T1SP: Episode 25

T1SP: Episode 25



[ Subscribe to the Podcast: iTunes | Android | RSS ]

News


* [ ] TrendMicro node.js server listening on localhost can execute commands; exposed to the internet
* [ ] SSH backdoor found in Fortinet firewalls
* [ ] SSH client vulnerability
* [ ] Australia’s Cybercrime Online Reporting Network (ACORN) received over 39K reports of criminal activity in 2015
* [ ] Hyatt names 250 hotels hit by malware, includes the one for DerbyCon
* [ ] Web sense rebranding as Forepoint, acquires Intel’s firewall business
* [ ] Twitter might be ending its 140 character limit
* [ ] Major vulns still being found in Health and Fitness mobile apps
* [ ] Angler exploit kit continues to evade detection
* [ ] LostPass attack is a phishing email attack that works against LastPass (showed at Shmoocon this weekend)
* [ ] Virus just took down the Melbourne Health computer system
* [ ] Lastpass has found a workaround for the LostPass attack
* [ ] A bit match fixing problem has been found in Tennis
* [ ] Trustwave is being sued by Affinity for supposedly missing an second hack that was going on while they were there to fix an initial hack


Ideas, updates, and discussion


* [ ] IR is messy and dangerous; assume compromise; assume continued compromise; be extremely careful saying that things were contained; if you’re not Mandiant you’re probably not doing a great job
* [ ] Smartphone encryption and the gun debate: same coin? ISIS supposedly has its own encryption app. What next, make murder illegal?


Tools, talks, and projects


* [ ] FIR – Fast Incident Response Management Platform
* [ ] DIVA damn insecure and vulnerable Android app
* [ ] Kill Chain for Kali Linux 2.0 : recon, weaponization, delivery, exploit, installation, c2, actions
* [ ] EZ-Wave: exploiting Z-Wave networks using SDR
* [ ] GoPhish: open source phishing framework
* [ ] V3n0m SQLi scanner
* [ ] VScan : uses NSE scripts to find vulns
* [ ] SleepyPuppy Burp Extension
* [ ] DBDAT — Database Assessment Tool — https://github.com/foospidy/DbDat


Announcements


* [ ] Speaking at AppSec Cali next week (Tuesday) on ATM
* [ ] Shmoocon hiring list: http://www.room362.com/2016/01/2016-shmoocon-hiring-list.html


Miscellaneous


* [ ] Great security news source: https://security.didici.cc/news
* [ ] Thanks to Tripwire for giving a shoutout to the podcast on Twitter


[ Subscribe to the Podcast: iTunes | Android | RSS ]

Notes


* The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM.

Become a Member: https://danielmiessler.com/upgrade

See omnystudio.com/listener for privacy information.

Episoder(532)

A Conversation with Abhishek Agrawal from Material Security

A Conversation with Abhishek Agrawal from Material Security

In this conversation, I speak with Abhishek Agrawal, co-founder and CEO of Material Security. We talk about: - Material's Security innovative approach to email security by not just preventing unauthorized access but also containing damage from potential breaches. -Abhishek's background in data infrastructure at Dropbox and how product mangers can become successful CEOs due to their cross-functional expertise.  - The need for customized security measures for different organizations, the role of AI in detecting email threats, the importance of single-tenant environments for sensitive customers and the potential risk of default settings in productivity suites like Google Workspace. Among other topics.  Abhishek's Background and Material Security (00:00:00)Email Security and Productivity Suite (00:01:01)Geographical Connection and Coffee Meetup (00:02:06)Product Managers as CEOs and Co-founders (00:02:59)Empowering Product Managers (00:05:01)Product Management and Marketing Importance (00:08:04)Email as a Content Repository (00:09:39)Securing Email Content (00:11:03)Data Protection for Email (00:12:10)Redacting and Canaries (00:12:57)Email Security vs. Data Security (00:14:53)Abuse Cases and Control Layers (00:17:32)Mailbox Compromise and Lateral Movement (00:17:39)Threat Scenario Analysis (00:20:15)Language Models for Detection (00:22:19)Optimism in AI Tools for Defense (00:24:34)Customized Detection Categories (00:25:52)Security Controls Trend (00:26:20)Security Concerns for Law Firms (00:27:07)Email Copy Distribution (00:27:24)API-Based Integration (00:29:08)Monitoring LM Functionality (00:30:42)Threat Intelligence and Detection (00:32:54)Product Design Philosophy (00:35:56)Data Protection (00:38:01)Flexibility in Deployment (00:39:26)Main Products (00:40:33)Posture Management (00:44:01)Broadening Product Coverage (00:48:49)Google Workspace Threat Detection (00:50:05)Challenges with CSP (00:51:13)Contextual Intelligence (00:52:02)Balancing Depth and Breadth (00:53:15)Learning about Material (00:53:40)Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

