The Threatpost Podcast

Latest Episodes:

RSA Conference 2020 Preview Feb 21, 2020

Show notes

The RSA 2020 conference kicks off next week in San Francisco, this year with a theme looking at the "human element" of cybersecurity. As they prepare to cover the show, Threatpost editors Lindsey O'Donnell-Welch, Tom Spring and Tara Seals break down the biggest news, stories and trends that they expect to hear about at RSA 2020 this year - from trends in the industrial cybersecurity landscape, to connected medical device security issues that will be flagged.

News Wrap: Valentine's Day Scams and Emotet's Wi-Fi Hack Feb 14, 2020

Show notes

Threatpost editors Tara Seals and Lindsey O'Donnell-Welch break down the top stories for this week, ended Feb. 14, including:

Recent phishing scams - including ones with a romance hook - continue to trick victims, showing that phishing tactics still work in stealing millions from individuals, corporations, and even government agencies.
Emotet has a newly discovered feature that hacks nearby Wi-Fi networks, allowing the prolific malware to spread rapidly, like a worm.
The operators behind the Robbinhood ransomware are using a new tactic called "bring your own bug," which researchers think will continue in future campaigns.
Patch Tuesday craziness this week included 99 patches from Microsoft, as well as vulnerability fixes from Adobe, Intel and Mozilla Firefox.

Katie Moussouris: The Bug Bounty Conflict of Interest Feb 12, 2020

Show notes

Bug bounty programs continue to increase in popularity – but that popularity has its downsides. Since the launch of the Hack the Pentagon program in 2016, bug bounty programs have quickly grown in popularity.

However, as more programs are created, some companies are forgetting the real reason behind bug bounties. That is, instead of making their systems more secure, companies want to merely hunt bugs. Threatpost talked to Katie Moussouris, founder and CEO of Luta Security, to hear more about her thoughts about the challenges in developing – and launching – bug bounty programs.

Critical Cisco 'CDPwn' Flaws Break Network Segmentation Feb 05, 2020

Show notes

Researchers on Wednesday disclosed five critical vulnerabilities in Cisco Discovery Protocol (CDP), the Cisco Proprietary Layer 2 network protocol that is used to discover information about locally attached Cisco equipment. Threatpost talked to Ben Seri, VP of Research at Armis, who discovered the flaws, about the CDPwn flaws, their impact, and why Layer 2 protocols are an under-researched area.

Researchers say that the vulnerabilities, which they collectively dub CDPwn, can allow attackers to remotely take over millions of devices. The flaws specifically exist in the parsing of CDP packets, in the protocol implementation for various Cisco products, from its software to IP cameras. Cisco issued patches on Wednesday addressing the five flaws, and is urging users to update as soon as possible.

WhatsApp Hacks Point to Sophisticated Mobile Cyberattacks Jan 30, 2020

Show notes

Oded Vanunu, head of products vulnerability research at Check Point research, has seen his share of WhatsApp vulnerabilities – the researcher at Black Hat 2019 demoed several flaws in the messaging platform could be used to manipulate chats, for instance.

However, Vanunu told Threatpost at CPX 360, Check Point's annual security conference that takes place this week, WhatsApp is a prime example of how mobile devices are increasingly becoming targeted by nation state actors, in stark contrast to previous, less serious threats mobile devices have faced like adware.

Vivin Nets Thousands of Dollars Using Cryptomining Malware Jan 22, 2020

Show notes

Threatpost talks to Nick Biasini, a threat researcher at Cisco Talos, about a recently-uncovered threat actor, dubbed Vivin, has made thousands of U.S. dollars through a large-scale cryptomining campaign.

News Wrap: PoC Exploit Controversy, Cable Haunt & Joker Malware Jan 17, 2020

Show notes

This week's news wrap podcast breaks down the biggest Threatpost security stories of the week, including:

Various proof-of-concept exploits being released for serious vulnerabilities this week - including for the recently-patched crypto-spoofing vulnerability found by the National Security Agency and reported to Microsoft.
Multiple cable modems used by ISPs to provide broadband into homes have a critical vulnerability in their underlying reference architecture, dubbed "Cable Haunt," that would allow an attacker full remote control of the device.
Google's continual battle against attackers who are infiltrating Google Play with Android apps (more than 17,000 apps to date) distributing the Joker malware.
Google setting an aggressive two-year deadline for dropping support for third-party tracking cookies in its Chrome web browser.

NSA Detects Major Microsoft Windows Flaw: What It Means Jan 15, 2020

Show notes

A major Microsoft crypto-spoofing bug impacting Windows 10 made waves this Patch Tuesday, particularly as the flaw was found and reported by the U.S. National Security Agency (NSA).

Microsoft's January Patch Tuesday security bulletin disclosed the "important"-severity vulnerability, which could allow an attacker to spoof a code-signing certificate, vital to validating executable programs in Windows, and make it appear as if an application was from a trusted source.

Threatpost talked to Pratik Savla, senior security engineer at Venafi, about the vulnerability, whether the hype around the flaw was warranted, and what the disclosure means for the NSA.

CCPA's Biggest Challenge: Where's The Data? Jan 09, 2020

Show notes

The California Consumer Privacy Act is being touted as one of the strongest privacy regulations in the U.S. enacted so far. However, though the CCPA was adopted on January 1, 2020, the act still has several loose ends and privacy loopholes that need to be fleshed out.

At a high level ,the CCPA mandates strict requirements for companies to notify users about how their user data will be used and monetized along with giving them straightforward tools for opting out. However, one of the bigger challenges with the CCPA is the question of tracking the location of that user data, Terry Ray, SVP and fellow with Imperva, tells Threatpost.

The Roadblocks and Opportunities For Women in Cybersecurity Dec 27, 2019

Show notes

In 2019, diversity in the cybersecurity was thrust to the forefront with recognition from both vendors and experts. The tech industry is facing challenges around diversity in general, but women are particularly underrepresented. And with an estimated 3.5 million jobs are expected to remain unfilledby 2021, infosec is certainly a lucrative space for women.

Threatpost sat down with Jessica LaBouve, a pen tester with A-LIGN, to discuss the personal challenges she's faced in the cybersecurity industry and the opportunities in the space that she sees for improvement.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected