SecuraBit
By SecuraBit
To listen to an audio podcast, mouse over the title and click Play. Open iTunes to download and subscribe to podcasts.
Podcast Description
SecuraBit is an information security podcast that features some of the biggest names in the industry who come on to talk to us about what they're up to. We also engage in both light and heavy discussion on the latest news and goings on in the community. We aren't intended to be an authoritative source of information if you're writing a paper for some infoseec class inc ollege. Our goal is to bring the community closer together and to help people understand who the movers and shakers are in the industry, as well as to entertain and have fun! We are: Anthony Garther, Chris Gerling, Chris Mills, Jason Mueller, Andrew Borel, and more folks behind the scenes who help us be unique! Please visit our website at http://www.securabit.com and send questions/comments to feedback@securabit.com. You can also find us in IRC at irc.freenode.net #securabit and follow us on twitter at @securabit. Thanks!!
| Name | Description | Released | Price | ||
|---|---|---|---|---|---|
|
1 |
ExplicitSecuraBit Episode 104: Cackalacky Goodness! | Hosts Chris Gerling – @secbitchris Mike Bailey - @mpbailey1911 Andrew Borel – @andrew_secbit Guests Dr. Tran Emwave Professor Farnsworth News Items ANONYMOUS CLAIM: ‘WE HAVE ACCESS TO EVERY CLASSIFIED DATABASE IN THE U.S. GOVERNMENT’ http://www.theblaze.com/stories/anonymous-claim-we-have-access-to-every-classified-database-in-the-u-s-government/ Pentagon boosts contractor cybersecurity program http://thehackernews.com/2012/05/pentagon-boosts-contractor.html "The effort, known as the Defense Industrial Base ("DIB") program, is a voluntary information-sharing program in which the Department of Defense shares "unclassified indicators and related, classified contextual information" about cyber-attacks and threats with defense contractors.” “In exchange, defense contractors report known intrusions and can receive forensics analysis and damage assessments from the government after those attacks. In an optional part of the program, the DIB Enhanced Cybersecurity Services, the government shares additional classified threat and technical data with defense contractors and Internet service providers. " 17 year old Teenager arrested over TeamPoison hacking attacks http://thehackernews.com/2012/05/17-year-old-teenager-arrested-over.html "A teenage boy has been arrested on suspicion of being a member of "TeamPoison", a computer hacking group that has claimed responsibility for 1,400 offences including an attack on the phone system of Scotland Yard's counter-terrorism unit last month. These include attacks on the United Nations, the UK Anti-Terrorist Hotline, MI6 and RIM, as well as politicians including Nicolas Sarkozy and Tony Blair.” “The boy, who police suspect used the hacker nickname 'MLT' and was a spokesman for TeamPoison, was interviewed at a local police station on offences under the Computer Misuse Act on Wednesday. The arrest is part of an ongoing investigation by the Police Central e-Crime Unit (PCeU) division of the Metropolitan Police into various hacking gangs who have made headlines in the last year or so.” “TeamPoison’s highest-profile attack was mounted against Scotland Yard’s counter-terror hotline last month, has also claimed responsibility Distributed Denial of Service attacks against banks in collaboration with Anonymous, another “hacktivist” group with similar anti-corporate and anti-authority politics.” 55,000+ Twitter Accounts Hacked, How To Tell If Yours Was Among Them http://www.technobuffalo.com/internet/social-networking/55000-of-twitter-accounts-hacked-how-to-tell-if-yours-was-among-them/ How to Securely Share a Password with Someone Using LastPass http://lifehacker.com/5909321/how-to-securely-share-a-password-with-someone-using-lastpass Not a bad way to avoid "hey, what's the password to $server" and yelling the answer over the cubicle walls for all to hear. Other ways to securely share or transfer passwords/acess FBI Wants Backdoors in Facebook, Skype and Instant Messaging http://www.wired.com/threatlevel/2012/05/fbi-seeks-internet-backdoors/ Everyone Has Been Hacked. Now What? http://www.wired.com/threatlevel/2012/05/everyone-hacked/ ‘Unknowns’ Hacking Group Hits NASA, Air Force, Harvard and Others in ‘Hacking for Good’ Effort http://www.theblaze.com/stories/unknowns-hacking-group-hits-nasa-air-force-harvard-and-others-in-hacking-for-good-effort/ Use Our Discount Codes Use code SecuraBit_Connect to get $150.00 off of ANY training course. The discount code is good for all SANS courses in all formats. FREE exam attempt with corresponding course purchase for SANSFIRE 2012 with code SecuraBit_SFGIAC Use code 36449 for 20% off your Syngress order! Upcoming events http://www.secore.info Links http://www.carolinacon.org http://www.rvasec.com http://www.richsec.com http://www.gh0st.net Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast – http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Av | 5/18/12 | Free | View In iTunes |
|
2 |
ExplicitSecuraBit Episode 103: Pockets full of Ownsies | Hosts Chris Gerling –@secbitchris Chris Mills - @chrisam Andrew Borel – @andrew_secbit Guests Tom Eston - @agent0x0 Mobile App/Device Security and Security Justice. Topics Lab Contests Banter News Items Skype User IP Address Disclosure http://pastebin.com/rBu4jDm8 Google knew street cars were slurping wifi (Marius Milner was the engineer, of NetStumbler fame) http://www.theregister.co.uk/2012/04/30/google_slurp_ok/ http://www.theregister.co.uk/2012/05/01/slurp_engineer_doe_named/ Mozilla is first major tech company to denounce CISPA http://news.cnet.com/8301-1009_3-57425719-83/mozilla-is-first-major-tech-company-to-denounce-cispa/?tag=txt;title Mac Flashback trojan still making $10,000 a day http://www.darkreading.com/insider-threat/167801100/security/attacks-breaches/232901268/apple-mac-flashback-trojan-gang-still-making-money.html Indictment Returned for Jeremy Hammond in Chicago Anonymous case http://abcnews.go.com/Technology/wireStory/indictment-returned-nyc-computer-hacking-case-16264667#.T6HRSqtSTlw Use Our Discount Codes Use code SecuraBit_Connect to get $150.00 off of ANY training course. The discount code is good for all SANS courses in all formats. FREE exam attempt with corresponding course purchase for SANSFIRE 2012 with code SecuraBit_SFGIAC Use code 36449 for 20% off your Syngress order! Upcoming events http://www.secore.info Links http://www.rvasec.com http://www.richsec.com http://www.gh0st.net Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast – http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available – http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 5/3/12 | Free | View In iTunes |
|
3 |
ExplicitSecuraBit Episode 102: The Last Train | Please join us as we kick it old school with various news and banter, as well as a special interview with Chris Sullo! Our show notes can be found here. | 4/24/12 | Free | View In iTunes |
|
4 |
ExplicitSecuraBit Episode 101: The Survey Says! | Join us as we talk with Robin Wood (@digininja) about his recent survey of IT Security professionals! Our show notes can be found here: http://wiki.securabit.com/ShowNotes/EP101 | 3/30/12 | Free | View In iTunes |
|
5 |
ExplicitSecuraBit Episode 100: Double Header with WPS and Forensics! | Join us as we interview Craig Heffner of Tactical Network Solutions regarding the recent WPS vulnerability and his Reaver tool, and as we also interview Harlan Carvey whose latest Windows Forensic Analysis Toolkit book was recently released. Our show notes can be found here: http://wiki.securabit.com/ShowNotes/EP100 | 3/11/12 | Free | View In iTunes |
|
6 |
ExplicitSecuraBit Episode 99: 99 Bottles of Pwn on the Wall! | Join us as we interview the CTO of Silicum Security about ECAT, Pascal Longpre! Please refer to our wiki for full show notes. | 2/27/12 | Free | View In iTunes |
|
7 |
ExplicitSecuraBit Episode 98: Adapting to Our Internet! | Please join us as we talk about cybercrime, botnets, and the ever changing internet with special guest Brian Krebs! Our show notes are now on our wiki: http://wiki.securabit.com/ShowNotes/EP98 | 2/8/12 | Free | View In iTunes |
|
8 |
ExplicitSecuraBit Episode 97: Ron Gula and Cyber Warfare! | Please join us as we interview Ron Gula, Co-Founder of Tenable Security! We also discuss various cyber warfare topics including Al Qaeda hacking, SCADA, and our own Pentesting lab offering for the community and for hackerspaces! http://wiki.securabit.com/ShowNotes/EP97 | 1/25/12 | Free | View In iTunes |
|
9 |
ExplicitSecuraBit Episode 96: Year in Review! | Join us as we talk about 2011! Please visit our wiki for full show notes! | 1/3/12 | Free | View In iTunes |
|
10 |
ExplicitSecuraBit Episode 95: Words with Alec Baldwin! | Join the crew as they interview special guest Marisa Fagan of SECore! Please visit our wiki for full show notes! | 12/16/11 | Free | View In iTunes |
|
11 |
ExplicitSecuraBit Episode 94: Late Night with Securaline! | Join us as we talk some lab shop with Mike Bailey and the rest of the crew! Please visit http://wiki.securabit.com/ShowNotes/EP94 for our show notes! | 12/6/11 | Free | View In iTunes |
|
12 |
ExplicitSecuraBit Episode 93: Playing in the Sandbox! | Join us as we interview Nick Keuning from GFI about their Sandbox solution! Our show notes are now housed on our wiki. Please visit this link to view them! | 11/5/11 | Free | View In iTunes |
|
13 |
ExplicitSecuraBit Episode 92: Hammers, Nails, and Screwed! | On this episode we had special guest Christofer Hoff on to discuss Cloud and Virtualized security. We touched on some pretty amazing points and we hope you'll enjoy this show! Please visit our wiki for full show notes! | 10/20/11 | Free | View In iTunes |
|
14 |
ExplicitSecuraBit Episode 91: The Show That Almost Wasn’t | Please visit our Wiki for full show notes | 10/10/11 | Free | View In iTunes |
|
15 |
ExplicitSecuraBit Episode 90: Ghosts and Cylons | Join us as we interview Saviour Emmanuel Ekiko, author of the Ghost Phisher tool. Show notes are now at our wiki: http://wiki.securabit.com/ShowNotes/EP90 | 9/26/11 | Free | View In iTunes |
|
16 |
ExplicitSecuraBit Episode 89: Executables or Executables? | Hosts Chris Gerling - @secbitchris Chris Mills - @chrisam Andrew Borel - @andrew_secbit Tony Huffman - @myne_us Guests Rafal Los - @Wh1t3Rabbit http://h30499.www3.hp.com/t5/Following-the-White-Rabbit-A/bg-p/sws-119 Topics Vericode vs Oracle Root Certificate Authorities Anonymous Item X Use Our Discount Code Use "Connect_SecuraBit" to get $150.00 off of ANY training course. The discount code is good for all [...] | 9/13/11 | Free | View In iTunes |
|
17 |
ExplicitSecuraBit Episode 88: How to get laid! | We are now doing our show notes inside of our wiki. If you have suggestions or comments please feel free to leave them here. http://wiki.securabit.com/ShowNotes/EP88 Thank you for listening! | 8/11/11 | Free | View In iTunes |
|
18 |
ExplicitSecuraBit Episode 87: Don't link my RF link! | Check out our wiki for show notes! http://wiki.securabit.com/ShowNotes/EP87 | 7/31/11 | Free | View In iTunes |
|
19 |
ExplicitSecuraBit Episode 86: Securing Layer 8 | Join us as we interview Lance Spitzner, Technical Director for the SANS Securing the Human Program. Show notes are now at our wiki: http://wiki.securabit.com/ShowNotes/EP86 | 7/24/11 | Free | View In iTunes |
|
20 |
ExplicitSecurabit SEG style #2 JOP with Tyler Bletsch | Hosts myne-us @myne_us Jacob hammack @hammackj Guest Host Dave Kennedy @dave_rel1k Guest Dr. Tyler Bletsch (Tyler.Bletsch {at} gmail.com) Tyler's former security group at NC State University under Xuxian Jiang - http://www.csc.ncsu.edu/faculty/jiang/ Topics JOP programming Turing complete exploit development (http://en.wikipedia.org/wiki/Turing_completeness) links JOP JOP technical report ftp://ftp.ncsu.edu/pub/tech/2010/TR-2010-8.pdf JOP academic paper http://www.csc.ncsu.edu/faculty/jiang/pubs/ASIACCS11.pdf Tyler's dissertation (JOP in x86 and MIPS, and a few other techniques) http://repository.lib.ncsu.edu/ir/bitstream/1840.16/6698/1/etd.pdf ROP http://cseweb.ucsd.edu/~hovav/dist/rop.pdf http://blog.zynamics.com/2010/03/12/a-gentle-introduction-to-return-oriented-programming/ http://sandsprite.com/CodeStuff/Understanding_imports.html http://j00ru.vexillium.org/?p=893 http://www.braid-game.com/ http://qubes-os.org/Architecture.html If you like the intro music and the closing music check out http://dualcoremusic.com/nerdcore/ break music http://www.audiomicro.com/saxophone-piano-drums-short-jazz-introduction-royalty-free-stock-music-94 | 7/16/11 | Free | View In iTunes |
|
21 |
ExplicitSecurabit SEG style #1 | Hosts myne-us @myne_us Jabob hammack @jhammack Guest Dave Kennedy @dave_rel1k http://www.derbycon.com/ http://www.secmaniac.com/ http://seorg.org/ Topics is BOF dead what got you started what are some of things that helped you get started Heap osx exploitation and more.... links http://advancedwindowsdebugging.com/ https://net-ninja.net/blog/?p=293 http://www.exploit-db.com/ http://www.offensive-security.com/live-information-security-training/ Intro by http://dualcoremusic.com/nerdcore/ @dave_rel1k | 7/2/11 | Free | View In iTunes |
|
22 |
ExplicitSecuraBit Episode 84: Tech Talk with Scott Moulton | SecuraBit Episode 84: Tech Talk with Scott Moulton June 15, 2011 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Tony Huffman – @myne_us Guests: Scott Moulton - @scottamoulton - http://www.myharddrivedied.com/ Use our discount code "Connect_SecuraBit" to get $150.00 off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events #BSidesLasVegas (3-4 August 2011) BlackHat Vegas (3 - 4 August 2011) DEFCON 19 (4 - 7 August 2011) #BSidesLA Los Angeles, CA (18 - 19 August 2011) #BSidesMO(21 Oct 2011) #BSidesNewDelhi (22 - 23 October 2011) VB Barcelona October 2011 Links: http://www.securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 6/28/11 | Free | View In iTunes |
|
23 |
ExplicitSecuraBit Episode 83: Hey look its the Human Hacker!!! | SecuraBit Episode 83: Hey look its the Human Hacker!!! June 1, 2011 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling - MIA Christopher Mills – @thechrisam - MIA Jason Mueller – @securabit_jay - MIA Andrew Borel – @andrew_secbit Tony Huffman – @myne_us Tim Krabec - @tkrabec Guests: Chris Hadnagy ( @humanhacker on Twitter ) discusses Social Engineering: The Art of Human Hacking General topics: Social Engineering: The Art of Human Hacking http://www.amazon.com/Social-Engineering-Human-Hacking-ebook/dp/B004EEOWH0/ref=tmm_kin_title_0?ie=UTF8&m=AG56TWVU5XWC2 Social-Enginer.org - variety of guests who use social enginering Does Social Engineering Always Involve Deception? Marketing or Social Engineering Stereotypes online help from skype :) <LOL Social Engineer CTF for DEFCON 19 Five Key Points of Social Engineering Links to News: http://www.rollingstone.com/music/news/hackers-plant-fake-tupac-story-on-pbs-website-20110531http://www.redstate.com/neil_stevens/2011/05/28/anthony-weiner-and-his-eponymous-twitter-hack/ http://threatpost.com/en_us/blogs/report-l3-warns-employees-attacks-using-compromised-securid-tokens-060111 Use our discount code "Connect_SecuraBit" to get $150.00 off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events #BSidesStJohns St. John's, NL (10 Jun 2011) #BSidesCT Meriden, CT (11 Jun 2011) FIRST Austria (12 - 17 June 2011) #BSidesVienna(18 June 2011) Toorcon (18 - 19 June 2011) #BSidesLasVegas (3-4 August 2011) BlackHat Vegas (3 - 4 August 2011) DEFCON 19 (4 - 7 August 2011) SANS Boston 2011(8 - 15 August 2011) #BSidesLA Los Angeles, CA (18 - 19 August 2011) #BSidesMO(21 Oct 2011) #BSidesNewDelhi (22 - 23 October 2011) VB Barcelona October 2011 Links: http://www.securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 6/14/11 | Free | View In iTunes |
|
24 |
ExplicitSecuraBit Episode 82: Totally Rad Man! | SecuraBit Episode 82: Totally Rad Man! May 18, 2011 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Tony Huffman – @myne_us Guests: Carl Herberger from http://www.radware.com/ General topics: DDOS: Recent attacks from groups like anonymous , attack vectors, technique information and how it can effect you. Signatures: Signature based detection and the effects it had on todays security General security: Some general discussion on security Securibit exploit development group (SEG) starting up blog post coming soon. NEWS: PSN hacked again! : Just two days after the PlayStation Network was restored after a near month-long outage, the PSN password page has apparently been exploited. According to reports, the exploit allows other users to reset your account password using only your e-mail address and date of birth. This personal data was made available to hackersduring the initial PSN attack. http://arstechnica.com/gaming/news/2011/05/report-playstation-network-passwords-exploited-accounts-compromised.ars international_strategy_for_cyberspace.pdf http://www.whitehouse.gov/sites/default/files/rss_viewer/international_strategy_for_cyberspace.pdf Backtrack 5 is out http://www.backtrack-linux.org/ Facebook privacy demo gets guy arrested in austrelia http://www.net-security.org/secworld.php?id=11045 Microsoft patch tuesday http://www.microsoft.com/technet/security/bulletin/ms11-may.mspx Use our discount code "Connect_SecuraBit" to get $150.00 off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events #BSidesDetroit (3 - 4 Jun 2011) #BSidesStJohns St. John's, NL (10 Jun 2011) #BSidesCT Meriden, CT (11 Jun 2011) FIRST Austria (12 - 17 June 2011) #BSidesVienna(18 June 2011) Toorcon (18 - 19 June 2011) #BSidesLasVegas (3-4 August 2011) BlackHat Vegas (3 - 4 August 2011) DEFCON 19 (4 - 7 August 2011) #BSidesLA Los Angeles, CA (18 - 19 August 2011) #BSidesMO(21 Oct 2011) #BSidesNewDelhi (22 - 23 October 2011) VB Barcelona October 2011 Links: http://www.securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 5/26/11 | Free | View In iTunes |
|
25 |
ExplicitSecuraBit Episode 81: Network Admins Takeover | SecuraBit Episode 81: Network Admins Takeover May 4, 2011 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Andrew Borel – @andrew_secbit Tim Krabec - @tkrabec Guests: Sam Bowne discusses IPv6 and the RA 0day attack Twitter: @sambowne Home page: samsclass.info General topics: IPv6 Info: http://samsclass.info/ipv6/60_S11.php RA 0day attack: http://samsclass.info/ipv6/proj/flood-router6a.htm http://orchilles.com/2011/04/ssl-renegotiation-dos-faq.html NIST Guidelines for the Secure Deployment of IPv6 http://csrc.nist.gov/publications/nistpubs/800-119/sp800-119.pdf Hurricane Electric cert and info http://ipv6.he.net/certification/ BackTrack 5 Available on May 10, 2011 http://www.backtrack-linux.org/ Netwitness http://www.netwitness.com/products-services/investigator-freeware http://www.netwitness.com/resources/videos/investigator-tutorial-1-overview-navigation Use our discount code "Connect_SecuraBit" to get $150.00 off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events: CEIC Orlando (15 – 18 May 2011) #BSidesROC Rochester, NY (21 May 2011) #BSidesDetroit (3 - 4 Jun 2011) #BSidesStJohns St. John's, NL (10 Jun 2011) #BSidesCT Meriden, CT (11 Jun 2011) FIRST Austria (12 - 17 June 2011) #BSidesVienna(18 June 2011) Toorcon (18 - 19 June 2011) #BSidesLasVegas (3-4 August 2011) BlackHat Vegas (3 - 4 August 2011) DEFCON 19 (4 - 7 August 2011) #BSidesLA Los Angeles, CA (18 - 19 August 2011) #BSidesMO(21 Oct 2011) #BSidesNewDelhi (22 - 23 October 2011) VB Barcelona October 2011 Links: http://www.securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 5/9/11 | Free | View In iTunes |
|
26 |
ExplicitSecuraBit Episode 80: Our 8080 Episode | SecuraBit Episode 80: Our 8080 Episode April 20, 2011 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Tony Huffman – @myne_us Dan Mitchell - @danmitchell Guests: int80 - @dualcoremusic DualcoreMusic General topics: http://dualcoremusic.com/nerdcore/ http://www.youtube.com/watch?v=CMNry4PE93Y NEWS: Patch Tuesday April 2011 64 patched: http://www.microsoft.com/technet/security/current.aspx http://isc.sans.edu/diary.html?date=2011-04-11 Oracle Critical Patch Update Advisory - April 2011 http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html Verizon 2011 Data Breach Report http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2011_en_xg.pdf Barracuda http://www.thetechherald.com/article.php/201115/7044/Malaysian-group-hits-Barracuda-Networks-Update?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+SecurityBloggersNetwork+%28Security+Bloggers+Network%29 http://blog.barracuda.com/pmblog/index.php/2011/04/12/waf-importance/ http://www.securecomputing.net.au/News/254601,barracuda-hack-shows-importance-of-defenceindepth.aspx?utm_source=twitterfeed&utm_medium=twitter http://www.flyingpenguin.com/?p=11513 “Starting Saturday night at approximately 5pm Pacific time, an automated script began crawling our Web site in search of unvalidated parameters. After approximately two hours of nonstop attempts, the script discovered a SQL injection vulnerability in a simple PHP script that serves up customer reference case studies by vertical market. As with many ancillary scripts common to Web sites, this customer case study database shared the SQL database used for marketing programs which contained names and email addresses of leads, channel partners and some Barracuda Networks employees. The attack utilized one IP address initially to do reconnaissance and was joined by another IP address about three hours later. We have logs of all the attack activity, and we believe we now fully understand the scope of the attack.” Texas http://www.txsafeguard.org/ http://blogs.chron.com/texaspolitics/archives/2011/04/personal_inform.html “Personal information of about 3.5 million Texans -- including names, mailing addresses and Social Security numbers -- was posted on a publicly accessible server at the state comptroller's office, much of it for more than a year, Comptroller Susan Combs said.” Michigan Police taking your phones http://www.thenewspaper.com/news/34/3458.asp http://www.geekosystem.com/cellebrite-cellphone-hacker/ “The American Civil Liberties Union (ACLU) is currently engaged in a war of words and requests for information on a device used by the Michigan state police that can extract information from cellphones. The device, which has reportedly been in use since at least 2008, is apparently being used by the police during minor traffic violations.” Wordpress http://en.blog.wordpress.com/2011/04/13/security/ http://newenterprise.allthingsd.com/20110413/wordpress-com-suffers-security-breach/?mod=ATD_rss&utm_source=twitterfeed&utm_medium=twitter http://threatpost.com/en_us/blogs/wordpress-hacked-source-code-stolen-041311 Georgian woman cuts off web access to whole of Armenia http://www.guardian.co.uk/world/2011/apr/06/georgian-woman-cuts-web-access Hacker Group Changes Millions of Passwords to "password"; Only 38% of Users Notice http://www.f-secure.com/weblog/archives/00002134.html “Passwords from over 3,000,000 user accounts were apparently set to "password" late last night in a wide-spread hack that affected hundreds of news, retail and Web 2.0 sites. Most affected users are completely unaware of the attack.” Quick Mentions: FBI take down botnet http://threatpost.com/en_us/blogs/doj-shuts-down-botnet-disables-infected-systems-041411 Facebook adds 2 factor http://threatpost.com/en_us/blogs/facebook-adds-two-factor-authentication | 4/27/11 | Free | View In iTunes |
|
27 |
ExplicitSecuraBit Episode 79: Back to the basics with Marcus Carey! | SecuraBit Episode 79: Back to the basics with Marcus Carey! April 6, 2011 Hosts: Christopher Mills – @thechrisam Jason Mueller – @securabit_jay Tony Huffman – @myne_us Guests: Marcus J Carey- @iFail http://hackersforcharity.org/ General topics: NEWS: Epsilon: http://www.pcworld.com/businesscenter/article/224192/epsilon_data_breach_expect_a_surge_in_spear_phishing_attacks.html http://www.eweek.com/c/a/Security/Epsilon-Data-Breach-Highlights-Cloud-Computing-Security-Concerns-637161/ http://threatpost.com/en_us/blogs/list-companies-hit-epsilon-breach-040511 https://threatpost.com/en_us/blogs/epsilon-data-breach-expands-include-capital-one-disney-others-040411 http://www.epsilon.com/News%20&%20Events/Press_Releases_2011/Epsilon_Notifies_Clients_of_Unauthorized_Entry_into_Email_System/p1057-l3 "On March 30th, an incident was detected where a subset of Epsilon clients' customer data were exposed by an unauthorized entry into Epsilon's email system. The information that was obtained was limited to email addresses and/or customer names only. A rigorous assessment determined that no other personal identifiable information associated with those names was at risk. A full investigation is currently underway," the statement said. LizaMoon: http://threatpost.com/en_us/blogs/counterspin-lizamoon-web-attacks-no-big-deal-040511 In a post on Cisco's security blog, senior security researcher Mary Landesman said that data from the company's ScanSafe Web security infrastructure suggests that just over 1,000 Web domains have been compromised using the SQL injection attack, not the 500,000 to 1.5 million cited in published reports. https://threatpost.com/en_us/blogs/widespread-lizamoon-web-attacks-push-rogue-antivirus-040111 “Websense researchers wrote on Thursday that a Google search for Web sites hosting the malicious URLs identified over 1.5 million Web sites hosting the code” Pandora.com data leak: http://threatpost.com/en_us/blogs/pandora-mobile-app-transmits-gobs-personal-data-040611?utm_source=Home+Page&utm_medium=Top+Graphic+Bar&utm_campaign=Position+3 “The data included both the owner's GPS location and tidbits the owners gender, birthday and postal code information. There was evidence that the app attempted to provide continuous location monitoring - which would tell advertisers not just where the user accessed the application from, but also allow them to track that user's movement over time. “ RSA attack: http://threatpost.com/en_us/blogs/rsa-securid-attack-was-phishing-excel-spreadsheet-040111 “"The attacker in this case sent two different phishing emails over a two-day period. The two emails were sent to two small groups of employees; you wouldn’t consider these users particularly high profile or high value targets. The email subject line read '2011 Recruitment Plan," Uri Rivner, head of new technologies in the identity protection division of RSA wrote in a post on the attack” http://www.nsslabs.com/research/analytical-brief-rsa-breach.html ¾ Energy Firms Had Data Breach over last year: http://threatpost.com/en_us/blogs/study-three-four-energy-firms-had-data-breach-last-year-040511 Long perceived to be beyond the attention of hackers, energy firms and utilities now report that they are being targeted. In the Ponemon study, 76% of the IT security staff interviewed reported that their organization had experienced "one or more data breaches" in the last 12 months. A similar number - 69% - said they felt a data breach was likely to occur in the next 12 months, Ponemon said. Comodo what really happened: https://threatpost.com/en_us/blogs/phony-ssl-certificates-issued-google-yahoo-skype-others-032311 http://pastebin.com/uSdKNDN5 “ I found out that TrustDll.dll takes care of signing. It was coded in C#. Simply I decompiled it and I found username/password of their GeoTrust and Comodo reseller account. “ FBI asks for help on cracking code: http://www.h-online.com/security/news/item/FBI-asks-for-help-crac | 4/8/11 | Free | View In iTunes |
|
28 |
ExplicitSecurabit Episode 78: Comodogate and Social Penetration! | Securabit Episode 78: Comodogate and Social Penetration! March 23, 2011 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Tony Huffman (myne-us) – @myne_us Guests: Dave Kennedy - @dave_rel1k Carlos “Darkoperator” Perez - @Carlos_Perez General topics: Rogue SSL certificates ("case comodogate") http://www.f-secure.com/weblog/archives/00002128.html PTES - Penetration Testing Execution Standard http://www.pentest-standard.org/ Social Enginer Toolkit http://www.social-engineer.org/podcast/ http://www.social-engineer.org/framework/Computer_Based_Social_Engineering_Tools:_Social_Engineer_Toolkit_(SET) BackTrack http://www.backtrack-linux.org/ DerbyCon http://www.derbycon.com/ Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events: #BSidesChicago (16 - 17 Apr 2011) #BSides London, (20 Apr 2011) #BSidesROC Rochester, NY (21 May 2011) #BSidesDetroit (3 - 4 Jun 2011) SANS Orlando March 2011 CEIC Orlando April 2011 FIRST Austria June 2011 BlackHat Vegas August 2011 VB Barcelona October 2011 Links: http://www.securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 3/30/11 | Free | View In iTunes |
|
29 |
ExplicitSecuraBit Episode 77: Return to the Rabbit Hole | Securabit Episode 77: Return to the Rabbit Hole March 9, 2011 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Jason Mueller – @securabit_jay Tony Huffman (myne-us) – @myne_us Andrew Borel – @andrew_secbit Guests: Rafal Los - @wh1t3Rabbit General topics: Preview the upcoming BlackHat EU talk "Defying Logic." Researchers Build Tool That Roots Out Business Logic Flaws In Web Apps http://www.darkreading.com/database-security/167901020/security/application-security/229300667/researchers-build-tool-that-roots-out-business-logic-flaws-in-web-apps.html --News -Malware on the andoid market place. (DroidDream) List of infected app http://blog.mylookout.com/2011/03/security-alert-malware-found-in-official-android-market-droiddream/ -Google nukes 150,000 email accounts on accident http://gmailblog.blogspot.com/2011/02/gmail-back-soon-for-everyone.html Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events BlackHat Europe 2011 (17 - 18 Mar 2011) #BSidesChicago (16 - 17 Apr 2011) #BSides London, (20 Apr 2011) #BSidesROC Rochester, NY (21 May 2011) #BSidesDetroit (3 - 4 Jun 2011) Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 3/13/11 | Free | View In iTunes |
|
30 |
ExplicitSecuraBit Episode 76: E-viting you to your demise! | SecuraBit Episode 76: E-viting you to your demise! February 23, 2011 SecuraBit would like to apologize for the audio issues in this episode. We were not able to use the normal recording method due to a complete power failure. Thanks for understanding! Hosts: Christopher Mills – @thechrisam Jason Mueller – @securabit_jay Tony – @myne_us Dan Mitchell - @danmitchell Andrew Borel – @andrew_secbit Guests: Bill Swearingen - @hevnsnt Trent Lo - @surbo General topics: History of i-hacked [HackerRun] - @HackerRun http://hackerrun.com/doku.php Messing with evites http://www.i-hacked.com/content/view/293/2/ http://www.csoonline.com/article/661365/evite-program-easily-tampered-with-researcher-says Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events #BSidesHalifax (5 Mar 2011) #BSidesGSO Greensboro, NC (9 Mar 2011) CanSecWest2011 (9 - 11 Mar 2011) #BSidesAustin (11 - 12 March 2011) http://www.keepsecurityweird.org/ BlackHat Europe 2011 (17 - 18 Mar 2011) #BSidesChicago (16 - 17 Apr 2011) #BSides London, (20 Apr 2011) #BSidesROC Rochester, NY (21 May 2011) #BSidesDetroit (3 - 4 Jun 2011) Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 3/2/11 | Free | View In iTunes |
|
31 |
CleanSecurabit Episode 75: Booze over IP | Securabit Episode 75: Booze over IP February 9, 2011 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Tony (myne-us) – @myne_us Guests: Mike Dahn twitter: @mikd Joe Gottlieb Twitter: joe_gottlieb General topics: Mike:Bsides origins and other. http://chaordicmind.com/blog/ Joe: Open Security Intelligence http://www.opensecurityintelligence.com/ On Monday, February 14th, SIEM and log management vendor SenSage will introduce the Open Security Intelligence forum to the security community to become involved in. The concept of the community is to share best practices in open security analytics to improve our collective security defenses. Specifically, Joe Gottlieb, President and CEO of SenSage would like to discuss: - Current challenges with today’s SIEM tools, which are a decade old - Why security analytics needs to be ‘open’ - Why integrating business intelligence tools (i.e. Pentaho, Microsoft Exchange, Cognos, etc.) with SIEM tools can create useful dashboards that help security analysts mine huge data stores for the ‘needle in the haystack’ information they need - Why ‘security quants’ (analysts that can look deep into the data and develop complex yet useful SQL queries) will become the next role in the SOC - The benefits of joining the community and sharing best practices The community will be hosted on a web portal – www.opensecurityintelligence.com – that is under development and will be discussed in our Feb. 14 release. Also, Joe is also giving a talk at Security BSides SF on 2/14 at 3pm PT on this very topic. --HBGary Federal http://krebsonsecurity.com/2011/02/hbgary-federal-hacked-by-anonymous/ --Nasdaq attack does not yet have reports of how they where attacked. The comment on the website was for the 1999 attack where someone defaced the nasdaq website. Quotes from http://www.wallstreetandtech.com/technology-risk-management/229201267 The operator of the Nasdaq Stock Exchange said it found "suspicious files" on its computer servers, in a Web application called Directors Desk which is used by members of corporations' boards of directors who want to share information and files. "What seems most likely is that the web servers were compromised in an attempt to use them to inject malicious software into their clients," commented one reader of the nakedsecurity.sophos.com blog. --Bsides http://www.securitybsides.com/w/page/12194156/FrontPage to contact: info (at) securitybsides dot org -or- call 415-742-1739 --Exploit developers corner Looking for exploit developers! If you have recently published an exploit or have a previously published exploits you would like to talk about contact us at feedback@securabit.com or can contact Tony (myne-us) directly on IRC at freenode #securabit to have a small interview about your discovery. List of common questions. -How did you find the vulnerability? -What is your goal in vulnerability research? -How did you go about disclosing the vulnerability and how did the vendor respond? -And more... !!Caution!!: No undisclosed vulnerabilities (0 day)! These vulnerabilities need to be reported to the vendor and patched or exceed a time period where vendor did not patch. If interested in releasing exploit on the show that is fine if can show proof you disclosed to vendor or see the proof of concept already posted on exploit-db or have a CVE. Us:NetWitness Spectrum at RSA http://www.netwitness.com/products/spectrum.aspx Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events RSA Conference 2011 (14 -18 Feb 2011) #BSidesSanFrancisco (14 - 15 Feb 2011) #BSidesCleveland (18 Feb 2011) #BSidesHalifax (5 Mar 2011) #BSidesGSO Greensboro, NC | 2/14/11 | Free | View In iTunes |
|
32 |
ExplicitSecurabit Episode 74: Podcasting in the Dark with Brian Krebs | Securabit Episode 74: Podcasting in the Dark with Brian Krebs January 26, 2011 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Guests: Brian Krebs - @briankrebs - http://krebsonsecurity.com/ General topics: I recall reading about various greeting card based attacks over the years. Do you think they've all been originated by the same folks who did this one? Or at least, with the same goals in mind? How prevalent do you think ATM skimmers are? What are some ways the common person can look out for them? Do you think financial institutions are getting better at educating their customers about the protections provided/not provided under Regulation E? Do you anticipate payment processing centers becoming a bigger target for criminals vs the individual businesses? Since many financials are under pressure from new reserve requirements, do you think new security requirements will force smaller financials to merge? How can they balance the need to offer more convenient services (such as mobile banking) with the need to improve security at the same time? What do you think the top 3 stories for 2010 were? Why do you think they were the top stories? Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events RSA Conference 2011 (14 -18 Feb 2011) #BSidesSanFrancisco (14 - 15 Feb 2011) #BSidesCleveland (18 Feb 2011) #BSidesHalifax (5 Mar 2011) #BSidesGSO Greensboro, NC (9 Mar 2011) CanSecWest2011 (9 - 11 Mar 2011) #BSidesAustin (11 - 12 March 2011) http://www.keepsecurityweird.org/ BlackHat Europe 2011 (17 - 18 Mar 2011) #BSidesChicago (16 - 17 Apr 2011) #BSides London, (20 Apr 2011) #BSidesROC Rochester, NY (21 May 2011) #BSidesDetroit (3 - 4 Jun 2011) Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 2/5/11 | Free | View In iTunes |
|
33 |
ExplicitSecurabit Episode 73: Eber Kneber and botnet stuntmen | Securabit Episode 73: Eber Kneber and botnet stuntmen January 12, 2011 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Guests: We discuss Kneber and other fun security topics with Alex Cox of NetWitness @perpetualsec http://www.networkforensics.com/ General topics: Kneber Botnet Mariposa Responsible disclosure Evil Virustotal http://socialmediasecurity.com/downloads/Facebook_Privacy_and_Security_Guide.pdf PROGRAMMABLE HID USB KEYSTROKE DONGLE: USING THE TEENSY AS A PEN TESTING DEVICE https://www.defcon.org/html/defcon-18/dc-18-speakers.html#Crenshaw http://www.irongeek.com/i.php?page=videos/dojocon-2010-videos Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events ShmooCon (28 - 31 Jan 2011) RSA Conference 2011 (14 -18 Feb 2011) #BSidesSanFrancisco (14 - 15 Feb 2011) #BSidesCleveland (18 Feb 2011) #BSidesHalifax (5 Mar 2011) #BSidesGSO Greensboro, NC (9 Mar 2011) #BSidesAustin (11 - 12 March 2011) http://www.keepsecurityweird.org/ #BSidesChicago (16 - 17 Apr 2011) #BSides London, (20 Apr 2011) #BSidesROC Rochester, NY (21 May 2011) #BSidesDetroit (3 - 4 Jun 2011) Links: http://www.securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 1/19/11 | Free | View In iTunes |
|
34 |
ExplicitSecuraBit Episode 72: Take risks, get owned! | SecuraBit Episode 72: Take risks, get owned! Recorded on December 29, 2010 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Guests: Jack Jones discusses Risk Assessment and the FAIR method http://riskmanagementinsight.com/ General topics: Risk Management, Small biz vs Enterprise Monte Carlo? How to Measure Anything: Finding the Value of Intangibles in Business by Douglas W. Hubbard http://www.amazon.com/How-Measure-Anything-Intangibles-Business/dp/0470539399/ref=tmm_hrd_title_0 OnePassword - http://agilewebsolutions.com/onepassword KeePass - http://keepass.info/ LastPass - http://lastpass.com/ Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events #BSidesMSP (7 Jan 2011) ShmooCon (28-31 Jan 2011) RSA Conference 2011 (14 -18 Feb 2011) #BSidesSanFrancisco (14-15 Feb 2011) #BSidesAustin (11-12 March 2011) http://www.keepsecurityweird.org/ Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 1/6/11 | Free | View In iTunes |
|
35 |
ExplicitSecuraBit Episode 71: Managing our Careers with Lee Kushner | SecuraBit Episode 71: Managing our Careers with Lee Kushner December 15, 2010 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Guests: Lee Kushner - @LJKush - http://www.ljkushner.com/ - http://www.infosecleaders.com/ General topics: Discussion on Career Management The importance of having a career plan. It’s a very crowded market in information security, and it’s getting more so every day. www.infosecleaders.com/2010-compensation-survey/ FAQ: Compromised Commenting Accounts on Gawker Media http://lifehacker.com/5712785/ OnePassword - http://agilewebsolutions.com/onepassword KeePass - http://keepass.info/ LastPass - http://lastpass.com/ Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events #BSidesBerlin (28-30 Dec 2010) #BSidesMSP (7 Jan 2011) ShmooCon (28-31 Jan 2011) RSA Conference 2011 (14 -18 Feb 2011) #BSidesSanFrancisco (14-15 Feb 2011) #BSidesAustin (March 2011) Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 12/19/10 | Free | View In iTunes |
|
36 |
ExplicitSecuraBit Episode 70: Following the wh1t3Rabbit, Hat-tricks with a wh1t3Rabbit | SecuraBit Episode 70: Following the wh1t3Rabbit, Hat-tricks with a wh1t3Rabbit December 1, 2010 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Christopher Mills – @thechrisam Chris Gerling – @chrisgerling Andrew Borel – @andrew_secbit Guests: HP's Rafal Los - @wh1t3Rabbit Subscribe to his blog at http://hp.com/go/white-rabbit General topics: Shmoocon tickets, who’s got them? Hat-trick http://en.wikipedia.org/wiki/Hat-trick Password security, does it really matter? Application security to detect and prevent malicious code. Diaspora https://joindiaspora.com/ Security Metrics Story time with Rafal RSnake shutting down his blog after 5 years and 1000 posts http://ha.ckers.org/ FTC Staff Issues Privacy Report Offers Framework for Consumers, Businesses, and Policymakers: Endorses “Do Not Track” to Facilitate Consumer Choice About Online Tracking http://www.ftc.gov/opa/2010/12/privacyreport.shtm SANS Discount: Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is good for all SANS courses in all formats. Syngress Discount: Use our discount code 36449 to receive 20% off any order direct from Elsevier! Upcoming events Sunbelt Quarterly Briefing December 8th, 2010 at 9am and 2pm DojoCon December 11-12, 2010 #BSidesBerlin December 28-30, 2010 ShmooCon January 28-31, 2011 Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 12/6/10 | Free | View In iTunes |
|
37 |
ExplicitSecuraBit Episode 69: Picking Locks and Messing up Podcasts, Welcome to Gringo Village! | SecuraBit Episode 69: Picking Locks and Messing up Podcasts, Welcome to Gringo Village! November 3, 2010 Hosts: Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Anthony Gartner – @anthonygartner http://anthonygartner.com Jason Mueller – @securabit_jay Rob Fuller – @mubix Tim Krabec – @tkrabec http://www.SMBMinute.com Guests: Deviant Ollum - http://deviating.net/ - Author of Syngress Practical Lock Picking General topics: Practical Lock Picking By Deviant Ollam http://www.syngress.com/hacking-and-penetration-testing/Practical-Lock-Picking/ Review submitted by a coworker: Practical Lock Picking by Deviant Ollum was an enjoyable read. The author does a good job of covering the art and science of picking locks. He chose two of the most common types of locks for the bulk of his material which helps keep the focus of the book tight. He leads the reader from the basic operational principles of the locks, to flaws in the design & manufacture and finally how to pick the locks. The coverage of pick types and other tools of the trade round out the readers knowledge of the subject. His down to earth style and simple language help the reader understand the material and develop the skills to pick these types of locks. His logical progression of starting with one pin and working your way up to all the pins in the lock will help the reader build confidence in their skills. The final sections on bypassing the door reminds the reader that locks are part of a system and sometimes the way to defeat a system is not the direct approach. Overall I would give this book 4 out of 4 stars. Shmoocon Tickets?? The Open Organization Of Lockpickers http://toool.us/ Lock Picking Videos - http://www.youtube.com/deviantollam General Information http://deviating.net/lockpicking/ IE Zero Day Microsoft Security Advisory (2458511) Vulnerability in Internet Explorer Could Allow Remote Code Execution http://www.microsoft.com/technet/security/advisory/2458511.mspx Enhanced Mitigation Experience Toolkit v2.0 http://www.microsoft.com/downloads/en/details.aspx?FamilyID=c6f0a6ee-05ac-4eb6-acd0-362559fd2f04 SpyEye v. ZeuS Rivalry Ends in Quiet Merger http://krebsonsecurity.com/2010/10/spyeye-v-zeus-rivalry-ends-in-quiet-merger/ Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is0 good for all SANS courses in all formats. Upcoming events #BSidesDFW November 6, 2010 #BSidesDE November 6, 2010 AppSec DC 2010 November 8-12, 2010 #BSidesOttawa November 12-13, 2010 RUXCON 2010 December 4-5, 2010 DojoCon December 11-12, 2010 #BSidesBerlin December 28-30, 2010 ShmooCon January 28-31, 2010 Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 11/7/10 | Free | View In iTunes |
|
38 |
ExplicitSecuraBit Episode 68: Teaching for handbags! | SecuraBit Episode 68: Teaching for handbags! Hosts: Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Anthony Gartner – @anthonygartner http://anthonygartner.com Jason Mueller – @securabit_jay Guests: Kevin Johnson discusses SANS SEC 542 Web App Pen Testing, Base, etc General topics: New Apple Macbook Air. Recent Security Zynga collecting data about Facebook users. Social engineering at a capture the flag event. Pros and cons to using social networks. Attacking your web applications for a more secure application. Samurai WTF (Web Testing Framework) http://samurai.inguardians.com/ Laudanum: Injectable Functionality http://laudanum.inguardians.com/ Basic Analysis and Security Engine (BASE) project http://base.secureideas.net/ Use our discount code "Connect_SecuraBit10" to get 10% off of ANY training course. The discount code is good for all SANS courses in all formats. Upcoming events #BSidesDFW November 6, 2010 #BSidesDE November 6, 2010 AppSec DC 2010 November 8-12, 2010 #BSidesOttawa November 12-13, 2010 #BSidesBerlin December 28-30, 2010 ShmooCon January 28-31, 2010 Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 10/25/10 | Free | View In iTunes |
|
39 |
ExplicitSecuraBit Episode 67: We're all gonna get HAX! | SecuraBit Episode 67: We're all gonna get HAX! October 6, 2010 Hosts: Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Anthony Gartner Guest: Roger Grimes General topics: Authored eight books, and co-authored another 4 Chasing hackers for 23 years SCADA issues What the bad guys are doing? Black hat cloud backup? Offline patch and reset days to recover from a issue. Whitelisting may be a solution, that is just too hard to implement in many environments. Needs full sign off from the organization Different levels of identification Syngress book of the month club for episode 68 Utilize code 36449 for a discount on books from Syngress! Executives should have Macs because it makes it easier on the pen tester Patching and warranties SANS Connector Program 10% of any SANS events or training use coupon code Connect_SecuraBit10 Lenny Zeltser Facebook Social Captcha Authentication http://blog.zeltser.com/post/1258010402/facebook-social-captcha-authentication Upcoming events Hacker Halted http://www.hackerhalted.com/ Tim Is speaking October 14th Phreaknic 10/15. http://www.phreaknic.info/pn14/ Bsides Delaware 11/6 Bsides Dallas-FortWorth 11/6 Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 10/13/10 | Free | View In iTunes |
|
40 |
ExplicitSecuraBit Episode 66: The third 6 would be unlucky! | SecuraBit Episode 66: September 22, 2010 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Guests: Aaron Barr (HB Gary Federal) @aaronbarr We discuss HBGary with Aaron, and delve into some fun topics like malware analysis, forensics, and other technical skills. General topics: Media Sponsor for: SecTor 2010 - http://www.sector.ca/ Security Training October 25. Conference Sessions October 26 & 27, 2010. Twitter XSS http://status.twitter.com/post/1161435117/xss-attack-identified-and-patched Robin Sage Malware analysis Behavior of malware in memory FGET is pretty pimp (free tool that remotely images NTFS volumes) https://www.hbgary.com/community/shawnblog/fget-v10-goes-live/ Free tools from HB Gary https://www.hbgary.com/community/free-tools/ Forensics How flypaper plays into image grabbing Upcoming events Hacker Halted http://www.hackerhalted.com/ Tim Is speaking October 14th Louisivlle Infosec 10/7. http://www.louisvilleinfosec.com/ Atlanta B-Sides 10/8. http://www.securitybsides.com/BSidesAtlanta HacKid - http://www.hackid.org/ 10/9-10/10 Phreaknic 10/15. http://www.phreaknic.info/pn14/ Links: http://www.HBGary.com/ http://www.SecuraBit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 10/3/10 | Free | View In iTunes |
|
41 |
CleanSecuraBit Episode 65: Application Security From the Ground Up! | SecuraBit Episode 65: Application Security From the Ground Up! September 8, 2010 Hosts: Anthony Gartner – @anthonygartner Jason Mueller – @securabit_jay Christopher Mills – @thechrisam Guests: Jeff Morgan * Product manager for HP’s Application Security Center product line * 20+ years experience developing commercial software solutions in industries ranging from healthcare to payroll to commercial printing * Joined SPI Dynamics in 2006, which was later acquired by HP * Previously a software engineer and held positions in development, QA, support and account management General topics: Application Security Development Lifecycle Flash, as usual NoScript Intel and McAfee Upcoming events Hacker Halted http://www.hackerhalted.com/ Tim Is speaking October 14th Louisivlle Infosec 10/7. http://www.louisvilleinfosec.com/ Atlanta B-Sides 10/8. http://www.securitybsides.com/BSidesAtlanta HacKid - http://www.hackid.org/ 10/9-10/10 Phreaknic 10/15. http://www.phreaknic.info/pn14/ SecTor 2010 - http://www.sector.ca/ Security Training October 25. Conference Sessions October 26 & 27, 2010. Links: http://securabit.com HP Application Security Center Chat with us on IRC at irc.freenode.net #securabit | 9/22/10 | Free | View In iTunes |
|
42 |
ExplicitSecuraBit Episode 64: A whole lot of organized crime going on! | SecuraBit Episode 64: A whole lot of organized crime going on! August 25, 2010 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Andrew Borel – @andrew_secbit Guests: Bryan Sartin - Director of Investigative Response at Verizon Business General topics: Verizon RISK Team - http://www.verizonbusiness.com/products/security/risk/ Bryan Sartin, the Director of Investigative Response at Verizon Business, discusses the 2010 Verizon Data Breach Report http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf VERIS Framework - https://verisframework.wiki.zoho.com/ MalCon: A Call for ‘Ethical Malcoding’ http://krebsonsecurity.com/2010/08/malcon-a-call-for-ethical-malcoding/ SecTor 2010 - http://www.sector.ca/ Security Training October 25. Conference Sessions October 26 & 27, 2010. The real iTunes fraud vulnerability: Gullible users - http://news.cnet.com/8301-13579_3-20014481-37.html Upcoming events Hacker Halted http://www.hackerhalted.com/ Tim Is speaking October 14th Louisivlle Infosec 10/7. http://www.louisvilleinfosec.com/ Atlanta B-Sides 10/8. http://www.securitybsides.com/BSidesAtlanta HacKid - http://www.hackid.org/ 10/9-10/10 Phreaknic 10/15. http://www.phreaknic.info/pn14/ Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 9/5/10 | Free | View In iTunes |
|
43 |
ExplicitSecuraBit Episode 63: Walking to the Waffle House with Andy Willingham | SecuraBit Episode 63: Walking to the Waffle House with Andy Willingham August 11, 2010 Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Guests: Andy Willingham (Southern Fried Security Podcast) - @andywillingham http://www.andyitguy.com/blog/ General topics: DEFCON/BLACKHAT/BSides Recap --Chris’s experience this year, and a review of the medical facilities in Las Vegas --General entertaining banter Shiny Old VxWorks Vulnerabilities http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html Facebook name extraction based on email/wrong password http://seclists.org/fulldisclosure/2010/Aug/130 Apple Fixes PDF Vunerability that allowed webbased Jail Break. iOS 4.0.2 Software Update http://support.apple.com/kb/DL1061 Interview with Andy Willingham ShmooCon 2011 Dates Announced http://tinyurl.com/29nzc46 Microsoft drops the patch bomb http://www.securabit.com/2010/08/10/microsoft-drops-the-patch-bomb/ Andriod Malware and Unexpected Features http://crave.cnet.co.uk/mobiles/android-gets-its-first-texting-malware-50000303/ Free Android antivirus clocks up 2.5m downloads http://www.theregister.co.uk/2010/08/11/free_android_security_app/ A Review of Verizon and Google's Net Neutrality Proposal http://www.eff.org/deeplinks/2010/08/google-verizon-netneutrality Upcoming events South Florida ISSA’s Hack the flag and chili cook-off Saturday August 14, 2010 from 12:00pm - 5:00pm http://sfissa.org/index.php/sfissa-mm-events/htf-main/85-hack-the-flag-2010 Hacker Halted http://www.hackerhalted.com/ Tim Is speaking October 14th Louisivlle Infosec 10/7. http://www.louisvilleinfosec.com/ Atlanta B-Sides 10/8. http://www.securitybsides.com/BSidesAtlanta HacKid - http://www.hackid.org/ 10/9-10/10 Phreaknic 10/15. http://www.phreaknic.info/pn14/ Links: http://www.securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 8/19/10 | Free | View In iTunes |
|
44 |
CleanSecuraBit Episode 62: Visualizing Data with NetWitness | SecuraBit Episode 62: Visualizing Data with NetWitness Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Guests: Eddie Schwartz - @eddieschwartz General topics: BSidesLV http://www.securitybsides.com/BSidesLasVegas BlackHat https://www.blackhat.com/html/bh-us-10/bh-us-10-home.html Defcon https://www.defcon.org/html/defcon-18/dc-18-schedule.html Shmoocon Woot Video http://www.youtube.com/watch?v=HJ0ypgZU_D0 NetWitness Visualize http://visualize.netwitness.com/ Brief panel on certifications. iPhone App Now Available. http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 http://itunes.apple.com/us/podcast/securabit/id280048405 Upcoming events South Florida ISSA’s Hack the flag and chili cook-off Saturday August 14, 2010 from 12:00pm - 5:00pm http://sfissa.org/index.php/sfissa-mm-events/htf-main/85-hack-the-flag-2010 Hacker Halted http://www.hackerhalted.com/ Tim Is speaking October 14th Links: http://securabit.com Chat with us on IRC at irc.freenode.net #securabit iTunes Podcast - http://itunes.apple.com/us/podcast/securabit/id280048405 iPhone App Now Available - http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8 | 8/1/10 | Free | View In iTunes |
|
45 |
CleanSecuraBit Episode 61: Reverse Engineering Malware with a Spider Monkey | SecuraBit Episode 61: Reverse Engineering Malware with a Spider Monkey Hosts: Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Tim Krabec – @tkrabec http://www.SMBMinute.com Nicholas Berthaume -- @nberthaume https://www.bordergatewayprotocol.net Anthony Gartner – @anthonygartner http://anthonygartner.com Guests: Guest: Lenny Zeltser - @lennyzeltser http://zeltser.com/ General topics: Reverse Engineering Malware New Linux Distro to analyze malware REMnux: A Linux Distribution for Reverse-Engineering Malware http://zeltser.com/remnux/ Based on Ubuntu Released just 5 days ago - July 8, 2010 2500 Downloads so far VMWare appliance Live Distro going out to Source Forge soon Enlightenment as window manager, (no gnome or kde) Just what you need to do the analysis Lightweight as possible Tools Emulate Services Allow malware to interact with your own resources how does it differ from CW Sandbox Determine the signs of comprise to compare with your production environment JS Unpack Since it is an Ubuntu distro, you can roll a custom version for your environment or lab. Intrigrrated into the Reverse Engining Malware course from SANS SANS Digital Forensics Summit The state of people relying on only antivirus for protection. The innovator's dilemma http://www.amazon.com/Innovators-Dilemma-Revolutionary-Business-Essentials/dp/0060521996 Microsoft Security Essentials http://www.microsoft.com/security_essentials/ http://www.sans.org/vlive/ Forensics 610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques SANS vLive! FOR610 - 201001 - Monday, July 26, 2010 - Thursday, August 26, 2010 http://www.sans.org/vlive/details.php?nid=20668 Upcoming events: BSidesLV http://www.securitybsides.com/BSidesLasVegas BlackHat https://www.blackhat.com/html/bh-us-10/bh-us-10-home.html Defcon https://www.defcon.org/html/defcon-18/dc-18-schedule.html Tim is speaking http://defcon.org/html/defcon-18/dc-18-speakers.html#PanelHTF Tim is also doing a skytalks schedule http://sudux.com/skytalks_web.jpg Hacker Halted http://www.hackerhalted.com/ Tim Is speaking October 14th South Florida ISSA’s Hack the flag and chili cookoff Saturday August 14, 2010 from 12:00pm - 5:00pm http://sfissa.org/index.php/sfissa-mm-events/htf-main/85-hack-the-flag-2010 These are the upcoming security cons and where you can find those of us that will be attending starting in less than two weeks. Links: Chat with us on IRC at irc.freenode.net #securabit | 7/22/10 | Free | View In iTunes |
|
46 |
ExplicitSecuraBit Episode 60: Free Calamari!!! | SecuraBit Episode 60: Free Calamari!!! Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Jason Mueller – @securabit_jay Tim Krabec – @tkrabec http://www.SMBMinute.com Guests: Christopher Boyd (Sunbelt Software) http://en.wikipedia.org/wiki/Christopher_Boyd http://www.vitalsecurity.org/ http://sunbeltblog.blogspot.com/ General topics: Chris speaks about how he got involved in the position he is in now. He also got into how he basically social engineers and discusses his blog. Dodgy Dr Who Games Orkut Shenanigans The Sunbelt Security Blog Fun with Internet Trolls How Drugs and Stabby Things Led to a Career in Security Internet Kill Switch Twitter Agrees to Data-Security Audits HacKid -http://www.hackid.org/ Links: FTC Requires Twitter To Set Up Data-Security Audits http://news.yahoo.com/s/nf/20100624/tc_nf/74031 Chat with us on IRC at irc.freenode.net #securabit | 7/7/10 | Free | View In iTunes |
|
47 |
CleanSecuraBit Episode 59: Too many acronyms, my head is going to explode! | SecuraBit Episode 59: Too many acronyms, my head is going to explode! Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Chris Gerling – @chrisgerling Guests: Dan Philpott discusses NIST, Information Assurance, SCAP, FISMA, etc Contact info: Twitter: @danphilpott General topics: Federal Information Security Management Act (FISMA) Implementation Project http://csrc.nist.gov/groups/SMA/fisma/index.html Special Publications (800 Series) http://csrc.nist.gov/publications/PubsSPs.html Small Business Corner (SBC) http://csrc.nist.gov/groups/SMA/sbc/index.html FISMApedia http://fismapedia.org/index.php?title=Main_Page The Security Content Automation Protocol (SCAP) http://scap.nist.gov/ -Change Management Windows Sysinternals http://technet.microsoft.com/en-us/sysinternals/default.aspx Sysinternals Suite http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx Links: http://csrc.nist.gov/ Chat with us on IRC at irc.freenode.net #securabit | 6/21/10 | Free | View In iTunes |
|
48 |
CleanSecuraBit Episode 58: Forensic Goodness with Harlan Carvey | SecuraBit Episode 58: Forensic Goodness with Harlan Carvey Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Christopher Mills – @thechrisam Chris Gerling – @chrisgerling Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Guests: Harlan Carvey http://windowsir.blogspot.com/ Tools: http://tech.groups.yahoo.com/group/win4n6/ General topics: Timeline creation Regripper Forensic trends SIFT Lance Mueller http://www.forensickb.com/ Are you interested in taking an upcoming SANS course? Dr. Eric Cole is teaching the upcoming SANS vLive! 501 course which starts on June 22. You can register for the course using this link, and coupon code 501SB to save $500! | 6/7/10 | Free | View In iTunes |
|
49 |
ExplicitSecuraBit Episode 57: Doctor Cole, I Presume? | Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Christopher Mills – @thechrisam Chris Gerling – @chrisgerling Andrew Borel – @andrew_secbit Guests: Dr. Eric Cole, Ph.D. - @drericcole General topics: Mr. Cole is teaching the upcoming SANS vLive! 501 course which starts on June 22. You can register for the courseusing this link, and coupon code 501SB to save $500! We discussed VOIP security, or the lack thereof. Signature based security solutions are going the way of the dinosaur, it's all about behavior and dynamic detection, such as heuristics now. How to protect your privacy online: http://twitter.com/ChrisPirillo/status/13881888168 Links: http://www.sans.org/security-training/instructors_upcoming.php?id=34 http://www.securityhaven.com/ Sunbelt Software Webinar: Thursday, May 27, 2010, 2PM - 3PM EDT Quarterly Briefing: Turn the tables on Bad Guys: Malware Unmasked The cyber threat landscape is constantly changing, and even with the most sophisticated security you’re never completely protected from attacks. As part of our mission to ‘keep the bad guys out’, SunbeltLabs presents in this webinar how we use our own sandbox technology to keep a step ahead. Sunbelt Software’s Lead Security Analyst, Brian Jack and Malware Response Manager, Dodi Glenn will discuss the current threat landscape and dig deeper into some of the most dangerous and complicated threats out there. During this briefing we will focus on two different types of threats: malicious PDFs and rogue antivirus applications. Learn how to gain an edge when protecting your enterprise. Whether you are dealing with spear phishing or mass attacks, join us to see how to deploy the right tools and learn how to quickly analyze and unmask malware. New threats require new technologies and techniques to protect yourself and your organization. Sign up now and turn the tables on the bad guys. Chat with us on IRC at irc.freenode.net #securabit | 5/26/10 | Free | View In iTunes |
|
50 |
CleanSecuraBit Episode 56: "Try Harder" - Used with permission | SecuraBit Episode 56: "Try Harder" - Used with permission Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Christopher Mills – @thechrisam Chris Gerling – @chrisgerling Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Guests: Chris Hadnagy - @humanhacker Operations Manager and involved with www.offensive-security.com www.backtrack-linux.org http://www.social-engineer.org/ General topics: MSFU course Saturday the 8th from 10am to 5pm in Louisville, KY Chris Speaks of a new kernel update released around the day of recording for Backtrack 4 Since you are able to listen to this podcast the DNS Security Update did not affect you SANS Investigative Forensic Toolkit (SIFT) was updated Links: http://www.exploit-db.com/ http://www.offensive-security.com/images/ryu-help-me.png Kid Friendly Podcast http://www.social-engineer.org/framework/Social_Engineering_Framework Free MSFU Course http://www.offensive-security.com/metasploit-unleashed/ SANS SIFT https://computer-forensics2.sans.org/community/siftkit/ Sponsor mention: Sunbelt Software Webinar: Thursday, May 27, 2010, 2PM - 3PM EDT Quarterly Briefing: Turn the tables on Bad Guys: Malware Unmasked The cyber threat landscape is constantly changing, and even with the most sophisticated security you’re never completely protected from attacks. As part of our mission to ‘keep the bad guys out’, SunbeltLabs presents in this webinar how we use our own sandbox technology to keep a step ahead. Sunbelt Software’s Lead Security Analyst, Brian Jack and Malware Response Manager, Dodi Glenn will discuss the current threat landscape and dig deeper into some of the most dangerous and complicated threats out there. During this briefing we will focus on two different types of threats: malicious PDFs and rogue antivirus applications. Learn how to gain an edge when protecting your enterprise. Whether you are dealing with spear phishing or mass attacks, join us to see how to deploy the right tools and learn how to quickly analyze and unmask malware. New threats require new technologies and techniques to protect yourself and your organization. Sign up now and turn the tables on the bad guys. Chat with us on IRC at irc.freenode.net #securabit | 5/9/10 | Free | View In iTunes |
|
51 |
CleanSecuraBit Episode 55: 10000 Tubes of KY and a Case of Dog Biscuits! | Sponsored by Sunbelt Software! Creators of the Sunbelt CWSandbox, for all your malware analysis needs! Visit their website for more details! Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Christopher Mills – @thechrisam Chris Gerling – @chrisgerling Andrew Borel – @andrew_secbit Missing Hosts: Jason Mueller – @securabit_jay Guests: Joshua Wright - @joswr1ght http://www.willhackforsushi.com/ - Josh talks about the MiFi hack - Bluetooth Hacking - Barcode scanner hacking including the Bluetooth scanner hacks - SANS SEC617 SEC617 Course - 617BIT Discount Code for $500 off the vLive! Course - Upcoming courses taught by Josh Wright http://www.sans.org/security-training/instructors_upcoming.php?id=97 - Pentest summit - Baltimore, MD - Josh will be speaking there. His talk will be about essential crypto for pentesters. http://www.sans.org/pen-testing-summit-2010/ General topics: Mcafee Released a failed (fubar) virus definition Discussion thread Gmail authentication code stolen Someone we know was owned Links: http://www.willhackforsushi.com/ SEC617 Course http://www.sans.org/security-training/instructors_upcoming.php?id=97 Bruce Schneier's book list Dark Reading - Taking Penetration Testing In-House Chat with us on IRC at irc.freenode.net #securabit | 4/25/10 | Free | View In iTunes |
|
52 |
CleanSecuraBit Episode 54 - Lions and Tigers and Banking Trojans, OH MY! | Hosts: Anthony Gartner – @anthonygartner http://anthonygartner.com Christopher Mills – @thechrisam Chris Gerling – @chrisgerling Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Guests: Sean-Paul Correll - @lithium -http://malwaredatabase.net/blog/ Threat researcher at Panda Security According to the Panda Annual security report, 66% of all malware are trojans: http://www.pandasecurity.com/img/enc/Annual_Report_Pandalabs_2009.pdf Definition of a Banking Trojan. Mariposa bot net take down: http://pandalabs.pandasecurity.com/mariposa-botnet/ Virus Total Web: http://www.virustotal.com/ Appeared at Security B-side in San Francisco Playing with Fire – Live Demonstration of Today’s Most Dangerous Malware http://www.ustream.tv/recorded/5143692 http://www.securitybsides.com/ Chat with us on IRC at irc.freenode.net #securabit | 4/11/10 | Free | View In iTunes |
|
53 |
ExplicitSecuraBit EP53: Thotcon If you think it you will go to Chicago! | SecuraBit Episode 53: Thotcon If you think it you will go to Chicago thotcon - http://www.thotcon.org/ Trustwave's Spider Labs - https://www.trustwave.com/spiderLabs.php Chat with us on IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – @anthonygartner Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Guests: Nick Percoc - Thotcon & Trustwave's Spider Labs Zach Fasel - Thotcon & Trustwave's Spider Labs Links: http://www.thotcon.org/ https://www.trustwave.com/spiderLabs.php SpiderLabs Radio - http://itunes.apple.com/podcast/spiderlabs-radio/id300567984 https://www.trustwave.com/spiderLabs-tools.php lacking Chris Gerling – @chrisgerling Jason Mueller – @securabit_jay | 3/28/10 | Free | View In iTunes |
|
54 |
ExplicitSecuraBit Episode 52: To catch a Mule with Krebs on Security! | Hosts: Anthony Gartner – @anthonygartner Christopher Mills – @thechrisam Chris Gerling – @chrisgerling Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Guests: Brian Krebs - @briankrebs - http://www.krebsonsecurity.com/ VRT Blog Post: http://vrt-sourcefire.blogspot.com/2010/03/apt-should-your-panties-be-in-bunch-and.html Eric Chien, Symantec Zeus, King of the Bots: http://www.noryak.net/papers/zeus.pdf Chat with us on IRC at irc.freenode.net #securabit | 3/16/10 | Free | View In iTunes |
|
55 |
CleanSecuraBit EP51 - Malware Detection With Sunbelt Software | SecuraBit EP51 - Malware Detection With Sunbelt Software Listen in as we discuss Sunbelt Software's CWSandbox and other products, along with in-depth malware detection and analysis! #BSidesSF - Tuesday/Wednesday, March 2-3, 2010 @ 10am - 5pm #BSidesAustin - Saturday, March 13, 2010 #BSidesBOS - Saturday/Sunday, April 24-25, 2010 Chat with us on IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – @anthonygartner Christopher Mills – @thechrisam Chris Gerling – @chrisgerling Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Guests: Brian Jack - Sunbelt Software Chad Loeven - Sunbelt Software Links: http://www.sunbeltsoftware.com/ http://www.sunbeltsoftware.com/Malware-Research-Analysis-Tools/Sunbelt-CWSandbox/ http://www.securitybsides.com/ | 3/2/10 | Free | View In iTunes |
|
56 |
ExplicitShmoocon 2010 Podcasters Meetup - NSFW!!!!!! | This is the audio from the 2010 pod-casters meet up. This is UNEDITED and completely raw. This file is NOT safe for work. You have been warned. | 2/16/10 | Free | View In iTunes |
|
57 |
ExplicitSecuraBit Episode 50: Interview with Rob Lee! | SecuraBit Episode 50: Interview with Rob Lee! What is SANS vLive? Forensics DOD Cyber Crime How the forensics classes are structured. 508 course and how it's changed. Divided up into essentials and then follow on courses. 6 total courses for all of the info. APT - Advanced Persistant Threat Q & A from the IRC If you haven’t taken the Security 508 course yet we have an excellent opportunity for you! Rob will be teaching the SEC508 (Forensics) course via the SANS vLive! platform beginning 3/23/2010. Classes will occur every Tuesday and Thursday until 4/29/2010 from 7-10PM EDT. Use code SB508 to get a free GCFA certification attempt with the purchase of the full course. Chat with us on IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – @anthonygartner Christopher Mills – @thechrisam Chris Gerling – @chrisgerling Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Guests: Rob Lee - @robtlee Links: http://phishme.com/ http://phishtank.com/ | 2/15/10 | Free | View In iTunes |
|
58 |
CleanSecuraBit Episode 49: ConFoo.ca! | SecuraBit Episode 49: ConFoo.ca! Podcasters Meetup - http://www.podcastersmeetup.com/ ShmooCon - Saturday Evening @ 8PM SANS Discount Code SB508 - Free GCFA attempt when using this link. Philippe Gamache: Day job is focused on secure programing, developer training and code audit. About ConFoo.ca: -New conference about web technology -PHP Quebec Conference offshoot -Get all the user groups in the Monteral area together to share information -8 Separate tracks at the time ShmooCon FireTalks Escaping the clutches of The GOOG - http://www.securabit.com/2010/01/21/escaping-the-clutches-of-the-goog/ Hosts: Anthony Gartner – @anthonygartner Christopher Mills – @thechrisam Chris Gerling – @chrisgerling Nicholas Berthaume - @aricon Andrew Borel – @andrew_secbit Guests: Philippe Gamache - ConFoo.ca - @SecureSymfony Chat with us on IRC at irc.freenode.net #securabit Links: ConFoo.ca - http://www.confoo.ca/en | 1/31/10 | Free | View In iTunes |
|
59 |
CleanSecuraBit Episode 48: Shmoocon (The Big Cheese) and PhoneFactor! | Hosts: Anthony Gartner – @anthonygartner Christopher Mills – @thechrisam Jason Mueller - @securabit_jay Chris Gerling – @chrisgerling Guests: Bruce Potter - Shmoocon - @gdead Steve Dispensa - CTO and Co-founder of PhoneFactor - http://www.phonefactor.com/about/management-team/steve-dispensa/ @dispensa Marsh Ray - PhoneFactor - @marshray Recent goings on: If you are going to Cybercrime contact Jason Mueller (@securabit_jay) and see if he wants to meet up! Sean Hausauer and David Shpritz join the crew! Check out their blog postings! SANS vLive! January 26, 2010 @ 2PM EST - Joshua Wright - Wireless Security (1 hour) Use coupon code SECURABIT for $20.00 registration fee. Regularly $495.00 http://www.securabit.com/2010/01/13/sans-vlive-with-joshua-wright/ First Guest - Bruce Potter - Shmoocon - @gdead Logistics of putting on a conference. New events! Ticket sales process is constantly evolving. Wardman Park in 1920's: http://www.shorpy.com/files/images/29398u.jpg ShmooCon 2010 FireTalks: http://www.novainfosecportal.com/2010/01/06/shmoocon-2010-firetalks/ Podcasters Meetup: http://www.podcastersmeetup.com/ PhoneFactor: How to fix SSL/TLS in software The process of working with vendors to get a solution implemented. Project Mogul End: Join us on January 27, 2010 when we speak with Phillipe Gaumeche about the ConFoo.Ca conference. Chat with us on IRC at irc.freenode.net #securabit Links: Shmoocon - http://www.shmoocon.org/ PhoneFactor - http://www.phonefactor.com/ Not on the air: Andrew Borel – @andrew_secbit | 1/17/10 | Free | View In iTunes |
|
60 |
ExplicitSecuraBit Episode 47: Double Dutch! | Listen in as we interview 1Password and NetWitness! Dave Teare - Co-Founder of 1Password Agile Web Solutions' 1 Password http://agilewebsolutions.com/products/1Password Q's What was the motivation to create 1Password? There are two key chain types that are used. Why the switch to the other one? When will we be able to sync across the iphone cord? (Edge/3G) 8.02.11 BGA type Are there plans to port 1Password to Win/Lin platforms? 1password Anywhere? Is there a way to import from other password managers? CSV format what is the difference between the 1password pro and the touch pro? http://help.agile.ws/1Password_touch/pro_vs_standard.html What is the diffrence between 1Password and 1Password Pro? Who actually maintains the twitter account? Find out more at http://get1password.com NetWitness - Eddie Schwartz http://www.netwitness.com/ Q's How long have you been with NetWitness? http://download.netwitness.com/ http://download.netwitness.com/download.php?src=DIRECT Google Earth integration - Very Cool!! What OS will the free or paid version work on and will it work from within a VM? What does netwitness do at the layer 7 level? Join us in IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – @anthonygartner Christopher Mills – @thechrisam Jason Mueller - @securabit_jay Andrew Borel – @andrew_secbit Guests: Dave Teare - 1Password Eddie Schwartz - Netwitness | 12/21/09 | Free | View In iTunes |
|
61 |
CleanSecuraNibble Episode 03 - Security Hour on IMP | SecuraNibble Episode 03 - Security Hour on IMP This SecuraNibble is released out of band is an extra episode outside our normal releases. This SecuraNibble is the recording of the conversation that happened on The International Mac Podcast held during their 12 Cubed event held on December 12, 2009. The conversation was a general security round table held between our own Anthony Gartner, and panel of 4 other security pod-casters. The panel of pod-casters include Bart Busschots of the International Mac Podcast, George Starcher of Typical Mac User Podcast, and the one and only Paul Asadoorian of PaulDotCom.com fame. This SecuraNibble is not an extremely in depth and geeky conversation but one that covers a lot of general information and it applies to all operating systems not just the mac. | 12/13/09 | Free | View In iTunes |
|
62 |
ExplicitSecuraBit Episode 46 – Making a Faster and Safer Web with Billy Hoffman | SecuraBit Episode 46 – Making a Faster and Safer Web with Billy Hoffman Details of the Academy Pro Deal New affiliation with the Academy Pro Old podcasts at http://www.theacademypro.com/podcasts.php Help people have a better user experience on the web. Zoompf -Billy's new company Common Mistakes on Low Performing Websites What is the best CMS to use. How the report on Zoompf is being run currently. New cameras and metadata http://en.wikipedia.org/wiki/Exchangeable_image_file_format -how much does the extra metadata take up in a file? AT&T service and coverage The origin of the name Zoompf Link farms and domain squating ICANN IPV6 ShmooCon Upcoming Events http://www.google.com/calendar/ical/pe2ikdbe6b841od6e26ato0asc%40group.calendar.google.com/public/basic.ics http://www.security-twits.com/ Join us in IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – @anthonygartner Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Jason Mueller - @securabit_jay Andrew Borel – @andrew_secbit Guest: Billy Hoffman - @zoompf - http://zoompf.com/blog/ | 12/5/09 | Free | View In iTunes |
|
63 |
CleanSecuraBit Episode 45 – More on DOJOCON | SecuraBit Episode 45 – More on DOJOCON Marcus J Carey discusses MetaSponse tool to be released in mid-December. This uses the MetaSploit Framework for Incident Response. Metasploit Framework 3.3 Released! http://blog.metasploit.com/2009/11/metasploit-framework-33-released.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+metasploit%2Fblog+%28Metasploit+Blog%29 Join us in IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – @anthonygartner Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Jason Mueller - @securabit_jay Andrew Borel – @andrew_secbit Guest: Marcus Carey – @marcusjcarey Links: DojoCon - http://www.dojocon.org/ Hackers for Charity - http://www.hackersforcharity.org/ hak5 - http://www.hak5.org/ NoVA Hackers - http://groups.google.com/group/novahackers dojosec @ USTREAM http://www.ustream.tv/dojosec White Wolf Security - http://www.whitewolfsecurity.com/ ShmooCon 2010 - http://www.shmoocon.org/ Netwars Competition - http://www.sans.org/netwars/ International Spy Museum - http://www.spymuseum.org/ Cyber Forensics: Digital CSI - http://spymuseum.org/programs/calendar_pages/2009/q4/2009_12_01_prog.php http://hashtags.org/tag/roachesmustdie | 11/24/09 | Free | View In iTunes |
|
64 |
CleanSecuraBit Episode 44 - Dennis Hurst and Movember! | SecuraBit Episode 44 – Guest Interview: Dennis Hurst, Senior Application Security Architect at HP Software & Solutions and a founding member of the Cloud Security Alliance Discussion of security and Agile development. Scaling agile requires feedback mechanisms and strong visibility http://h71028.www7.hp.com/enterprise/us/en/messaging/feature-software-scale-agile.html HP Application Security Center http://www.hp.com/go/stophackers Cloud Security Alliance http://cloudsecurityalliance.org Movember: Chris Gerling and Andrew Borel represent SecuraBit! http://us.movember.com/mospace/99916 (Chris) http://us.movember.com/mospace/361416/ (Andrew) Join us in IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – @anthonygartner Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Guest: Dennis Hurst Links: Movember - http://us.movember.com/ Donate to Security Podcasters Alliance - https://www.movember.com/us/donate/your-details/team_id/997 Security podcasters get hairy for charity - http://www.securecomputing.net.au/News/159403,security-podcasters-get-hairy-for-charity.aspx | 11/20/09 | Free | View In iTunes |
|
65 |
CleanSecuraBit Episode 43 – The Academy Pro | SecuraBit Episode 43 – The Academy Pro Guest Interview: Peter Giannoulis of The Academy Pro Metasploit Rising http://blog.metasploit.com/2009/10/metasploit-rising.html WordPress 2.8.5: Hardening Release http://wordpress.org/development/2009/10/wordpress-2-8-5-hardening-release/ Blubrry PowerPress Podcasting Plugin for WordPress http://www.blubrry.com/powerpress/ Time Warner Cable Exposes 65,000 Customer Routers to Remote Hacks http://www.wired.com/threatlevel/2009/10/time-warner-cable/ Google Voice voicemails appearing in public search results http://www.engadget.com/2009/10/19/google-voice-voicemails-appearing-in-public-search-results/ TweetDeck http://www.tweetdeck.com/beta/ Porn, CSS History Hacking, User Recon and Blackmail http://ha.ckers.org/blog/20091021/porn-css-history-hacking-user-recon-and-blackmail/ Windows 7 http://www.microsoft.com/windows/ Magic Mouse http://www.apple.com/magicmouse/ Quick Shell Script to Extract Contents http://pinowudi.blogspot.com/2009/10/quick-shell-script-to-extract-contents.html Join us in IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – @anthonygartner Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Guest: Peter Giannoulis Links: The Academy Pro - http://www.theacademypro.com/ The Academy Home - http://www.theacademyhome.com/ Don't forget to listen to the end of the show for the guest appearances by both Kermit the Frog and Sean Connery | 10/27/09 | Free | View In iTunes |
|
66 |
CleanSecuraBit Episode 42 - Phreaking Sweet Con in TN. | SecuraBit Episode 42 – Phreaking Sweet Con in TN. Phreaknic 13 – October 30 – November 1 2009 Phreaknic Curse CCTV throughout hotel, great + for attending the con Ware Chair Toss Firing a jet engine in the parking lot. Four Tracks 1 Cumberland (Main ballroom) 2 9th Floor (Vendor Area) 3 Cafe Area (Gaming) 4 Contest Area Size of conferences ShmooCon Running Conferences #RoachesMustDie from ShmooCon 2009 via Security Justice http://www.youtube.com/watch?v=6FsuvbGJ6f4 Microsoft Security Essentials - http://www.microsoft.com/security_essentials/ Google Wave - http://wave.google.com/help/wave/about.html New iTunes Store - http://www.apple.com/itunes/ Hotmail, Yahoo, and Gmail email passwords exposed - http://www.cso.com.au/article/321185/gmail_yahoo_mail_join_hotmail_passwords_exposed 1password - http://agilewebsolutions.com/products/1Password iKeepass - http://ikeepass.de/ Inside the URLZone Trojan Network - http://www.threatpost.com/blogs/inside-urlzone-trojan-network-105 Metasploit hiring in Austin, TX Rockstar QA Engineer Needed - http://austin.craigslist.org/sof/1410600092.html jQuery/Ruby Ninja Needed - http://austin.craigslist.org/sof/1410620402.html New version of Pocket God for the iPhone Hacker Consortium - http://hackerconsortium.com/ hack.rva - http://twitter.com/hackRVA - http://hackrva.org/ TechShop - http://techshop.ws/ Join us in IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – @anthonygartner Chris Gerling – @chrisgerling Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Guest: SkyDog Links: Phreaknic 13 - http://www.phreaknic.info/pn13/ | 10/13/09 | Free | View In iTunes |
|
67 |
CleanSecuraBit Episode 41 - Speaking of Cons, and forensics... | SecuraBit Episode 41 - Speaking of Cons, and forensics... Part 1: Marcus Carey Dojocon - http://www.dojocon.org/ - @dojocon November 6 & 7, 2009 Capitol College Maryland Part 2: Scott Moulton http://www.microforensics.com/pages/software-mercury.php (link below) blackberry stuff: bitpim Hosts: Chris Gerling – @chrisgerling Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Anthony Gartner – AnthonyGartner.com - @anthonygartner Guest: Marcus Carey - http://www.dojocon.org/ - @dojocon Scott Moulton - http://www.myharddrivedied.com/ Links: Dojocon - http://www.dojocon.org/ - @dojocon Mercury - http://www.microforensics.com/pages/software-mercury.php BitPim - http://www.bitpim.org/ | 10/6/09 | Free | View In iTunes |
|
68 |
CleanSecuraBit Episode 40 - Paul WHO???? | SecuraBit Episode 40 - Paul "Pauldotcom" Asadoorian Microsoft Security Bulletin MS09-048 - http://www.microsoft.com/technet/security/Bulletin/MS09-048.mspx Microsoft Security Bulletin MS07-063 - http://www.microsoft.com/technet/security/bulletin/MS07-063.mspx Renaud script to go from Nmap to Nessus Interview with Paul Asadoorian (PaulDotCom/Tenable/Nessus) Intro Questions: Who are you, and what are you doing on THIS podcast? Tell us about the PaulDotCom podcast (I’ve talked to SecuraBit listeners who have never heard of PDC) How long have you been using Nessus? When did you start working for Tenable? What is your role at Tenable? Nessus Questions: What’s new in this version of Nessus? Are changes driven primarily by Tenable, or the community? What does Nessus use for a scanning engine? How does Nessus interact and work with Nmap? Explain Nessus licensing and what an individual vs a corp is entitled to. How much is a license? Cost of proffesional feed = $1200.00/year Home feed no longer a delay, no SCADA plugins How does Nessus differ from OpenVAS? Can you use the OpenVAS repo with Nessus? Talk about the extensibility of Nessus. (Scripting, etc) How does Nessus work with OVAL definitions? How does this help for FDCC compliance? Does tenable have any dedicated appliances for enterprise scanning and monitoring based on nessus? Implementation and Operation questions (How Paul Does Things): Do you place scanning servers on each segment of the network, or do you scan through zone-to-zone firewalls? Why? Is there a practical limit to the number of deices that can be scanned by one scanning server? Or is it just a time tradeoff? How often do you scan (and re-scan) a network? How do you handle the results (and avoid dropping a 300 page Nessus report on the server guys and saying FIX IT) Are results parse-able and able to be fed into compliance and risk management tools? Other Questions: When is the next PaulDotCom episode? What are the topics/guests? What is your favorite beer? Hosts: Anthony Gartner – AnthonyGartner.com @anthonygartner Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Ed Smiley - @edsmiley Guest: Paul Asadoorian - @pauldotcom - http://www.pauldotcom.com Links: Nessus - http://www.nessus.org/nessus/ Tenable Network Security Blog and Podcast - http://blog.tenablesecurity.com/ | 10/2/09 | Free | View In iTunes |
|
69 |
ExplicitSecuraBit Episode 39 - Stealing candy from little kids everywhere!!! | SecuraBit Episode 39 – Stealing candy from little kids everywhere!!! Jay brought up that some government web sites will be switching to an http://openid.org authentication What Does DHS Know About You? - http://philosecurity.org/2009/09/07/what-does-dhs-know-about-you How to request your travel records - http://www.hasbrouck.org/blog/archives/001607.html TwiGUARD - http://twiguard.com/index.html TweetDeck - http://tweetdeck.com/beta/ MS IIS FTPD DoS ZER0DAY - http://www.milw0rm.com/exploits/9587 Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. - http://www.milw0rm.com/exploits/9594 Poison Ivy Remote Administration Tool - http://www.poisonivy-rat.com/ FRHACK: Pentesting Live DVD - http://pentestit.com/2009/09/09/frhack-pentesting-livedvd/ Upcoming Events: SANSFIRE 2009 - http://www.sans.org/sansfire09/ Baltimore, MD - June 13 - 22, 2009 Phreaknic 13 - http://www.phreaknic.info/pn13/Site_2/Welcome.html October 30 - November 1 2009 SANS Cyber Defense Initiative - http://www.sans.org/cyber-defense-initiative-2009 Washington, DC - December 11 - 18, 2009 ToorCon - http://www.toorcon.org/ San Diego Convention Center - October 23rd-25th, 2009 Join us in IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – http://www.anthonygartner.com – @anthonygartner Chris Gerling – http://www.chrisgerling.com – @hak5chris Christopher Mills – http://www.packetsense.net – @thechrisam Andrew Borel – @andrew_secbit Jason Mueller – @securabit_jay | 9/14/09 | Free | View In iTunes |
|
70 |
CleanSecuraBit Episode 38 – Classic Securabit, Lots of Rambling, Low Content | SecuraBit Episode 38 – Classic Securabit, Lots of Rambling, Low Content Louisville Metro InfoSec Conference in Louisville, KY October 8, 2009 8am - 5pm Sponsored by the local ISSA Chapter Some of speakers at the event include: John Strand Lee Kushner Scott Moulton Adrian "IronGeek" Crenshaw http://www.louisvilleinfosec.com/ Presentations are planed to be posted online afterwards. If you wish to attend the conference you can use the discount code of "geek seat" to get $20 off registration Round Table Topic: Who should be responsible for patching? Infrastructure or Security? There is a conversation about the new Snow Leopard for Mac and Macs mail. A brief discussion about Helix, Security Onion, and Splunk 4. Join us in IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – http://www.anthonygartner.com – @anthonygartner Chris Gerling – http://www.chrisgerling.com – @hak5chris Christopher Mills – http://www.packetsense.net – @thechrisam Andrew Borel – @andrew_secbit Guest: Brian Blankenship - chair ( a ) louisvilleinfosec ( dot ) com Links: Louisville Metro InfoSec Conference - http://www.louisvilleinfosec.com/ Security Onion - http://securityonion.blogspot.com/ Splunk 4 - http://www.splunk.com/view/splunk-4-features/SP-CAAAEVR | 8/30/09 | Free | View In iTunes |
|
71 |
CleanSecuraBit Episode 37 – Mapping Networks with Fyodor and NMAP | SecuraBit Episode 37 – Mapping Networks with Fyodor and NMAP NMAP 5 with Gordon "Fyodor" Lyon * How did Nmap start? * What's new in Nmap 5? * Whe kind of legal issues have you faced in regards to NMAP? * Where did the handle Fyodor start? * Will there be a second edition of Nmap book? (below) no second e yet or planned * Where is NMAP Going? * Where do you see Nmap Scripts (NSE) going, possibly doing a community repo? * Will scans for mobile devices in future releases? * Why lua vs. python or ruby or something else? Find the answers to these questions and more by listening to the show. After our interview we cover DEFCON and the Podcasters meetup. Join us in IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – http://www.anthonygartner.com – @anthonygartner Chris Gerling – http://www.chrisgerling.com – @hak5chris Christopher Mills – http://www.packetsense.net – @thechrisam Andrew Borel – @andrew_secbit Jason Mueller – @securabit_jay Rob Fuller – Mubix – http://www.room362.com – @Mubix Guest: Gordon "Fyodor" Lyon - http://insecure.org/fyodor/ Links: NMAP 5 - http://nmap.org/5/ Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning - http://www.amazon.com/Nmap-Network-Scanning-Official-Discovery/dp/0979958717/ref=sr_1_1?ie=UTF8&qid=1250122655&sr=8-1 New 'ping sweep' - http://carnal0wnage.attackresearch.com/node/373 The Programming Language Lua - http://www.lua.org/ WordPress 2.8.4 Security Release - http://wordpress.org/development/2009/08/2-8-4-security-release/ | 8/25/09 | Free | View In iTunes |
|
72 |
CleanSecuraBit Episode 36 - The f0rb1dd3n Network | SecuraBit Episode 36 - The f0rb1dd3n Network We are joined by Jayson Street to talk about his book, Disecting the Hack: The f0rb1dd3n Network, that is due out soon. All Black Hat bags will have an excerpt from the book in them. Additionally we get Jayson's input on the topic of the recent denial of service attacks not coming from North Korea after all. DJ Great Scott gives us an update on the social events at this years DEFCON. Finally we cover media destruction policies. How do you decommission old hard disks? Do you retain the ones from your copiers and fax machines? What about thumb drives? Join us in IRC at irc.freenode.net #securabit Hosts: Anthony Gartner – http://www.anthonygartner.com – @anthonygartner Chris Gerling – http://www.chrisgerling.com – @hak5chris Christopher Mills – http://www.packetsense.net - @thechrisam Andrew Borel – @andrew_secbit Jason Mueller – @securabit_jay Guest: Jayson E. Street – http://f0rb1dd3n.com/author.php Links: http://f0rb1dd3n.com Computer attack may not have originated in North Korea after all - http://blogs.usatoday.com/technologylive/2009/07/evidence-has-surfaced-that-the-denial-of-service-attacks-that-crippled-dozens-of-us-and-south-korean-web-sites-last-week-ma.html UK, not North Korea, source of DDOS attacks, researcher says - http://www.pcworld.idg.com.au/article/311070/uk_north_korea_source_ddos_attacks_researcher_says DEFCON 17 - http://www.defcon.org/html/defcon-17/dc-17-index.html Podcasters Meetup - http://www.podcastersmeetup.com/ | 8/7/09 | Free | View In iTunes |
|
73 |
ExplicitSecuraBit Episode 35 - Content, what content? Oh, THAT content!!! NSFW!!! | SecuraBit Episode 35 - Content, what content? Oh, THAT content!!! NSFW well some anyway!!! Facebook privacy settings are getting simplified. Michal Jackson causes google to trip thinking they had a DOS attack in progress, followed by spam assaults, and all the joke emails. Slowloris DOS the show stream. We discuss OSSEC with Andrew Hay. Join us in IRC at irc.freenode.net #securabit Next live recording is July 15, 2009 at 8pm EDT. Hosts: Andrew Borel - @andrew_secbit Anthony Gartner – http://www.anthonygartner.com – @anthonygartner Chris Gerling - http://www.chrisgerling.com - @hak5chris Christopher Mills - http://www.packetsense.net - @thechrisam Rob Fuller - Mubix - http://room362.com - @Mubix Guest(s): Wesley McGrew - http://www.mcgrewsecurity.com/ - @mcgrewsecurity Andrew Hay - http://www.andrewhay.ca/ - @andrewsmhay Links: http://serverfault.com/questions/32361/how-to-best-defend-against-a-slowloris-dos-attack-against-an-apache-web-server http://www.ossec.net/ OSSEC - http://www.ossec.net/ Andrew Hay's Book - http://www.amazon.com/OSSEC-Host-Based-Intrusion-Detection-Guide/dp/159749240X SecuraBit Episode 35 - Content, what content? Oh, THAT content!!! NSFW well some anyway!!! Facebook privacy settings are getting simplified. Michal Jackson causes google to trip thinking they had a DOS attack in progress, followed by spam assaults, and all the joke emails. Slowloris DOS the show stream. We discuss OSSEC with Andrew Hay. Join us in IRC at irc.freenode.net #securabit and you can find our past episodes at http://www.securabit.com. Next live recording is July 15, 2009 at 8pm EDT. Hosts: Chris Gerling - http://www.chrisgerling.com - @hak5chris Christopher Mills - http://www.packetsense.net - @thechrisam Anthony Gartner – http://www.anthonygartner.com – @anthonygartner Andrew Borel - @andrew_secbit Rob Fuller - Mubix - http://room362.com - @Mubix Guest(s): Wesley McGrew - http://www.mcgrewsecurity.com/ - @mcgrewsecurity Andrew Hay - http://www.andrewhay.ca/ - @andrewsmhay Links: http://serverfault.com/questions/32361/how-to-best-defend-against-a-slowloris-dos-attack-against-an-apache-web-server http://www.ossec.net/ OSSEC - http://www.ossec.net/ Andrew Hay's Book - http://www.amazon.com/OSSEC-Host-Based-Intrusion-Detection-Guide/dp/159749240X | 7/12/09 | Free | View In iTunes |
|
74 |
