Unsupervised Learning

START CONTENT * New SSL attack called FREAK * Has to do with falling RSA back to a deprecated and weak level * Requires the client and server are both vulnerable * The solution is to patch * Many orgs will also want to note which servers were vulnerable * The lesson is that you don’t reduce security to increase it * Backdoors x time = regret * Using Ruby’s Open-URI could be dangerous * open-uri monkeypatches kernel.open * open(params[:url]) can execute |ls * Hilary Clinton used a personal email address and did not store correspondence on government servers for her entire 4 years as Secretary of Defense * This seems highly suspect * First you’re putting that data at risk in a personal system * Second you’re obviously trying to hide your conversations * Facebook can access your account without your password * Google no longer encrypting Lollipop by default * Was one of the main selling points for 5, and now it’s gone * They said it was simply a driver issue * DLink routers have a remote command injection bug * Could allow DNS hijacking and other attacks * ISIS has threatened some members of the Twitter team for disabling their accounts * This really puts a point on public presence for me * I’m a strong proponent of the belief that the way to avoid attack is to avoid being a target, not to be hard to attack once people want to * This works for personal attacks, not for countries obviously * There has been some major fraud happening with people connecting stolen cards to ApplePay * The issue isn’t a security problem with ApplePay, but rather with standard bank / card security issue * Up to 18.8 non-Anthem customers exposed in the Anthem breach * This is in addition to the 80 million actual anthem customers * GoPro vulnerability on its website exposes customer Wi-fi passwords * Expect more of this * Uber took over 5 months to issue a breach notification * There was a breach of driver names and license numbers that they just now disclosed * Seagate NAS vulnerability allows unauthorized root access * This raises the cloud storage issue I blogged about last week END CONTENT Play Podcast Notes * Sorry about my voice on this one. I’m a bit sick. :( Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

START CONTENT * New stuxnet like piece of malware was discovered * Was found by Kaspersky * Has infected thousands of computers, mostly in Iran * The malware is the most advanced ever found * Can hide on the computer even after reinstall * Many of the names used in the application are known NSA codenames, such as GROK * Wired said those targeted groups were Islamic scholars * The group is called equation group due to the encryption used to hide itself * Car washes hacked by Billie Rios * Bad web software * Default passwords * Submit POST requests * Battery power can be used to track Android phones * Based on the power you use from cell phone tower usage * Obama sides with encryption against government groups * Lenovo laptops spying on you * Can we just say it’s dumb to use things produced in China? END CONTENT Play Podcast ### Notes * Sorry about the pops in the audio. My desk randomly makes loud noises. I’m working on it. Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

START CONTENT * Ukrainian banks hacked for up to 1 Billion dollars * Evidently installed malware on bank admin machines using phishing * Not sure they have an FDIC * As if the Ukraine didn’t have enough problems * 10 million password project * Mark Burnett posted 10 Million password combinations * Went through a long explanation of why he was doing it * I’ve broken them up and put them in the SecLists project * Jeb Bush leaks personal data * Anthem may have been Heartbleed * Could have been China, but who knows * Reminder about talking about things without information * It’s best to just leave it alone * HP released Home Security Systems report * We found 10/10 systems vulnerable to account harvesting * DARPA Dark Web Search Engine * Stuff not indexed by Google * Tor services, etc. * Obama creating new threat intelligence agency * Unified organization for tracking threats * Looking to partner with private industry as well * Anthem and Cyberinsurance * Up to 200M in cyberinsurance * Probably won’t cover it, but it’ll be a good test of usefulness * Facebook lets you pick who manages your account when you die * Facebook threat sharing program * Uber lost and found database was online with personal data in it * Basically, if you lose something in a car, they know who you are, and they keep your stuff for you * But they had the database exposed online END CONTENT Play PodcastBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

START CONTENT * Anthem, the second largest healthcare company, had a major breach * They lost around 80 million socials, addresses, emails, etc., which is roughly double the Target breach * There’s speculation that it was China, trying to penetrate government, but it’s early * Watch for phishing scams related to it * The megabreaches continue…weee! * A WordPress plugin called FancyBox had a serious compromise in it last week, which affected thousands of websites * If you’re going to run WordPress, understand that Plugins are the best way to get yourself hacked * Specifically, the type of plugins that handle user input and do something with it that affects the site’s output * Image manipulation plugins have been particularly vulnerable, usually to XSS * There was another critical Flash vulnerability this week * Like I said last week, and the week before, there’s a first time for everything * Three bug hunters at HP received the 125,000 prize for finding a major vulnerability in Internet Explorer * Because they work for HP they couldn’t take the cash, and instead donated it to charity * Microsoft released Outlook for iOS last week, which looks pretty slick * Unfortunately it is riddled with security flaws * Recommendation: wait for a few updates, and for them to get a security assessment END CONTENT Play PodcastBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

START CONTENT * Ghost bug in PHP could affect millions of servers * Flaw is in glibc, which is extensively by all Linux distributions * Patch and reboot using yum or aptitude * The US Army Released DShell, a malware forensics tool * This is an interesting trend where we see tons of formerly secret groups flock to Github. Great to see * Reddit released its first transparency report last week * Says it received 55 requests for user information * Says it complied with 64% of state and federal requests * Says it received 218 requests for content removal, and complied with 31 percent of those * I am pleased to see them releasing these numbers, and I hope more organizations do the same * The GHCQ was using a program called BADASS to collect data leaked by games such as Angry Birds * Luckily it only affected the 11 people still playing that game * Russian dating site, Topface, got hacked for 20 million usernames * The FBI busted up a Tom Clancy book plot in New York City * The plan was to get information about wall street trading algorithms and hopefully destabilize the markets * All they managed to do was embarrass themselves by commenting on how they couldn’t recruit young women * China is demanding to be able to build backdoors into any code sold to its banking sector * Some people call this news, but with China we just call this Wednesday * Apple released a Yosemite update that fixed Thunderstrike, among other things * Anonymous and Lizard Squad are going after each other * Anonymous is the famous hacking group known for all sorts of things * Lizard Squad is known for taking down the XBox and Playstation networks around Christmas time * Anonymous DDoS’d the Lizard Squad website, and then Twitter suspended a couple of their handles * Interesting to see these groups going after each other * BMW and the internet of things is in the news, with BMW owners receiving an automatic push to around 2 million cars * A vulnerability was present that could allow attacks to spoof cell towers and possibly control onboard systems * BMW pushed a patch that ensures all such communications go over HTTPS * It’s interesting that, like printers, cars are likely to become a primary IoT platform just because there are so many of them * The key is to figure out what normal things exist in the world today en mass, and then imagine those things being connected * Printers, cars, furniture, clothing, etc. It’s the regular stuff that makes it interesting because of how much attack surface they represent, and how prevalent the perspective they’ll offer into our daily lives END CONTENT Play Podcast Notes * Intro is from Zomby. The song is ‘Orion’, and it’s from the ‘With Love’ album. Highly recommended if you like chill EDM. Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

START CONTENT * There was an issue with the Marriott website that exposed reservations and payment information. It’s now been fixed * Police are now using a new radar to see into peoples’ homes without a warrant * Security budgets are reportedly going up due to the mega-breaches in 2014 * Also leading to higher pay for CIOs * Anecdotally, I’d say it’s a pretty good time to be in infosec * A new security startup, PFP Cybersecurity, uses power consumption to detect malware * Meant initially to be used for SCADA type systems * The US hacked North Korean computers back in 2010 * This is reportedly the reasons we were so sure they hacked Sony * Recently leaked documents from Snowden show heavy offense * Snowden recently talked to Schneier at Harvard about a number of things * The NSA is becoming increasingly offensively oriented vs. defensive * The NSA supposedly uses compromised systems as jump points * Snowden said most NSA hackers are junior enlisted with limited skills * Russia reportedly hacking for geopolitical gain, not just money * Millions of gas stations could be at risk of shutdown * The Automated Tank Gauges can be remotely accessed by attackers * Could be manipulated to cause alerts * Potentially could be used to stop the flow of fuel * Microsoft gave Charlie Hebdo data to FBI in 45 minutes * Starwood hack based on bad passwords * Bad passwords, password re-use, and a brute forcing tool * Account harvesting is rough: user enumeration, weak passwords, and lack of account lockout * Flash has another major exploit. Update your stuff. * People continue to be worried that the President’s crackdown on hackers could hurt security professionals * Congress is meeting on the 27th of January to discuss breach notification * The wireless in around 2 million cars is highly vulnerable to attack * A polish company has created Mouse-Box, which is an entire computer inside of a mouse enclosure END CONTENT Play Podcast Notes * Sorry about the noise part way through. My girl walked in and started unpacking groceries. But when I say one take, I mean one take. Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

START CONTENT * UK police arrest 18-year-old in connection to Playstation and XBox attack * Major ASUS router bug * Local users can take full control without a password * Biggest issue there seems to be DNS hijacking * Legislative attacks on infosec profession and encryption * Anti-hacking law language ambiguous “according to owner” * Obama is said to agree with Cameron, but it’s complicated * Evidence of a plot is different than outlawing encryption * There’s other talk about it being illegal to see hack data * French reporting 19,000 DoS attacks since the shootings * Anonymous is going after ISIS and others * An attack on free speech is an attack on Anonymous * Google releases another Windows flaw that they didn’t fix * Verizon API vulnerability exposes customer email addresses * Issue was with a mobile API used by Android devices * Allowed him to retrieve peoples’ emails and send emails as them * On whether we should trust the FBI regarding the Sony attack * We now find out the attribution came from a previous NSA hack * It’s hard to criticize without data * This doesn’t mean they did it, or that the FBI is always right, or that they should always be trusted * It means be cautious when you don’t have any information, and the person you’re criticizing has all of it * Free speech and the Paris attacks * Where is the line for free speech? * I think it comes down to safety and taste * You can’t yell fire, and art matters * Quote of the week * No one is as happy as they seem on Facebook, as depressed as they seem on Twitter, or as employed as they seem on LinkedIn. END CONTENT Play Podcast Notes * I have a consolidated InfoSec news feed (here) that I use as a source for headlines. Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

Subscribe to the Podcast: iTunes | Android | RSS START HEADLINES * Google drops security updates for Android 4.3 and below * This is a problem since that’s most of the install-base * Only .1% of users are on Android 5 * Microsoft and Adobe Push Critical Security Fixes * Seems like Google’s been messing up recently, with their attack on Whitehat for the Aviator stuff, their dropping security updates for Android, and now this early release of a bug before there was a fix. * Obama is asking for the removal of a number of state laws that make it harder to get good broadband in the US. * Obama is asking for quicker laws around the disclosure of hacks * One potential law is the Personal Data Notification and Protection Act, which would require companies to notify within 30 days if they get hacked. * The CENTCOM Twitter account got hacked a couple of days ago by some pro-ISIS folks * Obama is looking to improve the sharing of cybersecurity information as a response to the hack * Sammy Kamkar has released a keylogger for Microsoft wireless keyboards, called Keysweeper * David Cameron wants to make encrypted messaging apps illegal * 1) I’m not sure how he thinks this is possible Subscribe to the Podcast: iTunes | Android | RSSBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.