How to be a martyr in style...
June 22nd, 2012 --
In this week's news segment we cover Julian Assange's attempt at martyrdom in style, claims of a Twitter outage, the cracking of 923-bit pairing-based encryption in Japan, the blackmailing of an American firm by hackers, Face.com's tragic fail, The Washington Post's stunning (not) revelation that Flame was the work of the US and Israel, AutoCAD worms, bug bounties and more!
Insomnia Security's Mark Piper tackles all that at the top of the show. He's filling in for Adam Boileau.
PLUS Marcus Ranum talks password hashing, general auth approaches...
June 15th, 2012 --
On this week's show we chat with Rapid7's H D Moore about massive recon in both the IPv4 and IPv6 worlds. He's been busy basically banner grabbing the entire Internet and he's found some really, really weird stuff out there. There are some very interesting nuggets in that interview. Check it out.
Prison. Not so lulzy...
June 8th, 2012 --
On this week's show we'll be chatting with Forbes' London bureau chief Parmy Olson.
Parmy did a great job of covering the whole LulzSec fiasco last year for Forbes, but she's gone one better and written a book about the whole thing. It's called We Are Anonymous: Inside the hacker world of LulzSec and you know what? It's pretty good!
Actually, it's really, really good. I'm about a third of the way through a review copy. Parmy will joins us to talk about what it was like to stitch a story like this together.
When it's Chinese it's a back door. When it's European it's a debugger.
May 31st, 2012 --
On this week's show we're taking a look at some research out of Cambridge University that's drawn a lot of attention. It involves a claim that researchers found a hardware back door on a Chinese-made FPGA (Field Programmable Gate Array).
That FPGA is apparently used in military hardware. You can find links to the draft paper and a write-up here.
So was this "back door" put there by super-secret Chinese cyber-warriors? Or is it something much less interesting like an undocumented debugging interface?
Forbes journalist book alleges close relationship between Assange and FBI snitch...
May 30th, 2012 --
If people are wondering why on Earth Wikileaks' chief Julian Assange is apparently being pursued by the US Department of Justice, a new book by Forbes' London Bureau chief Parmy Olson might help to clear things up for you.
Assange likes to proclaim that the DoJ investigation is a case of the big bad gummint being out to persecute him for being a truth-teller, but if Olson's book (Amazon) is to be believed it looks like he's been a very naughty boy.
The Internet as "tactical cloud computing"...
May 25th, 2012 --
This week's feature audio is an excerpt from an AusCERT presentation I recorded last week. The talk, by Brad Barker of the HALO Corporation, discusses the Zeta drug cartel's use of technology and social media. HALO Corporation does everything from intelligence support to kidnap and ransom consulting. Barker has an interesting analysis of how civilian technology is altering methods of operation and the wider battlefield. It's good stuff.
This is always fun...
May 22nd, 2012 --
The following is the closing session from AusCERT's 2012 conference, the speed debate.
It's a chance to have a bit of a laugh at all things security and it's hosted by ABC personality Adam Spencer. Enjoy!
The Sophos guys dissect an age old issue...
May 22nd, 2012 --
At AusCERT last week I caught up with Phil Piotrowski, a threat researcher with Sophos, as well as Rob Forsyth, a director of Sophos here in Australia.
Affix your tinfoil hat and tune in...
May 18th, 2012 --
The following is a recording Susan Landau's plenary presentation. She's a Visiting Scholar in the Computer Science Department at Harvard University. Prior to that she worked as a Distinguished Engineer at Sun Microsystems, and held faculty positions at the University of Massachusetts and Wesleyan University.
Her talk is titled Surveillance or Security? The Risks Posed by New Wiretapping Technologies.
There's more than one way to skin the DDoS cat. Meow.
May 18th, 2012 --
In this sponsored podcast we chat with both Arbor Networks' Nick Race and Matt Hollis of Vocus.
We discuss the state of both application and volumetric based DDoS techniques.
As you'd no doubt be aware, Arbor makes DDoS mitigation equipment -- there's the enterprise stuff that blocks application-based attacks, like attacks that exhaust resources on the target, then there's the telco stuff that blocks the volumetric attacks -- a.k.a. bandwidth exhaustion attacks.
Can governments mandate success?
May 18th, 2012 --
Yesterday I caught up with SCADA security expert and AusCERT speaker Mark Fabro of Lofty Perch.
We spoke about attempts by governments to mandate minimum security requirements for critical infrastructure through regulation. I started off by asking him what regulation attempts in North America look like now.
Mr. SCADA words it up...
May 18th, 2012 --
The following is a recording of Mark Fabro's AusCERT plenary.
As soon as you listen to Mark for more than five minutes you'll quickly realise he really knows what he's talking about.
This talk is about performing incident response and forensic analysis on live SCADA networks. It's very interesting stuff and Mark is a great presenter.
You might be better off with a paper-based review...
May 18th, 2012 --
In this sponsor podcast we're chatting with Declan Ingram, Principal Security Consultant with Datacom TSS.
Datacom TSS is a relatively new Aussie company that offers all the usual services, like penetration testing and app review, and we're going to chat with Declan about when those types of services can be best deployed. Dropping massive amounts of budget on pentesting might not be the best way to use your resources, he says.
Get your hack on!
May 17th, 2012 --
This is an interview with Robert Clark, the operational attorney for the US Army Cyber Command. I posted audio of his talk yesterday... he spoke a lot about international law as it applies to cyber war. But I wanted to pick his brains about something he briefly mentioned.
During his presentation he mentioned that espionage is actually legal under international law. I asked him to expand on that and we had a great chat about the legal aspects of online espionage.
A chat with Arbor Networks founder Rob Malan...
May 17th, 2012 --
In this sponsored Arbor Networks founder and CTO Rob Malan.
If you're lucky enough to have met Rob, you'd know that not only has he built a crazily successful business, but he's one of the most technologically savvy people you will ever meet. He lives and breathes his business, and lately he's been focussing on what he sees as a future problem area: Denial of service attacks against mobile 3G and 4G/LTE networks.
As you'll hear, Rob says the average mobile network is a bit of a disaster and there'll be plenty of opportunities for miscreants to wreak havoc on them.
The RFID devil's in the detail...
May 17th, 2012 --
The following is a full recording of a presentation by the University of Auckland's Peter Gutmann discussing contactless payment systems.
It's a nice overview that points out some of the dumber implementation mistakes that have been made by card brands and issuers.
There's a reference to a Shmoocon talk in this recording. You can find the whole thing here.
The programmable network with Christopher Hoff...
May 17th, 2012 --
In this interview we chat with Juniper Networks' chief security architect Christopher Hoff. I posted the audio of Chris's plenary talk yesterday... it was very interesting stuff, so check it out if you get a chance. He basically outlined his vision for security automation -- security at scale.
A part of that vision is advocating a more communication and integration between apps and infrastructure. He says apps should be able to interact directly with networking infrastructure through APIs. It sounds great, but could it be a disaster?
Who is doing a better job?
May 16th, 2012 --
In this sponsor podcast we chat with Richard Byfield, co-founder and general manager of Datacom TSS.
Datacom TSS is a relatively new Australian company backed by the Datacom group, the large integrator. They're an independent company offering the usual stuff, like penetration testing and app review, but what makes them a little different are its founders.
Programmable networks and other fun stuff...
May 16th, 2012 --
The following is a complete recording of Christopher Hoff's AusCERT presentation. He's the chief security architect with Juniper Networks. He has a vendor-heavy background, but don't hold that against him -- he's got some very interesting ideas around virtualisation, cloud computing and deperimiterisation. His talk is about automating security at scale, but he starts off, off all things, with a history innovation in toilets, which surprisingly works pretty well.
This is required listening...
May 16th, 2012 --
The following is a complete recording of an absolutely fascinating presentation by Robert Clark -- the operational attorney for the US Army Cyber Command.
His presentation examines the legal regime surrounding cyberspace operations.
He looks at the legal underpinnings of computer network security; defense; exploitation; and, attack. It is absolutely riveting stuff and I hope to be catching up with Mr. Clark at some point during the conference to ask him about six million questions.
Recent comments
10 weeks 5 days ago
12 weeks 11 hours ago
14 weeks 3 days ago
21 weeks 1 hour ago
21 weeks 2 days ago
22 weeks 15 hours ago
24 weeks 6 days ago
27 weeks 4 days ago
29 weeks 5 days ago
29 weeks 5 days ago