CleanSecuraBit Episode 34 RoundTable Well Virtually anyway!!! | SecuraBit Episode 34 This week we welcome Scott Fitzpatrick of Symantec to join our roundtable on the news items of the day. News Items: StrongWebMail Fail - http://www.pcworld.com/businesscenter/article/166314/web_mail_company_to_pay_prize_after_ceo_hacked.html TweetDeck still passes authentication in the clear Google Apps criticized about their security iPhone 3.0 Teathering Hack - http://www.jellysms.com/blog/enable-internet-tethering-with-your-iphone-in-2-minutes-on-o2-ireland-with-30-gm/ RSnake's SlowLoris (low bandwidth, greedy, poisonus HTTP client) - http://ha.ckers.org/slowloris/ Mubix presenting a six hour work shop "From Shell to Owning the Company" at ToorCamp DefCon and the Podcasters Meetup - In Sky box 207 and 208 8pm or after the last talk on Saturday night. - Exotic Liability (http://www.exoticliability.com/) and Germaina Newbs (http://grmn00bs.blogspot.com/) will be join the line up. PaulDot Com with Securabity Thursday July 2, 2009 at 7pm. Join us in IRC at irc.freenode.net #securabit Our Next live recording is July 1, 2009 at 8pm EDT. Hosts: Chris Gerling - http://www.chrisgerling.com - @hak5chris Jason Mueller - @securabit_jay Christopher Mills - http://www.packetsense.net - @thechrisam Rob Fuller - Mubix - http://room362.com - @Mubix Andrew Borel - @andrew_secbit Guests: Scott Fitzpatrick Links: Symantec - http://www.symantec.com/ Mubix - Couch to Career - http://www.room362.com/archives/564-couch-to-career-follow-up.html | 7/1/09 | Free | View In iTunes |
|
75 |
CleanSecuraBit Episode 33 - Bursting Clouds with Kostya Kortchinsky | In this episode we talk to Kostya about the process that is behind Cloud Burst. He speaks about breaking out of the existing Virtual Machine and into the host. Once you own the host you have the ability to own other Virtual Machines. Quick Topics: OS X Security Update Palm Pre North Korea Cyberware Air France Flight 447 Hosts: Anthony Gartner - http://www.anthonygartner.com - @anthonygartner Chris Gerling - http://www.chrisgerling.com - @hak5chris Christopher Mills - http://www.packetsense.net - @thechrisam Jason Mueller - @securabit_jay Guests: Kostya Kortchinsky - http://www.linkedin.com/pub/kostya-kortchinsky/4/211/a71 Tim Krabec - http://www.SMBMinute.com - @tkrabec Links: Immunity Inc - http://www.immunitysec.com/ CLOUDBURST exploit video - http://www.immunityinc.com/documentation/cloudburst-vista.html CVE-2009-1244 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1244 53634 : VMware Multiple Products Display Function Host OS Arbitrary Code Execution - http://osvdb.org/53634 Microsoft Security Bulletin MS08-067 - http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx SyScan '09 Singapore July 2-3 - http://www.syscan.org/Sg/program.html The Cassandra Tool - https://cassandra.cerias.purdue.edu/main/index.html Apple Security Update 2009-002 / Mac OS X v10.5.7 - http://support.apple.com/kb/HT3549 Palm® Pre™ - http://www.palm.com/us/products/phones/pre/ North Korea Builds Up Cyber Warfare Unit - http://news.yahoo.com/s/afp/20090505/ts_afp/nkoreaitmilitary Air France Flight 447 - http://en.wikipedia.org/wiki/Air_France_Flight_447 DEFCON® Hacking Conference - http://www.defcon.org/ Immunity CANVAS - http://www.immunitysec.com/products-canvas.shtml | 6/12/09 | Free | View In iTunes |
|
76 |
ExplicitSecuraBit Episode 32 PDF Love! | SecuraBit Episode 32 PDF Love! Dieter talks about how the ifilter will actually allow you to use a pdf to exploit the system because ifilter uses the windows indexing service. He also discusses some of the various methods of prevention including his tool called PDFiD. Penetration Document Format http://www.flickr.com/photos/packetsense/3549486353/ Hosts: Anthony Gartner - http://www.anthonygartner.com - @anthonygartner Chris Gerling - http://www.chrisgerling.com - @hak5chris Christopher Mills - http://www.packetsense.net - @thechrisam Guests: Didier Stevens - http://blog.didierstevens.com/ Links: PDFiD - http://blog.didierstevens.com/2009/03/31/pdfid/ PDF Tools - http://blog.didierstevens.com/programs/pdf-tools/ Security Justice - http://securityjustice.com/ Exotic Liability - http://exoticliability.ning.com/ | 5/27/09 | Free | View In iTunes |
|
77 |
ExplicitSecurabit Episode 31 Show Notes - The Intertubes need a patch Episode | Episode 31 Show Notes - The Intertubes need a patch Episode In this episode we are joined by Russell Butturini, he speaks to the guys about the tool he authored at the suggestion of the hak5 crew. He even talks about some of his horror stories about security. Hosts: Anthony Gartner - http://www.anthonygartner.com - @anthonygartner Christopher Mills - http://www.packetsense.net - @thechrisam Andrew Borel - @Andrew_Secbit Guests: Russell Butturini - http://www.linkedin.com/pub/b/960/913 Links: U3 Incident Response Switch Blade - http://wiki.hak5.org/wiki/U3_Incident_Response_Switchblade Command Line Kung Fu Blog http://blog.commandlinekungfu.com/ http://packetsense.net/blog Extending CVSS Beyond Its Base Score - http://www.packetsense.net/blog/2009/05/12/extending-cvss-beyond-its-base-score/ http://www.splunk.com/ http://www.cisco.com/en/US/products/ps6241/index.html | 5/22/09 | Free | View In iTunes |
|
78 |
CleanSecuraBit EP30 l0phtcrack 6 | This week we interview Christien Rioux and Chris Wysopal about the upcoming release of l0phtcrack 6. Hosts: Anthony Gartner - http://www.anthonygartner.com - @anthonygartner Chris Gerling - http://www.chrisgerling.com - @hak5chris Christopher Mills - http://www.packetsense.net - @thechrisam Jason Mueller - @securabit_jay Guests: Christien Rioux - @dildog Chris Wysopal - @cwysopal Links: l0phtcrack - http://www.l0phtcrack.com/ Adobe Product Security Incident Response Team (PSIRT) - http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html Finjan finds botnet of 1.9m infected computers - http://news.zdnet.co.uk/security/0,1000000189,39643173,00.htm | 5/2/09 | Free | View In iTunes |
|
79 |
CleanSecuraBit EP29 Flash in the TV | This week .... Chris Gerling's experience at Helix training and his impressions of Helix 3 Pro. Flash on the TV. Are TV's the next big botnet? Oracle's buying Sun. Does this mean the end for MySQL? We discuss these topics and more on Securabit Episode 29. Hosts: Andrew Borel - @Andrew_Secbit Anthony Gartner - http://www.anthonygartner.com - @anthonygartner Chris Gerling - http://www.chrisgerling.com - @hak5chris Christopher Mills - http://www.packetsense.net - @thechrisam Jason Mueller - @securabit_jay Links: Live Forensics & Incident Response Featuring Helix3 - http://www.e-fense.com/Docs/E103.pdf Adobe Flash for Your TV Means Hulu in Your Living Room -http://blog.wired.com/gadgets/2009/04/adobe-flash-for.html | 4/26/09 | Free | View In iTunes |
|
80 |
CleanSecuraBit EP28 I am stuck in a VM, and I can't get out!!! | SecuraBit EP28 I am stuck in a VM, and I can't get out!!! Special Guest - Rob Randell This week we are joined by Rob Randell from VMware. We cover recommendations for using Virtual Machines securely, VM breakouts such as cloudburst, and various other issues revolving around the security of virtual machines. Hosts: Andrew Borel - @Andrew_Secbit Anthony Gartner - http://anthonygartner.com - @anthonygartner Rob Fuller - Mubix - http://room362.com - @mubix Guest: Rob Randell – http://vmware.com @rjrandell Steve McGrath - http://cutnet.net Chris Hoff - http://www.rationalsurvivability.com @beaker Links: http://vmware.com | 4/15/09 | Free | View In iTunes |
|
81 |
CleanSecuraBit EP27 No joke!! We have George Starcher!! | SecuraBit EP27 No joke!! We have George Starcher!! This week we have special guest George Starcher and we recorded the show on April 1st. George is a long time podcaster with older shows such as In The trenches which he did with Kevin Devin and later had some guests fill in including our own Anthony Gartner. George is still very active in the security community with his job and also does spots on the The Typical Mac User Podcast as well as a big contributor to their forums. Hosts: Anthony Gartner - http://www.anthonygartner.com - @anthonygartner Chris Gerling - http://www.chrisgerling.com - @hak5chris Guest: George Starcher - http://georgestarcher.com - @GeorgeStarcher Links: http://en.wikipedia.org/wiki/Conficker http://kevindevin.com http://georgestarcher.com/ http://typicalmacuser.com/ http://en.wikipedia.org/wiki/The_Castles_of_Dr._Creep http://www.opendns.com/ http://www.govtech.com/events/vatech2009 | 4/5/09 | Free | View In iTunes |
|
82 |
ExplicitSecuraBit Episode 26: | SecuraBit Episode 26: "@Quine and back to Roots" This week we interview Zach Lanier aka @Quine, the Security Twits manager. We ask all about Security Twits as well as delve into some security topics in the second half. Listen all the way through to hear us as our normal selves without serious guests, it's a riot! Security Twits is a listing of security professionals on Twitter. It's a great opportunity to discover other great people in our community. Go to http://www.security-twits.com/ for more details and follow @securitytwits as well as @quine on twitter. Hosts: Anthony Gartner - http://www.anthonygartner.com - @anthonygartner Chris Gerling - http://www.chrisgerling.com - @hak5chris Christopher Mills - http://www.packetsense.net - @thechrisam Jason Mueller - http://www.securinate.com - @securabit_jay Guest: Zach Lanier - http://n0where.org/ - @quine Links: http://en.wikipedia.org/wiki/Conficker http://www.adam.com.au/bogaurd/PSYB0T.pdf http://it.slashdot.org/article.pl?sid=09/03/23/2257252&from=rss http://ciscofatty.com/ | 3/29/09 | Free | View In iTunes |
|
83 |
CleanSecuraByte Episode 06: HP SWFScan | We're proud to announce a new tool from HP's Application Security Center called SWFScan. Prajakta Jagdale and Matt Wood from the HP Web Security Research Group explain why SWFScan was created, and the hope that it will help developers produce more secure flash applications. Hosts Anthony Gartner - http://www.anthonygartner.com @AnthonyGartner Chris Gerling - Hak5Chris, http://www.chrisgerling.com @Hak5chris Chris Mills - ChrisAM @packetsense Guest Prajakta Jagdale (http://www.linkedin.com/pub/4/93a/785) Matt Wood - HP Web Security Research Group Links SWF Scan (http://www.hp.com/go/swfscan) HP (http://www.hp.com/) Win a Cheeseburger (http://h30423.www3.hp.com/?fr_story=3a98c704f7ef61299c19ef1f648f1acb1a5aeab8&rf=sitemap) | 3/23/09 | Free | View In iTunes |
|
84 |
CleanSecuraBit EP25 Jayson E. Street's Talks about his book f0rb1dd3n | Securabit Episode 25 Show Notes "Jayson E. Street's f0rb1dd3n" This week we interview Jayson E. Street about his new novel f0rb1dd3n. f0rb1dd3n is a fictional story that also provides an overview of the tools, techniques, and culture of hackers. Throughout the story reference to an appendix that will provide the detail information about the item being referenced, and where to find more information. The expected release data is in July 2009 around Black Hat and Defcon. A beta of Sumo LINUX is targeted for release the first week of April. Quine will be our next guest interview. Hosts Anthony Gartner - AnthonyGartner.com @AnthonyGartner Chris Gerling - Hak5Chris, Chrisgerling.com @Hak5chris Chris Mills - ChrisAM @packetsense Guest Jayson E. Street - http://f0rb1dd3n.com/author.php Links http://f0rb1dd3n.com http://osvdb.org http://datalossdb.org | 3/21/09 | Free | View In iTunes |
|
85 |
CleanSecuraBit EP24 A Night with G. Mark Hardy!!! | Securabit Episode 24 ìG, Mark Hardy In this episode of Securait we are joined by G. Mark Hardy, President of National Security Corporation. Topics The history of computer security industry The Shmoocon Puzzle 2009 Badge Puzzle The Value of Information Coffee Wars IX Developing Public Speaking Skills Explaining Technical Topics to Nontechnical Audiences Are bad times good for security professionals? The Value in Investing in Yourself Hosts Anthony Gartner - AnthonyGartner.com @AnthonyGartner Chris Gerling - Hak5Chris, Chrisgerling.com @Hak5chris Chris Mills - ChrisAM @packetsense Jason Mueller - @Securabit_Jay Guest G. Mark Hardy - http://www.gmarkhardy.com/ Links Shmoocon 2009 Badge Puzzle (http://shmoocon.info) CoffeeWars (http://www.coffeewars.org) Between Silk and Cyanide: A Codemaker's War, 1941-1945 (http://www.amazon.com/Between-Silk-Cyanide-Codemakers-1941-1945/dp/0684864223) Tight Security for Tough Times (http://events.techtarget.com/secdefense/) | 3/15/09 | Free | View In iTunes |
|
86 |
ExplicitSecuraBit EP 23 The Echo Show!!! with Guest Marcus Carey | We have a brief discussion hackerspaces. Chris Gerling is looking into starting a hackerspace in the Richmond, VA area. Next we cover the details about SUMO LINUX 2.0 with our guest Marcus Carey. SUMO LINUX 2.0 - Based on a stable version of Debian so we can update with Debian packages and Unbuntu Packages. -Windows response tools will be added. -Build a wiki with detailed documentation of all the tools included to make it easy for a newbie to get started. -No plans for multi-boot. -Distributed out via Bit Torrent. -Memory analysis and RAM dumping. Cheap USB sticks have really helped with this. The analysis is also proving to be a big help in forensics. -Will be coordinating the project on the Securabit forums (http://forums.securabit.com/index.php?showforum=9) -User feedback will help us make it better for everyone. -Post in the forum if you are interested in helping out. Other News Items -Homebrew patches for zero days in the enterprise. -Cell phones and international roaming charges at the border. -What hardware tools should you have in a forensic toolkit? Have something you want plugged on Securabit? Send it to Feedback@securabit.com. If you are interested in helping with the Richmond, VA area hackerspace contact Chris Gerling. Hosts Anthony Gartner - AnthonyGartner.com @AnthonyGartner Chris Gerling - Hak5Chris, Chrisgerling.com @Hak5chris Chris Mills - ChrisAM @packetsense Jason Mueller - @Securabit_Jay Guest Marcus Carey ñ SUMO LINUX http://www.sumolinux.com Links Hackerspaces http://hackerspaces.org SUMO LINUX http://www.sumolinux.com Adobe Zero Day http://isc.sans.org/diary.html?storyid=5902&rss Excel Zero Day http://isc.sans.org/diary.html?storyid=5923 & http://www.microsoft.com/technet/security/advisory/968272.mspx Forensic Talon http://www.logicubeforensics.com/products/hd_duplication/talon.asp | 2/27/09 | Free | View In iTunes |
|
87 |
CleanSecuraBit Episode 22 | Episode 22 Schmoocon Recap We reflect back on Schmoocon 2009, the Podcasters Meetup, and look foward to DEFCON. Also we cover patch Tuesday, Back|Track 4, and a community replacement for Helix. Hosts: Anthony Gartner - AnthonyGartner.com @AnthonyGartner Chris Gerling - Hak5Chris, Chrisgerling.com @Hak5chris Chris Mills - ChrisAM @packetsense Jason Mueller - @Securabit_Jay Links: Schmoocon Podcasters Meetup Microsoft Security Bulletin MS09-003 Microsoft Security Bulletin MS09-004 Back|Track 4 DEFCON Helix | 2/13/09 | Free | View In iTunes |
|
88 |
ExplicitShmoocon Podcaster Meetup Live Audio | Here is the audio from the meetup on 2/6 if anyone is interested. We're releasing this on our feed for anyone who doesn't follow pauldotcom. It's not edited, just raw audio so if you have any complaints keep them to yourself. ;) Thanks to all who came! | 2/10/09 | Free | View In iTunes |
|
89 |
ExplicitEpisode 20: Time Warp Again! | Sorry folks, we will not be releasing episodes out of order anymore. In this episode we discuss: Managing IP space inside a company network. Attributing a device on the network to an employee / function. Standardizing vulnerability management using Security Content Automation Protocol (SCAP) and Open Vulnerability Assessment System (OpenVAS). And briefly touch on the Obama Administration's Outline for their Cyber Security Strategy. Use our Forums! Don’t forget to give us a feedback on Itunes so we can bump the old shows off the list. Thanks again for all the donations for the Tip Jar. Hosts: Anthony Gartner - AnthonyGartner.com @AnthonyGartner Chris Gerling - Hak5Chris, Chrisgerling.com @Hak5chris Chris Mills - ChrisAM @packetsense Andrew Borel - @Andrew_Secbit Special Guest: Tim Krabec (@tkrabec) of the SMBMinute.com Important links for the show and documents used: Open Vulnerability Assessment System Security Content Automation Protocol Obama Administration Outlines Cyber Security Strategy More Cyber Security Regulations Recommended | 2/10/09 | Free | View In iTunes |
|
90 |
ExplicitSecuraBit EP 21 HP Security reasearchers speak with SecuraBit | In this special episode of Securabit we are interviewing Billy Hoffman and Prajakta Jagdale. Billy is the author of the book Ajax Security. Prajakta is a Security Research Engineer with HP and is presenting at this year's ShmooCon. Hosts: Anthony Gartner - AnthonyGartner.com @AnthonyGartner Chris Gerling - Hak5Chris, Chrisgerling.com @Hak5chris Chris Mills - ChrisAM @packetsense Jason Mueller - SecurabitJay Special Guests: Billy Hoffman (http://en.wikipedia.org/wiki/Billy_Hoffman) Prajakta Jagdale (http://www.linkedin.com/pub/4/93a/785) Important links for the show and documents used: HP (http://www.hp.com/) Ajax Security (http://www.amazon.com/Ajax-Security-Billy-Hoffman/dp/0321491939) NoScript (http://noscript.net/) SchmoonCon (http://www.shmoocon.org/presentations-all.html#flash)HP's very own Prajakta Jagdale (She is the security research engineer for HP's Web Security Research Group) & Matt Wood (HP Web Security Research Group) join SecuraBit for a very informative discussion. Questions on Ajax, Flash, and Web Application security. | 2/7/09 | Free | View In iTunes |
|
91 |
ExplicitSecuraBit EP18 Don't say we didn't warn you. | This show is out of order and we debated if we would even release it. Well why not, have a listen if you don't like it delete it and remember we told you so ;) This show was a hostile take over by The guys at SMB Minute. It was all just for fun and happened on Dec 31 2008. Remember we warned you.... Listen at your own risk!!! Don’t forget to give us a feedback on Itunes so we can bump the old shows off the list. Thanks again for all the donations for the Tip Jar. Hosts: Rob Fuller - Mubix, room362.com @mubix Anthony Gartner - AnthonyGartner.com @AnthonyGartner Chris Gerling - Hak5Chris, Chrisgerling.com @Hak5chris Chris Mills - ChrisAM @packetsense Jason Mueller - SecurabitJay Important links for the show and documents used: NONE | 1/25/09 | Free | View In iTunes |
|
92 |
