Cyber Exposure
Podcast
The lost 2020 episode... We are back and now we are Frictionless!
It was a long summer and fall months; nevertheless, we are back at it. This is the "lost" episode and final for 2020. We will try to be more regular in 2021.Happy New Year! & Stay Safe!In this episode, Gavin and I discuss what we have been up to over the last several months as we'll discuss some major improvements/innovations here at Tenable.
- Listen:
Show notes:
Business Aligned Without Selling Out
In this episode Bill and Gavin discuss becoming more business aligned security leaders and how to influence change.
- Listen:
ML Geek-off
In this episode Bill and Gavin are joined by Wei Tai from the Data Science team to discuss Machine Learning and how accurate the team have identified the major vulnerabilities of 2019. Bill also learns how to press the record button so the team don’t have to record the podcast for a third time in a week.
- Listen:
Predict to protect
In this episode Bill and Gavin discuss predicting the vulnerabilities that matter most through machine learning and reducing the burden of patching the infrastructure.
- Listen:
Bill serves Gavin a bitter tasting Pi
In this episode Bill and Gavin discuss Nessus on Raspberry Pi, which unfortunately didn't make it through the rigorous testing processes, and the top vulnerabilities you should be patching to secure the remote workforce.
- Tenable Solution Center: Protecting Your Remote Workforce
- How COVID-19 Response Is Expanding the Cyberattack Surface
Also apologies if we offend anyone this week, we might be going a tad stir crazy which is affecting our (Gavin's) filter somewhat.
- Listen:
Maslow’s Modified Needs
In this episode Bill and Gavin talk about protecting the new norm of the remote workforce and discuss CVE-2020-0796.
- Listen:
Takeaway RSA
In this episode Bill and Gavin discuss a presentation on the top 5 attack vectors in 2020 according to SANS.
Here’s a link to the video of the presentation Bill and Gavin are referencing: https://www.youtube.com/watch?v=xz7IFVJf3Lk
- Listen:
INIT to win it
New year, new format. Instead of the usual Olson mocking through the use of the latest cyber news, Bill and Gavin will be sharing some inner workings of team Tenable and what the dev are creating.
In this episode, Bill and Gavin talk about the innovation competition between dev teams and measuring the maturity of your assessment practices.
- Listen:
Measuring up
In this special episode, Bill and Gavin are joined by Tenable's CISO Bob Huber and Data Scientist Bryan Doyle. The chaps discuss measurements that matter and how to communicate security effectiveness.
- Listen:
Meet Dave, My Personal Password Manager
In this episode Bill finally gets some payback on Gavin, they discuss Smart Televisions on spending sprees, a goose with a bad attitude and poor cyber hygiene and Bluekeep exploitation. Bill is also joined by Amit Yoran, CEO of Tenable, to discuss learned helplessness in the world of Cyber Security.
- Need a new job? Run for office
- More stunt hacking
- HONK HONK
- Bad hackers
- Market differentiation?
- Who has the real blues
- More adobe flaws
- Listen:
Mo Money, Mo Honey
In this episode, Bill and Gavin talk RDP honeypot, ATM jackpots and RCE hotspots. The chaps are also joined by Satnam Narang to talk about cash app scams.
- Honey is not just for Pooh
- Mo Money
- Oh boy
- Whoa - this is crazy
- A great blog
- Gavin made this up, right?
- RCEs are fun
- The power of VPR
- Mo Money Mo Money
- Listen:
Legit Shhgit
In this episode Bill and Gavin talk about dismantling hotel lamps for fun and profit, multiple router Vulnerabilities and keeping track of private information in repositories. Bill is also joined by Ryan and Scott from the research team to discuss a couple of major zero days affecting Exim and vBulletin.
- Keeping track of all your assets is hard
- Thousands of cloud computing servers could be owned with 'very simple' attack
- Cisco has lots of things needing patching - tieing it to this d-link vulnerability
- Do you know the game - “never have I ever”?
- Are people thinking about BYOD anymore
- Is it me, or could this have been the plan along, too good be true is often
- With all that is going on - could this be a thing that makes you go hmmm and signal had a nasty bug as well
- Here take my charger, please
- Tenable research
- Listen:
All your cat scans belong to us
In this episode Bill and Gavin talk snooping on cat scans, TGIF data breach, breaking into Gavin's bank account with a handy sound board and power grid blackouts. Bill also interviews Steve Smith and Kent Dyer from the Government Affairs team to understand issues affecting Governments across the Globe.
- Can we get Gavin out of retirement
- It could have been way worse
- “My voice is my password, verify”
- TGIF - down under is not as relaxing
- Lessons are everywhere
- How are you feeling?
- Love the idea, the devil will be in the details
- Listen:
Tik Tok Hot Shot
In this episode, Bill and Gavin talk about yet another ransomware outbreak affecting Texas, Bills Moose being petted by a minor celebrity, age old Notepad vulnerability and are joined by Satnam Narang to talk about TikTok shenanigans.
- Where are your notes, or is this your favorite text editor?
- RCEs in Windows 10
- What else happens 20 times a day….
- Do you know what your business does?
- Listen:
Black Hats Recapped IRL
In this episode, Bill and Gavin discuss attacks against adult apps, a WhatsApp flaw that enables an attacker to change messages and join groups, hacking alarm systems with a $2 device, and predicting the NVD future with Predictive Prioritization.
- Rogue Asset Discovery for free!
- Seeing into the future, or before NVD, with Predictive Prioritization
- LockPickingLawyer takes on IoT Alarms
- 3Fun hacking for fun and embarrassment
- WhatsApp hack attack can change your messages
- VXWorks flaw affects over 200M devices
- Listen:
Apples Rotting in Gavin's Vault
In this episode, Bill turns the insecurity tables on Gavin with the IOS 13 keychain bug. The boys also discuss insecure trains, remote code execution vulnerabilities in Atlassian and how to respond to a major outage publicly. Bill is also joined by David Wells who talks about the recent vulnerability he discovered in Comodo AV.
- Major software bug in IOS 13 beta reveals stored passwords without authentication
- Train software snaffled by employee
- Multiple Atlassian Vulnerabilities
- Multiple vulnerabilities to pivot through the Citrix SD-WAN
- Tenable research discover major weaknesses in Siemens
- Cloudflare shows the right way to discuss a major public incident
- Listen:
Overly Convenient Store Cards
In this episode Bill and Gavin discuss strange meetings in English Forests, improvements in security guidelines around IoT devices, bricking iPhone with a single message and the issues with non experts defining Government policy. Bill is also joined by Jimi Sebree to discuss how he discovers new zero days and a recent Arlo Camera teardown.
- All things IoT
- Crime does not pay
- 1 more reason to use a password vault
- Convenient loss @ a convenience store
- 2019 so far so….
- Protect yourself at all times
- When the non-experts are making policy
- Bricking an iphone with malformed imessage
- Fixed in 12.3
- Similar to “Black dot” from last year
- Listen:
Foxy Zero Days and MSSP Misery
In this episode Bill and Gavin talk about a Firefox Zero Day, organizations facing bankruptcy due to ransomware, MSSP's as an attack vector and C&C Slack. The guys are also joined by Matt Everson and Justin Brown from Tenable Research team.
- Breaches costing real money.
- Paying Ransom & other fees
- Firefox has a 0-day
- https://objective-see.com/blog/blog_0x43.html
- CVE-2019-11707
- Help software is the vulnerability
- Slack - is more than useful
- Gangs attacking MSSPs
- Listen:
Eternally Blue about Ransomware
Bill and Gavin talk about Baltimore City being hit with Ransomware, yet another leak of hundreds of millions of personal details, and the chaps are joined by Claire Tills to discuss how the media drive remediation efforts for popular vulnerabilities.
- Baltimore City
https://www.welivesecurity.com/2019/05/17/eternalblue-new-heights-wannacryptor/ - First American Title
https://krebsonsecurity.com/2019/05/first-american-financial-corp-leaked-hundreds-of-millions-of-title-insurance-records/ - SandboxEscaper
- https://kb.cert.org/vuls/id/119704/
- https://www.bleepingcomputer.com/news/security/new-windows-10-zero-day-bug-emerges-from-bypassing-patched-flaw/ (this one has all the other bugs discovered)
- ICS in Poland
https://medium.com/@woj_ciech/state-of-industrial-control-systems-in-poland-and-switzerland-656e2e363fe3 - Old vulns and bad habits
- Listen:
CSuperhost Spycams and Compromised CMSes
In this episode Bill and Gavin discuss dodgy Superhost spying on their guests, SharePoint issues and weaknesses affecting the elderly. Gavin also interviews the delightful Jenny Radcliffe, the People Hacker, about social engineering.
- Airbnb Superhost’s creepy spycam sniffed out by sleuthing infosec pro
- SharePoint servers under attack through CVE-2019-0604
- Open source bug poses a threat to sites running multiple CMSes
- Dhound Chatbot: open domains, IP addresses
- Unless you want your payment card data skimmed, avoid these commerce sites
- EXPLOITING 10,000+ DEVICES USED BY BRITAIN’S MOST VULNERABLE
- Listen:
Correct Horse Burrito Staple
In this episode Bill and Gavin talk easy to guess passwords, the Beapy Cryptojacking worm sweeping through Asia and hungry cybercriminals leveraging credential stuffing attacks
- 10 most hacked passwords
- The Chipotle Hack And The Troubling Trend Of Credential Stuffing
- New zero-day vulnerability CVE-2019-0859 in win32k.sys
- Beapy: Cryptojacking Worm Hits Enterprises in China
- Listen:
Break into Bills house with this one simple trick
In this episode Bill realises smart locks are slightly less clever than their name implies, we discuss data science based cyber hygiene and MRI misgivings.
- Corporate giants want to help students, feds and themselves by offering cyber pros $75,000 in loan assistance
- Cool blog entry about building going "smart"
- Owning WPA3
- All about Man in the Middle Attacks
- Now you see Cancer, now you don't
- Chipzilla
- Windows 3.1 installed where?
- The ubiquity of WordPress plugins
- Who is the group named Triton?
- Ponemon Report (registration required)
- Ted Gary's Blog entry
- Listen:
Four phones, two laptops and a malware laden USB stick walk into a bar...
In this episode, Bill tries to track Merger and Acquisition activity with children's GPS devices, Gavin highlights the issues of hiding malware in BIOS and Thom Langford from TL(2) joins to give a CISO's perspective.
- Motherboard flaws can lead to hidden malware
- Mar-a-lago physical security failure
- Game of Thrones torrents packing nasty surprises
- Researcher prints PWNED! on hundreds of GPS watches
- Listen:
Top Ten Vulnerabilities and Deceased Bovines
In this weeks episode, Bill and Gavin discuss Cult of the Dead Cow, top ten vulnerabilities, supply chain attacks and leaky geolocation apps.
- Listen:
Paying peanuts for insecure web-apps
Bill and Gavin discuss several stories which highlight the challenges around Cyber Hygiene. We also have a chat on vulnerability prioritization with Tenable's Kevin Flynn.
- Listen:
ABOUT THE
CYBER EXPOSURE PODCAST
Conversations and interviews related to Cyber Exposure, vulnerability management, and security overall. We are pleased to have you as a listener and welcome your feedback at [email protected]. If you are interested in being a guest, let us know at the same email address.
About
Your Hosts
Bill Olson is a Tenable Technical Director, responsible for product strategy and direction. Bill works closely with our customers to understand their needs in vulnerability management and continuous network monitoring. He is passionate about building better solutions to improve customers’ security posture and programs.
Gavin Millard is a trained, ethical hacker who works with medium and large enterprises to address their cybersecurity challenges. With a deep understanding of how attackers plot a breach, he helps bring these companies to a trusted state of IT infrastructure. He previously worked as the Europe, Middle East and Africa (EMEA) technical director for Tripwire. He has also spoken frequently on data integrity, hacking and other key security topics.