Talkin' Bout [Infosec] News

Latest Episodes:

Webcast: Hack for Show, Report For Dough: Part 2 Dec 21, 2021

Show notes

At Black Hills Information Security (BHIS), we make our living doing pentesting, but we’ve never once been paid for a pentest. Penetration Testers get paid for their reports. For their explanations. For their story of the environment as it appears to an attacker. The scanning and testing and exploiting (and failing at those things) is […]

The post Webcast: Hack for Show, Report For Dough: Part 2 appeared first on Black Hills Information Security.

Talkin’ About Infosec News – The Floor is Java – 12/15/2021 Dec 15, 2021

Show notes

ORIGINALLY AIRED ON DECEMBER 13, 2021 00:00 – PreShow Banter™ 09:41 – FEATURE PRESENTATION: The Floor is Java – Log4Shell / Log4J 10:26 – Lets Jump In 11:31 – Oh No… 12:28 – None of This is New 15:36 – How Does This Work? 19:48 – Mitigations 21:48 – Find it on Hosts 23:54 – Hal […]

The post Talkin’ About Infosec News – The Floor is Java – 12/15/2021 appeared first on Black Hills Information Security.

(00:00) - PreShow Banter™
(09:41) - FEATURE PRESENTATION: The Floor is Java – Log4Shell / Log4J
(10:26) - Lets Jump In
(11:31) - Oh No...
(12:28) - None of This is New
(15:36) - How Does This Work?
(19:48) - Mitigations
(21:48) - Find it on Hosts
(23:54) - Hal Translator
(25:25) - Find it on the Network
(26:53) - Miners Beacon
(28:24) - Great Write-Ups!
(31:47) - Conversation with Q & A

Talkin’ About Infosec News – 12/09/2021 Dec 09, 2021

Show notes

ORIGINALLY AIRED ON DECEMBER 6, 2021 Articles discussed in this episode: 00:18 – BHIS – Talkin’ Bout [infosec] News 2021-12-06 02:57 – Story # 1: Apple AirTag Car Thefts – https://www.macrumors.com/2021/12/03/airtag-linked-to-car-thefts/ 11:04 – Story # 2: Ubiquiti dev charged for extortion – https://www.bleepingcomputer.com/news/security/former-ubiquiti-dev-charged-for-trying-to-extort-his-employer/ 17:09 – Plug: Pay What You Can SOC Training – https://www.antisyphontraining.com/soc-core-skills-w-john-strand/ 18:24 – […]

The post Talkin’ About Infosec News – 12/09/2021 appeared first on Black Hills Information Security.

(00:00) - PreShow Banter™
(00:18) - BHIS - Talkin' Bout [infosec] News 2021-12-06
(02:57) - Story # 1: Apple AirTag Car Thefts - https://www.macrumors.com/2021/12/03/airtag-linked-to-car-thefts/
(11:04) - Story # 2: Ubiquiti dev charged for extortion - https://www.bleepingcomputer.com/news/security/former-ubiquiti-dev-charged-for-trying-to-extort-his-employer/
(17:09) - Plug: Pay What You Can SOC Training – https://www.antisyphontraining.com/soc-core-skills-w-john-strand/
(18:24) - Story # 3: U.S. State Department hacked with NSO spyware - https://www.reuters.com/technology/exclusive-us-state-department-phones-hacked-with-israeli-company-spyware-sources-2021-12-03/
(24:15) - Story # 4: The rise of dark web design - https://theconversation.com/the-rise-of-dark-web-design-how-sites-manipulate-you-into-clicking-168347
(33:46) - Story # 5: Researcher Found Way to Brute Force Verizon Customer PINs Online - https://www.vice.com/en/article/93bbpy/brute-force-verizon-pins-researcher-video
(39:43) - Story # 6: Russia and China attacking US satellites with lasers and jammers - https://www.independent.co.uk/space/russia-china-attack-us-satellites-lasers-b1967516.html?utm_source=reddit.com
(44:25) - Story # 7: Ransomware Takeaways: Q3 2021 - https://www.backblaze.com/blog/ransomware-takeaways-q3-2021/
(49:36) - Story # 8: Microsoft prompts try to stop people downloading Chrome - https://www.theverge.com/2021/12/2/22813733/microsoft-windows-edge-download-chrome-prompts
(50:36) - Story # 8b: Microsoft Edge will warn users about downloading Google Chrome - https://arstechnica.com/gadgets/2021/12/microsoft-edge-will-now-warn-users-about-the-dangers-of-downloading-google-chrome/

Fixing Content-Security-Policies with Cloudflare Workers Dec 03, 2021

Show notes

Kent Ickler // Background Over four years ago now, I wrote a blog post on fixing missing Content-Security-Policy by updating configuration on webservers: https://www.blackhillsinfosec.com/fix-missing-content-security-policy-website/. Content-Security-Policies instruct a user’s web browser how it should behave on certain security considerations. Oh, how times have changed. Here at Black Hills Information Security (BHIS), we’ve actually migrated webservers, hosting […]

The post Fixing Content-Security-Policies with Cloudflare Workers appeared first on Black Hills Information Security.

Talkin’ About Infosec News – 11/26/2021 Nov 26, 2021

Show notes

ORIGINALLY AIRED ON NOVEMBER 22, 2021 Articles discussed in this episode: Story # 1: Chinese Team Up With Russia To Launch US Cybersecurity Assault – https://hothardware.com/news/chinese-hackers-team-up-with-russian-ransomware-gang Story # 2: The FBI Got Hacked Over a Beef With a Guy Named Vinny? – https://www.thedailybeast.com/was-fbi-email-hack-just-an-elaborate-troll-of-a-guy-named-vinny-troia Story # 3: Insurers run from ransomware cover as losses mount – https://www.reuters.com/markets/europe/insurers-run-ransomware-cover-losses-mount-2021-11-19/ Story # […]

The post Talkin’ About Infosec News – 11/26/2021 appeared first on Black Hills Information Security.

(00:00) - PreShow Banter™ — Fixing Compressors
(02:13) - BHIS - Talkin' Bout [infosec] News 2021-11-22
(05:31) - Story # 1: Chinese Team Up With Russia To Launch US Cybersecurity Assault – https://hothardware.com/news/chinese-hackers-team-up-with-russian-ransomware-gang
(12:23) - Story # 2: The FBI Got Hacked Over a Beef With a Guy Named Vinny? – https://www.thedailybeast.com/was-fbi-email-hack-just-an-elaborate-troll-of-a-guy-named-vinny-troia
(18:32) - Story # 3: Insurers run from ransomware cover as losses mount – https://www.reuters.com/markets/europe/insurers-run-ransomware-cover-losses-mount-2021-11-19/
(23:27) - Story # 4: Ransomware gangs rich enough to buy zero-days – https://www.zdnet.com/article/ransomware-gangs-are-now-rich-enough-to-buy-zero-day-flaws-say-researchers/
(35:06) - Story # 5: FBI Alert on FatPipe VPN Zero-Day - https://thehackernews.com/2021/11/fbi-issues-flash-alert-on-actively.html
(45:31) - Story # 6: Debunking worthless “security” practices – https://arstechnica.com/information-technology/2021/11/securing-your-digital-life-part-4/

Talkin’ About Infosec News – 11/17/2021 Nov 17, 2021

Show notes

ORIGINALLY AIRED ON NOVEMBER 15, 2021 Articles discussed in this episode: 00:00 – BHIS – Talkin’ Bout [infosec] News 2021-11-15 02:22 – Story # 1: Robinhood data breach – https://www.bleepingcomputer.com/news/security/robinhood-discloses-data-breach-impacting-7-million-customers/ 07:27 – Story # 2: Trojanized IDA Pro – https://thehackernews.com/2021/11/north-korean-hackers-target.html 09:48 – Story # 3: stealing data today, quantum computers tomorrow – https://www.technologyreview.com/2021/11/03/1039171/hackers-quantum-computers-us-homeland-security-cryptography/ 18:42 – Story # 4: DDR4 […]

The post Talkin’ About Infosec News – 11/17/2021 appeared first on Black Hills Information Security.

(00:00) - BHIS - Talkin' Bout [infosec] News 2021-11-15
(02:22) - Story # 1: Robinhood data breach – https://www.bleepingcomputer.com/news/security/robinhood-discloses-data-breach-impacting-7-million-customers/
(07:27) - Story # 2: Trojanized IDA Pro – https://thehackernews.com/2021/11/north-korean-hackers-target.html
(09:48) - Story # 3: stealing data today, quantum computers tomorrow – https://www.technologyreview.com/2021/11/03/1039171/hackers-quantum-computers-us-homeland-security-cryptography/
(18:42) - Story # 4: DDR4 Rowhammer technique – https://arstechnica.com/gadgets/2021/11/ddr4-memory-is-even-more-susceptible-to-rowhammer-attacks-than-anyone-thought/
(26:58) - Story # 5: Secure software supply chain – https://sysdig.com/blog/software-supply-chain-security/
(33:26) - Story # 6: New Android Spyware – https://threatpost.com/new-android-spyware-poses-pegasus-like-threat/176155/
(43:46) - Story # 7: Hoax Email Abused Coding in FBI Website – https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/
(55:23) - Story # 8: DomainTools Acquires Farsight Security – https://www.infosecurity-magazine.com/news/domaintools-acquires-farsight/

Talkin’ About Infosec News – 11/12/2021 Nov 12, 2021

Show notes

ORIGINALLY AIRED ON November 08, 2021 Articles discussed in this episode: 00:00 – PreShow Banter™ — God’s Waiting Room 03:08 – BHIS – Talkin’ Bout [infosec] News 2021-11-08 04:50 – Story # 1: JavaScript in Excel – https://techcrunch.com/2021/11/02/microsoft-brings-javascript-to-excel/ 09:12 – Story # 2: Bots That Steal 2FA Codes – https://www.vice.com/en/article/y3vz5k/booming-underground-market-bots-2fa-otp-paypal-amazon-bank-apple-venmo 13:00 – Story # 3: US bans trade with NSO Group – https://www.engadget.com/us-trade-ban-nso-group-145347522.html 22:34 – Story # 4: US House Passes Acts to Help SMBs with Cybersecurity – https://www.infosecurity-magazine.com/news/house-helps-smbs-cybersecurity/ 33:34 – Story # 5: Hackers Apologize to Arab Royal Families – https://www.vice.com/en/article/n7nw8m/conti-ransomware-hackers-apologize-to-arab-royal-families-for-leaking-their-data We are self-publishing free Infosec Zines called PROMPT#. PROMPT# will contain: Infosec articles Challenging puzzles Comic book based on real-life hacking adventures Coloring contests Bonus Backdoors & Breaches Consultant Cards (print version only) Other stuffs You can check out current and upcoming issues here: https://www.blackhillsinfosec.com/prompt-zine/

(00:00) - PreShow Banter™ — Gods Waiting Room
(03:08) - BHIS - Talkin' Bout [infosec] News 2021-11-08
(04:50) - Story # 1: JavaScript in Excel - https://techcrunch.com/2021/11/02/microsoft-brings-javascript-to-excel/
(09:12) - Story # 2: Bots That Steal 2FA Codes - https://www.vice.com/en/article/y3vz5k/booming-underground-market-bots-2fa-otp-paypal-amazon-bank-apple-venmo
(13:00) - Story # 3: US bans trade with NSO Group - https://www.engadget.com/us-trade-ban-nso-group-145347522.html
(22:34) - Story # 4: US House Passes Acts to Help SMBs with Cybersecurity - https://www.infosecurity-magazine.com/news/house-helps-smbs-cybersecurity/
(33:34) - Story # 5: Hackers Apologize to Arab Royal Families - https://www.vice.com/en/article/n7nw8m/conti-ransomware-hackers-apologize-to-arab-royal-families-for-leaking-their-data

Webcast: How to Share Your Knowledge with Others Nov 02, 2021

Show notes

Have you ever seen a call for papers for a conference and thought to yourself that you’d like to submit a talk and then immediately thought, oh never mind? Have you ever been asked to present internally at your organization and immediately recommended someone else to do it? Was it because you didn’t know how to give a presentation, or because you were afraid of speaking in front of an audience, or because you didn’t know where to start? This Black Hills Information Security (BHIS) presentation on giving presentations the way people like to hear presentations is based on Jason’s background as a video editor, storyteller, comedian, and content creator. We dive into structure, delivery, and how your audience perceives every single word and image you share. By the end of this most meta-presentation on presentations using science and stuff, you’ll be equipped with getting started sharing your knowledge with others in a way they will want to hear it. Recorded•2021-08-26 Join the BHIS Community Discord: https://discord.gg/bhis 00:00 – FEATURE PRESENTATION: How to Share Your Knowledge With Others 55:28 – Q & A We are self-publishing free Infosec Zines called PROMPT#. PROMPT# will contain: Infosec articles Challenging puzzles Comic book based on real-life hacking adventures Coloring contests Bonus Backdoors & Breaches Consultant Cards (print version only) Other stuffs You can check out current and upcoming issues here: https://www.blackhillsinfosec.com/prompt-zine/

(00:00) - FEATURE PRESENTATION: How to Share Your Knowledge With Others
(55:28) - Q & A

