Podcasts

This week's show features a fantastic, extended interview with Howard Schmidt, the former White House cyber security co-ordinator and special Assistant to the US President.

We spend about 35 minutes talking about what information security looks like from a high-level policy perspective. It's a long interview but there are some gems in there. We talk about some of the initiatives Howard kicked off at the White House, about the critical infrastructure legislation ping-pong game the executive branch played with congress, about Edward Snowden's leaks, and what it was like to work for Barack Obama.

This week's show is brought to you by a new sponsor -- Context Information Security. ContextIS is a global consultancy and managed service provider and its Australian general manager Scott Ceely joins us this week to talk about watering hole attacks. More specifically he's talking to us about a watering hole attack that managed to hose a few high value targets with some pretty basic exploitation techniques. The Crouching Tiger watering hole attack, a case study, if you will.

Adam Boileau, as usual, joins us to talk about the week's news headlines. Show notes here.

This week's show is brought to you by the fine, fine people at Tenable Network Security, big thanks to Tenable for all its support over the years.

And on this week's show we chat briefly with South Korean researcher SeungJin Lee about Smart TV security. They're equipped with cameras and microphones and they're popping up in living rooms everywhere.

Now, smart phones have cameras and microphones on them, so a lot of the hype around connected home devices seems a bit unreasonable. It's not like this is the first type consumer device that can be turned into a surveillance device. But as you'll hear, Smart TV operating systems are pretty insecure and vulnerable to some pretty basic forms of exploitation, so some of these concerns are actually quite reasonable.

SeungJin Lee will be dropping in to discuss his research into Smart TV security, research he'll be presenting at BlackHat in Las Vegas the week after next!

In this week's sponsor interview we chat with Ron Gula, the CEO of Tenable Network Security. This week we ask Ron if Ed Snowden's revelations on NSA spying could drive non-US companies away from doing business with American cloud service providers.

And we check the week's security news stories with Adam Boileau. Show notes here.

On this week's show we take an axe to all the crazy hype around BlueBox's Android research. It's been a shameful, shameful week for the tech media. I half expected to walk outside this week and find crowds of consumers holding pitchforks and burning their Android devices based on the headlines we've been seeing about 99% of all 'droid devices being open to attack!

As you'll hear in this week's interview with Justin Case (jcase), the research is cool -- it's a code signing check bypass for android install packages -- but you can put down the matches and the lighter fluid. It's not that bad.

In this week's sponsor interview we continue the conversation about code signing with Brad Arkin, the CSO of Adobe. Adobe itself had some trouble with an attacker compromising its systems and signing malware with its HSM. Last week, as you would have heard, someone managed to do the same thing at Opera, only that case was worse because they also jacked the browser's update boxes for a short time and served up bogus patches.

Last time Brad was on the show he was the head of security and privacy at Adobe so handling the operational security and code signing wasn't actually his responsibility. But it is now so he's been doing some thinking.

What do these recent developments tell us about distributed trust models for code signing? Are desktop OS's moving towards the mobile app signing model that has worked so spectacularly well for Apple? Well, Brad says they are, with caveats.

Adam Boileau, as usual, joins the show to discuss the week's news headlines. Show notes are here.

We've got a great show for you this week. Mark Dowd of Azimuth Security pops in to talk about the bugs he found in libraries used by secure telephony providers like Silent Circle. They're serious, serious bugs, and they were easy to find.

Also this week we talk to Les Goldsmith of ESD America. ESD is a pretty interesting outfit. They sell the German-developed GSMK Cryptophone, a product that has been around for a very, very long time and is mostly used by militaries and police. They also sell counter surveillance training, bug sweeping gear, armoured vehicles, tactical training and explosives detection dogs, but hey, today we're focussing on the electronic stuff.

We get Les's reaction to the news that the US has been bugging the offices of the European Union, the Ecuadorian embassy and, well, pretty much everyone all the time. He's got some really interesting perspectives on that.

In this week's sponsor interview we chat with Chris Gatford about these awful, awful IPMI vulnerabilities. The Intelligent Platform Management Interface turns out to be anything but! If you haven't heard, it turns out there are serious, protocol-level design flaws in IPMI which are going to make life tough for anyone who's actually using it. it's the sort of thing that will take a long time to truly fix, too.

This week's show is a bit shorter than usual. We've got a discussion of the week's news then a great chat with Brian Contos, the VP and CISO of Blue Coat Systems Advanced Threat Protection Group.

It's this week's sponsor interview and we'll be chatting about whether or not cyber warfare is really asymmetrical. It's the accepted wisdom that it is, but I gotta say, when we look at who's using it -- the US and Israel against Iran and Syria, Russia versus Estonia -- it looks to me like it's something used by the big guys to smash the little guys. Brian disagrees, so it's a nice lively discussion and it's coming up after the news.

In this week's show we talk opsec with international man of mystery The Grugq. In light of revelations the Internet lounge at the G20 summit was essentially an intelligence collection system set up by GCHQ, we thought we'd look at what travelling diplomats and executives can do to protect their data when entering a hostile environment where all infrastructure is assumed to be controlled by your adversary.

There's some great practical advice in that segment, and it's after the news.

In this week's sponsor interview we speak with Jack Daniel, Tenable Network Security's product manager about Microsoft's bug bounty program. $100k for a good exploit! The times, they change.

And we check in with Adam Boileau to discuss the week's news headlines. Show notes can be found here.

In this week's feature interview we chat with author and speaker Richard Thieme about what they used to call the generation gap. NSA leaker Edward Snowden is "Internet generation". Are the ideals espoused by people like Snowden rooted in counter-cultural ideals or are they just generational norms?

Are these ideas around online liberty becoming mainstream? Now that we have so many gen-Ys and millennials actually running the information infrastructure that powers our institutions, could we be on the cusp of serious changes in the way the establishment works? That is an interesting chat.

In this week's sponsor interview we're chatting to John Vecchi, Solera's VP of Product Strategy, all about whether or not we're neglecting mundane threats because we're so focussed on identifying APT.

Adam Boileau joins us for this week's news segment. Show notes, including links to the articles discussed, can be found here.

On this week's show we take a look at PRISM, the NSA's recently exposed massive surveillance program. Leaked PowerPoint slides from NSA describe a surveillance system that allows the agency to effortlessly capture a target's YouTube, Google, Facebook and Skype. This has been reported as these companies allowing the US government access to "back doors" on their systems.

In this week's episode we look at an alternative theory: The NSA is actually capturing information on "persons of interest" in real-time via fibre taps, decrypting it with private keys, then storing it. It's our theory and we're sticking with it. Listen to this week's episode to see if you agree!

Also this week we've got Tenable's chief of security, Marcus Ranum, stopping by in this week's sponsor interview to follow up on his keynote speech at AusCERT. The speech was called Never Fight a Land War in Cyber Space and it's really about the idea that conventional military thinking doesn't apply to the Internet.

I published a recording of his talk and it got a great reaction, but I was left with some questions after I saw it. So I rang him up and asked them! It's actually a really, really interesting interview so make sure you tune in for it.

****EDITOR'S NOTE: During the discussion on PRISM, I referenced 5Tb/s of traffic between "the US, Canada and US". That should have been "The US, Canada and Europe". Sorry about that!

This week's show is a cracker! We've got a great feature interview with journalist and author Parmy Olson about what the future might hold for Anonymous. Is it time for the Anonymous brand to be retired? The media has largely lost interest in its activities -- how could the hacktivism phenomenon bounce back to the same levels of notoriety as it experienced in 2011?

Tune in to find out!

This week's show is brought to you by Senetas, makers of absolutely kick-ass layer 2 encryption equipment.

In this week's sponsor interview we're chatting with Senetas co-founder and CTO Julian Fay about homomorphic encryption. This is where you can actually perform operations on data while it's still encrypted! It's all a bit twisted, but it's fascinating stuff and it's this week's sponsor interview topic.

The following is a recording of Marcus Ranum's AusCERT keynote speech on CYBER WAR. Marcus was doing the circuit a few years ago with a talk titled "Cyber war is bullshit", which I think makes clear his position, but this one is titled Never Fight a Land War in Cyberspace. He basically argues that the application of traditional military thinking to the cyber domain is flawed. He also argues there's a massive money and power grab taking place as the military and the private sector defence base tries to set the agenda so it can profit from it. It's a really worthwhile talk, and delivered with typical MjR flair. Enjoy.