BrakeSec Education Podcast

Show Topic Summary (less than 300 words) Dish Network is still busted due to ransomware, your Pixel phone baseband RCE, Nothing runs like a Deere (away from OSS requests, anyway), and “Are we past DAST?”   Questions and potential sub-topics (5 minimum): https://techcrunch.com/2023/03/15/dish-customers-kept-in-the-dark-as-ransomware-fallout-continues/  https://medium.com/@cmanojshrestha/hack-any-social-media-account-using-cookie-stealing-attack-a6cdc4caafc1  https://boringappsec.substack.com/p/edition-18-the-diminishing-returns  https://www.theregister.com/2023/03/17/john_deere_sfc_gpl/  https://www.bleepingcomputer.com/news/security/alleged-breachforums-owner-pompompurin-arrested-on-cybercrime-charges/ (thanks D Mathews!) https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/  https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html    Additional information / pertinent Links (would you like to know more?): https://www.shopbiscoff.com/lotus-biscoff-xl-two-pack-case-bulk-size https://twitter.com/InfoSystir/status/1636847843683041280?s=20            Show Points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake @bryanbrake@mastodon.social Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec Youtube: https://www.youtube.com/c/BDSPodcast  Email: bds.podcast@gmail.com

Nickolas Means, VP of Engineering at SYM, discusses topics such as building a blameless culture during incidents, building a compliance program without impacting engineering velocity, cross-training dev and security teams, the challenges of shifting left in software development, the relationship between programming languages and security conferences, crafting secure applications, and the launch of sim, a platform for managing access to production systems.

BrakeSec Show Outline (all links valid as of 27 Jan 2023, subject to change)   Is it scheduled?  Yes || No|| Completed   Date:  2023/01/26   Guest info Name and Title: John Aron, Founder/CEO of Aronetics Email: john@aronetics.com Time Zone (if other than Pacific): Eastern Standard   Guest info Name and Title: Jerod Brennen Email: jerod@brennenconsulting.com Time Zone (if other than Pacific): EST   Show Topic Summary (less than 300 words) Clear the fog of marketing truths and viable solutions that actually deter and defend adversarial action.   Questions and potential sub-topics (5 minimum): Edge devices everywhere A paradigm culture shift is necessary How/What kind of culture shift is needed?  In 2007, Steve Jobs unveiled the iPhone with no mention of how to keep it safe While DARPA that created GPS, shares a sorry - not sorry       4. Working from Home or the office, how can you guarantee security with travel between both? This type of computing isn’t possible in government circles. 5. The New York Times 2019 Fall Special - So the internet didn’t turn out the way we hoped. How can we restore sanity and normalcy to using a computer when there is a persistent threat everywhere?  Who is under ‘persistent threat’?  6. Jerod: decentralization of technologies and empowering makers and people    Additional information / pertinent Links (would you like to know more?): Even Nobodies Have Fans Now. (For Better or Worse.) - The New York Times.pdf(local copy) (local copy defeats paywall) ) So the Internet Didn’t Turn Out the Way We Hoped. Now What_ - The New York Times.pdf (local copy defeats paywall) https://identity.foundation/  https://www.scmp.com/news/china/science/article/3206384/chinese-scientists-claims-new-quantum-code-breaking-algorithm-raise-eyebrows-us  https://www.amazon.com/Fourth-Turning-American-Prophecy-Rendezvous/dp/0767900464   https://www.investopedia.com/tech/what-dao/  https://www.jimcollins.com/books.html (“good to great”, and “Built to Last” were called out) https://www.amazon.com/Tyranny-Twenty-Lessons-Twentieth-Century/dp/0804190119  John’s Bsides San Diego slides: https://www.aronetics.com/wp-content/uploads/2023/01/Losing-Control-Aronetics-6-Oct-2022-FIN.pdf  John’s WiCys talk slides: Pending -  Sidechannel (Fractional CISO organization) https://sidechannel.com/ (Jerod’s organization) https://www.aronetics.com/ - (John’s company) Show Points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake @bryanbrake@mastodon.social Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec       

Lots of Layoffs (meta, Microsoft, Amazon, Sophos, Alphabet, Google) talk about the future effects of that, did it affect security? Attack surface management is risk management, Breaches and the TSA no-fly list leaked, and more! Full youtube video: https://www.youtube.com/watch?v=1Dgq8FpnWPw   Questions and/or potential sub-topics (5 minimum): Layoffs (fear, uncertainty, doubt), what it means for people,  https://www.lollydaskal.com/leadership/5-warning-signs-you-are-being-led-by-a-weak-leader/ “No fly list leaked” https://www.vice.com/en/article/93a4p5/us-no-fly-list-leaks-after-being-left-in-an-unsecured-airline-server Attack Surface Management: https://flashpoint.io/blog/what-is-attack-surface-management/ https://www.bleepingcomputer.com/news/security/beware-hackers-now-use-onenote-attachments-to-spread-malware/ https://securityaffairs.com/141102/hacking/eof-cisco-routers-exposed-rce.html https://www.linkedin.com/posts/threatintelligence_threat-intel-cheat-sheet-by-cyber-threat-activity-7021035081184026624-3GWH? (issues with "step 0")   Additional information / pertinent Links (would you like to know more?): https://www.sec.gov/ix?doc=/Archives/edgar/data/0001283699/000119312523010949/d641142d8k.htm  - TMO’s 8k filing https://www.bleepingcomputer.com/news/security/verizon-notifies-prepaid-customers-their-accounts-were-breached/ https://en.wikipedia.org/wiki/Maia_arson_crimew https://discord.gg/brakesec      Show Points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake @bryanbrake@mastodon.social  Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec 

topics What were the biggest stories of 2022? Any notable trends that you saw https://acut3.github.io/bug-bounty/2023/01/03/fetch-diversion.html (fetch Diversion) I got 5 million steps in 2022! Looking to jog/run 350 miles https://medium.com/@jdowde2/the-security-threat-of-and-in-file-path-strings-d75ee695eb3a  (danger of , and .. in file paths Google’s threat Horizon’s report     Additional information / pertinent Links (would you like to know more?): https://services.google.com/fh/files/blogs/gcat_threathorizons_full_jan2023.pdf (google’s Threat Horizons report) https://securityboulevard.com/2023/01/google-cybersecurity-action-team-threat-horizons-report-5-is-out/  https://medium.com/malware-buddy/6-useful-infographics-for-threat-intelligence-240d6aca333e  https://www.vice.com/en/article/zmpx4x/hacker-monitor-cars-kill-engine-gps-tracking-apps \youtube.c https://hbr.org/2016/09/excess-management-is-costing-the-us-3-trillion-per-year  https://thenewstack.io/circleci-secrets-catastrophe/ https://www.nbc29.com/2023/01/06/twitter-leak-exposes-235-million-email-addresses-hack/  https://www.vice.com/en/article/zmpx4x/hacker-monitor-cars-kill-engine-gps-tracking-apps    Show Points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake @bryanbrake@mastodon.social Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec 

Full stream video on Youtube: https://youtu.be/i1xpAfNFCvY John's Youtube channel, to find more training/contact information: https://www.youtube.com/channel/UC3ctyx980M8jLa_cEiQveLQ https://en.wikipedia.org/wiki/Capability_Maturity_Model_Integration ADKAR model: https://www.prosci.com/methodology/adkar CCE framework: https://inl.gov/cce/ Dashboard (non-sponsored link): https://monday.com Diagrammming tool: https://figma.com https://www.sciencedirect.com/topics/computer-science/system-analysis Amazon book: https://www.amazon.com/Engineering-Safer-World-Systems-Thinking/dp/0262533693

Full stream video on Youtube: https://youtu.be/i1xpAfNFCvY John's Youtube channel, to find more training/contact information: https://www.youtube.com/channel/UC3ctyx980M8jLa_cEiQveLQ https://en.wikipedia.org/wiki/Capability_Maturity_Model_Integration ADKAR model: https://www.prosci.com/methodology/adkar CCE framework: https://inl.gov/cce/ Dashboard (non-sponsored link): https://monday.com Diagrammming tool: https://figma.com https://www.sciencedirect.com/topics/computer-science/system-analysis Amazon book: https://www.amazon.com/Engineering-Safer-World-Systems-Thinking/dp/0262533693  

https://youtu.be/iW39Mugj4OM  -Full stream video (interview starts at 28m22s)   Broadcasted live on Twitch -- Watch live at https://www.twitch.tv/brakesec Seattle Community Network - https://seattlecommunitynetwork.org/ https://medium.com/seattle-community-network/    Check Bryan out on Mastodon! Mastodon

introducing @operat0r talked a bit about mobile device hacking and rooting/jailbreaking phones for testing Grab the powershell script here: https://github.com/freeload101/Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy   Check out the Youtube videos, including demo! Part2 is here: https://www.youtube.com/watch?v=RXgwUWpRuYA

introducing @operat0r talked a bit about mobile device hacking and rooting/jailbreaking phones for testing Grab the powershell script here: https://github.com/freeload101/Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy   Check out the Youtube videos, including demo! Part 2 will be available soon! Part 1:  https://youtu.be/U5SFav9h1L4