TechSNAP

Latest Episodes:

Episode 370: Hidden in Plain Sight Jun 01, 2018

Show notes

We explain how the much hyped VPNFilter malware actually works, and its rather surprising sophistication.

Plus a clear break down of the recent Kubernetes news, how a 40 year old tel-co protocol is being abused today, and a Git vulnerability you should know about.

Sponsored By:

Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean
iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!
Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com

Links:

Episode 369: Another Pass at Bypass May 23, 2018

Show notes

We’ll explain how Speculative Store Bypass works, and the new mitigation techniques that are inbound.

Plus this week’s security news has a bit of a theme, and we share some great war stories sent into the show.

Sponsored By:

Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean
iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!
Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com

Links:

Episode 368: EFail Explained May 15, 2018

Show notes

The EFail hype-train has hit hypersonic speed, we’ll tap the breaks and explain who disclosed it, what it is, what it’s not, our recommendations, and early reactions.

Plus things to consider when deciding on-premises vs a cloud deployment, and the all business gadget from 1971 that kicked off the consumer electronics revolution.

Links:

The HP-35 — Consumer Electronics, an Origin Story
The people cost of building out a Kubernetes cluster on-prem | Operos
EFAIL — EFAIL describes vulnerabilities in the end-to-end encryption technologies OpenPGP and S/MIME that leak the plaintext of encrypted emails.
efail-attack-paper.pdf
GnuPG Efail press release Response
No, PGP is not broken, not even with the Efail vulnerabilities - ProtonMail Blog — Recently, news broke about potential vulnerabilities in PGP, dubbed Efail. However, despite reports to the contrary, PGP is not actually broken, as we will explain in this post.
Eric's War Story is VERY Familiar
When it rains it pours for Steve
Critical Cisco WebEx Bug Allows Remote Code Execution
Cisco WebEx and 3rd Party Support Utilities

Episode 367: FreeNAS Uber Build May 08, 2018

Show notes

Our FreeNAS build is complete and Allan’s back to cover the final details. Plus the new GPU attack against Android phones, and a perfect example of poor IoT security.

Sponsored By:

Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean
iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!
Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com

Links:

Drive-by Rowhammer attack uses GPU to compromise an Android phone | Ars Technica — JavaScript based GLitch pwns browsers by flipping bits inside memory chips.
Rooting a Logitech Harmony Hub — Exploitation of these vulnerabilities from the local network could allow an attacker to control the devices linked to the Hub as well as use the Hub as an execution space to attack other devices on the local network
A Complete Guide to FreeNAS Hardware Design, Part I: Purpose and Best Practices — If it’s imperative that your ZFS based system must always be available, ECC RAM is a requirement. If it’s only some level of annoying (slightly, moderately…) that you need to restore your ZFS system from backups, non-ECC RAM will fit the bill.
FreeNAS: A Worst Practices Guide
Jason likes Hubble
Bryan Nuked an email server once...
Humble Book Bundle: DevOps by Packt (pay what you want and help charity) — This software engineering bundle is Packt with information! Streamline your processes with ebooks like Automate it!, DevOps for Networking, Mastering Ansible, and Continuous Delivery with Docker and Jenkins. You'll also get helpful videos including Mastering DevOps, Mastering Windows PowerShell 5 Administration, Learning Kubernetes, and more.

Episode 366: Catching up with Allan May 02, 2018

Show notes

We catch up with Allan Jude and he shares stories of hunting network bottlenecks, memories of old firewalls, and some classic ZFS updates.

Plus the vulnerabilities found in Volkswagen cars, and the lengths a security research went to create the ultimate honeypot laptop.

Special Guest: Allan Jude.

Sponsored By:

Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean
Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com
iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!

Links:

Volkswagen and Audi Cars Vulnerable to Remote Hacking — esearchers also gained access to the IVI system's root account, which they say allowed them access to other car data.
It’s Impossible to Prove Your Laptop Hasn’t Been Hacked. I Spent Two Years Finding Out. — For the last two years, I have carried a “honeypot” laptop with me every time I’ve traveled; this computer was intended to attract (and then detect) tampering.
chipsec — Platform Security Assessment Framework
UEFITool — UEFI firmware image viewer and editor
Haven Project — Haven is for people who need a way to protect their personal spaces and possessions without compromising their own privacy, through an Android app and on-device sensors
Mr S. Delivers on his DO FreeNAS Guide
OZ Shares a War Story
Dave's REALLY Close Call...
Karl Gives us the CTO View on new Hires
Our Approach to Employee Security Training | PagerDuty — These are both training courses that we developed in-house and delivered ourselves.

Episode 365: The Unfixable Exploit Apr 24, 2018

Show notes

Hardware flaws that can’t be solved, human errors at the physical layer, and spoofing cellular networks with a $5 dongle.

Sponsored By:

iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!
Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean
Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com

Links:

Sysadmin unplugged wrong server, ran away, hoped nobody noticed • The Register — ‘I was a snot-nosed kid fresh out of college and thought I knew everything!’
Spoofing Cell Networks with a USB to VGA Adapter | Hackaday — Available through the usual overseas suppliers for as little has $5 USD, these devices can be used unmodified to transmit low-power FM, DAB, DVB-T, GSM, UMTS and GPS signals.
ShofEL2, a Tegra X1 and Nintendo Switch exploit — The Tegra X1 (also known as Tegra210) SoC inside the Nintendo Switch contains an exploitable bug that allow taking control over early execution, bypassing all signature checks.
Atlanta spends more than $2 million to recover from ransomware attack — . It appears that firms Secureworks and Ernst & Young were paid $650,000 and $600,000, respectively, for emergency services while Edelman was paid $50,000 for crisis communication services. Overall, the funds seemingly applied to the ransomware attack response add up to approximately $2.7 million.
Google Chrome 66 Released Today Focuses on Security — The biggest change is that Google Chrome will start showing SSL certificate errors for all Symantec certs issued before June 1, 2016. This is "stage two" of Google's long-term plan on distrusting Symantec certificates altogether.
Where to get started with monitoring?
defunkt uses a fool tools for his network
Brian shares some love for Zabbix
VMware Patches Pwn2Own VM Escape Vulnerabilities — VMware on Tuesday patched a series of vulnerabilities uncovered earlier this month at Pwn2Own. The flaws enabled an attacker to execute code on a workstation and carry out a virtual machine escape to attack a host server.
balena - A Moby-based container engine for IoT — A Moby-based container engine for IoT

Episode 364: The Case for Monitoring Apr 18, 2018

Show notes

We cover all the bases this week in our TechSNAP introduction to server monitoring.

Why you should monitor, what you should monitor, the basics of Nagios, the biggest drawbacks of Nagios, its alternatives, and our lessons learned from the trenches.

Sponsored By:

Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean
Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com
iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!

Links:

Why Bother with Server Monitoring? — Once a network or server has been installed, how do you know it is working as it should? Just like a car or any appliance, it may need maintenance or parts replaced to keep it in top working order. Network and server monitoring allows the Network Administrator to see how hardware and software are performing. We can look for certain signs or warnings that the system is not working efficiently and take action to fix things to prevent system degradation or failure.
What is Nagios? — Monitoring of network services such as SMTP, POP2, HTTP, NNTP, ICMP, SNMP, FTP, SSH.
A Real Example Of Nagios Monitoring — There are two major problems the monitoring solves: alerting and trending. Alerting is to notify the person in charge about a major event like service failing to work. Trending is to track the change of something over time – disk or memory usage, replication lag etc.
graphios — A program to send nagios perf data to graphite (carbon) / statsd / librato / influxdb
Sensu — Sensu’s platform is the solution to the monitoring problems you’re facing today, and the right foundation for your organization tomorrow. From bare metal to Kubernetes—get complete visibility across every system, every protocol, every time.
Sensu: Finally the Nagios Replacement I Have Been Looking For! – Chariot Solutions
Icinga 2 — With the RESTful API of Icinga 2 you can update your configurations on the fly or show live information about current problems on your custom dashboards. You can process check results from third party tools or tell the Core to run actions interactively. The interface is secured with SSL. Access control can be configured fine grained and per user.
Nagios Vs. Icinga: the real story of one of the most heated forks in free software
Phill Barber's Blog: Nagios vs Sensu vs Icinga2
Prometheus — Power your metrics and alerting with a leading open-source monitoring solution.
nagios - Docker Hub — Nagios Core with Nagiosgraph, check_nrpe, custom checks & XMPP Notifications
Previous TechSNAP Coverage: Keeping it Up | TechSNAP 20
Dax was inspired by last weeks episode

Episode 363: Tips from the Top Apr 12, 2018

Show notes

Getting started or getting ahead in IT is a moving target, so we’ve crowd sourced some of the best tips and advice to help.

