Risky Business Podcast

September 17, 2015

Risky Business #383 -- Inside FireEye's research gag

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we take a look at what the hell it happening in Germany, where FireEye sought and obtained an ex parte injunction against a bunch of security researchers over a presentation they were about to do at 44Con. We speak with infosec lawyer Alex Urbelis -- he was at 44Con when all this came to light and he shares his insights.

This week's show is sponsored by Senetas. They're a publicly listed company based in Melbourne that makes hardware encryption gear. Terribly sexy, layer 2 stuff actually. This week the company's co-founder and CTO Julian Fay joins the show to talk about the NSA's recent push to get people using encryption algorithms that are resistant to quantum computing-based attacks.

Adam Boileau, as always, stops in to discuss the week's news.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

beist on Twitter: "Just another stagefright 0day by my coworker, chpie. this one is reasonably reliable, more than 50% against Nexus 5. http://t.co/V5qhKvOr6C"
https://twitter.com/beist/status/643579728687841280

Project Zero: Stagefrightened?
http://googleprojectzero.blogspot.com.au/2015/09/stagefrightened.html

Let's Encrypt Issues First Cert | Threatpost | The first stop for security news
https://threatpost.com/first-lets-encrypt-free-certificate-goes-live/114...

Japan charges Bitcoin exchange CEO with embezzlement - Yahoo News
http://news.yahoo.com/japan-charges-bitcoin-exchange-ceo-embezzlement-ji...

Atlanta's Bitpay got hacked for $1.8 million in bitcoin - Atlanta Business Chronicle
http://www.bizjournals.com/atlanta/news/2015/09/16/atlantas-bitpay-got-h...

Cryptome founder revokes PGP keys after weird 'compromise' \u2022 The Register
http://www.theregister.co.uk/2015/09/16/cryptome_revokes_pgp_keys_after_...

Scan of Internet for Compromised Cisco Routers Finds Fewer Than 100 | Threatpost | The first stop for security news
https://threatpost.com/scan-of-ipv4-space-for-implanted-cisco-routers-fi...

Once seen as bulletproof, 11 million+ Ashley Madison passwords already cracked | Ars Technica
http://arstechnica.com/security/2015/09/once-seen-as-bulletproof-11-mill...

Ashley Madison passwords like "thisiswrong" tap cheaters' guilt and denial | Ars Technica
http://arstechnica.com/security/2015/09/ashley-madison-passwords-like-th...

DARPA Protecting Software From Reverse Engineering Through Obfuscation | Threatpost | The first stop for security news
https://threatpost.com/darpa-protecting-software-from-reverse-engineerin...

Installation of Tor Relays in Libraries Attracts DHS Attention | Threatpost | The first stop for security news
https://threatpost.com/installation-of-tor-relays-in-library-attracts-dh...

Researchers Outline Bugs in Yahoo, PayPal, Magento | Threatpost | The first stop for security news
https://threatpost.com/researchers-outline-vulnerabilities-in-yahoo-payp...

'To read this page, please turn off your ad blocker...' \u2022 The Register
http://www.theregister.co.uk/2015/09/15/to_read_this_page_please_turn_of...

CoreBot Adds New Capabilities, Transitions to Banking Trojan | Threatpost | The first stop for security news
https://threatpost.com/corebot-adds-new-capabilities-transitions-to-bank...

GM Took 5 Years to Fix a Full-Takeover Hack in Millions of OnStar Cars | WIRED
http://www.wired.com/2015/09/gm-took-5-years-fix-full-takeover-hack-mill...

Hack Brief: Emergency-Number Hack Bypasses Android Lock Screens | WIRED
http://www.wired.com/2015/09/hack-brief-new-emergency-number-hack-easily...

Shedload of security bugs squashed in iOS 9 - what the hell went wrong with iOS 8? \u2022 The Register
http://www.theregister.co.uk/2015/09/16/ios_9_security_updates/

AirDrop hole deposits stealth malware on all pre-iOS 9 Apple devices \u2022 The Register
http://www.theregister.co.uk/2015/09/16/airdrop_hole_malware_pre_ios_9/

Apple mitigates but doesn't fully fix critical iOS Airdrop vulnerability | Ars Technica
http://arstechnica.com/security/2015/09/apple-mitigates-but-doesnt-fully...

New Debian Releases Fix PHP, VirtualBox Bugs | Threatpost | The first stop for security news
https://threatpost.com/new-debian-releases-fix-php-virtualbox-bugs/114655/

WordPress Shortcodes Security Patch | Threatpost | The first stop for security news
https://threatpost.com/wordpress-patches-serious-shortcodes-core-engine-...

Bug Bounties, (Non) Lawsuits and Working with the Research Community \xab Executive Perspective | FireEye Inc
https://www.fireeye.com/blog/executive-perspective/2015/09/bug_bounties_...

Lattice-based cryptography - Wikipedia, the free encyclopedia
https://en.wikipedia.org/wiki/Lattice-based_cryptography

Quantum-safe Security : Cloud Security Alliance
https://cloudsecurityalliance.org/group/quantum-safe-security/

NSA preps quantum-resistant algorithms to head off crypto-apocalypse | Ars Technica
http://arstechnica.com/security/2015/08/nsa-preps-quantum-resistant-algo...

Risky Business #383 -- Inside FireEye's research gag

0:00 / 57:38

Risky Business Podcast

September 10, 2015

Risky Business #382 -- Charlie Miller talks car hax, Uber

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're checking in with Charlie Miller. We chat car hacking and we also (kind of) find out what he's up to now he's working at Uber.

This week's show is brought to you by HackLabs, an Australian security consultancy. They're a key sponsor of Australia's Cyber Security Challenge, which is basically a CTF for Australian CS students. What makes this one a bit different is it's being run by the Prime Minister's Office, which is, yeah, unexpected. Chris joins us later to discuss the challenge, that's this week's sponsor interview.

Adam Boileau, as always, stops in to discuss the week's news.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Is John McAfee running for US president? 'My campaign manager told me not to comment' \u2022 The Register
http://www.theregister.co.uk/2015/09/08/mcafee2016/

Ex-Ashley Madison CTO Threatens Libel Suit - Krebs on Security
http://krebsonsecurity.com/2015/09/ex-ashley-madison-cto-threatens-libel...

Ashley Madison made dumb security mistakes, researcher says \u2022 The Register
http://www.theregister.co.uk/2015/09/08/ashley_madison_made_dumb_securit...

