Paul's Security Weekly (Audio)

This week: Minecraft on your lightbulb Sonicwall breached, who's next? Ditch Android, install Linux Hacking your face Thermostat freedom Pen test fails HackRF hacking times 2 Going around EDR Hackers in your printer Chinese data breach NFC relays and PCI Constructive construction hacks FlipperZero firmware update ICS, PLCs, and attacks Bayesian Swiss Cheese, taste good? Do you want to hack back? Keeping secrets Enforcing CMMC OWASP top ten gets a make over Android Spyware makes a LANDFALL Gemini's deep research into your documents Slopguard and AI datacenters in space! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-900

This week: Reversing keyboard firmware Ghost networks Invasion of the face changers Ghost tapping and whole lot of FUD AI doesn't code securely, but Aardvark can secure code De-Googling Thermostats Dodgy Android TV boxes can run Debian HackRF vs. Honda Cyberslop AI paper Turning to the darkside Poisoning the watering hole Nagios vulnerabilities VPNs are a target Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-899

In the security news this week: Cybersecurity is dead, and AI killed it Exploiting the patching system Apple makes it easier for spyware Who is patching Cisco ASA? Shove that DMCA somewhere HTTPS - a requirement Russia wants to own all the exploits Abandonware challenges Reversing at its hardest with Lua Hacking team is back, and leetspeak malware When you forget to authenticate your API Jamming with cool tech GoSpoof and After 35 Years, a Solution to the CIA's Kryptos Puzzle Has Been Found! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-898

In the security news: When in doubt, blame DNS, you're almost always correct How to Make Windows 11 great, or at least suck less CSRF is the least of your problems Shady exploits Linux security table stakes (not steaks) The pill camera Give AI access to your UART Security products that actually try to be secure? Firmware vulnerabilities, lots of them Teams is spying on you More details on PolarEdge VSCode, marketplaces, and developers at risk Cisco SNMP flaw used to deploy malware The 90's called, they want their exploits back This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-897

First up is a technical segment on UEFI shells: determining if they contain dangerous functionality that allows attackers to bypass Secure Boot. Then in the security news: Your vulnerability scanner is your weakest link Scams that almost got me The state of EDR is not good You don't need to do that on a phone or Raspberry PI Hash cracking and exploits Revisiting LG WebOS Hardening Docker images Hacking Moxa NPort Shoddy academic research The original sin of computing Bodycam hacking A new OS for ESP32 The AI bubble is going to burt Mobile VPNs are not always secure Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-896

This week we kick things off with a special interview: Kieran Human from Threat Locker talks about EDR bypasses and other special projects. In the security news: Hacking TVs Flushable wipes are not the only problem People just want to spy on their pets, except the devices can be hacked Linux EDR is for the birds What does my hat say we love exploits and hashes ESP32s in your router RF signal generator on a PI Zero Mic-E-Mouse and other things that will probably never happen, until they do Hacking with money Uninitialized variables and other things the compiler should catch Breaking out of the shell Hacking with sound, for real, not just another side channel attack Bring back 2G When the game engine gets hacked Oracle 0-days This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-895

Mary Ann Davidson, an experienced security leader and former Oracle executive, makes a surprise appearance to discuss the crucial role of governance in AI. She advocates for a security mindset among developers and emphasizes building defensible systems rather than over-relying on security personnel. The conversation explores AI's practical applications, the importance of human oversight, and the challenges surrounding risk-based compliance in cybersecurity. Mary Ann also shares insights on mentorship and recruiting new talent in the field.

Discover the latest in cybersecurity as the panel dives into Broadcom's strategies and LastPass vulnerabilities. They discuss the dangers of a GitHub impersonation campaign targeting Mac users. The importance of balancing user freedom with security is debated, alongside risks related to running unvetted scripts by developers. The dangers of QR codes and SEO poisoning are revealed, along with effective measures for managing third-party risk. Plus, find out how to protect your devices against theft and what to do if you lose your phone!

This week, Deviant, a security researcher, dives into the alarming vulnerabilities found in digital safes and the implications for home security. He reveals insights on reset-heist backdoors and the intricacies of exploiting manufacturer algorithms. The discussion also touches on Differential Power Analysis attacks, using locksmith tools for physical bypass, and the debate over mechanical versus electronic locks. Deviant shares his expertise on locksmithing training and the crucial balance between security and convenience in various settings.

Dive into the world of cyber threats as the hosts explore the intricacies of vulnerability management and the alarming shortcomings of current security practices. Discover the risks associated with biometrics in cars and the latest trends in car theft technology. They share insights on running web servers on smartphones and discuss the implications of a major npm supply-chain compromise. From malicious copy-paste tactics to discussing the impact of Bluetooth security tools, this conversation is packed with essential tech knowledge and cautionary tales.