Talkin’ About Infosec News – 10/28/2021 Oct 28, 2021

Show notes

ORIGINALLY AIRED ON OCTOBER 25, 2021 Articles discussed in this episode: 01:42 – Story # 1: https://www.bleepingcomputer.com/news/security/fired-it-admin-revenge-hacks-school-by-wiping-data-changing-passwords/ 06:34 – Story # 2: https://krebsonsecurity.com/2021/10/missouri-governor-vows-to-prosecute-st-louis-post-dispatch-for-reporting-security-vulnerability/ 11:50 – Story # 3: https://www.pcgamer.com/hackers-drain-cryptocurrency-accounts-of-thousands-of-coinbase-users/ 23:47 – Story # 4: https://threatpost.com/vmware-esxi-encrypted-python-script-ransomware/175374/ 35:30 – Story # 5: https://thehackernews.com/2021/10/chinese-hackers-used-new-rootkit-to-spy.html 45:56 – Story # 6: https://cyberworkx.in/2021/10/08/a-new-uefi-bootkit-that-targets-windows-computers/ 51:45 – Story # 7: https://www.washingtonpost.com/national-security/rail-cybersecurity-dhs-regulations/2021/10/06/b3db07da-2620-11ec-8831-a31e7b3de188_story.html 54:14 – Story # 8: https://www.nbcnews.com/tech/security/ransomware-hits-us-candymaker-ahead-halloween-rcna3391 We are self-publishing free Infosec Zines called PROMPT#. PROMPT# will contain: Infosec articles Challenging puzzles Comic book based on real-life hacking adventures Coloring contests Bonus Backdoors & Breaches Consultant Cards (print version only) Other stuffs You can check out current and upcoming issues here: https://www.blackhillsinfosec.com/prompt-zine/

(00:00) - BHIS - Talkin' Bout [infosec] News 2021-10-25
(01:42) - Story # 1: https://www.bleepingcomputer.com/news/security/fired-it-admin-revenge-hacks-school-by-wiping-data-changing-passwords/
(06:34) - Story # 2: https://krebsonsecurity.com/2021/10/missouri-governor-vows-to-prosecute-st-louis-post-dispatch-for-reporting-security-vulnerability/
(11:50) - Story # 3: https://www.pcgamer.com/hackers-drain-cryptocurrency-accounts-of-thousands-of-coinbase-users/
(23:47) - Story # 4: https://threatpost.com/vmware-esxi-encrypted-python-script-ransomware/175374/
(35:30) - Story # 5: https://thehackernews.com/2021/10/chinese-hackers-used-new-rootkit-to-spy.html
(45:56) - Story # 6: https://cyberworkx.in/2021/10/08/a-new-uefi-bootkit-that-targets-windows-computers/
(51:45) - Story # 7: https://www.washingtonpost.com/national-security/rail-cybersecurity-dhs-regulations/2021/10/06/b3db07da-2620-11ec-8831-a31e7b3de188_story.html
(54:14) - Story # 8: https://www.nbcnews.com/tech/security/ransomware-hits-us-candymaker-ahead-halloween-rcna3391

Talkin’ About Infosec News – 10/19/2021 Oct 19, 2021

Show notes

ORIGINALLY AIRED ON OCTOBER 11, 2021 Articles discussed in this episode: 00:21 – Story # 1: Facebook Aftermath | https://engineering.fb.com/2021/10/05/networking-traffic/outage-details/ 09:17 – Story # 2: Twitch Source Code | https://www.theregister.com/2021/10/06/twitch_data_leak/ 25:31 – Story # 3: SMS Hacked; 5 Years | https://arstechnica.com/information-technology/2021/10/company-that-routes-sms-for-all-major-us-carriers-was-hacked-for-five-years/ 31:40 – Story # 4: K-12 Cybersecurity Bill | https://thehill.com/policy/cybersecurity/575957-biden-signs-bill-into-law-to-strengthen-k-12-school-cybersecurity?rl=1 36:39 – Story # 5: Forced Disclosure? | https://www.newsweek.com/businesses-could-soon-have-disclose-ransomware-payouts-1635838 Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/

(00:00) - BHIS - Talkin' Bout [infosec] News 2021-10-11
(00:21) - Story # 1: Facebook Aftermath | https://engineering.fb.com/2021/10/05/networking-traffic/outage-details/
(09:17) - Story # 2: Twitch Source Code | https://www.theregister.com/2021/10/06/twitch_data_leak/
(25:31) - Story # 3: SMS Hacked; 5 Years | https://arstechnica.com/information-technology/2021/10/company-that-routes-sms-for-all-major-us-carriers-was-hacked-for-five-years/
(31:40) - Story # 4: K-12 Cybersecurity Bill | https://thehill.com/policy/cybersecurity/575957-biden-signs-bill-into-law-to-strengthen-k-12-school-cybersecurity?rl=1
(36:39) - Story # 5: Forced Disclosure? | https://www.newsweek.com/businesses-could-soon-have-disclose-ransomware-payouts-1635838

Our TOPPODCAST Picks

Follow Us

Stay Connected

Talkin’ Bout [Infosec] News

Related Podcasts

Links

Stay Connected