Extorting money from Ashley Madison customers is actually pretty easy | Ars Technica
http://arstechnica.com/business/2015/09/extorting-money-from-ashley-madi...

Pwn2Own loses HP as its sponsor amid new cyberweapon restrictions | Ars Technica
http://arstechnica.com/tech-policy/2015/09/pwn2own-loses-hp-as-its-spons...

Lockpickers 3-D Print TSA Master Luggage Keys From Leaked Photos | WIRED
http://www.wired.com/2015/09/lockpickers-3-d-print-tsa-luggage-keys-leak...

Russian Spy Gang Hijacks Satellite Links to Steal Data | WIRED
http://www.wired.com/2015/09/turla-russian-espionage-gang-hijacks-satell...

The Feds Need a Warrant to Spy With Stingrays From Now On | WIRED
http://www.wired.com/2015/09/feds-need-warrant-spy-stingrays-now/

The Untold Story of Silk Road, Part 2: The Fall | WIRED
http://www.wired.com/2015/05/silk-road-2/

US counter-intel czar to hack victims: "raise shields" against spearphishing | Ars Technica
http://arstechnica.com/security/2015/09/us-counterintelligence-czar-tell...

Director of national intelligence: Snowden forced "needed transparency" | Ars Technica
http://arstechnica.com/tech-policy/2015/09/director-of-national-intellig...

FTC, Experts Push Startups to Think About Security From the Beginning | Threatpost | The first stop for security news
https://threatpost.com/ftc-experts-push-startups-to-think-about-security...

Bitcoin cyberextortionists are blackmailing banks, corporations | Ars Technica
http://arstechnica.com/business/2015/09/uk-banks-corporations-are-being-...

MS researchers claim to crack encrypted database with old simple trick | Ars Technica
http://arstechnica.com/security/2015/09/ms-researchers-claim-to-crack-en...

Researchers respond to developer's accusation that they used crypto wrong | Ars Technica
http://arstechnica.com/information-technology/2015/09/researchers-respon...

Mozilla: data stolen from hacked bug database was used to attack Firefox | Ars Technica
http://arstechnica.com/security/2015/09/mozilla-data-stolen-from-hacked-...

Serious bug causes "quite a few" HTTPS sites to reveal their private keys | Ars Technica
http://arstechnica.com/security/2015/09/serious-bug-causes-quite-a-few-h...

Many new top-level domains have become Internet's "bad neighborhoods" [Updated] | Ars Technica
http://arstechnica.com/security/2015/09/many-new-top-level-domains-have-...

Lateline - 09/09/2015: Its been described by the Government as its latest security weapon, but is the National Facial Biometric Matching Capability open to misuse?
http://www.abc.net.au/lateline/content/2015/s4309519.htm

Gloves on as Googler deposits foul zero-day on Kaspersky lawn \u2022 The Register
http://www.theregister.co.uk/2015/09/08/kaspersky_0day/

Hacker drops zero-day, opens FireEye fire sale \u2022 The Register
http://www.theregister.co.uk/2015/09/08/fireeye_0day/

Attack code exploiting Android's critical Stagefright bugs is now public | Ars Technica
http://arstechnica.com/security/2015/09/attack-code-exploiting-androids-...

It's still 2015, and your Windows PC can still be pwned by a webpage \u2022 The Register
http://www.theregister.co.uk/2015/09/08/patch_tuesday_sept2015/

An Android Porn App Takes Your Photo and Holds It to Ransom
http://gizmodo.com/an-android-porn-app-takes-your-photo-and-holds-it-to-...

Greg! The Stop Sign!! by TISM - a metaphor for our collective mortality | Music | The Guardian
http://www.theguardian.com/music/2014/nov/25/greg-the-stop-sign-by-tism-...

TISM - Greg! The Stop Sign!!! - YouTube
https://www.youtube.com/watch?v=z4Sr63_EDBc

Risky Business #382 -- Charlie Miller talks car hax, Uber

0:00 / 56:23

Risky Business Podcast

September 03, 2015

Risky Business #381 -- Samy Kamkar on his outlaw days

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're chatting with hacker superstar and YouTube phenomenon Samy Kamkar. Samy is a security researcher of note -- his recent hardware hacks have been coming thick and fast. This week I spoke to him about his brush with the law following his unleashing of the Samy worm on MySpace a decade ago, some of his recent research and his plans for the future.

This week's show is brought to you by Tenable Network Security! Big thanks to Tenable for its support of the Risky Business podcast, we sure do appreciate it. So in this week's sponsor interview we're speaking with Tenable's very own Cris Thomas, a.k.a. Space Rogue. He was one of the early l0pht crew and this week we get his thoughts of the encroachment of security into pop culture and mainstream media. Between the Ashley Madison data breach's media impact and the fantastic USA Network television program Mr. Robot, is the security community finally getting the love its been craving all this time?

Adam Boileau, as always, joins the show for a look at the week's news headlines.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

12 Must-Follow Feeds in the World of Security | WIRED
http://www.wired.com/2015/09/12-must-follow-feeds-world-security/

Prepare to be Thunderstruck: What if 'deuszu' ISN'T the Ashley Madison hacker? \u2022 The Register
http://www.theregister.co.uk/2015/09/01/prepare_to_be_thunderstruck_what...

What us worry? Ashley Madison says it added over 100K users last week | Ars Technica
http://arstechnica.com/security/2015/08/what-us-worry-ashley-madison-say...

Ecuador Considered Smuggling Julian Assange to Freedom in a Bag | WIRED
http://www.wired.com/2015/09/ecuador-considered-smuggling-julian-assange...

Uber Hires the Hackers Who Wirelessly Hijacked a Jeep | WIRED
http://www.wired.com/2015/08/uber-hires-hackers-wirelessly-hijacked-jeep/

Malware infecting jailbroken iPhones stole 225,000 Apple account logins | Ars Technica
http://arstechnica.com/security/2015/08/malware-infecting-jailbroken-iph...

China and Russia cross-referencing OPM data, other hacks to out US spies | Ars Technica
http://arstechnica.com/security/2015/08/china-and-russia-cross-referenci...

Lizard Squad launches DDoS against UK law enforcement agency | Ars Technica
http://arstechnica.com/security/2015/09/lizard-squad-launches-ddos-again...

Six Nabbed for Using LizardSquad Attack Tool - Krebs on Security
http://krebsonsecurity.com/2015/08/six-nabbed-for-using-lizardsquad-atta...

Spooks, plod and security industry join to chase bank hacker \u2022 The Register
http://www.theregister.co.uk/2015/08/28/irate_security_posse_intel_spook...

BitTorrent patched against flaw that allowed crippling DoS attacks | Ars Technica
http://arstechnica.com/security/2015/08/bittorrent-patched-against-flaw-...

Former security intern admits developing super-stealthy Android spyware | Ars Technica
http://arstechnica.com/security/2015/08/former-security-intern-admits-de...

Android ransomware uses XMPP chat to call home, claims it's from NSA | Ars Technica
http://arstechnica.com/security/2015/09/android-ransomware-uses-xmpp-cha...

OPM (Mis)Spends $133M on Credit Monitoring - Krebs on Security
http://krebsonsecurity.com/2015/09/opm-misspends-133m-on-credit-monitoring/

White House eyes sanctions for China over cyber-theft of trade secrets | Ars Technica
http://arstechnica.com/tech-policy/2015/08/white-house-eyes-sanctions-fo...

Lawyer: Turkey Arrested Journalists to Deter Foreign Media - ABC News
http://abcnews.go.com/International/wireStory/lawyer-turkey-arrested-jou...

Jihadist Fan Club CryptoCrap - Hacker OPSEC
http://grugq.github.io/blog/2014/08/09/jihadist-fan-crypto/

FBI: $1.2B Lost to Business Email Scams - Krebs on Security
http://krebsonsecurity.com/2015/08/fbi-1-2b-lost-to-business-email-scams/

How a bug in Visual Studio 2015 exposed my source code on GitHub and cost me $6,500 in a few hours
https://www.humankode.com/security/how-a-bug-in-visual-studio-2015-expos...

Associated Press sues FBI for impersonating its site to install spyware \u2022 The Register
http://www.theregister.co.uk/2015/08/28/associated_press_sues_fbi_for_im...

Netflix Sleepy Puppy Cross-Site Scripting Payload Framework | Threatpost | The first stop for security news
https://threatpost.com/netflix-sleepy-puppy-awakens-xss-vulnerabilities-...

xss-filters
https://www.npmjs.com/package/xss-filters

secure-handlebars
https://www.npmjs.com/package/secure-handlebars

Sneaky adware caught accessing users' Mac Keychain without permission | Ars Technica
http://arstechnica.com/security/2015/09/sneaky-adware-caught-accessing-u...

Attacks accessing Mac keychain without permission date back to 2011 | Ars Technica
http://arstechnica.com/security/2015/09/attacks-accessing-mac-keychain-w...

Google Chrome 45 Security Patches, Bug Bounty Awards | Threatpost | The first stop for security news
https://threatpost.com/google-patches-critical-vulnerabilities-in-chrome...

Cyber Security Challenge Australia
https://www.cyberchallenge.com.au/

Combo Breaker - motorized combo lock cracking device - YouTube
https://www.youtube.com/watch?v=YcpSvHpbHQ4

Home by waxheadmusic | Free Listening on SoundCloud
https://soundcloud.com/waxheadmusic/home

InControl Remote Mobile App | Land Rover USA
http://www.landroverusa.com/ownership/incontrol/index.html

Risky Business #381 -- Samy Kamkar on his outlaw days

0:00 / 77:38

Risky Business Podcast

August 27, 2015

Risky Business #380 -- AshMad fallout: Attackers doxed, suicides and mayhem

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we look at the fallout from the Ashley Madison attack. Did Brian Krebs just dox the Impact Team ringleader? Is he Australian?

Adam Boileau and I talk about all the AshMad fallout and other infosec news.

This week's show is brought to you by RSA. And in this week's sponsor interview we're chatting with RSA's Brett Williams about vendor trends; looking at the big endpoint push of 2015. I also picked his brain on the SIEM vs full packet capture/big data approach.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Ashley Madison: 'Suicides' over website hack - BBC News
http://www.bbc.com/news/technology-34044506

AshleyMadison: $500K Bounty for Hackers - Krebs on Security
http://krebsonsecurity.com/2015/08/ashleymadison-500k-bounty-for-hackers/

Ashley Madison Hackers Release an Even Bigger Batch of Data | WIRED
http://www.wired.com/2015/08/ashley-madison-hackers-release-even-bigger-...

Leaked AshleyMadison Emails Suggest Execs Hacked Competitors - Krebs on Security
http://krebsonsecurity.com/2015/08/leaked-ashleymadison-emails-suggest-e...

Ashley Madison Hit With $500 Million in Lawsuits | WIRED
http://www.wired.com/2015/08/ashley-madison-hit-500-million-lawsuits/

Ashley Madison Offering $500K Reward for Info on Hackers | WIRED
http://www.wired.com/2015/08/ashley-madison-offering-500k-reward-info-ha...

Almost None of the Women in the Ashley Madison Database Ever Used the Site
http://gizmodo.com/almost-none-of-the-women-in-the-ashley-madison-databa...

Exposed Ashley Madison members targeted by scammers and extortionists | Ars Technica
http://arstechnica.com/security/2015/08/exposed-ashley-madison-members-t...

Ashley Madison hackers leave footprints that may help investigators | Ars Technica
http://arstechnica.com/security/2015/08/ashley-madison-hackers-leave-foo...

Who Hacked Ashley Madison? - Krebs on Security
http://krebsonsecurity.com/2015/08/who-hacked-ashley-madison/

Street Gangs, Tax Fraud and 'Drop Hoes' - Krebs on Security
http://krebsonsecurity.com/2015/08/street-gangs-tax-fraud-and-drop-hoes/

IRS' estimate of tax records stolen by fraudsters soars to over 300,000 | Ars Technica
http://arstechnica.com/security/2015/08/irs-estimate-of-tax-records-stol...

Agora, the Dark Web's Biggest Drug Market, Is Going Offline | WIRED
http://www.wired.com/2015/08/agora-dark-webs-biggest-drug-market-going-o...

GitHub attacked again as Chinese developers forced by police to pull code | Ars Technica
http://arstechnica.com/security/2015/08/github-attacked-again-as-chinese...

Court Says the FTC Can Slap Companies for Getting Hacked | WIRED
http://www.wired.com/2015/08/court-says-ftc-can-slap-companies-getting-h...

Spotify Clears Up Its Controversial Privacy Policy | WIRED
http://www.wired.com/2015/08/spotify-clears-up-its-privacy-policy/

Mr. Robot Finale Postponed in Wake of Virginia TV Station Shooting | WIRED
http://www.wired.com/2015/08/mr-robot-finale-postponed-virginia-shooting/

Pro-Government Twitter Bots Try to Hush Mexican Activists | WIRED
http://www.wired.com/2015/08/pro-government-twitter-bots-try-hush-mexica...

Facebook ThreatExchange Information Sharing | Threatpost | The first stop for security news
https://threatpost.com/facebook-updates-information-sharing-platform/114370

Facebook Opens ThreatExchange Information Sharing Platform | Threatpost | The first stop for security news
https://threatpost.com/facebook-threatexchange-platform-latest-hope-for-...

Google Pulls App Exploiting Certifi-Gate Vulnerability | Threatpost | The first stop for security news
https://threatpost.com/google-pulls-app-exploiting-certifi-gate-vulnerab...

Details Surface on Patched Sandbox Violation Vulnerability in iOS | Threatpost | The first stop for security news
https://threatpost.com/details-surface-on-patched-sandbox-violation-vuln...

Apple Patches iOS Ins0mnia Vulnerability | Threatpost | The first stop for security news
https://threatpost.com/patched-ins0mnia-vulnerability-keeps-malicious-io...

August 2015 Apple QuickTime Security Patches | Threatpost | The first stop for security news
https://threatpost.com/apple-patches-quicktime-crash-and-code-execution-...

MT WARNING | Free Listening on SoundCloud
https://soundcloud.com/mtwarningmusic

MT WARNING
http://mtwarningmusic.com/shows/

Risky Business #380 -- AshMad fallout: Attackers doxed, suicides and mayhem

0:00 / 45:00

Risky Business Podcast

August 20, 2015

Risky Business #379 -- Ashley Madison dump, Troy Hunt and The Grugq

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

In this week's podcast we check in with Troy Hunt from HaveIBeenPwned.com. Troy has done the responsible thing in adding the Ashley Madison dataset to his service -- you can only search for email addresses in the dump after you've verified that you control them. We'll talk to him about why he did that.

This week's show is brought to you by FireEye and FireEye senior systems engineer Ben Wilson stops by to have a chat about some neat tricks attackers and malware authors are getting up to with various scripts on Windows. WMI for persistence is a thing now, for example. It's a really interesting chat that one and it's coming up a bit later.

The Grugq is in the news chair this week, filling in for Adam Boileau.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and The Grugq on Twitter if that's your thing.

Show notes

Was the Ashley Madison Database Leaked? - Krebs on Security
http://krebsonsecurity.com/2015/08/was-the-ashley-madison-database-leaked/

Ashley Madison hack is not only real, it's worse than we thought | Ars Technica
http://arstechnica.com/security/2015/08/ashley-madison-hack-is-not-only-...

Microsoft issues emergency patch for critical IE bug under active exploit | Ars Technica
http://arstechnica.com/security/2015/08/microsoft-issues-emergency-patch...

Exclusive: Russian antivirus firm faked malware to harm rivals - Ex-employees | Reuters
http://www.reuters.com/article/2015/08/14/us-kaspersky-rivals-idUSKCN0QJ...

Crackdowns Haven't Stopped the Dark Web's $100M Yearly Drug Sales | WIRED
http://www.wired.com/2015/08/crackdowns-havent-stopped-dark-webs-100m-ye...

What We Know About the NSA and AT&T's Spying Pact | WIRED
http://www.wired.com/2015/08/know-nsa-atts-spying-pact/

Busting the Biggest Myth of CISA---That the Program Is Voluntary | WIRED
http://www.wired.com/2015/08/access-cisa-myth-of-voluntary-info-sharing/

Virginia Finally Drops America's 'Worst Voting Machines' | WIRED
http://www.wired.com/2015/08/virginia-finally-drops-americas-worst-votin...

How Not to Start an Encryption Company - Krebs on Security
http://krebsonsecurity.com/2015/08/how-not-to-start-an-encryption-company/

How BitTorrent could let lone DDoS attackers bring down big sites | Ars Technica
http://arstechnica.com/security/2015/08/how-bittorrent-could-let-lone-dd...

RPC Portmapper Reflective DDoS Attacks | Threatpost | The first stop for security news
https://threatpost.com/reflection-ddos-attacks-abusing-rpc-portmapper/11...

Android security on the ropes with one-two punch from researchers | Ars Technica
http://arstechnica.com/security/2015/08/android-security-on-the-ropes-wi...

Your BMW or Benz Could Also Be Vulnerable to That GM OnStar Hack | WIRED
http://www.wired.com/2015/08/bmw-benz-also-vulnerable-gm-onstar-hack/

My browser visited Weather.com and all I got was this lousy malware (Updated) | Ars Technica
http://arstechnica.com/security/2015/08/my-browser-visited-drudgereport-...

Luca Todesco OS X Zero Day Vulnerabilities | Threatpost | The first stop for security news
https://threatpost.com/inside-the-unpatched-os-x-vulnerabilities/114344

Bugged, Tracked, Hacked | 60 Minutes | 9Jumpin
http://www.9jumpin.com.au/show/60minutes/stories/2015/august/phone-hacking/

Troy Hunt: Here's how I'm going to handle the Ashley Madison data
http://www.troyhunt.com/2015/07/heres-how-im-going-to-handle-ashley.html

fireeye/flare-wmi \xb7 GitHub
https://github.com/fireeye/flare-wmi

https://www.insomniasec.com/downloads/publications/shellgame.pdf

Risky Business #379 -- Ashley Madison dump, Troy Hunt and The Grugq

0:00 / 41:40

Risky Business Podcast

August 13, 2015

Risky Business #378 -- Mary Ann Davidson vs Krebs and Dowd

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we're chatting with Mark Dowd and Brian Krebs about Oracle CSO Mary Ann Davidson's somewhat odd blog post from earlier this week. In the post she laid into security researchers for violating Oracle's EULA when reverse engineering their products. The post got pulled, much drama, we sift through the ashes of that. Plus we chat to Brian about the daring $46.7m online heist against Ubiquiti Networks.

This week's show is brought to you by BugCrowd. But in this week's sponsor interview we're not chatting with a BugCrowd representative, we're speaking to one of its customers instead. Paul Moreno from Pinterest drops by to talk about his experience in operating a bug bounty through an outsourced provider.

Adam Boileau, as always, joins the show to discuss the week's news headlines.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Doubts cast on Islamic State's so-called leak of US .mil, .gov passwords \u2022 The Register
http://www.theregister.co.uk/2015/08/12/islamic_panic/

Attackers are hijacking critical networking gear from Cisco, company warns | Ars Technica
http://arstechnica.com/security/2015/08/attackers-are-hijacking-critical...

Why Not Insider Trade on Every Company? - Bloomberg View
http://www.bloombergview.com/articles/2015-08-11/why-not-insider-trade-o...

Sen. Warren Worried About Banks' New Encrypted Messaging Platform | Threatpost | The first stop for security news
https://threatpost.com/sen-warren-worried-about-banks-new-encrypted-mess...

Russia hacks Pentagon computers: NBC, citing sources
http://www.cnbc.com/2015/08/06/russia-hacks-pentagon-computers-nbc-citin...

Manipulating Microsoft WSUS to Own Enterprises | Threatpost | The first stop for security news
https://threatpost.com/manipulating-wsus-to-own-enterprises/114168

Imploding Barrels and Other Highlights From Hackfest DefCon | WIRED
http://www.wired.com/2015/08/highlights-from-defcon-2015/

Hackers Cut a Corvette's Brakes Via a Common Car Gadget | WIRED
http://www.wired.com/2015/08/hackers-cut-corvettes-brakes-via-common-car...

Internet-Connected Gas Pumps Are a Lure for Hackers | WIRED
http://www.wired.com/2015/08/internet-connected-gas-pumps-lure-hackers/

Researchers Hacked a Model S, But Tesla's Already Released a Patch | WIRED
http://www.wired.com/2015/08/researchers-hacked-model-s-teslas-already/

Meet RollJam, the $30 device that jimmies car and garage doors | Ars Technica
http://arstechnica.com/security/2015/08/meet-rolljam-the-30-device-that-...

Researchers reveal electronic car lock hack after 2-year injunction by Volkswagen | Ars Technica
http://arstechnica.com/security/2015/08/researchers-reveal-electronic-ca...

"Funtenna" software hack turns a laser printer into a covert radio | Ars Technica
http://arstechnica.com/security/2015/08/funtenna-software-hack-turns-a-l...

Hack of telematics device lets attackers mess with car's brakes | Ars Technica
http://arstechnica.com/cars/2015/08/hack-of-telematics-device-lets-attac...

The Windows 10 Security Settings You Need to Know | WIRED
http://www.wired.com/2015/08/windows-10-security-settings-need-know/

Lenovo used Windows anti-theft feature to install persistent crapware | Ars Technica
http://arstechnica.com/information-technology/2015/08/lenovo-used-window...

Darkhotel APT Latest to Use Hacking Team Zero Day | Threatpost | The first stop for security news
https://threatpost.com/darkhotel-apt-latest-to-use-hacking-team-zero-day...

0-day attack on Firefox users stole password and key data: Patch now! | Ars Technica
http://arstechnica.com/security/2015/08/0-day-attack-on-firefox-users-st...

Attackers actively exploit Windows bug that uses USB sticks to infect PCs | Ars Technica
http://arstechnica.com/security/2015/08/attackers-actively-exploit-windo...

Microsoft Patches USB-Related Flaw Used in Targeted Attacks | Threatpost | The first stop for security news
https://threatpost.com/microsoft-patches-usb-related-flaw-used-in-target...

August 2015 Microsoft Patch Tuesday Security Bulletins | Threatpost | The first stop for security news
https://threatpost.com/microsoft-patches-critical-vulnerabilities-in-new...

Severe weaknesses in Android handsets could leak user fingerprints | Ars Technica
http://arstechnica.com/security/2015/08/severe-weaknesses-in-android-han...

Android 'Serialization' Vulnerability Affects 55 Percent of Devices | Threatpost | The first stop for security news
https://threatpost.com/patched-android-serialization-vulnerability-affec...

Huge Flash Update Patches More Than 30 Vulnerabilities | Threatpost | The first stop for security news
https://threatpost.com/huge-flash-update-patches-more-than-30-vulnerabil...

Oracle security chief to customers: Stop checking our code for vulnerabilities [Updated] | Ars Technica
http://arstechnica.com/information-technology/2015/08/oracle-security-ch...

Tech Firm Ubiquiti Suffers $46M Cyberheist - Krebs on Security
http://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberh...

History | DAN WARNER
http://danwarner.com.au/history/

Risky Business #378 -- Mary Ann Davidson vs Krebs and Dowd

0:00 / 63:17

Risky Business Podcast

August 06, 2015

Risky Business #377 -- Wassenaar back to drawing board, latest from BlackHat

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we discuss the BIS decision to ditch its car-a-zay plans for Wassenaar regulation, the latest car hacking news and more.

We also check in with Trey Ford in this week's feature slot. Trey was the General Manager of the BlackHat conference, these days he works at Rapid7, and he joins us to talk about the vibe in Vegas at this year's conference.

This week's show is brought to you by RSA Security! Big thanks to RSA for making this week's show possible. RSA's very own Chris Thomas will be joining us in this week's sponsor interview to talk about the role industry should be playing in education. RSA is helping a few universities set up "learning SOCs", but where to from there?

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Government Takes Second Look at US Wassenaar Rules | Threatpost | The first stop for security news
https://threatpost.com/unusual-re-do-of-us-wassenaar-rules-applauded/114096

Chrysler and Harman Hit With a Class Action Complaint After Jeep Hack | WIRED
http://www.wired.com/2015/08/chrysler-harman-hit-class-action-complaint-...

Patch Your OnStar iOS App to Avoid Getting Your Car Hacked | WIRED
http://www.wired.com/2015/07/patch-gm-onstar-ios-app-avoid-wireless-car-...

This Gadget Hacks GM Cars to Locate, Unlock, and Start Them (UPDATED) | WIRED
http://www.wired.com/2015/07/gadget-hacks-gm-cars-locate-unlock-start/

Hackers Could Heist Semis by Exploiting This Satellite Flaw | WIRED
http://www.wired.com/2015/07/hackers-heist-semis-exploiting-satellite-flaw/

Hackers Can Seize Control of Electric Skateboards and Toss Riders | WIRED
http://www.wired.com/2015/08/hackers-can-seize-control-of-electric-skate...

DRAM "Bitflipping" exploit for attacking PCs: Just add JavaScript | Ars Technica
http://arstechnica.com/security/2015/08/dram-bitflipping-exploit-for-att...

"Thunderstrike 2" rootkit uses Thunderbolt accessories to infect Mac firmware [Updated] | Ars Technica
http://arstechnica.com/apple/2015/08/thunderstrike-2-rootkit-uses-thunde...

0-day bug in fully patched OS X comes under active exploit to bypass password protection | Ars Technica
http://arstechnica.com/security/2015/08/0-day-bug-in-fully-patched-os-x-...

Inside the $100M 'Business Club' Crime Gang - Krebs on Security
http://krebsonsecurity.com/2015/08/inside-the-100m-business-club-crime-g...

Chinese VPN Service as Attack Platform? - Krebs on Security
http://krebsonsecurity.com/2015/08/chinese-vpn-service-as-attack-platform/

Newly discovered Chinese hacking group hacked 100+ websites to use as "watering holes" | Ars Technica
http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking...

China-Tied Hackers That Hit U.S. Said to Breach United Airlines - Bloomberg Business
http://www.bloomberg.com/news/articles/2015-07-29/china-tied-hackers-tha...

Russian hacker targets CommSec, E*TRADE retail accounts
http://www.theage.com.au/business/markets/russian-hacker-targets-commsec...

New attack on Tor can deanonymize hidden services with surprising accuracy | Ars Technica
http://arstechnica.com/security/2015/07/new-attack-on-tor-can-deanonymiz...

Bound to happen: BIND bug exploits now in the wild \u2022 The Register
http://www.theregister.co.uk/2015/08/04/bind_bug_exploits_now_in_the_wild/

Windows 10 Upgrade Spam Carries CTB-Locker Ransomware | Threatpost | The first stop for security news
https://threatpost.com/windows-10-upgrade-spam-carries-ctb-locker-ransom...

drspringfield / cabletables - Bitbucket
https://bitbucket.org/drspringfield/cabletables

John McAfee cuffed by Tennessee cops, faces drug-driving, gun rap \u2022 The Register
http://www.theregister.co.uk/2015/08/05/tennessee_cops_stops_john_mcafee...

McAfee tells El Reg: 'My shootout with the police was highly exaggerated' \u2022 The Register
http://www.theregister.co.uk/2015/08/05/john_mcafee_says_police_shootout...

Office Lip Dub - Everything's Under Control by Peregrine - YouTube
https://www.youtube.com/watch?v=o8DQKieBPNU

Risky Business #377 -- Wassenaar back to drawing board, latest from BlackHat

0:00 / 55:45

Risky Business Podcast

July 30, 2015

Risky Business #376 -- Sniper rifles, bank safes and Android all pwned

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

This week we're checking in with Josh Drake of Zimperium. With exploitation of Stagefright via Josh's sweet, sweet exploit you'd think the mother of all worms is coming. Well, probably not. Later versions of Android are tricky to exploit, and the diversity of hardware in earlier versions means coming up with one exploit to rule them all isn't really feasible. We'll drill down into that with Josh in a little while.

This week's show is brought to you by Tenable Network Security. Tenable's very own Jack Daniel will be along in this week's sponsor interview to add a bit of context to recent car hacking news. Jack was a mechanic in a previous life. I myself worked for Bosch as an engineer designing automotive electronics in the 90s. So we put our old man pants on and talk about how we arrived in a world where 1.4 million Chrysler owners are patching their vehicles against security flaws using a mailed out USB stick.

Adam Boileau, as usual, joins the show to discuss the week's news headlines.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Hackers Can Disable a Sniper Rifle-Or Change Its Target | WIRED
http://www.wired.com/2015/07/hackers-can-disable-sniper-rifleor-change-t...

Brinks' Super-Secure Smart Safes: Not So Secure | WIRED
http://www.wired.com/2015/07/brinks-super-secure-smart-safes-not-secure/

Researchers Hack Air-Gapped Computer With Simple Cell Phone | WIRED
http://www.wired.com/2015/07/researchers-hack-air-gapped-computer-simple...

US Census Bureau IT systems hacked, data leaked by Anonymous \u2022 The Register
http://www.theregister.co.uk/2015/07/23/us_census_bureau_hacked/

NSA: We'll move your metadata into /dev/null when you stop suing us \u2022 The Register
http://www.theregister.co.uk/2015/07/27/nsa_phone_metadata_latest/

White House Says No Thanks to Snowden Pardon Petition | Threatpost | The first stop for security news
https://threatpost.com/white-house-says-no-thanks-to-snowden-pardon-peti...

New Chrome Extension Helps Combat Keyboard Biometrics | Threatpost | The first stop for security news
https://threatpost.com/new-chrome-extension-helps-combat-keyboard-biomet...

Researchers claim they've developed a better, faster Tor | Ars Technica
http://arstechnica.com/information-technology/2015/07/researchers-claim-...

A public marketplace for hackers-what could possibly go wrong? | Ars Technica
http://arstechnica.com/security/2015/07/a-public-marketplace-for-hackers...

Pakistan bans BlackBerry messaging, e-mail for "security reasons" | Ars Technica
http://arstechnica.com/security/2015/07/pakistan-bans-blackberry-messagi...

What amateurs can learn from security pros about staying safe online | Ars Technica
http://arstechnica.com/security/2015/07/what-amateurs-can-learn-from-sec...

Yahoo Touts Success of Bug Bounty Program | Threatpost | The first stop for security news
https://threatpost.com/yahoo-touts-success-of-bug-bounty-program/114019

Malvertising campaign hits 10 MEELLION users in 10 days \u2022 The Register
http://www.theregister.co.uk/2015/07/29/malvertising_affects_10_million/

Click-Fraud Malware Spreading via JavaScript Attachments | Threatpost | The first stop for security news
https://threatpost.com/click-fraud-malware-spreading-via-javascript-atta...

Group that hacked Anthem shared weaponized 0-days with rival attackers | Ars Technica
http://arstechnica.com/security/2015/07/group-that-hacked-anthem-shared-...

Apple Patches Remote 'Invoice Vulnerability' in iTunes, App Store | Threatpost | The first stop for security news
https://threatpost.com/apple-patches-remote-invoice-vulnerability-in-itu...

Xen reports new guest-host escape, this time through CD-ROMs \u2022 The Register
http://www.theregister.co.uk/2015/07/28/xen_reports_new_guesthost_escape...

PHP File Manager Riddled With Vulnerabilities, Including Backdoor | Threatpost | The first stop for security news
https://threatpost.com/php-file-manager-riddled-with-vulnerabilities-inc...

New vulnerability can put Android phones into permanent vegetative state | Ars Technica
http://arstechnica.com/security/2015/07/new-vulnerability-can-put-androi...

