Liquidmatrix Security Digest Podcast

Episode 0x25 -- The one with ALL the cybers

We're not sure why this keeps happening.

As is the new normal around here, we've spent more time arguing about the show instead of actually doing the show. Add to that Dave's issues with (a)using a computer, and (b)having a decent ISP. It took a whole lot of goofing about to get this episode into the realm of "listenable". But hey, it's done now. Enjoy!

1. Upcoming this week...
2. Lots of News
3. Breaches
4. SCADA / Cyber, cyber... etc.
5. finishing it off with DERPs/Mailbag and
6. THE DEEP DIVE
7. Our new weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• News and Commentary
1. Krebs gets whacked And does some digging
2. Forbes magazine internet thingy talks about cracking crypto (so does Sophos) (and a lawsuit on the use of RC4 - so another reason to stop using it)
3. Hacked retailers up in arms over $13 million 'fine', Visa lands up in court
4. It's Kali Time
5. MCMC probes The Malaysian Insider over spyware story
• The Breach Report
1. Second Factor FTW
2. Philippines National Telecom Commission Defaced by Anon
3. CCTV hack wins gamblers $33*10^6 (cue Ocean's 11/12/13)
• SCADA / Cyber, cyber... etc
1. You Say: Cyber. I Say: Unsubscribe
2. North Korea restores Internet access, blames US hackers
3. Queensland police to use surveillance drones to combat crime ahead of G20 conference
4. Federal Judge Finds National Security Letters Unconstitutional, Bans Them
5. NERC 2012 Annual Report (pdf)
6. Medical device hacking: The 6 lines of code that could bring down a hospital
7. US Cyber Command Admits Offensive Cyberwarfare Capabilities, Fundamental Shift In US Doctrine
8. U.S. Demands China Crack Down on Cyberattacks
9. Who’s Really Attacking Your ICS Devices?
• DERP
1. EC-Council goes off the deep end
• Mailbag / Bizarro Land
1. Question:

   Anyway, anyway, guys guys guys, come on. I'm in this computer, right. So I'm looking around, looking around, you know, throwing commands at it, I don't know where it is or what it does or anything. It's like, it's like choice, it's just beautiful, okay. Like four hours I'm just messing around in there. Finally I figure out, that it's a bank. Right, okay wait, okay, so it's a bank. So, this morning, I look in the paper, some cash machine in like Bumsville Idaho, spits out seven hundred dollars into the middle of the street.

   That was me. That was me. I did that.

2. Answer:

   What are you, stoned or stupid? You don't hack a bank across state lines from your house, you'll get nailed by the FBI. Where are your brains, in your ass? Don't you know anything?

• The Deep Dive - Security Research and the Law
1. Internet troll “weev” sentenced to 41 months for AT&T/iPad hack.
• Briefly - NO ARGUING OR DISCUSSION ALLOWED
1. The Matrix in less than 600 bytes of JavaScript
2. Branching breach impact model
3. Top 10 Web Hacks of 2012 Webinar (Matt is hosting it with Jeremiah Grossman)
4. Hackers play Space Invaders on Belgrade billboard, get rewarded with iPads.
5. Microsoft to push Windows 7 Service Pack 1 to users starting March 19
• Liquidmatrix Staff Projects
1. The Liquidmatrix Vegas Party- We threatened more news. There will be passes distributed. You can beg your way onto the list by sending an email to vegas2013party@liquidmatrix.org.
2. The BSidesLV Ticket Give-away-

   Three tickets up for grabs:

   • best original piece of artwork incorporating a security rock star; bonus points for using a unicorn
   • best rap song about a major breach
   • best poem describing a vendor DERP

   Judging will be done by The Liquidmatrix Intern. Mocking will be done by us. I'd suggest you start buying a vote early. Email your submission to bsideslv2013@liquidmatrix.org

3. The Security Conference Library 
4. Contribute to the Strategic Defense Execution Standard (#SDES) and you'll be Doing Infosec Right in no time.
5. If you're interested in helping out with openCERT.ca, drop a line to info@openCERT.ca
6. Upcoming Appearances: James speaking at Thotcon, BSidesChicago, BSidesRochester and Training (with Rich Mogull) at BHUSA. Dave will be at Secure Dusseldorf, Infosecurity Europe, Black Hat, DEF CON, Secure Asia
• In Closing
1. Movie Review Hackers
2. everyday is CTF! go set up a team
3. Signing up for a SANS course? Be sure to use the code "Liquidmatrix_150" and save $150 off the course fee! And Liquidmatrix_5 for 5% off a course
4. Seacrest Says: Dave says "screw you Cogeco"

Creative Commons license: BY-NC-SA

Episode 0x24 -- The Robot Uprising

You'd think those worthless meatbag humans would be more respectful.

It looks like we will have a limited incidence of Robots in tonights episode. Of course, nothing in life can be ACTUALLY robot free. That's just silly talk. Also, pro-tip: make grilled cheese sandwiches in the George Foreman after making steak - better than butter.

1. Upcoming this week...
2. Lots of News
3. Breaches
4. SCADA / Cyber, cyber... etc.
5. finishing it off with DERPs/Mailbag and
6. THE DEEP DIVE
7. Our new weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• News and Commentary
1. Pwn2Own: IE, Firefox, Chrome and Java go down ...and Adobe Flash, Reader and Oracle Java exploits Chrome hack details (threat post link) Thanks Ben!
2. Indian .gov puts bounty on botnet takedown
3. China's internet backbone will have security features (also censorship) (SAVA)
4. How Facebook Prepared to Be Hacked
5. Having the MD5 hash of "123456" is probably not the best way to store passwords in your publicly searchable code on github... /via Thierry Zoller. (also don't put your twitter oauth keys in github)
6. International Womens' Day - Don't forget Admiral Grace
7. Freeze All The Robots: Put Android ICS in the freezer to break crypto
8. Harvard sneaks through 16 Deans' email
9. Deja vote: Iran blocks VPN use ahead of elections
• The Breach Report
1. Another bitcoin exchange gets p0wned
2. Ausie Ausie Ausia Bank Oy Oy Oy (Reserve Bank of Australia gets infected, then found out)
3. Pakistan .gov gets hacked
• SCADA / Cyber, cyber... etc
1. Metasploit releases exploit module for Honeywell ICS that has a patch available
2. Formal Paper (pdf) from Ralph Langner Bound to Fail: Why Cyber Security Risk Cannot Be "Managed" Away
3. US Military Advisory Panel Says Nuke a Cyber Attacker
4. Reasons to depend on Kaspersky for ICS/SCADA operating systems -- EXCELLENT IPv6 STACKS
5. BP Fights Off Up to 50,000 Cyber-Attacks a Day: CEO
6. Cyberwar: you lack imagination
• DERP
1. TELUS releases qualitive security survey (pdf link) - completely ignores science, math and proper research
2. Survival of the fittest: Some data-breach victims can't be helped - but they enjoy reacharounds
3. China points at USA and cries "you're stinky and mean"
• Mailbag / Bizarro Land

1. Dear Dudes of the Liquid

   I found a vuln when I was browsing a company's website with w3af? Should I report it?

   Yimmy, Warsaw

• Briefly - NO ARGUING OR DISCUSSION ALLOWED
1. From Space Rogue - The Infinite Daft Loop - productivity in a can
2. Play Donkey Kong as the Princess
3. Browser sec
4. Tripwire aquires nCircle
5. Click to play!!!!
6. Microsoft preps UPDATE EVERYTHING patch batch
• Liquidmatrix Staff Projects
1. The Liquidmatrix Vegas Party- We threatened more news. There will be passes distributed. You can beg your way onto the list by sending an email to vegas2013party@liquidmatrix.org.
2. The BSidesLV Ticket Give-away-

   Three tickets up for grabs:

   • best original piece of artwork incorporating a security rock star; bonus points for using a unicorn
   • best rap song about a major breach
   • best poem describing a vendor DERP

   Judging will be done by The Liquidmatrix Intern. Mocking will be done by us. I'd suggest you start buying a vote early. Email your submission to bsideslv2013@liquidmatrix.org

3. The Security Conference Library 
4. Contribute to the Strategic Defense Execution Standard (#SDES) and you'll be Doing Infosec Right in no time.
5. If you're interested in helping out with openCERT.ca, drop a line to info@openCERT.ca
6. Upcoming Appearances: James speaking at Thotcon, BSidesChicago, BSidesRochester and Training (with Rich Mogull) at BHUSA. Dave will be at Secure Dusseldorf, Infosecurity Europe, Black Hat, DEF CON, Secure Asia
• In Closing
1. Movie Review Moon (it's all about clones - BTW spoiler alert)
2. everyday is CTF! go set up a team
3. Signing up for a SANS course? Be sure to use the code "Liquidmatrix_150" and save $150 off the course fee! And Liquidmatrix_5 for 5% off a course
4. Seacrest Says: "Here's to a hoopy frood who really knew where his towel was." RIP Douglas Adams

Creative Commons license: BY-NC-SA

Episode 0x23 -- Post RSA Actual News

Recovery takes time. There has not been enough time.

There's really not anything significant to note off the top. There's much going on in the world of infosec. I wish that it weren't as true, but even with the wildness of RSA, the cybers never sleep.

You might want to stay until the end of the show to hear about a CONTEST and something even cooler...

