Easy Prey21 Apr 2021

Hacking with Alissa Valentina Knight

Gifted hackers can access data from a government website, a hospital medical system, or even a car. Most are not aware when their personal information is stolen, sold, and used until it is too late.

Today's guest is Alissa Knight. Alissa is a recovering hacker of 20 years, a cyber security influencer, content creator, and the principal cyber security analyst at Alissa Knight and Associates. She is the author of the recently released book Hacking Connected Cars. Alissa has been quoted in articles by Brian Krebs and featured in numerous magazine articles including PC Magazine, Wired, and Forbes.

Show Notes:

[1:01] - Alissa shares how she started hacking at the age of 13 and she got caught hacking a government network. They came to arrest her at school.
[2:27] - After this experience, Alissa later went on to own a few startups and sold them for millions of dollars.
[3:44] - Alissa explains her combat training when owning a defense contracting company. She then transitioned back into cyber security.
[5:10] - Her company shifted from defense contracting to private sector cyber security.
[6:06] - While living in Germany, Alissa got into hacking connected cars.
[7:07] - Although Alissa knows the risks of having connected technology, she is definitely a consumer of connected devices.
[7:55] - We are seeing a fundamental change in cybersecurity because now it isn't just about information. It can literally be life or death.
[9:02] - Alissa loves cinematography and combines her knowledge of hacking and content creation.
[10:17] - Cybersecurity can be boring and uninteresting. Alissa states that she got tired of seeing the same white papers and changed it up to make it more interesting not just for her but for clients as well.
[11:22] - Alissa references a book called Blue Ocean Strategy and summarizes its content in relation to her business model and content.
[12:58] - "A lot of the content out there for security is told through the eyes of a blue team member. It's told through the eyes of the defender. Very rarely do we see content being told through the eyes of the adversary."
[14:13] - Alissa describes what she wants people to see through her content.
[15:58] - In Alissa's opinion, we need to relearn the concept of prevention.
[17:27] - Chris points out that many mistakes are made when people think they have an impenetrable system. They become complacent.
[18:20] - There are so many products out there right now that become very overwhelming and many don't know what to choose or buy.
[19:17] - Alissa breaks down the categories of mHealth and describes how she was able to hack into them.
[20:59] - When testing these systems through hacking, Alissa was shocked at how much information she was able to access about patients.
[22:01] - Alissa explains the rule that CMS passed called FHIR.
[24:36] - Describing the systems that hospital systems use, Alissa points out some issues with lack of security.
[26:48] - Alissa shares a personal story about being diagnosed with cancer and the experience of getting an email with her medical data available through a mobile app.
[29:21] - The average person is not digging deep to find where their information could have been published on the darkweb.
[30:54] - Alissa explains the differences between what some providers can and cannot do with data.
[31:41] - To explain a BOLA vulnerability, Alissa uses an easy to visualize analogy.
[33:58] - Some of the problems in the APIs that Alissa is testing is insecure coding and programming. She lists how this can see patient health information in medical systems.
[35:13] - Simply changing an ID slightly once it has been authenticated is the number 1 vulnerability in APIs. Alissa says it's the easiest hack in the world.
[36:08] - Sharing a story about an experience with a pen tester, Chris demonstrates how important testing for vulnerabilities is.
[38:16] - We as consumers have to rely on manufacturers to make more secure cars and our healthcare providers to create more secure programs. It's unfortunately out of our hands.
[39:54] - It is not an immediate thing to learn. Alissa points out the many tools and the importance of understanding them.
[42:16] - Exploits and these penetration testing tools are important, but if they are in the wrong hands they can be used for different purposes.
[43:32] - When the developer is responsible for data, it leads to many problems. Alissa describes what can happen.
[46:19] - Alissa explains what she predicts what she thinks will happen in the future.
[47:28] - "I think zero trust should have been the foundational elements of the building blocks from the beginning."
[49:37] - There is a lot of amazing technology coming from Tel Aviv which is a shift from the past.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

Links and Resources:

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(329)

Job Recruiter Scams

Job hunting is hard enough without having to stop and ask whether the recruiter in your inbox is even real. My guest today, Jay Jones, ran into that problem firsthand after being laid off in December ...

24 Juni 35min

Bail Bonds Scams

Getting a call that someone you love has been arrested is scary enough. Getting that call from someone who sounds official, knows just enough to seem credible, and says you have to send money right aw...

17 Juni 36min

Confessions of a Fraudster

Technology keeps changing, but many of the most effective scams still come down to something very human: trust. My guest today is Tony Sales, co-founder of We Fight Fincrime and Underworld TV. Tony ha...

10 Juni 54min

Personal Safety

Scams and safety threats don't always announce themselves. Sometimes they start quietly, with a moment of distraction, a strange feeling you ignore, or a situation that shifts just enough to test whet...

3 Juni 43min

Data For Sale

Everyday conveniences ask for tiny pieces of information all the time like a phone number at checkout, a zip code at the register, an email address for a receipt, or a loyalty account for a small disc...

27 Maj 43min

Exploiting Psychology

Scams are often explained as a failure of judgment, but the truth is far more human. People are not fooled because they are foolish. They are manipulated at the exact moment emotion overrides logic, w...

20 Maj 45min

Investment Traps

Investment losses can be confusing because they do not always tell the whole story. Sometimes money is lost because the market has changed. Other times, an investor was sold something they did not und...

13 Maj 47min

Elder Exploitation

Aging parents often rely on the people closest to them for help, but what happens when that help becomes a way to take control? For Charles Wallace, the warning signs started small. His mother's fridg...

6 Maj 39min