with Veris Group’s Adaptive. Before working for Veris Group, Jared spent 4 years leading incident response missions for the U.S. Air Force Hunt Team, detecting and removing Advanced Persistent Threats on Air Force and DoD networks. Passionate about PowerShell and the Open Source community, Jared is the lead developer of the PowerForensics project, an open source forensics framework for PowerShell, and maintains a DFIR focused blog.

Stories of the Week - 7:00PM-8:00PM

Paul's Stories

  1. Vulnerability Scanners Turn Up Mostly False Positives - AHHHHHHHHHHHHHHHHHHH!!!!!!!
  2. Ironic: CCTV systems slide open a backdoor into your biz network - Okay, yea we knew this. What do we DO about it?
  3. Surprise! You have mystery PCs - We’ll have to set up a special system that only does network scanning and let it run until it finishes — probably a few months to scan every IP address. Uhm, there are better ways to accomplish this.
  4. Attackers Packing Malware Into Powershell - Yup, we've known about this for a while.
  5. Threat Intelligence's Big Data Problem - Threat Intelligence and big data, go buzzwords!
  6. "Even Sex Toys Aren’t Safe From Hackers - Okay, but what is the risk of hacking sex toys?
  7. It is time to prioritize security for Internet of Things and wearables
  8. Hotel light control hack illuminates lamentable state of IoT security - I love how they tied the IP address to the room number! A cunning plan!
  9. Amazon goes after patent so you can pay by selfie - Facial recognition to pay for stuff? Will it work?
  10. LinkedIn Being Used To Prime Phishing Targets - Well, yea, we've done it for years.
  11. One of the Celebgate hackers pleads guilty to phishing iCloud and Google logins - Yea, usually its not even this sophisticated.
  12. Home Depot To Pay $19.5 Million In Data Breach Settlement - Do you think this really hurt Home Depot?
  13. "Safari - Things got hacked, software is vulnerable. The end.
  14. "SSH Honeypots (Ab)used as Proxy - Honeypots are great, but you have to monitor them closely and be certain they are not being abused. This is a neat little hack.
  15. Defence In Depth For Web Applications - Look defending web applications, or even software applications, is hard. However, the process is well-defined: 1) Before you write software do threat modeling 2) Train developers on security 3) developers do static analysis 4) QA does dynamic scanning 5) security teams implement a RASP.

Larry's Stories

  1. APT Ransomware - More on the theory as discussed a few weeks back
  2. TeslaCrypt unbreakable - Upgrades now mean that the encryption in “uncrackable”. I also just heard a story about a new crypto ware (incorrectly identified as Locky), that used specific crypto module. It was broken, because the dev put in a backdoor for key recover “incase it was used for bad things”….um, WAT?

Jeff's Stories

  1. [1] Could FTC Play Bigger Role in Card Security?
  2. [2] Jon Oliver talks about encryption