Hacking Humans

Latest Episodes:

OWASP broken access control (noun) [Word Notes] Feb 01, 2022

Show notes

Software users are allowed access to data or functionality contrary to the defined zero trust policy by bypassing or manipulating the installed security controls.

Useful ransomware protection for you. Jan 27, 2022

Show notes

Guest Roger Grimes, Data Driven Defense Evangelist at KnowBe4, joins Dave to discuss his new book "Ransomware Protection Playbook," Dave has a story about a Meta (Facebook) group with a cryptocurrency scam that promises "a new way to wealth," Joe's story has tales of account takeover attacks of high-profile gamers, and our Catch of the Day is from listener Jesse about a text they received from "Facebook" about a $600,000 windfall.

Links to stories:

Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@thecyberwire.com or hit us up on Twitter.

OWASP security misconfiguration (noun) [Word Notes] Jan 25, 2022

Show notes

The state of a web application when it's vulnerable to attack due to an insecure configuration.

The perfect environment for ATOs (account takeovers) to breed. Jan 20, 2022

Show notes

Guest Jane Lee, Trust and Safety Architect at Sift, joins Dave to talk about the Digital Trust and Safety Index, Joe and Dave share some follow up from a listener, Ben, with a suggestion as an alternative to prevent clicking on those bonus phishing scams, Joe's story is about fake ticket scams for the Kansas City Chiefs NFL playoff game against the Pittsburgh Steelers, Dave's got a story about scams on Apple's App Store, and our Catch of the Day is from an anonymous listener about an email they received from their "IT department" requesting credentials (including password) when getting a new laptop. (Note: This is our first COTD that is not a scam, rather a bad policy.)

Links to stories:

Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@thecyberwire.com or hit us up on Twitter.

OWASP insecure design (noun) Jan 18, 2022

Show notes

A broad OWASP Top 10 software development category representing missing, ineffective, or unforeseen security measures.

The only locks you should pick are your own. Jan 13, 2022

Show notes

Guest Tom Tovar, CEO and Co-Creator of AppDome, joins Dave and Joe to discuss the results of a recent consumer survey, Dave's story is based on a tweet where the user's child's middle school had some unintended consequences of a phishing scam training, Joe has two stories: one on QR code scammers on parking kiosks, and one about a book publishing phishing scam, and our Catch of the Day is a message that purports to come from the USPS sent in by listener William about a missed package delivery.

Links to stories:

Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@thecyberwire.com or hit us up on Twitter.

Log4j vulnerability (noun) [Word Notes] Jan 11, 2022

Show notes

An open source Java-based software tool available from the Apache Software Foundation designed to log security and performance information.

Changing the game on ransomware. Jan 06, 2022

Show notes

Guest Adam Flatley, Director of Threat Intelligence at Redacted, talks with Dave about "the only way to truly disrupt the ransomware problem is to target the actors themselves," Joe shares some statistics that will help you stay up-to-date on recent cybersecurity trends, Dave's story is about criminal indictments in a case of a Maryland company buying lead paint victims’ settlements for a fraction of their value, and our Catch of the Day comes from listener Brady about a slick mail campaign they received from "Amazon."

Links to stories:

Have a Catch of the Day you'd like to share? Email it to us at hackinghumans@thecyberwire.com or hit us up on Twitter.

OWASP injection (noun) [Word Notes] Jan 04, 2022

Show notes

A broad class of attack vectors, where an attacker supplies input to an applications command interpreter that results in unanticipated functionality.

Identity "protection" and a pigeon drop. [Hacking Humans Goes to the Movies] Dec 30, 2021

Show notes

Thanks for joining us for Episode 5 of our fun project brought to you by the team of Hacking Humans, the CyberWire's social engineering podcast. Co-hosts Dave Bittner and Joe Carrigan are joined by Rick Howard in this series where they view clips from their favorite movies with examples of the social engineering scams and schemes you hear about on Hacking Humans. In this episode, Dave, Joe and Rick are watching Joe's and Dave's scene picks. They watch each of the selected scenes, describe the on-screen action for you, and then the team deconstructs what they saw. Grab your popcorn and join us for a trip to the movies.

Links to this episode's clips if you'd like to watch along:

Joe's clip from "Identity Thief"
Rick's pick from "The Flim-Flam Man"

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected