Paul's Security WeeklySubscribe

Bypassing Biometrics, Hiding in Plain Sight, Hacker Cinema, & High Aspirations – PSW #720

In the Security News for this week: Stop hiding your secrets in plain sight, Detecting Wildcard DNS Abuse, $5 setup that hacks biometrics, Managing passwords with pen and paper, Windows 10 Zero Days, & why The Matrix (might be) the best hacker movie!

Full episode and show notes

Announcements

  • Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.

Hosts

Principal Security Researcher at Eclypsium
  1. 1. Don’t Hide Your Secrets in Plain Sight
    Pretty good write-up of some of the ways in which to store and access secrets in AWS.
  2. 2. VirusTotal Introduces ‘Collections’ to Simplify IoC Sharing
    Pretty neat addition to the platform: "Collections...are live reports that contain, alongside a title and an optional description, a group of IoCs such as domain addresses, file hashes, IPs, and URLs, which can be enhanced with VirusTotal analysis metadata."
  3. 3. How Decryption of Network Traffic Can Improve Security
    Agree or Disagree? - "Today, it’s nearly impossible to tell the good from the bad without the ability to decrypt traffic securely."
  4. 4. Play Your Cards Right: Detecting Wildcard DNS Abuse
  5. 5. Printing Shellz: Critical bugs impacting 150 HP printer models patched
    This is so interesting: "while the scanner board communicates with the communication board using normal network, the printer board seems to use CAN bus to interact with the formatter, making the architecture of this MFP somewhat similar to vehicles" Shodan is proof some people don't do this: "Secondly, since an attacker in the same network segment can exploit the vulnerability by communicating directly to JetDirect TCP/IP port 9100, it is recommended to place the printers into a separate, firewalled VLAN" Full research (A GREAT read): https://labs.f-secure.com/assets/BlogFiles/Printing-Shellz.pdf
  6. 6. SmartNICs set to infiltrate enterprise networks
  7. 7. How Red Canary and Microsoft can help reduce your alert fatigue – Microsoft Security Blog
  8. 8. Zoom Launches Auto-Update Feature For Windows And Mac Clients
    Have to give Zoom some credit here: "Their most recent step in this regard has been the launch of end-to-end encryption followed by two-factor authentication." and now they have automatic updates. Though does not appear to support Linux clients for me and the other person using the Linux client.
  9. 9. Multiple Vulnerabilities Spotted In Zoom Video Conferencing App
    Oh and they fixed a couple of vulnerabilities: "Following the report from the researcher, Zoom patched both the vulnerabilities with the latest releases. Users can take a look at the list of affected products shared in Zoom’s advisory to know about the security status of their apps. Whereas it’s ideal to ensure still updating the respective Zoom apps to the latest releases to receive any patches anyway."
  10. 10. Hacking Fingerprints With a $5 Setup To Bypass Biometric Authentication
    Awesome: "For our final step, we add some wood glue on top of the print to bring to life a fake fingerprint that we can use on a scanner."
  11. 11. Organizations Now Have an Average 76 Security Tools to Manage
  12. 12. Attackers exploiting Windows Installer vulnerability despite patching
  13. 13. Thousands of AT&T customers in the US infected by new data-stealing malware
  14. 14. Despite the popularity of password managers, many still use pen and paper – Help Net Security
  15. 15. Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution
  16. 16. Insulet OmniPod Insulin Management System vulnerability
  17. 17. New Windows 10 zero-day gives admin rights, gets unofficial patch
  18. 18. This stealthy malware hides behind an impossible date
  19. 19. ‘The Matrix’ Is the Best Hacker Movie
  20. 20. “High” aspirations: 5 cannabis jobs you never knew existed
  21. 21. Perv dubbed ‘Dr Magic Flute’ claimed he could cure women’s cancer by having sex
Professor at Roger Williams University
Sr. InfoSec Consultant at Online Business Sytems
Security Analyst at Black Hills Information Security
Retired Senior Cyber Advisor at Lawrence Livermore National Laboratory
Director of Offensive Security & Research at Trimarc Security, Founder & CEO at Dark Element

Related

You can skip this ad in 5 seconds