Paul's Security Weekly (Audio)

Latest Episodes:

PSW #779 - Sin Ming Loo Apr 07, 2023

Show notes

The approach of cybersecurity workforce development and how someone with such technical background come to designing a degree program with non-traditional approach. What it takes to keep it going?

Segment Resources:

https://go.boisestate.edu/ucore

https://go.boisestate.edu/gcore

In the Security News: Rorschach, QNAP and sudo, why bother signing things, why bother having a password, why bother updating firmware, smart screenshotting, TP-Link oh my, music with Grub2, byte arrays and UTF-8, what is my wifi password, Debian and systemd, opening garage doors, downgrade your firmware to be more secure, exploit databases, this is like a movie, unsolved CTFs, and Near-Ultrasound Inaudible Trojans! All that and more on this episode of Paul's Security Weekly!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

Like us on Facebook: https://www.facebook.com/secweekly

Show Notes: https://securityweekly.com/psw779

PSW #778 - Philippe Laulheret Mar 30, 2023

Show notes

How to get into reversing embedded firmware? Can the planet really be hacked? We'll go over a couple of fun exploitation examples, see what mistakes were made and maybe what could have been done better to make these devices tougher to break into.

Segment Resources:

Voip phone hacking: Blog: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/avaya-deskphone-decade-old-vulnerability-found-in-phones-firmware/

Def Con presentation (intro to hardware hacking): https://www.youtube.com/watch?v=HuCbr2588-w&ab_channel=DEFCONConference

Medical Research: BBraun infusion pump: https://www.youtube.com/watch?v=6agtnfPjd64&ab_channel=hardwear.io

Medical devices under attack: https://www.rsaconference.com/USA/agenda/session/Code%20Blue%20Medical%20Devices%20Under%20Attack

Hacking DrayTek routers: https://www.youtube.com/watch?v=CD8HfjdDeuM&ab_channel=Hexacon

Philippe's public work: https://github.com/philippelaulheret/talks_blogs_and_fun

In the Security News: Turning traffic lights green with the flipperzero (and a bunch of other hardware), suspending AV and EDR, Test signing mode, Linux control freaks, hacking the Apple Studio Disaply, Intel;s attack surface reduction claim, the truth about TikTok that everyone is missing, just stop developing AI, but only for 6 months, anyone can connect to Amazon's wireless network, revoking the wrong things, losing your keys, the funny, not-so-funny things about firmware encryption, and exploding thumb drives. All that, and more, on this episode of Paul's Security Weekly!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

Like us on Facebook: https://www.facebook.com/secweekly

Show Notes: https://securityweekly.com/psw778

PSW #777 - Nico Waisman Mar 23, 2023

Show notes

We sit down with Nico Waisman to discuss vulnerability research and other security-related topics!

In the Security News: Windows MSI tomfoolery, curl turns 8...point owe, who doesn't need a 7" laptop, glitching the ESP, your image really isn't redacted or cropped, brute forcing pins, SSRF and Lightsail, reversing D-Link firmware for the win, ICMP RCE OMG (but not really), update your Pixel and Samsung, hacking ATMs in 2023, breaking down Fortinet vulnerabilities, Jamming with an Arduino, it 315 Mega hurts, analyzing trojans in your chips, and the 4, er 1, er 3, okay well how to suck at math and the 4 Cs of Cybersecurity! All that, and more, on this episode of Paul's Security Weekly!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

Like us on Facebook: https://www.facebook.com/secweekly

Show Notes: https://securityweekly.com/psw777

PSW #776 - Santiago Torres Arias Mar 16, 2023

Show notes

Software supply chain attacks, those in which hackers target the "water supply" of software are on the rise. This makes software developers everywhere valid targets. We will discuss the developer perspective on software supply chain attacks.

Segment Resources:

https://in-toto.io

https://sigstore.dev

In the security news: AI on your PI, no flipper for you, stealing Tesla's by accident, firmware at scale, the future of the Linux desktop, protect your attributes, SOCKS5 for your Burp, TPM 2.0 vulnerabilities, the world's most vulnerable door device and hiding from "Real" hackers, sandwiches, robot lawyers, poisonis epipens, and profanity in your code! All that, and more, on this episode of Paul's Security Weekly!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

Like us on Facebook: https://www.facebook.com/secweekly

Show Notes: https://securityweekly.com/psw776

PSW #775 - Ask Our PSW Hosts Anything! Mar 09, 2023

Show notes

Tune in to ask our PSW hosts anything you want to know! Join the live discussion in our Discord server to ask a question. Visit securityweekly.com/discord for an invite!

Larry Pesce, Jeff Man, Tyler Robinson, and more will be answering your questions, including:

What is your advice on avoiding burnout?
If each of the hosts had to be a distribution of Linux, which one would each of them be?
Which host is the worst influence?
Why is security so hard?
Will any of you be at RSAC this year and where can we come see you?
What current projects are you working on?

