Liquidmatrix Security Digest Podcast

Episode 0x66

The One Where Ben and Jamie Aren't At RSAC

So the rest of the gang are out playing in either San Fran or Calgary. You get what's left over - actual security professionals doing actual security work.

Upcoming this week...

1. Lots of News
2. Breaches
3. SCADA / Cyber, cyber... etc.
4. finishing it off with DERPs/Mailbag (or Deep Dive)
5. And there are weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• News and Commentary
1. Pentagon Admits, Only a Bug Bounty Will Work US Companies Prefer China over Pentagon, Generals try Cybering Harder
2. John McAfee doesn't computer
• Breaches
1. Internet of Crap - now with Patriot Missiles in Turkey
• SCADA / Cyber, cyber... etc
1. 1Password loopback vuln ... but wait, a rationale response from the vendor
2. DROWNing!!!
3. A little late but congress says no to Flowers By Irene
• DERP
1. UK Minister Compares Adblocking to Piracy. Fails at Internet
2. Ad networks have a vulnerability again
• Mailbag

1. Dear Liquidmatrix,

   How come you're not at RSAC with the cool kids?

   Signed,

   Cool Kids

• Briefly -- NO ARGUING OR DISCUSSION ALLOWED
1. I was in Engadget. Read about it.
2. Incident response methodologies
3. Closing Thoughts
1. Seacrest Says: good luck with the post RSAC conflu

Creative Commons license: BY-NC-SA

Episode 0x65

Ben and Matt Screw Up HTML

Thanks Matt-Dave, this is Ben-Jamie for episode 0x65 (82 for those of you not good with the hexa-ma-decimal) and we're down a bunch of peope tonight but that's okay because we're super committed (except Wil, he's doing who knows what somewhere). Tonight we've got a lot of news about vulns and then a brief stroll through the cybers, derps and mailbags before calling it a night. Hey Matt, what's in the news?

Upcoming this week...

1. Lots of News
2. Breaches
3. SCADA / Cyber, cyber... etc.
4. finishing it off with DERPs/Mailbag (or Deep Dive)
5. And there are weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• News and Commentary
1. glibc - Set fire to the rain
2. Google's advisory on glibc vuln
3. Cisco's firewall doesn't... you know... firewall and it's a pretty nasty vuln affecting millions of ASA deployments making it ripe for worm fodder. The vuln was discovered by Exodus Intel. Predictably the mass scanning started , and Qualys made some pretty good points about this vuln. Notably, Cisco has released an IDS signature back in November; but how does that help an admin who gets the alert. This mitigation probably didn't work.
• SCADA / Cyber, cyber... etc
1. Fireeye vuln let's you whitelist malware
2. Apple Encryption Bomb Dropped
3. Trail of Bits Technical Deep Dive on Apple Encryption
• DERP
1. Fake Download Buttons Be Gone!
2. 3rd Party JavaScript in Major Banks Login Forms
• Mailbag

1. Hi-Di-Ho
   Have you thought about doing a livestream?
   
   Mr. Hanky

• Briefly -- NO ARGUING OR DISCUSSION ALLOWED
1. Docker's Security Upgrades
2. AWS Lambda WAF awesomeness
3. Mimikatz defense
• Upcoming Appearances:  -- more gratuitous self-promotion
1. Dave: - RSA!
2. James: - Nowhere - except for going to Seattle next week
3. Ben: - Nowhere
4. Matt: - RSA!
5. Wil: - in his trailer between takes
6. Other LSD Writers: - There is no Other Writers
7. Closing Thoughts
1. Seacrest Says: Eggplant 2 - Mother approved

Creative Commons license: BY-NC-SA

Episode 0x64

FIVE Golden Digests...

Yup, back again. Actually a thing. There's even some people here to talk to you about security things. And whining. Also, fuck you Skype.

Upcoming this week...

1. Lots of News
2. Breaches
3. SCADA / Cyber, cyber... etc.
4. finishing it off with DERPs/Mailbag (or Deep Dive)
5. And there are weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• News and Commentary
1. Dridex Malware Platform installing Avira
2. Let's encrypt has crossed 500K
3. SANS Securing the Human Newsletters And use Gophish to test them out...
4. Job hunting? White House seeking a CISO
• SCADA / Cyber, cyber... etc
1. Obama gonna make it rain $19 billion cybers
2. ENISA Cyber Europe 2016
3. Hacker doxxes 20k FBI agents
• DERP
1. VTech: "Not our bad..." ¯\_(ツ)_/¯
2. Microsoft doesn't understand what "no" means
3. Avast decides to pull a Comodo
4. Your backups should be in a separate cloud thingie
5. Alibaba security team fails to notice 99 million brute force attempts - TAO says "you're welcome"
• Mailbag

1. Dear Digestives

   What's the deal with auditors and the woodie they've got for full disk encryption on servers in secured data centers?

