You'll find the GPS software security paper here...
November 2nd, 2012 --
Here are this week's show notes; links to our news items, the paper discussed in the news segment and, of course, a link to our featured artist!
Travis Goodspeed on his new gizmo...
October 31st, 2012 --
This podcast is an interview I did at the Breakpoint security conference with security researcher Travis Goodspeed. He's come up with a hardware device called FaceDancer that allows him to capture USB device firmware by emulating the devices. What can you do with that? Well, you can start messing with those devices, loading up custom firmware, and even use modified USB devices to attack hosts.
Low level pwnage for the win!
October 31st, 2012 --
This podcast is an interview with Eric "Musclenerd" McDonald. Eric is a renowned iPhone jailbreaker and as such has a very detailed understanding of smartphone platforms.
His talk at Ruxcon Breakpoint was all about the security of baseband chipsets. If you follow this stuff you might know that the baseband chipsets in these smartphones -- which handle all the basic communications functions of the phones -- are actually quite sophisticated. And where there's sophistication, there are potential problems.
Mixed bag this week...
October 26th, 2012 --
This week's show is brought to you by our benevolent overlords at Adobe! And this week's sponsor interview is a must listen. Adobe's director of product security and privacy Brad Arkin joins us to discuss the breach at Adobe HQ that lead to malicious binaries being signed as valid by their code signing boxes.
Links to news, feature topics and more!
October 26th, 2012 --
I've included links to all news items plus the three feature topics covered off with Paul Ducklin. Enjoy!
New research a real heartstopper...
October 25th, 2012 --
This podcast is an interview I did with Barnaby Jack, a security researcher with IOActive. Barnes is probably best known for his work on ATM security. He famously "jackpotted" an ATM live on stage at BlackHat in 2010, but if he were to do a live demo of his latest research he'd probably wind up in prison.
Why realtime prevention is fantasy...
October 25th, 2012 --
All our coverage of the Breakpoint security conference was made possible by our sponsor PacketLoop.
PacketLoop is a new Australian business that applies big data analysis techniques to your packet captures... you can visualise your captures, drill down into them, and even spot successful 0day attacks against your organisation after the event -- that's a simple trick, that one, they just loop your packet captures through IPSs after the fact... when they get signature updates, they loop them through again. Hence the name, PacketLoop.
New exploit mitigations in Android look pretty good...
October 25th, 2012 --
This podcast is an interview I did with Accuvant's Joshua Drake, aka jduck. His Breakpoint presentation was on the topic of Android security.
As regular listeners of the Risky Business podcast would know, we're pretty much convinced Android was rushed to market -- it was insecure, immature, way too open and a big, glaring risk to its users. Combine that with the inherent problems with the Android ecosystem and you had a recipe for disaster.
From location at the Ruxcon Breakpoint conference in Melbourne…
October 20th, 2012 --
This week's show is being produced entirely on the ground at the Ruxcon Breakpoint security conference in my old home town of Melbourne Australia! And it's a shorter show than usual because I'm pretty busy down here producing a bunch of podcasts as a part of some joint coverage I'm doing for both Risky.Biz and The Register. If you want to check out some audio and blog posts from Breakpoint, head to http://risky.biz/breakpoint.
From the ground at Breakpoint!
October 20th, 2012 --
Here's this week's show notes. Lots of fun, lots of fail. I forgot to record this week's outro, so I should point out that this week's feature track is by the Cactus Channel. See the last link!
Mass murder, Windows exploits, hacking Apple and owning spy agencies…
October 17th, 2012 --
The inaugural Ruxcon Breakpoint security conference has kicked off with a bang in Melbourne.
This morning's first presentation was a talk by Roelof Temmingh, the creator of Maltego. The Maltego software, for those who don't know it, is essentially a data analysis and reconnaissance tool with some pretty powerful features.
Crims could send 830 volts straight to your heart...
October 17th, 2012 --
Pacemakers and implanted defibrillators are vulnerable to wireless attacks that could kill tens of thousands, says the security researcher best known for "jackpotting" an ATM on stage at the BlackHat security conference in Las Vegas in 2010.
The researcher in question, Barnaby Jack, today told the Ruxcon Breakpoint security conference in Melbourne, Australia that “the most obvious scenario would be a targeted attack against a high profile individual.”
Jack also warned of a worst-case scenario “worm with the ability to commit mass murder".
How gaps in your authentication procedures will be exploited...
October 11th, 2012 --
On this week's show we're chatting with Kevin Mitnick! Arguably the world's best known hacker, Kevin used to be a very naughty boy, and that saw him sent to prison a few times... but since his most recent release over 12 years ago he's established himself as a security consultant, author and globetrotting public speaker.
We're chatting to him about the fundamentals of identity verification. How can you be sure that person on the phone requesting a password reset really is your customer? Can you rely solely on static identity information in this day and age?
Links to news and more!
October 11th, 2012 --
Here is a list of news stories discussed in episode 258 of the Risky Business podcast.
The kernel is the new battleground, says ReactOS and iOS co-author Alex Ionescu
October 10th, 2012 --
Windows 8 will make hackers' lives hard, says Windows internals expert, security researcher and co-author of the open source Windows XP clone ReactOS Alex Ionescu.
Now chief architect at CrowdStrke, a security company focused on nation-state adversaries, Ionescu says Windows 8 builds on the usermode exploit mitigations introduced into Windows Vista and 7 with new approaches to security that attempt to mitigate kernel mode attacks.
Windows internals expert Alex Ionescu talks Win8 security features...
October 5th, 2012 --
On this week's show we're taking a look at Windows 8 with Alex Ionescu. Alex works for Crowdstrike, he's a genuine expert in Windows internals and he says exploit writing and persistence when it comes to owning windows boxes is about to get a whole lot harder. That's after the news.
Links to news, training rego, music and more!
October 5th, 2012 --
This week's feature guest Alex Ionescu is a smart cookie indeed. Scroll to the links below to find a link to a synopsis of his Ruxcon Breakpoint talk.
An endless ticket to ride?
September 27th, 2012 --
On this week's show we're taking a look at public transport ticketing security. Some clever fellows from the US of A have figured out how to reset their RFID tickets with a nifty little app for NFC-enabled smartphones. All this due to some positively boneheaded mistakes made during the initial rollout of some ticketing systems. That interview is with Corey Benninger of Intrepidus Group.
News, music and more!
September 27th, 2012 --
These show notes include links to a few stories that didn't make it to the final edit of the show. Also included is Corey Benninger's slide deck from EU Sec West, and a video demo.
Bumper news session plus a look at autoupdaters in the enterprise...
September 21st, 2012 --
This week's show is a shorter one than usual -- we've just got the news segment with Adam and a sponsor interview.
This week's show is sponsored by our benevolent overlords at Adobe! Big thanks to them. And we've got a fascinating chat in this week's show with Adobe's Steve Gotwalls about auto updaters.
How have they been architected? What do the update mechanisms look like? Are the update packages served via https or http? Can you cache them at your border? Should enterprise networks swallow updates without doing independent QA?
Recent comments
10 weeks 6 days ago
12 weeks 1 day ago
14 weeks 4 days ago
21 weeks 1 day ago
21 weeks 3 days ago
22 weeks 1 day ago
25 weeks 10 hours ago
27 weeks 5 days ago
29 weeks 6 days ago
29 weeks 6 days ago