Difference between revisions of "Episode616"

From Paul's Security Weekly
Jump to: navigation, search
(2 intermediate revisions by the same user not shown)
Line 15: Line 15:
 
{{Template:Paul}}
 
{{Template:Paul}}
 
{{Template:Larry}}
 
{{Template:Larry}}
{{Template:Doug}}
+
{{Template:LeeNeely}}
  
 
<br><br>
 
<br><br>
Line 21: Line 21:
 
= Announcements =
 
= Announcements =
 
{{Template:Announcements}}
 
{{Template:Announcements}}
*Qualys is introducing a new prescription for security and it’s FREE:  Global IT Asset Discovery and Inventory. Activate it today at securityweekly.com/qualys so you can achieve 100% near real-time visibility across your hybrid environments.
 
 
  
 
= Interview: Tony Punturiero, Offensive Security -  6:00-7:00PM =
 
= Interview: Tony Punturiero, Offensive Security -  6:00-7:00PM =
Line 31: Line 29:
 
<br>
 
<br>
  
= Tech Segment: Stewart Room, PwC- 6:30 - 7:30PM =
+
= Security News - 6:30 - 7:30PM =
[[File:StewartRoom.jpg|right|250px|thumb|<center>'''[https://twitter.com/StewartRoom Stewart Room]'''<br>is the Partner at [https://pwc.blogs.com/data_protection/stewart-room/ PwC].</center>]] Stewart Room, CIPP/E, is a partner at PwC UK. He is the global leader of the cyber security and data protection legal services practice, the joint global leader of the multidisciplinary data protection practice, and the UK data protection practice leader. He has more than 25 years of experience as a Barrister and Solicitor, focusing for the majority of this time on data, technology and communications.<br>Room specialises in the field of data protection. information management and cyber security, including programme design and delivery, the commercial exploitation of data, the security of data, regulatory investigations and litigation arising from the misuse of data. He is rated as a leading individual in data protection by legal directory Chambers UK, who says he "is the kind of lawyer who inspires confidence" and "he is an excellent, first-rate, tactical lawyer."<br>He is one of the founding directors of Cyber Security Challenge UK (which forms part of the UK National Strategy for Cyber Security), the President of the National Association of Data Protection Officers and the editor of the Cyber Security Practitioner journal. Room has written a number of textbooks on information law and is regularly quoted in the press. He is a past winner of the Financial Times Innovative Lawyer of the Year award.<br><br>'''Segment Topic:'''<br>Data Provacy and The Journey to Code<br><br>'''Segment Description:'''<br> Security Professionals have long understood the need to deliver security outcomes in technology and data, but is the privacy community on the same page? Data Privacy requires outcomes for matters such as data accuracy, data minimisation and fair processing, as well as risks, such as portability and access. These outcomes need tech and data solutions. In this session we will examine The Journey to Code, the next evolutionary step for Data Privacy.<br><br>'''Segment Resources:'''<br>https://www.linkedin.com/feed/update/urn:li:activity:6550420449854058497
 
<br>
 
 
 
<!-- <center>{{#ev:youtube|iPHM80z9D9k}}</center> -->
 
 
 
= Security News - 7:30 - 8:30PM =
 
 
== Paul's Stories ==
 
== Paul's Stories ==
 
{{Template:PSWPaul616}}
 
{{Template:PSWPaul616}}
Line 50: Line 42:
 
#[https://blog.knowbe4.com/scam-of-the-week-equifax-settlement-phishing Equifax Settlement Phishing] Surprise, there are phishing emails for the Equifax settlement. Use the [https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement FTC Site] or go directly to [https://www.equifaxbreachsettlement.com/file-a-claim Equifax Settlement site].
 
#[https://blog.knowbe4.com/scam-of-the-week-equifax-settlement-phishing Equifax Settlement Phishing] Surprise, there are phishing emails for the Equifax settlement. Use the [https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement FTC Site] or go directly to [https://www.equifaxbreachsettlement.com/file-a-claim Equifax Settlement site].
 
#[https://thehackernews.com/2019/08/android-qualcomm-vulnerability.html  New flaws in Qualcomm Chips expose Android Devices to Hacking] Critical vulnerabilities dubbed "QualPwn" could allow devices to be exploited via WLAN firmware weakness. Devices with Qualcomm Snapdragon 835 and 435 chips vulnerable.
 
#[https://thehackernews.com/2019/08/android-qualcomm-vulnerability.html  New flaws in Qualcomm Chips expose Android Devices to Hacking] Critical vulnerabilities dubbed "QualPwn" could allow devices to be exploited via WLAN firmware weakness. Devices with Qualcomm Snapdragon 835 and 435 chips vulnerable.
 +
<!-- [[File:StewartRoom.jpg|right|250px|thumb|<center>'''[https://twitter.com/StewartRoom Stewart Room]'''<br>is the Partner at [https://pwc.blogs.com/data_protection/stewart-room/ PwC].</center>]] Stewart Room, CIPP/E, is a partner at PwC UK. He is the global leader of the cyber security and data protection legal services practice, the joint global leader of the multidisciplinary data protection practice, and the UK data protection practice leader. He has more than 25 years of experience as a Barrister and Solicitor, focusing for the majority of this time on data, technology and communications.<br>Room specialises in the field of data protection. information management and cyber security, including programme design and delivery, the commercial exploitation of data, the security of data, regulatory investigations and litigation arising from the misuse of data. He is rated as a leading individual in data protection by legal directory Chambers UK, who says he "is the kind of lawyer who inspires confidence" and "he is an excellent, first-rate, tactical lawyer."<br>He is one of the founding directors of Cyber Security Challenge UK (which forms part of the UK National Strategy for Cyber Security), the President of the National Association of Data Protection Officers and the editor of the Cyber Security Practitioner journal. Room has written a number of textbooks on information law and is regularly quoted in the press. He is a past winner of the Financial Times Innovative Lawyer of the Year award.<br><br>'''Segment Topic:'''<br>Data Provacy and The Journey to Code<br><br>'''Segment Description:'''<br> Security Professionals have long understood the need to deliver security outcomes in technology and data, but is the privacy community on the same page? Data Privacy requires outcomes for matters such as data accuracy, data minimisation and fair processing, as well as risks, such as portability and access. These outcomes need tech and data solutions. In this session we will examine The Journey to Code, the next evolutionary step for Data Privacy.<br><br>'''Segment Resources:'''<br>https://www.linkedin.com/feed/update/urn:li:activity:6550420449854058497 -->
 +
<br>
 +
 +
<!-- <center>{{#ev:youtube|iPHM80z9D9k}}</center> -->
 +
 +
= BT Village and SE Village Interviews - 7:30 - 8:30PM =
 +
 +
* O'Shea Bowens, Null Hat Security
 +
* Tyler Robinson, Nisos, Inc.
 +
* Ãarań Łeyländ
 +
 
<br><br>
 
<br><br>

Revision as of 18:00, 15 August 2019

Recorded August 15, 2019 at G-Unit Studios in Rhode Island!

Episode Audio

Hosts

  • Paul Asadoorian
    Embedded device security researcher, security podcaster, and CEO of Active Countermeasures .
  • Larry Pesce
    Senior Managing Consultant and Director of Research at InGuardians, SANS Instructor.
  • Lee Neely
    is a Sr. Cyber Analyst at LLNL,SANS Analyst, SANS NewsBites Editor


  • Announcements

    • We have exciting news about the Security Weekly webcast program: We are now partnered with (ISC)2 as an official CPE provider! If you attend any of our webcasts, you will be receiving 1 CPE credit per webcast! Register for one of our upcoming webcast with Zane Lackey of Signal Sciences, Ian McShane from Endgame, or Stephen Smith and Jeff Braucher of LogRhythm (or all 3!) by going to securityweekly.com/webcasts If you have missed any of our previously recorded webcasts, you can find our on-demand library at securityweekly.com/ondemand

    • So many of the big East Coast cybersecurity tradeshows take place in crowded cities like Boston and New York, where parking is a nightmare and will cost you an arm and a leg. However, this year's Compass Cybersecurity Symposium is being held at Twin River Casino in Lincoln, RI, just 15 minutes outside of Providence! The venue has plenty of free and easy parking. Speakers include social engineering expert Chris Hadnagy and Security Weekly podcast founder Paul Asadoorian. Use the discount code "SW2019" to save $20 on registration!

    • Security Weekly will be at Hacker Halted in Atlanta, GA this October 10th-11th! EC-Council is offering our listeners a $100 discount to attend the two day conference. Use discount code HH19SW when you register or go to securityweekly.com/hackerhalted and register there! Make sure you checkout the keynote (Paul Asadoorian) and Mr. Jeff Man's talk as well!