ExplicitSecurabit EP 19 MS DOS's itself, and more!!! | In this episode which is likely to be out of sequence. SecuraBit did a recording on the 31st of the year and we will likely release it but episode 18 was a potential lost episode. Chris Mills talks about how twitter has changed some of it's security measures in the aftermath of the hack on its admin accounts. He even did some testing of a bogus account. We even got into some discussions on which types of phones handle what kind of sites. Please be careful, Jay is going to be getting a twitter account and might actually post. Oh FRAK!!!! The next part on the agenda was the new Windows 7 Beta. This caused Microsoft to DOS itself. Which really takes a LOT to happen. After the break we started to go into some tools we actually use or have used and wanted to recommend. Jay spoke of his Retina software they use. We did play a nice practical joke on jay and left him hanging in the wind for a few moments, but he did recover. Spoke about running ISS for the nice pretty reports for the higher up's and Nessus for the technicians. Anthony mentioned Hot Spot Shield which works on windows, mac, iphone and many other platforms. The chat room recommended Open VPN but none of us had used it. Chris Mills also went into one of the tools he used back in the day but recently started to use again called NTop. Talked about itunes going DRM free. Always a good thing!!! This then drifted in to a conversation about players in general. Jay recommended engadget.com and how they covered CES so well. This then divulged into computers for kids as well as netbooks. Anthony is getting close to being able to do the Mix MInus. This means there will be the chance to play the music / voice mails / audio feedback on to everyone so that we can comment or answer the questions. This will be a welcome addition to the show. Jay stated our new goal - to be "Internet Famous" Don’t forget to give us a feedback on Itunes so we can bump the old shows off the list. Thanks again for all the donations for the Tip Jar. Hosts: Rob Fuller - Mubix, room362.com @mubix Anthony Gartner - AnthonyGartner.com @AnthonyGartner Chris Gerling - Hak5Chris, Chrisgerling.com @Hak5chris Chris Mills - ChrisAM @packetsense Jason Mueller - SecurabitJay Important links for the show and documents used: http://www.iss.net/ http://www.nessus.org/nessus hotspotshield.com http://openvpn.net http://www.ntop.org Check out the end of the cast for Jay's audition for American 1dol!!! | 1/24/09 | Free | View In iTunes |
|
93 |
ExplicitSecuraByte Episode 05 Happiness, Fail Whale beaches Itself!!! | News at 11. Well really we started recording about 8 PM on Monday January 5th. In this SecuraByte episode, Securabit had its largest conference call yet. Securabit was joined by the guys from both SecurityJustice.com and SMBMinute.com, as well as Melissa on Twitter AKA @Geekgrrl. We discussed the security vulnerability discovered with twitter.com's tech support. This is a service many of us use and enjoy. Please have a listen in while we discuss amongst ourselves. Don’t forget to give us a feedback on Itunes so we can bump the old shows off the list. Thanks again for all the donations for the Tip Jar. Hosts: Rob Fuller - Mubix, room362.com @mubix Anthony Gartner - AnthonyGartner.com @AnthonyGartner Chris Gerling - Hak5Chris, Chrisgerling.com @Hak5chris Chris Mills - ChrisAM @packetsense Jason Mueller - SecurabitJay Special Guests: Melissa (@geekgrrl), Tim Krabec (@tkrabec) of the SMBMinute.com, Tom (@agent0x0) securityjustice.com, and Dave (@Securi-D) securityjustice.com Important links for the show and documents used: Britney, Obama Twitter Feeds Hijacked Following Phishing Attack http://blog.wired.com/27bstroke6/2009/01/twits-get-phish.html Fire Fox Addon "Long URL Please" http://www.longurlplease.com/ WIRED just posted this follow up: http://blog.wired.com/27bstroke6/2009/01/professed-twitt.html | 1/7/09 | Free | View In iTunes |
|
94 |
ExplicitSecurabit Episode 17 for xmass Santa gave us an Nmap book to give away!!! | This is a unique episode for SecuraBit, we are teaming up with the Security Justice Podcast to do a double header show. SecuraBit recorded their show from 8-9 PST, then handed off the reins to Security Justice to finish out the night. In doing so we had a combine set of prizes. To win the prize required that you listen and get the correct answer to a trivia question given on SecuraBit. You also had to listen to the Security Justice Podcast to and know the answer to their question as well. SecuraBit even manged to start on time as well as hand off on time. It was a very different type of show due to trying to condense everything in to a single hour. (Good thing we didn't have any real content, Just kidding) SecuraBit opened the show but because Jay needed to switch some things out we actually went to a break faster than normal. When we returned from the break we did indeed have Jay on the line. We started to go into the new Microsoft Zero Day, and Jay informed us that he had been out of the loop for a week but since the patch only came out 73 minute before he found out about it he figured he was right on time. The next topic was Chris Gerling going to sans and taking the forensics 508 course. Chris then told us that he felt like he should never have picked up a helix disk based on the level of knowledge he has now compared to before the course. We also discussed that many states are requiring a Private Investigators license to do forensics. That none of us on the show agreed that this was a good idea, but yet several lobbyists have been pushing for this very idea. Jay asked the question about what was thought about the BGP security vulnerability. Anthony discussed a new site he went to as a security review. After the break, we went into the trivia question. The trivia Question was: What are the flags you have to set in order to do an NMAP-style XMAS scan in Unicornscan? We will post the winner soon in conjunction with the Security Justice podcast. After the trivia question we went into thoughts on what to do about prior employees, handling creditials, voice mails, and emails. We referenced the guy in San Francisco who was fired from the job, but yet still was able to hold the network he left hostage. Don't forget to give us a feedback on Itunes so we can bump the old shows off the list. Thanks again for all the donations for the Tip Jar. Hosts: Rob Fuller - Mubix, room362.com Anthony Gartner - AnthonyGartner.com Chris Gerling - Hak5Chris, Chrisgerling.com Chris Mills - ChrisAM Jason Mueller - SecurabitJay Important links for the show and documents used: No links this time! | 12/22/08 | Free | View In iTunes |
|
95 |
ExplicitSecurabit Episode 16 How many F-Bombs are required for $40 | In this episode we talk about Chris Gerling attending the SANS Cyber Defense Initiative 2008 in Washing DC. He will be taking the Security 508 Computer Forensics, Investigation, and Response course. If you are at the conference please make sure you look for Chris. He also plans to take the new GPEN test while there. We might be bringing the sock monkey to Shmoocon and have him do some interviews. We also spoke about how few businesses are actually checking a persons signature or id for credit cards. Most businesses are simply not checking the cards like they should be. Chris is beginning to wonder if they will card his fiancee between now and when they get married. After the break we came back and mentioned that we were not going going to drop the Fbomb for 40 bucks as was hinted at in the chat room. Went into the issue of dns forwarding being done on CheckFree.com The article was actually from The Washington Post by Brian Krebs. Anthony put a shout out to Ed Smiley for sending both Mubix and Anthony a copy of 1password. It was a Great hookup. Then we covered various apps on the IPhone. We touched on what the encryption is on a 3g network. We found a great powerpoint slide show explaining it. After the last break we went into firewall set ups. Everyone but Anthony is running FIOS so the discussion on how to set up the coax or ethernet wan links ensued. You will just have to listen to it to see what kind of sense it makes. We did get lots of comments from our faithfull in the irc channel (irc.freenode.net #Securabit). From there the show just went down hill with strippers and alcohol. Don't forget to give us a feedback on Itunes so we can bump the old shows off the list. Thanks again for all the donations for the Tip Jar. Hosts: Rob Fuller - Mubix, room362.com Anthony Gartner - AnthonyGartner.com Chris Gerling - Hak5Chris, Chrisgerling.com Chris Mills - ChrisAM Jason Mueller - SecurabitJay Special Guest: Joel Esler from sourcefire.com and Joelesler.net Important links for the show and documents used: http://www.sans.org/cdi08/ http://www.sans.org/training/description.php?mid=98 http://www.sans.org/press/giac_pentest_cert.php http://voices.washingtonpost.com/securityfix/2008/12/hackers_hijacked_large_e-bill.html?nav=rss_blog | 12/9/08 | Free | View In iTunes |
|
96 |
ExplicitSecurabit EP 15 Will the real Joel Esler please step forward! | Sorry for the delay in getting this episode out this time. Anthony got stuck with doing some actual work and then we all got hit by the holidays. We do hope you enjoy the show this week. Mubix attended the CSI Conference and no not CSI on TV, the CSI Anual conference. The topic he found intriguing is Security and Responsibility. If something happens how and to what extent as security professionals are we responsible and accountable. This is a topic he brought up on twitter as well and got a lot of replies back. Some agreeing and some not, Feel free to weigh in on this one. Some of the references that were brought up in response to this topic were Sandboxie, castlecops, and Web of Trust. After the break we went into a discussion on DD Images and using live view on them, but since that was a fail, Chris used QEMU. You can even go get some test images at ProjectHoneypot.org and convert them using a tool dd2vmdk . The conversation went into WPA is not Busted. We referenced Steven Gibson's explantion and Joel Eslers blog posts on the subject. During the break we discussed a great site as well from Josh Wright about Wireless Vulnerabilities & Exploits After the Break we were able to bring in the real Joel Esler. Joel is part time batman as well and Joel has aggred to give us at least one batmobile, but we digress. He actually works for sourcefire. This is an organzation that you should take a look at, it is well worth your time. He also is an avid security blogger and has his own blog at Joel Esler.net Joel talks about he IPS's of today are simply not the same as many of the original IPS's. We lose Joel a little bit during the break and we cut a little more abruptly to break than we normally do. Sorry about that! But we kind of ran out of content and time. SecuraBit would like to make sure everyone has a Happy Holidays and don't forget to leave us feedback on Itunes even if you don't listen via Itunes. We want to get some of these casts out of there that have not posted in years. Hosts: Rob Fuller - Mubix, room362.com Anthony Gartner - AnthonyGartner.com Chris Gerling - Hak5Chris, Chrisgerling.com Chris Mills - ChrisAM Jason Mueller - SecurabitJay Special Guest: Joel Esler from sourcefire.com and Joelesler.net Important links for the show and documents used: http://www.phishtank.com/ http://projecthoneypot.org/ http://www.sourcefire.com/products/3D/?semg=USSFR2&gclid=CISstozXgpcCFQVKtAodijdxXQ http://www.joelesler.net/finshake/Blog/Blog.html http://www.wirelessve.org/news_entries http://en.wikipedia.org/wiki/Dd_(Unix) http://en.wikipedia.org/wiki/QEMU http://isc.sans.org/diary.html?rss http://isc.sans.org/diary.html?storyid=5300 http://www.clamav.net/ http://sandboxie.com/ http://www.castlecops.com/ http://en.wikipedia.org/wiki/Web_of_trust | 11/30/08 | Free | View In iTunes |
|
97 |
ExplicitSecurabit Episode 14 We remind you to not get SWACKED!!! | In this episode we have a special guest Adrian from Irongeek.com. We conversed about the going's on at phreaknic. Adrian presented down there and this is where he ended up meeting Bruce and Heidi Potter from the Shmoocon Group. The discussion covered a little more on the MS08-067 issues, Sans Training, and CEH. This is the first episode where we experimented and used stickam.com to allow the listeners to see just how messed up we really are. After the break, Adrian spoke about how one of the guys from binrev.com turned him on to a book for review called Googling Security: How Much Does Google Know About You? written by Greg Conti. Anthony ended up going into some of new virus / trojan infections. These were on the lines of antivirus 2009 and others of the type. Consensus was that a good cleaner tool was called Rougefix (recommendatin from the IRC channel by Tim Krabek). Adrian recommended a song by Tom Smith about Technical Suport for Dad. We went into a little more information on the New York School district's vulnerability. We also went into a little bit on how to lock down a printer as well. Found a list of the PJL commands for HP. Securabit wanted to remind everyone that if you have anything to say you are welcome to come on the show and tell us what you think and know. It is an open invitation. We want to thank those individuals who have donated to the podcast as well. Check out a couple of our friends podcasts at http://securityjustice.com and the http://SMBminute.com Hosts: Chris Mills - ChrisAM Chris Gerling - Hak5Chris, Chrisgerling.com Anthony Gartner - AnthonyGartner.com Jason Mueller - SecurabitJay Special Guest: Adrian from Irongeek.com Important links for the show and documents used: http://irongeek.com http://www.phreaknic.info/pn12/ http://shmoocon.org http://www.binrev.com/ http://www.amazon.com/Googling-Security-Much-Google-About/dp/0321518667 http://www.technibble.com/repair-tool-of-the-week-roguefix/ http://www.tomsmithonline.com/main1.htm http://timesunion.com/AspStories/story.asp?storyID=732745 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&taskId=120&prodSeriesId=84028&prodTypeId=18972&prodSeriesId=84028&objectID=bpl01965 | 11/10/08 | Free | View In iTunes |
|
98 |
ExplicitSecurabit Episode 13 B00 (Happy Ha110w33n) | In the Halloween Episode 13 where we neglected to mention Halloween, the guys talk about a wide range of topics on the show. The topics we covered included Australia joining the Great Firewall of China, The FBI's Dark Market Takedown, National Cyber Security Awareness Month, CERT Training, spaghetti sauce, and phreaknic 12 (where Chris was going to go but was not able to at the last minute) The East Coast is represented up and down with Chris G traveling to New York. We even had a ghostly apparition that sounded a lot like Jason Mueller. Hosts: Chris Mills - ChrisAM Chris Gerling - Hak5Chris Anthony Gartner - AnthonyGartner.com Jason Mueller - Important links for the show and documents used: http://www.techcrunch.com/2007/12/30/australia-joins-china-in-censoring-the-internet/ http://www.fbi.gov/page2/oct08/darkmarket_102008.html http://www.sickurity.com/ http://www.us-cert.gov/press_room/cyber_security_awareness_month.html https://www.vte.cert.org/vteweb/ http://www.acm.org/ http://www.schneier.com/essay-241.html http://www.phreaknic.info/pn12/ | 10/30/08 | Free | View In iTunes |
|
99 |
ExplicitSecuraByte Episode 4 | This evening we had a podcast about the new Zero Day Exploit. This exploit covers all versions of windows from 2000 and above. Securabit brought in Tim Krabec from the smbminute.com podcast. This covers the article from Microsoft MS08-067. Hosts: Chris Mills - ChrisAM Chris Gerling - Hak5Chris Anthony Gartner - AnthonyGartner.com Guests: Tim Krabec (Cray Beck) Important links for the show and documents used: http://docs.google.com/Presentation?id=dghttrwg_26c47c5xcx http://blogs.technet.com/msrc/archive/2008/10/23/ms08-067-released.aspx http://blogs.msdn.com/sdl/archive/2008/10/22/ms08-067.aspx http://milw0rm.com/exploits/6824 http://blogs.technet.com/swi/ SecuraByte Episode 4Beer Tim's beer Optimator Spaten Munich | 10/24/08 | Free | View In iTunes |
|
100 |
ExplicitSecuraBit Episode 12 | Securabit Episode 12 Anthony Gartner Chris Mills Chris Gerling Chris G rides the Failbus with his FIOS connection IT Jobs: No "Widespread Worry"?: http://blogs.cioinsight.com/biztech30/content/it_careers/it_jobs_no_widespread_worry_2.html Air Force Cyber Command: http://blog.wired.com/defense/2008/08/air-force-suspe.html Cracking one billion passwords per second with NVIDIA video card - http://www.net-security.org/secworld.php?id=6616 BREAK Chris G talks about running VM's in Vista Ultimate 64 bit The guys discuss home networking Soekris Box: http://www.soekris.com/ Netgate m1n1wall firewall 3E 2D3 http://www.netgate.com/product_info.php?products_id=312 AIG Executives Blow $440,000 After Getting Bailout: http://www.foxbusiness.com/story/markets/industries/finance/aig-executives-blow--getting-bailout/ Password Management Systems: Password Safe - http://passwordsafe.sourceforge.net/ KeePass - http://keepass.info/ Password Gorilla - http://www.fpx.de/fp/Software/Gorilla/ - Works on Mac OS X 1Password - http://agilewebsolutions.com/products/1Password Apple Keychain - http://en.wikipedia.org/wiki/Apple_Keychain - Nice, but not portable TrueCrypt on JungleDisk - http://www.windmeadow.com/node/35 New Nevada Law Requiring Businesses to Encrypt Emails with Customers - http://www.reuters.com/article/pressRelease/idUS182108+29-Sep-2008+BW20080929 France required to keep record all connections - http://news.zdnet.co.uk/itmanagement/0,1000000308,39217959,00.htm | 10/13/08 | Free | View In iTunes |
|
101 |
ExplicitSecuraBit Episode 11 | This week Anthony Gartner & Rob Fuller discuss the latest computer security news. Special guests are Vyrus and CP from the dc949.org group. Episode 11 Discussions covered the following topics: Skynet, Advanced Dork, Google Site Indexer, These tools work worked on by CP and Vyrus and the dc949 group and are written as open source. Rob brought up a Firefox add on called Barrier Spoke of how we can use google alerts to help us in our daily tasks to track where our information is being sent out to. Discussion ensued about Scroogle.org not to be confused with scoogle.com and how you can do secure searching though the site and that the site purges logs with in 48 hours. A mention of Cisco was brought up and we also spoke of a visualized version for the Cisco Mips processors and the specific virtualized version of the Cisco 7200 Routers. BlackBerry Encryption keys may be in the hands of the Indian Government as part of the deal with Rim. | 9/29/08 | Free | View In iTunes |
|
102 |
CleanSecuraBit Episode 10 | (Apologies in advance for the short term 'wiki' look of these show notes, the public wiki will be up soon!) On this Episode of Securabit: Chris Gerling - Hak5chris Chris Mills - ChrisAM Anthony Gartner - AnthonyGartner Jason Mueller - SecuraBit_Jay Guest Chris Wilson Episode 10 - A milestone! We are all still alive even though the CERN Particle Collider has been started up. OpenSource Projects, Software, Patches Obama Sex Video Spam New SecuraBit VPS! (We have since cancelled and will be moving to something else soon) Linode with CentOS. However, no SELinux available For CentOS help go to: #CentOS on irc.freenode.net Tips for configuring the new server: Disable root login on ssh Good passwords Lock down ports The Securabit guys started using the CentOS distribution because of its interconnections with Snort See this site for details on how to configure Snort on CentOS In non-security related news: Steve Jobs Apple Special Event "Let's Rock" Apple did update QuicktTime and Bonjour: http://voices.washingtonpost.com/securityfix/2008/09/security_updates_for_ipod_touc.html?nav=rss_blog Netbooks are everywhere: Even Commodore joins Netbook Crowd: http://news.cnet.com/8301-17938_105-10029963-1.html Google Chrome: Milworm Chrome Exploit/Vulnerabilities http://www.milw0rm.com/exploits/6353 http://www.milw0rm.com/exploits/6355 http://www.milw0rm.com/exploits/6365 http://www.milw0rm.com/exploits/6367 http://www.milw0rm.com/exploits/6372 http://www.milw0rm.com/exploits/6386 Google Chrome and Germany: http://www.salon.com/wires/ap/scitech/2008/09/09/D9338OT80_germany_google_chrome/index.html MS commercial analysis: http://www.purpleslinky.com/Humor/Satire/A-Commercial-About-Nothing-Analysis-of-the-First-Microsoft-Seinfeld-Ad.245991 MS Mouse: http://www.maximumpc.com/tags/bluetrack BREAK Schneier and portable device security: http://www.schneier.com/blog/archives/2008/07/open_source_lap.html http://www.schneier.com/blog/archives/2005/07/risks_of_losing.html Latest happenings with Securabit Looking for a Team and mentoring atmosphere Coming soon: New Site/wiki/forums on the Linode VPS Chris Mills: Employer Security Expo Talked about Password Security and showed off Rainbow Tables/Ophcrack (http://ophcrack.sourceforge.net/) and Driftnet (http://ex-parrot.com/~chris/driftnet/) BREAK Chris Wilson | 9/19/08 | Free | View In iTunes |
| 103 | CleanVideoSecuraNibble: Snort Sensor Tutorial | Chris Wilson brings us some Snort goodness with this 37 minute tutorial on how to build a snort sensor from scratch using CentOS. I hope this is of use to everyone, it is very very well done! | 9/16/08 | Free | View In iTunes |
|
104 |
ExplicitSecuraByte Episode 3 | Last night we did a spontaneous hour long interview with the guys from HacDC, a Hackerspaces group. Hosts: Rob Fuller - Mubix Chris Mills - ChrisAM Chris Gerling - Hak5Chris Guests: Nick Farr - Treasurer HacDC Mitch Altman - http://en.wikipedia.org/wiki/Mitch_Altman - NoiseBridge San Francisco Bryce HacDC and Hackerspaces. What is a Hackerspace?: Physical space where hackers make things, in person place to do things rather in addition to online. People can work on their own projects and collaborate with others. Mitch has been working on Brain machines. Tips on how to start a hackerspace: - Visit a hackerspace - Document on Hackerspace design patterns (PDF). - Go to Visit: Hackerspaces.org and email questions about getting started to info@hacdc.org - Last Hope Talk: Building Hacker Spaces Everywhere: Your Excuses are Invalid - Nick Farr and Friends (MP3). If I am not a member, can I go: Yes! Some hackerspaces mentioned: NY Resistor C-base (Berlin Germany) The Hacktory (Philadelphia) Mitch working on SF Space, NoiseBridge NoiseBridge email list Intersting Hackerspace projects: Blinkenlights - Project Blinkenlights was a light installation in the Haus des Lehrers building at the Alexanderplatz in Berlin that transformed the building front into a giant low-resolution monochrome computer screen. tmplab - Paris France http://www.tmplab.org/ (French) Columbia heights Wireless - The Columbia Heights Wireless Project aims to provide wireless access to the Internet to HacDC's neighbors in Columbia Heights. This project, in three phases, will help test different technologies and methods for providing this access as well as building local neighborhood IT infrastructure. | 9/10/08 | Free | View In iTunes |
|
105 |
ExplicitSecuraBit Episode 9 | On this episode of SecuraBit: Multiboot Security DVD Mubix posted an awesome link on his blog to a Multiboot Security DVD that allows you to choose which common security distros, all on one medium! OS Choices: Backtrack 3 Damn Small Linux 4.2.5 GeeXBoX 1.1 (not geekbox ) Damn Vulnerable Linux (Strychnine) 1.4 Knoppix 5.1.1 MPentoo 2006.1 Ophcrack 1.2.2 (with 720 mb tables) Puppy Linux 3.01 Byzantine OS i586-20040404 Make a bootable FAT32 USB stick using Unetbootin Some distros the Securabit guys would like to see added: Helix Intelguardians Samurai RedHat/Fedora OpenSSH Compromises As noted on the Securabit website, a Fedora and Red Hat Enterprise Linux servers were compromised. The ComputerWorld Blog - Linux Security Idiots article explains how the servers were compromised -Stolen SSH keys are used to gain access to the system -After that, rootkit "phalanx2" is installed and steals more SSH keys -Obviously this could be used to install any malware at all The RHEL offshoot CentOS was not affected by the compromise. Joomla Vulnerability US CERT Joomla! Password Reset Vulnerability Joomla Core Exploit Announcement - Password Remind Functionality Joomla user password reset vulnerability being actively exploited BREAK After Break Banter Italy tries to ban PirateBay Awesome Quote: "Fear makes the wolf look bigger" Best Western Pwned Originally Discovered by The Sunday Herald. As many as 8 million accounts compromised Best Western Response Vulnerbilty of BGP This exploit of Border Gateway Protocol allows the attacker to monitor internet traffic and forward it to anywhere in the world. Five hours of traffic was forwarded to New York during Defcon 16. This vulnerability is going to be bigger than the Kaminsky DNS Vuln. Speaking of Dan, he loves Securabit! Defcon presentation from Anton Kapela and Alex Pilosov Border Gateway Protocol Wired - Revealed: The Internet's Biggest Security Hole Wired - More on BGP Attacks -- Updated The Middler Jay Beale - Middler - Release it already! DefCon Talk Audio Steganography Hiding information by slightly altering the binary sequence of a sound file From simple algorithms that insert info in the form of signal noise, to more powerful methods that exploit sophisticated signal processing techniques to hide information. LSB coding (least significant bit):  substitute with a binary msg Parity coding Phase coding:  #  The original sound signal is broken up into smaller segments whose lengths equal the size of the message to be encoded. A Discrete Fourier Transform (DFT) is applied to each segment to create a matrix of the phases and Fourier transform magnitudes. Phase differences between adjacent segments are calculated. Phase shifts between consecutive segments are easily detected. In other words, the absolute phases of the segments can be changed but the relative phase differences between adjacent segments must be preserved. Therefore the secret message is only inserted in the phase vector of the first signal segment as follows: Spread spectrum Two versions of SS can be used in audio steganography: the direct-sequence and frequency-hopping schemes. In direct-sequence SS, the secret message is spread out by a constant called the chip rate and then modulated with a pseudorandom signal. It is then interleaved with the cover-signal. In frequency-hopping SS, the audio file's frequency spectrum is altered so that it hops rapidly between frequencies. Least Significant Bit BREAK Security Justice stops by Tom and Dave from Security Justice -Search for pics of Mubix gets you this -Shmoocon will h | 9/4/08 | Free | View In iTunes |
|
106 |
ExplicitSecuraBit Episode 8 | On this Episode of SecuraBit Jason Mueller Chris Gerling Anthony Gartner Back from three week hiatus. Defcon and BlackHat Defcon Parties: Core Impact Party EthicalHacker.net party Cisco Party Isight Party I-hacked Party StillSecure Freakshow Party ChicagoCon: Boot Camps: Oct 27 - 31 Conference: Oct 31 - Nov 1: http://www.chicagocon.com/ Defcon Badges Ran out of Badges on first day: http://search.twitter.com/search?q=Defcon+badges+out TV-B-Gone built into the badges: http://www.hackaday.com/2008/08/05/defcon-16-badge-details-released/ Servo hacks the badges - LINK? Podcasters Meetup - http://www.podcastersmeetup.com/ and http://securabit.com/2008/08/13/dc16-recap/ Documentary: Hackers are People Too: http://www.hackersarepeopletoo.com/ BREAK More from Podcasters meetup: Maltego - Maltego is an open source intelligence and forensics application - http://www.paterva.com/maltego/ Iphone Metasploit: http://secmaniac.blogspot.com/2008/07/metasploit-3-on-iphone.html Hak5 plug: Show every Monday - http://www.hak5.org/ Drinks: Absolut Mandarin: http://www.absolut.com/us Rain Vodka: http://www.rainvodka.com/ Current news: Georgia and Russia: Cyber Warfare: http://it.slashdot.org/article.pl?sid=08/08/10/0126232&from=rss Estonia to help Georgia: http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9112399& Watch out for tanks in Atlanta: http://is.gd/1qNy MIT Subway Card Hacking Pulled from Defcon: http://news.cnet.com/8301-1009_3-10012612-83.html Talk Posted Here: http://www-tech.mit.edu/V128/N30/subway/Defcon_Presentation.pdf Naval PostGraduate School wins capture the flag: http://swampie.wordpress.com/2008/08/11/naval-postgraduate-school-wins-defcon-capture-the-flag-competition/ Wall of Sheep: http://www.blackhat.com/html/bh-usa-08/wallofsheep.html Lesson: Don't take your production (or perhaps any) computer to hacker conferences Driftnet to catch Jpegs at Defcon: http://ex-parrot.com/~chris/driftnet/ Anthony will be working on Iphone Security Apple sells 95 Iphones/day/store: http://is.gd/1qND Tshirts and Stickers gone, but more on there way? Martin McKeay at Defcon: http://www.cwes01.com/1083/7776/psw/separated.png Direct Download On this episode of SecuraBit: Jason Mueller Chris Gerling Anthony Gartner Back from three week hiatus. Defcon and BlackHat Defcon Parties: Core Impact Party EthicalHacker.net party Cisco Party Isight Party I-hacked Party StillSecure Freakshow Party ChicagoCon: Boot Camps: Oct 27 - 31 Conference: Oct 31 - Nov 1: http://www.chicagocon.com/ Defcon Badges Ran out of Badges on first day: http://search.twitter.com/search?q=Defcon+badges+out TV-B-Gone built into the badges: http://www.hackaday.com/2008/08/05/defcon-16-badge-details-released/ Servo hacks the badges - http://edge.i-hacked.com/new-defcon16-details Podcasters Meetup - http://www.podcastersmeetup.com/ and http://securabit.com/2008/08/13/dc16-recap/ Documentary: Hackers are People Too: http://www.hackersarepeopletoo.com/ BREAK More from Podcasters meetup: Maltego - Maltego is an open source intelligence and forensics application - http://www.paterva.com/maltego/ Iphone Metasploit: http://secmaniac.blogspot.com/2008/07/metasploit-3-on-iphone.html Hak5 plug: Show every Monday - http://www.hak5.org/ Drinks: Absolut Mandarin: http://www.absolut.com/us Rain Vodka: http://www.rainvodka.com/ Curr | 8/15/08 | Free | View In iTunes |
|
107 |
ExplicitSecuraBit Episode 7 | On this episode of SecuraBit, we talk to Chris Eng and Chris Wysopal from Veracode about SOURCE Boston, as well as Jennifer Leggio about Twitter and more: SOURCE Boston identi.ca and OpenID Facebug Bug leaks birthday data ActiveworxA little more on the DNS fiasco (see past show links on DNS issues).Failbus I'm going to be installing wiki software and recruiting some folks to help us do proper full show notes for each episode. We're also looking for people to help out with the forums, IRC, and research for technical segments. If you can contribute in any way we'll make sure you get recognized. Direct link to show here. Remember to hit up the T-Shirt and Sticker page. Soon I will remove the T-Shirt donate link as I will be shipping the box of T-Shirts to Jay to take with him to Defcon. Hit us up on the forums, or at irc.freenode.net #securabit. Thanks for listening! | 7/27/08 | Free | View In iTunes |
|
108 |
ExplicitSecuraByte Episode 2 | Last night we decided to discuss a little more on the DNS vulnerability issue that's been the hot topic everywhere in terms of detection and defense. Thanks to guest Chris Wilson for his invaluable insight into the snort signature we were provided by alexkirk in #snort on irc.freenode.net. We also discussed detection of encrypted traffic on a network, and some of the implications of it. Direct link to the mp3 is here. Apologies for Chris Wilson's audio, his speakers were on unbeknown-st to us, and I cleaned it up as best I could. :) Also, the stickers are finally in! Get your T-Shirts and stickers here! | 7/25/08 | Free | View In iTunes |
|
109 |
ExplicitSecuraByte Episode 1: DNS Haiku | Today we introduce a new portion of the show: Securabytes. Securabytes are unannounced episodes, they could be last minute interviews or just more beer induced security speak. So, without further ado, here is the first Securabyte from the Securabit Podcast. "Introducing haiku-DNS: [laughing corruption collapsing kittens gallop nectars forgiving] = usa.gov" - Chris Wesley McGrew of McGrew Security, Martin McKeay of the Network Security Blog / Podcast, and some guy name Joel joined me (Rob Fuller) last night to discuss the DNS vulnerability leakage that happened about quitting time yesterday (7/21). We discuss the leak, how the vulnerability works, mitigating, and the potential it has on mass scales. Every one of the gentlemen that joined us, and we here at Securabit urge you to patch as soon as possible. If you need further information, please check the following links: Direct link to this episode: http://media.libsyn.com/media/securabit/securabytep01.mp3 Check to see if you are vulnerable: http://www.doxpara.com/ In depth explanation of the vulnerability: http://www.mcgrewsecurity.com/?p=151 More supporting links: http://www.mckeay.net/2008/07/21/patch-dns-now/ http://www.matasano.com/log/mtso/ http://www.doxpara.com/?p=1176 http://blogs.zdnet.com/security/?p=1520 | 7/22/08 | Free | View In iTunes |
|
110 |
ExplicitSecuraBit Episode 6 | On this episode of SecuraBit Chris, Jay, and the crew discuss: Major DNS vulnerability patched! Check your DNS vulnerability status here! BackTrack 3: Hard Drive? More BT3 goodness! (Courtesy of pure_hate) Andy's Trip to Spain! Various other things, and if you haven't noticed by now.. bloopers! We also want to announce that our T-Shirts have arrived, which you can get here! Stickers will be available very soon! As always, hit up the forums and start talking security with other professionals, pop into our irc at irc.freenode.net #securabit (cloaks coming soon!), and send any feedback to feedback@securabit.com or through the contact page on the site here! Thanks for listening! | 7/16/08 | Free | View In iTunes |
|
111 |
ExplicitSecuraBit Episode 5 | On this episode of SecuraBit: Anthony, Chris, Christopher, Jay, and special guest Rob (mubix) discuss: Signature based anti-virus dead? Rubbermaid Botmaster Sentenced BackTrack3 Final released! Using Google Earth to crash neighboring pools Crazed Bovine Traversal Distributed Honeypot Project The iTunes link on the front page here works again!!! Check out the forums, and our IRC at irc.freenode.net #securabit. Any feedback is welcomed either through the contact form, or at feedback@securabit.com, or on the forums. Thanks for listening!! | 6/29/08 | Free | View In iTunes |
|
112 |
ExplicitSecuraBit Episode 4 | On this episode of SecuraBit, Chris, Jay, Anthony, Andy, and Chris Mills discuss: * Integrity of Fax Signatures. * Metasploit hacked? Layer 2 VLAN fun. * Clever Museum Theft. * Ironkey-like USB Flash Drive: DiskGO GUARDIAN. * Virus that encrypts your data. * Safari Carpet Bombing, and more! Make sure to hit up our forums, and IRC at irc.freenode.net channel #securabit Send all feedback to feedback@securabit.com or use the contact page on the site. We apologize for the delay! Thanks for listening! | 6/17/08 | Free | View In iTunes |
|
113 |
ExplicitSecuraBit Episode 3 | On this episode of SecuraBit, Chris, Jay, Anthony, Andy, and Chris Mills discuss: TJ Maxx employee fired for disclosing vulnerability.Atari CEO says TPM chips will end all game piracy.How to sell security.Hackthissite.org call for developers.Large companies paying employees to read internal email.Comcast loses control of its domain name.Various geek talk. Going MP3 only on this episode. Thanks for listening! Direct DL: SecuraBit Episode 3 MP3 | 6/2/08 | Free | View In iTunes |
|
114 |
ExplicitSecuraBit Episode 2 | On this episode of SecuraBit. Chris, Jay, and Anthony discuss: Debian and Ubuntu SSH flaw Open and read the windows hibernation file SSL capable NetcatGoogle sponsors the oCERTExploit-Me web application security testing suiteUS Air Force wants its own BotnetMilitary computer contractor pleads guilty to ID theftJapan worker in 780k porn hits gets “Demoted?”Using Gmail as a Spam BazookaCreating a Master Information DocumentRecovery of data from Space Shuttle Columbia HD Download the MP3 here. Please leave feedback either via comments or to feedback@securabit.com. Thanks for tuning in! | 5/16/08 | Free | View In iTunes |
|
115 |
CleanSecuraBit Episode 1 | On this episode of SecuraBit Chris, Jay and company discuss: YubicoMalicious circuitryWhitelisting/BlacklistingMAC addresses and coffee shopsGamestop and security awarenessSocial EngineeringStorm Worm/Kraken WormFake employers and phishing with monster/careerbuilder/diceJohnny Long's No Tech Hacking For any questions or comments email feedback@securabit.com or post a comment here! Download the iTunes format here. | 5/3/08 | Free | View In iTunes |
| Total: 115 Episodes |
Customer Reviews
Good start, keep up the good work!
Cut from the same cloth as PauldotCom Security Weekly, these guys offer a not-so-politically correct spin on the state of information security. Once you listen to them, you'll realize that behind the casual presentation, are guys that have been down in the trenches and know what they are talking about.
Very good start!
I'm really enjoying this podcast so far. The guys are very knowledgeable and give you thorough, well-educated discussions on various security topics.
great podcast
Intelligent conversations about relavent topics.
Listeners also subscribed to
- Security Justice
- Security Justice
- View In iTunes
- Exotic Liability
- Exotic Liability
- View In iTunes
- Social-Engineer.Org PodCast
- www.social-engineer.org
- View In iTunes