In the Security News: Using HDMI radio interference for high-speed data transfer, Top 10 open source software risks, Dumb password rules, Grand Theft Auto, The false promise of ChatGPT, The "Hidden Button", How a single engineer brought down twitter, Microsoft's aim to reduce "Tedious" business tasks with new AI tools, The internet is about to get a lot safer, All that, and more!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

Like us on Facebook: https://www.facebook.com/secweekly

Show Notes: https://securityweekly.com/psw775

PSW #774 - Asaf Cidon Mar 02, 2023

Show notes

Barracuda published its 2023 Email Security Trends report that shows how email-based security attacks affect organizations around the world. 75% of the organizations surveyed for the report had fallen victim to at least one successful email attack in the last 12 months, with those affected facing average costs of more than $1 million for their most expensive attack. 23% said that the cost of email-based attacks has risen dramatically over the last year.

Segment Resources:

https://assets.barracuda.com/assets/docs/dms/2023-email-security-trends.pdf

This segment is sponsored by Barracuda. Visit https://securityweekly.com/barracuda to learn more about them!

In the Security News for this week: indistinguishable classifiers, screenshot the /etc/passwd file, what the Zimbra, couple of cool Burp plugins, my voice is my passport. verify me, software is harder to exploit, unless its in firmware, when ChatGPT writes an article, becoming a trusted installer, not the last breach for lastpass, getting fried at the charger, and why hackers love stickers!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

Like us on Facebook: https://www.facebook.com/secweekly

Show Notes: https://securityweekly.com/psw774

Throwback Episode - PSW #480 Feb 23, 2023

Show notes

It's another holiday week, so enjoy this interview from the PSW archives!

We chat with Marcus J. Ranum of Tenable, pit ODROID against Raspberry Pi, and introduce you to USBee in our security news. All that and more, so stay tuned!

PSW #773 - Ron Woerner Feb 16, 2023

Show notes

Zero Trust is the buzzword of the 2020's. Vendors are selling it, the US Federal Government is requiring it, and organizations are implementing it, but what does it really mean (I mean really beyond the hype)? In this segment, Paul and Ron will talk ways combat threats through people, process, and technology Zero Trust Risk Management.

Segment Resources:

Forrester Research Zero Trust blogs: https://www.forrester.com/blogs/category/zero-trust-security-framework-ztx/

Ron Woerner YouTube: https://www.youtube.com/user/ronw68123

VetSec: https://veteransec.org/

Free CISSP Training Program: https://frsecure.com/cissp-mentor-program/

In the Security News: If it can run Linux, it should, TikTok thefts, significant vulnerability findings, and I'm not even joking, typo squatting is lame, what will it take Bruce!, stealing from the TPM, GoAnywhere, including root, what if attackers targeted your yacht?, two for the price of one (exploits), X is really old, and vulnerable, come for a ride on a CHERI-OT and be memory safe, codebreaking old letters, and vulnerable wienermobiles! All that, and more, on this episode of Paul's Security Weekly!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

Like us on Facebook: https://www.facebook.com/secweekly

Show Notes: https://securityweekly.com/psw773

PSW #772 - Hal Pomeranz Feb 09, 2023

Show notes

Linux systems are a collection of free and Open Source software-- some packaged by your distro, some built from source. How do you verify that your upstream isn't polluted by bad actors?

Segment Resources:

https://github.com/evilsocket/opensnitch

https://securityonionsolutions.com/software/

https://deer-run.com/users/hal/

https://archive.org/details/HalLinuxForensics

In the Security News: VMware and Ransomware makes you want to run some where, double-free your OpenSSH, download the RIGHT software, you have Docker, I have root, we don't talk about CORS, to vulnerability or not to vulnerability, vulnerability risk scoring, a matter of perspective, very persistent Cisco attacks, running UPNP without all the protections, overflowing a buffer in your bootloader over HTTP, C can be memory safe (but developers will still screw it up), and lasers, microwaves, satellites and the Sun! All that, and more, on this episode of Paul's Security Weekly!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

Like us on Facebook: https://www.facebook.com/secweekly

Show Notes: https://securityweekly.com/psw772

PSW #772 - Hal Pomeranz Feb 09, 2023

Show notes

Linux systems are a collection of free and Open Source software-- some packaged by your distro, some built from source. How do you verify that your upstream isn't polluted by bad actors?

Segment Resources:

https://github.com/evilsocket/opensnitch

https://securityonionsolutions.com/software/

https://deer-run.com/users/hal/

https://archive.org/details/HalLinuxForensics

Visit https://www.securityweekly.com/psw for all the latest episodes!

Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter!

Like us on Facebook: https://www.facebook.com/secweekly

Show Notes: https://securityweekly.com/psw772