The Cybersecurity Defenders Podcast

Latest Episodes:

#148 - Intel Chat: Hacker Summer Camp, N. Korea, Dispossessor, Proofpoint & Sinkclose Aug 14, 2024

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

A heated dispute at DEF CON over the custom electronic badges this year turned physical, leading to an altercation between two attendees.
The U.S. Department of Justice has charged Matthew Isaac Knoot, a 38-year-old Nashville resident, with multiple crimes for aiding North Korean IT workers in securing jobs with U.S. and U.K. companies.
The FBI has dismantled the infrastructure of the Dispossessor ransomware group, also known as Radar, which had rapidly gained prominence since its inception in August 2023.
A critical flaw in Proofpoint’s email filtering service was recently discovered, allowing cybercriminals to impersonate major brands and send phishing emails that bypassed Proofpoint’s security.
A newly discovered security flaw affects AMD processors dating back to 2006. The vulnerability, which impacts CPUs from the Athlon 64 to the Ryzen 7000 series, allows attackers to exploit speculative execution to access sensitive data.

#147 - Cybersecurity product development with Vijay Pitchuman, Director of Product for Identity Management at Okta Aug 07, 2024

Show notes

On this episode of The Cybersecurity Defenders Podcast we talk about cybersecurity product development with Vijay Pitchuman, Director of Product for Identity Management at Okta.

#146 - Intel Chat: GhostEmperor, .top, PlugX & Microsoft Jul 31, 2024

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

The Chinese hacker group GhostEmperor has re-emerged after a two-year hiatus, displaying new advanced capabilities and sophisticated evasion techniques.
The Chinese company, Jiangsu Bangning Science & Technology Co., in charge of handing out domain names ending in “.top” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains.
Following a report by the cybersecurity firm Sekoia.io, the Paris Public Prosecutor’s Office launched a preliminary investigation into a botnet involving millions of global victims, including thousands of machines in France.
Microsoft has initiated significant changes to its Windows operating system following a critical incident involving CrowdStrike's kernel driver.

#145 - Exploring threat intelligence with Jamie Williams, Threat Intelligence Researcher at Unit 42 Jul 30, 2024

Show notes

On this episode of the Cybersecurity Defenders podcast, we explore threat intelligence with Jamie Williams, Threat Intelligence Researcher at Palo Alto Networks' Unit 42.

Jamie is a seasoned professional in the field of cybersecurity. Before joining Unit 42, he made significant contributions at the MITRE Corporation as a Senior Principal Cyber Operations Engineer. During his tenure at MITRE, Jamie led the development of MITRE ATT&CK® for Enterprise, focusing on adversary emulation and behavior-based detections.

In addition to his full-time role, Jamie is also a member of the IANS Faculty, where he shares his extensive knowledge and experience with the cybersecurity community. With a rich background that includes time at the National Security Agency, Jamie brings a wealth of expertise to the podcast.

Katie Nickels blog can be found here.

Google Mandiant's article on requirement-driven intelligence can be found here.

#144 - How to think about IR with Lee Sult, Chief Investigator at Binalyze Jul 26, 2024

Show notes

On this episode of The Cybersecurity Defenders Podcast we sit down with Lee Sult, Chief Investigator at Binalyze, and talk about incident response (IR).

Lee is a seasoned cybersecurity expert and investigator with extensive experience in digital forensics and incident response. He is the Chief Investigator at Binalyze and has a strong track record at prestigious organizations like Trustwave-SpiderLabs and Palantir. Lee has supported the US Secret Service and managed complex cybersecurity incidents for Fortune 50 companies.

As the co-founder and former CTO of Horangi Cyber Security, Singapore's first cybersecurity startup, Lee's leadership and collaboration skills have significantly impacted the region's cybersecurity landscape. Passionate about mentoring, Lee actively contributes to cybersecurity communities and supports up-and-coming entrepreneurs.

