Episode586

From Paul's Security Weekly
Jump to: navigation, search

Recorded December 13, 2018 at G-Unit Studios in Rhode Island!

Episode Audio

Hosts

  • Paul Asadoorian
    Embedded device security researcher, security podcaster, and CEO of Active Countermeasures .
  • Larry Pesce
    Senior Managing Consultant and Director of Research at InGuardians, SANS Instructor.
  • Joff Thyer
    SANS Instructor, penetration tester, and Security Researcher at Black Hills Information Security.


  • Announcements

    • RSA Conference 2019 is the place to be for the latest in cybersecurity data, innovation and thought leadership. From March 4 – 8, San Francisco will come alive with cybersecurity’s brightest minds as they gather together to discuss the industry’s newest developments. Go to rsaconference.com/securityweekly-us19 to register now using the discount code 5U9SWFD to receive $100 off a full conference pass!
    • If you are interested in quality over quantity and having meaningful conversations instead of just a badge scan, join us April 1-3, at Disney's Contemporary Resort for InfoSec World 2019 where you can connect and network with like-minded individuals in search of actionable information. Use the registration code OS19-SECWEEK for 15% off the Main Conference or World Pass.
    • Check out our On-Demand material! Some of our previously recorded webcasts are now available On-Demand at: securityweekly.com/ondemand.

    Interview: Ed Skoudis, Counter Hack Challenge & Kringle Con 2018 - 6:00-7:00PM

    Ed Skoudis is the founder of Counter Hack, an innovative organization that designs, builds, and operates popular infosec challenges and simulations including CyberCity, NetWars, Cyber Quests, and Cyber Foundations. As director of the CyberCity project, Ed oversees the development of missions which help train cyber warriors in how to defend the kinetic assets of a physical, miniaturized city. Ed's expertise includes hacker attacks and defenses, incident response, and malware analysis, with over fifteen years of experience in information security. Ed authored and regularly teaches the SANS courses on network penetration testing (Security 560) and incident response (Security 504), helping over three thousand information security professionals each year improve their skills and abilities to defend their networks. He has performed numerous security assessments; conducted exhaustive anti-virus, anti-spyware, Virtual Machine, and IPS research; and responded to computer attacks for clients in government, military, financial, high technology, healthcare, and other industries. Previously, Ed served as a security consultant with InGuardians, International Network Services (INS), Global Integrity, Predictive Systems, SAIC, and Bell Communications Research (Bellcore). Ed also blogs about command line tips and penetration testing.


    Tech Segment: Don Murdoch, Regent University Cyber Range - 7:00PM-7:30PM

    Don Murdoch
    is the Assistant Director at Regent University Cyber Range.
    Don Murdoch, GSE, MSISE, MBA is a seasoned IT leader with over 20 years of IT and InfoSec experience across several disciplines. Don is currently the Assistant Director of the Regent University Cyber Range. Don is the author of the Blue Team Handbook: Incident Response edition, recently named #3 of 100 Best Cyber Security Books of All Time on bookauthority.com. The first half of Don’s career emphasized software development, network and systems management, and database administration. At his career midpoint, he worked as the Information Systems Security Officer for Old Dominion University in Virginia, where he spent most of his days in the Wild, Wild West of academic computing and put most of his SANS education to the test. For the remainder of his career, Don has worked in computer, network, and information security as the lead Security Engineer/Security Architect, and then Director for the Strategy and Planning team for the Infrastructure division within a Fortune 500 Medicaid focused Insurance company, and lastly as the Director of a MSSP organization where his team developed, deployed, and managed a 24/7 SOC for numerous clients. Don also has significant experience with the SANS Institute, including Local Mentor, Community Instructor, GCIH grader, active Advisory Board member, and courseware developer.
    BlueTeamHandbook.jpg


    Topic: Blue Team Handbook
    1. So Don – why another book? What was the genesis for this one?
    2. Whats been happening over the last few years, book wise?
    3. What makes this book different than the last one?
    4. Who does your illustrations?
    5. What’s the hardest part about writing a security focused book? About this one in particular?
    6. Who can use the book and how?
    7. Whats Next?
    8. Whats up with the last one – getting a little long in the tooth?
    9. How do you use these at work?
    10. Any success stories (Yep, I have a few).


    Security News - 7:30 - 8:30PM

    Paul's Stories

    1. Taylor Swift Used Facial Recognition to Thwart Stalkers - According to Rolling Stone, a facial-recognition camera was hidden inside a kiosk playing clips of Swift from rehearsals. As fans approached the kiosk to watch, the camera would stealthily snap their photo. Those images were then compared to a database of Swift's known stalkers."Despite the obvious privacy concerns—for starters, who owns those pictures of concertgoers and how long can they be kept on file?—the use of facial-recognition technology is on the rise at stadiums and arenas," the report notes. Ticketmaster, for instance, recently invested in Austin, Texas-based facial recognition startup Blink Identity, which says its technology can identify 60 people a minute walking at full speed past a sensor, meaning paper and digital tickets may soon be a thing of the past. The same tech can be used throughout a venue to allow concertgoers to purchase drinks, snacks, and merchandise.
    2. Unlocking Android phones with a 3D-printed head - Rather worryingly (if someone has managed to make a 3D-printed version of your head), all four Android phones were duped into thinking they were looking at the real Tom. Only the iPhone X wasn’t duped. It’s certainly impressive to see Apple’s iPhone X not be tricked by Thomas Brewster’s fake head, and it may surprise owners of Android smartphones who have had at best mixed experiences with facial recognition.
    3. New Australian Backdoor Law
    4. Warning! Unprivileged Linux Users With UID > INT_MAX Can Execute Any Command - Oops: The issue, tracked as CVE-2018-19788, impacts PolicyKit version 0.115 which comes pre-installed on most popular Linux distributions, including Red Hat, Debian, Ubuntu, and CentOS. The vulnerability exists due to PolicyKit's improper validation of permission requests for any low-privileged user with UID greater than INT_MAX. Where, INT_MAX is a constant in computer programming that defines what maximum value an integer variable can store, which equals to 2147483647 (in hexadecimal 0x7FFFFFFF). So it means, if you create a user account on affected Linux systems with any UID greater than INT_MAX value, the PolicyKit component will allow you to execute any systemctl command successfully.
    5. Humble Bundle Breach Could Be First Step In Wider Attack
    6. OpSec Mistake Brings Down Network Of Dark Web Money Counterfeiter - Encrypt everything: A source knowledgeable of the case's details told ZDNet today that the suspect had failed to protect his operation's business transactions with proper encryption. While the suspect used cryptocurrency to receive payments, he still kept a list of mailing addresses where he sent packages containing the counterfeit banknotes.
    7. Ticketmaster Fails To Take Responsibility For Malware - Finger pointing: In a statement on its website, Inbenta said: "Upon further investigation by both parties, it has been confirmed that the source of the data breach was a single piece of JavaScript code... Ticketmaster directly applied the script to its payments page, without notifying our team. Had we known that the customized script was being used this way, we would have advised against it."
    8. It's December Of 2018 And, To Hell With It, Just Patch Your Stuff - The gift that keeps giving, vulnerabilities: Microsoft, Adobe, and SAP are finishing up the year with a flurry of activity, combining to patch more than 140 CVE-listed security flaws between them.
    9. Ethical Hacking Growing In Popularity At Data Breaches Increase
    10. UK Whitehats Blacklisted By Cisco Talos
    11. Worst password offenders of 2018 exposed
    12. Education Gets an 'F' for Cybersecurity
    13. Grammarly Launches Public Bug Bounty Program
    14. WordPress Releases Security Update

    Joff's Stories

    1. Australia's New Anti-Encryption Law
    1. CIO Review and BHIS

    Larry's Stories

    1. DOSfuscation, just goes to show that strings analysis is still useful.