   Love you all, but I NEED AN ANSWER NOW

• Briefly -- NO ARGUING OR DISCUSSION ALLOWED
1. Archive.org's Malware archive
2. Make all those asshole auditors shut up about O365
3. Specialists Vs. Generalists by some guy named Nick
4. Pamela Anderson is in a movie about the singularity
5. RSA Parties List 2016

• Upcoming Appearances:  -- more gratuitous self-promotion
1. Dave: - RSA, CSA Summit 2016 (Slovenia), FIRST ...25th?
2. James: - I work. A lot.
3. Ben: - Also works. A lot.
4. Matt: - There is no Matt.
5. Wil: - Doesn't work so much... Rehearsing for Radioheaded (again...), more CBC news coming...
6. Other LSD Writers: - There is no Other Writers
7. Closing Thoughts
1. Seacrest Says: Eggplant

Creative Commons license: BY-NC-SA

Episode 0x63

May The Forth Be With You!

Dave's here. Wil's here. Matt's here. Ben's here. I'm here. There's a guest (or two) HOLY CRAP IT'S A REGULARLY SCHEDULED LIQUIDMATRIX PODCAST. Also, Dave claims he's fixed the website - we'll see how that goes.

Upcoming this week...

1. Lots of News
2. Breaches
3. SCADA / Cyber, cyber... etc.
4. finishing it off with DERPs/Mailbag (or Deep Dive)
5. And there are weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• News and Commentary
1. Lessons Learned from the Java Deserialization Bug ( Apache Nose Job that Ben mentioned - everything old is new again)
2. Let's talk a bit about privacy on Tor
3. Baby Monitors live in New York!
4. 2016 Social Security Blogger Award Voting is Open Now
5. Security Firm Norse Corp. Imploding Threat Butt
• Breaches
1. Let's just assume that there have been some.
• SCADA / Cyber, cyber... etc
1. The Muricans are invading Canada's all bran fibre (h/t @ultramegaman)
2. Israel got hacked by the NSA and James Bond
3. Go get your prescriptions from these guys
• Curmudgeon's Corner
1. The latest from Internet Curmudgeons -- tonight Spacerogue - YES THAT SPACEROGUE!
• DERP
1. Developers Accidentially Ship Dropbox and Gmail Logins - Motorola
2. HSBC succesfully defends against DDoS but is offline
3. Security researcher finds 'backdoor' to MediaTek processors
4. Tavis wrecks Comodo
• Mailbag

1. Gentlemen,

   First let me say how happy I am that the Liquidmatrix podcast is pushing out new episodes in 2016. I look forward to listening more.

   That said I find I must take exception to the "Mailbag" commentary in Episode 61.

   <rant>

   What definition of "enterprise" are you using?

   I will heartily endorse that Matt is an "awesome" hacker and that the toolkit he is building at the startup he's at is likely totally awesome. But in what world is a startup also an enterprise?

   Startups use homebrew and open source systems because they are cash-short and it makes more business sense (meaning a combination of financial, risk, compliance, and resource sense) to build versus buy.

   But any true enterprise CISO that used a SIEM built by one of their team members is (using the language of the kids today) “smoking crack”.

   Why? Allow me to expand the thought.. Assume Matt works for me at an $8B company and I adopted the SIEM platform he developed versus using MSSP or SIEM…

   1. As the company grows the amount of time Matt will need to spend building connectors and enhancing the system will continue to grow. Matt will need to take time away from actual security (which is what I hired him for in the first place) and act more like a developer than a security staff member. Is that the best use of his limited time? I doubt it.
   2. Some compliance regimes (yeah, I know, I can hear the complaints now but at the enterprise level this stuff matters) require systems you rely on for security to “have support”. I’m not a development shop! I do security for a company that makes widgets! Crap – now I have a finding in my external audit and my PCI assessor is twitching.
   3. What happens when Matt gets bored (and he will – all good hackers do after a period of time) and leaves the company? Who’s going to support this thing? Now I have to go find an equally awesome hacker (not an easy prospect these days) and hope they can support this now critical piece of security infrastructure. There is a very real possibility that the system will degrade into a useless piece of crap before I can find someone to take over… That’s potentially devastating as I have *nothing* to fall back on.