    • Have you been trying your hardest to get a ticket to DerbyCon FinishLine?! We know that tickets sold out almost immediately, as they do almost every year, and we have an exciting announcement: Security Weekly is giving away 7 tickets to DerbyCon! Here's what you need to do - subscribe to the Security Weekly YouTube channel and send an email to sam@securityweekly.com with either a written or video testimonial about what Security Weekly means to you! That's it, it's really that simple! First 7 people to complete this will receive a ticket to DerbyCon! You will also be invited to participate in our Security Weekly DerbyCon interview series that Sam and Mark will be running at the conference!


    Interview: Tony Punturiero, Offensive Security - 6:00-7:00PM

    Tony Punturierois the Community Manager at Offensive Security
    Tony Punturiero (aka @tjnull) to the OffSec is an experienced pentester and red teamer for a government contractor, and is known for his great passion for educating and mentoring others. TJ is also an Adjunct Professor for a Local Community College teaching cybersecurity courses and coaches one of the top Community College's cyber team in the State of Maryland. He earned a BS in Cybersecurity from University of Maryland University College (UMUC) where he is a board member for the award winning UMUC Cyber Padawans. Over the year's, TJ has participated in over 200 Cyber Security competitions across the globe and is a 2 time SANS Netwars Champion.

    TJ is also one of the Founding members/Lead moderators of NetSecFocus--an online Information Security community consisting of 5700+ members that has partnered with other infosec organizations such as Hackthebox, Wizard Labs, and Hackmethod. Other then having a passion for cybersecurity TJ enjoys hiking, traveling, going to breweries, and playing video games.

    Segment Title/Topic:
    The journey of turning from a blue teamer to a red teamer. Kickstarting an Infosec Community and much more!

    Segment Description:
    Discussing about my adventure transferring from being on the blue side to becoming a pentester/red teamer full time. Created an infosec community to help each people in the infosec field come together to learn from one another.

    Segment Resources:


    Security News - 6:30 - 7:30PM

    Paul's Stories

    1. Researchers find security flaws in 40 kernel drivers from 20 vendors | ZDNet
    2. What a security researcher learned from monitoring traffic at Defcon
    3. Gamers Beware: Zero-Day in Steam Client Affects All Windows Users
    4. We checked and yup, it's no longer 2001. And yet you can pwn a Windows box via Notepad.exe
    5. Hack in the box: Hacking into companies with warshipping
    6. New Bluetooth Vulnerability Lets Attackers Spy On Encrypted Connections
    7. A compendium of container escapes - Help Net Security
    8. NULL license plate gets security researcher $12K in tickets
    9. Serious flaws in six printer brands discovered, fixed
    10. Should You Upgrade to Wi-Fi 6?
    11. Intel Patches High-Severity Flaws in Tools, NUC Firmware | SecurityWeek.Com
    12. The Flaw in Vulnerability Management: It's Time to Get Real
    13. New Research Finds More Struts Vulnerabilities

    Larry's Stories

    Lee's Stories

    1. Malware lingers in SMBs for an average of 800 days before discovery SMBs are often understaffed, or lack staff and infrastructure to detect and respond to Malware.
    2. Update to iOS 12.4 to Block New Vulnerabilities 13% of five year old or less iOS devices are not even running iOS 12.
    3. AirDrop and Password sharing can reveal passwords Bug in AirDrop can be used to reveal device information including a cryptographic hash that can be decoded to the device phone number.
    4. CafePress changes password policy after 23m pwned accounts CafePress was storing passwords insecurely, having users change their passwords fixes that. They aren't really acknowledging the breach.
    5. Equifax Settlement Phishing Surprise, there are phishing emails for the Equifax settlement. Use the FTC Site or go directly to Equifax Settlement site.
    6. New flaws in Qualcomm Chips expose Android Devices to Hacking Critical vulnerabilities dubbed "QualPwn" could allow devices to be exploited via WLAN firmware weakness. Devices with Qualcomm Snapdragon 835 and 435 chips vulnerable.



    BT Village and SE Village Interviews - 7:30 - 8:30PM

    • O'Shea Bowens, Null Hat Security
    • Tyler Robinson, Nisos, Inc.
    • Ãarań Łeyländ