- 1 Paul's Security Weekly Episode #664 - August 27, 2020
- 2 1. Hacking Tesla's Model 3, 28,000 Printers Hijacked, & iOS 14 Privacy Changes - 06:00 PM-07:30 PM
- 2.1 Announcements
- 2.2 Description
- 2.3 Hosts
- 2.4 Doug White's Content:
- 2.5 Jeff Man's Content:
- 2.6 Joff Thyer's Content:
- 2.7 Larry Pesce's Content:
- 2.8 Lee Neely's Content:
- 2.9 Paul Asadoorian's Content:
- 2.10 Tyler Robinson's Content:
- 3 2. SWVHSC Micro Interviews: Polarity & Netsparker - 07:30 PM-08:15 PM
- 4 3. Predicting Vulnerabilities In Compiled Code - Roi Cohen & Shani Dodge - 08:30 PM-09:15 PM
Paul's Security Weekly Episode #664 - August 27, 2020
Subscribe to all of our shows and mailing list by visiting: https://securityweekly.com/subscribe
1. Hacking Tesla's Model 3, 28,000 Printers Hijacked, & iOS 14 Privacy Changes - 06:00 PM-07:30 PM
Join the Security Weekly Mailing List for webcast/virtual training announcements and to receive your personal invite to our Discord server by visiting https://securityweekly.com/subscribe and clicking the button to join the list!
Do you have a specific guest or topic that you want us to cover on one of the shows? Submit your suggestions for guests by visiting https://securityweekly.com/guests and completing the form! We review suggestions monthly and will reach out to you once reviewed!
Google Researcher Reported 3 Flaws in Apache Web Server Software, Medical Data Leaked on GitHub Due to Developer Errors, Experts hacked 28,000 unsecured printers to raise awareness of printer security issues, Tesla Is Cracking Down On Performance-Enhancing Hacks For The Model 3, Former Uber CSO Charged Over Alleged Breach Cover-Up, and Researchers Sound Alarm Over Malicious AWS Community AMIs!
Doug White's Content:
Jeff Man's Content:
Joff Thyer's Content:
Larry Pesce's Content:
Lee Neely's Content:
- Former Uber CSO Charged Over Alleged Breach Cover-Up Just 10 days after former CSO Joseph Sullivan testified about a 2014 breach, he reportedly received an email from the hacker informing him of the 2016 breach and, rather than report the breach, paid the attackers .85 BTC ($100,000 USD) via a bug bounty program and had attackers sign a non-disclosure agreement (NDA) asserting no data was stolen or stored.
- Transparent Tribe APT Targets Government, Military by Infecting USB Devices "Transparent Tribe" (APT36) has reportedly been targeting government and military personnel in India and Afghanistan with a new remote access Trojan (RAT) dubbed "Crimson Remote" that is specifically designed to infect USB devices and spread to other systems on targeted network.
- University of Utah pays $457,000 to ransomware gang The university said it actually dodged a major ransomware incident and that the hackers managed to encrypt only 0.02% of the data stored on its servers. Systems were recovered from backup, but threats to release student data online lead to paying ransom.
- 8.3M Freepik Users Exposed in Recent Databreach Information was accessed using SQL injection attack - sanitize input, don't just rely on the WAF.
- FBI, CISA Warn of Growing 'Vishing' Threat as Hackers Take Advantage of Remote Working Trend Calling users mobile, from help-desk look-alike numbers, with look-alike "new" VPN services.
- Russian Charged with Trying to Recruit Employee to Plant Malware in US Company The U.S. DOJ has arrested 27-year-old Russian citizen Egor Igorevich Kriuchkov for recruiting an employee working at a Nevada-based company to plant malware on the company's network in order to steal data, and then threaten to publicly release it if the company refused to pay up.
- New Zealand Stock Exchange Hit by Cyber Attack for Second Day New Zealand Stock Exchange, in part: "experienced a volumetric DDoS attack from offshore via its network service provider, which impacted NZX network connectivity." Network connectivity issues resulting in stopping trading for the day.
Paul Asadoorian's Content:
- [SANS ISC Malicious Excel Sheet with a NULL VT Score - /dev/random] - I found a sample that just has a very nice score of 0/57 on VT. Yes, according to all AV's the file is safe. Really? If it matched one of my hunting rules, there is for sure something suspicious inside. Let's have a look at it. The file has been uploaded yesterday on VT (SHA256:1191d5c1dd7f6ac38b8d72bee37415b3ff1c28a8f907971443ac3a36906e8bf5)
- Facing gender bias in facial recognition technology - Help Net Security - The solutions we evaluated was misidentifying women 18% more often than men. You can imagine the terrible consequences this type of bias could generate. For example, a smartphone relying on face recognition could block access, a police officer using facial recognition software could mistakenly identify an innocent bystander as a criminal, or a government agency might call in the wrong person for questioning based on a false match. The list goes on. The reality is that the culprit behind these issues is bias within model training that creates biases in the results.
- How do I select a password management solution for my business? - Help Net Security
- Google Researcher Reported 3 Flaws in Apache Web Server Software - The first of the three issues involve a possible remote code execution vulnerability due to a buffer overflow with the "mod_uwsgi" module (CVE-2020-11984), potentially allowing an adversary to view, change, or delete sensitive data depending on the privileges associated with an application running on the server. Dodged that one, we use Nginx!
- Medical Data Leaked on GitHub Due to Developer Errors - Don't do this stuff: : Embedding hard-coded login credentials in code instead of making them a configuration option on the server the code runs on; using public repositories instead of private repositories; failing to use two-factor or multifactor authentication for email accounts; and/or abandoning repositories instead of deleting them when no longer needed, they wrote.
- Researchers Sound Alarm Over Malicious AWS Community AMIs - You use a shared AMI at your own risk. Amazon can’t vouch for the integrity or security of AMIs shared by other Amazon EC2 users. Therefore, you should treat shared AMIs as you would any foreign code that you might consider deploying in your own data center and perform the appropriate due diligence. We recommend that you get an AMI from a trusted source.
- A Tale of Escaping a Hardened Docker container - Red Timmy Security - I think the docker.sock thing has been known for a while...
- Experts hacked 28,000 unsecured printers to raise awareness of printer security issues - In the end, we managed to hijack 27,944 printers out of the 50,000 devices that we targeted, which amounts to a 56% success rate. Taking this percentage into account, we can presume that out of 800,000 internet-connected printers across the world, at least 447,000 are unsecured.
- Tesla Is Cracking Down On Performance-Enhancing Hacks For The Model 3
- Facebook again criticizes iOS 14 privacy changes, warns of drastic effect on advertising industry - 9to5Mac - I really want to turn this off now: In the blog post, Facebook explains that it and many advertising partners rely on the Identifier for Advertisers (IDFA) feature. This is what allows advertisers to track users across different apps and websites. With iOS 14, however, Apple is adding a new privacy protection such that developers will be required to ask for permission before tracking a user across apps or websites.
- Code-execution bug in Pulse Secure VPN threatens patch laggards everywhere
Tyler Robinson's Content:
- Facebook says Apple's new privacy rules will hamper its ad service
- Police Want Your Smart Speaker—Here's Why
- CBP just paid $476K for people's phone location data from a company that's under investigation for selling personal data
- Wirecard: the frantic final months of a fraudulent operation
- Zoom says it’s fixed problem behind massive outages
- New and inexperienced group of hackers from Iran are using Dharma ransomware against easily attacked businesses in Russia, India, China, and Japan
- TikTok intends to file a lawsuit challenging the US Executive Order on Addressing the Threat Posed by TikTok.
- Snyk has identified malicious code in the Mintegral software development kit widely used by applications in Apple’s App Store. The “SourMint” malware is adapted to ad fraud and data collection.
- Cobalt.io grabs $29M Series B to continue building out pentesting platform – TechCrunch
2. SWVHSC Micro Interviews: Polarity & Netsparker - 07:30 PM-08:15 PM
Most analysts will tell you that they balance between being thorough and getting the job done quickly. Paul Battista asked the security community to weigh in on this debate. He’ll share what they thought and explain why it’s no longer necessary to choose between the two. This segment is sponsored by Polarity. Visit https://www.polarity.io/sw to learn more about them!
Take the Polarity Challenge! Get your free community edition by visiting: www.polarity.io/sw
Dynamic application security testing (DAST) for web applications has come a long way, establishing a niche market with a variety of offerings. In this segment Ferruh will discuss the big differences in DAST solutions available and help you understand which one is a pure DAST that you could rely on the most in this day and age. This segment is sponsored by Netsparker. Visit https://securityweekly.com/netsparker to get a trial of the best dynamic application scanning solution on the market!
Ferruh Mavituna is CEO at Netsparker
Ferruh’s deep understanding of web application security was the driving force behind Netsparker’s success. Prior to founding Netsparker, he worked as security consultant and penetration tester for several enterprise companies in the US and UK. Ferruh focuses on web app security research and automated vulnerability detection & exploitation. A frequent speaker at conferences and podcasts, he has released several research papers and tools.
Paul Battista is CEO & Founder at Polarity
Former intelligence officer for the Central Intelligence Agency’s Information Operation Center; participated in all elements of the intelligence cycle from planning operations through dissemination to senior policy makers in the White House. Before his government service, Paul was a senior engineer for Aetna Inc., a penetration tester, and incident responder for multiple Fortune 100 customers.
3. Predicting Vulnerabilities In Compiled Code - Roi Cohen & Shani Dodge - 08:30 PM-09:15 PM
Security Weekly is ramping up our webcast/technical training schedule for the rest of 2020! In September you can Learn How to Extend the Enterprise Network for Remote Workers and Protect Your Home Network, Find out Why Traditional Data Security Can’t Be Zero Trust, and Learn how to reduce the blast radius of your cloud infrastructure. Visit https://securityweekly.com/webcasts to see what we have coming up! Or visit securityweekly.com/ondemand to view our previously recorded webcasts!
The growth in software vulnerability exploitation creates a need for better prediction capabilities. Over time, there have been shifts in the ways of discovering vulnerabilities in binary code. Research and development of new tools enables security pros to adopt innovative techniques to scale the process.
This segment is sponsored by Vicarius.
Visit https://securityweekly.com/vicarius to learn more about them!
Cybersecurity expert with over 15 years of experience. Former research team leader at CyberArk, Penetration tester, and graduate of and elite technology unit @IDF
Shani Reiner (Dodge)
Shani has 10 years of experience working as a cyber security researcher and a data scientist. Her malware research has led to the development of the industry’s most advanced analysis tools. Shani holds a B.Sc. in Computer Science and a M.B.A specializing in finance, strategy and entrepreneurship, both from the Hebrew University of Jerusalem.