   Are you seriously asking me to sign up for this amount of risk? REALLY?

   </rant>

   Homebrew and open source security tools have their place and properly used are likely viable solutions in the startup/SMB space. Use in a true enterprise, IMO, is likely going to add so much risk that the cash expense of $VENDORPRODUCT is very much worth it.

   Keep up the good podcast work, y’all. I look forward to more episodes.

   Martin Fisher

• Briefly -- NO ARGUING OR DISCUSSION ALLOWED
1. Michael Geist on the TPP
2. Internet Link Tester / Validator w/ Raspberry Pi (or any Linux)
3. Maximum Absorbency Garment
4. Bill Clinton has used email once or twice. Nope just twice.
5. Safe Harbour 2 is here
6. Google's Vulnerability Reward Program paid out more than $2 million in 2015
• Liquidmatrix Staff Projects -- gratuitous self-promotion
1. Messages from our Sponsors
2. We really need to have more projects
• Upcoming Appearances:  -- more gratuitous self-promotion
1. Dave: - RSA, ATLSECCON, NAB, Interop, Bill's thong shop
2. James: - Currently nothing till Vegas.
3. Ben: - At home
4. Matt: - RSA? Maybe? Come buy me beer during SXSW
5. Wil: - Waiting to take OSCP...
6. Other LSD Writers: - Apparently bloggering...
7. Closing Thoughts
1. Seacrest Says: Out.

Creative Commons license: BY-NC-SA

Episode 0x62

The Return of Dave?

Well, we weren't kidding folks. This is number 3 inside of a month. If you include the special "Blast From The Past" Episode 0x40 Live from SecTor 2014, that's FOUR episodes in a month. Wooooooooo. Now, time to talk security. But first, a moment for Abe.

Upcoming this week...

1. Lots of News
2. SCADA / Cyber, cyber... etc.
3. finishing it off with DERPs/Mailbag (or Deep Dive)
4. And there are weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• News and Commentary
1. Amazon Customer Service Backdoor
2. Bug in Linux Kernel... Patch now The gory details from Perception Point
3. ISO 27017: A New Standard to Learn
4. Update from last week: Actual PDF of Trustwave lawsuit
5. Canada Discovers It's Under Attack by Dozens of State-Sponsored Hackers
• SCADA / Cyber, cyber... etc
1. Pentagon to save the power grid
• DERP
1. Reporter thinks SHODAN is creepy.
2. FBI Runs Child Porn Sites
3. Apple can read (Backed Up) iMessages
4. NY and California Politicians DON'T MATH
• Mailbag

1. @mattjay I'd like to hear you talk for an hour on browser stuff, really.

   — Icon0clast (@Icon0clast) January 21, 2016

• Briefly -- NO ARGUING OR DISCUSSION ALLOWED
1. POCIIGTFO x10 is out.
2. @beaker (Chris Hoff) dispenses wise words
3. If you use OS X - lots of defaults write commands
4. SSH Logins to Slack
5. WhatsApp will add encryption indicators so you know your chats are safe
• Upcoming Appearances:  -- more gratuitous self-promotion
1. Dave: - Will be at RSA, probably in the lobby of the W
2. James: - Wednesday January 27th - TASK. Unknown thereafter
3. Ben: - Hiding.
4. Matt: - Will be at RSA, probably in the lobby of the W (near Dave)
5. Wil: - On CBC Calgary (26:50 or so)
6. Other LSD Writers: - Can't login to post a story either
7. Closing Thoughts
1. Seacrest Says: Jolly Ranchers Make Me Squee

Creative Commons license: BY-NC-SA

Episode 0x40

BLAST FROM THE PAST

I lost this recording - sorry. But I found it so it's all good.

Despite being more than a year old, the entire episode is relevant. Still. (Because InfoSec).

Listen in as Dave, Ben, and James discuss the infosec job, career, education, professional development quagmire with a live audience interjecting with questions and non-canned laughter.

Closing Thoughts

Seacrest Says: Where we're going, we don't need roads...

Creative Commons license: BY-NC-SA

Episode 0x61

THERE IS NO DAVE, ONLY ZUUL

Twice in two weeks. It's almost like we're making this thing a thing. Of course it'd be nice if Dave would fix the website so I could post there. At least libsyn and iTunes still work.

Upcoming this week...

1. Lots of News
2. Breaches
3. SCADA / Cyber, cyber... etc.
4. finishing it off with DERPs/Mailbag (or Deep Dive)
5. And there are weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• News and Commentary
1. Adblock Plus just got uninvited from the ininternet-advertising industry's big conference
2. Yahoo 10k bug bounty
3. Affinity Gaming sues Trustwave
4. AWS Enterprise Accelerator - Compliance -- Standardized Architecture for NIST 800-53 on the AWS Cloud
• SCADA / Cyber, cyber... etc
1. Firm Sues Cyber Insurer Over $480K Loss
2. Ukraine power hacked by someone? But too soon for attribution.
• DERP
1. Griefer hacks baby monitor, terrifies toddler with spooky voices
2. RSA Conference Keynote Speakers
3. RBC doesn't respond to security vuln
4. LastPass LostPass ShmostPass
• Mailbag

1. Hi LSD

   
   

   Why do we keep buying shitty enterprise security products? Can't we be awesome hackers and build our own cool shit?

   
   

   Enterprise Guy

   
   
   Mentioned: Elastalert, OS Query, Talk Slides
• Briefly -- NO ARGUING OR DISCUSSION ALLOWED
1. Topic of Interest: Key Management
2. OpenSSH 0-Day
3. Fast Incident Response
4. I'm still hiring
• Upcoming Appearances:  -- more gratuitous self-promotion
1. Dave: - Hiding.
2. James: - TASK January: Docker and Home Automation Security 2016-01-27 at Metro Hall in Toronto
3. Ben: - Hiding from plumbers
4. Matt: - South by Infosec
5. Wil: - Slumming in Calgary, being a socialist.
6. Other LSD Writers: - Hiding. Scared of the wilderness.
7. Closing Thoughts
1. Seacrest Says: Elon Musk, please land my rocket

Creative Commons license: BY-NC-SA

Episode 0x60

Mid-Season Cliffhanger

Short paragraph containing introductory material and a thanks to listeners (if reasonable)

Upcoming this week...

1. Lots of News
2. SCADA / Cyber, cyber... etc.
3. finishing it off with DERPs/Mailbag (or Deep Dive)
4. And there are weekly Briefs - no arguing or discussion allowed

And if you've got commentary, please sent it to mailbag@liquidmatrix.org for us to check out.

DISCLAIMER: It's not that explicit, but you may want to use headphones if you're at work.

ADDITIONAL DISCLAIMER: In case it is unclear, this is the story of 5 opinionated infosec pros who have sufficient opinions of their own they don't need to speak for anyone except themselves. Ok? Good.

In this episode:

• News and Commentary
1. TrendMicro security fails TrendMicro also asks: What About Canada, Eh?
2. Juniper ScreenOS VPN traffic possibly snoopable... and admin access backdoored. But... They are patching it. And Fortinet as well?
3. We can read encrypted emails on BlackBerry devices, Dutch team says
4. Microsoft Drops Support for IE Older Than 11
5. Cyber Insurers Dictating Cybersecurity Standards?
• SCADA / Cyber, cyber... etc
1. Steal your keys from your doorbell... Forget the Doorbell - APT the Surveillance Camera
2. Project GRIDSTRIKE
3. Reid Wightman Explains Why VFD Mfg Companies Are Stupid
4. SCADAPASS ALL THE PASSWORDS
• DERP
1. T-Mobile. Dude. You suck.
2. Canadian company helps with oppression... again
3. And again... And again...
4. So here's The State of The Onion...
5. So run a Node or donate.
6. (Unsure DERP delivery...) Let's Encrypt certs used to hide malware transmission.
• Mailbag

1. Dear Liquid-whatever-your-name-is,

   Seriously, what the shit.

   Is this a thing again?

   Signed The People

   <!#-- random tag-->

   Also, how come large enterprises don't get small startup security?

• Briefly -- NO ARGUING OR DISCUSSION ALLOWED
1. Using Massscan to push poetry
2. Urban Dictionary Goes Infosec
3. Intro to DFIR
4. I'm hiring again (I swear the last guy survived that incident)
5. Closing Thoughts
1. Seacrest Says: Are you really back? REALLY!?!!

Creative Commons license: BY-NC-SA