Unsupervised Learning

By Daniel Miessler

Listen to a podcast, please open Podcast Republic app. Available on Google Play Store.


Category: Tech News

Open in Apple Podcasts


Open RSS feed


Open Website


Rate for this podcast

Subscribers: 214
Reviews: 0

Description

Thinking about the intersection of security, technology, and society—and what might be coming next. A curated 15-30 minute summary of the week's most important stories and ideas every Monday, and periodic essays and guest appearances that explore a single topic.


Episode Date
News & Analysis | No. 263
870
Congressional System Integrity, FBI Egregor, Parler Dox, Clearview Spike, JetBrains Speculation, Chinese Finacial APTs, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 14, 2021
News & Analysis | No. 259
1647
Recon/Attack Surface Management Analysis, The Pentester's BluePrint, Amazon's 10,000 Small Bets, Sunburst APT29 Hack, Data Dump on the CCP, Ransomware Makes Half of All Major Incidents, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 14, 2021
News & Analysis | No. 257
738
Amazon Curate (I Wish), Tesla Hack, IoT Security Bill, Iran Assassination, Robot Dogs, Drupal, TikTok Cartels, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 14, 2021
News & Analysis | No. 255
1301
Tim Berners-Lee's Solid Idea, Police Looking Through Ring Cameras, Feinstein's Chinese Spy, Trump Banned 31 Chinese Companies, Microsoft on MFA, US Trolling Russian APT, Zoom Thanksgiving, Facbook Copying Snap, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 14, 2021
News & Analysis: No. 253
1273
US Election Security, How to Write Well, The Future of Sensors and Algorithms, I Like Pre-recorded Conference Talks, Substack is Great For Newsletters BUT, Zoom End-to-End Encryption, Chinese Espionage Database, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 03, 2020
News & Analysis | No. 251
1449
The Content Value Hierarchy, Chinese Suicide Drones, 900,000 Unemployment Claims, Law Enforcement Suspending Leave, Tricking Teslas, Sweden Increasing Military Spending, Atlanta Drone Arrest, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, the Weekly Aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 19, 2020
Operation Fortify: A US Ransomware Plan
546
A simple yet comprehensive plan for how the United States could address its devastating ransomware problem. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 15, 2020
The Relationship Between Hardship, Struggle, and Meaning
833
My essay on how struggle could be necessary for meaning, and how this could be the underlying cause of much of America's mental health problem. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 15, 2020
News & Analysis | No. 250
1614
CrowdSec, Nudge, Trickbot Trickery, CISA Ransomware Guide, Twitter and Facebook anti-Disinformation, QAnon Takedowns, Putin Turning on Trump, Azure Vulnerabilities, PC shipments up, Virtual Sales Call AI, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 12, 2020
News & Analysis | No. 249
1314
Operation Fortify, Cyber Pearl Harbor, Github Code Scanning, E-6B Flights, Blackbaud++, Grinder Password Reset, Cloudflare API Security, QNAP Drama, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 05, 2020
News & Analysis | No. 248
1004
Everyday Threat Modeling, Why I Like TikTok So Much, Windows XP Leak, SSH 8.4, Renée DiResta's Latest, Student Visas Changes, Cisco IOS Vulns, QAonon Gamification, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 28, 2020
Why Creators Should Move to Direct Support Monetization
701
My essay about why I think creators—especially in InfoSec—should be setting up their own domains and moving to a direct model for monetization. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 24, 2020
No, Changing Your SSH Port Isn't Security by Obscurity
784
My latest essay on the timeless debate on SSH ports and Security by Obscurity. I talk about why changing your port is not usually obscurity, and give what I believe to be an airtight method of how you can tell the difference between regular security and Security by Obscurity. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 23, 2020
News & Analysis | No. 247
1202
SSH Port Obscurity, The TikTok Deal, Ransomware Death, Chinese Espionage CRM, Amazon Bribery, Instant Domain Admin, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 21, 2020
Book Summary | Naked Statistics, by Charles Wheelen
1364
In this episode, I review the book Naked Statistics, by Charles Wheelen. I cover: My one-sentence summary of the text The table of contents, which is super helpful to see the structure of the argument My capture of the main points My takeaways, questions, and ideas that came from reading it My final summarization And then my rating of the book and whether I recommend you read the full text Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 16, 2020
News & Analysis | No. 246
1562
Gullibility vs. Disinformation, Russia, Iran, and China Attacking US Elections, Oracle TikTok, US Revokes Chinese Visas, China vs. US Cyber, Patch Tuesday, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 14, 2020
Book Summary | Atomic Habits, by James Clear
967
In this episode, I review the book Atomic Habits, by James Clear. I cover: My one-sentence summary of the text The table of contents, which is super helpful to see the structure of the argument My capture of the main points My takeaways, questions, and ideas that came from reading it My final summarization And then my rating of the book and whether I recommend you read the full text Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 10, 2020
News & Analysis | No. 245
1505
Anxiety and Freedom, Microsoft Deepfake Detection, Facebook Disinformation, Replacing Huawei, India China Apps, JEDI Microsoft, A Text Scam, Cisco Jabber Flaw, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 08, 2020
News & Analysis | No. 244
1089
Russian attempted hack of Tesla, New Zealand SE DDoS, Drone Assassinations, China Unified Social Credit System, Cisco Sabotage, Stolen Gaming Accounts, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 31, 2020
News & Analysis | No. 243
1549
InfoSec Creator Monetization, Initiating Contact with a Mentor, The Dark Side of Bounty/Creator Life, Facebook Election Threat Scenarios, Uber CISO Arrested, Spy HR Review Goes Bad, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 24, 2020
News & Analysis | No. 242
1442
Clearview AI ICE, NSA/FBI Fancy Bear Malware, Indian Health Card, Trump TikTok 90 Days, Startups Dying, Uber/Lyft vs. Courts, Android Earthquakes, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 17, 2020
News & Analysis | No. 241
1476
State Department Russian Media, Clean Network Plan, Cap One Fine, NSA Tracking Warning, YouTube Account Ban, Amazon Malls, No More Pixel 4, Audio RPGs, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 10, 2020
News & Analysis | No. 240
978
FBI Twitter Suspects, Recorded Future China Vatican, TikTok Microsoft Sep 15th, Amazon and Shopify Thriving, Forrester Ad Spending, Samsung Out of China, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 04, 2020
Unsupervised Learning: No. 239
616
Pentagon Information Warfare, Fancy GRU Attacks, 2 Chinese COVID Hackers, Chief Software Officer, Space Force DEVOPS, FBI Chinese Tax Software, DJI Drone Vulns, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 27, 2020
Unsupervised Learning: No. 238
1751
Twitter's Breach, The US Attacked IRA, Bloomberg FBI Sabre, Iran Keeps Getting Hacked, Russia's Cozy Bear, Cloudflare Outage, UIPath Automation, Verizon Uses Google AI to Automate Customer Service, Gamers Are Spending More, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 21, 2020
Our Lighted Path to Totalitarianism
840
An essay on how five trends seem to naturally guide civilizations towards Totalitarianism as they progress, and what we can do to avoid that outcome. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 16, 2020
Unsupervised Learning: No. 237
885
Americans in China, TikTok Banning, Chinese Critics, BlueLeaks, Router Security, COVID Accelerating Trends, Twitter Subscriptions?, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 13, 2020
Searching for the Ultimate Obstacle to Creativity
1055
This essay looks at Training as Avoidance, The Toolbox Fallacy, and procrastination, and explores a potential root cause that underpins them all to inhibit creativity. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 07, 2020
Unsupervised Learning: No. 236
1660
Encrochat breach, F5 Big Problem, DHS Social Election Query, WastedLocker, India Bans Chinese Apps, Florida DNA Privacy, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 06, 2020
Unsupervised Learning: No. 235
1111
Chinese diplomats stealing secrets, COVID flying risk, RT interviewing US cops, Army Ignite future predictors, China launches its GPS network, Russians paid bounties to kill US troops, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 29, 2020
Unsupervised Learning: No. 234
1218
Ripple20 IoT Vulns, Homeland Security Surveillance, US Cyber Budget, Adobe EOL, AWS DDoS, Bellingcat Poison Investigation, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 21, 2020
The Dark Web Has Nothing on Data Brokers
457
How so-called legitimate Data Brokers are a far worse threat to peoples' privacy than cyber-criminals operating on the Dark Web. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 15, 2020
Unsupervised Learning: No. 233
1203
SMBleed, Republicans. vs. China, Hawkey Surveillance, COVID in August 2019, IBM Facial PR, Palantir NHS, Blockchain Misinformation, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 15, 2020
The Problem With Extracted Versions of Things
355
A short essay on how we might get more pleasure from things that take longer to process and attain, and what we can do with that information. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 12, 2020
Unsupervised Learning: No. 232
1994
COVID-19 Trends, New Zoom Trouble, Facebook Blocking, Chrome Incognito Suit, Retail Rents, Nuclear Contractor Hack, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 08, 2020
Unsupervised Learning: No. 231
1097
US Protests & Unrest, Trump Goes Into the Bunker, NSA Warns on Exim, Octopus Scanner, Stanford's SIO Virality Project, Windows 10 Update, SHA-1 Deprecated in SSH, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 01, 2020
Unsupervised Learning: No. 230
1447
Twitter Bots, Face Recognition Headsets, Chrome Bug Memories, Virtual Currency, White House OPSEC, Realtime Language Translation, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 25, 2020
Analysis of the 2020 Verizon Data Breach Report
639
In this episode, Daniel takes a look at the 2020 Verizon Data Breach Investigations Report. He looks at the key findings and talks about what they might mean to us going forward. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 20, 2020
Unsupervised Learning: No. 229
1156
Feds Release Top Vulns, China Brainwave Tracking, Europe CISSP Masters, Army Electronic Warfare, Microsoft Third-largest Patch Tuesday, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 18, 2020
Unsupervised Learning: No. 228
998
Thunderbolt Attack, Celebrity Ransomware, ClearView Government, Blackhat DEFCON Virtual, War Thunder, 5G Bio Attacks, PC Game Cheating, Zoom Keybase, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 12, 2020
Unsupervised Learning: No. 227
1219
VICE vs. Chinese Surveillance, Indian Contact Tracing, NHS + GCHQ, Banjo Racism, Singapore Requires Check-ins, Bruce on Contact Tracing, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 04, 2020
Unsupervised Learning: No. 226
1244
Bay Area Lockdown Til May, The Swedish Approach, California Autopsies, Zoom Security Updates, Palantir Contacts, NSA Web Vulns, GreyNoise Services, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 28, 2020
A Conversation with Renée DiResta: Disinformation and Conspiracy Propagation
3980
In this episode, Daniel speaks with Renée DiResta about her work tracking narratives online. They discuss: The different strains of false information Her work at the Stanford Internet Observatory How the same narrative can be used by multiple sides The origin of the Bill Gates conspiracies Mapping campaigns to actor strategies What she recommends others do who are interested in her field Other topics around disinformation, conspiracy, and narrative tracking Renée DiResta is the technical research manager at Stanford Internet Observatory, a cross-disciplinary program of research, teaching and policy engagement for the study of abuse in current information technologies. Renee investigates the spread of malicious narratives across social networks, and assists policymakers in devising responses to the problem.               Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 22, 2020
Unsupervised Learning: No. 225
887
Flu Simulations, Amazon Thermal Cameras, Facebook Bad Info Tracing, 5G Gates Conspiracies, Google Slows Hiring, Amazon Hires More, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 21, 2020
Unsupervised Learning: No. 224
1211
Biogen Superspreaders, African Locusts, Game of Life, Meat Troubles, 5G Conspiracies, Japan Getting Out of China, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 14, 2020
Unsupervised Learning: No. 223
952
Coronavirus unemployment rate, 2 million guns, UK 5G attacks, German Antibodies, Zoom Drama, New Cloudflare Servers, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 07, 2020
A Conversation With Leif Dreizler About Security Engineering at Segment
3295
So today I’m talking to Leif Dreizler. Leif is a buddy of mine who also works in San Francisco. He’s a developer at a company called Segment, and over the last year or so he’s been telling me about all kinds of cool stuff he’s been working on, how his team is set up, and how they see security teams being built in the future. So we’re going to cover those topics and more in a conversation that ranges from security engineering strategy to solving specific problems through custom tooling. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 02, 2020
Unsupervised Learning: No. 222
2043
Who's hiring, freezing, and laying off, models predict 100-200K US deaths, April distancing, Adversarial Capital, Booz Russia, Google State Phishes, Worker Monitoring, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism…  Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 30, 2020
Unsupervised Learning: No. 221
1588
Health-justified Video Surveillance, FDA Emergency Approval of a C19 Test, Israel Mobile Monitoring, Amazon Essentials, Pandemic Drone Monitoring, Retasking Factories, Rich People Ventilators, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 24, 2020
Unsupervised Learning: No. 220
1224
Virus updates, Github gets NPM, New Stimulus, Amazon Hiring 100K, Saltwater Nozzles, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 17, 2020
Unsupervised Learning: No. 219
798
Coronavirus Update, Nation-state Exchange Hacking, FuzzBench, New Artillery, Germ Catapults, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 09, 2020
Unsupervised Learning: No. 218
852
SARS-CoV-2 update, China's health tracking, Firefox DNS over HTTPS, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 02, 2020
Unsupervised Learning: No. 217
1153
MGM breach, DDoS and Ransomware on the Rise, Twitter v. Bloomberg, Tesla Tape, Russia Pro Trump & Pro Bernie, Tapping Cables, Insider Concern, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 24, 2020
Unsupervised Learning: No. 216
831
Adsense Extortion, OT Ransomware Attack, Ring 2FA, Smart Speaker Jamming Bracelet, DARPA's Flying Gun, Lots of Advisories, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 20, 2020
A Conversation With General Earl Matthews on Election Security
2344
In this episode I speak with retired Air Force Major General Earl Matthews on the topic of election security. We talk about digital elections, attacking trust in the US system, social media influence campaigns, and possible motives for foreign interference in US elections. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 15, 2020
Unsupervised Learning: No. 215
852
Iran DDoS, Jigsaw Picture Validation, 1000 Chinese Espionage Cases, Twitter Deepfake Labeling, Android Bluetooth Vuln, Cisco Discovery Vuln, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 10, 2020
Unsupervised Learning: No. 214
1677
London Facial Recognition, Coalfire Freedom, NYT Reporter Spyware, Avast Sells Customer Data, Google's Bounty Program, Kali 2020, Harvard Chemist Espionage, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 04, 2020
Unsupervised Learning: No. 213
1102
Saudi Bezos Hack, MIT Davos AI, Moar Energy Attacks, NIST Privacy, Ohio CISO, Microsoft Data Breach, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 27, 2020
Unsupervised Learning: No. 212
1292
Clearview AI Surveillance De-anonymizing Faces, Face Obscuring Tech, Google Cookies, San Diego GE Surveillance, Oregon Selling DMV Data, Windows 7 Done, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 21, 2020
Unsupervised Learning: No. 211
1057
California's Privacy Law, SHA1 exploit, Ransomware Storage, Ring Voyeurs, 20 vs. 2020, ATT&CK ICS, Telecom SMS, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 13, 2020
Visibility and Understanding Create Both Tools and Weapons
350
How increased understanding leads to the creation of better and better tools, and why tools are inexorable from weapons. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 12, 2020
Unsupervised Learning: No. 210
762
War with Iran, TikTok, New GIAC cert, Mystery Drones, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 08, 2020
Unsupervised Learning: No. 209
907
Ring Sued, Mean Time to Hardening, APT20 2FA, China Base Pictures, China Satellites, Angled Toilets, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 30, 2019
Unsupervised Learning: No. 208
919
Mobile Tracking, Chinese Drone-Flu Terrorism, Message Spying, Bing Misinformation, 23andMe GlaxoSmithKline, Spam Laws, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 23, 2019
Unsupervised Learning: No. 207
1717
Pentagon vendor requirements, Ring camera freakout, Bluetooth Thieves, Palantir Pentagon, Amazon Rekognition, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 17, 2019
Unsupervised Learning: No. 206
1305
Vietnamese BMW APT, Defense Contractor Prep, China replacing a culture, HackerOne Cookie Snafu, Chinese Also Worried About Privacy, China Mobile Face, CDC Flu Warning, AWS Sagemaker, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 09, 2019
Unsupervised Learning: No. 205
2040
Spam trends, CWE's latest 25, Uber audio recordings, Uber unauthorized drivers, Chinese research theft, Google state-actor notifications, bluetooth burglars, Nixon deepface, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 02, 2019
Unsupervised Learning: No. 203
1084
Google health care, Google checking, Github open source, China policy hack, Hactivist bounties, healthcare attacks, facial protests, OSINT CTF, surveillance robots, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 18, 2019
Unsupervised Learning: No. 202
863
Capital fired, DHS biodata, Twitter insiders, Baltimore Cyber Insurance, Airbnb Assessment, Google Play Malware, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 11, 2019
Unsupervised Learning: No. 201
1190
Unify drama, Fancy cheating, NSO lawsuits, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 04, 2019
Unsupervised Learning: No. 200
1072
200th episode!, White House cyber vacancies, AT&T SIM bribery, South Africa ultimatum, climate change power crash, Bahgdadi dead, RuNET, NYT insanity, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 28, 2019
Unsupervised Learning: No. 199
1109
Stolen Cards Stolen, Autoclerk Hacked, TeamViewer Hacked, Russia Pretending to be Iranian, JackSpotting, Pixel4 Faces, FrenchFacRec, Samsung Fingerprints, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 21, 2019
Unsupervised Learning: No. 198
1085
Eye reflection EXIF, WiFi gait, Russian Cyber Clusters, Russia African Americans, China Pressure, VPN drama, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 14, 2019
Unsupervised Learning: No. 197
1464
Yahoo creep, DarkNet, E2E encryption, Cyber talent, RandomDeath, Private Data Property, Eyeballer, plus Technology News, Human News, Ideas Trends and Analysis, Updates, Discovery, Recommendations, and the Aphorism for the week! Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 07, 2019
Unsupervised Learning: No. 196
1480
New York is suing Dunkin (Donuts) for not revealing breaches in a timely manner (going all the way back to 2015), which is says jeopardized their customers. Good for New York. It's one thing to be breached: it's much worse to try to pretend it didn't happen. More NPR wrote an extraordinary piece on how the US penetrated ISIS' communications infrastructure and basically tore it down from the inside. It includes significant details on the operation, which made me cringe as I read them because they were so descriptive. But what we lost in operational surprise we likely gained in deterrence. More Uyghurs are playing cat and mouse with the Chinese government on the TikTok platform, with the former using videos to show solidarity while the latter searches for and deletes the content. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 30, 2019
Unsupervised Learning: No. 195
1569
Here's the new MITRE 2019 25 Most Dangerous Software Errors. Memory corruption bugs are huge right now. More There's a ton of recent DDoS activity that's leveraging IoT devices for UDP amplification attacks. Specifically, the WS-Discovery service (WSD) is being used because the response to request ratio is so large (from 43% to 15,000%). More There's a lot of chatter out there about Snowden due to his new book coming out, the NSA suing to keep him from making money off of it, him saying he'd like to come home, and him reiterating that he was just trying to do the right thing. Oh, and him saying he's never cooperated with the Russians. This whole situation makes me cautious of anyone with a singular and strong opinion about this, including myself. In 2016 I wrote a short piece about my opinion, and I am pretty much still in the same place with it. In short, if you think he's a hero you're probably wrong, and if you think he's a traitor you're probably wrong. He seems to be some combination of these two things, and from day to day, article to article, and book to book, I simply can't tell how much of which. Book Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 23, 2019
Unsupervised Learning: No. 194
1467
Not sure how this isn't bigger news, but Saudi Arabia shut down half its oil production after a number of drones attacked the largest oil processing plant in the world. Yemeni rebels claimed credit, but the US blames Iran. More DNS over HTTPS is coming to Chrome as well, so it's not just Firefox. So this is basically where browsers have a preferred DNS server, which works over HTTPS, and ISPs therefore won't be able to see every DNS request that users make. This will be a good thing for reducing the risk of ISPs (and actors with access to their logs) seeing what people are requesting, but it raises questions around filtering, caching networks, and other major components of the status quo. More A couple of Coalfire Pentester's got arrested and are still in custody for trying to break into a courthouse that they were actually paid to break into. Evidently, it's not clear whether the physical part was in scope or not. So, no, the get out of jail free card wouldn't have helped. Everyone already knows they were doing it thinking it was ok; the question is next steps. And meanwhile they sit in jail, probably spending all their time mentally working on DEFCON slides. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 15, 2019
Unsupervised Learning: No. 193
1330
AIG says BEC has overtaken ransomware as the primary claim type against their cyber insurance policies in EMEA, accounting for 23% of claims. More Paper The NSA Cyber Chief wants to share digital threat information early and often. I like the fact that they're opening up a bit, and I think it's only good for everyone (except bad guys). The more they share the higher the bar is for attackers, and the less time they have to use certain TTPs. This is exactly the type of Government-Industry interaction that we need to be doing more of to stay ahead of China. More NYU did a report on how social media is likely to be used for misinformation campaigns in 2020. They say Instagram will be a much bigger player this time around, which makes sense given that images are the dominant meme carrier. Article Study Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 08, 2019
Unsupervised Learning: No. 192
2104
Ring has already partnered with over 400 police departments. As you know, I'm torn on this kind of tech. Neighborhood watch can be a good thing, and it can also be a bad thing. Technology tends to magnify both weaknesses and strengths, so it can make neighborhood watch really great, or it can turn it into a nightmare. The problem is that you can easily start on the positive side, build it all the way up, and then in a few legal, policy, and tech changes have it turn into the oppressive form. Some say this is a reason not to do any of this stuff, but I disagree. We know someone is going to do it, so I think the best thing that can be done is to build a benign version and hope it wins in the market. More People are drawing comparisons between China's social credit system (which is actually multiple systems) and the Silicon Valley's various apps that have internal rating systems. They're saying that these ratings will eventually be used to make decisions about things that matter. Sure, but this has existed throughout human history. Word of mouth, blacklists, etc.: these are all ways of extending the reach of good or bad reputation. I think whenever someone points out the downside of a technology, we should ask ourselves whether that dynamic exists already in the real world, and adjust our opinions accordingly. More The Pentagon is worried that China will beat the US in AI if we don't create a stronger link between the government and both academia and industry, which China is good at. We basically need to move faster from edge concepts to practical implementations, but it's damn hard to do this when we have all sorts of legal and ethical constraints that China doesn't have. Our caution and morality are a definite weakness in this case. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 02, 2019
Unsupervised Learning: No. 191
1553
Protestors in Hong Kong are physically attacking and destroying facial recognition cameras. More Palo Alto says 7 out of 10 new domain registrations (NDRs) are either malicious or not safe for work, and they encourage companies to block them. More Lt. Gen. Fogarty is fighting to change the name of Army Cyber Command to Army Information Warfare Command, and to give the group a much larger scope in its mission. More We continue to see attacks against open source supply chains, in packages like NPM, RubyGems, Webmin, and many others. It's about to become imperative for people to understand—and to be able to validate—the entire chain of trust that a given application sits upon before they use it. There have been many companies in this space in the past, but I expect to see them (and new players) get a lot more attention soon. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 26, 2019
The Difference Between Data, Information, and Intelligence
319
The terms intelligence, information, and data are thrown around pretty loosely in most tech circles, and this inevitably leads to people confusing and/or conflating them. What follows is a simple explanation of how the related terms are different from each other, and how they work together. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 19, 2019
Unsupervised Learning: No. 190
1358
There are some seriously nasty Windows RDP bugs out there. If you have RDP facing the internet, make sure you're patched. And try to get to VPN as soon as possible. More A huge survey of firmware security has found virtually no improvement over the last 15 years. People seem surprised by this, but it is exactly what I would have predicted based on my analysis here. Basically, for most people not in the industry, our current state is actually fine. More NYPD has over 82K peoples' DNA in a database, and the program has little visibility and oversight. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 19, 2019
Unsupervised Learning: No. 189
504
Ring is developing two-way relationships with hundreds of police departments in the US. This allows Ring users to be alerted to crime in their area via 911 data, and police departments to pull video from participating Ring devices. This is the type of functionality that most people will see and think, “Wow, I'd love to have that!”, which is why it's going to be very successful. But it's also one tiny step away from something terrifying. More A number of critical bugs in VxWorks are going to cause issues with infrastructure for years to come. More DARPA is building a $10 million dollar, open source voting system with a focus on security. More It looks like China's social credit system might not be a giant monolithic system, but rather a series of siloed experiments. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 13, 2019
Unsupervised Learning: No. 188
1169
Marcus Hutchins got off with time-served, and people have feelings. The range basically goes from 'he did nothing wrong', to, 'he should rot in prison'. In my mind this outcome was close to perfect. Remember, he went through two years of hell since being brought up charges, he's still a convicted felon, and he also is largely banned from the US. I think it's good that he admitted guilt, faced consequences, and is being offered a chance to continue giving back to the community. More Attorney General Barr said recently that companies should put backdoors in their products that bypass encryption, or else the government will pass laws that require it. This is unspeakably stupid. Without even getting into the philosophy of whether the internet can host a private conversation (which requires a warrant to tap), we can just start with the fact that backdoors present a clear and present danger to security, right now, due to the weaknesses of those who create them. If the NSA can be hacked or somehow lose its sensitive tools and materials, there's no company this cannot happen to. Purposefully installing backdoors therefore equates (effectively) to giving such access to attackers. Unacceptable. More Equifax is offering people $125 dollars in reparations for them losing all your data. But to get it, you have to log in and give a bunch of data about yourself. It's hilarious. They made money offering credit protection after the breach, and now they're going to collect updated information on anyone who wants to collect $125. On Twitter I called this a sadder and more permanent form of giving plasma. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 29, 2019
Humans Are Genebots
467
Unpacking the evolution-granted bliss of prep schools and elite institutions, and why they resonate so much with us. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 26, 2019
Machine Learning Doesn’t Introduce Unfairness—It Reveals It
514
The difference between unfairness and bias in machine learning. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 25, 2019
Unsupervised Learning: No. 187
2109
Lots of people in the security community went silly over the FaceApp application last week, basically saying that you shouldn't be using the application because they'll steal your face and then be able to impersonate you. Oh, and then it turned out to be a Russian company who put out the application, and that made it 100x worse. The problem here is the lack of Threat Model Thinking. When it comes to election security, propaganda discussions, etc., I am quite concerned about Putin's willingness and ability to harm our country's cohesion through memes and social media. But that does not extend to some random company stealing faces. Why? Because before you can get legitimately concerned about something, you have to be able to describe a threat scenario in which that thing becomes dangerous. As I talked about in this piece, pictures of your face are not the same as your face when it comes to biometric authentication. There's a reason companies need a specific device, combined with their custom algorithm, in order to enroll you in a facial identification system. They scan you in a very specific way and then store your data (which is just a representation, not your actual face) in a very specific way. Then they need to use that same exact system to scan you again, so they can compare the two representations to each other. That isn't happening with random apps that have pictures of you. And even if that were the case, they could just get your face off your social media, where those same people who are worried are more than happy to take selfies, put their pictures on profile pictures, and make sure as many people see them as possible. There are actual negative things that can be done with images (like making Deepfakes of you), and that will get easier over time, but the defense for that is to have zero pictures of you…anywhere. And once again you have to ask who would be doing that to you, and why. Bottom line: authentication systems take special effort to try to ensure that the input given is the same as the enrollment item, e.g., (face, fingerprint, etc.), so it will not be easy any time soon to go from a random picture to something that can full a face scanner or fingerprint reader at the airport. People reading this probably already know this, but spread the word: threat modeling is one of our best tools for removing emotion from risk management.  A contractor named SyTech that does work with Russian FSB has been breached, resulting in the release of 7.5TB of data on the FSB's various projects. This is obviously embarrassing for SyTech and the FSB, but the leaked projects focused on de-anonymization, spying on Russian businesses, and the project to break Russia away from the Internet, which are all known and expected efforts. So there don't seem to be any big reveals as a result of the leak. More Someone discovered that a bunch of browser extensions were reading things they shouldn't be, and sending them out to places they shouldn't be. This is not surprising to me. Chrome extensions are like Android apps, which should tell you all you need to know about installing random ones that seem interesting. My policy on browser extensions is extremely strict for this reason. People need to understand how insane the entire idea of the modern web is. We're visiting URLs that are executing code on our machines. And not just code from that website, but code from thousands of other websites in an average browsing session. It's a garbage fire. And the only defense really is to question how much you trust your browser, your operating system, and the original site you're visiting. But even then you're still exposing yourself to significant and continuously-evolving risk when you run around clicking things online. And the worst possible thing you can do in this situation is install more functionality, which gives more parties, more access, to that giant stack of assumptions you're making just by using a web browser. The best possible stance is to have as few people possible with access to your particular dumpster. And that means installing as few highly-vetted add-ons as possible. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 22, 2019
Time Speeds Up When You’re Wasting It
316
An essay on why time can feel like it's speeding up when you get older, and how to slow it back down. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 20, 2019
Unsupervised Learning: No. 186
1234
Parts of Manhattan had a power outage Saturday night, which happened to be the anniversary of another power outage in 1977. The power company apologized but didn't explain what happened. The hacker in me thinks this could easily be a probing shot by a sophisticated attacker, or a fun prank by amateurs. But the overwhelming odds are on simple failure. Either way, this country needs to get a whole lot more resilient to small attacks, because enough small ones can quickly become a big one. More Zoom has had a bad week or two. Not only did it have a major vuln, but it turned out to be part of the design, and they moved relatively slowly in addressing it, and then companies started auto-uninstalling it from their OS. They had a lot of momentum going in the space, too. This will sting for sure. More Facebook will be fined $5 billion over its various privacy catastrophes. More Marriott is being fined $124 million over the Starwood breach. Real question: how does that compare to their coffee budget? More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 15, 2019
Unsupervised Learning: No. 185
1297
The Telegraph has found strong links between Huawei employees and Chinese intelligence agencies. The Huawei counter was that this was extremely common among telecom companies, and that it wasn't a big deal. The counter to that counter was, basically, "Well, then why did you try to hide it?" /gg More The NPM security team caught a malicious package designed to steal cryptocurrency. A lot of these packages work by uploading something useful, waiting until it's used by lots of people, and then updating it to have the malicious payload. My buddy Andre Eleuterio did the IR on the situation there at NPM, and said they're constantly improving their ability to detect these kinds of attacks. Luckily NPM's security team had the talent and tooling to detect such a thing, but think of how many similar companies aren't so equipped. I think any team that's part of a supply chain should be thinking about this type of attack very seriously. More Federal agents are mining state DMV photos to feed their facial recognition systems, and they're doing it without proper authorizations or consent. To me this has always been inevitable because—as Benedict Evans pointed out—it's a natural extension of what humans already do. You already have wanted posters. You already have known suspects lists. And it's already ok for any citizen or any cop to see any person on that list and report them. In fact it's not just possible, it's encouraged. So the only thing happening here is that process is becoming a whole lot more aware (through more sensors), and therefore more effective. Of course, any broken algorithms that identify the wrong people, or automatically single out groups of people without actual matches, those issues need to be snuffed out for sure. But we can't expect society to not use superior machine alternatives to existing human  processes, such as identifying suspects in public. That just isn't realistic. Our role as security people should be making sure these systems are as accurate as possible, with as little bias as possible, by the best possible people. In other words, we should spend our cycles improving reality, not trying to stop it from happening. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 08, 2019
The World is Collapsing Into Two Countries—Green and Red
492
The world being sorted into two different countries—a Green country of the top 10% of income/wealk, and a Red country that's everyone else. These countries are separated not by geography, but by class. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 03, 2019
Unsupervised Learning: No. 184
1133
I created a new tutorial on OWASP Amass, and just joined the team as a contributor as well. Tutorial Chinese hacking groups have been embedded deep inside multiple major US tech firms for many years, including Fujitsu, Tata, NTT, Dimension Data, and HPE. The first thing you should be thinking is where else they are today. More Amazon is getting heavier into the SIEM space (and perhaps others) with their new Amazon Security Hub offering. It takes in lots of event types from various AWS services, and surfaces what it thinks is most important. Of course, it doesn't do this for other product types, i.e., non-AWS stuff, but that could come eventually. More Amazon also launched a new service that lets you monitor your AWS VPC traffic. And lots of vendors are announcing their support for it. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 01, 2019
Unsupervised Learning: No. 183
787
There's a Linux vulnerability called SACK Panic (among other names) that takes advantage of a kernel feature called Selective ACK. The feature lets systems tell the other side of the conversation how much data it's received, and it turns out it can be overflowed or fuzzed. The former creates a crash, and the latter creates a slowdown. You should patch. And if you have any services facing the internet running Linux, you should definitely patch. More A Florida city paid $600,000 in bitcoin to get access to their data back from a ransomware gang. More Magic Leap is suing former engineer Chi Xu for allegedly using his knowledge of the headset to make a version for China. More The average security group is running over 50 security tools. As my friend Jeremiah once said when looking at a Momentum Partners slide, "Are we secure yet?" More Amazon just got a patent for using delivery drones for surveillance. I don't necessarily think that means they'll use delivery drones for surveillance though. That's what a lot of the conspiracy theorists will say, though—just based on them getting a patent for using delivery drones for surveillance. Actually, the patent is a bit more benign than my joke implies. It's designed to monitor opted-in people's property, a lot like a house camera or a Ring device. Makes sense. But still. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 24, 2019
Unsupervised Learning: No. 182
636
The US is supposedly ramping up attacks against Russian power grid through the use of new cyberattack powers granted by Trump. I am happy to hear of this, but it's an example of where we as outsiders can only know a tiny fragment of the story. But any signs that this administration sees Russia as a foe, and are treating it as such, are positive in my view. More Adobe is entering the deepfakes arena by showing off research tools designed to detect manipulated photos. More Target stores have been hit by major outages. More Many places are using very granular bluetooth beacon tracking to watch you move throughout their businesses, including airports, malls, subways, buses, gyms, hotels, festivals, museums, etc. More The US is going after ethnic Chinese researchers in the medical field, and specifically at cancer centers. I'm all for becoming more aggressive towards the Chinese government pilfering the world's intellectual property, but, um, cancer research is one thing that I think it's ok to spread widely. It's not like they're stealing the only copy of the research; they're just sharing it. Maybe I'm missing something, but if that something is just about who makes the profit, then I'm calling Meh. More Firewalling outbound DNS could save companies billions. Yes! I've been on about this for years. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 18, 2019
Unsupervised Learning: No. 181
1485
Some absolutely fascinating research has just come out on what percentages and types of vulnerabilities are actually exploited in the wild. It found that only 5.5% of vulnerabilities discovered between 2009 and 2018 were actually exploited, with most of those being issues with a CVSS score of 9 or 10. The best part of the paper, however, was a discussion of optimal patching strategies, where they looked at different methodologies for what to patch and measured them against each other based on coverage (no misses) and efficiency (not patching what you don't have to). Options included patching by CVSS, whether or not there are public exploits, by vulnerability tags, etc. The ML model performed best, but it seemed that patching the CVSS 7 and above was decent as well, and for more efficiency but less coverage—CVSS 9 and above. Super interesting paper. More The US is going to start requiring 5 years of social media account history from Visa applicants, as part of the filtering process. I'm genuinely curious as to how effective this is going to be. On the one hand, there will now be a market for creating and maintaining fake social media accounts that people can use for this purpose. But on the other hand, there will be many who don't want to go to that effort and either won't try to come, or will get caught in the filter. As with most things, the efficacy will come down to execution. More A team at Stanford has made it possible to edit video using a text editor. So, editing the things that were said by the actual subject, to say something else entirely, but having it seamlessly injected into the video so it looks completely natural. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 11, 2019
Grit is the Ultimate Privilege
385
An argument that we should acknowledge grit as one of the most powerful causal factors in success, and figure out ways to bring its benefits to everyone. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 08, 2019
Why Software Remains Insecure
261
A concise explanation of why software continues to have security and quality problems after decades of supposedly trying to address the problem. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 06, 2019
Unsupervised Learning: No. 179
1040
The Deepfakes thing is already starting to have an impact, and it didn't even involve actual Deepfake (GAN ML) technology. A video was spread of Nancy Pelosi speaking very slowly and seeming to stumble over her words, which made her look quite bad. The video was virally shared throughout social media on the right. Problem is, it was intentionally slowed down to make her look old/stupid/crazy. What this shows us is that it's not the machine learning that makes Deepfakes dangerous; it's the willingness of a massive percentage of the US populationto believe total garbage without an ounce of scrutiny. It doesn't matter if Deepfakes can be shown to be fake because people are matching evidence to their emotions, not the other way around. The vulnerability is our ignorance and cynicism, not a spoofing technology. And as I wrote about a couple of years ago, this will be used as a weapon against us. More Essay A real estate insurance website for First American Financial Corp was vulnerable to a simple IDOR (where you change the account number in the URL to get another account), and it evidently resulted in the exposure of hundreds of millions of insurance records that included extremely sensitive information. IDOR is still one of the most common and dangerous vulns a web app can have, and for companies like this they can be devastating. More The US Military is trying to learn how popular movements form and evolve, and to do so they're studying 350 billion social media messages. But it's a Bloomberg article, so maybe they're actually studying bullfrogs for clues about hypertension. More Moody's has downgraded Equifax's rating in some significant part due to its 2017 cyber breach. This is noteworthy because until now, breaches have largely been spackled over in terms of the major financial perspective and at the 6-24 month timescale. This is a positive indication that companies could actually start taking cybersecurity more seriously, and not just at the CISO and IT level, but from the boardroom down. More Advisories: TP-Link Routers Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 28, 2019
Unsupervised Learning: No. 178
1409
Trump has semi-banned the use of foreign telecom gear, which is really a direct shot at Huawei and China. more Baltimore’s IT systems are still being held hostage after 2 weeks. Of all the cities in the world that I could imagine this happening to, Baltimore is towards the top of the list. If you don’t have good schools or a good police force, I don’t expect you’d have good IT security hygiene either. more Crime is so bad in Mexico that people buy fake mobile phones so they can give them to muggers instead of their real one. I have to assume this is also happening in Brazil. more This is a stunning audio Deepfake of Joe Rogan doing a few different routines. It sounds exactly like him. Not a little bit. Exactly. Now imagine that for politicians and celebrities, where there is plenty of source material to train from. We’re about to move to a world where you can only trust authenticated voices and personalities, using sources and clients that are trusted to serve you their actual content. Expect a massive industry around serving authentic content and detecting fakes. more Salesforce had to disable access to millions while the fixed an access control issue that allowed open reading of tons of customer data. more Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 24, 2019
Unsupervised Learning: No. 177
1352
My Takeaways from the 2019 DBIR ReportMy Summary The Report The DOJ has unsealed the indictment against those who they believe hacked Anthem in 2015, and they are Chinese Nationals. They didn't reveal the suspected motive, however. But as I wrote about last year, I don't think we need an explanation. I think it's obvious. More An Airbnb host in China has been arrested for watching guests using a hidden camera. More The Mossad has released an interesting challenge in something of a spy CTF style. More Chinese scientists have created a small, portable camera system that uses LIDAR to resolve human features from up to 28 miles away. Good news—it also penetrates smog. More Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 14, 2019
Finding Clarity on the Exodus of the New Left
638
A short essay that attempts to wrap a simple narrative around what's happening with the exodus of the New Left, and what it's doing to the moderate left, center, and right that they left behind. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 04, 2019
Unsupervised Learning: No. 175
2217
Deepfakes are about to seriously erode our collective ability to tell truth from fiction, and this is already a big enough problem without them. Think of every problem you care about, and realize this represents an exponent on each one. This video captures it extremely well. Link Slack has warned the world that it's being targeted by Nation State actors. I'm glad they said it, but we already knew that. Think of what an attacker could get if they could access any company's internal Slack communication without being detected. Link Scientists have captured the brain waves of someone hearing speech, run that through an algorithm that created it's own speech from the recordings, and got a 75% recognition rate from humans on that speech. So the algorithm knew what the person heard, and turned that into spoken language that people actually understood. The next step is for the algorithm to know what people thought, instead of heard. In other words, machine learning is taking very close to mind-reading—but we still have potholes and cancer. Link Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 01, 2019
A Political Discussion with Jeremiah Grossman
6346
Today's standalone episode of Unsupervised Learning is a political conversation with Jeremiah Grossman, who many of you will know as the founder of Whitehat Security, current CEO of BitDiscovery, Jujitsu Blackbelt, and all-around great individual. In this episode, however, we’re not going to be talking about Information Security, but Politics. We have remarkably different and similar views on politics, which we’ve been discussing in private for years, and we thought now was the perfect time to show that it’s possible to disagree with someone, respect them, and have a conversation about those disagreements in a positive and useful way. This is the first experiment of this kind on Unsupervised Learning, and I’m quite pleased with how it turned out. So with that, Here’s Jeremiah Grossman. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 14, 2019
Unsupervised Learning: No. 173
1481
Amazon has many thousands of people doing quality control on Alexa, meaning that they're listening to incoming audio captured on Echo devices. This shouldn't be surprising. The question is how they're doing it, and what policies they have around privacy when doing so. I don't personally see a major problem here. But at the same time I'd never put a Facebook device in my home. To me it's more about the company and its incentives than anything else. Link A number of FBI-affiliated websites were hacked, and information on thousands of federal agents and law enforcement officers are now being sold online. Link Chinese schools are using facial recognition on students, and using ML to determine whether or not they're currently paying attention, distracted, etc. Link Sift is a service that builds a risk profile on you so merchants can determine whether you're a benign actor or someone about to commit fraud. I think people need to accept that continuous risk scoring for people and situations is both inevitable and actually already happening. The moment you try to block bad actors by looking at their behavior, you quickly end up with a score that determines action based on various thresholds. And the moment you do it for bad actors, you're kind of implicitly doing it for good actors as well. There are better and worse ways to approach this, but profile scoring is not something we're going to be able to avoid going forward. Let's accept this reality and start having the conversations about how to make (and keep) this functionality as benign as possible. Link A Dutch F-16 was damaged by rounds from its own 20MM cannon. So it fired bullets, and then flew into them. Life is awesome. Link Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 14, 2019
Unsupervised Learning: No. 171
1152
Mastercard is looking to create a Digital ID service that can bind your digital presence to your mobile device, which will be able to verify you to various services. Palantir has won an $800 million contract to build the next combat intelligence system (to replace DCGS-A) for the Army. Putin appears to be causing brain drain in Russia. Dropbox has an interesting proposal for improving vendor security assessments. TL;DR: They turned their requirements into contractual points. LOVE IT.  Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 01, 2019
Unsupervised Learning: No. 169
1128
Multiple governments have now blacklisted Huawei, which Huawei seems very confused by. The best explanation I've heard so far about why this move makes sense for western countries came from Rob Joyce of NSA. He basically said that just like Kaspersky in Russia, the reason you can't trust Huawei is that it's a Chinese company, and even if they're not already infiltrated by the Chinese government, they can be at any moment without anyone knowing that it happened. And there's nothing Huawei or anyone else could do to stop it. Strong argument. Link 2/3 of Android antivirus apps are hot garbage. Gasp. Link DARPA is building an open-source, secure voting system. That's their goal, anyway. I'm skeptical of being able to build truly secure systems, but I have lots of confidence in DARPA, and I also know the bar for improvement over the current state is quite low. So, yeah, go forth and prosper. Link The RAND Think Tank conducts wargames between the U.S. and its potential enemies, such as Russia and China, and one analyst said that we keep losing. The issue seems to be that our key advantages can be neutralized rather easily, and it'd take a lot of money to fix the biggest issues. Link Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 18, 2019
Unsupervised Learning: No. 167
2042
This is a description of cyberwar that sounds quite realistic to me, and it's based around the thousand-cuts idea. Ring Doorbells have a vulnerability that allows one to capture clear-text videos and other data from the cameras if you can get on the wireless network that the camera is using. An independent security researcher found the Dow Jones Watchlist database sitting open on the internet. Schneier talks here about how easy it is to influence people in sensitive positions, similar to my post on China building a database on us.… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 03, 2019
Unsupervised Learning: No. 165
1438
OpenAI text spoofing, Twitter DMs, Chinese tracking database, Ponemon Cyber Risk Score, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 21, 2019
Unsupervised Learning: No. 163
1004
My takeaways from ENIGMA 2019—one of my two favorite conferences in the world. The US has charged Huawei with stealing trade secrets, money laundering, and fraud. This escalates the already tense situation with China on a number of fronts. An engineer does a Twitter thread on AI-created videos on YouTube. He describes how they are created, promoted, and selected for display in recommendations. Fascinating read. This is a video of thieves scanning a BMW key fob through the wall of the owner's house, and driving away in their car. It could be that proximity-based security devices might need a trigger event (from the owner) before becoming active, like for mobile payments. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 04, 2019
An Overview of the OWASP IoT Top 10 for 2018
895
We just released the 2018 version of the OWASP Internet of Things Top 10, and in this episode I talk you through the list and give the philosophy, methodology, and next steps for the project. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 07, 2019
Unsupervised Learning: No. 159
1686
German politicians hacked, NSA's new RE tool, Weather Channel tracking, sick TSA agents, Facebook dust tracking, Technology News, Human News, Ideas, Discovery, Recommendations, and the weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 07, 2019
Unsupervised Learning: No. 155
973
Google+ breach, Android flaws, China's long game against the US, Australia's encryption blunder, NYPD drones, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 11, 2018
Unsupervised Learning: No. 153
899
Ukraine malware, China's Black Mirror, DARPA's Mosaic, FBI trolling, Silicon Valley jobs, Technology News, Human News, Ideas, Trends, & Analysis, Discovery, Notes, Recommendations, and the weekly Aphorism! Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 26, 2018
Unsupervised Learning: No. 147
721
OWASP IoT Top 10 Draft, Facebook compromise, Fornite cheating, Pentagon weapons, spam calls, technology news, human news, ideas, discovery, recommendation, and the weekly aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 25, 2018
Unsupervised Learning: No. 141
3524
AMA Summer 2018, Security News, Technology News, Human News, Ideas, Discovery, and the weekly Recommendation and Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 04, 2018
Unsupervised Learning: No. 139
1056
TLS 1.3, BurpSuite Improvements, Google Ad Database, Russian Attack Sattelites, Amazon Theaters, Google AI Cooling, Wheat Genome, Giant Magellan Telescope, Carb Ratios, Leg Exercise and Cognitive Health, Ideas, Discovery, Notes, Recommendations, and the weekly Aphorism… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 20, 2018
Unsupervised Learning: No. 135
1668
GRU ATT&CK analysis, Assange to the UK, Cisco backdoors, DARPA electronics, faces from genomes, viz.ai, open plans are bad, Best Buy consulting, ultrasound vs. dementia, 4 day work weeks, ideas, recommendations, and the aphorism of the week! Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 22, 2018
Unsupervised Learning: No. 133
2096
Twitter deleting accounts, deepfakes, location leaks, Rekognition, bio databases, juggalo makeup, iOS 12 security, Siri upgrades, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 11, 2018
Unsupervised Learning: No. 131
1787
Predicting your credit rating based on the tech you use, Russians attack Germans, WPA3, China bird drones, AT&T and Verison to stop selling our location data, Facebook red team, Twitter Smyte, plus tech, humans, discovery, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 26, 2018
Unsupervised Learning: No. 129
680
Reboot your router, China hacked a U.S. Navy contractor and stole around 600GB of top secret data. Newark, NJ is monitoring much of the city with surveillance cameras, and they're making the camera footage available to the public. Facebook also shared data with a number of Chinese companies. Tech, Humans, Ideas, Discovery, Reconmendations, Aphorism…  Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 12, 2018
Unsupervised Learning: No. 128
643
Pentagon background checks, China using machine learning in schools, Rusian ethnicity detecting AI, US Military presence in Africa, Atlanta lost dashcam footage, Kidnapping insurance, Technology News, Ideas, Recommendation, Aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 04, 2018
Unsupervised Learning: No. 127
573
VPNFilter botnet, Echo private convo, Ghostery GDPR fail, PornHub VPN, Technology News, Human News, Ideas, Trends, & Analysis, Discovery, Recommendations, the weekly Aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 29, 2018
Unsupervised Learning: No. 126
549
VPNFilter botnet, LA + Palantir, Amazon Surveillance, Momentum report, Clapper says Russia turned the election, Chinese supply chain attacks, Tech News, Human News, Ideas, Discovery, Recommendation, the Aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 25, 2018
Unsupervised Learning: No. 125
746
Regulators aren't staffed to audit you on GDPR, inaudible Siri and Alexa commands, iOS 4 is bringing lots of privacy updates, California DNA storage, technology news, human news, Ideas, recommendation, the weekly aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 18, 2018
If You’re Not Doing Continuous Asset Management You’re Not Doing Security
423
How enterprises are completely ignoring the security activity that could help the most. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 16, 2018
Unsupervised Learning: No. 120
1154
It's 2 billion users now, Liinux beep, Digital Shadows finds fail files, cloud misconfiguration, AlterEgo, AI applications, Alexa sending payments, Tech, Ideas, Recommendation, Aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 09, 2018
Unsupervised Learning: No. 119
1644
Atlanta disabled, MyFitnessPal hacked, Cambridge Analytica election tampering, Drupal, Saks, DARPA drones, Cloudflare 1.1.1.1, Slack bosses, Democratic Chinese AIs, Georgia facepalm, tech, humans, ideas, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 02, 2018
Unsupervised Learning: No. 116
1044
Chinese at CanSecWest, Applebees POS, Palantir, Poisoning, TensorFlow DoD, Amazon laughing, Google 72-qbits, Amazon FinTech, Android P, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 13, 2018
Unsupervised Learning: No. 115
743
GitHub DDoS, Celebrite Attacks, AI warnings, Palantir in New Orleans, Grub Backspace, 4G attacks, Space Corps, Amazon wins Defense Department deal, tech news, human news, discovery, notes, recommendation, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 06, 2018
Unsupervised Learning: No. 113
3104
Parkland tampering, Avoid Huawei, Bongo S3, Facebook 2FA Spam, Android Cryptojacking, Spyware Hacking, Password Dating, Technology News, Human News, Trends, Ideas & Analysis, Data & Statistics, Discovery, Recommendations, Aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 20, 2018
Unsupervised Learning: No. 112
1321
Chinese AR glasses, Cisco ASA flaws, Russian Nuclear Cryptomining, Marine quadcopters, POS Skimmers, Chrome HTTP, technology news, human news, discovery, notes, recommendations, and the aphorism of the week… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 12, 2018
Unsupervised Learning: No. 111
842
Olympic security drones, Alexa trickery, Chinese quantum satellite, Audio Adversary Examples, BeeToken Ethereum theft, App Store Security, Cryptomining, technology news, human news, discovery, notes, recommendations, and the aphorism of the week… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 05, 2018
Unsupervised Learning: No. 109
886
Social engineering, breach impact, Chinese turncoat, Android spy kit, Hawaiian OPSEC, Russian cables, bypassing CloudFlare, technology news, human news, discovery, notes, recommendations, and the aphorism of the week… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 22, 2018
Unsupervised Learning: No. 107
1811
Meltdown & Spectre, India's Database, Criminals and Monero, Equifax Non-action, technology news, human news, discovery, notes, recommendations, and the aphorism of the week… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 08, 2018
The Biggest Advantage in Machine Learning Will Come From Superior Coverage, Not Superior Analysis
505
Many people, in many fields, think Machine Learning won't replace their analysts because their humans are better than an algorithm. But it's not just about side-by-side comparisons. The bigger question is, "what percentage of the data can humans actually look at?", and the answer to that question (a tiny fraction) is the reason ML will be so helpful. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 03, 2018
It's Wrong to Fear-monger on IoT Security
320
How it's shortsighted and irresponsible for InfoSec professionals to fear-monger on IoT Security, and what we should be saying instead. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 03, 2018
Unsupervised Learning: No. 106
1681
Swatting death, Ethereum kidnap, Chinese dystopia, Alteryx S3 bucket, Starbucks Monero, Forever21, Microphone ads, technology news, human news, discovery, notes, recommendations, and the aphorism of the week… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 03, 2018
Unsupervised Learning: No. 105
1411
TRITON, 1.4 billion credentials, HP keyloggers, iTunes Bitcoin laundering, removing credit card signatures, technologgy news, human news, discovery, notes, recommendations, and the aphorism of the week… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 18, 2017
Unsupervised Learning: No. 104
1542
NiceHash hacked, Apple bugs, Stealing Cars via Relay, Crypto Collusion, technologgy news, human news, discovery, notes, recommendations, and the aphorism of the week… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 12, 2017
Unsupervised Learning: No. 103
1712
Uber's mess, Google tracking users, AI finding missiles, drone disclosure, net neutrality, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 27, 2017
Unsupervised Learning: No. 102
1568
Github security, China IW, Brexit IW, S3 again, Quad9 DNS security, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 20, 2017
Unsupervised Learning: No. 101
2123
Verizon’s DBIR Report, sleeping fingerprints, IoT legislation, S3 security tools, AI tricks scammers, SEALs kill Green Beret, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 13, 2017
Unsupervised Learning: No. 100
1396
Russian IW memes, POTUS Twitter, Texas Attack, Silence Trojan, NotPetya Damages, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 06, 2017
Unsupervised Learning: No. 99
1750
Information Warfare, AI vs. CAPTCHA, Google Bug Bug, DARPA Drone Swarms, USB Fail, Medical Extortion, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 31, 2017
InfoSec Needs to Embrace New Tech Instead of Ridiculing It
362
The InfoSec community needs to learn how to shepherd the public through new technology instead of joining them in fleeing from it. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 26, 2017
The Difference Between Violence and Terrorism
272
The ways that terrorism and violence are different, and why it's important that we don't confuse them. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 26, 2017
Unsupervised Learning: No. 98
1974
The Reaper botnet, Google Advanced Email Protection, Bitcoin Over $6,000, Duo's $70 million, Dubai going to facial recognition, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 23, 2017
Unsupervised Learning: No. 97
2191
Major WPA2 Flaw, Suburu hack, Vulnerable Container Ships, F-35 Data Stolen, Accenture S3 Buckets, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 16, 2017
Unsupervised Learning: No. 96
2040
Russians vs. NSA, ArcSight vs. Russia, DISQUS breach, TrendMicro vulnerability, Stamos, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 11, 2017
Unsupervised Learning: No. 95
666
IE leak, Whole Foods, Sonic, Apple Open-sources Kernels, Equifax $15 million retirement, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 02, 2017
Unsupervised Learning: No. 94
2007
Deloitte hacked, Equifax fumbles, SEC hacked, iCloud ransom, Adobe PGP facepalm, Verizon S3 buckets, CCleaner, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 25, 2017
Unsupervised Learning: No. 93
2551
Equifax fallout, BlueBorne, Microsoft RCE, iPhone X, Dumping AWS, Cassini, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 18, 2017
Unsupervised Learning: No. 92
1797
Equifax, Hutchins got Krebs'd, Russia used Facebook, Energy hacking, Anti-protester AI, High-pitched Assistant hacking, tech news, human news, ideas, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 11, 2017
Unsupervised Learning: No. 91
2275
465K pacemaker patches, instagram leak, DJI bounty, Marketing departments messing up security news, false dichotomy in complex issues, IRS social media mining, death of the Sun, more fake Wells Fargo accounts, human echolocation, facial gestures as interface, discovery, recommendations, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 04, 2017
Unsupervised Learning: No. 90
1833
Swedish gov leak, OPM hacking arrest, cybersecurity spending $1T, Oreo, Whole Amazon Foods, intelligence genes, false dichotomy of conflicting ideas, OPSEC obscurity, discovery, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 28, 2017
Unsupervised Learning: No. 89
2124
Serious CANBUS issue, Cyber as a branch of the service?, iOS 11 Cop Mode, biometric wearables, Bill Joy battery, bitcoin forking again, ideas, discovery, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 20, 2017
Unsupervised Learning: No. 88
1320
Amazon Macie, APT28, Cuba sonic attacks, Palantir and police, DNA malware, confusing self-driving cars, ideas, discovery, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 15, 2017
Unsupervised Learning: No. 85
1561
The future of security testing, nuclear plant hacks, Android malware, satellite decryption, wildcard certs, military encryption, gsuite protections, WWE S3, tesla 3, jawbone, drone hacking, mental aging, millionare GPAs, discovery, recommendations, the weekly aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 10, 2017
Unsupervised Learning: No. 83
1591
Petya ransomware worm, RNC breach, Anthem settlement, Russians want source code, risk ratings, patching, ICOs, ideas, discovery, recommendation, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 27, 2017
Unsupervised Learning: No. 82
1199
Live from London, Gamestop hacked, PowerPoint malware, Chinese Apple Hack, XSS, WWDC summary, FDA approves cancer drug, heroin $51B, ideas, discovery, recommendation, aphorism, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 12, 2017
Unsupervised Learning: No. 81
1650
OneLogin, Extortion, Coinbase, Pandemic, Booz, Mobile Apps, Electricity, AI voices, Sheets, Walmart, Karoshi, APIs, discovery, aphorisms, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 04, 2017
Unsupervised Learning: No 79
1979
WannaCry, Intel leaks, DocuSign phishing, cockpit codes, Delta facial recognition, China vs. CIA, WordPress bug bounty, Marines and drones, HPE R&D, Watts, graduates only making 40K, China's DNA project, honeymoons vs. rings, Sherrif Eli, retirees hoarding money, boo restaurant kiosks, investing in employees, discovery, aphorisms, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 23, 2017
Unsupervised Learning: No. 78
1845
The WannaCry ransomware worm, the president's EO, Macron hacking, HP backdoors, laptop bans, Amazon releases, Chinese online commerce, CRISPR, Germany and renewable energy, beetles, dental health as social indicator, Reading superpowers, Net Neutrality, serverless, deep learning black box, The Three Body Problem, you can now support the site, The Mechanical Universe, TrueCaller, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 14, 2017
Unsupervised Learning: No.76
1065
Verizon's DBIR report, Chipotle (again), USAF bounty, NSA surveillance hampered, Android hacks, Taser and computer vision, Google fights fake news, Exercise types & mental skills, Perfect pitch recording, Lifecasting, RF X-Ray, discovered links, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 02, 2017
Unsupervised Learning: No. 75
2084
DoublePulsar in the wild, vigilante IoT worms, Bose listening headphones, PoS hacking sentence, Google ad blocking, best anti-aging exercises, unqualified Indian engineers, , discovered links, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 23, 2017
Unsupervised Learning: No 74
3149
Shadow Brokers, fingerprinting Netflix traffic, Magneto vuln, Juniper advisories, Amazon speaker tech, Facebook's 100Gbit optical switches, Google Hire, Minecraft currency, a solar-powered water harvester, OWASP Top 10 draft comments, remote SSH, EC2 and NAT firewalls, deep learning is a black box, discovered links, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 17, 2017
Unsupervised Learning: No 73
4569
Word 0-day, BrickerBot, iOS GIF, Russian arrested, Tizen, OilRig, APT10 MSPs, Dallas sirens, ATM drilling, Watson golf, Uber Italy, AI memory, links, projects, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 10, 2017
Unsupervised Learning: No. 72
3787
Apple fixed tons of bugs, hacking smart TVs over DVB-T, gift card bots, handgun AIs, Uber manipulations, AI vs. jobs, how to read more, cloud secret management, OPSEC and phishing, links, projects, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 03, 2017
Unsupervised Learning: No. 71
2570
Half of Android devices haven't been patched in over a year, Tavisclosure, NEST camera flaws, senate vs. privacy, electronics ban, bad Let's Encrypt certs, Moodle SQLi, infosec venture capital drying up, IBM employees heading into the office, Twitter going paid model, Google killing Talk, Quiet spaces, Age of the influencer, AI vs. jobs, tools, aphorisms, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 26, 2017
Unsupervised Learning: No. 70
1470
Russians at it again, Microsoft and Adobe updates, PoS breaches, US-CERT throws TLS shade, epilepsy tweet stalking, Tesla's billion, lip-reading AI, autonomous BMWs, Fiber Lasers, taxing robots, Green Zones and Red Zones, AI disruption of healthcare, discovery, recommendations, and aphorisms, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 20, 2017
Unsupervised Learning: No. 69
1631
The Vault7 CIA dump, Russian shenanigans, Dahua, Verifone, mandatory genetic testing, Wordpress, atomic storage, Google Kaggles, presenting at HouSecCon, fasting research, data wars, chaos, voice interfaces, tools, projects, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 13, 2017
Unsupervised Learning: No. 68
2264
Amazon's S3 outage, Uber greyballing, fooling AI, DNS RATs, automating human jobs, suicide and ML, post-work IQ and creativity, greatness vs. imperfection, media choice, tools, projects, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 06, 2017
Unsupervised Learning: No. 67
1884
CloudBleed, SHA1-1, White House Leaks, Planets, Satellites, Drones vs. Eagles, InfoSec Jobs, ExFil, IQ and Creativity in a Post-work World, Weaponized Narrative, Security Tools, Tons of Great Links, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 27, 2017
Unsupervised Learning: No. 66
1758
My recap of RSA 2017, Google's zero-trust implementation, Trump domain hacked, robots doing your taxes, the IoT Security train analogy, the future of authentication, toolswatch best tools of 2016, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 21, 2017
Unsupervised Learning: No. 64
1346
Tax phishing, Microsoft SMB vulnerability, Cellebrite tools released, Computer interfaces, Centrism, Mobile 2.0, new projects, more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 07, 2017
The Experience of Free Will is Not Free Will
330
A short essay on how it's possible to experience free will without it being real. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 01, 2017
Unsupervised Learning: No. 63
2803
Peak Prevention at AppSec Cali, Austrian Hotel Ransomware, Russian FSB Drama, WordPress Issues, AV Conflicts, Uber Pays Another Company's Bounty, Data Science, Rules for Rulers… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 30, 2017
Unsupervised Learning: No. 62
1680
An OWASP Gaming Security Framework, infosec news, OPSEC is obscurity, AMP is a horrible idea, the End of Twitter, the Sound of Silence, chaning your Echo wake word, RAWGraphs, Ask Lesley, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 22, 2017
Unsupervised Learning: No. 61
2375
Nasty new GMail phishing bug, Microsoft kills security bulletins, ShadowBrokers go dark, Cellebrite hacked, Combining sensor data with machine learning, the tradeoff between privacy and IoT functionality, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 16, 2017
Gratitude is the Epicenter of Happiness
267
The elusive center of happiness is gratitude, and the reason seems to be evolution. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 14, 2017
If You Believe Nothing You Can Be Convinced of Anything
729
An essay about the Russian hacking attribution issue, and how people who cannot differentiate the credibility of information sources are ultimately set to believe anything rather than nothing. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 13, 2017
Unsupervised Learning: No. 60
1902
How we know Russia did it, the FBI using Best Buy, an IBM study on ransomware, MongoDB hacks, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 11, 2017
4 Things To Do in the First Week of Every January
145
A short piece on why I don't like New Years resolutions, and the four things I prefer to do instead.  Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 27, 2016
Unsupervised Learning: No. 58
890
This week's topics: Yahoo!, Shadowbrokers, Building Your Own Honeytrapping Infrastructure, The Power of Newsletters, Project Aristotle, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 19, 2016
Unsupervised Learning: No. 57
1742
This week’s topics: Russia gave us attribution for Christmas, the NSA is shedding talent, the evilest ransomware, how to raise someone's IQ in 2 minutes, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 12, 2016
Unsupervised Learning: No. 56
891
Gooligan, Korean Game Hacking Law, DoubleFlag Experian Hack, Georgia Tech Attribution Research, Amazon's re:Invent Conference Highlights, recommended links, and more… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 05, 2016
Unsupervised Learning: No. 55
1450
Biowarfare defenses, AI advances, mergers and acquisitions, Facebook and censorship, IoT definitions, the philosophy of Westworld, and more... Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 28, 2016
The Difference Between Threats, Threat Actors, Vulnerabilities, and Risks
346
My essay that clearly separates the differences between the core infosec terms of threat, threat actor, vulnerabilty, and risk. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 27, 2016
The Difference Between Existentialism, Nihilism, and Absurdism
481
For centuries there have been people who believe there is no intrinsic meaning in the universe. Here I’ll summarize the three major branches of this belief, and how each proposes we deal with the situation. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 22, 2016
Stop Being Proud of Complexity
234
An essay on how complexity often communicates the exact opposite of its desired effect. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 22, 2016
Unsupervised Learning: No. 54
878
Britain's new surveillance law, CRISPR biotech, the Army's new Phaser, NIST's new IoT Security guidelines, ML-based facial recognition, and more... Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 21, 2016
Unsupervised Learning: No. 52
2459
Subscribe to Unsupervised Learning via: iTunes | Android | RSS | Newsletter This is Episode No. 52 of Unsupervised Learning—a weekly show where I collect my favorite stories in infosec, technology, and humans, and talk about why they matter. The show is released in two forms: * the Podcast, which you can subscribe to via iTunes, Android, Blog, or RSS * the Newsletter, which is the podcast’s companion and conveniently serves as its show notes as well. You can get the newsletter by clicking here or on the image/text below. Thank you for listening! Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 07, 2016
Unsupervised Learning: No. 51
3638
Subscribe to Unsupervised Learning via: iTunes | Android | RSS | Newsletter This is Episode No. 51 of Unsupervised Learning—a weekly show where I collect my favorite stories in infosec, technology, and humans, and talk about why they matter. The show is released in two forms: * the Podcast, which you can subscribe to via iTunes, Android, Blog, or RSS * the Newsletter, which is the podcast’s companion and conveniently serves as its show notes as well. You can get the newsletter by clicking here or on the image/text below. Thank you for listening! Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 31, 2016
Unsupervised Learning: No. 50
2244
Subscribe to Unsupervised Learning via: iTunes | Android | RSS | Newsletter This is Episode No. 50 of Unsupervised Learning—a weekly show where I collect my favorite stories in infosec, technology, and humans, and talk about why they matter. The show is released in two forms: * the Podcast, which you can subscribe to via iTunes, Android, Blog, or RSS * the Newsletter, which is the podcast’s companion and conveniently serves as its show notes as well. You can get the newsletter by clicking here or on the image/text below. Thank you for listening! Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 24, 2016
Unsupervised Learning: No. 49
2859
Subscribe to Unsupervised Learning via: iTunes | Android | RSS | Newsletter This is Episode No. 49 of Unsupervised Learning—a weekly show where I collect my favorite stories in infosec, technology, and humans, and talk about why they matter. The show is released in two forms: * the Podcast, which you can subscribe to via iTunes, Android, Blog, or RSS * the Newsletter, which is the podcast’s companion and conveniently serves as its show notes as well. You can get the newsletter by clicking here or on the image/text below. Thank you for listening! Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Oct 18, 2016
Unsupervised Learning: Episode 46
1801
Subscribe to the Podcast via: iTunes | Android | RSS | Newsletter [ Click here to get the full companion newsletter with complete show notes from this episode. ] [ Click here to get the full companion newsletter with complete show notes from this episode. ] Subscribe to the Podcast via: iTunes | Android | RSS | Newsletter Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 27, 2016
Unsupervised Learning: Episode 45
3424
Subscribe to the Podcast via: iTunes | Android | RSS | Newsletter [ Click here to get the full companion newsletter with complete show notes from this episode. ] [ Click here to get the full companion newsletter with complete show notes from this episode. ] Subscribe to the Podcast via: iTunes | Android | RSS | Newsletter Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 19, 2016
Unsupervised Learning: Episode 44
2049
Subscribe to the Podcast via: iTunes | Android | RSS | Newsletter [ Click here to view the full companion newsletter with complete show notes from this episode. ] [ Click here to view the full companion newsletter with complete show notes from this episode. ] Subscribe to the Podcast via: iTunes | Android | RSS | Newsletter Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 11, 2016
Unsupervised Learning: Episode 43
2549
Subscribe to the Podcast via: iTunes | Android | RSS | Newsletter News Internet disinformation service for hire [ Link ] Rob Fuller (@mubix) has found a way to pull credentials from a locked machine using a USB dongle and Responder [ Link ] Yelp starts new bug bounty with HackerOne, offers up to 15K […] -- :: Unsupervised Learning: Episode 43 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 07, 2016
Unsupervised Learning: Episode 42
3874
[ Subscribe to the Podcast: iTunes | Android | RSS ] InfoSec news and articles Dropbox hacked 68 million accounts Back in 2012 Malware infected all Eddie Bauer stores in U.S. and Canada All 350 stores in North America Wicked iPhone vulnerability called Trident (3 0days) All you need to do is follow a link, […] -- :: Unsupervised Learning: Episode 42 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Sep 01, 2016
Unsupervised Learning: Episode 41
2054
[ Subscribe to the Podcast: iTunes | Android | RSS ] InfoSec news and articles NSA hacking tools supposedly leaked back in 2013 Could have just been a jump box, which rival groups commonly attack from each other Snowden thinks Russia hacked the NSA and is announcing this as part of the DNC debate Flip […] -- :: Unsupervised Learning: Episode 41 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 18, 2016
Unsupervised Learning: Episode 40
3278
- LinkedIn breach from 2013 | 65.5 million emails and salted and hashed passwords - XSS in Wordpress plugin (JetPack) - DerbyCon is going to stream live this year | you can’t stream the networking, so it probably won’t hurt next year’s sales too much - Websites using audio fingerprinting to track web users Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 31, 2016
Unsupervised Learning: Episode 39
1428
[ Subscribe to the Podcast: iTunes | Android | RSS ] InfoSec news and articles BAE systems saying that SWIFT hack is linked to the Sony breach [ Link ] Kaspersky is saying ransomware is the #1 threat now [ Link ] Identity thieves grab W-2 data from Equinox [ Link ] Germany claims it was […] -- :: Unsupervised Learning: Episode 39 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 14, 2016
Unsupervised Learning: Episode 38
2726
[ Subscribe to the Podcast: iTunes | Android | RSS ] InfoSec news and articles Michigan lawmakers want life sentence for hacking cars | will that apply to changing the speed of your turn signal? SWIFT to get update after Bangladesh hack NSA is so overwhelmed with data that it’s no longer effective FBI now […] -- :: Unsupervised Learning: Episode 38 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
May 02, 2016
Unsupervised Learning: Episode 37
2149
[ Subscribe to the Podcast: iTunes | Android | RSS ] InfoSec news Feds paid over 1M to get into San Bernardino iPhone Continued fallout from Panama papers 3.2 million servers vulnerable to JBoss attack which is being used in SamSam ransomware attacks MIT launches internal bug bounty platform | https://threatpost.com/mit-launches-experimental-bug-bounty-program/117618/ NSA recommends out-of-band taps […] -- :: Unsupervised Learning: Episode 37 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 25, 2016
Unsupervised Learning: Episode 36
1241
[ Subscribe to the Podcast: iTunes | Android | RSS ] News [ ] Nothing useful found on Farook’s phone | http://www.theregister.co.uk/2016/04/14/nothing_useful_on_farook_iphone/?utm_source=dlvr.it&utm_medium=facebook | I think they knew this and used it as a lever for something they’ve wanted for a long time [ ] Apple engineers say security threat is hackers, not government | http://www.macrumors.com/2016/04/15/apple-engineers-hackers-security-threat/ […] -- :: Unsupervised Learning: Episode 36 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 18, 2016
Unsupervised Learning: Episode 35
1620
[ Subscribe to the Podcast: iTunes | Android | RSS ] News [ ] The hack of Mossak Fonseca has been tied to a breach of their wordpress install through a plugin called Revolution Slider, leading to the Panama Papers breach. So just to be clear, we might have just seen the biggest data leak […] -- :: Unsupervised Learning: Episode 35 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 11, 2016
5 Increasingly Effective Ways to Achieve Immortality
810
[ Subscribe to the Podcast: iTunes | Android | RSS ] — I think a lot about how to become immortal. More than I should, probably. Many think it’s a waste of time. Everyone dies, and it’s foolish to think we can avoid it. This piece takes a different view, and describes a number of ways, with varying levels of requirement and effectiveness, one can either avoid dying or live on after death. They’ll go from most practical to most effective. 1. Live On Through Your Children This one is cheating a bit, mostly because you’re not actually becoming immortal. But the fact remains that this does give many people (probably billions) a genuine feeling of lastingness, and that’s significant. Again, I don’t really count it because it’s an extremely tenuous way of living on, but it deserves mention. 2. Live On Through Your Works This one is kind of like the first, in that you’re not actually getting to continue living. So it’s a bit of a misnomer too. What it deals with, however, can also provide a significant sense of contentment at the end of one’s life. Basically, if you leave behind works and ideas that will be used by significant numbers of people, for a significant period of time, you can think of this as living on. It’ll take some sting off of dying, perhaps. But not much. You’re still dead. 3. Reconstruction Through Reproduction of Variables Ok, now we’re getting into actual survivability. This one works like this: either before you die, or after you are dead, an organization collects a series of inputs about you and uses them to create a working model of you. Here are some of the input types: * Your DNA (this is really important) * Everything there is to know about where you grew up (what was happening in the world then, where you went to high school, what the major news events were, the major themes in culture and art, etc.) * Everything there is to know about the people you grew up with * All your personal, transformational experiences. This can be gathered from a myriad of sources, but your own description of the incidents will be key. It’ll also come from interviews with people who know those experiences and how they affected you * Every piece of output you left behind, e.g. blog posts, Facebook posts, books, essays, schoolwork, letters, videos, whatever. They’re all harvested for evidence of who you are Then, the system takes the environment data and models it against your DNA, which it got from a piece of hair or something. It runs your entire genome and determines how you would respond mentally to these various stimuli. The output is a digital life form that is, as much as it can be, you. You now live in cyberspace somewhere, and you’re introduced to the fact that you were reconstructed using this method, and that you have this rich history, etc. You are you. 4. Preserving Your Brain to Be Put in Another Body in the Future Another method for achieving comfort that you’ll continue to live after death is to have a reliable way to preserve your brain once you pass, with the belief that it’ll be either 1) put into another body later (not my favorite idea), or 2) it’ll be downloaded into a digital form to live permanently in cyberspace. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 07, 2016
Unsupervised Learning: Episode 33
2250
News [ ] Panama Papers leak [ ] Hackers targeting major US law firms [ ] Ubuntu has some kernel vuln patches out [ ] 50 million turkish citizens have their information dumped online [ ] Microsoft makes cloud-app security services now available (Adallom) [ ] OSVDB shutting down because nobody would pay them [ ] WhatsApp is now end-to-end encrypted [ ] Critical new Flash bug, expect Ransomware to leverage it [ ] Security salaries skyrocketing due to talent shortage | http://www.csoonline.com/article/3049374/security/survey-with-all-eyes-on-security-talent-shortage-sends-salaries-sky-high.html [ ] Data exfiltration using Smart Lightbulbs | http://www.scribd.com/doc/306620189/Eyal-Ronen-and-Adi-Shamir-Hack-Lightbulbs [ ] Significant Firefox extensions bug, look for a patch soon [ ] $40 attack that steals police drones from 2 kilometers away | http://www.theregister.co.uk/2016/04/01/hacker_reveals_40_attack_to_steal_28000_drones_from_2km_away/ | break wep, disconnect their controller, connect yours, must be within 100 meters [ ] IoT is expected to push the US ahead of China in manufacturing by 2020 | http://www.zdnet.com/article/internet-of-things-analytics-expected-to-push-u-s-ahead-of-china-for-manufacturing/ [ ] 1,400 vulnerabilities found in automated medical supply system | https://www.helpnetsecurity.com/2016/03/30/1400-flaws-automated-medical-supply-system/ | automated cabinets that dispense medical supplies , if you’re locked out it could be bad -- :: Unsupervised Learning: Episode 33 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 07, 2016
T1SP: Episode 32
2189
[ Subscribe to the Podcast: iTunes | Android | RSS ] News * [ ] Verizon Enterprise Solutions had a major data breach of their customer data. This is the group that handles breaches for their customers. “Virtually every attack in this data set (98 percent) was opportunistic in nature, all aimed at easy marks…” * [ ] Iranians charged with attacks against US banks and a New York dam * [ ] Hackers steal 81 billion from the Federal reserve bank of New York * [ ] Uber launches bug bounty program, describes the surface area. Someone said it was really bad, though. Not sure what that’s about * [ ] New ultra-fast SSD technology coming from Intel soon * [ ] FBI backs off request for Apple backdoor. Says they have it handled. We find out it’s an Israeli company * [ ] Water treatment plant hacked, chemical mix changed for tap supplies | http://www.theregister.co.uk/2016/03/24/water_utility_hacked/ * [ ] German steel mill compromised and wrecked a blast furnace * [ ] This is after a string of attacks against power companies using spear phishing and office malware * [ ] Microsoft’s AI Chatbot was a teenage girl, but it learned from the people who talked to it, so before long it was talking about loving incest, sex, and hitler * [ ] Millions of Android devices vulnerable to root exploit due to Snapdragon chip flaw * [ ] Kentucky-based Methodist Hospital declares state of emergency after it’s wrecked by Locky ransomware * [ ] Credit Card Breaches Linked To Security Cameras * [ ] Chinese national pleads guilty to stealing plans for Air Force aircraft * [ ] Hackers offer Apple’s Ireland staff $23,000 for their login credentials * [ ] Ransomware hitting major vulns: The Angler, Neutrino, Magnitude, RIG, and Nuclear exploit kits spread the Flash CVE 2015-7645 exploit; Angler spreads Flash 2015-8446; Angler and Neutrino spread Flash CVE 2015-8651; and Angler spreads Silverlight CVE-2016-0034, an exploit exposed in the Hacking Team breach. * [ ] Microsoft Deploys Macro Blocking Feature in Office to Curb Malware Ideas, updates, and discussion * [ ] Innovation Sandbox | Innovative Security Products (2016 Edition) * [ ] AI and messaging apps are the new mobile apps * [ ] Human Attention as Attack Surface | https://danielmiessler.com/blog/human-attention-as-influence-attack-surface/ * [ ] Most can’t respond to breach: http://blogs.csc.com/2016/03/15/while-majority-of-orgs-fear-big-breach-theyre-not-prepared-to-respond/?utm_content=bufferc043c&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer * [ ] How your data is collected and commoditized online by free online services | http://www.troyhunt.com/2016/03/how-your-data-is-collected-and.html Tools, talks, and projects * [ ] Innovation Sandbox | Innovative Security Products (2016 Edition) * [ ] 2016 Data Breach Digest | https://danielmiessler.com/blog/analysis-verizons-2016-data-breach-digest/ * [ ] AI and messaging apps are the new mobile apps | https://danielmiessler.com/blog/ai-assistants-are-the-new-applications/ * [ ] Idea Expansion Format | https://danielmiessler.com/blog/idea-expansion-format-ief/ * [ ] BinDiff is a comparison tool for binary files that helps to quickly find differences and similarities in disassembled code. * [ ] IntelMQ is a solution for CERTs for collecting and processing security feeds, pastebins, tweets and log files using a message queuing protocol. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 28, 2016
T1SP: Episode 31
1938
[ Subscribe to the Podcast: iTunes | Android | RSS ] News [ ] FBI saying it will force Apple to hand over source code and signing ability if they don’t comply | http://thehackernews.com/2016/03/fbi-apple-iphone.html [ ] Locky ransomware campaign, JS downloader [ ] X11 forwarding issue in OpenSSH, update now [ ] Seagate Phish Exposes All […] -- :: T1SP: Episode 31 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 14, 2016
My Response to Sam Harris on the Apple Encryption Debate
2189
[ Subscribe to the Podcast: iTunes | Android | RSS ] [ UPDATE: Much credit to Sam for engaging in the conversation. I’m not sure how people claim he’s closed on this topic when he is clearly open to exploring it. ] I don't agree with all of it. But this is a very good response to my remarks about encryption. https://t.co/rMl8zgtuWN@danielmiessler— Sam Harris (@SamHarrisOrg) February 28, 2016 — I’ve been planning on doing a podcast episode on the Apple encryption debate for some time, but I was unsure of the format I should use. This problem was just solved for me when I listened to Sam Harris—who is someone I respect greatly—miss the mark significantly in a recent podcast. The thing that compelled me to respond was the fact that I don’t often disagree with Sam. His logic is usually impeccable, and we often end up with nearly identical opinions. So it was somewhat surreal to hear him be wrong about something. Or at least disagree with me (which, of course, may not be the same thing). Anyway, being in information security myself I felt like a response was important. This essay takes the form of a retort to his comments, followed by my own points and then a summary. Sam’s points [ The points are summarized, by the way, not necessarily exact quotes. ] * Apple built the lock, but didn’t build the key, and now they’re telling us that building the key would put us all at risk. Self-serving abdication of responsibility. * Community in tech swayed by Snowden. Even when the government gets a court order, they think they shouldn’t give access * Gives cases where text messages could have helped solve a murder, but the texts are unread because the iPhone is unbreakable. Imagine being a family member! * Could someone build an impregnable room inside their own house? * What if you could take a drug that could make your DNA unanalyzable? So you could never be linked to any crime. The only people who would benefit would be criminals! * Apple could maintain the backdoor and it’d be fine, just like banks have your banking information. They’re trading on paranoia. My responses [ NOTE: This will come in the form of a podcast, which I may still record. I wrote it largely in the voice of a spoken conversation. ] First, let’s start with where we agree. You speak of a “Cult of Privacy”, where people are blindly saying that Snowden did nothing wrong whatsoever, that he didn’t set a dangerous precedent, that any violation of privacy in any case is always bad, etc., etc. I absolutely agree with you that this is not an intelligent way to understand and discuss current events. But there’s another cult on the other side, and it’s one that you’re coming dangerous close to membership in. And that’s “The Cult of Safety”. This one works like this: If there is any situation in which some amount of data could be used to help learn where a kidnapped girl is, or where a terrorist’s bomb will detonate, then it’s within the rights of a government to legally seize ... Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 28, 2016
T1SP: Episode 29
1158
[ Subscribe to the Podcast: iTunes | Android | RSS ] News * [ ] Apple calls out FBI on iPhone decryption case * [ ] Trump calls for a boycott of Apple, from an iPhone * [ ] Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers * [ ] Wow. Someone hacked @linuxmint’s website and replaced ISOs with backdoored version today http://blog.linuxmint.com/?p=2994  * [ ] This affects a universally used library (glibc) at a universally used protocol (DNS).  Generic tools that we didn’t even know had network surface (sudo) are thus exposed, as is software written in programming languages designed explicitly to be safe. ~ Dan Kaminsky * [ ] Mint Forum Hacked, website compromised, fake downloads posted * [ ] TeslaCrypt now targeting Joomla sites as well as WordPress * [ ] Hollywood Hospital pays 17K to decrypt files; hope they cleaned up afterwards otherwise they’ll be paying rent * [ ] Patch your vServer; RCE flaw * [ ] Power grid honeypot by MalCrawler Ideas, updates, and discussion * [ ] The San Bernadino health department changed the iCloud password (at the FBI’s request) after having the device for just a few hours * [ ] The FBI didn’t have the other two phones, which were destroyed * [ ] The implications for data security if US companies are told the government must be able to get in is that US citizens will soon be told that they cannot create, purchase, or use tech that is locked down in this way * [ ] There’s another way to the iPhone data: https://threatpost.com/delicate-hardware-hacks-could-unlock-shooters-iphone/116388/ via @IOActive Tools, talks, and projects * [ ] Bitquark is releasing some subdomain research; will be added to SecLists * [ ] Log.io web interface for looking at log files | http://www.tecmint.com/linux-server-log-monitoring-with-log-io/ * [ ] Lobotomy: Automate Android assessment and reversing | https://n0where.net/android-security-toolkit-lobotomy/ * [ ] SSLyze: https://n0where.net/fast-and-full-featured-ssl-scanner-sslyze/ * [ ] SELKS: Full NSM with Suricate and rule manager | https://www.stamus-networks.com/downloads/ Announcements * [ ] I’ll be at the IOAsis at RSA next week; come by and say hello Miscellaneous * [ ] War-games movie prompted Reagan to take cybersecurity action | http://www.nytimes.com/2016/02/21/movies/wargames-and-cybersecuritys-debt-to-a-hollywood-hack.html [ Subscribe to the Podcast: iTunes | Android | RSS ] Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 23, 2016
T1SP: Episode 28
2535
[ Subscribe to the Podcast: iTunes | Android | RSS ] News [ ] Major Cisco ASA buffer overflow; patch now [ ] Critical patches for Windows and Flash [ ] The FBI is officially investigating Hillary Clinton regarding her private email server [ ] NSA doing a complete reorg (basically combining defense and offense) […] -- :: T1SP: Episode 28 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 15, 2016
T1SP: Episode 27
1375
[ Subscribe to the Podcast: iTunes | Android | RSS ] News [ ] Heavy surveillance around the Super Bowl [ ] A new BlackEnergy spear phishing campaign is targeting more Ukrainian companies [ ] Magneto, the popular e-commerce CMS, releases fixes to critical XSS issues [ ] Someone has posted private files of America’s […] -- :: T1SP: Episode 27 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 02, 2016
T1SP: Episode 26
2948
[ Subscribe to the Podcast: iTunes | Android | RSS ] News [ ] Backdoor found in AMX devices that run corporate and government conference rooms [ ] Autopwn every Android device on your network using BetterCap and addJavascritInterface [ ] Cyber insurance challenged: a lawsuit for failing to cover a 500K loss in Houston […] -- :: T1SP: Episode 26 appeared originally on danielmiessler.com. :: Subscribe to Unsupervised Learning---my weekly show where I handpick the best stories from infosec and technology, and talk about why they matter. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 25, 2016
T1SP: Episode 25
1581
[ Subscribe to the Podcast: iTunes | Android | RSS ] News * [ ] TrendMicro node.js server listening on localhost can execute commands; exposed to the internet * [ ] SSH backdoor found in Fortinet firewalls * [ ] SSH client vulnerability * [ ] Australia’s Cybercrime Online Reporting Network (ACORN) received over 39K reports of criminal activity in 2015 * [ ] Hyatt names 250 hotels hit by malware, includes the one for DerbyCon * [ ] Web sense rebranding as Forepoint, acquires Intel’s firewall business * [ ] Twitter might be ending its 140 character limit * [ ] Major vulns still being found in Health and Fitness mobile apps * [ ] Angler exploit kit continues to evade detection * [ ] LostPass attack is a phishing email attack that works against LastPass (showed at Shmoocon this weekend) * [ ] Virus just took down the Melbourne Health computer system * [ ] Lastpass has found a workaround for the LostPass attack * [ ] A bit match fixing problem has been found in Tennis * [ ] Trustwave is being sued by Affinity for supposedly missing an second hack that was going on while they were there to fix an initial hack Ideas, updates, and discussion * [ ] IR is messy and dangerous; assume compromise; assume continued compromise; be extremely careful saying that things were contained; if you’re not Mandiant you’re probably not doing a great job * [ ] Smartphone encryption and the gun debate: same coin? ISIS supposedly has its own encryption app. What next, make murder illegal? Tools, talks, and projects * [ ] FIR – Fast Incident Response Management Platform * [ ] DIVA damn insecure and vulnerable Android app * [ ] Kill Chain for Kali Linux 2.0 : recon, weaponization, delivery, exploit, installation, c2, actions * [ ] EZ-Wave: exploiting Z-Wave networks using SDR * [ ] GoPhish: open source phishing framework * [ ] V3n0m SQLi scanner * [ ] VScan : uses NSE scripts to find vulns * [ ] SleepyPuppy Burp Extension * [ ] DBDAT — Database Assessment Tool — https://github.com/foospidy/DbDat Announcements * [ ] Speaking at AppSec Cali next week (Tuesday) on ATM * [ ] Shmoocon hiring list: http://www.room362.com/2016/01/2016-shmoocon-hiring-list.html Miscellaneous * [ ] Great security news source: https://security.didici.cc/news * [ ] Thanks to Tripwire for giving a shoutout to the podcast on Twitter [ Subscribe to the Podcast: iTunes | Android | RSS ] Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 19, 2016
T1SP: Episode 24
1700
[ Subscribe to the Podcast: iTunes | Android | RSS ] News * [ ] Norse lays of 20 people; not clear what percentage that is; threat intel not going so well? * [ ] OPM declines to release details on its big breach * [ ] Juniper says it’s going to remove the code that it thinks was developed by the NSA to eavesdrop on traffic * [ ] CVE details lists (OS X, iOS, Flash, Air, IE, Chrome, Firefox) as the software with the most issues * [ ] GM is going to do a bug bounty * [ ] The Hacker Manifesto turned 30 (My crime is that of curiosity) * [ ] Sophos Home free for Windows and Mac users * [ ] SF Yellowcab filling for bankruptcy * [ ] Hackers shut down Ukraine power grid; evidently a malicious word doc sent via email; supposedly the Sandworm Team * [ ] Bicycle Attack on TLS: https://guidovranken.files.wordpress.com/2015/12/https-bicycle-attack.pdf * [ ] North Korea evidently detonated a hydrogen bomb * [ ] Time warner customers lose email passwords (320K) * [ ] Microsoft killing off IE 8, 9, and 10 on January 12th * [ ] VTech launching new product line after it got hacked and leaked data on 6 million kids * [ ] Big Flash player update, 0-day and 18 other issues Ideas, updates, and discussion * [ ] Back to Ubuntu from CentOS * [ ] Sick for five weeks * [ ] Ikigai (what you love, what the world needs, what you can be paid for, what you are good at) * [ ] Giving books as gifts Tools, talks, and projects * [ ] TOWER-SEC protecting ECUs and Telematics on cars * [ ] AppSensor project; Detection points: https://www.owasp.org/index.php/AppSensor_DetectionPoints * [ ] Where the Science is Taking Us in Cybersecurity, Dan Geer * [ ] Rapid7 Hackazon app (modern) * [ ] DVNA (Damn vulnerable Node Application) * [ ] Argon2 password hashing algorithm * [ ] Dradis * [ ] Kippo SSH honeypot [ Subscribe to the Podcast: iTunes | Android | RSS ] Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. * It’s better to listen via iTunes or with the player embedded above, but you can also download the sound file directly. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 11, 2016
T1SP: Episode 23
3305
[ Subscribe to the Podcast: iTunes | Android | RSS ] News * [ ] Juniper backdoor; could have been found with diff; signs point to NSA * [ ] RCE on FireEye appliances * [ ] Hyatt got hacked; malware on POS * [ ] 45K drones registered with FAA within 2 days * [ ] Industry moving towards password-free logins; still single factor, now the factor is your device; although access to device could require factors * [ ] Microsoft will now tell you if your account has been targeted by government authorities * [ ] Tor announced it’s doing a bug bounty, looks like it’ll be internal * [ ] Steam had a DoS that revealed 34K user details * [ ] Linode has been suffering a massive DDoS on its datacenters, DNS infrastructure * [ ] Spy files found in North Korea’s Operating System Ideas, updates, and discussion * [ ] 3 things you should do every January * [ ] Web Scanner Series: Burp vs. Netsparker * [ ] When you’re interviewing, make sure you make it clear that you’re the asset too, not just them * [ ] Failing at the basics in intelligence and infosec * [ ] Why Trump is Winning * [ ] Sensitive data sent in URL over HTTPS * [ ] Difference between correlation and causation * [ ] Paul Graham’s REFRAGMENTATION post * [ ] The relationship between Relaxation, Fun, and Performance * [ ] Michael Coates makes the argument that false negatives are way better than false positives because false positives create unnecessary work for his team * [ ] Brainstorm questions, not solutions Tools and projects * [ ] BLUTO * [ ] Serpico * [ ] Firmware Extraction from Craig Smith * [ ] Vulnerability Database Resources * [ ] IoT Attack Surfaces Project * [ ] RobotsDisallowed Project * [ ] Nowhere.net (CyberPunk) * [ ] EyeWitness * [ ] REST Security Cheat Sheet * [ ] Censys.io * [ ] GithubDorks * [ ] InstaRecon (DNS lookups, whois, shodan, google dorks, etc) * [ ] twfactorauth.org Announcements * [ ] Speaking at OWASP Cali end of January * [ ] Currently working on an ICS / SCADA primer Miscellaneous * [ ] Need to check out the Benedict Evans blog * [ ] Serial Podcast / Making a Murderer on Netflix * [ ] If you know any Army veterans who are getting out and want to get into InfoSec, let me know * [ ] Twitter account: CISSP Googling * [ ] Sam Altman (Startup Playbook) [ Subscribe to the Podcast: iTunes | Android | RSS ] Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 04, 2016
