Hack Naked News 108 January 24 2017

From Paul's Security Weekly
Jump to: navigation, search

Hack Naked News #108

Recorded January 24, 2017 at G-Unit Studios in Rhode Island!

Episode Audio

Hosts

  • Paul Asadoorian
    Embedded device security researcher, security podcaster, and CEO of Active Countermeasures .
  • Jason Wood
    Threat hunter at CrowdStrike, penetration tester, sysadmin, and Founder of Paladin Security.
  • News

    This week, an impenetrable web server, Android threats that matter and one that really doesn't, Firefox attempts to protect users, Film festivals are apparently targets for attackers and Cisco patches a critical flaw. Jason Wood joins us to cover the attorney generals stance on encryption in our expert commentary for this week. All that and more on this edition of Hack Naked News.

    ITPro.TV Annoucenment: "Upcoming courses include Cybersecurity Analyst+, CCNA Cyber Ops, ITIL Operational Support and Analysis, and Microsoft System Center. ITProTV is introducing a new membership level soon. All current Premium Members will be granted the highest membership level available, so​ ​sign up today! Visit itpro.tv/hacknaked and use code ​ HN30."

    • InfoSecWorld - Your 10% off discount code to promote to your members is OS17-SW. This will give them 10% off the main conference or the World Pass.
    • 2017 SOURCE Boston Proposal - Code SECURITYWEEKLY for $100 off either a conference ticket or one of the trainings. The early bird prices are currently in effect, but they can get an additional discount by using your code.
    • Charity Event Shaves that Save at the RSA Conference 6:00 pm - 8:00pm PT on Wednesday, Feb 15, 2017 At the RSA Conference Moscone Center South, Gateway Ballroom / Viewing Room To register / more details: https://www.stbaldricks.org/events/infosecshaves2017

    Security News

    1. Dovecot mailserver graded 'nearly impenetrable' - German security firm Cure53 spent 20 days testing Dovecot, and open-source IMAP email server, and came to the conclusion, get this, it's actually secure. Deemed "nearly impenentrable", some say its a testament to the security of open-source software. I say its a testament to well-written and resilient software, which takes careful planning and a lot of hard work. Props to Dovecot, and lets hope this serves as a model for all software companies.
    2. Hackers Hit Sundance Film Festival, Shutting Down Box Office - A "Cyber" attack took down the box offices for the Sundance film festival. Screenings were not affected, and no reports have been issued detailing the attacks, nor has any group claimed responsibility. But why? Why pick on the Sundance film festival? With so much going on in the world, so many ways for attackers to either profit or make a point by attacking specific targets, why pick on Sundance? Hopefully we'll know more soon, however this stands as an example of why you can't ignore security and just say "Why would anyone want to hack us?".
    3. Android Pattern Lock can be cracked in five attempts heres what to do - Okay look, sure someone can take a video of you swiping your unlock pattern across the screen of your favorite, or maybe not-so-favorite, smartphone. Here's the thing, this is pretty low on your list of priorities to secure yourself against attacks. You are not in a spy movie and far more likely to contract malware on your phone a dozen different ways. So focus on that, rather than the drama, save it fo' yo' mama. On the flip side, this is a pretty neat attack!
    4. Firefox bares teeth, attacks sites that collect personal data - Firefox has joined the ranks of Google Chrome by putting up a warning label when entering sensitive information into a site that is not protected with HTTPS. While I believe this is a really good thing, it does not excuse the users from being more aware of security and the implications. We've had warning messages in browsers for a long time, and the users become conditioned to accepting warnings, which in theory makes everyone less secure. On the flip side, when new messages appear its an opportunity to educate users about security online, which I will take all day long as opposed to doing nothing or relying on Anti-Virus programs to protect from all the bad things (because they don't).
    5. Ransomware app hosted in Google Play infects unsuspecting Android user - Google has removed 20 infected apps from the Google Play Store caught infecting devices with ransomware dubbed "Charger". Infected phones are locked and $180 worth of Bitcoin is demanded to unlock your phone. Be careful, as often times ransomeware is more than just looking for a ransom, as many variants are known to also collect your credentials or install backdoors, where your other accounts can be held for ransom, or your device is re-infected.
    6. Cisco Patches Critical Flaw in WebEx Chrome Plugin - Cisco has issues a patch for a WebEx Chrome plugin containing a remotely exploitable vulnerability. This one is a bit concerning as many corporations use this technology, so a campaign to exploit it could yield some interesting targets. This bug was discovered by Tavis Ormandy, and its recommended that the extension be uninstalled and re-installed for the patch to be 100% effective.

    Security News: Expert Commentary With Jason Wood

    Jason Wood - https://threatpost.com/ag-nominee-backs-law-enforcements-ability-to-overcome-encryption/123301/