TechSNAP S01E125 · Security by Mediocrity

Overview

DNS Hijacking takes down the New York Times, Twitter, and more. We’ll explain what happened. Plus researchers bypass Dropbox’s authentication, a big batch of your questions our answers, and much much more! On this week’s TechSNAP.

Torrents

Subtitles

Episodes

1. 1 1. Dropbox Flaws2011-04-18Get the full details are two major issues with Dropbox, that are simply built into the core of the software/service.
2. 2 2. The Cloud Fails2011-04-25Reality rained on Amazon’s Cloud recently as aspects of their EC2 hosting service suffered major outages. We look at the many issues facing cloud computing. Plus we dig into the iP
3. 3 3. PSN Breech Details2011-05-02We cover the amazing details of the Playstation Network breech, we share some of the most interesting details in this episode.
4. 4 4. A Simple Mistake2011-05-09
5. 5 5. Allan Goes to War2011-05-16We’ll cover the dirty details of a Facebook flaw that exposes your private account info to snoops, look into the privacy issues around “Smart Meters” and discuss a few big tech riv
6. 6 6. Backups & Server Hardware2011-05-23Every six hours the NSA collects as much data that exists in the entire lib of congress and we have a few practical notes on how a system like that could even function. We follow u
7. 7 7. Let’s Go Phishing2011-05-27There have been 10 separate attacks against Sony, the details are like nothing we’ve ever seen before.
8. 8 8. Hijacking the News2011-06-02Google has confirmed that 100s of Gmail accounts were being snooped on, and the targets of this attack are not happy! The cookie catastrophe in the UK continues, we’ll share the br
9. 9 9. Bitcoin Explained2011-06-10We’ll dig into bitcoin and explain what it is, and how it works. Is there a future for this Cryptocurrency? Plus Sony is in the news again, and its not good... And we talk about a
10. 10 10. Encryption Best Practices2011-06-17We follow up on last week’s bitcoin coverage with scandal that has a $500k price tag.
11. 11 11. Perfect Passwords2011-06-24We’ve got the details of an FBI raid that knocked several popular sites off-line. The WordPress plugin repository was compromised, and backdoors were added to a few popular plugins
12. 12 12. Leaky Authentication2011-07-01How many times have your credentials been leaked online? Think your safe? Chris thought he was. In today’s episode he’ll find out how many times his information has been leaked onl
13. 13 13. Cyber Warfare2011-07-08We cover what critical targets hackers and foreign governments might target to wage Cyber Warfare. Plus what major attacks have already taken place.
14. 14 14. Phreaking 3G2011-07-14We’ll cover a story that really drives home how serious cell phone hijacking has gotten, and what new technology just made it a lot easier for the bad guys.
15. 15 15. Classified Cloud2011-07-22
16. 16 16. Battery Malware2011-07-29Attackers take aim at Apple with an exploit that could brick your Macbook, or perhaps worse. Plus you need to patch against a 9 year old SSL flaw.
17. 17 17. Google Server Secrets2011-08-05Find out what consumer storage device is shipping with an encryption backdoor, and we share details about Google’s super secret million servers strong infrastructure.
18. 18 18. DEFCON Brings the Scary2011-08-12
19. 19 19. Planning for Failures2011-08-18The RSA leak exposes the dirty under-belly of the commercial security industry, it’s a story that sounds like it’s straight out of Hollywood. Then – We’ve packed this episode full
20. 20 20. Keeping it Up2011-08-25
21. 21 21. Smarter Google DNS2011-09-02Google and openDNS join forces to improve the speed of your downloads, find out what they are doing and how it works! Plus gmail suffered another man in the middle attack, and Kern
22. 22 22. Rooted Trust2011-09-08Remember the Man in the Middle attack on google from last week? Turns out it was far worse than though, we now have more details on the DigiNotar compromise, and a number of other
23. 23 23. Ultimate Home Router2011-09-15Exploits are in the wild that can take down critical infrastructure equipment, and some highly trusted sites were attacked this week and used against their own visitors.
24. 24 24. Ultimate RAID2011-09-15When your data is important, understanding RAID can make the difference between a major loss, or saving the day.
25. 25 25. Ultimate File Server2011-09-29
26. 26 26. Ultimate Backups2011-10-06We’ll tell you about AT&T leaving Android open to a hack so easy, my two year old son could pull it off.
27. 27 27. Pimp My Network2011-10-13
28. 28 28. Ultimate ZFS Overview2011-10-20Buckle up and prepare for the our Ultimate ZFS overview! Plus, the next generation of Stuxnet is in the wild, but this time is laying low, collecting data.
29. 29 29. Skype Exposes Pirates2011-10-27Researches have developed a way to tie your file sharing to your Skype account.
30. 30 30. Great Disk Famine2011-11-03Anonymous says it’s going after a Mexican Drug Cartel, we’ll share you the amazing details! Plus: Our tips for controlling remote downloads, and why all I’m going to want for Chris
31. 31 31. How Malware Makes Money2011-11-10The FBI shuts down a cyber crime syndicate, and we’ll tell you just how much profit they were bring in.
32. 32 32. STOP SOPA2011-11-17The Internet is facing its greatest challenge yet, we explain why the fight against online piracy has taken a turn towards Internet censorship.
33. 33 33. Stuffed War Stories2011-11-24Microsoft’s flawed code signing infrastructure puts your machine at risk, find out how.
34. 34 34. Allan’s ZFS Server Build2011-12-01
35. 35 35. Two Factor Fail2011-12-08Find out how some simple Social Engineering skills can earn you $45k, a drug cartel’s private cell network.
36. 36 36. Simulated Cyber War2011-12-15Find out how the 2012 Olympics are preparing for cyper war, we’ll answer a great batch of questions.
37. 37 37. Future SSL2011-12-22Find out what major infrastructure software uses the admin password of “100”, plus future improvements to SSL, how the CIA keeps their IT guys trustworthy, and… An epic tech war st
38. 38 38. Unsafe Wifi2011-12-29A major implementation flaw in protected Wifi has been found, we’ll share the amazing details.
39. 39 39. NGINX vs Apache2012-01-05How NGINX stacks up to Apache, and which server is right for the job! PLUS: The EFF has raised a red flag over the new version of AOL’s instant messenger we’ll share the details on
40. 40 40. SQL Injections2012-01-12We’ll explain how SQL Injections work, plus cover tools you can use to passively discover details about everyone connected to your network. And Adobe blames some researches for THE
41. 41 41. Cyber Bank Heist2012-01-19Find out how hackers robbed a bank for nearly $6 million dollars over the Internet, the Zappos security breach, the fall of the koobface botnet, and what happened to Megaupload. Pl
42. 42 42. Answers for Everyone2012-01-26
43. 43 43. DHCP Attacks2012-02-02Find out how a simple system update brought DreamHost down for nearly two days, and how the MS Updater Trojan works.
44. 44 44. Server Room Fire2012-02-09It’s a worst case scenario, when a server room catches fire in this week’s war story! Plus: We’ll share a story that might make you re-think taking advantage of your hard drive war
45. 45 45. First Day Fail2012-02-16A first day on tech job war story, that’s as rough as they get! Plus details on recent doubt researchers have cast around the fundamental security technology behind SSL.
46. 46 46. Email Constipation2012-02-23We answer the question: What to do when your email server gets blocked, and why it keeps happening. PLUS: GSM phones are vulnerable to a simple tracking attack, all you need is som
47. 47 47. NASA Hacked 5,400 Times?2012-03-01
48. 48 48. Federal Bureau of Lulz2012-03-08We cover the amazing story of how the FBI infiltrated and exposed LulzSec. And in a retro war story, Microsoft miss more than just a leap day and we answer some of your feedback qu
49. 49 49. Amazon’s Secrets2012-03-15Microsoft has released an extremely critical patch, the race against hackers has begun. We’ll give you the details on this important update. Secrets about Amazon’s EC2 back-end hav
50. 50 50. Exploits for Sale2012-03-22Does your government use taxpayer money to buy exploits from the open market? We’ll share the details, malware is being spread via Skype, and we’ve got great news for VLC users! An
51. 51 51. Global Blackout a Hoax2012-03-29Microsoft leads raids on the Zeus botnet and seizes their servers, Duqu still evolving and new details have been revealed.
52. 52 52. Extreme WiFi Makeover2012-04-05Find out what happens when the Internet Engineering Task Force is faced with unreliable hotel WiFi And we’ve got the details on backdoor built into AT&T’s Microcell’s back door. Ye
53. 53 53. Geek’s Natural Habitat2012-04-12Software powering many of the devices we use has a critical flaw that can give an attacker root access, we’ll give you the details.
54. 54 54. Exaggerated Cybercrime2012-04-19We bust some Cybercrime propaganda, give you the scoop on a fresh openSSL vulnerability, and answer a common audience question.
55. 55 55. Obscurity is not Security2012-04-26
56. 56 56. Learning to Hack2012-05-03In Barnes and Noble attempt to censor a magazine article about hacking, that have propelled it into the spotlight. We’ve got the details on this great write up! PLUS: Moving big fi
57. 57 57. Sage IT Wisdom2012-05-10Apple’s latest version of OS X has a major bug that can store your passwords in clear text, an 8 year old vulnerability has been found in PHP, and why the DHS is hoping for attacks
58. 58 58. No Pay? No Patch!2012-05-17Adobe tells customers to upgrade to get the latest security fixes, Kickstarter has an embarrassing security lapse. PLUS: Self-destructing SSDs, and Mirroring vs a CDN, what’s the d
59. 59 59. Man In the Browser Attack2012-05-24Yahoo has made a mistake so big, you have to hear it to believe it. A common feature in firewalls could actually make you more susceptible attack, Blizzard huge security blunder. P
60. 60 60. Feedback Blowout #12012-05-31Software that’s supposed to get you around censorship, could be logging your activities online, plus we’ve got a classic Social Engineering story for you. And then we clear the dec
61. 61 61. I Know Your Password2012-06-07It’s a simple thing but everyone keeps messing it up, bad password storage practices many popular sites had their password databases leaked online this week, we’ve got the details!
62. 62 62. Bypassing Authentication2012-06-14A MySQL flaw so awful, I simply had to laugh. And how a simple SSH config mistake, lead to a really bad day. Plus we answer some great audience questions, all that and much more on
63. 63 63. Peek Inside2012-06-21
64. 64 64. Token Security2012-06-28How attackers can defeat an RSA token in as little as 15 minutes, FBI has taken down an online fraud ring, we’ve got the details. And a botched software update that shutdown a bank
65. 65 65. Faster GPU Cracking2012-07-05Everyone’s beloved password cracker has had a major update, and you won’t believe what it can do now! The Aerospace industry has a new Advanced Persistent Threat, and a major Micro
66. 66 66. Network Benchmarking2012-07-12Our tools to benchmark and monitor your network.
67. 67 67. Single Point of Failure2012-07-19Find out how an entire cities infrastructure depended on a single building, and what happened when it exploded. Plus the technical details on Android’s security upgrade, the Apple
68. 68 68. Failure Cascade2012-07-26The failure of Google Talk takes down several other Google services including GMail and then as a result even Twitter, we got the details. Plus how to determine if your WordPress s
69. 69 69. Most VPNs Insecure2012-08-02We’ll cover how the most common type of VPN has been cracked wide open. Plus what to look for when renting a server, and what’s involved in managing a dedicated box.
70. 70 70. Not So Secret Answers2012-08-09A Gawker Reporter’s entire online presence is hacked, and all his devices wiped. We’ll walk you through the details of this attack, and why it suggests we might be facing some fund
71. 71 71. Server Puppeteering2012-08-16Rumor has it the playstation network has been hacked again, but we’ve got the real story. Blizzard suffered a nasty database breach, and it might be much worse then they are lettin
72. 72 72. Not so Private Keys2012-08-23How a Man in the Browser attack could expose an airport VPN, RuggedCom’s messed up the very fundamentals again, and the big update from Adobe. Plus – Running Linux in a FreeBSD Jai
73. 73 73. Double 0-Java2012-08-30This week we’ll tell you the story about Agent Double 0-Java, the exploit with a license to kill. Plus Google’s creative solution to securing user content. Then it’s a big batch of
74. 74 74. Donated Privacy2012-09-06
75. 75 75. The Human Factor2012-09-13It was a tough week for the cloud, we’ll run down the list and summarize what happened to the services we all depend on so much! Plus a big batch of your questions, our answers, an
76. 76 76. Self Healing Internet2012-09-20The story about an antivirus that detects itself, IE’s awful zero day exploits, and the Internets amazing ability to route around problems.
77. 77 77. Password SecuritIEEE2012-09-27A big password leak from a major industry player, mobile security takes a big hit, we cover a couple of the major vulnerabilities affecting our favorite gadgets, and more Java trou
78. 78 78. Wire-Shark2012-10-04We’ve got the details on a critical flaw in the chip and pin credit card system. The future of secure hashing, doing proper backups with rsync, and how squirrels and sharks take do
79. 79 79. Don’t Copy That Floppy2012-10-11How a Russian Spy ring used floppies to pass sensitive information, how Backblaze made it through the great hard drive shortage, and why the US congress is saying no to Chinese Tel
80. 80 80. Best Tool for the Job2012-10-17
81. 81 81. Breaking DKM2012-10-25How an aviation blogger unlocked the secrets of the TSA’s barcode, if you’re a Barnes and Noble shopper we’ve got a story you need to hear, and a serious bug in the Linux Kernel. P
82. 82 82. /var/water/logged2012-11-01
83. 83 83. Security by the Horns2012-11-08How a hardware failure in Indonesia took Google down in California, stealing Crypto keys from virtual machines, and the trouble with Sophos. And an inside look at how Netflix crams
84. 84 84. Patch Your Password2012-11-15Allan will build the case for abandoning the password, the Skype flaw that will shock you, And we discuss picking the right server OS, when to RAID or not to RAID, and a BIG batch
85. 85 85. Tales from the BCrypt2012-11-22How Allan saved PayPal from an embarrassing leak and a bunch of cash, details on the FreeBSD project’s compromise, and the latest advances in password hashing.
86. 86 86. Cat Got Your Router2012-11-29The amazing Internet speed record set by researches recently, the backdoor built into Samsung’s networked printers, and a clever attack against home routers.
87. 87 87. MySQL or Yours?2012-12-06MySQL had a bad week, we’ll run down the list of the recently disclosed vulnerabilities, the SSH server that allows an attacker full root access, and a GPU password cracking monste
88. 88 88. 2-Factor Trojan2012-12-13A trojan that targets your PC and phone to drain your bank account, a powerful 0day exploit against your SmartTV, and a new approach to GPS spoofing. Plus we answer batch of your q
89. 89 89. WordPress LAN Recon2012-12-20
90. 90 90. SSH FUD Busting2012-12-27We bust the FUD around the media’s overreaction to SSH Key mismanagement, plus the details on millions of WordPress databases exposed by a popular plugin.
91. 91 91. Saving Private Exploit2013-01-03Internet Explorer, Ruby on Rails, and the Windows Nvidia drivers all have new exploits. We’ll tell you the good, the bad, and the ugly. Plus picking the right VPS, a big batch of y
92. 92 92. Hiding in the Silence2013-01-10A zero day vulnerability takes down some major wikis, how Polish researchers hide secret messages in Skype’s silence.
93. 93 93. Red October Hunts You2013-01-17If you thought Stuxnet was a big deal, wait till you meet Red October. The incredible story of some of the most sophisticated malware yet surfaces, and we’ve got the details.
94. 94 94. Barricade Your Barracuda2013-01-24If you have a Barracuda device, it’s time to put it behind a real firewall. We’ll blow your minds with the horrible state of security on many popular Barracuda products.
95. 95 95. Universal Exploit n’ Play2013-01-31It’s way past time to turn off Universal Plug and Play, we’ll give you the details on the exploit that only requires a single network packet.
96. 96 96. Snakes in a Bank2013-02-07Using phone tones and a little Python to get access to someone’s bank account, and Oracle steps up with an early patch for Java but it doesn’t fix everything. Then we answer a big
97. 97 97. Battle of the Bots2013-02-14A researcher stumbles into the middle of a botnet war, and documents what he finds. Plus a Facebook mistake took down countless sites around the web.
98. 98 98. Attacking the Devs2013-02-21Facebook and Apple are compromised by the same Java exploit, and the details are quite interesting, Punkbuster service goes offline, taking down online game servers for 100s of use
99. 99 99. How I Met Your SSH2013-02-28cPanel’s helpdesk was recently compromised, exposing root credentials for many of their customers, plus the troubles at Zendesk that caused quite a headache for twitter and other p
100. 100 100. 100% Uptime2013-03-07We’ve warned against it for nearly 100 episodes, this week we’ll share the fallout from NBC.com getting hacked, Bit9’s whitelist technology is use against them and their customers.
101. 101 101. GIF me root2013-03-14We’ll explain the MiniDuke malware and the extremely clever way to slipped it’s way into victims systems. Researchers discovered a way to bypass google two-factor authentication, w
102. 102 102. Packets Over 90,0002013-03-21A CloudFlare outage takes down three quarter of a million sites, we’ll tell you what went wrong. Some old school malware gets the job done, Allan’s cool toys from Japan, a big batc
103. 103 103. Time to Git ZFS2013-03-28Is your bucket exposed to the public? A security researcher has recently discovered many S3 buckets are publicly available, we’ll share the details.
104. 104 104. Amplifying the Hype2013-04-04It’s been called the largest DDoS attack in history, we’ll bust past the hype and explain how a DNS Reflection attack works.
105. 105 105. FTP Treasure Trove2013-04-11A treasure trove of data was found on an open FTP site, leaving AMI BIOS users open to attack. Plus a look at PunkSPIDER, a batch of your questions, and so much more! On this week’
106. 106 106. Evil DNS is Evil2013-04-1813 of the most popular home routes are wide open to attack, is your’s one of them? Tune in to find out.
107. 107 107. Dedupe Gone Wrong2013-04-25Oracle patches 128 vulnerabilities, you won’t believe how many of them are critical. Plus how twitter can solve their hacking problem, ZFS questions galore, and much much more! On
108. 108 108. Intelligent Malware2013-05-02
109. 109 109. Packet Tells A Lot2013-05-09
110. 110 110. Jails vs VMs2013-05-16A security breach become a lesson for us all. We’ll make some lemonade from a bad situation, and arm you with what you need to protect your self. Plus Demonoid users get phished, a
111. 111 111. BSDCan 2013 Recap2013-05-23Researchers find exploits for popular game engines, putting both clients and servers at risk, we’ll share the details.
112. 112 112. Making the Onion Cry2013-05-30In an ironic twist of fate, the Onion suffers an embarrassing compromising, that appears to match a new pattern of attack. We’ve got the details.
113. 113 113. Phishin’ Hole2013-06-06
114. 114 114. Preparing for Orwell’s Internet2013-06-13We’ve got a bunch of options to protect your privacy online, things to consider before you self host. Plus: With a little planning ahead, you can protect yourself from compelled di
115. 115 115. What’s in Your Cache2013-06-20
116. 116 116. HP’s Backdoor2013-06-27Opera’s code signing certificate gets compromised, resulting in malware getting push out via their automatic update system. Plus the backdoor that ships in some high-end HP product
117. 117 117. Who Watches the Monitors2013-07-04Extending your office LAN for remote office workers, monitoring the monitoring service, and Zynga’s embarrassing Apache error.
118. 118 118. Phish and Chips2013-07-11We’ll cover Dropbox’s two-factor authentication flaw, how “Team Telecom” forced fibre providers to enable surveillance, the FBI’s warning about phishing attacks.
119. 119 119. Exploit Brokers2013-07-18The business of selling 0day exploits is booming, we’ll explain how this shady market works, and how a couple guys turned a Verizon Network Extender into a spy listening post.
120. 120 120. Ethically Hacked2013-07-25
121. 121 121. Grand Theft BGP2013-08-01A BGP hack reroutes the traffic of banks, Amazon and many others. We’ll explain how this can happen, and why we don’t see it more often.
122. 122 122. Cost of Encryption2013-08-08
123. 123 123. Encryption Prediction2013-08-15
124. 124 124. Little Fish Big Breach2013-08-22
125. 125 125. Security by Mediocrity2013-08-29DNS Hijacking takes down the New York Times, Twitter, and more. We’ll explain what happened. Plus researchers bypass Dropbox’s authentication, a big batch of your questions our ans
126. 126 126. Random Access Fires2013-09-05RAM Prices are getting hot, we’ll tell you why. Plus the router flaw you need to know about, a pfSense disaster, your questions our answers, and much much more.
127. 127 127. NSA SSLeaze2013-09-13A mobile provider is hacked, customer records are breached, and the authorities suspect it was an inside job, we’ll share the details.