Security and Obscurity
611
[ Subscribe to the Podcast: iTunes | Android | RSS ] In this episode I explore the topic of Security and Obscurity by reading my popular essay on the topic. Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 13, 2015
T1SP: Episode 21
1095
[ Subscribe to the Podcast: iTunes | Android | RSS ] Topics for this episode: News * [ ] Stringing Shodan to exploitation * [ ] Why you need to check HaveIBeenPwned * [ ] Another DELL root cert hacked * [ ] ISIS OPSEC advice (data privacy, tor, crytocat, telegram, proton mail, gps features on mobile devices, etc.) They also mention not to use instagram because Facebook has a poor privacy record. * [ ] Obama wants to make it harder for terrorists to use technology to escape from justice * [ ] DHS giving companies free penetration tests * [ ] Issues in Honeywell gas detectors (path traversal and clear-text passwords) * [ ] UAE Bank declines to pay ransom, data released * [ ] Swift is open source * [ ] Amazon two-factor now available * [ ] Credit freeze vs. monitoring * [ ] Thousands of IoT devices sharing the same SSH keys * [ ] Many people predicting that 2016 is the year that Apple gets targeted by more attackers * [ ] Engine Immobilizers hackable over the internet Announcements * [ ] Speaking at OWASP Cali end of January * [ ] Currently working on an ICS / SCADA primer Productivity * [ ] Algorithmic learning [ Subscribe to the Podcast: iTunes | Android | RSS ] Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. * It’s better to listen via iTunes or with the player embedded above, but you can also download the sound file directly. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 13, 2015
Take 1 Security Podcast: Episode 20
1415
Topics for this episode: News and analysis * [ ] Ads using high frequency sound to communicate across devices. The ultrasonic pitches are embedded into TV commercials or are played when a user encounters an ad displayed in a computer browser. While the sound can’t be heard by the human ear, nearby tablets and smartphones can detect it. When they do, browser cookies can now pair a single user to multiple devices and keep track of what TV commercials the person sees, how long the person watches the ads, and whether the person acts on the ads by doing a Web search or buying a product. * [ ] Conficker in police body cameras (windows brute force tool) * [ ] Siri iOS data extraction. Tv reporter * [ ] The eye of Siri * [ ] Read top stories from the security news site * [ ] Expect to see concealed carry increase in the united states * [ ] Starwood hotels hit with POS malware * [ ] How to Deploy Splunk AD Monitoring in 437 Easy Steps * [ ] PCs being shipped with MiTM certs in them (supply chain security) * [ ] Java Deserialization flaws evidently affect more libraries * [ ] France looking at banning Tor, blocking public WiFi * [ ] Blackberry leaves Pakistan rather than provide backdoor * [ ] EFF launches bug disclosure program for Let’s Encrypt and HTTPS Everywhere * [ ] Flash is really on the way out Ideas and commentary * Personal Github Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. * It’s better to listen via iTunes or with the player embedded above, but you can also download the sound file directly. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Dec 07, 2015
Corporations Don't Want Employees
233
Companies don't want employees, and they're doing their best to get rid of them. We should be getting ready for this. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 17, 2015
Take 1 Security Podcast: Episode 19
1878
Topics for this episode: News and analysis * [ ] A couple of months into my job with IOActive * [ ] Paris Attacks: resilience vs. prevention * [ ] Updating the OWASP IoT Project (no longer the Top 10) It’s an umbrella project. * [ ] Adding to the IoT project the SCADA Top 10 List (read the list), and Nabil Ouchn is going to be project leader on that project * [ ] Pentagon farms coding to Russia * [ ] Crypto email service pays ransom, gets taken out anyway * [ ] Blackout Europe shows vulnerabilities in LTE. Forced leak of location within 2-KM radius. Were also able to block LTE and force 3G or 2G. * [ ] Onapsis talks SAP HANA vulnerabilities. They’re config issues, and aren’t patchable, and include: remote file writes, remote directory deletions, moving files to where they can be access remotely, remote command execution, and remote python execution. To fix, you have to upgrade to the latest version and reconfigure your system. Also two issues with the database that allow HTTP RCE and SQL RCE. * [ ] TPP : how did we even get an agreement that was secret in the first place. Forget the details. This should never be allowed to happen again * [ ] Linux ransomware now hitting websites (broken by Brian Krebs) * [ ] Linux.Encoder.1 has a predictable key for its ransomware, and a tool was released to decrypt victims’ systems. Good to know that even attackers make dumb encryption implementation mistakes. * [ ] Visio smart tracking turned on for 10 million users. Here was the pitch “revolutionary shift across all screens that brings measurability, relevancy and personalization to the consumer like never before!” * [ ] Ring-0 theory of devops: history of the o-ring. Small thing that everything else depends on. for serial tasks you need A players to have an A process. As you lower the whole thing tumbles down * [ ] The Chinese Great Cannon: so we know about the Great Firewall, now learn about the Great Cannon * [ ] Must read article: What ISIS Really Wants, by the Atlantic * [ ] Two must follows: Gunnar Peterson, and Benedict Evans. Gunnar is brilliant in security, and Benedict works for Adresesen Horowitz Updates and announcements * Hit me up at IOActive if you have any security consulting needs. Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. * It’s better to listen via iTunes or with the player embedded above, but you can also download the sound file directly. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Nov 16, 2015
Take 1 Security Podcast: Episode 18
1618
Topics for this episode: News and analysis * Sonar framework * Schneider Electric SCADA issues revealed at DEFCON * Ashley Madison hack, extortion will become more common, passwords added to SecLists * Hackers attack PR firm and manipulate stocks * Uber is quadrupling their security staff in 2015 * Android vulnerabilities lately Ideas and commentary * Business-based hacking: extortion-based hacking, ransomware, prediction-based hacking, PR releases, etc. Find the leverage, then execute the hack * My problem with threat intelligence * Optimal playlists for getting work done: baroque, no words, medium volume, 60 beats per minute * Ambient sound as two-factor, which goes to my idea of continuous authentication * How standardization and insurance will change security * Miller (mlr) is like sed, awk, join, cut, and sort, but for name:index data such as CSV * Participation in the OWASP IoT Project, Sasa Zdjelar is going to work on an IOT disposition project, Digicert is possibly working on a secure updates project, and we welcome others to add to the mix Updates and announcements * Vegas conferences: two talks, Blackhat Arsenal, DEFCON talk on IoT Attack Surface Areas, Caparser release * If you’re into IoT, be sure to check out Craig Smith’s podcast at IoT Weekly, and Bruce Sinclair’s IoT podcast as well * SecLists has been reorganized, go check it out * Kali Linux 2.0 is out: new kernel, based on debian, rolling release, go get it Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Aug 25, 2015
Mr. Robot Episode 3 Review
1112
[ NOTE: There are spoilers below, not just for this episode but for the show in general. ] Enough people have asked me to start doing reviews of Mr. Robot episodes that I’m going to have a go at it. The deciding factor was the fact that I had such a strong desire to write during the third episode. I’m going to start here with thoughts on the show in general, not just on episode 3. Mr. Robot in general The character The main protagonist is an interesting character. He is what the writer evidently wants to capture, or actually believes to be, the template for a true hacker, which is highly damaged. I am quite struck with the focus that is placed on how truly messed up he is. He has major drama with the way his father was killed. He largely hates society. He has deep personal depression. And he’s a user of narcotics. I’m left thinking along the lines of a Hemingway type of artist, where the best creativity (in this case hacking) comes from those wo are the most tortured internally. Painters, musicians, etc. We’re familiar with the template. This redeeming qualities, which the writers take equal efforts to highlight, are the desire to protect people, his love for the blonde girl, and a general but understated willingness to fight back against the soul-crushing force of our modern, consumerist society. I really enjoy how he is only actually going to see his psychiatrist because he’s trying to help her, and if she’s actually going to help him it’ll kind of be on accident. He deeply analyzes people and sees if they’re good, or weak, or in need of help, and then if they are he kind of hates them less because of this. And he is willing to use his superpowers to help them as a result, like when he pushed that guy out of his psychiatrist’s life. The tech Before going into the various problems, it must be said that the information security writing has been exemplary. I’d say definitely the best we’ve seen in either movies or “television” (whatever that is). That said, there are a number of missing links in the armor. On one of the first episodes, possibly the first, I noticed an IP address with a final octet in the 300’s. That’s just an editing miss, but it did take me out of the fantasy. In Episode 2, which I generally didn’t like, I was quite bothered by the destruction scene. Here’s what I think happened there. They wanted to do a destruction scene, they had it all rigged up, and they wrote the story so that he’d do a quick hack and then get spooked enough to do it. Then they show the infosec writer(s) the story component and they’re like, Um, no. There’s no way anyone of this skill level would be hacking from his actual IP address. And they’re like, Well, we need to do this scene. Most people will miss that, and the scene will be cool enough to make up for it. So the writer stomps out of the room mumbling about how they shouldn’t have hired him for authenticity if they were going to make such obvious mistakes, and they go with it. Who knows if that really happened, but that’s how I imagine it. Comments on modern society I also find the comments on modern society to be quite interesting. I think it’s a big part of the whole hacker feel. Hackers have always had this component to their mystique. Being counter-culture. Being underground. Fighting against the man. So the idea that everything is a conspiracy with the rich exploiting the poor, the strong exploiting the weak, and everything being about selling advertising and the dominance o... Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 19, 2015
Take 1 Security Podcast: Episode 17
1554
Topics for this episode: Announcements * [ ] New desk, new mic setup News * [ ] SSL vuln spoofing issue, requires mitm * [ ] Sleepy puppy XSS Payload Management Framework * [ ] Troy Hunt on tech presentations * [ ] Stock market attacked and taken down. Anonymous warned about it beforehand * [ ] OPM goes to 21.5 million cards; director steps down * [ ] People need to get fired for this stuff; it’s the only way anyone will care enough to do anything * [ ] National Guard announces data breach Commentary * [ ] Mr. Robot * [ ] Splunk buys Caspida * [ ] Securing web session ids, by Eran Hammer Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 12, 2015
Take 1 Security Podcast: Episode 16
409
Topics for this episode: * [ ] Hacking Team Hacked, show which oppressive governments bought their software * [ ] No exploits for non-jailbroken iPhone * [ ] The FBI spent 775K on Hacking Team software * [ ] Citi creating a digital currency, called Citicoin * [ ] Clinton attacking China on hacking, “Said they’re trying to hack into everything that doesn’t move.” * [ ] Eric Holder suggests that Snowden had a positive impact, and that an agreement could be reached * [ ] Critical bug in node.js patched that could lead to DoS * [ ] MasterCard looking to do facial scanning to authenticate purchases * [ ] FBI is offering 4.3 million for help finding top hackers * [ ] A petition for Ellen Pao to leave Reddit has topped 150K signatures Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jul 07, 2015
Take 1 Security Podcast: Episode 15
857
Topics for this episode: * iOS flaw * The Chinese hacking campaign against the US * Breach at Recorded future * Hacking cars through key fobs * NSA/GCHQ hacking of people through security software * Snowden’s documents in the hands of the Chinese and Russians * Samsung re-enabling Windows Update * Mr. Robot * Blackhat/DEFCON Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 29, 2015
Take 1 Security Podcast: Episode 14
1371
Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 15, 2015
Take 1 Security Podcast: Episode 13
2575
Notes * The intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jun 12, 2015
Take 1 Security Podcast: Episode 12
828
Play Podcast START CONTENT * Singtel buys Trustwave * Snowden does interview with John Oliver * CheckPoint buys Lacoon * Everyone’s trying to do everything, which gives the big people a major advantage * China melted GitHub * MiTM’d Baidu traffic and modified its analytics JavaScript to make constant requests to GitHub * They did it because GitHub was hosting two mirror repos for content that is banned in China * Also highlights the need for encryption, so that the JS couldn’t have been injected * Obama just came out and said that if you attack us, we’ll sanction you * How does that work exactly, when China makes everything we use? * Then we just found out Russia hacked us through the State Department issue * A major vulnerability was revealed in Inngate routers used in the US and Europe. * It allows attackers to browse and write to the root file system of the devices, changing configuration, distributing malware, etc. * Mostly used in US and European hotels * Attackers are compromising IRS accounts in large numbers. Claim yours to avoid it happening to you * Featuring Brooks Garrett * He’s a friend and co-worker going back 8 years * He’s the smartest IT guy I’ve ever known: sick programmer, Linux ninja, database, networking, everything. Full stack, real deal. * He’s a volunteer firefighter * He blogs at http://brooksgarrett.com: latest posts are Remote Streaming with Pi and MPD, Nagios SMS alerts with Amazon SNS, Cleaning Passwords from Logs, Fixing OhMyZSH prompts in PuTTY * His Twitter is @brooksgarrett * If you’re not following his stuff, you should be END CONTENT Notes * Intro track is from one of my favorite EDM artists: Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Apr 08, 2015
Take 1 Security Podcast: Episode 11
1017
Play Podcast START CONTENT * Twitch, a game streaming service owned by Amazon, was hacked last week * Passwords, emails, usernames, addresses, phone numbers, dates of birth * Amazon bought them last year for almost 1 billion dollars * Bar Mitzvah attack on TLS * Requires that you can sniff traffic * Basically an RC4 problem * Solution is to remove it from your supported algorithms * GitHub Has been hit by a massive DDoS attack * Apparently from China * CSRF vulnerability found in a wind turbine * Allowed you to pull usernames and passwords * Also allowed the password to be changed for the default user, which had admin access * CSRF vulnerability exposes Hilton customer accounts * There was an account rotation issue where you could gain access to their account as long as you could guess their 9-digit username * Snowden says IT workers now the targets of spies * They’re not going after their information, but to use them for access to networks * Premera hacked on same day as Blue Cross (January 29th) * Same story: encryption, know your network, etc. * Also same story: health data is harder to clean up from because it involves PII that cannot easily be changed * More speculation around these attacks is that they’re data gathering for larger attacks on government networks * Apple Acquires FoundationDB * Fast NoSQL database probably to be used for its increasing entry into the services market * Researchers use heat to breach air-gapped systems * Everyone knows that an airgap is the best defense * Ben-Gurion University came out with BitWhisper * Now bidirectional using malware on both systems that controlled heat creation and detection * Only 8-bits per hour * BioCatch, Zumigo, Alibaba release tools to identify users * I used to work with a technology called BioPass * Uses what you do with your mouse, scrolling, how you smile via selfie, compares habits, your current location, etc. Similar to existing fraud detection just with more data points * Really cool tech, needs to be used with the right authentication level * Korea investing 5B in IoT and Smart Cars * Bring Your Own IoT * Recording audio and video are getting increasingly easy * Sensitive meetings might become dead zones soon, and perhaps even sensitive work areas * Some people will say that we already have this risk, but they key is the ease with which it can be done END CONTENT Play Podcast Notes * I skipped a week due to travel in Asia. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 30, 2015
Take 1 Security Podcast: Episode 10
1321
Play Podcast START CONTENT * There was another SQL Injection bug found in SEO by Yoast * It required admins to click a malicious link * Was patched quickly * It’s the plugins that make WordPress vulnerable * Attackers are targeting gamers for ransomware * Virlock is one version of ransomware that not only locks the screen, but infects files * It’s also polymorphic, so it changes itself every time it runs * TeslaCrypt goes after gamers, which seems super smart because they are often addicted * The Hello Barbie doll is recording kids voices and sending the recordings over the Internet for voice recognition * I get asked a lot about what to do about this kind of stuff * Start by making a list of everything that can record voice or audio in your home, and determine what kind of controls you have on them * Assume the worst, even though it’s probably not that bad * US industrial systems attacked 245 times between October 2013 and September 2014 * Most attacks were against Critical Manufacturing and Energy * Biggest vectors were spear phishing and port scanning * CloudFlare aims to defeat DDoS with Virtual DNS * They want to proxy DNS before it hits customer name server * The CIA supposedly tried to hack Apple hardware * The article has come under extreme scrutiny * Going to be on the Security Weekly podcast with Pau * Hillary Clinton’s email account dram * OpenSSL is getting an audit * Bout time * Wikimedia is suing the NSA over surveillance * Spoofing the boss is the best way to phish someone, evidently * Had a great time at CactusCon in Phoenix * Did a talk with Jason and saw Dave’s keynote * Dave’s keynote was about struggling with the basics, not APT * He asked when a major breach was NOT a dumb mistake * Someone’s looking to make a Snowden Phone * Looks like I’ll be on the Security Weekly podcast with Paul * Going to talk about IoT security and my our OWASP project END CONTENT Play Podcast Notes * Comments welcome on content and format, as usual. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 16, 2015
Take 1 Security Podcast: Episode 9
779
START CONTENT * Sorry about the audio last week; wireless headsets don’t compare to the Yeti * The CIA is focusing on cyberespionage in its new management * Anthem is refusing an audit by the OIG office–an org that audits health care groups that provide services to federal employees * Nothing says I’m guilty like refusing an audit * Reminds me of the Russians refusing the crash investigation in Game of Cards * There’s been a possible credit card breach at the Mandarin Oriental hotel chain * The incident was reported by Brian Krebs * Three people were indicted in the Epsilon hack * Resulted in around 1 billion email addresses being stolen * Dave Aitel thinks junk hacking is a waste * Basically hacking your blender or whatever * In my opinion he’s missing the point that most conferences are like this * I think there’s a hierarchy of talks * Create new defense tool based on new defense idea * Create new defense idea * Create new attack tool based on new attack idea * Create new attack idea * Create new tool for existing attack or defense idea * Describe existing attack or defense idea * Microsoft has reported it’s vulnerable to FREAK as well, making it even more serious * FREAK has proved to be less alarming than previous SSL vulns simply because of the difficulty of attack END CONTENT Play Podcast Notes * I think I’m going to standardize the intro and outro so that I only end up recording the actual story content each week. * Any recommendations on what else you’d like to see would be appreciated. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 09, 2015
Take 1 Security Podcast: Episode 8
985
START CONTENT * New SSL attack called FREAK * Has to do with falling RSA back to a deprecated and weak level * Requires the client and server are both vulnerable * The solution is to patch * Many orgs will also want to note which servers were vulnerable * The lesson is that you don’t reduce security to increase it * Backdoors x time = regret * Using Ruby’s Open-URI could be dangerous * open-uri monkeypatches kernel.open * open(params[:url]) can execute |ls * Hilary Clinton used a personal email address and did not store correspondence on government servers for her entire 4 years as Secretary of Defense * This seems highly suspect * First you’re putting that data at risk in a personal system * Second you’re obviously trying to hide your conversations * Facebook can access your account without your password * Google no longer encrypting Lollipop by default * Was one of the main selling points for 5, and now it’s gone * They said it was simply a driver issue * DLink routers have a remote command injection bug * Could allow DNS hijacking and other attacks * ISIS has threatened some members of the Twitter team for disabling their accounts * This really puts a point on public presence for me * I’m a strong proponent of the belief that the way to avoid attack is to avoid being a target, not to be hard to attack once people want to * This works for personal attacks, not for countries obviously * There has been some major fraud happening with people connecting stolen cards to ApplePay * The issue isn’t a security problem with ApplePay, but rather with standard bank / card security issue * Up to 18.8 non-Anthem customers exposed in the Anthem breach * This is in addition to the 80 million actual anthem customers * GoPro vulnerability on its website exposes customer Wi-fi passwords * Expect more of this * Uber took over 5 months to issue a breach notification * There was a breach of driver names and license numbers that they just now disclosed * Seagate NAS vulnerability allows unauthorized root access * This raises the cloud storage issue I blogged about last week END CONTENT Play Podcast Notes * Sorry about my voice on this one. I’m a bit sick. :( Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Mar 03, 2015
Take 1 Security Podcast: Episode 7
520
START CONTENT * New stuxnet like piece of malware was discovered * Was found by Kaspersky * Has infected thousands of computers, mostly in Iran * The malware is the most advanced ever found * Can hide on the computer even after reinstall * Many of the names used in the application are known NSA codenames, such as GROK * Wired said those targeted groups were Islamic scholars * The group is called equation group due to the encryption used to hide itself * Car washes hacked by Billie Rios * Bad web software * Default passwords * Submit POST requests * Battery power can be used to track Android phones * Based on the power you use from cell phone tower usage * Obama sides with encryption against government groups * Lenovo laptops spying on you * Can we just say it’s dumb to use things produced in China? END CONTENT Play Podcast ### Notes * Sorry about the pops in the audio. My desk randomly makes loud noises. I’m working on it. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 24, 2015
Take 1 Security Podcast: Episode 6
749
START CONTENT * Ukrainian banks hacked for up to 1 Billion dollars * Evidently installed malware on bank admin machines using phishing * Not sure they have an FDIC * As if the Ukraine didn’t have enough problems * 10 million password project * Mark Burnett posted 10 Million password combinations * Went through a long explanation of why he was doing it * I’ve broken them up and put them in the SecLists project * Jeb Bush leaks personal data * Anthem may have been Heartbleed * Could have been China, but who knows * Reminder about talking about things without information * It’s best to just leave it alone * HP released Home Security Systems report * We found 10/10 systems vulnerable to account harvesting * DARPA Dark Web Search Engine * Stuff not indexed by Google * Tor services, etc. * Obama creating new threat intelligence agency * Unified organization for tracking threats * Looking to partner with private industry as well * Anthem and Cyberinsurance * Up to 200M in cyberinsurance * Probably won’t cover it, but it’ll be a good test of usefulness * Facebook lets you pick who manages your account when you die * Facebook threat sharing program * Uber lost and found database was online with personal data in it * Basically, if you lose something in a car, they know who you are, and they keep your stuff for you * But they had the database exposed online END CONTENT Play Podcast Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 17, 2015
Take 1 Security Podcast: Episode 5
437
START CONTENT * Anthem, the second largest healthcare company, had a major breach * They lost around 80 million socials, addresses, emails, etc., which is roughly double the Target breach * There’s speculation that it was China, trying to penetrate government, but it’s early * Watch for phishing scams related to it * The megabreaches continue…weee! * A WordPress plugin called FancyBox had a serious compromise in it last week, which affected thousands of websites * If you’re going to run WordPress, understand that Plugins are the best way to get yourself hacked * Specifically, the type of plugins that handle user input and do something with it that affects the site’s output * Image manipulation plugins have been particularly vulnerable, usually to XSS * There was another critical Flash vulnerability this week * Like I said last week, and the week before, there’s a first time for everything * Three bug hunters at HP received the 125,000 prize for finding a major vulnerability in Internet Explorer * Because they work for HP they couldn’t take the cash, and instead donated it to charity * Microsoft released Outlook for iOS last week, which looks pretty slick * Unfortunately it is riddled with security flaws * Recommendation: wait for a few updates, and for them to get a security assessment END CONTENT Play Podcast Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 08, 2015
Take 1 Security Podcast: Episode 4
473
START CONTENT * Ghost bug in PHP could affect millions of servers * Flaw is in glibc, which is extensively by all Linux distributions * Patch and reboot using yum or aptitude * The US Army Released DShell, a malware forensics tool * This is an interesting trend where we see tons of formerly secret groups flock to Github. Great to see * Reddit released its first transparency report last week * Says it received 55 requests for user information * Says it complied with 64% of state and federal requests * Says it received 218 requests for content removal, and complied with 31 percent of those * I am pleased to see them releasing these numbers, and I hope more organizations do the same * The GHCQ was using a program called BADASS to collect data leaked by games such as Angry Birds * Luckily it only affected the 11 people still playing that game * Russian dating site, Topface, got hacked for 20 million usernames * The FBI busted up a Tom Clancy book plot in New York City * The plan was to get information about wall street trading algorithms and hopefully destabilize the markets * All they managed to do was embarrass themselves by commenting on how they couldn’t recruit young women * China is demanding to be able to build backdoors into any code sold to its banking sector * Some people call this news, but with China we just call this Wednesday * Apple released a Yosemite update that fixed Thunderstrike, among other things * Anonymous and Lizard Squad are going after each other * Anonymous is the famous hacking group known for all sorts of things * Lizard Squad is known for taking down the XBox and Playstation networks around Christmas time * Anonymous DDoS’d the Lizard Squad website, and then Twitter suspended a couple of their handles * Interesting to see these groups going after each other * BMW and the internet of things is in the news, with BMW owners receiving an automatic push to around 2 million cars * A vulnerability was present that could allow attacks to spoof cell towers and possibly control onboard systems * BMW pushed a patch that ensures all such communications go over HTTPS * It’s interesting that, like printers, cars are likely to become a primary IoT platform just because there are so many of them * The key is to figure out what normal things exist in the world today en mass, and then imagine those things being connected * Printers, cars, furniture, clothing, etc. It’s the regular stuff that makes it interesting because of how much attack surface they represent, and how prevalent the perspective they’ll offer into our daily lives END CONTENT Play Podcast Notes * Intro is from Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Feb 02, 2015
Take 1 Security Podcast: Episode 3
651
START CONTENT * There was an issue with the Marriott website that exposed reservations and payment information. It’s now been fixed * Police are now using a new radar to see into peoples’ homes without a warrant * Security budgets are reportedly going up due to the mega-breaches in 2014 * Also leading to higher pay for CIOs * Anecdotally, I’d say it’s a pretty good time to be in infosec * A new security startup, PFP Cybersecurity, uses power consumption to detect malware * Meant initially to be used for SCADA type systems * The US hacked North Korean computers back in 2010 * This is reportedly the reasons we were so sure they hacked Sony * Recently leaked documents from Snowden show heavy offense * Snowden recently talked to Schneier at Harvard about a number of things * The NSA is becoming increasingly offensively oriented vs. defensive * The NSA supposedly uses compromised systems as jump points * Snowden said most NSA hackers are junior enlisted with limited skills * Russia reportedly hacking for geopolitical gain, not just money * Millions of gas stations could be at risk of shutdown * The Automated Tank Gauges can be remotely accessed by attackers * Could be manipulated to cause alerts * Potentially could be used to stop the flow of fuel * Microsoft gave Charlie Hebdo data to FBI in 45 minutes * Starwood hack based on bad passwords * Bad passwords, password re-use, and a brute forcing tool * Account harvesting is rough: user enumeration, weak passwords, and lack of account lockout * Flash has another major exploit. Update your stuff. * People continue to be worried that the President’s crackdown on hackers could hurt security professionals * Congress is meeting on the 27th of January to discuss breach notification * The wireless in around 2 million cars is highly vulnerable to attack * A polish company has created Mouse-Box, which is an entire computer inside of a mouse enclosure END CONTENT Play Podcast Notes * Sorry about the noise part way through. My girl walked in and started unpacking groceries. But when I say one take, I mean one take. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 25, 2015
Take 1 Security Podcast: Episode 2
946
START CONTENT * UK police arrest 18-year-old in connection to Playstation and XBox attack * Major ASUS router bug * Local users can take full control without a password * Biggest issue there seems to be DNS hijacking * Legislative attacks on infosec profession and encryption * Anti-hacking law language ambiguous “according to owner” * Obama is said to agree with Cameron, but it’s complicated * Evidence of a plot is different than outlawing encryption * There’s other talk about it being illegal to see hack data * French reporting 19,000 DoS attacks since the shootings * Anonymous is going after ISIS and others * An attack on free speech is an attack on Anonymous * Google releases another Windows flaw that they didn’t fix * Verizon API vulnerability exposes customer email addresses * Issue was with a mobile API used by Android devices * Allowed him to retrieve peoples’ emails and send emails as them * On whether we should trust the FBI regarding the Sony attack * We now find out the attribution came from a previous NSA hack * It’s hard to criticize without data * This doesn’t mean they did it, or that the FBI is always right, or that they should always be trusted * It means be cautious when you don’t have any information, and the person you’re criticizing has all of it * Free speech and the Paris attacks * Where is the line for free speech? * I think it comes down to safety and taste * You can’t yell fire, and art matters * Quote of the week * No one is as happy as they seem on Facebook, as depressed as they seem on Twitter, or as employed as they seem on LinkedIn. END CONTENT Play Podcast Notes * I have a consolidated InfoSec news feed (here) that I use as a source for headlines. Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 19, 2015
Take 1 Security Podcast: Episode 1
230
Subscribe to the Podcast: iTunes | Android | RSS START HEADLINES * Google drops security updates for Android 4.3 and below * This is a problem since that’s most of the install-base * Only .1% of users are on Android 5 * Microsoft and Adobe Push Critical Security Fixes * Seems like Google’s been messing up recently, with their attack on Whitehat for the Aviator stuff, their dropping security updates for Android, and now this early release of a bug before there was a fix. * Obama is asking for the removal of a number of state laws that make it harder to get good broadband in the US. * Obama is asking for quicker laws around the disclosure of hacks * One potential law is the Personal Data Notification and Protection Act, which would require companies to notify within 30 days if they get hacked. * The CENTCOM Twitter account got hacked a couple of days ago by some pro-ISIS folks * Obama is looking to improve the sharing of cybersecurity information as a response to the hack * Sammy Kamkar has released a keylogger for Microsoft wireless keyboards, called Keysweeper * David Cameron wants to make encrypted messaging apps illegal * 1) I’m not sure how he thinks this is possible Subscribe to the Podcast: iTunes | Android | RSS Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.
Jan 14, 2015