1. Upcoming this week...
2. Lots of News
3. Breaches
4. SCADA / Cyber, cyber... etc.
5. finishing it off with DERPs/Mailbag and
6. THE DEEP DIVE
7. Our new weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• News and Commentary
1. Miniduke is older than we thought (Miniduke tells time in China)
2. Cloudflare dDoS post mortem
3. Google services should not require real names: Vint Cerf
4. Oracle Issues Emergency Java Update
5. Wireless brain sensor pack. Future - here we come!
6. The Lightning Digital AV Adapter Surprise
7. When will we trust robots?
• The Breach Report
1. Evernote Security Notice: Service-wide Password Reset Evernote hacked: Emails, encrypted passwords stolen But it's ok, there will be 2 factor auth someday Critics say Evernote breach was avoidable.
2. Envelopes mailed to 26k retired government employees in N.C. exposes SSNs
3. Encrypted laptop, casino reports belonging to federal agency stolen from rental car in Calgary
4. City of Owen Sound websites offline due to porn hack
• SCADA / Cyber, cyber... etc
1. Information Assurance Certification Review Board: Certified SCADA Security Architect (CSSA)
2. NEWS TO NO ONE: SANS SCADA and Process Control Security Survey - the state of the industry is discouraging
3. Recent 10-Ks mentioning "cyber" incidents
4. Canadian Anti-hacking agency slow to learn about Chinese cyberattack
5. Symantec: work on Stuxnet worm started two years earlier than first thought
6. SCADA 'Sandbox' Tests Real-World Impact Of Cyberattacks On Critical Infrastructure
• DERP
1. Jailed hacker allowed into IT class, hacks prison computers
2. Nearly Every NYC Crime Involves Cyber, Says Manhattan DA
• Mailbag / Bizarro Land

1. Dearest Son,

   Why do you people always talk about "the echo chamber"? What is the echo chamber for?

   Love, Mom

• Deep Dive -
1. Government Malware! discuss (Finfisher, Hacking Team)Zero Day Doc
• Briefly - NO ARGUING OR DISCUSSION ALLOWED
1. Recon 2013 CFP opened
2. APT 1 goes back years
3. There's a vuln in sudo (yes, that sudo)
4. Quick and dirty pcap slicing with tshark and friends
• Liquidmatrix Staff Projects
1. The Liquidmatrix Vegas Party- More news to follow
2. The BSidesLV Ticket Give-away-

   Three tickets up for grabs:

   • best original piece of artwork incorporating a security rock star; bonus points for using a unicorn
   • best rap song about a major breach
   • best poem describing a vendor DERP

   Judging will be done by The Liquidmatrix Intern. Mocking will be done by us. I'd suggest you start buying a vote early.

3. The Security Conference Library 
4. Contribute to the Strategic Defense Execution Standard (#SDES) and you'll be Doing Infosec Right in no time.
5. If you're interested in helping out with openCERT.ca, drop a line to info@openCERT.ca
6. Upcoming Appearances: James speaking at Thotcon, BSidesChicago, BSidesRochester and Training (with Rich Mogull) at BHUSA. Dave will be at Secure Dusseldorf, Infosecurity Europe, Black Hat, DEF CON, Secure Asia
• In Closing
1. RIP Stompin' Tom We'll leave a light on.
2. everyday is CTF! go set up a team
3. Signing up for a SANS course? Be sure to use the code "Liquidmatrix_150" and save $150 off the course fee!
4. Seacrest Says: I'm drinking beer at HouSec bitches!

Creative Commons license: BY-NC-SA

Episode 0x22 -- RSA is almost over...

Yes, we all survived, but RSAConflu hurts

So, 4/5th of Liquidmatrix is hanging out at RSAC this week. And we are really tired and would like to go home. Voices are pretty blown so we apologize for channeling Mike Rothman. It's been an exciting week and… well… thank goodness it's over.

1. For this week's special episode...
2. Stupid Vendor tricks
3. BSidesSF + harrassment
4. Buzzword Bingo
5. Speed Dating
6. We Lost
7. I've got 99 problems and Rich ain't one
8. Brian "CyberPotato" Honan

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• No Notes due to SPECIAL REASONS
• Liquidmatrix Staff Projects
1. The Security Conference Library 
2. Contribute to the Strategic Defense Execution Standard (#SDES) and you'll be Doing Infosec Right in no time.
3. If you're interested in helping out with openCERT.ca, drop a line to info@openCERT.ca
4. Upcoming Appearances: James speaking at Thotcon, BSidesChicago, BSidesRochester and secret coolness for Hacker Summer Camp in Vegas. Dave will be at Secure Dusseldorf, Infosecurity Europe, Black Hat, DEF CON, Secure Asia
• In Closing
1. Movie Review: No Review
2. everyday is CTF! go set up a team
3. Signing up for a SANS course? Be sure to use the code "Liquidmatrix_150" and save $150 off the course fee!
4. Seacrest Says: I came for the booth babes and stayed for the bacon licking.

Creative Commons license: BY-NC-SA