3 Security Buddies

Paul Kehrer, Robert Clark, Matias Brutti

Weekly podcast where three security buddies discuss security topics.

الحلقات

  1. 3SB-8: Password Complexity

    ٢٤‏/٠٦‏/٢٠٢١

    3SB-8: Password Complexity

    Follow up: No follow ups Topics: NIST changing password requirementsRoundtable how we got into security + suggestions Paul Rant: Paul is on vacation. No Rants.   Links: https://pages.nist.gov/800-63-3/sp800-63b.html https://www.ncsc.gov.uk/blog-post/let-them-paste-passwords  Hosts: Paul Kehrer @reaperhulk Robert Clark @hyakuhei Matías Brutti @MrBrutti Special Guest: Travis McPeak @travismcpeak  Post-Production: Matias Brutti @MrBrutti Disclaimer: The opinions and security statements on this podcast are our own and do not represent that of our respective past, current or future employers.

    ١ س
  2. 3SB-7: 🍎 Security Worms

    ١٦‏/٠٦‏/٢٠٢١

    3SB-7: 🍎 Security Worms

    Follow up: US is elevating ransomware the same level of terrorism. Topics: Apple Security WWDCMove beyond passwords ( iCloud Keychain WebAuthN keys ) Discover account-driven User EnrollmentSecure login with iCloud Keychain verification codes ( domain-binding apple-totp )Polkit PrivEscGrowing abuse of Kubernetes (it’s not containers)  Paul Rant: Apple Bug Report blackhole   Links: https://www.reuters.com/technology/exclusive-us-give-ransomware-hacks-similar-priority-terrorism-official-says-2021-06-03/ https://threatpost.com/microsoft-cryptomining-kubeflow/166777/https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/  Hosts: Paul Kehrer @reaperhulk Robert Clark @hyakuhei Matías Brutti @MrBrutti Post-Production: Matias Brutti @MrBrutti Disclaimer: The opinions and security statements on this podcast are our own and do not represent that of our respective past, current or future employers.

    ١ س ٢٨ د
  3. 3SB-6: Dependency Hell

    ٠٩‏/٠٦‏/٢٠٢١

    3SB-6: Dependency Hell

    Follow up:  - Nothing this week Topics: Automated Fuzzing Testing in GoStack Overflow Supply Chain AttacksDeps.devUpdate on Github’s policies regarding exploits, malware, and vulnerability researchPaul Rant: Pinning dependencies on Libraries  Links: https://blog.golang.com/fuzz-betahttps://www.wsj.com/articles/software-developer-community-stack-overflow-sold-to-tech-giant-prosus-for-1-8-billion-11622648400https://deps.devhttps://github.blog/2021-06-04-updates-to-our-policies-regarding-exploits-malware-and-vulnerability-research/ Hosts: Paul Kehrer @reaperhulk Robert Clark @hyakuhei Matías Brutti @MrBrutti Post-Production: Matias Brutti @MrBrutti Disclaimer: The opinions and security statements on this podcast are our own and do not represent that of our respective past, current or future employers.

    ٥٥ د
  4. 3SB-5: Hardware Apocalypses

    ٠٣‏/٠٦‏/٢٠٢١

    3SB-5: Hardware Apocalypses

    Follow up: Vaxxed || Mask Rant UpdateWhatsApp will not be removing functionality. Topics: OpenSSL RustificationData without context is useless AMD attacks on Virtual Machine Protection System.M1ssing Register Access Controls Leak EL0 State Paul Rant: QC35 switch is garbage. GARBAGE! Links: https://therecord.media/two-attacks-disclosed-against-amds-sev-virtual-machine-protection-system/https://m1racles.com Hosts: Paul Kehrer @reaperhulk Robert Clark @hyakuhei Matías Brutti @MrBrutti Post-Production: Matias Brutti @MrBrutti Disclaimer: The opinions and security statements on this podcast are our own and do not represent that of our respective past, current or future employers.

    ١ س ٦ د
  5. 3SB-4: EuroCyberVision

    ٢٦‏/٠٥‏/٢٠٢١

    3SB-4: EuroCyberVision

    Episode Follow up: Codecov Mercari Audacity Open Source Telemetry  Topics: WhatsApp: Give me your privacy or I will stop working. Russian Keyboard as a first line of defense  Craig Federighi MacOS vs iOS Security Model  Paul Rant: Vaxxed or Mask. Trust by Verify Rant by Matias Brutti.  Links: https://about.mercari.com/en/press/news/articles/20210521_incident_report/https://github.com/audacity/audacity/discussions/889https://blog.malwarebytes.com/privacy-2/2021/05/whatsapp-calls-and-messages-will-break-unless-you-share-data-with-facebook/https://www.schneier.com/blog/archives/2021/05/adding-a-russian-keyboard-to-protect-against-ransomware.htmlhttps://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/https://9to5mac.com/2021/05/19/craig-federighi-mac-malware-problem/https://www.imore.com/craig-federighi-defends-iphone-security-throwing-mac-under-bus Hosts: Paul Kehrer @reaperhulk Robert Clark @hyakuhei Matías Brutti @MrBrutti Post-Production: Matias Brutti @MrBrutti Disclaimer: The opinions and security statements on this podcast are our own and do not represent that of our respective past, current or future employers.

    ١ س ٦ د
  6. 3SB-3: Zero Trust Cyber

    ١٩‏/٠٥‏/٢٠٢١

    3SB-3: Zero Trust Cyber

    Episode 2 Follow up: CodeCov continues to claim victims. Rapid7 & Twilio.  Topics: Rob’s python adventuresAlfredos mouse micFragAttackCyberBattleSiem Paul Rant: ZeroTrust Executive Order By Robert Links: https://www.rapid7.com/blog/post/2021/05/13/rapid7s-response-to-codecov-incident/ https://www.twilio.com/blog/response-to-the-codecov-vulnerabilityhttps://github.com/ortegaalfredo/mousemic https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/05/fragattack-new-wi-fi-vulnerabilities-that-affect-basically-everything/https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/  Hosts: Paul Kehrer @reaperhulk Robert Clark @hyakuhei Matías Brutti @MrBrutti Post-Production: Matias Brutti @MrBrutti Disclaimer:  The opinions and security statements on this podcast are our own and do not represent that of our respective past, current or future employers.

    ١ س ٨ د
  7. 3SB-2: BlockChain Tuna

    ١١‏/٠٥‏/٢٠٢١

    3SB-2: BlockChain Tuna

    Episode 1 follow up: Signal continues to make the news. This time hacking Privacy  Topics: CocoaPods Trunk: Remote Code Execution found Cosign - container image signing. TBONE hacking Tesla from a drone with zero clicks. SAML XML Injections Tinker Twitter threat on: real & physical occupational hazard for infosec.1Password Secrets Automation Google mandatory MFA Paul’s rant: -blockchain tuna tracking  Links: https://signal.org/blog/the-instagram-ads-you-will-never-see/https://blog.cocoapods.org/CocoaPods-Trunk-RCE/ https://justi.cz/security/2021/04/20/cocoapods-rce.htmlhttps://blog.1password.com/introducing-secrets-automation/https://kunnamon.io/tbone/https://research.nccgroup.com/2021/03/29/saml-xml-injection/https://security.googleblog.com/2021/05/making-internet-more-secure-one-signed.html https://twitter.com/TinkerSec/status/1388107620574171140https://blog.google/technology/safety-security/a-simpler-and-safer-future-without-passwords/ Hosts: Paul Kehrer @reaperhulk Robert Clark @hyakuhei Matías Brutti @MrBrutti Post-Production: Matias Brutti @MrBrutti Disclaimer:  The opinions and security statements on this podcast are our own and do not represent that of our respective past, current or future employers.

    ١ س ٦ د
  8. 3SB-1: A New Beginning

    ٠٤‏/٠٥‏/٢٠٢١

    3SB-1: A New Beginning

    Episode 0 follow up: - Signal legal consequences. Robert was right. Topics: Hypocrite commits Apple AirDrop PII leakZK proof Vuln DisclosureSoftware RAID recovery rant by Paul Links: AirDrop Leak paper (https://www.usenix.org/system/files/sec21fall-heinrich.pdf) presented in August at the USENIX Security Symposiumhttps://www.scmagazine.com/home/security-news/vulnerabilities/darpa-is-creating-zero-knowledge-proofs-for-vulnerability-disclosure/ Disclaimer:  The opinions and security statements on this podcast are our own and do not represent that of our respective past, current or future employers.

    ٤٧ د
  • ٨ حلقة

التقييمات والمراجعات

٥
من ٥
‫٦ من التقييمات‬

حول

Weekly podcast where three security buddies discuss security topics.

المعلومات

  • صناع العمل
    Paul Kehrer, Robert Clark, Matias Brutti
  • سنوات النشاط
    ٢٠٢١
  • الحلقات
    ٨
  • التقييم
    فاضح
  • حقوق النشر
    © All rights reserved.
  • موقع البرنامج على الويب
    3 Security Buddies