WordPress Patches Critical XSS Vulnerability in All Builds | Threatpost | The first stop for security news
https://threatpost.com/wordpress-patches-critical-xss-vulnerability-in-a...

Valve patches security hole that enabled takeover of Steam accounts | Ars Technica
http://arstechnica.com/gaming/2015/07/valve-patches-security-hole-that-e...

Critical Remotely Exploitable Bug Haunts BIND | Threatpost | The first stop for security news
https://threatpost.com/critical-remotely-exploitable-bug-haunts-bind/114008

950 million Android phones can be hijacked by malicious text messages | Ars Technica
http://arstechnica.com/security/2015/07/950-million-android-phones-can-b...

La Polic\xeda by labjacd | Free Listening on SoundCloud
https://soundcloud.com/labjacd/la-policia

Risky Business #376 -- Sniper rifles, bank safes and Android all pwned

0:00 / 67:44

Risky Business Podcast

July 23, 2015

Risky Business #375 -- Ashley Madison, Jeep hacks drive news agenda

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

In this week's feature interview we're chatting with Dave Jorm, our resident North Korea watcher. Some of you might remember Dave, he was on the show a couple of years ago talking about his OSINT satellite data analysis of North Korea and more recently he popped by to talk about software defined networking security.

Well, some recent analysis of North Korea's official Red Star OS has found it has a nasty habit -- it watermarks media files that users open with a unique ID. This will of course help the North Korean regime to track down the smugglers of digital media, whether that's activist material or South Korean soaps, which are most definitely verboten in the hermit kingdom.

This week's show is brought to you by Intralinks -- these guys do secure document exchange and storage. Intralinks very own Todd Partridge drops by to talk about how their customers are actually customising these types of document services.

Adam Boileau, as usual, joins the show to discuss the week's news headlines.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Online Cheating Site AshleyMadison Hacked - Krebs on Security
http://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-ha...

Hackers Remotely Kill a Jeep on the Highway-With Me in It | WIRED
http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

Patch Your Chrysler Now Against a Wireless Hacking Attack | WIRED
http://www.wired.com/2015/07/patch-chrysler-vehicle-now-wireless-hacking...

Senate Bill Seeks Standards For Cars' Defenses From Hackers | WIRED
http://www.wired.com/2015/07/senate-bill-seeks-standards-cars-defenses-h...

Google Calls Proposed U.S. Wassenaar Rules 'Not Feasible' | Threatpost | The first stop for security news
https://threatpost.com/google-calls-proposed-u-s-wassenaar-rules-not-fea...

Hacking Team RCSAndroid Spying Tool Listens to Calls; Roots Devices to Get In
http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-...

SSD Advisory - Trend Micro Threat Intelligence Manager Multiple Vulnerabilities Remote Code Execution | SecuriTeam Blogs
https://blogs.securiteam.com/index.php/archives/2502

Hacking Team apparently violated EU rules in sale of spyware to Russian agency | Ars Technica
http://arstechnica.com/tech-policy/2015/07/hacking-teams-surveillance-so...

Hacking Team Says It Always Sold 'Strictly Within the Law' | Threatpost | The first stop for security news
https://threatpost.com/hacking-team-claims-it-always-sold-strictly-withi...

Netragard Shutters Controversial Exploit Acquisition Program | Threatpost | The first stop for security news
https://threatpost.com/netragard-shutters-controversial-exploit-acquisit...

Researcher angry after finding his code in Hacking Team malware | Ars Technica
http://arstechnica.com/security/2015/07/researcher-takes-umbrage-after-f...

Obama administration decides not to blame China publicly for OPM hack | Ars Technica
http://arstechnica.com/tech-policy/2015/07/obama-administration-decides-...

Four men reportedly arrested in connection to JPMorgan Chase hack | Ars Technica
http://arstechnica.com/tech-policy/2015/07/4-men-reportedly-arrested-in-...

UK man accused of hacking spree on US government is arrested (again) | Ars Technica
http://arstechnica.com/security/2015/07/uk-man-accused-of-hacking-spree-...

Experian Hit With Class Action Over ID Theft Service - Krebs on Security
http://krebsonsecurity.com/2015/07/experian-hit-with-class-action-over-i...

Hacking Team's evil Android app had code to bypass Google Play screening | Ars Technica
http://arstechnica.com/security/2015/07/hackingteams-evil-android-app-ha...

Dozens of phone apps with 300M downloads vulnerable to password cracking | Ars Technica
http://arstechnica.com/security/2015/07/dozens-of-phone-apps-with-300m-d...

New Campaign Targeting Japanese with Hacking Team Zero Day | Threatpost | The first stop for security news
https://threatpost.com/new-campaign-targeting-japanese-with-hackingteam-...

Free Tool Looks for HackingTeam Malware | Threatpost | The first stop for security news
https://threatpost.com/free-tool-looks-for-hackingteam-malware/113850

OpenDNS BGP Stream Twitter Feed | Threatpost | The first stop for security news
https://threatpost.com/bgp-security-alerts-coming-to-twitter/113843

Bug in widely used OpenSSH opens servers to password cracking | Ars Technica
http://arstechnica.com/security/2015/07/bug-in-widely-used-openssh-opens...

Google Patches 43 Bugs in Chrome | Threatpost | The first stop for security news
https://threatpost.com/google-patches-43-bugs-in-chrome/113892

Bug in latest version of OS X gives attackers unfettered root privileges | Ars Technica
http://arstechnica.com/security/2015/07/bug-in-latest-version-of-os-x-gi...

Microsoft Issues Critical, Out-of-Band Patch for All Versions of Windows | Threatpost | The first stop for security news
https://threatpost.com/microsoft-issues-critical-out-of-band-patch-for-a...

RedStar OS Watermarking - Insinuator
http://www.insinuator.net/2015/07/redstar-os-watermarking/

Secure Collaboration + Content Management | Intralinks
https://www.intralinks.com/

Risky Business #375 -- Ashley Madison, Jeep hacks drive news agenda

0:00 / 57:22

Risky Business Podcast

July 16, 2015

Risky Business #374 -- Anti-Flash sentiment sweeps the globe

Presented by

Patrick Gray

CEO and Publisher

Adam Boileau

Technology Editor

On this week's show we'll be checking in with Richard Forno on the fallout from the OPM breach. Richard has been kicking around in DC infosec circles for a long time now and he let's us know what the mood is like inside the beltway.

In this week's sponsor interview we chat with Chris Gatford of HackLabs! HackLabs is an Australia-based pentesting and consulting firm and we're speaking to Chris about the changing nature of security consultancies.

Adam Boileau, as usual, joins the show to discuss the week's news, which has been dominated by calls for the axing of the Flash plugin and the continued fallout from the Hacking Team breach.

Don't forget you can now support the Risky Business page via our Patreon campaign.

Oh, and do add Patrick and Adam on Twitter if that's your thing.

Show notes

Flash. Must. Die. | WIRED
http://www.wired.com/2015/07/adobe-flash-player-die/

Microsoft nixes A-V updates for XP, exposes 180 MEEELLION luddites \u2022 The Register
http://www.theregister.co.uk/2015/07/15/xp_antimalware_support_axed/

Ubuntu PC maker System76 abandons Flash, says it's too dangerous | Ars Technica
http://arstechnica.com/information-technology/2015/07/ubuntu-pc-maker-sy...

Firefox blacklists Flash player due to unpatched 0-day vulnerabilities | Ars Technica
http://arstechnica.com/security/2015/07/firefox-blacklists-flash-player-...

Adobe: We REALLY are taking Flash security seriously - honest \u2022 The Register
http://www.theregister.co.uk/2015/07/14/adobe_response_to_security_holes/

Once again, Adobe releases emergency Flash patch for Hacking Team 0-days | Ars Technica
http://arstechnica.com/security/2015/07/once-again-adobe-releases-emerge...

Hacking Team's Flash 0-day: Potent enough to infect actual Chrome user | Ars Technica
http://arstechnica.com/security/2015/07/hacking-teams-flash-0day-potent-...

Hacking Team Used Spammer Tricks to Resurrect Spy Network - Krebs on Security
http://krebsonsecurity.com/2015/07/hacking-team-used-spammer-tricks-to-r...

Hacking Team spyware rootkit: Even a new HARD DRIVE wouldn't get rid of it \u2022 The Register
http://www.theregister.co.uk/2015/07/14/hacking_team_stealth_rootkit/

How a Russian hacker made $45,000 selling a 0-day Flash exploit to Hacking Team | Ars Technica
http://arstechnica.com/security/2015/07/how-a-russian-hacker-made-45000-...

Hacking Team's snoopware 'spied on anti-communist activists in Vietnam' \u2022 The Register
http://www.theregister.co.uk/2015/07/13/hacking_team_vietnam_apt/

Hacking Team touts new spyware suite, calls leaks now "obsolete" | Ars Technica
http://arstechnica.com/security/2015/07/hacking-team-remains-defiant-tou...

Critical OpenSSL bug allows attackers to impersonate any trusted server | Ars Technica
http://arstechnica.com/security/2015/07/critical-openssl-bug-allows-atta...

Dozens Nabbed in Takedown of Cybercrime Forum Darkode | WIRED
http://www.wired.com/2015/07/dozens-nabbed-takedown-cybercrime-forum-dar...

As Predicted, OPM Director Resigns in Wake of Epic Hack | WIRED
http://www.wired.com/2015/07/predicted-opm-director-katherine-archuleta-...

New Bill Would Grant Lifetime Credit Monitoring to OPM Victims | Threatpost | The first stop for security news
https://threatpost.com/new-bill-would-grant-lifetime-credit-monitoring-t...

A $200 privacy device has been killed, and no one knows why | Ars Technica
http://arstechnica.com/security/2015/07/a-200-privacy-device-has-been-ki...

ProxyGambit - anonymize net over GSM or PTP link
http://samy.pl/proxygambit/

Sixty-five THOUSAND Range Rovers recalled over DOOR software glitch \u2022 The Register
http://www.theregister.co.uk/2015/07/14/range_rover_recall/

Hackers sell 79,267 Cloudminr accounts for ONE Bitcoin \u2022 The Register
http://www.theregister.co.uk/2015/07/14/cloudminr_hack_80000_bitcoin_min...

DEA agent slugged a MEELLION dollars for Silk Road snipe \u2022 The Register
http://www.theregister.co.uk/2015/07/13/silkroad_dea_agent_outofpocket_b...

Papa don't breach: Wannabe singer jailed for hacking Madonna \u2022 The Register
http://www.theregister.co.uk/2015/07/10/madonna_hacker_sentencing/

Wow, another NSA leak: Network security code appears on GitHub \u2022 The Register
http://www.theregister.co.uk/2015/07/09/nsa_network_security_code_leaks_...

New RC4 Attack Dramatically Reduces Plaintext Recovery Time | Threatpost | The first stop for security news
https://threatpost.com/new-rc4-attack-dramatically-reduces-plaintext-rec...

Oracle Patches Java Zero Day | Threatpost | The first stop for security news
https://threatpost.com/oracle-patches-java-zero-day/113792

New PHP Releases Fix BACRONYM MySQL Flaw | Threatpost | The first stop for security news
https://threatpost.com/new-php-releases-fix-bacronym-mysql-flaw/113740

Firefox 39 Out With Patches for Four Critical Vulnerabilities | Threatpost | The first stop for security news
https://threatpost.com/firefox-39-out-with-patches-for-four-critical-vul...

MS kills critical IE 11 bug after exploit was shopped to Hacking Team | Ars Technica
http://arstechnica.com/security/2015/07/ms-kills-critical-ie-11-bug-afte...

Microsoft Security Bulletin MS15-058 - Important
https://technet.microsoft.com/en-us/library/security/MS15-058

Microsoft Security Bulletin MS15-068 - Critical
https://technet.microsoft.com/en-us/library/security/ms15-068.aspx

Microsoft Security Bulletin MS15-067 - Critical
https://technet.microsoft.com/en-us/library/security/ms15-067.aspx

Job search | Employment and jobs | Queensland Government
https://smartjobs.qld.gov.au/jobtools/jncustomsearch.viewFullSingle?in_o...

[ - infowarrior.org - ]
http://infowarrior.org/about.html

Penetration Testing & Web Application Security - HackLabs
http://www.hacklabs.com/

Screaming Headless Torsos (Live in New York -- Knitting Factory 1996) - YouTube
https://www.youtube.com/watch?v=FAKhafsFslE

Screaming Headless Torsos - 2 Bruce Wayne featuring Jimmy Valentine - YouTube
https://www.youtube.com/watch?v=Pzdd2mUiDF0

Risky Business #374 -- Anti-Flash sentiment sweeps the globe

0:00 / 55:38