Category Archives: Podcast

Defensive Security Podcast Episode 26

July 14, 2013Podcastdark seoul, eas, EDA, HP, incident response, ipmi, malware, OWASPjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Vulnerability market, OWASP top 10 still relevant, HP Storage back door, Default root ssh keys in EAS servers, IPMI Vulnerabilities, Dark Seoul update, Incident response goes horribly wrong, Dropbox and WordPress leveraged by attackers

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email

Vulnerability market: http://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computer-flaws.html

OWASP top 10 still relevant: http://www.cyberwarzone.com/dutch-domain-registrar-hacked-sqli

HP Storage back door: http://www.infoworld.com/t/data-security/hp-admits-undocumented-backdoors-in-two-separate-storage-lines-222614

Default root ssh keys in EAS servers: http://www.infosecurity-magazine.com/view/33372/eas-vulnerability-bodies-of-the-dead-could-rise-again/

IPMI Vulnerabilities: http://www.infoworld.com/d/security/serious-flaws-found-in-ipmi-server-management-protocol-222107

Dark Seoul update: http://arstechnica.com/security/2013/07/hard-drive-wiping-malware-that-hit-s-korea-tied-to-military-espionage/
http://www.mcafee.com/us/resources/white-papers/wp-dissecting-operation-troy.pdf

Incident response goes horribly wrong: http://arstechnica.com/information-technology/2013/07/us-agency-baffled-by-modern-technology-destroys-mice-to-get-rid-of-viruses/

Dropbox and WordPress leveraged by attackers: http://www.pcadvisor.co.uk/news/security/3457260/dropbox-wordpress-used-in-cyberespionage-campaign/

Defensive Security Podcast Episode 25

July 7, 2013Podcastdrive by infection, encryption, ICS, infosec, malware, microsoftjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Snowden offered asylum, Germany’s interior minister cautions Germans against using US-based services, California AG urges legislation to require the use of encryption, 85% of virus infections are from drive by download, Attacks on energy sector, Texas government infections, MS Tuesday

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email

85% of virus infections are from drive by downloads: http://www.csis.dk/en/csis/news/3981/

Attacks on energy sector: http://securityaffairs.co/wordpress/15820/security/ics-cert-surge-in-attacks-against-energy-industry.html

Texas government infections: http://www.kens5.com/news/State-computers-compromised-but-theres-not-enough-staff-to-fix-it-214231541.html

MS Tuesday: http://www.theregister.co.uk/2013/07/05/ms_july_2013_patch_tuesday_prealert/

Defensive Security Podcast Episode 24

June 30, 2013PodcastCarberp, FINRA, malware, phishing, stuxnet, Syrian Electronic Armyjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Kaspersky study indicates 200,000 malware variants are released daily, the Carberp trojan’s source code is leaked and an 0day is discovered, FINRA reports on prolific cyber attacks against its members, the FT is attacked by the Syrian Electronic Army and gives a play by play on what happened, Kaspersky reports an 87% increase in phishing attacks, Google reports that compromised legitimate sites are more dangerous than malicious sites, Sophos says 30,000 SMB sites are hacked per day to spread malware, the age old debate about administrator rights, password complexity, and the unintended consequences of leaks: foreign companies defect to more hospitable countries, renewed focus on systems administrators, and we can stop pretending to not know where Stuxnet came from. Continue reading Defensive Security Podcast Episode 24 →

Defensive Security Podcast Episode 23

June 24, 2013PodcastEMET, linkedin, OpPetroljb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

The discrepancy between perception and reality when it comes to quantifying risk, the major fail that was OpPetrol, Malvertising, EMET 4 released, How not to be a CSO by the Harvard Business Review, Linked In’s DNS woes, and CSOs are not recognizing reality. Continue reading Defensive Security Podcast Episode 23 →

Defensive Security Podcast Episode 22

June 16, 2013Podcastfda, Java, malware, OWASPjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Risk Science Podcast, Forensic 4Cast podcast, Gartner security myths, 2013 OWASP top ten, FDA finds security risk in medical devices, Oracle fixes 40 more java bugs, B-sides Rhode Island videos, Can the Germans break PGP?

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email

Risk Science Podcast: http://riskscience.net/

Forensic4Cast :http://forensic4cast.com/

Gartner security myths: http://www.networkworld.com/news/2013/061113-gartner-reveals-top-10-it-270738.html

2013 OWASP top ten: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

FDA finds security risk in medical devices: http://www.networkworld.com/news/2013/061413-federal-regulators-address-rising-security-270844.html

Oracle fixes 40 more java bugs: https://www.infoworld.com/d/security/oracle-ship-40-security-fixes-java-se-220758

B-sides Rhode Island videos: http://www.irongeek.com/i.php?page=videos%2Fbsidesri2013%2Fmainlist

Can the Germans break PGP? http://malwarejake.blogspot.com/2013/06/are-germans-really-breaking-pgp-and-ssh.html

Defensive Security Podcast Episode 21

June 9, 2013PodcastCitadel, Java, malware, microsoft, PRISMjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Verizon, PRISM and Edward Snowden, Java users are bad at patching, cost of breaches is up, Microsoft operation takes down 1462 Citadel botnets, malware increasingly using peer to peer communications for command and control, and malware trends.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email Continue reading Defensive Security Podcast Episode 21 →

Defensive Security Podcast Episode 20

June 2, 2013Podcast, Securitymalwarejb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

US power grid is highly vulnerable and under constant attack, Iran attacking energy companies, increase in sophisticated attacks against keys and certificates, Indian government site redirects to black hole exploit kit, FSB report find that only 36% of small businesses regularly patch, 5 quick wins from the DBIR, Google to give software vendors 7 days prior to releasing information on active exploits, and planning for the failure of malware prevention.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email Continue reading Defensive Security Podcast Episode 20 →

Defensive Security Podcast Episode 19

May 19, 2013Podcastadobe, Java, malwarejb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Adobe and Microsoft patches, signed Mac malware, EC Council website hacked, 7 steps to secure Java, Microsoft on invulnerable software, more on OpUSA, Ohio city’s taxpayer database stolen and the importance of malware being invisible.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email Continue reading Defensive Security Podcast Episode 19 →

Defensive Security Podcast Episode 18

May 12, 2013PodcastBYOD, Cold Fusion, Syrian Electronic Army, The Onion, Twitterjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Adobe warns customers of a Cold Fusion 0day, Washing courts owned by that 0day, web servers found compromised with the Cdorked/Darkleech, critical vulnerability in Nginx, Anonymous’ opUSA turned out to be a bunch of nothing, too many admins is bad for security, Name.com gets compromised, The Onion’s twitter feed is compromise by the SEA, slippery slope of BYOD and Google’s plans for authentication.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email

Washington courts compromised via cold fusion: http://www.washingtonpost.com/national/apnewsbreak-wash-courts-hacked-up-to-1-million-drivers-license-numbers-accessed/2013/05/09/eba5d7d0-b8d3-11e2-b568-6917f6ac6d9d_story.html

Cold fusion: http://www.networkworld.com/news/2013/050913-adobe-warns-customers-of-unpatched-269596.html

http://www.infoworld.com/d/security/highly-critical-vulnerability-fixed-in-nginx-web-server-software-218168

Web server compromises: http://www.theregister.co.uk/2013/05/08/cdorked_latest_details/

Opusa http://qz.com/82201/massive-hacker-strike-against-us-government-banks-turns-out-to-be-a-dud/

http://podcasts.infoworld.com/d/security/too-many-admins-spoil-your-security-218023

http://nakedsecurity.sophos.com/2013/05/08/name-dot-com-suffers-breach

http://theonion.github.io/blog/2013/05/08/how-the-syrian-electronic-army-hacked-the-onion/

BYOD https://www.infoworld.com/d/consumerization-of-it/the-unintended-consequences-of-forced-byod-217919

Google auth plans http://www.csoonline.com/article/733130/google-s-five-year-plan-for-authentication-it-s-complicated

Defensive Security Podcast Episode 17

May 5, 2013Podcast, Security0day, cyberwar, internet explorer, iOS, security awarenessjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

This week: Twitter warns news agencies of attacks and to use dedicated PCs for using twitter, the US department of Labor website was compromised and serving up an 0day for IE8, 18 12-13 year olds in Alaska socially engineered passwords for 300 computers out of their teachers, iOS did NOT have a malicious app discovered, AV vendors are starting to shun Windows XP, 7 elements of a successful security awareness program, and the unforeseen impacts of cyberwar.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email

Episode 17

http://security.onestopclick.com/technology_news/media-warned-to-tighten-twitter-security_474.htm

http://arstechnica.com/security/2013/05/internet-explorer-zero-day-exploit-targets-nuclear-weapons-researchers/

http://www.bbc.co.uk/news/technology-22398484

http://www.networkworld.com/news/2013/050213-ios-app-contains-potential-269393.html

http://podcasts.infoworld.com/t/anti-virus/windows-xp-risk-antivirus-vendors-jump-ship-217806

http://www.wired.co.uk/news/archive/2013-05/2/comment-crew-plunder-qinetiq

http://www.networkworld.com/news/2013/050113-the-7-elements-of-a-269301.html

http://www.networkworld.com/news/2013/050113-livingsocial-breach-scope-widens-on-269295.html

http://qz.com/81268/the-worst-possible-cybersecurity-breaches-could-be-far-worse-than-you-imagined/