Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

In this episode of the Defensive Security Podcast, hosts Jerry Bell and Andrew Kalat discuss a range of cybersecurity topics, including the recent Oracle Cloud breach, the challenges of asset management in large environments, and the importance of prioritizing vulnerabilities. They also explore the findings from a pen test report, the implications of emerging threats like Medusa ransomware, and the need for better security practices in organizations. Links: https://www.bleepingcomputer.com/news/security/oracle-customers-confirm-data-stolen-in-alleged-cloud-breach-is-valid/ https://thehackernews.com/2025/03/10-critical-network-pentest-findings-it.html?m=1 https://www.horizon3.ai/attack-research/attack-blogs/critical-or-clickbait-github-actions-and-apache-tomcat-rce-vulnerabilities-2025/ https://www.forbes.com/sites/daveywinder/2025/03/30/fbi-warns-use-2fa-as-time-traveling-hackers-strike/ https://www.reversinglabs.com/blog/epss-is-not-foolproof-shift-your-appsec-beyond-vulnerabilities Like what we’re doing and want to help support us? Donate here: https://www.patreon.com/defensivesec

Summary In this episode, we celebrate the 300th episode of the Defensive Security Podcast then discuss various cybersecurity topics including the rise of AI-driven threats, the importance of zero trust architecture, best practices for incident response, the impact of human error on security breaches, and the risks associated with collaboration tools. We also cover the dangers of malvertising campaigns exploiting platforms like GitHub. Like what we’re doing and want to help support us? Donate here: https://www.patreon.com/defensivesec Links: https://venturebeat.com/security/51-seconds-to-breach-how-cisos-are-fighting-back-against-lightning-fast-attacks/ https://www.theregister.com/2025/03/10/incident_response_advice/ https://www.scworld.com/news/95-of-data-breaches-involve-human-error-report-reveals https://www.darkreading.com/cyber-risk/remote-access-infra-remains-riskiest-corp-attack-surface https://www.bleepingcomputer.com/news/security/microsoft-says-malvertising-campaign-impacted-1-million-pcs/

A Disney security breach highlights the dangers of unapproved AI tools, showing how easy it is to compromise sensitive data. The discussion dives into VMware ESX vulnerabilities and their implications for corporate cybersecurity. Listeners learn about the complexities of vulnerability management, emphasizing the need for proactive strategies. The potential risks of third-party vendors and the exposure of sensitive data on GitHub also raise alarms. As technology evolves, so do the threats, prompting a call for vigilance in security practices.

In this episode of the Defense of Security podcast, hosts Jerry Bell and Andrew Kalat discuss various cybersecurity topics, including a recent incident involving notorious hackers breaching a company network in under an hour, strategies to defend against deepfake attacks, the targeting of freelance developers by North Korean adversaries, vulnerabilities in Palo Alto firewalls, and the emergence of ghost ransomware. The conversation emphasizes the importance of proactive security measures and the evolving landscape of cyber threats. Want to support the Defensive Security Podcast?  You can donate here: https://www.patreon.com/defensivesec Takeaways: The speed of cyber attacks is increasing, with breaches occurring in under an hour. Organizations must implement robust processes to defend against deepfake attacks. Freelance developers are at risk of being targeted by sophisticated cybercriminals. Palo Alto firewalls are vulnerable to attacks if management interfaces are exposed to the internet. Ghost ransomware is a growing threat, often using familiar tactics to exploit vulnerabilities. Links: https://arstechnica.com/security/2025/02/notorious-crooks-broke-into-a-company-network-in-48-minutes-heres-how/ https://www.darkreading.com/vulnerabilities-threats/4-low-cost-ways-defend-organization-against-deepfakes https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/ https://www.theregister.com/2025/02/19/palo_alto_firewall_attack/ https://hackread.com/fbi-cisa-ghost-ransomware-threat-to-firms-worldwide/

The discussion dives into the changing tactics of ransomware, highlighting a shift from encryption to outright data theft for extortion. It reveals the challenges organizations face with data loss prevention and the vulnerabilities linked to internet exposure. Device code phishing, especially tied to Russian tactics, raises alarm bells, while AI's role in cybersecurity brings both threats and vulnerabilities to light. The hosts blend insightful commentary with humor, making this complex landscape engaging and accessible.

The discussion dives into the latest ransomware tactics, revealing how attackers target employees to exploit insider threats. There’s a deep look at the rise of LLM hijackers manipulating cloud accounts, highlighting the urgent need for better security measures. The ethics of phishing simulations come under scrutiny, advocating for supportive training instead of punitive measures. Cybersecurity professionals face challenges balancing risk with effective security, especially with the implications of generative AI in the workplace, where sensitive data can be at stake.

The conversation dives into alarming ransomware statistics, revealing that a staggering 58% of victims had to temporarily halt operations. Payment for ransoms rarely guarantees data recovery, with only 13% regaining everything. The hosts analyze the inefficiencies of using numerous security tools and discuss the dangers of AI in cybersecurity, especially highlighted by the DeepSeek breach. They also emphasize the critical need to secure management interfaces amid the evolving cyber threat landscape.

The discussion kicks off with a hidden backdoor in Juniper routers that raises serious network security alarms. PayPal’s recent data breach highlights the urgent need for better data protection strategies. The conversation then dives into older Ivanti vulnerabilities still being exploited, emphasizing timely patching. The massive PowerSchool data breach reveals the severe consequences of poor credential protection. Lastly, CISA's new software security guidelines aim to enhance protection across critical infrastructure, showcasing the ongoing battle against cyber threats.

“Another day, another data breach.” In this episode of the Defensive Security Podcast, Jerry Bell and Andrew Kalat discuss a significant data breach affecting hotel reservation data, regulatory actions taken against GoDaddy for poor security practices, and the evolving landscape of cyber attacks. They emphasize the importance of proactive defense strategies and innovative detection techniques to combat these threats effectively. Takeaways Data breaches continue to be a common occurrence in the cybersecurity landscape. Regulatory bodies like the FTC are increasingly involved in enforcing security improvements post-breach. Organizations must prioritize security measures to protect sensitive data from breaches. The importance of multi-factor authentication cannot be overstated in preventing credential theft. Ad blockers are not just for user convenience; they are essential for security. Cybersecurity is a shared responsibility across all departments, including marketing and IT. Proactive detection strategies can help identify malicious activity before significant damage occurs. Understanding the attack vectors used by cybercriminals is crucial for effective defense. Regularly updating and patching systems is vital to prevent exploitation of known vulnerabilities. Innovative detection techniques, such as canary accounts, can enhance security monitoring efforts. Links: https://www.bleepingcomputer.com/news/security/otelier-data-breach-exposes-info-hotel-reservations-of-millions/ https://www.bleepingcomputer.com/news/security/ftc-orders-godaddy-to-fix-poor-web-hosting-security-practices/ https://www.bleepingcomputer.com/news/security/hackers-leak-configs-and-vpn-credentials-for-15-000-fortigate-devices/ https://cybersecuritynews.com/hackers-exploiting-companies-google-ads-accounts/ https://www.blackhillsinfosec.com/one-active-directory-account-can-be-your-best-early-warning/

In this episode of the Defensive Security Podcast, hosts Jerry Bell and Andrew Kalat discuss various cybersecurity topics, including the dangers of malware disguised as proof of concept code on GitHub, the alarming rise in phishing attacks, the implications of a recent Treasury hack, and the targeted attacks on Ivanti’s security products. The conversation emphasizes the need for skepticism in security research, the importance of creating a safer environment for users, and the ongoing challenges posed by sophisticated threat actors. Links: https://www.bleepingcomputer.com/news/security/fake-ldapnightmware-exploit-on-github-spreads-infostealer-malware/ https://www.forbes.com/sites/daveywinder/2025/01/09/do-not-click-new-gmail-outlook-apple-mail-warning-for-billions/ https://www.bleepingcomputer.com/news/security/treasury-hackers-also-breached-us-foreign-investments-review-office/ https://www.bleepingcomputer.com/news/security/google-chinese-hackers-likely-behind-ivanti-vpn-zero-day-attacks/