Liquidmatrix Security Digest Podcast

Episode 7 -- Breach Week Special! Perfectionism is the enemy of publishing on time. It's another week and we've got a solid hour of discussion about the stuff that's important in the world of infosec this week. DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work. ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 4 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good. In this episode:

• News
1. Instagram patches a hole - kinda gets their response wrong
2. Anonymous gets Syrian - 2.4 Million emails leaked
3. ENISA (EU) tells the banks to assume PCs not secure - via Krebs
4. iOS hacker figures out to get free stuff on the app store (at least through in App purchases)
5. Plesk 0day for sale
6. Obama gets emergency powers over the internet
7. The chinese own the telcos
• Breaches
1. Yahoo - 453K passwords
2. formspring - 1 million passwords
3. Phandroid forums - 1 million passwords
4. Billabong - 35000 accounts
5. Nvidia forums compromised - Nvidia also shut down its online store
• Commentary
1. Errata
• Symantec Malfunction
2. Foot In The Door
• CERT at the national level
• Why Canada .gov sucks
• CanCERT is not a CERT (get in touch with sales@ for details on pricing)
• Also, CCIRC is not a CERT (unless you’re in critical infrastructure)
• CERT vs RISS
• Brian Honan Schools You - Source Barcelona 2010
3. Hardcore
• How to do it right inside your company and outside
• CIRT/CERT - industry, national, internal
• practice, practice, practice
• How to share
• Mailbag

1. mailbag@liquidmatrix.org

   So this is the summer of breaches, the hits keep on rolling, my running total of stolen passwords is now at over 10 million accounts. I’ve got a small website (redacted) and I don’t know if I’m doing security right. Help a lady out will ya? Also, will this ever end?

   
   

   Cheers

   Mary K, NZ

• In Closing
1. Bsides/BlackHat/DEF CON -- all but Ben / The Intern shall be there.
2. There are parties in Vegas
3. DEF CON is still cancelled - check status here
4. Hacker Pyramid!
5. BsidesLV schedule is up
6. Spiderlabs wants you to survive
7. don’t be a sexist jerk at BH/DC
8. Tonight, the part of Seacrest will be played by 'elephant shoes'.

Creative Commons license: BY-NC-SA

Episode 6 -- Anybody Know How Google Voice Works? MAGIC! Sorry for the delay in posting folks, someone (cough, @gattaca, cough) has a crappy ISP and someone (cough, SEACREST, cough) talks quietly and has a crappy mic, there's about 7 hours of editing and tweaking on this one -- and it still sounds like crap. DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work. In this episode:

• News
1. BREAKING NEWS: Liquidmatrix Security Male Model on COVER of SCMag (also talks about Risk Management or something)
2. Debit/credit card photos in tweets -- This Twitter account proves the infinite stupidity of humans (and other stupid shit ways to post pictures of your douchetacularness NSFW)
3. Amazon talks about what went wrong in US East & Leap second makes availability pain (Check out the funny Twitter @AmazonStatus & CAP theorem)
4. Phisher faces 50 years in the slammer
5. Alaska Department of Health and Social Services fined for breach & Appeals court calls bank’s security “commercially unreasonable”
6. Pornoscanners go mobile
7. Wireless Hacking Suspected in Air Raid Siren Miscues
8. Comodo blacklists itself (truth in Certificate Selling)
9. Something bad happened in the iOS App Store... twice. Which (considering the relative sizes of the install base of iOS vs. well, everything) is still pretty awesome.
• Commentary
1. Errata
• No, seriously, you need to use the cloud to manage the thing that connects you to the cloud - Cisco jumps the shark on Cloud-washing and treating customers like crap.
2. Foot In The Door
• hire the right auditors
• use them as a tool to raise issues up to the executive
• tell them the problem areas
• invest time in the auditors and point them to your pain
• feed them recommendation
• don’t let them position compliance as security
3. Hardcore
• The box kicking story
• For example -- finding a way to get the answer they don’t want to give
• The prevarication story
• Another opportunity to learn from auditors/old people
• Asking questions into negative space -- to find answers you need to find the place in the middle where the facts have not coalesced.
• Peter Falk - Just one more thing...
• Matlock - How to get the jury to see it your way...
• Mailbag

1. mailbag@liquidmatrix.org

   Long time listener, first time writing in...

   I find myself compelled to write inasmuch as I found myself shouting at my iPod yesterday. I, of course, am referring to "Liquid Matrix Security Digest Podcast Episode 2" where a conversation about "What Should You Do If You Are The CISO Of A Breached Company?" occurred. Forgive me as I left the Post-It note with the timestamps of the offending speech on the mirror in my bathroom so that I may focus my Daily Rage upon it as I carefully shave "I da CISO, bitch!" into my scalp each morning.

   In essence Ben argued that the role of the CISO in the event of a password breach is to stride confidently into the CEOs office and say "I told you this was going to happen, this is not my fault, and we need to force all users to change passwords - Damn The Consequences, Man!" (While this is not a direct quote it it was I very distinctly heard...)

   While this is a nice gedankenexperiment in that it is very cool to imagine ourselves in the role of "Captain Astounding: Protector Of Users" but the reality of a breached company has certain rules..

   1) If the breached company is a startup or new venture the Senior Management regards this event as an existential crisis. Not so much to the company itself - but to their exit plan (hey, who doesn't dream of being bought by Facebook or Microsoft for a billion dollars?) or to their about-to-be-so-far-underwater-they-implode stock options. Lose track of this fact and You Are Toast.

   2) If the breached company is an older company the critical component is the quality of business leadership available. If they take counsel of their fears - see Rule 1. If they take a more mature view you can actually get effective response but know that you have almost no influence on that outcome.

   3) If you were the CISO pre-breach you have to realize your credibility and professional competence is seriously in question by *everyone*. It matters not that you wrote 523 emails protesting storage of passwords in clear text, nor that you did not get the budget to keep your IPS under maintenance, nor that $Security_Requirement was ignored. If this offends your sensibilities I would simply refer you to the Book of Hezekiah, Chapter 9, Verse 27 where it is written "Yea, and the LORD spake unto the people, and the LORD spake "Life is not fair - never said it was, never said it will be - Get Over It!" and thus the people were greatly nonplussed".

   4) If you are the successor to the CISO who ran the shop pre-breach you have to realize that nobody believes anything you say without the Incident Response Consultants agreeing with you. You have not been around long enough for anyone to trust you or to accept your influence. You will not be seen having the same "at-risk" quotient as everyone else (See Rule 1 above).

   5) Almost everyone company that experiences a major breach turns a significant portion of the response and decision making to Outside Counsel and Incident Response Consultants. There are good and bad reasons for doing this - let's just accept that it happens. Fighting these folks - especially Outside Counsel - is generally a No Win situation (See Rule 3 & 4 above).

   So what do you do?

   You do what you can. You use whatever influence you have to try to do the right thing. But realize a breach response is *not* a Security Problem it is a Business Problem and that business folks are going to be in charge. If you cannot deal with that - you might want to become a Incident Response Consultant.

   Love, Uncle @armorguy

• In Closing
1. Tweetup - has to be pushed, sorry folks
2. Bsides/BlackHat/DEF CON -- all but Ben / The Intern shall be there.
3. Also, DEF CON has been cancelled - check status here
4. Hacker Pyramid!
5. Also, have a look at the Declaration of Internet Freedom. We like it. You should like it too. Although Liking it on Facebook shows that you don’t understand the fucking point of the Declaration.
6. As of recording time, tomorrow is the day when the internet shuts down -- DNSchanger DNS servers are going down. So I guess you won’t ever hear this episode.
7. THERE IS NO SEACREST.

Creative Commons license: BY-NC-SA

We've been threatening to do something interesting and cool...

We're happy to announce that we will be producing a bi-weekly video podcast edition - tightly edited to a broadcast friendly 22 minutes in length. Perfect to watch while having lunch or between an episode of M*A*S*H and Barney Miller. 

Thanks for all of your support so far and we look forward to invading your space regularly to make some friends and maybe even learn a thing or two.

((PS: Based on comments from listeners, we're going to make some changes and give you a more granular set of RSS feeds so that you can select to receive exactly the version of our show that makes you the happiest. If you're subscribed to the general feed, this is the last full video episode you'll see.))

Episode 5 -- Everybody's Working For The Weekend (Canada Day Edition) The fun with the Liquidmatrix gang continues in this episode. Pay close attention and you'll notice that there aren't any edits in this one. That's right - one take and we've got it in the can. Lots of good stuff in here - let us know if we missed anything. DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work. In this episode:

• News
1. Operation Card Shop - UGNazi and 23 others get silver bracelets for free from the feds
2. Hotels misrepresent credit card data security measures, FTC is not happy
3. Typo squatter gets spanked by law firm
4. Bank settles with wire fraud victim
5. DHS gives federal agencies threat detection packages and DHS demos cyber attack to help sway lawmakers to pass a cyber bill
6. RSA securid key not so secure - it’s broken - no it isn’t - yes it is - Damn you people - it's the smartcard portion of a dual-use device that's 'broken', quit slamming multi-factor authN.
7. Portswigger get’s new tricks
-
8. Errata Charlatan of the Week
• Commentary
1. Foot In The Door
• LM Team,
  

  First off I want to say that I'm really enjoying the podcast. I'm still very early into my career and trying to transition into InfoSec. I would love to hear about all of your views on Information Security in colleges. I was thinking about it following some twitter chatter between some people and Chris Eng about this. I thought that there were some good conversations. I'm a little bit disappointed since I just finished my M.S in Computer Info Sys with a security concentration. In the classes I took we learned some basic network security concepts. Only touched a bit on web application security. I was hoping we would of done some offensive stuff, but we never did.

  I compared my classes to pen testing classes out there and it seems to me they’re on a better track but what do I know.

  Just some thoughts,
  Jimmy

2. Hardcore
• From a Black Hat to Black Suit - The Last Hope (2008)
• Black Hat to a Black Suit - The Econopocalypse NOW Edition - Notacon (2009)
• The Black Suit Plan Isn't Working - Now What? - The Next Hope (2010)
• Mailbag
1. mailbag@liquidmatrix.org
2. Hi there LiquidM,
   

   Long-time listener, first time emailer!

   I was wondering if you could help me with a small dilemma I'm facing. I've been working as one of those penetration tester types in the financial sector for a while now, and my company treats me right... but more and more I hear the calling of the darkside... no, not THAT darkside, the calls of those working for security companies and $vendor that get to do exciting things with exciting people! The ones that get to actually TALK about their research...

   So, what's a guy to do? Please LiquidM help me, you're my only hope!
   Chris
   
   P.S: Love the show... but you guys are very Canadian O.o' ;) See you guys in Vegas I hope.... eh!

3. Hey there fellow Canucks…
   

   Over the years I've had many IT jobs, from network admin to system admin for small consulting firms in my area (nothing big). A common theme was the unwillingness to implement the most basic of security mechanisms, or acknowledge the possibility that the systems/networks we would implement for our clients were perhaps done in a un-secure fashion. As a security enthusiast this was very frustrating.

   On a few occasions, I would prove this using a few simple demonstrations on how easy malware, or human, could compromise the network (malicious emails, word/pdf docs, ms08_067 for example). Every time my demonstrations were brushed off as "unlikely" or "impossible", requiring a level of technical knowledge that no employee possesses inside "client X". One such place was an ISP, where we would setup and host websites, providing clients with FTP access to upload and download content. I was actually instructed not to make the passwords too complicated, to ensure our clients were able to use it. Even after I had showed my boss a public exploit (from exploit-db) was available for the FTP software used. Again brushed off as "unlikely" seeing the exploit needed to be authenticated to properly function. This, of course, started the debate of weak passwords that lasted all of 2 seconds… At another spot, I actually showed the senior administrator (my supervisor), hosting a SSH server on port 80 was possible… funny. By now I think you get the picture on how security was handled, so I won't go any further.

   My question is what would you say to the lonely sys-admin, in a small to mid sized firm, on how to handle an employer that doesn't seem concerned at all with security? How should the lonely admin tackle these types of issues without annoying "the boss" with this silly thing called "security", when it's obvious he or she is not willing to listen?

   I'm fortunate enough to no longer be in this situation, but I'm sure there are many out there still living with these types of conditions.
   Steven
   
   ps.: hope all of this made sense, and good job on the podcast very much enjoying it so far

Creative Commons license: BY-NC-SA

Episode 4 -- The Gang's all here. Matt has returned from the distant shores of the western USA... but he didn't listen to the podcast from last week - sucker. Lots of good stuff in here - let us know if we missed anything. DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work. In this episode:

• News
1. Facebook Security Reporting Flowchart
2. 79 banks get ponied (or maybe not)
3. more drive by malware and phishing sites according to the goog
4. Bromium debuts micro-virtualization
5. New Mexico retiree data on laptop goes for a walk
6. Data Security and Breach Notification Act of 2012 - Text
7. FAA worried someone might p0wn fancy corporate jet
8. Stealing autocad designs via malware is now a thing in Peru
9. Happy Birthday Alan Turing
10. Errata: Microsoft vs. Free Software
• Commentary
1. Foot In The Door
• ACLs
• Crypto
• malware/network hackers vs. disk crypto
2. Hardcore
• repair work and warranty replacement
• DBAN
• Self encrypting hard drives
• disk destruction
• Mailbag
1. mailbag@liquidmatrix.org
2. Salut les gars à liquides à matrice
   Ma banque a dit ma carte de crédit se sont compromis, je ne sais pas comment cela pourrait se produire, je lance anti-virus et toujours mettre à jour mon ordinateur. Qu'est-ce que je fais mal?
   Merci
   Guy
3. Hi Guys at Liquid Matrix
   My bank said my credit card got compromised, I don’t know how this could happen, I run anti-virus and always update my computer. What am I doing wrong?
   Merci
   Guy

Download the MP3 Listen: Subscribe to us using plain old Also, we're now available through Creative Commons license: BY-NC-SA

It's Episode 3 -- We Should Be So Committed. Your heroes find themselves completely Canadian this week as @mattjay is visiting the extreme west coast of America. DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work. In this episode:

• News
1. Vulnerability in MySQL/MariaDB
2. Bromium discovers vuln that affect many hypervisors on intel platforms
3. Microsoft fixes cert trust list in response to flame
4. Hospital respirators riddled with malware
5. Breach... again
6. Canada wants to listen to your boring airport conversations and so do the brits (on the internet)
7. What do you get when you mix 2 crypto heroes and 2 navy seals (other than @Shpantzer’s best dream ever) - The Circle (no, not google)
8. FLAME, LinkedIn, Last.FM etc... why we’re not following up on a follow up
• Commentary
1. Foot In The Door
• "Try a Firewall"
• pay for your AV
• always update
• use a current browser
• the work computer is not the play computer
2. Hardcore
• More on Authentication - because it's not that easy.
• Oauth and other ways to limit the potential damage.
• 3 Factor Auth for Banking.
• Social Engineering.
• Liquidmatrix Guidelines (coming soon)
• Mailbag
1. mailbag@liquidmatrix.org
2. Hi LM -- We just got breached and my boss is treating the breach like it doesn’t matter (passwords, credit cards and personal info were stolen for a few customers) - help me talk some sense into him! thanks, Anonymous (no, not that Anonymous)

Download the MP3 Subscribe to us using plain old Also, we're now available through Creative Commons license: BY-NC-SA

It's Episode 2 -- and I'm sure you all know what that means... ... no more talk of midichlorians. And the continuing saga of 4 infosec nerds who will attempt to do what has never been done before... bring you a high quality information security related podcast that is not just a long series of injokes, ranting, personality disorders and hard drive snake oil. DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work. In this episode:

• News
1. Breach Week - Linkedin, eHarmony, last.fm
2. Linkedin bad incident response and Leakedin
3. VUPEN Hacked or Not?
4. Google's Attack Warnings
5. More news on Flame - turns out it is ground breaking (at least form a crypto perspective) - and it’s got MS worried - but there’s more, it can work with non-connected systems and relies on human mules - also, Flame falls on its sword
6. Skimmers show up in the Ontario Government
7. Small business owners don’t follow good security practices and don’t think they’re at risk (surprise!)
• Commentary
1. Foot In The Door
• never store passwords in plain text
• when using hashes (SHA1 etc...) SALT please!
• don’t use MD5
• never use the same password twice (space or time)
2. Hardcore Authentication
• authN vs authZ
• retrofitting old auth systems & what’s wrong with hashes
• two factor auth (tokens, soft tokens) DIY Options:Google or Wikid
• building auth properly (openID, Google Login, Facebook Connect)
• handling a password compromise properly
• Mailbag
1. mailbag@liquidmatrix.org
2. Hi LM! Does my company need a CISO? ...thanks! Jeff, California
• Following Up
1. NASDAQ Compensates for limp IPO

Download the MP3 Subscribe to us using plain old Also, we're now available through Creative Commons license: BY-NC-SA

Previously on the Liquidmatrix Security Digest Podcast... There was some talk, it was kinda nice. People said "do it again!" and now you're caught up. Welcome back to the Liquidmatrix Security Digest Podcast. The continuing saga of 4 infosec nerds who will attempt to do what has never been done before... bring you a high quality information security related podcast that is not just a long series of injokes, ranting, personality disorders and hard drive snake oil. DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work. In this episode:

• News
1. Iran has a CERT? yes, it’s called irCert - that is all
2. keylogger in simurgh (an Iranian proxy that has an icon that looks onionish) - found by some good old Toronto boys at UofT (Munk Citizen Lab)
3. Obama create Super-Friends force with industry to fight evil malware overlords
4. Cloudflare’s google apps account gets p0wned (and they come clean about it very quickly)
5. Stiltwalker from DC949 (orange camo FTW!)
6. iOS security doc released by Apple from a Threatpost article by Dennis Fisher
7. Notable Hacks - University of Nebraska lost 650,000 records
8. No chinese backdoor - yes, that sounds dirty
9. Errata - e-Soft legal threat
• Commentary
1. You're only allowed to use APT if you use it properly
• Flame! (remember my name!, I’m going to live forever... oh wait... wrong song) ← but first an intro on Stuxnet/Duqu/Stars
• let’s not forget IXESHE
• Obama does teh cyber ORLY?
2. Flame - p0wning middle eastern regimes since a while back
• Mikko's awesome Wired article
• Mailbag
1. Liquidmatrix Jobs Board
2. Mock Infosec Job Board

Creative Commons license: BY-NC-SA Oh, and just because it's awesome... thanks to Bill Pennington!

You knew it was going to happen sooner or later... Welcome to the first Liquidmatrix Security Digest Podcast. In this series, we will attempt to do what has never been done before... bring you a high quality information security related podcast that is not just a long series of injokes, ranting, personality disorders and hard drive snake oil. DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work. In this episode:

• News
• Sleazy Telcos in Canada
• Facebook lawsuits
• Thrift Savings Plan data stolen
• Smartphone hijacking vuln
• Free Byron
• Attrition.org Security Community Errata
• Commentary
• Facebook IPO and Market Makers
• DEF CON 19 - Security When Nanoseconds Count

Creative Commons license: BY-NC-SA