#143 - Intel Chat: Blast-RADIUS, Chrome, AT&T, Kaspersky & Crowdstrike Jul 24, 2024

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Blast-RADIUS is a vulnerability in the RADIUS protocol that allows a man-in-the-middle attacker to forge valid protocol accept messages in response to failed authentication requests.
The blog post on Syntax-Err0r details a technique for silently installing a Chrome extension to maintain persistence, bypassing typical detection methods.
American telecom service provider AT&T has confirmed that threat actors managed to access data belonging to "nearly all" of its wireless customers as well as customers of mobile virtual network operators using AT&T's wireless network.
The U.S. Department of Commerce added Kaspersky to its Entity List, barring U.S. businesses from engaging with the company due to national security concerns related to the Russian government's influence over Kaspersky's operations.
On July 19th Crowdstrike distributed a faulty update to its Falcon sensors that caused widespread problems with computers running Microsoft Windows. As a result, roughly 8.5 million systems crashed, bringing up the feared blue screen of death, in what is being called the largest IT outage in history (+outage 1-month ago, +outage 3-months ago).

#142 - Threat detection & research with Zack Allen, Security Detection & Research Leader at Datadog Jul 19, 2024

Show notes

On this episode of The Cybersecurity Defenders Podcast we talk threat detection & research with Zack Allen, Security Detection & Research Leader at Datadog.

Zack is a seasoned security research, engineering, and product leader with over a decade of experience in building organizations that create impactful security for customers. Zack specializes in threat research and intelligence, cloud security, software engineering, and DevOps. His expertise has significantly contributed to advancing the field of cybersecurity. He is also the visionary behind Detection Engineering Weekly, a platform that provides insights and updates on the latest in detection engineering.

You can subscribe to Zack's newsletter here.

#141 - The Rescue of Evelyn Chang by Gene Yu, Founder & CEO of Blackpanda Jul 11, 2024

Show notes

On this episode of The Cybersecurity Defenders Podcast we speak with Gene Yu, Founder & CEO of Blackpanda.

Gene has a diverse background, with early roles at Palantir's Asia office and Credit Suisse on Wall Street. He also served as a team leader in the US Army Special Forces, completing four combat tours in Iraq and the Southern Philippines. Gene is an active angel investor, renowned for leading the successful rescue of Evelyn Chang from Abu Sayyaf terrorists in 2013. He graduated with top honors in computer science from West Point and has attended Johns Hopkins University and Stanford's Executive Program.

Gene’s book, about the incredible rescue of Evelyn Chang, can be purchased here.

#140 - Intel Chat: 10bn Pwds, Eldorado RaaS, 840Mpps DDoS, regreSSHion & $1.4bn in stolen crypto Jul 10, 2024

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

Likely the biggest password leak ever: nearly 10 billion credentials exposed.
Eldorado is a newly discovered ransomware-as-a-service operation targeting both Windows and Linux systems.
OVHcloud has reported mitigating a record-breaking distributed denial-of-service attack that peaked at 840 million packets per second.
Cisco has issued a warning about a critical remote code execution vulnerability named "regreSSHion," tracked as CVE-2024-6387, affecting OpenSSH on glibc-based Linux systems.
In the first half of 2024, cryptocurrency thefts amounted to $1.4 billion, significantly driven by rising crypto prices and a few large-scale attacks.

#139 - Intel Chat: MOVEit, P2PInfect, polyfill.io & TeamViewer Jul 04, 2024

Show notes

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.

A high-severity security vulnerability in Progress Software's MOVEit Transfer software could allow cyberattackers to get around the platform's authentication mechanisms — and it's been spotted being actively exploited in the wild just hours after it was made public.
A new version of the P2P worm, P2PInfect, that targets Redis servers running on both Linux and Windows systems, which is aimed at deploying both ransomware and cryptocurrency mining payloads, is out in the wild.
The polyfill.io domain, used for providing backward compatibility for older browsers, has been shut down amid accusations of malicious activity after recently being acquired by Chinese firm Funnull, and was allegedly redirecting users to malicious sites and employing evasion techniques.
The Germany-based company behind the world-famous remote desktop software TeamViewer has confirmed that in 2016 TeamViewer software was compromised.

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Cybersecurity Defenders Podcast

Related Podcasts

Links

Stay Connected