7 Jun 202454min

UL NO. 435: Making New Things is Post-AI Safety

UL NO. 435: Making New Things is Post-AI Safety

Jason Haddix's AI Course, Microsoft Recall analysis, exercise erasing trauma, AI and the jobs problem… ➡ Check out Vanta and get $1000 off:vanta.com/unsupervised Subscribe to the newsletter at: https://danielmiessler.com/subscribe Join the UL community at:https://danielmiessler.com/upgrade Follow on X:https://twitter.com/danielmiessler Follow on LinkedIn:https://www.linkedin.com/in/danielmiessler See you in the next one!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

7 Jun 202424min

UL NO. 434: Can You Articulate Yourself in 50 Words?

UL NO. 434: Can You Articulate Yourself in 50 Words?

NetworkChuck's Fabric Video, Algorithms Replace Degrees, AI Transparency, New Grad Difficulty, Windows Goes Full AI, and more… ➡ Check out the Autonomous IT Podcast:https://community.automox.com/autonomous-it-podcasts-144 Subscribe to the newsletter at: https://danielmiessler.com/subscribe Join the UL community at:https://danielmiessler.com/upgrade Follow on X:https://twitter.com/danielmiessler Follow on LinkedIn:https://www.linkedin.com/in/danielmiessler See you in the next one!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

1 Jun 202427min

UL NO. 433: China's Flawed Strategy

UL NO. 433: China's Flawed Strategy

A new book, A new Fabric pattern, Autonomous fighter jets, Friend trips, and more… ➡ Check out Vanta and get $1000 off:vanta.com/unsupervised Subscribe to the newsletter at: https://danielmiessler.com/subscribe Join the UL community at:https://danielmiessler.com/upgrade Follow on X:https://twitter.com/danielmiessler Follow on LinkedIn:https://www.linkedin.com/in/danielmiessler See you in the next one!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

29 Mai 202410min

A Conversation with Mike Privette from Return on Security

A Conversation with Mike Privette from Return on Security

In this conversation, I speak with Mike Privette. Mike is the CISO and Cybersecurity Economist at Return on Security. We discuss:- The economic impact of COVID-19, the shift from prioritizing growth to operational efficiency, and the subsequent market crash and rebound in 2024. - The rise of AI in application security, the importance of trust and safety, and the potential for AI to enhance personal digital sovereignty.  -The changing dynamics of startups, venture capital, and private equity in the cybersecurity space.  Among many other topics. Introduction and Guest Welcome (00:00)Return on Security's audience (01:53)Economic trends in cybersecurity & COVID-19 (05:59)Shift towards operational efficiency in cybersecurity companies (09:39)Current cybersecurity trends and rebound effects (13:23)Application Security and AI (15:05)The Evolution of AI Security Companies (16:09)Trust and Safety in Cybersecurity & Discussing Deepfake videos (17:03)Validation of Ground Truth (19:18)Personal and corporate security from AI (20:31)Continuous Defender and AI Filtering (21:31)Validation of True Content to combat misinformation (23:23)AI for News Reports and Corporate Communications (26:16)The Future of AI Security (27:11)The trend of personal digital sovereignty (31:03)Private equity vs. VC vs. startups (33:36)Operational efficiency and the future of startups (36:29)Cybersecurity industry trends and data science (43:36)The Universal Dashboard concept (45:15)Sharing knowledge and connections (45:42)Check Out Return on Security (45:58)Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

24 Mai 202446min

UL NO. 432: Can You Summarize Your Work in a Sentence?

UL NO. 432: Can You Summarize Your Work in a Sentence?

Thoughts on GPT-4o, Dell's API Hack, Russian Campus Campaigns, Google's Pretend Work, and more… ➡ Check out Vanta and get $1000 off:vanta.com/unsupervised Subscribe to the newsletter at: https://danielmiessler.com/subscribe Join the UL community at:https://danielmiessler.com/upgrade Follow on X:https://twitter.com/danielmiessler Follow on LinkedIn:https://www.linkedin.com/in/danielmiessler See you in the next one!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

24 Mai 202427min

A Conversation on Maritime Security with BlackBerry Threat Intelligence

A Conversation on Maritime Security with BlackBerry Threat Intelligence

In this sponsored conversation, I speak with Corey Ranslem, CEO of Dryad—and the resident expert on Maritime Attacks—and Ismael Valenzuela, VP of Threat Intelligence and Research at Blackberry. We talked about all things Maritime Security, and I learned a whole lot from the conversation. Digital Hijacking at Sea: Unveiling a Cyber Attack Scenario in the Red Sea BlackBerry Quarterly Global Threat Report — March 2024 Maritime Cyberthreats: A Growing Risk to Global Trade (blackberry.com) 00:00:00 Introduction and Guest Welcome00:00:30 Maritime Security Overview00:01:15 Baltimore Incident Discussion00:02:00 Legacy Systems on Ships00:03:20 Connectivity Challenges at Sea00:04:10 Cyber Threats in Maritime Industry00:05:00 Post-Accident Cyber Investigations00:06:00 Potential Cyber Attacks on Ships00:07:30 Threat Scenarios and Models00:08:45 USB and External Media Threats00:09:30 Evolution of Navigation System Connectivity00:10:30 Crew Connectivity and Cyber Risks00:11:30 Lessons from Other Industries00:12:15 GPS Spoofing and Navigation Interference00:13:30 Digital Hijacking of Ships00:14:45 Economic Disruption via Cyber Attacks00:16:00 Financial Motivation Behind Attacks00:17:15 Ransomware in Maritime Context00:18:30 Panama Canal and Economic Impact00:19:30 Cyber Security Maturity in Maritime Industry00:21:00 Legacy Systems and Geopolitical Interests00:22:15 Challenges with Security Solutions at Sea00:23:30 Historical Cyber Incidents in Maritime00:24:30 GPS Spoofing Techniques00:25:15 International Maritime Organization Standards00:26:30 Criminal Trends and Cyber Attacks00:27:45 Open Source Tools and Threat Actors00:28:45 Information Sharing in Maritime Industry00:29:30 Real-World Examples of Cyber Incidents00:31:00 Cruise Ships and Large Yachts Security00:32:15 Autonomous Vessels and Cyber Protection00:33:30 Future of Autonomous Vessels00:34:15 Learning and Improving Cyber Security in Maritime00:35:30 Role of Threat Intelligence in Maritime Security00:36:15 Optimism for the Future of Maritime Security00:37:30 Industry Awareness and Education Efforts00:38:30 AI Integration in Maritime Security Solutions00:39:15 Conclusion and Final ThoughtsBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

16 Mai 202440min

UL NO. 431: Companies are Graphs of Algorithms

UL NO. 431: Companies are Graphs of Algorithms

The US goes skills-based, AI is mostly prompting, simulation -> reality, 30 useful concepts, and more…… Subscribe to the newsletter at: https://danielmiessler.com/subscribe Join the UL community at:https://danielmiessler.com/upgrade Follow on X:https://twitter.com/danielmiessler Follow on LinkedIn:https://www.linkedin.com/in/danielmiessler See you in the next one!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

9 Mai 202411min

Populært innen Teknologi

romkapsel
rss-avskiltet
teknisk-sett
tomprat-med-gunnar-tjomlid
energi-og-klima
shifter
rss-impressions-2
elektropodden
fornybaren
smart-forklart
nasjonal-sikkerhetsmyndighet-nsm
rss-alt-som-gar-pa-strom
rss-alt-vi-kan
teknologi-og-mennesker
kunstig-intelligens-med-morten-goodwin
rss-snakk-om-sikkerhet
rss-bouvet-bobler
rss-digitaliseringspadden
rss-teams-cast-away
rss-bits-and-bytes-for-advokater