Episode 377

From Security Weekly Wiki
Jump to navigationJump to search

Episode Media

MP3 pt1

MP3 pt2

MP3 pt3


Paul's Security Weekly - Episode 377 for Thursday June 19th, 2014

And now, from the dark corners of the Internet, where exploits run wild, packets aren’t the only things getting sniffed, and the beer flows steady its Paul’s Security Weekly!

  • This segment is sponsored by Palo Alto Networks creators of THE next-generation firewalls, helping you enforce network security policies based on applications, users, and content. Visit them on the web at www.paloaltonetworks.com
  • and by The SANS institute the most trusted source for computer security training, certification and research. visit www.sans.org to learn more
  • and by Tenable Network Security, the creators of Nessus, the worlds best vulnerability scanner. Check out the new Nessus Enterprise and Nessus Enterprise cloud, engage your IT department in the vulnerability management process today!

"Now, fire up a packet capture, pour yourself a beer, and give the intern control of your botnet..."

"Here's your host, a man who is never truly satisfied, either manualy, artificially, with a flesh light, Paul Asadoorian!"

Guest Interview: Chris "loganWHD" Hadnagy

Chris Hadnagy, aka loganWHD, has been involved with computers and technology for over 14 years. Presently his focus is on the "human" aspect of technology such as social engineering and physical security. Chris has spent time in providing training in many topics around the globe and also has had many articles published in local, national and international magazines and journals.

  1. How does one get started social engineering?
  2. Now that Social Engineering has gotten a lot of press and awareness, are our jobs as professional social engineers getting harder? Are we like magicians who give away how the tricks are done?
  3. Some of the best social engineers are interested in sociology, what are like the top 3 things about people's behavior that make it easy to social engineer them?
  4. What is one of the most successful SE attacks used by bad guys (whether its a type of phish, mobile phone trick, etc...)?
  5. Tell us about some of the recent guests on your show, why did you choose them and what did they talk about?

Five Questions

  1. Three words to describe yourself
  2. If you were a serial killer, what would be your weapon of choice?
  3. If you wrote a book about yourself, what would the title be?
  4. In the popular game of Ass Grabby Grabby do you prefer to go first or second?
  5. If you could have dinner with one celebrity, who would it be?

Ten more questions to ask at random:

  1. If you had super powers, what would they be?
  2. A penguin walks through that door right now wearing a sombrero. What does he say and why is he here?
  3. If we came to your house for dinner, what would you prepare for us?"
  4. Pick two celebrities to be your parents."
  5. What do you think about when you are alone in your car?
  6. What song best describes your life?
  7. If you were a Star Trek® [or Star Wars® ] character, which one would it be?
  8. If you were 80 years old, what would you tell your children?
  9. What is the record amount of time you have gone without a shower?
  10. What is the geekiest thing you've ever done/created/bought/said?

Guest Interview: Steve Christy

  1. How did you get your start in information security?
  2. CVE turns 15 this year, how did the CVE begin?
  3. What major change is coming to the CVE program?
  4. Where are most of the vulnerabilities coming from that end up as CVEs?
  5. When vendors find bugs in their own software, do they request a CVE from you?
  6. The formal CVE entry typically doesn't contain detailed information about the vulnerability, mitigation, etc... How come?
  7. The vuln research industry is aging. The industry didn't EXIST, really, 10 years ago. What of the next generation of researchers? Are they being left in the dust?


  • This segment is brought to you by http://www.blacksquirrel.io/ - Pentest Networks from Your Browser! Exploit the limits of network security through just a browser. Have a Chrome exploit in your toolkit? Good, but for the rest of us there's Black Squirrel. Visit blacksquirrel.io for more information.
  • and by Onapsis the leading provider of solutions to protect ERP systems from cyber-attacks. Customers can secure their SAP and Oracle business-critical platforms from espionage, sabotage and financial fraud risks. Visit them on the web at http://www.onapsis.com/
  • and by Pwnie Express - Check out the community edition and turn your Nexus 7 into a lean and mean pen testing machine. For all those hard to reach places, there's Pwnie Express, visit them on the web at pwnieexpress.com

Paul's Stories

  1. Cisco Security Advisory: Undocumented Test Interface in Cisco Small Business Devices
  2. "Ten Years Later
  3. Black Hat USA 2014: Embedded & Vulnerable
  4. Tavis Ormandy finds an embarrassing hole In more Microsoft products
  5. "Research Project Pays People to Download
  6. Gear to Block ‘Juice Jacking’ on Your Mobile
  7. Ransomware with a happy ending | Naked Security
  8. Vixie: Open Internet is Slowly Poisoning Us
  9. "Hacking the DSP-W215
  10. "Hacking the DSP-W215
  11. "Hacking the DSP-W215
  12. Products endorsed by cybersec experts

Larry's Stories

  1. Latin in Truecrypt? - [Larry] - So, take the first letter of each word in the parting message, and it is bad Latin for "I'm with the NSA now" or some variant. Time to get your tin foil hats.
  2. Transmitting ADS-B... - [Larry] wow, talk about dangerous bat man, but this was exactly what Renderman was talking about in his DEFCON talk...unauthenticated radio that can crash planes.
  3. Need some advice - verification on the illegality of decoding Pager traffic in the US. I'm told it is illegal, but only prosecuted when shared with a third party. I'm looking for discussion, rulings, court cases, specific sections of law, etc.

Jack's Stories

Joff's Stories