Plus a tricky use of zero-width characters to catch a leaker, a breakdown of the new BranchScope attack, and a full post-mortem of the recent Travis CI outage.

Sponsored By:

Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean
Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com
iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!

Links:

Invisibly inserting usernames into text with Zero-Width Characters — Zero-width characters are invisible, ‘non-printing’ characters that are not displayed by the majority of applications.
Incident Post-Mortem and Security Advisory — On Tuesday, 13 March 2018 at 12:04 UTC a database query was accidentally run against our production database which truncated all tables.
As predicted, more branch prediction processor attacks are discovered — New attack focuses on a different part of the branch prediction system.
BranchScope: A New Side-Channel Attack on Directional Branch Predictor - asplos18.pdf
Mathew has a neat use for Terraform
Del says Learn just one thing...
Mat Man has some great tips
Ben says you might already be doing it
Mr S with a advice from recruiting stand point.

Episode 362: Rebuilding it Better Apr 05, 2018

Show notes

It’s a TechSNAP introduction to Terraform, a tool for building, changing, and versioning infrastructure safely and efficiently.

Plus a recent spat of data leaks suggest a common theme, Microsoft’s self inflicted Total Meltdown flaw, and playing around with DNS Rebinding attacks for fun.

Sponsored By:

Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean
Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com
iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!

Links:

The Under Armour Hack Was Even Worse Than It Had To Be — When Under Armour announced that its nutrition app MyFitnessPal had suffered a data breach impacting the information of roughly 150 million users, things actually didn't seem so bad.
Panerabread.com Leaks Millions of Customer Records — Panerabread.com, the Web site for the American chain of bakery-cafe fast casual restaurants by the same name, leaked millions of customer records — including names, email and physical addresses, birthdays and the last four digits of the customer’s credit card number — for at least eight months before it was yanked offline earlier today, KrebsOnSecurity has learned.
No, Panera Bread Doesn’t Take Security Seriously – PB — This post establishes a canonical timeline so subsequent reporting doesn’t get confused.
Total Meltdown — In short - the User/Supervisor permission bit was set to User in the PML4 self-referencing entry. This made the page tables available to user mode code in every process. The page tables should normally only be accessible by the kernel itself.
Terraform by HashiCorp — HashiCorp Terraform enables you to safely and predictably create, change, and improve infrastructure. It is an open source tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.
Terraforming 1Password - AgileBits Blog — Most of the 2 hours and 39 minutes of downtime were related to data migration. The 1Password.com database is just under 1TB in size (not including documents and attachments), and it took almost two hours to complete the snapshot and restore operations.
Whonow — A malicious DNS server for executing DNS Rebinding attacks on the fly

Episode 361: It's All in the Log Mar 29, 2018

Show notes

Embarrassing flaws get exposed when the logs get reviewed, Atlanta city government gets shut down by Ransomware, and the cleverest little Android malware you’ll ever meet.

Plus we go from a hacked client to a Zero-day discovery, answer some questions, ask a few, and more!

Sponsored By:

Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit. Promo Code: snapocean
Ting: Save $25 off a device, or get $25 in service credits! Promo Code: Visit techsnap.ting.com
iXSystems: Get a system purpose built for you. Promo Code: Tell them we sent you!

Links:

Unified Logs in High Sierra (10.13) Show Plaintext Password for APFS Encrypted External Volumes — My verification test is below. Note that it gets stored in on-disk, collected logs (non-volatile logs).
Thousands of servers found leaking 750MB worth of passwords and keys — Leaky etcd servers could be a boon to data thieves and ransomware scammers.
Atlanta city government systems down due to ransomware attack — FBI called in as some city services are interrupted, employees told to turn off PCs.
Android malware found inside apps downloaded 500,000 times | ZDNet — Cybercriminals have distributed malware to hundreds of thousands of Android users by hiding it inside a series of apparently harmless apps.
From hacked client to 0day discovery — The client’s account had been blocked because it was spotted sending spam. Once connected to the service, it was clear that the monthly quota of the account was almost reached and that the latest emails sent shown on the dashboard had content that were clearly spam.
Listener Feedback from Jeff S
Listener Feedback from Tyler

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected